diff --git a/.github/scripts/update-demo-registry-vars.sh b/.github/scripts/update-demo-registry-vars.sh old mode 100644 new mode 100755 diff --git a/README.md b/README.md index 720d3aa39a..7250c65aa6 100644 --- a/README.md +++ b/README.md @@ -1,105 +1,252 @@ -## Архітектурна документація - -### Інструменти для розробки технічної документації проекту - -- [AsciiDoc](https://asciidoc.org/) - мова розмітки з підтримкою структурних та семантичних елементів, яка використовується для формування текстових документів -- [Antora](https://antora.org/) - інструмент структурування текстових AsciiDoc документів за розділами та формування єдиного статичного HTML сайту з технічною документацією на базі _.yml_ плейбука конфігурації - -### Інструменти візуалізації технічних аспектів рішення та діаграм -- [PlantUml](https://plantuml.com/) - інструмент з відкритим кодом, який дозволяє описувати UML діаграми, візуалізовувати JSON та YAML у текстовому вигляді за допомогою власного доменного синтаксису -- [Draw.IO](https://draw.io/) - он-лайн інструмент створення діаграм різних типів з можливостями збереження у SVG форматі с підтримкою подальшого редагування - -### Шаблон типової документації -- [Шаблон опису типового бекенд-сервісу](https://gitbud.epam.com/mdtu-ddm/general/doc-template) - -### Приклади створення PlantUML діаграм -* [Діаграма взаємодії компонентів платформи](/modules/ROOT/partials/infrastructure/ddm-control-plane-components.puml) -* [Діаграма послідовностей по розробці централізованих компонентів платформи та пакету для інсталяції](/modules/ROOT/partials/infrastructure/gitops-main-flow.puml) -* [Діаграма послідовностей встановлення платформи](/modules/ROOT/partials/infrastructure/ddm-platform-install.puml) -* [Діаграма послідовностей створення реэстру за допомогою Control Plane](/modules/ROOT/partials/infrastructure/ddm-registry-creation-details.puml) - -### Офіційна документація інструментів -- [Документація AsciiDoc](https://docs.asciidoctor.org/asciidoc/latest/) -- [Гайд техрайтера AsciiDoc](https://asciidoctor.org/docs/asciidoc-writers-guide/) -- [Документація Antora](https://docs.antora.org/antora/2.0/) - -### Автоматизований процес формування та публікації сайту документації -- [Генерація нової версії сайту технічної документації](https://jenkins-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/view/Documentation/job/ddm-architecture/job/MASTER-Build-ddm-architecture/) -- [Публікація нової версії сайту технічної документації](https://jenkins-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/view/Documentation/job/documentation-cd-pipeline/job/dev/) -- [Остання версія технічної документації](https://ddm-architecture-mdtu-ddm-edp-cicd-documentation-dev.apps.cicd2.mdtu-ddm.projects.epam.com/mdtuddm/dev/bpms/task-distribution.html) - -### Локальне оточення для розробки технічної документації - -Для ведення розробки документації, необхідно встановити: -- [IntelliJ IDEA / JetBrains WebStorm](https://www.jetbrains.com/) - інтегроване середовище розробки -- [AsciiDoc JetBrains плагін](https://plugins.jetbrains.com/plugin/7391-asciidoc) - підтримка синтаксису AsciiDoc та попереднього перегляду в IntelliJ IDEA та WebStorm -- [PlantUML Integration IntelliJ IDEA плагін](https://plugins.jetbrains.com/plugin/7017-plantuml-integration) - плагін для розробки діаграм у текстовому вигляді з використанням PlantUML синтаксису та їх попереднього перегляду -- [Antora](https://docs.antora.org/antora/2.3/install/install-antora/) - генератор статичних HTML сайтів шляхом структурування та трансформації AsciiDoc документів -- (опційно) [Asciidoctor.js Live Preview](https://chrome.google.com/webstore/detail/asciidoctorjs-live-previe/iaalpfgpbocpdfblpnhhgllgbdbchmia) - розширення до браузеру Сhrome для перегляду AsciiDoc документів (файли з розширенням _.adoc_) - -### Встановлення Antora - -Для встановлення Antora та необхідних розширень виконайте у терміналі ([інструкція інсталяції](https://docs.antora.org/antora/2.3/install/install-antora/)): -```bash -npm i -g @antora/cli @antora/site-generator-default asciidoctor-plantuml -``` - -Перевірте коректність встановлення: -```bash -antora -v -``` - -Для надання Antora можливості отримувати доступ до Git репозиторіїв ([інструкція аутентифікації для приватних репозиторіїв](https://docs.antora.org/antora/2.3/playbook/private-repository-auth/)): -```bash -git config --global credential.helper store && \ - echo -n 'Repository URL: ' && read REPLY && \ - git ls-remote -h $REPLY > /dev/null -``` - -Альтернативним шляхом може бути створення файлу сховища токенів доступу Git _$HOME/.git-credentials_ на базі файлу шаблону _.git-credentials.local_ шляхом копіювання та видалення суфіксу _.local_. Наступним кроком має бути генерація HTTP-пароля у Gerrit та додавання -адреси репозиторію до файлу: -```bash -https://:@gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com -``` - -Альтернативою може бути додавання переліку необхідних репозиторіїв у вигляді: -```bash -https://:@gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/ -``` - -### Генерація технічної документації - -> **WARNING**: Локально антора може сберегти кеш. Для запобігання помилок рекомендується запускати усі команди з атрибутом --fetch (eg: ```antora site.yml --fetch```) - -Генерація статичного HTML сайту документації з використанням останних версій розділів з відповідних репозиторіїв: -```bash -antora site.yml -``` - -Генерація статичного HTML сайту документації з використанням локальних копій розділів документації (необхідно створити з файлу _site-template.yml_ файл _site-local.yml_ та відкорегувати шляхи до локальних директорій. _site-local.yml_ знаходиться у _.gitignore_): -```bash -antora site-local.yml -``` - -В обох випадках, сайт технічної документації буде згенеровано у директорію, налаштовану у _.yml_ плейбуці: -```bash -outpout: - dir: ./build/site -``` - -### Перегляд технічної документації - -Для перегляду згенерованої документації на локальному оточенні можно використовувати: -- Браузер, встановлений за замовчуванням, шляхом відкриття файлу _./build/site/index.html_ в IntelliJ IDEA (_File > Open In > Browser > Default_) -- Вбудовані можливості перегляду IntelliJ IDEA (_File > Open In > Browser > Built-in Preview_) - -### Налаштування швидкого запуску процесу генерації документації в IntelliJ IDEA - -Для автоматизації кроку генерації документації, в IntelliJ IDEA можно налаштувати конфігурацію запуску **Shell Script**: -- Викликати з головного меню: _Run > Edit Configurations > Add New Configuration_ -- Вибрати тип конфігурації запуску **Shell Script** -- Вказати ім'я **Name: antora-site** -- Вказати тип скприпта **Execute: Shell Script** -- Вказати скрипт **Script text: antora site-local.yml** - -Як результат, в IntelliJ IDEA з'явиться додаткова конфігурація запуску для генерації технічної документації через Antora **antora-site**, яку можна використовувати у якості швидкого виклику. +# Developing and maintaining technical product documentation + +## Description of tools + +The development of documentation is conducted using the following tools: + +- [AsciiDoc](https://asciidoc.org/) - A markup language supporting structural and semantic elements for creating text documents. +- [PlantUml](https://plantuml.com/) - An open-source tool for describing UML diagrams and visualizing `JSON` and `YAML` in text form. +- [Draw.IO](https://draw.io/) - An online tool for creating various types of diagrams, with the ability to save in `SVG` format. + +For structuring text `AsciiDoc` documents and creating a unified static HTML site, [Antora](https://antora.org/) is used, based on _.yml_ playbook configurations. + +### Official documentation of tools + +- [AsciiDoc Documentation](https://docs.asciidoctor.org/asciidoc/latest/) +- [AsciiDoc Technical Writer's Guide](https://asciidoctor.org/docs/asciidoc-writers-guide/) +- [Antora Documentation](https://docs.antora.org/antora/2.0/) + +### Local environment for developing technical documentation + +Necessary tools for development: +- [IntelliJ IDEA / JetBrains WebStorm](https://www.jetbrains.com/): An integrated development environment. +- [AsciiDoc JetBrains Plugin](https://plugins.jetbrains.com/plugin/7391-asciidoc): A plugin for `AsciiDoc` syntax support. +- [PlantUML Integration](https://plugins.jetbrains.com/plugin/7017-plantuml-integration): For developing diagrams with `PlantUML` syntax. +- [Asciidoctor.js Live Preview](https://chrome.google.com/webstore/detail/asciidoctorjs-live-previe/iaalpfgpbocpdfblpnhhgllgbdbchmia): A **Chrome** extension for viewing `AsciiDoc` documents through a web browser. + +## Viewing technical documentation through IntelliJ IDEA + +IntelliJ IDEA provides several ways for local viewing of technical documentation. Here's how you can utilize these options: + +### Using the built-in AsciiDoc toolbar + +You can use the built-in toolbar above the documentation development window in an open AsciiDoc (`.adoc`) file. Here, you will find options for real-time documentation preview mode: + +1. **Show Editor and Preview**: + - This option lets you see both the code editor and the preview window simultaneously. + - You can edit the documentation in the editor and immediately see the results of these changes in the preview window. + - This is useful for quickly verifying changes, ensuring an efficient editing process. + +2. **Show Preview Only**: + - This mode provides only the preview window without the code editor. + - It's ideal for focusing on the final appearance of the documentation, especially when you need to check the overall format and layout of elements. + - You can easily switch to **Show Editor and Preview** mode if you need to make changes. + +### Viewing options in the top right corner of the development window + +You can also use the viewing options located in the top right corner of the development window: + +1. **Built-In Preview**: + - Opens the built-in preview window directly in the IntelliJ IDEA development environment. + - This is convenient for quick viewing and editing. + +2. **View in external browser**: + - **Chrome**: If Chrome is installed, select this option to open a tab with the documentation in the browser. + - **Firefox**: Similarly, select Firefox for viewing in this browser. + - **Edge**: If you use Edge, choose this option. + +> 💡 **TIP:** You can also open the desired viewing option by pressing the key combination `Alt+F2` > `Preview File in...`. + +These IntelliJ IDEA features allow flexible work with technical documentation, providing various viewing options to meet the needs of developers and technical writers. + +## Building Antora in a local environment + +You can build the overall structure of the documentation using Antora in a local environment. + +### Installing Antora + +> 📝 **NOTE:** Complete installation instructions for Antora can be found at [this link](https://docs.antora.org/antora/latest/install/install-antora/). + +1. Check if Antora is installed: + + ```bash + antora -v + ``` + +2. Install **Node**. + + To check if **Node** is installed and its version, execute the following command: + + ```bash + node --version + ``` + +#### Installing Node on Linux + +- Install Node on Linux using the command: + + ```bash + nvm install --lts + ``` +- See detailed instructions [at this link](https://docs.antora.org/antora/latest/install/linux-requirements/). + + > 💡 **TIP:** Linux users are invited to share their comments and supplement important information missing in this brief guide or the complete documentation. + +#### Installing Node on macOS + +- Install Node on macOS using the command: + + ```bash + nvm install --lts + ``` + +* View detailed instructions [at this link](https://docs.antora.org/antora/latest/install/macos-requirements/). + + > 💡 **TIP:** macOS users are invited to share their comments and supplement important information missing in this brief guide or the complete documentation. + +#### Installing Node on Windows + +For installing Node on Windows, follow these steps: + +1. **Install [Chocolatey](https://chocolatey.org/):** + - Open **PowerShell** as an administrator. + - Execute the command: + + ```powershell + Set-ExecutionPolicy Bypass -Scope Process -Force; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) + ``` + +2. **Install nvm:** + - Use the same **PowerShell** window as an administrator. + - Execute the command: + + ```powershell + choco install -y nvm + ``` + +3. **Install Node:** + - Open a new **PowerShell** window. + - Execute the command: + + ```powershell + nvm install 16.20.2 + ``` + + > 🔑 **IMPORTANT:** Specify the exact version of Node for Windows (e.g., `16.20.2`) if you encounter an issue [nvm-windows#214](https://github.com/coreybutler/nvm-windows/issues/214). + + > 📝 **NOTE:** If Node is not installed after running the `nvm install` command, try installing Node through **Chocolatey** using the command: + > + > ```bash + > choco install nodejs-lts + > ``` + > or + > + > ```bash + > choco install nodejs + > ``` + > + > 💡 **TIP:** Detailed instructions can be found [at this link](https://docs.antora.org/antora/latest/install/windows-requirements/). + > + > Windows users are invited to share their comments and supplement important information missing in this brief guide or the complete documentation. + + +#### Installing Antora globally using `npm` + +1. You can install Antora globally so that the `antora` command is available on your `PATH`. To install Antora globally, pass the `-g` option to `npm i`. + + ```bash + npm i -g @antora/cli@3.1 @antora/site-generator@3.1 + ``` + +2. Verify the antora command is available on your `PATH` by running: + + ```bash + antora -v + ``` + +3. If the installation was successful, the command should report the version of the Antora CLI and site generator. + + ```bash + antora -v + @antora/cli: 3.1.5 + @antora/site-generator: 3.1.5 + ``` + +> 💡 **TIP:** See also: [Installing Antora Locally](https://docs.antora.org/antora/latest/install/install-antora/#install-dir). + +### Granting access for Antora to remote Git repositories + +> 📝 **NOTE:** Complete instructions for accessing private repositories can be found [at this link](https://docs.antora.org/antora/latest/playbook/private-repository-auth/). + +#### Populating the credential store interactively + +To grant Antora access to your source repositories, follow these steps: + +1. Open a terminal and execute the command to configure Git: + + ```bash + git config --global credential.helper store && \ + echo -n 'Repository URL: ' && read REPLY && \ + git ls-remote -h $REPLY > /dev/null + ``` + > 📝 **NOTE:** For `'Repository URL: '`, enter the URL of the Git repository to which you need to grant access. + +2. Repeat these steps for each repository from your Antora playbook. In our example, it's the _site.yml_ file.) + +#### Populating the credential store directly (GitLab example) + +Use personal access tokens to grant access to repositories: + +1. In your GitLab account, open [GitLab personal access token](https://docs.gitlab.com/ee/user/profile/personal_access_tokens.html) and create a token with `read_repository` scope. + +2. To grant access to repositories, use one of the following methods: + + - **Through the `GIT_CREDENTIALS` environment variable:** + Set the environment variable with the value of the personal access token. For example: + ```bash + export GIT_CREDENTIALS='https://:@gitlab.example.com' + ``` + Antora will use this token for all repositories in `gitlab.example.com`. + +- **Through the _$HOME/.git_credentials_ file:** + Create or modify the `.git_credentials` file. Add lines with the necessary repositories in the following format: + ```bash + https://:@gitlab.example.com/ + # or + https://:@gitlab.example.com/ + # or use a single token for all repositories + https://:gitlab.example.com/ + ``` + +### Generating technical documentation + +- Generate a static HTML site from the documentation using the command: + + ```bash + antora site.yml + ``` + +- Generate a static _LOCAL_ HTML site from the documentation using the command: + + ```bash + antora site-local.yml + ``` + + The generated site can be viewed locally through the default browser. The output of this site will be available at the path defined in your site.yml playbook: + + ``` + output: + dir: ./output/ua + ``` + +### Setting up quick launch for documentation generation process in IntelliJ IDEA + +To automate the documentation generation step, you can set up a **Shell Script** run configuration in IntelliJ IDEA: + +1. From the main menu, select: _Run > Edit Configurations > Add New Configuration_. +2. Choose the **Shell Script** run configuration type. +3. Specify the name **Name: antora-site**. +4. Specify the script type **Execute: Shell Script**. +5. Specify the script **Script text: _antora site-local.yml_**. + +After setting up, IntelliJ IDEA will have an additional run configuration **antora-site** for generating technical documentation through Antora, which can be used for the quick launch of the process. diff --git a/antora.conf b/antora.conf index a9b9854c8c..c24786b64a 100644 --- a/antora.conf +++ b/antora.conf @@ -1,7 +1,12 @@ server { listen 80; - rewrite ^/$ /ua/platform/1.9.6/ permanent; + rewrite ^/$ /ua/platform/1.9.7/ permanent; + rewrite ^/uk/(.*)$ /ua/$1 last; + + rewrite ^/ua/platform/1.9.6$ /ua/platform/1.9.6.1 last; + rewrite ^/ua/platform/1.9.8$ /ua/platform/1.9.7 last; + rewrite ^/ua/platform/1.9.9$ /ua/platform/1.9.7 last; location /ua { error_page 404 /ua/404.html; diff --git a/docs/en/antora.yml b/docs/en/antora.yml index e54d90a590..9c57412c55 100644 --- a/docs/en/antora.yml +++ b/docs/en/antora.yml @@ -1,5 +1,5 @@ name: platform title: The Registries Platform -version: "1.9.6" +version: "1.9.7" nav: - modules/ROOT/nav.adoc \ No newline at end of file diff --git a/docs/en/modules/ROOT/documents/.giz-cicd.adoc b/docs/en/modules/ROOT/documents/.giz-cicd.adoc new file mode 100644 index 0000000000..e1fb1482f5 --- /dev/null +++ b/docs/en/modules/ROOT/documents/.giz-cicd.adoc @@ -0,0 +1,535 @@ += Platform for state registries: Architectural blueprint, best practices, and guidelines for global deployment and maintenance +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] + +<<< + +== Document goals + +This document offers an in-depth exploration of the Platform for state registries. Beyond the technical specifications, it encapsulates valuable insights from our journey as system developers. We shed light on pivotal facets like stakeholder management and robust CI/CD practices, intending to furnish actionable guidelines and best practices. Our overarching objective is to streamline the process for other vendors, paving the way for the international dissemination, deployment, maintenance, and evolution of software systems across varied landscapes. + +[NOTE] +==== +The furnished document and the accompanying system documentation serve as guiding principles for the team responsible for supporting the platform. This encompasses the development of new features, collaboration with vendors for feature implementation, and the management of the open-source community. It is imperative to note that the documents themselves do not guarantee the establishment of a functional and efficient process. + +The pivotal element in constructing such a process is the formation of a dedicated team within a government organization. This team is tasked with crafting the process in accordance with the provided guidelines, with a specific focus on addressing the developmental aspects. Furthermore, this team is positioned to offer recommendations and support to registry development teams, augmenting reference examples and conducting audits of developed registries. An additional facet of their responsibilities may involve the installation and adaptation of the platform for new countries. +==== + +== What is the Platform for state registries + +The *_Platform for state registries_* is an information system designed to efficiently deliver government services in a digital format. It enables the rapid creation, modeling, deployment, and maintenance of electronic state registries, striking an optimal balance between data security requirements, deployment speed, registry ownership costs, and data exchange with other registries. + +[high-level-structure] +=== High-level structure + +The *_Registries Platform_* is a powerful distributed system using the latest and greatest open-source technologies. Built with an innovative microservice architecture, it's a cloud-native platform that guarantees reliability, scalability, and infrastructure independence. + +Look at the accompanying diagram, which illustrates how the Platform is structured across multiple levels and zones. You'll notice how it's divided into distinct zones and subsystem levels, each with unique interactions. + +.Platform structure diagram +image::ROOT:giz-cicd/ddm-platform-structural-view.drawio.png[width=80%, height=60%] + +Within this Platform, you'll find two specific zones that operate at a system level and manage administrative and operational traffic. It's a complex yet efficient system that's sure to impress. + +Infrastructure :: +The _Registries Platform_ supports deployment in both *public and private cloud environments*, ensuring a versatile foundation for your needs. At its core, the Platform employs a sophisticated *container orchestration mechanism* to ensure seamless operations. ++ +[TIP] +You can learn more about the container orchestration platform here: https://diia-engine.github.io/diia-engine-documentation/en/platform/1.9.6/arch/architecture/container-platform/container-platform.html[Container orchestration platform]. + +Central components of the Platform:: +Every instance of the _Registries Platform_ incorporates a level known as the Central components of the Platform. This level is divided into *two logical zones*: + +* [*] *Administrative*: Subsystems that facilitate development functions, deployment operations, and the regulation of digital registry services. +* [*] *Operational*: Subsystems that ensure the registry operates following the deployed digital regulations. + +Registries :: +A single Registries Platform instance is equipped to service *a cluster of isolated registries*. Every registry tenant is *represented through two distinct zones*: + +* [*] *Administrative*: Subsystems that facilitate development functions, deployment operations, and the regulation of digital registry services. + +* [*] *Operational*: Subsystems that ensure the registry operates following the deployed digital regulations. + +Component for managing the state of Platform resources :: +This component provides the ability to install and update an instance of the Registries Platform. ++ +[TIP] +Dive deeper into the intricacies of the Platform resource state management component: https://diia-engine.github.io/diia-engine-documentation/en/platform/1.9.6/arch/architecture/platform-installer/overview.html[Component for managing the state of platform resources]. + +== Development and testing environment + +The *_Platform for state registries_* offers flexibility in its deployment. While developers can deploy components even on personal machines, setting up a comprehensive environment that mirrors the platform's essence is advised for optimal results. + +Component development, testing, and deployment :: +Each component within the platform can be developed, tested, and built locally or in remote environments. A more encompassing setup is beneficial for a holistic approach to testing, especially integration testing. + +Integration testing :: +Integration tests validate the platform's interactions with real instances of external systems. Successful execution is confirmed through snapshots, detailed logs, and comprehensive reproduction steps. + +System availability and compatibility :: +Establishing a reliable environment is essential to guarantee that the system is available and that components are compatible. This method ensures that the components work independently and cohesively with each other without any issues. + +Comprehensive Platform setup :: +For those seeking an in-depth understanding of the Platform's architecture, we suggest creating a comprehensive environment that can accommodate its complete setup. If you want to delve deeper into the details, you can access the source code for all components on GitHub. This will enable you to engage in transparent and collaborative development practices. + +<<< +=== Infrastructure + +The Platform for state registries is *_cloud-agnostic_*, meaning it can function effectively on different cloud services without relying on a specific environment. This flexibility enables clients and developers to choose the most appropriate cloud service for their needs and preferences without being bound to a single provider. + +The Platform must be deployed on virtual infrastructures that are officially supported, which currently include: + +* [*] *Public clouds*: such as https://aws.amazon.com/[Amazon Web Services (AWS)], https://azure.microsoft.com/[Microsoft Azure (Azure)], and https://cloud.google.com/[Google Cloud Platform (GCP)]. These services provide access to virtual resources over the Internet and are available to the public. + +* [*] *Private clouds*: These are clouds intended solely for the use of one organization. For instance, https://www.vmware.com/products/vsphere.html[VMWare vSphere] is a platform enabling the creation of private, especially on-premises cloud infrastructures. + +The infrastructures above should install an OKD cluster, the version of which complies with the Platform's requirements, as laid out in the official documentation of the Platform: https://diia-engine.github.io/diia-engine-documentation/en/platform/1.9.6/admin/installation/okd-requirements.html[Platform for state registries: requirements for OKD clusters]. + +=== Container orchestration platform + +*_OpenShift_* is an open-source container management platform that provides advanced orchestration capabilities and deployment of containerized software. It is developed based on Kubernetes and offers a full stack of solutions and abstractions for developing, deploying, managing, and monitoring containers. This platform provides an opportunity to deploy your software provision in any public cloud environment, private cloud environment, or local infrastructure, delivering resilience, reliability, and security for deployed software. + +OpenShift is a flexible platform that can be easily extended, supplemented, and integrated with other tools, platforms, and software. This component allows you to have: + +* [*] *monitoring and logging* capabilities that provide information about the health and performance of software and infrastructure; +* [*] *network security policies* and *role-based access control (RBAC)* to enable secure publishing and end-user access; +* [*] *backup* and *scaling* of the platform and deployed software, allowing for rapid *recovery* of the system state and responding to load increases or decreases +* [*] *distributed data stores* for storing state and information of stateful applications. + +OpenShift is an ideal solution for organizations looking to modernize their software infrastructure and accelerate digital transformation processes. It is the primary component for deploying and managing containerized applications in the *_Registries Platform_*. + +.Container orchestration platform. High-level architecture +image::platform:ROOT:giz-cicd/container-orchestration.drawio.png[width=750,float="center",align="center"] + +The OpenShift architecture consists of several virtual machines, including: + +* *Master virtual machines*. Responsible for managing the overall health of the cluster, including application planning and deployment. +* *Infrastructure and Platform virtual machines*. They contain system operators and applications that provide work for +_Container orchestration Platform_ and _Registries Platforms_. +* *Registry virtual machines*. Run containers with registry software. + +=== Managing the state of Platform resources + +[platform-components] +==== Platform components + +The Platform components, as seen in the repositories on https://github.com/orgs/epam/repositories?q=edp-ddm&type=all[GitHub], are Helm charts that need to be deployed on an OpenShift cluster in a specific sequence and connection. + +.Component deployment and interaction diagram +[plantuml] +---- +@startuml + +skinparam DefaultFontName Helvetica + +skinparam backgroundColor #F2F2F2 +skinparam component { + BackgroundColor #e1e1ea + BorderColor #34495E + FontColor black + BorderThickness 2 +} +skinparam package { + BackgroundColor #E74C3C + FontColor black + BorderThickness 2 +} + +title Component deployment and interaction diagram + +package "DDM Platform install" as ddm_platform_install #ffe6e6 { + [OKD Install] as okd_install + [DDM Core Install] as ddm_core_install +} +ddm_core_install -[#34495E]-> infra_components: deploys Nexus, Ceph, and Platform Keycloak + +ddm_core_install -[#34495E]-> ddm_cp_install: deploys Control Plane components + +package "Infra Components" as infra_components #e6faff { + [catalog-source] + [monitoring] + [storage] + [logging] + [service-mesh] + [backup-management] + package "user-management" as user-management_infra #f2e6ff { + [groupsync-operator] + [keycloak-operator] + [keycloak] + [hashicorp-vault] + } + [control-plane-nexus] + [external-integration-mocks] + package "Outside Openshift" #ecd9c6 { + [platform-vault] + [platform-minio] + } +} + +package "DDM Control Plane (CP)" as ddm_cp_install #e6ffe6 { + [keycloak-operator] + [codebase-operator] + [control-plane-console] + [control-plane-gerrit] as ddm_gerrit + [control-plane-jenkins] + [infrastructure-jenkins-agent] +} + +okd_install -[hidden]-> infra_components +ddm_gerrit -u-> infra_components : contains the composite repository "cluster-mgmt", which defines specific versions of infrastructure components + +ddm_gerrit -d-> registry_components : contains registry templates "registry-tenant-template-*", which define specific versions of registry components + +package "Registry regulations" as registry_regulations #cce6ff { + [registry-regulation-template-minimal] + [registry-regulation-template-recommended] +} + +package "Registry components" as registry_components #ffffe6 { + [bpms] + [officer-portal] + [jenkins-operator] + [dataplatform-jenkins-agent] + [gerrit-operator] + [codebase-operator] + [user-process-management] + [bp-admin-portal] + [user-task-management] + [kong] + [form-management] + [admin-portal] + [redash-chart] + [pg-exporter-chart] + [citus] + [strimzi-kafka-operator] + [nexus] + [keycloak-operator] + [kafka-schema-registry] + [citizen-portal] + [user-settings-service-persistence] + [user-settings-service-api] + [bp-webservice-gateway] + [digital-document-service] + [hashicorp-vault] + [excerpt-service-api] + [excerpt-worker] + [report-exporter] + [registry-configuration] + [process-history-service-api] + [...] +} + +ddm_gerrit -r-> registry_regulations : creates repository "registry-regulations-template" + +legend + Each component is a separate git repository +end legend + +@enduml +---- + +It can be time-consuming to deploy these components manually. Hence, utilizing the _Component for managing the state of Platform resources_ is more efficient. + +[installer-managing-resources] +==== Installer: Component for managing the state of Platform resources + +The *_Installer_* is a set of software tools that offer the capability to *install and update* an instance of the _Registries Platform_. + +Key functions: :: + +* [*] Installing the Registries Platform +* [*] Updating the Registries Platform +* [*] Deploying the Central service for managing Platform secrets +* [*] Deploying the Platform backup storage + +The following diagram illustrates the components encapsulated within the Platform Installer and how they interact with other subsystems: + +.Platform Installer. Components deployment and update +image::platform:ROOT:giz-cicd/platform-installer-subsystem.drawio.png[] + +____ +So, with the _Installer_, you can quickly deploy the Platform and its components in a few straightforward steps: + +. Setting up your environment. +. Installing the OKD cluster in this environment. +. Preparing and launching the installer itself. + +See https://diia-engine.github.io/diia-engine-documentation/en/platform/1.9.6/admin/installation/platform-deployment/platform-deployment-overview.html[Deploying the Platform on target environments]. +____ + +Installer modules description (functions.sh) :: ++ +*INIT-CHECK*: Checks essential parameters. ++ +*ENCRYPTION-ETCD*: Sets up ETCD encryption and validates OpenShift certificates. ++ +*INSTALL-CLUSTER-MGMT*: Deploys key components: `catalog-source`, `storage`, `keycloak-operator-crd`, `logging`, `service-mesh`. ++ +*INSTALL-NEXUS*: Deploys `control-plane-nexus` (_Docker image repository and XSD_). ++ +*VAULT-INSTALL*: Initiates the central Vault. ++ +*MINIO-INSTALL*: Sets up the central Minio. ++ +*INIT-NEXUS*: Loads Docker images to Nexus. ++ +*INSTALL-ADDITIONAL-COMPONENTS*: Deploys `user-management`. ++ +*INSTALL-CONTROL-PLANE*: Initiates Control Plane components. ++ +*NEXUS-RESOURCE-UPLOAD*: Adds XSD resources to Nexus. ++ +*BACKUP-CREDENTIALS*: Sets backup access parameters in Minio. ++ +*USAGE*: Provides guidance for `install.sh`. + +The following diagram presents the structure of the Platform Installer: + +.Installer structure. Components and interactions +[plantuml] +---- +@startuml + +skinparam DefaultFontName Helvetica + +skinparam backgroundColor #F2F2F2 +skinparam component { + BackgroundColor #e1e1ea + BorderColor #34495E + FontColor black + BorderThickness 2 +} +skinparam package { + BackgroundColor #E74C3C + FontColor black + BorderThickness 2 +} + +title Installer components and interactions + +package "Installer" as installer #e6f3ff { + package "images" as images #ffffe6 { + [external docker images] + [registry docker images] + } + package "nexus" as nexus #ffffe6 { + [liquibase-ext-schema] + } + package "repositories" as repositories #ffffe6 { + package "control-plane" as control-plane #e6ffe6 { + [codebase-operator] + [control-plane-console] + [control-plane-gerrit] + [control-plane-installer] + [control-plane-jenkins] + [ddm-architecture] + [infrastructure-jenkins-agent] + [keycloak-operator] + } + package "infra" as infra #e6ffe6 { + [backup-management] + [catalog-source] + [control-plane-nexus] + [external-integration-mock] + [keycloak] + [logging] + [monitoring] + [service-mesh] + [storage] + [user-management] + } + package "registry" as registry #e6ffe6 { + [hashicorp-vault] + [keycloak-operator] + } + } + package "terraform" as terraform #ffffe6 { + [minio] + [vault] + } + [control-plane-installer.img] as installer_image + [docker_load.sh] as docker_load + [functions.sh] as functions + [install.sh] as install +} + +@enduml +---- + +=== Development and testing tools + +Engage with our high-level diagram to uncover the core technologies and understand how they seamlessly cater to the Registries Platform's diverse needs. + +.Key technologies and tools +image::platform:ROOT:giz-cicd/ddm-platform-tech-view.drawio.png[] + +TIP: For a deeper dive, visit the https://diia-engine.github.io/diia-engine-documentation/en/platform/1.9.6/arch/architecture/platform-technologies.html[Platform technology stack] page. + +=== Development and testing scenarios + +Equipped with a target environment and a comprehensive toolkit for development, you're all set to modify any component. Using *_Helm_*, you can easily compile its Docker image locally and deploy it onto a prepared environment within the OKD cluster. + +*_Helm_* streamlines and automates creating, packaging, configuring, and deploying Kubernetes applications. It consolidates your configuration files into one versatile package. In a microservices-driven architecture, management can become complex as the application expands and more microservices are added. Helm elegantly tackles this challenge, ensuring efficient deployment and management of these services. + +.Development workflow +[plantuml] +---- +@startuml + +skinparam DefaultFontName Helvetica + +skinparam backgroundColor #e6f2ff +skinparam rectangle { + BackgroundColor #ffffe6 + BorderColor #000000 + FontColor black + BorderThickness 2 +} + +title Development workflow + +rectangle "Clone source code" as clone +rectangle "Develop" as develop +rectangle "Run unit tests" as unit_tests +rectangle "Build docker image" as build_docker +rectangle "Deploy to env with Helm" as deploy_helm + +clone -r-> develop +develop -r-> unit_tests +unit_tests -r-> build_docker +build_docker -r-> deploy_helm + +@enduml +---- + +____ +Consider a streamlined deployment strategy? We advocate the *_GitOps_* methodology for its precision and efficiency. By integrating GitOps, you facilitate the automation of infrastructure configuration and component deployment and enhance overall system orchestration. +____ + +At the heart of GitOps is the Git repository, serving as the definitive source for subsystem configuration files. This method seamlessly governs the Platform's infrastructure and registry deployments, blending automated deployment, efficient version control, simple change reversals, and clear visibility into system changes. This synergy is achieved through Git-based workflows and clear descriptions of the desired state of the Platform and registry. + +____ +To maximize the benefits of GitOps, automating the integration and deployment of the Platform components is crucial. It's about embracing the *_CI/CD_* approach. +____ + +The following section provides a closer look at CI/CD. + +== Continuous Integration and Continuous Delivery (CI/CD) + +=== Overview of CI/CD + +*_CI/CD_* represents a harmonized suite of processes empowering developers to craft high-quality software through a fluid, automated process spanning development, testing, delivery, and deployment. This holistic approach amplifies collaboration and drives efficiency throughout the software development lifecycle. + +* [*] *Continuous Integration (CI)*: A practice in which developers consistently merge their code changes into a central repository. After each merge, automated builds and tests are triggered, enabling swift detection of integration hiccups. + +* [*] *Continuous Delivery (CD)*: Evolution of CI, it ensures the code remains ever-ready for deployment. The focus is on full-throttle automation of the software release process, from changes in code to its testing, culminating in a deployment-ready state. Nevertheless, the deployment decision remains manual. + +* [*] *Continuous Deployment (CD)*: Elevating the automation gamut, it instantaneously deploys code changes to production after successfully navigating all CI/CD pipeline tests. This refines the release mechanism by obliterating manual steps in the Continuous Delivery phase. + +* [*] *Continuous Testing*: This encompasses the continuous execution of automated tests throughout the software development phase. Incorporating unit, integration, and end-to-end tests ensures swift issue detection and remediation, upholding software reliability. + +Collectively, these practices sculpt a robust, agile, and efficient software development and deployment blueprint. + +=== Essential CI/CD tools + +Building a foundational CI/CD pipeline is achievable with select pivotal tools: + +* [*] *Version Control System (VCS)*: A linchpin for monitoring codebase alterations. Git is a popular choice, given its seamless synergy with CI/CD tools. e.g., GitHub, GitLab, Gerrit. + +* [*] *Continuous Integration (CI) server*: This server kindles the automation of build and testing processes activated by code amendments. e.g., Jenkins, GitHub Actions, GitLab CI, Travis CI. + +* [*] *Build automation tool*: Streamlines the build process. e.g., Maven, Gradle (Java), npm (Node.js). + +* [*] *Automated testing framework*: Bolsters code quality via automated test execution in the CI loop. e.g., JUnit (Java), pytest (Python), Jasmine (JavaScript). + +* [*] *Artifact repository*: Safeguards build artifacts birthed during the CI phase. e.g., Nexus, JFrog Artifactory. + +* [*] *CD orchestration*: Breathes life into the post-CI deployment process. e.g., *Jenkins*, *GitLab CI*. + +Special mention to *Tekton*, a tool rooted in cloud-native and container-native ethos, tailored for modern container-centric app development and deployment. It bestows a toolkit for defining and orchestrating CI/CD pipelines via code. + +=== Delving into CI/CD Pipelines + +A *_CI/CD pipeline_* consists of a series of interconnected steps for *_continuous integration and deployment_*, which is crucial for releasing software versions. This approach enhances software delivery throughout its development lifecycle through process automation. Organizations can accelerate their coding processes without sacrificing quality by incorporating CI/CD automation in the development, testing, release, and monitoring stages. While it's possible to execute each step of the pipeline manually, the actual value of CI/CD emerges with automation. The primary goal of this automation is to reduce human errors and ensure a consistent software release process. + +The *_CI pipeline (Continuous Integration pipeline)_* is the bedrock of streamlined coding, seamlessly merging code modifications into a cohesive project. Reviewing code changes through a _Version Control System (VCS)_ crafts an updated codebase for the following stages, including _Code Review_ and _Build Pipelines_. + +The *_CD pipeline (Continuous Delivery pipeline)_* is your gateway to seamless software delivery. Its essence is the stage-by-stage promotion of application builds, ensuring each phase is validated before moving to the next. Think of it as a quality gatekeeper, overseeing a collection of pivotal applications and their respective stages. + +The *Deploy pipeline* adds versatility to the Continuous Delivery journey, offering: + +* [*] Streamlined integration of applications into varied environments, ready for auto-testing and progression. +* [*] An adaptable environment for both automated and manual application checks. +* [*] Efficient deployment options, whether you opt for the latest or a specific build from the Docker registry. +* [*] Fluid movement of image builds across environments. +* [*] Smart auto-deployment of applications using the supplied payload. + +=== CI/CD quality gates + +Each CI/CD pipeline is intricately laced with steps known as *_Quality gates_*. + +A *_Quality gate_* is a set of criteria a project must meet to transition from one phase to the next. These gates can be automated or manual, requiring human or team intervention. Integrating Quality gates into CI/CD pipelines ensures that the software only progresses if it aligns with foundational standards and requirements. Navigating through these gates significantly decreases the likelihood of releasing substandard or vulnerable code to the end-user environment, ensuring swift feedback loops with developers. + +.General scheme of passing quality gates +image::platform:ROOT:giz-cicd/cicd-common-QG.drawio.png[] + +TIP: For more on recommended software development and quality control practices, visit: +https://diia-engine.github.io/diia-engine-documentation/en/platform/1.9.6/platform-develop/coding-standards.html[Recommended software development and quality control practices]. + +=== CI/CD pipelines and stages + +Look at the full-fledged delivery path through pipelines and their respective stages. It's crucial to note that the stages may vary depending on the type of codebase. + +Here's a sample breakdown of potential stages that a pipeline might include. Not all of these stages are mandatory, but they provide a glimpse into a comprehensive development pipeline that ensures the high quality of the final product. + +.CI/CD pipelines and stages +image::platform:ROOT:giz-cicd/cicd-pipelines.drawio.png[] + +Pipelines' stages and components overview :: + +* *Init*: This stage kicks off the information collection process. It checks out all files from the selected branch of the Git repository. For the primary branch, it uses the HEAD, and for code review, it sources from the relevant commit. + +* *Commit validation*: At this stage, the Merge Request header is verified for compliance with established naming conventions such as http://semver.org[Semantic Versioning] and https://www.conventionalcommits.org/en/v1.0.0/[Conventional Commits]. This can be used to integrate with an issue-tracking system like Jira. + +* *Compile*: The code is compiled using appropriate build tools like npm, maven, gradle, etc., ensuring code consistency. + +* *Testing*: This stage initiates the testing procedures: + +** *Unit testing*: Low-level testing focused on individual methods, functions, components, or modules used in the software. Passing this quality threshold verifies if recent code changes led to any regressions or introduced errors in previously tested software parts. + +** *Integration testing*: This tests the interaction between microservice components, such as interactions with databases or Redis. + +* *Code linting*: A quality check for detecting and rectifying inconsistent or undesirable code. This step aims to identify potential issues, apply coding standards, and maintain clean code. Common tools include https://eslint.org/[ESLint], https://checkstyle.sourceforge.io/[Checkstyle], and https://pylint.pycqa.org/en/latest/[Pylint]. + +* *Docker linting*: This involves linting the Dockerfile using https://github.com/hadolint/hadolint[Hadolint], ensuring Docker images adhere to https://docs.docker.com/develop/develop-images/dockerfile_best-practices/[Best practices for writing Dockerfiles]. Additionally, https://github.com/koalaman/shellcheck[Shellcheck] is utilized to lint Bash code in Docker RUN instructions. An alternative tool that can be used is https://github.com/RedCoolBeans/dockerlint[dockerlint]. + +* *Code quality*: A code quality control tool checks for common issues, ensuring the code aligns with established quality standards for the programming language. A versatile tool for this is https://www.sonarsource.com/products/sonarqube/[SonarQube]. + +* *Static application security testing (SAST)*: This involves static testing of the microservice source code to identify vulnerabilities that malicious actors could exploit. + +* *Secret detecting*: This step involves identifying and preventing the inclusion of secrets in the code. + +* *Software composition analysis (SCA)*: Here, open-source components integrated into the microservice codebase are analyzed for security, license compliance, and code quality. This method can identify all related components, their auxiliary libraries, dependencies, software licenses, outdated dependencies, and potential vulnerabilities. Tools like https://dependencytrack.org/[Dependency Track], https://github.com/jeremylong/DependencyCheck[DependencyCheck: OWASP], and https://snyk.io/series/open-source-security/software-composition-analysis-sca/[Snyk] can be employed. + +* *Build*: This stage constructs the application. + +* *Docker building*: A Docker image is created from the Dockerfile, which is then stored in the current Artifact repository with the corresponding VCS tag for further deployment and testing. + +* *Container scanning* involves scanning the built Docker image and its components for known vulnerabilities. This method can be part of SCA testing, but using both types of analysis is recommended for broader risk coverage. + +* *Git tag*: This step involves adding a git tag to the main branch in the VCS repository, corresponding to the artifact's version in the Artifact repository. The tag might include the build number and match the artifact's name. + +* *Docker image push*: Pushing the built docker image to storage in the Artifact repository for further deployment on the selected environments. + +* *Reports aggregator*: A component of the CI/CD process designed to collect and visualize report checks for further analysis if the code and/or artifact does not meet the set quality thresholds. + +** For _Build_ and _Deploy_ pipelines, it is recommended to use the https://www.defectdojo.org[DefectDojo] platform for security and vulnerability management for subsequent analysis and handling by development and security engineers. + +** A separate platform with additional aggregation, grouping, and testing results management capabilities is recommended for collecting and analyzing reports from automated testing results. An example is https://reportportal.io/[ReportPortal]. + +* *Deploy*: Either an automatic or manual step of deploying a specified version of the service on a selected environment (Env) using the helm tool following the GitOps approach. + +* *Automation testing*: Automated testing of the application's key functionality to detect fundamental and critical problems before moving to the subsequent testing stages. This approach is initiated after each successful deployment of a new microservice version in the environment. + +* *QA Testing*: Manual quality assurance of the code according to predefined functionality use scenarios. Typically, it finishes with a manual approval from a QA engineer. + +* *Promote*: Promotes final docker images to the Artifact repository. \ No newline at end of file diff --git a/docs/en/modules/ROOT/images/giz-cicd/cicd-common-QG.drawio.png b/docs/en/modules/ROOT/images/giz-cicd/cicd-common-QG.drawio.png new file mode 100644 index 0000000000..8c7b2db2c0 Binary files /dev/null and b/docs/en/modules/ROOT/images/giz-cicd/cicd-common-QG.drawio.png differ diff --git a/docs/en/modules/ROOT/images/giz-cicd/cicd-common-QG.drawio.svg b/docs/en/modules/ROOT/images/giz-cicd/cicd-common-QG.drawio.svg new file mode 100644 index 0000000000..ea0be9a830 --- /dev/null +++ b/docs/en/modules/ROOT/images/giz-cicd/cicd-common-QG.drawio.svg @@ -0,0 +1,4 @@ + + + +
Push
new change
Push...
Merge Request
Merge Request
Build pipeline
Build pipeline
Ready to Merge
Ready to Merge
Team 
code review
Team...
Code Review pipeline
Code Review pipel...
Deploy pipeline
Deploy pipeline
Environment
Environment
Ask review
Ask review
Get
approvals
Get...
Merged
Merged
Auto/Manual
trigger
Auto/Manual...
Deploy
Deploy
Fail
Fail
Comments
Comments
Feature/Bugfix
Feature/Bugfix
Merge conflict
Merge conflict
Revert
Revert
Create MR
Create MR
General scheme of passing quality gates
General scheme of passing quality gatesText is not SVG - cannot display \ No newline at end of file diff --git a/docs/en/modules/ROOT/images/giz-cicd/cicd-pipelines.drawio.png b/docs/en/modules/ROOT/images/giz-cicd/cicd-pipelines.drawio.png new file mode 100644 index 0000000000..9e84226942 Binary files /dev/null and b/docs/en/modules/ROOT/images/giz-cicd/cicd-pipelines.drawio.png differ diff --git a/docs/en/modules/ROOT/images/giz-cicd/cicd-pipelines.drawio.svg b/docs/en/modules/ROOT/images/giz-cicd/cicd-pipelines.drawio.svg new file mode 100644 index 0000000000..d7c430d598 --- /dev/null +++ b/docs/en/modules/ROOT/images/giz-cicd/cicd-pipelines.drawio.svg @@ -0,0 +1,4 @@ + + + +
Software composition analysis
Software composit...
Code quality
Code quality

Static application security testing

Static applicatio...
Compile
Compile
Testing
Testing
Code linting
Code linting
Docker linting
Docker linting
Secret detecting
Secret detecting
Init
Init
Commit validation
Commit validation
Software composition analysis
Software composit...
Build
Build
Code quality
Code quality

Static application security testing

Static applicatio...
Docker building
Docker building
Compile
Compile
Testing
Testing
Code linting
Code linting
Docker linting
Docker linting
Secret detecting
Secret detecting
Init
Init
Commit validation
Commit validation
Container scanning
Container scanning
Git tag
Git tag
Docker image push
Docker image push
Reports aggregator
Reports aggregator
VCS
VCS
Registry
Registry
Automation
testing
Automation...
QA testing
QA testing
Init
Init
Deploy
Deploy
Promote
Promote
Code review pipeline
Code review pipeline
Build pipeline
Build pipeline
Deploy pipeline
Deploy pipeline
Reports
aggregator
Reports...
CI/CD pipelines and stages
CI/CD pipelines and stagesText is not SVG - cannot display \ No newline at end of file diff --git a/docs/en/modules/ROOT/images/giz-cicd/container-orchestration.drawio.png b/docs/en/modules/ROOT/images/giz-cicd/container-orchestration.drawio.png new file mode 100644 index 0000000000..a65c33ac62 Binary files /dev/null and b/docs/en/modules/ROOT/images/giz-cicd/container-orchestration.drawio.png differ diff --git a/docs/en/modules/ROOT/images/giz-cicd/ddm-platform-structural-view.drawio.png b/docs/en/modules/ROOT/images/giz-cicd/ddm-platform-structural-view.drawio.png new file mode 100644 index 0000000000..7e1c5dcde4 Binary files /dev/null and b/docs/en/modules/ROOT/images/giz-cicd/ddm-platform-structural-view.drawio.png differ diff --git a/docs/en/modules/ROOT/images/giz-cicd/ddm-platform-tech-view.drawio.png b/docs/en/modules/ROOT/images/giz-cicd/ddm-platform-tech-view.drawio.png new file mode 100644 index 0000000000..2236adc88f Binary files /dev/null and b/docs/en/modules/ROOT/images/giz-cicd/ddm-platform-tech-view.drawio.png differ diff --git a/docs/en/modules/ROOT/images/giz-cicd/platform-installer-subsystem.drawio.png b/docs/en/modules/ROOT/images/giz-cicd/platform-installer-subsystem.drawio.png new file mode 100644 index 0000000000..a392799736 Binary files /dev/null and b/docs/en/modules/ROOT/images/giz-cicd/platform-installer-subsystem.drawio.png differ diff --git a/docs/en/modules/ROOT/partials/admonitions/ua-specific.adoc b/docs/en/modules/ROOT/partials/admonitions/ua-specific.adoc index 4ce7baeae6..26d5bd7b53 100644 --- a/docs/en/modules/ROOT/partials/admonitions/ua-specific.adoc +++ b/docs/en/modules/ROOT/partials/admonitions/ua-specific.adoc @@ -1,3 +1,3 @@ [NOTE,caption=UA-specific] This functionality is specific to the Ukrainian implementation and may not apply or function as described in other contexts or regions. -Please consult the local guidelines or documentation if you are implementing this outside of Ukraine. \ No newline at end of file +Please consult the local guidelines or documentation if you are implementing this outside Ukraine. \ No newline at end of file diff --git a/docs/en/modules/admin/images/backup-restore/registry/control-plane-create-backup-01.png b/docs/en/modules/admin/images/backup-restore/registry/control-plane-create-backup-01.png index 30754f3758..e086bf6877 100644 Binary files a/docs/en/modules/admin/images/backup-restore/registry/control-plane-create-backup-01.png and b/docs/en/modules/admin/images/backup-restore/registry/control-plane-create-backup-01.png differ diff --git a/docs/en/modules/admin/images/backup-restore/registry/control-plane-create-backup-02.png b/docs/en/modules/admin/images/backup-restore/registry/control-plane-create-backup-02.png index eb033f078f..e174d884e4 100644 Binary files a/docs/en/modules/admin/images/backup-restore/registry/control-plane-create-backup-02.png and b/docs/en/modules/admin/images/backup-restore/registry/control-plane-create-backup-02.png differ diff --git a/docs/en/modules/admin/images/backup-restore/registry/control-plane-create-backup-03.png b/docs/en/modules/admin/images/backup-restore/registry/control-plane-create-backup-03.png index d1d4b1ae80..bea00faf23 100644 Binary files a/docs/en/modules/admin/images/backup-restore/registry/control-plane-create-backup-03.png and b/docs/en/modules/admin/images/backup-restore/registry/control-plane-create-backup-03.png differ diff --git a/docs/en/modules/admin/images/backup-restore/registry/control-plane-create-backup-job.png b/docs/en/modules/admin/images/backup-restore/registry/control-plane-create-backup-job.png index eaa89e4ea2..06d40c647a 100644 Binary files a/docs/en/modules/admin/images/backup-restore/registry/control-plane-create-backup-job.png and b/docs/en/modules/admin/images/backup-restore/registry/control-plane-create-backup-job.png differ diff --git a/docs/en/modules/admin/images/backup-restore/registry/control-plane-create-restore-01.png b/docs/en/modules/admin/images/backup-restore/registry/control-plane-create-restore-01.png index 853047b90f..9ffcc45403 100644 Binary files a/docs/en/modules/admin/images/backup-restore/registry/control-plane-create-restore-01.png and b/docs/en/modules/admin/images/backup-restore/registry/control-plane-create-restore-01.png differ diff --git a/docs/en/modules/admin/images/backup-restore/registry/control-plane-create-restore-02.png b/docs/en/modules/admin/images/backup-restore/registry/control-plane-create-restore-02.png index 8778fa162b..216515ab90 100644 Binary files a/docs/en/modules/admin/images/backup-restore/registry/control-plane-create-restore-02.png and b/docs/en/modules/admin/images/backup-restore/registry/control-plane-create-restore-02.png differ diff --git a/docs/en/modules/admin/images/backup-restore/registry/control-plane-create-restore-05.png b/docs/en/modules/admin/images/backup-restore/registry/control-plane-create-restore-05.png index 2ee5a36112..8da92ff7d6 100644 Binary files a/docs/en/modules/admin/images/backup-restore/registry/control-plane-create-restore-05.png and b/docs/en/modules/admin/images/backup-restore/registry/control-plane-create-restore-05.png differ diff --git a/docs/en/modules/admin/images/backup-restore/registry/control-plane-create-restore.png b/docs/en/modules/admin/images/backup-restore/registry/control-plane-create-restore.png index bc962e94a4..a0693339b5 100644 Binary files a/docs/en/modules/admin/images/backup-restore/registry/control-plane-create-restore.png and b/docs/en/modules/admin/images/backup-restore/registry/control-plane-create-restore.png differ diff --git a/docs/en/modules/admin/images/infrastructure/cluster-mgmt/change-key/change-key-41.png b/docs/en/modules/admin/images/infrastructure/cluster-mgmt/change-key/change-key-41.png index 687d1abd1f..44f87086a7 100644 Binary files a/docs/en/modules/admin/images/infrastructure/cluster-mgmt/change-key/change-key-41.png and b/docs/en/modules/admin/images/infrastructure/cluster-mgmt/change-key/change-key-41.png differ diff --git a/docs/en/modules/admin/images/installation/aws/installation-aws-1.png b/docs/en/modules/admin/images/installation/aws/installation-aws-1.png deleted file mode 100644 index 5a5cb14e67..0000000000 Binary files a/docs/en/modules/admin/images/installation/aws/installation-aws-1.png and /dev/null differ diff --git a/docs/en/modules/admin/images/installation/aws/installation-aws-1.svg b/docs/en/modules/admin/images/installation/aws/installation-aws-1.svg new file mode 100644 index 0000000000..67564feb1c --- /dev/null +++ b/docs/en/modules/admin/images/installation/aws/installation-aws-1.svg @@ -0,0 +1,4 @@ + + + +
Private subnet
Private subnet
Public subnet
Public subnet
NAT Gateway
NAT Gateway
IGW-1
IGW-1
Route tables
Route tables
10.0.0.0/16
10.0.0.0/16
10.0.101.0/24
10.0.101.0/24
Internet
Internet
Bastion
Bastion
deployer-node
deployer-node
10.0.1.0/24
10.0.1.0/24Public security group
22 port
22 port
public sec group
public sec groupPrivate security group
(Elastic IP)
(Elastic I...
(Elastic IP)
(Elastic I...
S3
S3
Locking
Lock...
DynamoDB
DynamoDBText is not SVG - cannot display \ No newline at end of file diff --git a/docs/en/modules/admin/images/registry-management/quick-links/quick-links-1.png b/docs/en/modules/admin/images/registry-management/quick-links/quick-links-1.png index b7874a9ce9..e2f71f4d7e 100644 Binary files a/docs/en/modules/admin/images/registry-management/quick-links/quick-links-1.png and b/docs/en/modules/admin/images/registry-management/quick-links/quick-links-1.png differ diff --git a/docs/en/modules/admin/pages/admin-study/platform-admin-tools.adoc b/docs/en/modules/admin/pages/admin-study/platform-admin-tools.adoc index 66e944624a..95bfc0edc9 100644 --- a/docs/en/modules/admin/pages/admin-study/platform-admin-tools.adoc +++ b/docs/en/modules/admin/pages/admin-study/platform-admin-tools.adoc @@ -11,7 +11,7 @@ TIP: For more details about the duties of the Platform Administrator, please ref == Setting up a local environment -You need to set up a local environment for full and comfortable work with the Platform. To do this, install the following list of tools on your local machine: +We recommend configuring your local environment to make working with the Platform more convenient. Install the following tools on your machine: include::registry-develop:partial$snippets/study/local-environment-setup-en.adoc[] @@ -19,6 +19,8 @@ include::registry-develop:partial$snippets/study/local-environment-setup-en.adoc include::registry-develop:partial$snippets/study/platform-tools-en.adoc[] -The Platform Administrator should be able to use the tools of the xref:admin:registry-management/control-plane-quick-links.adoc#platform-admin-zone[Platform's administrative zone] and xref:admin:registry-management/control-plane-quick-links.adoc#platform-operational-zone[Platform's operational zone]. We also recommend familiarizing yourself with the tools of the administrative and operational zones of the registry, as Platform Administrators sometimes participate in registry processes. +The Platform Administrator should be able to use the tools of the xref:admin:registry-management/control-plane-quick-links.adoc#platform-admin-zone[Platform's administrative zone] and xref:admin:registry-management/control-plane-quick-links.adoc#platform-operational-zone[Platform's operational zone]. -Note: Some parts (like "include::" and "xref:") are kept unchanged because they seem to be part of the AsciiDoc syntax, and translating them might break their functionality. \ No newline at end of file +We also recommend familiarizing yourself with the tools of the administrative and operational zones of the registry, as Platform Administrators sometimes participate in registry processes. + +//TODO: Note: Some parts (like "include::" and "xref:") are kept unchanged because they seem to be part of the AsciiDoc syntax, and translating them might break their functionality. \ No newline at end of file diff --git a/docs/en/modules/admin/pages/backup-restore/backup-schedule-cluster-mgmt.adoc b/docs/en/modules/admin/pages/backup-restore/backup-schedule-cluster-mgmt.adoc index 3c66d39656..9aaa5c7e20 100644 --- a/docs/en/modules/admin/pages/backup-restore/backup-schedule-cluster-mgmt.adoc +++ b/docs/en/modules/admin/pages/backup-restore/backup-schedule-cluster-mgmt.adoc @@ -1,224 +1,172 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Setting up the central components backup schedule and retention time +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] + +include::platform:ROOT:partial$admonitions/language-en.adoc[] == General description -//Платформа дозволяє [.underline]#керувати розкладом створення резервних копій центральних компонентів, а також часом зберігання таких резервних копій у сховищі бекапів#. The platform allows for [.underline]#managing the schedule of creating backups for central components and the time for storing such backups in the backup repository#. -//Резервні копії компонентів створюються за допомогою інструмента *`velero`* та зберігаються у захищеному сховищі бекапів *`minio`* поза межами кластера Платформи. -The backups of components are created using the *`velero`* tool and stored in a secure backup repository called *`minio`*, located outside of the Platform cluster. - -//[NOTE] -//==== -//Розклад резервного копіювання налаштовується у форматі https://uk.wikipedia.org/wiki/Cron[*unix-cron*] на інтерфейсі адміністративної панелі *Control Plane*. -//Час зберігання резервних копій має бути більшим за або дорівнювати одиниці, бути цілим числом та не містити спеціальних символів. +The backups of components are created using the *`velero`* tool and stored in a secure backup repository called *`minio`*, located outside the Platform cluster. [NOTE] ==== The backup schedule is configured in the https://uk.wikipedia.org/wiki/Cron[*unix-cron*] format on the *Control Plane* administrative panel interface. The retention time for backups must be greater than or equal to one, be a whole number, and not contain special characters. - ==== -// Перелік центральних компонентів, для яких можна налаштувати резервне копіювання за розкладом та час зберігання резервних копій: :: - The list of central components for which backup scheduling and retention time can be configured includes: :: -//* [*] Сховище артефактів -- центральний компонент *`nexus`*. * [*] Artifact repository - central component *`nexus`*. -//* [*] Панель керування Платформою та реєстрами -- центральний компонент *`control-plane`*. -//TODO: Platform and Registries should always start from capital letter? -* [*] Control panel for the Platform and Registries - central component *`control-plane`*. -//* [*] Керування користувачами -- центральний компонент *`user-management`*. +* [*] Control panel for the Platform and registries—central component *`control-plane`*. * [*] User Management - central component *`user-management`*. -//* [*] Моніторинг -- центральний компонент *`monitoring`*. * [*] Monitoring - central component *`monitoring`*. - -//Значення зберігаються до конфігурації *_values.yaml_* у репозиторії *_cluster-mgmt_*. The values are stored in the *_values.yaml_* configuration file in the *_cluster-mgmt_* repository. -//Відповідні параметри застосовуються завдяки Jenkins-пайплайну `*MASTER-Build-cluster-mgmt*`. The corresponding parameters are applied through the `*MASTER-Build-cluster-mgmt*` Jenkins pipeline. [#schedule-setup] -//== Налаштування розкладу == Setting up a schedule -//. Увійдіть до консолі *Control Plane* як адміністратор Платформи. +include::partial$templates/snippets/backup-restore-planning-en.adoc[] + . Log in to the *Control Plane* console as the Platform administrator. + image:admin:infrastructure/cluster-mgmt/update-cluster-mgmt-01.png[] -//. Перейдіть до розділу [.underline]#Керування платформою# та натисніть `РЕДАГУВАТИ`. -//TODO: How do we translate correctly into English the interface controls that are in Ukrainian as in this example? -. Go to the [.underline]#Platform Management# section and click on `EDIT`. + +. Go to the [.underline]#Platform management# section and click on *`Edit`*. + image:admin:backup-restore/backup-schedule-cluster-mgmt/cp-backup-schedule-1.png[] -//. Перейдіть до секції [.underline]#Розклад резервного копіювання# та виконайте налаштування для необхідних центральних компонентів. + . Navigate to the [.underline]#Backup schedule# section and configure the settings for the required central components. + [TIP] ==== -//Наразі це: Currently, they are: -//. Сховище артефактів -- центральний компонент *`nexus`*. . Artifact repository - central component *`nexus`*. -//. Панель керування Платформою та реєстрами -- центральний компонент *`control-plane`*. -. Control panel for the Platform and Registries - central component *`control-plane`*. -//TODO: Platform and Registries should always start from capital letter? -//. Керування користувачами -- центральний компонент *`user-management`*. +. Control panel for the Platform and registries -- central component *`control-plane`*. . User Management - central component *`user-management`*. -//. Моніторинг -- центральний компонент *`monitoring`*. . Monitoring - central component *`monitoring`*. ==== - + image:admin:backup-restore/backup-schedule-cluster-mgmt/cp-backup-schedule-2.png[] + [NOTE] ==== -//Розклад резервного копіювання налаштовується у форматі https://uk.wikipedia.org/wiki/Cron[*unix-cron*] та визначається за серверним часом -- https://24timezones.com/chasovyy-poyas/utc[UTC]. The backup schedule is configured in the https://uk.wikipedia.org/wiki/Cron[*unix-cron*] format and is determined by the server's time in https://24timezones.com/chasovyy-poyas/utc[UTC]. -//Якщо ви конфігуруєте розклад для України, то необхідно враховувати https://24timezones.com/%D0%9A%D0%B8%D1%97%D0%B2/%D1%87%D0%B0%D1%81[зміщення] на +2 години (`UTC+2`) у зимовий час та +3 години (`UTC+3`) у літній час. If you are configuring the schedule for Ukraine, take into account the +2 hours https://24timezones.com/%D0%9A%D0%B8%D1%97%D0%B2/%D1%87%D0%B0%D1%81[offset] (`UTC+2`) in winter time and +3 hours offset (`UTC+3`) in summer time. -//Скористайтеся ресурсом https://crontab.guru/[] -- простим та зручним редактором для виразів cron, щоб краще зрозуміти логіку налаштувань розкладу. Use the https://crontab.guru/[] resource, a simple and convenient cron expression editor, to better understand the logic of schedule settings. ==== -//. Налаштуйте розклад для компонента *Nexus* та задайте час зберігання бекапів у днях: + . Configure the schedule for the *Nexus* component and set the backup retention time in days: -//* У полі `Розклад` вкажіть, наприклад, таке значення: `5 11 * * MON-FRI`. Використовуйте пробіл як роздільник. + * In the `Schedule` field, enter, for example, the following value: `5 11 * * MON-FRI`. Use a space as a separator. + -//Це означатиме, що резервна копія для компонента `*nexus*` створюватиметься кожного дня, з понеділка по п'ятницю, об 11:05 за часом UTC (13:05 за київським часом). This means that a backup for the `*nexus*` component will be created every day from Monday to Friday at 11:05 UTC time (13:05 Kyiv time). -//* У полі `Час зберігання в днях` вкажіть, наприклад, `5`. Тобто бекап зберігатиметься у сховищі протягом 5 днів. -//TODO: How do we translate the interface elements? Is interface already translated into English so we can check? + * In the `Retention time (days)` field, enter, for example, the following value: `5`. This means that the backup will be stored in the repository for 5 days. + image:admin:backup-restore/backup-schedule-cluster-mgmt/cp-backup-schedule-3.png[] -//. Налаштуйте розклад для компонента *Control Plane* та задайте час зберігання бекапів у днях: + . Configure the schedule for the *Control Plane* component and set the backup retention time in days: -//* У полі `Розклад` вкажіть, наприклад, таке значення: `6 11 * * MON-FRI`. Використовуйте пробіл як роздільник. + * In the `Schedule` field, enter, for example, the following value: `6 11 * * MON-FRI`. Use a space as a separator. + -//Це означатиме, що резервна копія для компонента `*control-plane*` створюватиметься кожного дня, з понеділка по п'ятницю, об 11:06 за часом UTC (13:06 за київським часом). This means that a backup for the *control-plane* component will be created every day from Monday to Friday at 11:06 UTC time (13:06 Kyiv time). -//* У полі `Час зберігання в днях` вкажіть, наприклад, `6`. Тобто бекап зберігатиметься у сховищі протягом 6 днів. + * In the `Retention time (days)` field, enter, for example, the following value: `6`. This means that the backup will be stored in the repository for 6 days. + image:admin:backup-restore/backup-schedule-cluster-mgmt/cp-backup-schedule-4.png[] -//. Налаштуйте розклад для компонента *User Management* та задайте час зберігання бекапів у днях: + . Configure the schedule for the *User Management* component and set the backup retention time in days: -//* У полі `Розклад` вкажіть, наприклад, таке значення: `7 11 * * MON-FRI`. Використовуйте пробіл як роздільник. + * In the `Schedule` field, enter, for example, the following value: `7 11 * * MON-FRI`. Use a space as a separator. + -//Це означатиме, що резервна копія для компонента `*user-management*` створюватиметься кожного дня, з понеділка по п'ятницю, об 11:07 за часом UTC (13:07 за київським часом). This means that a backup for the *user-management* component will be created every day from Monday to Friday at 11:07 UTC time (13:07 Kyiv time). -//* У полі `Час зберігання в днях` вкажіть, наприклад, `7`. Тобто бекап зберігатиметься у сховищі протягом 7 днів. + * In the `Retention time (days)` field, enter, for example, the following value: `7`. This means that the backup will be stored in the repository for 7 days. + image:admin:backup-restore/backup-schedule-cluster-mgmt/cp-backup-schedule-5.png[] -//. Налаштуйте розклад для компонента *Monitoring* та задайте час зберігання бекапів у днях: + . Set up the schedule for the *Monitoring* component and specify the backup retention period in days: -//* У полі `Розклад` вкажіть, наприклад, таке значення: `7 11 * * MON-FRI`. Використовуйте пробіл як роздільник. + * In the `Schedule` field, enter, for example, the following value: `7 11 * * MON-FRI`. Use a space as a separator. + -//Це означатиме, що резервна копія для компонента `*monitoring*` створюватиметься кожного дня, з понеділка по п'ятницю, об 11:07 за часом UTC (13:07 за київським часом). + This means that a backup for the *monitoring* component will be created every day from Monday to Friday at 11:07 UTC time (13:07 Kyiv time). -//* У полі `Час зберігання в днях` вкажіть, наприклад, `8`. Тобто бекап зберігатиметься у сховищі протягом 8 днів. + * In the `Retention time (days)` field, enter, for example, the value 8. This means that the backup will be stored in the repository for 8 days + image:admin:backup-restore/backup-schedule-cluster-mgmt/cp-backup-schedule-6.png[] -//. Натисніть kbd:[ПІДТВЕРДИТИ], щоб зберегти зміни. -. Click kbd:[CONFIRM] to save the changes. + +. Click *`Confirm`* to save the changes. + -//В результаті сформується запит на оновлення зі статусом `Новий`. As a result, a request for update with the status `New` will be generated. -//. Поверніться до розділу [.underline]#Керування платформою#, прокрутіть бігунок униз сторінки та знайдіть секцію `Запити на оновлення`. -//TODO: How do we translate correctly the name of the section above? -. Go back to the [.underline]#Platform Management# section, scroll down the page, and find the `Update requests` section. + +. Go back to the [.underline]#Platform management# section, scroll down the page, and find the `Update requests` section. + image:admin:backup-restore/backup-schedule-cluster-mgmt/cp-backup-schedule-7.png[] -//. Відкрийте сформований запит, натиснувши іконку перегляду -- 👁. + . Open the generated request by clicking the view icon -- 👁. + -//NOTE: Запропоновані зміни зберігаються до конфігурації *_values.yaml_* у репозиторії *_cluster-mgmt_* у разі підтвердження. NOTE: The proposed changes will be saved to the *values.yaml* configuration file in the *cluster-mgmt* repository upon confirmation. -//. У новому вікні зіставте 2 версії змін, переконайтеся, що внесені вами дані вірні, та натисніть `Підтвердити`. Ви також можете відразу відхилити зміни до конфігурації, натиснувши `Відхилити`. + . In the new window, compare the two versions of the changes, make sure the data you entered is correct, and click `Confirm`. You can also reject the changes to the configuration immediately by clicking `Reject`. + -//TIP: У вікні для порівняння можна зручно перевірити 2 версії змін: поточну (зліва) та нову (справа). TIP: The comparison window allows you to conveniently check the two versions of the changes: the current one (on the left) and the new one (on the right). + image:admin:backup-restore/backup-schedule-cluster-mgmt/cp-backup-schedule-8.png[] + image:registry-management/cp-submit-mr/cp-submit-mr-3.png[] + -// В результаті запит набуває статусу `Підтверджено`. У встановлений час запускається Jenkins-пайплайн `*MASTER-Build-cluster-mgmt*`. Він застосовує параметри заданої конфігурації та створює резервні копії у сховищі бекапів. As a result, the request will change the state to `confirmed`. At the specified time, the `*MASTER-Build-cluster-mgmt*` Jenkins pipeline will be triggered. It applies the parameters of the specified configuration and creates backups in the backup repository. -//. Зачекайте, доки виконається збірка коду. Це може зайняти декілька хвилин. + . Wait until the code build is completed. This may take a few minutes. + -//Ви можете перевірити поточний статус та результат виконання за посиланням *`CI`* на інтерфейсі. You can check the current status and execution result by clicking the *`CI`* link on the interface. + image:admin:backup-restore/backup-schedule-cluster-mgmt/cp-backup-schedule-9.png[] + image:admin:backup-restore/backup-schedule-cluster-mgmt/cp-backup-schedule-10.png[] -//== Перевірка створених бекапів == Checking the created backups -//У визначену дату та час мають бути створені резервні копії, згідно із розкладом, вказаним у конфігурації (_див. -- xref:#schedule-setup[]_). At the specified date and time, backups should be created according to the schedule specified in the configuration (see -- xref:#schedule-setup[]_). -// Перевірити це можна наступним чином: :: You can check this as follows: :: -//. Увійдіть до Openshift-консолі як адміністратор Платформи. -//TODO: How do we write Platform Administrator or Platform administrator? . Log in to the Openshift console as the Platform administrator. -//. Отримайте API-токен для доступу до кластера через `oc login`: . Obtain an API token for cluster access via `oc login`: -//* Натисніть `*Copy Login Command*`. + * Click `*Copy login command*`. + image:admin:backup-restore/backup-schedule-cluster-mgmt/cp-backup-schedule-11.png[] -//* Увійдіть через *Keycloak*. + * Log in through *Keycloak*. + image:admin:backup-restore/backup-schedule-cluster-mgmt/cp-backup-schedule-12.png[] -//* Натисніть `*Display Token*` (показати токен). + * Click `*Display Token*`. + image:admin:backup-restore/backup-schedule-cluster-mgmt/cp-backup-schedule-13.png[] -//* Скопіюйте `oc login` API-токен. + * Copy the `oc login` API token. + image:admin:backup-restore/backup-schedule-cluster-mgmt/cp-backup-schedule-14.png[] -//. Відкрийте термінал/консоль, вставте отриманий токен та виконайте вхід. + . Open a terminal/console, paste the obtained token, and execute the login. + image:admin:backup-restore/backup-schedule-cluster-mgmt/cp-backup-schedule-15.png[] -//. Отримайте список бекапів за допомогою команди: + . Retrieve the list of backups using the command: + [source,bash] @@ -226,19 +174,13 @@ image:admin:backup-restore/backup-schedule-cluster-mgmt/cp-backup-schedule-15.pn velero get backups ---- + -//В результаті отримуємо список бекапів центральних компонентів, а саме їх назви, статуси, дату та час створення, а також час, протягом якого ці бекапи зберігатимуться у сховищі. As a result, you will get a list of backups for central components, including their names, statuses, creation dates and times, as well as the retention period for these backups in the repository. + image:admin:backup-restore/backup-schedule-cluster-mgmt/cp-backup-schedule-16.png[] + -//[NOTE] -//==== -//Зверніть увагу, що час створення бекапів показано не серверний (UTC), а цільовий, зі зміщенням (UTC+2, за Києвом). -//==== [NOTE] ==== Note that the backup creation time is shown in the target time zone (UTC+2, Kyiv time), not the server time (UTC). +==== -//IMPORTANT: Після закінчення строку зберігання, система бекапування видаляє застарілі резервні копії. -IMPORTANT: After the retention period expires, the backup system deletes outdated backups. - +IMPORTANT: After the retention period expires, the backup system deletes outdated backups. \ No newline at end of file diff --git a/docs/en/modules/admin/pages/backup-restore/backup-schedule-registry-components.adoc b/docs/en/modules/admin/pages/backup-restore/backup-schedule-registry-components.adoc index 98e9e953a5..d0d8c29177 100644 --- a/docs/en/modules/admin/pages/backup-restore/backup-schedule-registry-components.adoc +++ b/docs/en/modules/admin/pages/backup-restore/backup-schedule-registry-components.adoc @@ -1,192 +1,131 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Setting up the registry components backup schedule and retention time +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] + +include::platform:ROOT:partial$admonitions/language-en.adoc[] -//== Загальний опис == General description -//Платформа надає можливість [.underline]#керувати розкладом створення резервних копій компонентів реєстру, а також часом зберігання таких копій у сховищі бекапів#. The platform provides the ability to [.underline]#manage the schedule for creating backup copies of registry components and the time span for storing such copies in the backup repository#. -//Резервні копії компонентів створюються за допомогою інструменту *`velero`* та зберігаються у захищеному сховищі бекапів *`minio`*, що знаходиться поза межами кластера Платформи. Backup copies of components are created using the *`velero`* tool and stored in a secure *`minio`* backup repository located outside the Platform cluster. -//[NOTE] -//==== -//Розклад резервного копіювання налаштовується у форматі https://uk.wikipedia.org/wiki/Cron[*unix-cron*] на інтерфейсі адміністративної панелі *Control Plane*. - -//Період зберігання резервних копій має бути більшим за або дорівнювати одиниці, бути цілим числом та не містити спеціальних символів. -//==== [NOTE] ==== The backup schedule is configured in the https://uk.wikipedia.org/wiki/Cron[*unix-cron*] format on the *Control Plane* administrative panel interface. The retention period for backup copies must be greater than or equal to one unit, be a whole number, and not contain special characters. ==== -//// -TODO: Need this section? -Перелік компонентів реєстру, для яких налаштовується резервне копіювання за розкладом та час зберігання резервних копій: :: - -* [*] [.underline]#Портал управління бізнес-процесами реєстру# -- компонент `*bp-admin-portal*`. -* [*] [.underline]#Кабінет отримувача послуг# -- компонент `*citizen-portal*`. -* [*] [.underline]#Кабінет посадової особи# -- компонент `*officer-portal*`. -* [*] [.underline]#Система перевірки та версіонування коду# -- реєстровий компонент `*gerrit*`. -* [*] [.underline]#Система збірки та розгортання змін на середовищах# -- реєстровий компонент `*jenkins*`. -* [*] [.underline]#Система управління ідентифікацією користувачів реєстру та правами доступу# -- реєстровий компонент *keycloak*. -* [*] [.underline]#Сховище артефактів# -- реєстровий компонент *`nexus`*. -//// - -//Значення зберігаються до конфігурації реєстру у файл *_deploy-templates/values.yaml_*. + The values are stored in the registry configuration *_deploy-templates/values.yaml_* file. -//Відповідні параметри застосовуються завдяки Jenkins-пайплайну *`Create-registry-backup-`*. The corresponding parameters are applied through the *`Create-registry-backup-`* Jenkins pipeline. [#schedule-setup] -//== Налаштування розкладу == Setting up a schedule -//. Увійдіть до консолі *Control Plane* як адміністратор реєстру. -//TODO: How do we translate correctly into English the interface controls that are in Ukrainian as in the below example? + how do we write Registry Administrator? +include::partial$templates/snippets/backup-restore-planning-en.adoc[] + . Log in to the *Control Plane* console as the Registry administrator. + image:admin:infrastructure/cluster-mgmt/update-cluster-mgmt-01.png[] -//. Перейдіть до розділу [.underline]#Реєстри# та оберіть необхідний. + . Go to the [.underline]#Registries# section and select the required one. + image:admin:infrastructure/cluster-mgmt/change-key/change-key-01.png[] -//. Натисніть кнопку `Редагувати`, що розташована у правому верхньому куті. + . Click the `Edit` button located in the upper right corner. + -//NOTE: Налаштування розкладу резервного копіювання та часу зберігання резервних копій доступне також при створенні реєстру, та не є обовʼязковим. NOTE: You can also set up a backup schedule and retention time while creating a registry. However, it is not mandatory. - + image:admin:infrastructure/cluster-mgmt/change-key/change-key-02.png[] -//. Перейдіть до секції [.underline]#Резервне копіювання#. Тут можна встановити розклад створення резервних копій та період зберігання. Активуйте перемикач та налаштуйте розклад створення автоматичних резервних копій. + . Go to the [.underline]#Backup# section. Here you can set the schedule for creating backup copies and the retention period. Turn the toggle on and configure the schedule for creating automatic backup copies. + -//TIP: За замовчуванням налаштування автоматичних резервних копій вимкнено для нових реєстрів. -//TODO: How do we translate the name of this toggle into English? Is this interface element already translated? TIP: By default, the *Set automatic backup copy* toggle is turned off for new registries. - + image:admin:backup-restore/backup-schedule-registry-components/backup-schedule-registry-components-01.png[] + [NOTE] ==== -//Розклад резервного копіювання налаштовується у форматі https://uk.wikipedia.org/wiki/Cron[*unix-cron*] та визначається [.underline]#за київським часом#. The backup schedule is configured in the https://uk.wikipedia.org/wiki/Cron[*unix-cron*] format and is defined based on [.underline]#Kyiv time#. -//За замовчуванням часовий пояс `*Europe/Kiev*` встановлюється у конфігурації _values.yaml_ та на рівні поди з Jenkins як змінна середовища. By default, the `*Europe/Kiev*` time zone is set in the _values.yaml_ configuration and at the Jenkins pod level as an environment variable. -//Враховується https://24timezones.com/%D0%9A%D0%B8%D1%97%D0%B2/%D1%87%D0%B0%D1%81[зміщення] на +2 години (`UTC+2`) у зимовий та +3 години (`UTC+3`) у літній час. The https://24timezones.com/%D0%9A%D0%B8%D1%97%D0%B2/%D1%87%D0%B0%D1%81[offset] of +2 hours (`UTC+2`) in winter and +3 hours (`UTC+3`) in summer is taken into account. -//Скористайтеся ресурсом https://crontab.guru/[] -- простим та зручним редактором для виразів cron, щоб краще зрозуміти логіку налаштувань розкладу. Use the https://crontab.guru/[] resource, a simple and convenient cron expression editor, to better understand the logic of schedule settings. ==== -//* У полі `Розклад` вкажіть, наприклад, таке значення: `5 10 * * MON-FRI`. Використовуйте пробіл як роздільник. -* In the `Schedule` field, enter, for example, the following value: `5 11 * * MON-FRI`. Use a space as a separator. + +* In the `Schedule` field, enter, for example, the following value: `5 11 * * MON-FRI`. Use space as a separator. + -//Це означатиме, що резервна копія для середовища реєстру створюватиметься кожного дня, з понеділка по п'ятницю, о 10:05 за київським часом. -//TODO: Kiev or Kyiv? This means that a backup copy for the registry environment will be created every day from Monday to Friday at 10:05 according to Kyiv time. + -//TIP: Після введення розкладу резервного копіювання, на інтерфейсі з'являється підказка, яка показує час 3-х наступних запусків створення резервних копій. TIP: After entering the backup schedule, a hint appears on the interface showing the time of the next 3 backup creation runs. -//* У полі `Час зберігання (днів)` вкажіть, наприклад, `5`. Тобто бекап зберігатиметься у сховищі протягом 5 днів. -//TODO: Interface element above name in English? + * In the `Retention time (days)` field, enter, for example, the following value: `5`. This means that the backup will be stored in the repository for 5 days. + -//NOTE: Значення може бути лише додатним числом та не меншим за 1 день. Рекомендуємо встановити час збереження більшим за період між створенням копій. NOTE: The value can only be a positive number and should not be set to less than 1 day. It is recommended to set the retention time longer than the period between creating copies. - + image:admin:backup-restore/backup-schedule-registry-components/backup-schedule-registry-components-02.png[] -//. Натисніть kbd:[ПІДТВЕРДИТИ], щоб зберегти зміни. + . Click kbd:[CONFIRM] to save the changes. + -//В результаті сформується запит на оновлення зі статусом `Новий`. As a result, a request for update with the status `New` will be generated. -//. Поверніться до розділу `Реєстри`, прокрутіть бігунок униз сторінки та знайдіть секцію `Запити на оновлення`. -//TODO: How to properly translate the names of the interface elements above? + . Go back to the `Registries` section, scroll down the page, and find the `Requests for update` section. + image:registry-management/cp-submit-mr/cp-submit-mr-1.png[] -//. Відкрийте сформований запит, натиснувши іконку перегляду -- 👁. + . Open the generated request by clicking the view icon -- 👁. + -//NOTE: Запропоновані зміни вносяться до конфігурації файлу *_deploy-templates/values.yaml_* у разі підтвердження. NOTE: The proposed changes will be applied to the *_deploy-templates/values.yaml_* configuration file upon confirmation. -//. У новому вікні зіставте 2 версії змін, переконайтеся, що внесені вами дані вірні, та натисніть kbd:[Підтвердити]. Ви також можете відразу відхилити зміни до конфігурації, натиснувши kbd:[Відхилити]. + . In the new window, compare the two versions of the changes, make sure the data you entered is correct, and click kbd:[Confirm]. You can also reject the changes to the configuration immediately by clicking kbd:[Reject]. + -//TIP: У вікні для порівняння можна зручно перевірити 2 версії змін: поточну (зліва) та нову (справа). TIP: The comparison window allows you to conveniently check the two versions of the changes: the current one (on the left) and the new one (on the right). - + -image:admin:backup-restore/backup-schedule-registry-components/backup-schedule-registry-components-6.png[] +image:admin:backup-restore/backup-schedule-registry-components/backup-schedule-registry-components-12.png[] + image:registry-management/cp-submit-mr/cp-submit-mr-3.png[] + -//У результаті запит набуває статусу `Підтверджено`. У встановлений час запускається Jenkins-пайплайн *`Create-registry-backup-`*. Він застосовує параметри заданої конфігурації та створює резервні копії у сховищі бекапів. As a result, the request will change the state to `confirmed`. At the specified time, the *`Create-registry-backup-`* Jenkins pipeline will be triggered. It applies the parameters of the specified configuration and creates backups in the backup repository. -//. Зачекайте, доки виконається збірка коду. Це може зайняти декілька хвилин. + . Wait until the code build is completed. This may take a few minutes. -//== Перевірка створених бекапів == Checking the created backups -//У визначену дату та час мають бути створені резервні копії, згідно із розкладом, вказаним у конфігурації (_див. -- xref:#schedule-setup[]_). At the specified date and time, backups should be created according to the schedule specified in the configuration (_see --xref:#schedule-setup[]_) -//Перевірити це можна наступним чином: :: You can check this as follows: :: + -//. У відомостях про реєстр відкрийте секцію [.underline]#Компоненти реєстру# та перейдіть до *Jenkins*. -//TODO: What is the correct English name of the above interface section? + . In the registry information, open the [.underline]#Registry components# section and navigate to *Jenkins*. + image:admin:backup-restore/backup-schedule-registry-components/backup-schedule-registry-components-1.png[] -//. Перейдіть до теки з необхідним реєстром та оберіть пайплайн *`Create-registry-backup-`*. Якщо пайплайн підсвічується зеленим, то збірку можна вважати успішною. + . Go to the folder with the corresponding registry and select the *`Create-registry-backup-`* pipeline. If the pipeline is highlighted in green, the build can be considered successful. + image:admin:backup-restore/backup-schedule-registry-components/backup-schedule-registry-components-2.png[] -//. Відкрийте деталі збірки. + . Open the build details. + image:admin:backup-restore/backup-schedule-registry-components/backup-schedule-registry-components-3.png[] -//. Перейдіть до виводу консолі (`*Console Output*`), щоб переглянути технічний лог виконання пайплайну. -//TODO: Should we leave below Console Output two times? + . Go to the console output (`*Console Output*`) to view the technical log of the pipeline execution. + image:admin:backup-restore/backup-schedule-registry-components/backup-schedule-registry-components-4.png[] -//. Прокрутіть бігунок униз сторінки та переконайтеся, що резервну копію реєстру створено. + . Scroll down the page and make sure that the registry backup has been created. + -.Console Output. Успішне створення резервної копії реєстру .Console Output. Successful creation of registry backup - ==== ---- [INFO] Velero backup - external-1-2023-02-17-17-07-36 done with Completed status ---- -//Вираз показує, що створено резервну копію для реєстру із певною назвою (_тут_ -- `external-1`), дату та час створення бекапу та статус успішного завершення. + This expression indicates that a backup has been created for the registry with a specific name (_here_ - `external-1`), the date and time of backup creation, and the successful completion status. ==== + image:admin:backup-restore/backup-schedule-registry-components/backup-schedule-registry-components-5.png[] - + -//IMPORTANT: Після закінчення строку зберігання, система бекапування видаляє застарілі резервні копії. -IMPORTANT: After the retention period expires, the backup system deletes outdated backup copies. +IMPORTANT: After the retention period expires, the backup system deletes outdated backup copies. \ No newline at end of file diff --git a/docs/en/modules/admin/pages/backup-restore/control-plane-backup-restore.adoc b/docs/en/modules/admin/pages/backup-restore/control-plane-backup-restore.adoc index 5a97344160..1e42fc0c93 100644 --- a/docs/en/modules/admin/pages/backup-restore/control-plane-backup-restore.adoc +++ b/docs/en/modules/admin/pages/backup-restore/control-plane-backup-restore.adoc @@ -1,86 +1,99 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Manually backing up and restoring the registry +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] + +include::platform:ROOT:partial$admonitions/language-en.adoc[] == Backing up registry -//Після успішного розгортання реєстру та регламентів адміністратор Платформи має можливість створити резервну копію реєстру, що буде збережена до захищеного сховища бекапів (для прикладу, Minio). -After a successful deployment of the registry and regulations, the Platform administrator can create a backup of the registry, which will be stored in a secure backup repository (for example, Minio). +include::partial$templates/snippets/backup-restore-planning-en.adoc[] -//Для цього необхідно виконати наступні кроки: -To back up a registry this, follow these steps: +After a successful deployment of the registry and regulations, the Platform administrator can create a backup of the registry, which will be stored in a secure backup repository—*MinIO*. -//* Увійдіть до **Control Plane**, використовуючи створені попередньо створені логін та пароль. -* Log in to the **Control Plane** using the previously created login and password. -//* Перейдіть до розділу **Реєстри** та оберіть реєстр для резервного копіювання. -* Go to the **Registries** section and select the registry for backup. -//* Перейдіть до секції **Конфігурація** на сторінці xref:admin:registry-management/control-plane-view-registry.adoc#sections[Перегляд конфігурації створеного реєстру], натисніть на посилання до Jenkins (**CI**) Платформи та у вкладці **Всі** (**All**) знайдіть job із назвою `Create-registry-backup-backup-test` (див. зображення нижче). -//TODO: У програмі, замість назви підсторінки "Перегляд конфігурації створеного реєстру" я бачу табу "Інформація про реєстр", і нижче переклала її саме так. -* Go to the **Configuration** section at the xref:admin:registry-management/control-plane-edit-registry.adoc#sections[Registry information] tab, click on the link under **CI** to open Jenkins, navigate to the *All* tab, and find the job named `Create-registry-backup-backup-test` (see the image below). +To back up a registry this, follow these steps: :: -//TIP: Детальніше -- див. xref:admin:registry-management/control-plane-view-registry.adoc#registry-deploy-status[Перевірка відомостей про розгортання реєстру]. -//TODO: Can I translate the below page name in such a way? How do I check the reference at the below address? -TIP: For more details, see xref:admin:registry-management/control-plane-edit-registry.adoc#registry-deploy-status[Checking registry deployment details] +. Log in to the **Control Plane** using the previously created login and password. -image:backup-restore/registry/control-plane-create-backup-job.png[] +. Go to the **Registries** section and select the registry for backup. -//* Відкрийте job та натисніть `Зібрати з параметрами`, щоб запустити `Create-registry-backup-backup-test` job. -* Open the job and click `Build with Parameters` to launch the `Create-registry-backup-backup-test` job. +. Open the **Configuration** section at the xref:admin:registry-management/control-plane-edit-registry.adoc#sections[Registry information] tab, click on the link under *CI* to open Jenkins, navigate to the *All* tab, and find the job named *Create-registry-backup-``* where `` means the name for your registry (_see the image below_). ++ +TIP: For more details on Jenkins jobs, see xref:admin:registry-management/control-plane-edit-registry.adoc#registry-deploy-status[Checking registry deployment details] ++ +image:backup-restore/registry/control-plane-create-backup-job.png[] +. Open the job and click *`Build with Parameters`* to launch the *Create-registry-backup* pipeline. ++ image:backup-restore/registry/control-plane-create-backup-01.png[] -//* Натисніть `Зібрати`. -* Click `Build`. - +. Click *`Build`*. ++ image:backup-restore/registry/control-plane-create-backup-02.png[] ++ image:backup-restore/registry/control-plane-create-backup-03.png[] ++ +If the job is successfully executed, a backup of the registry with its regulations is created and uploaded to the corresponding backup repository directory. + +[WARNING] +==== +Backup replication of S3 buckets:: + +After the backup creation pipeline has run, it establishes bucket replication pipelines. These pipelines are scheduled to run at 19:30 (UTC) by default. If you need to launch the pipeline earlier, you can manually modify this schedule: + +. Log into OKD. +. In the top-right corner, click Copy login command > Display Token. +. In the *Log in with this token* field, copy the token to log into OpenShift through the terminal. It might look like this: ++ +.Example of oc login +[source,bash] +---- +oc login --token=sha256~gQa0bxg_aaabbbcccd_D88470E-aabBcQuCn9keIM4I --server=https://api.envone.dev.registry.eua.gov.ua:1234 +---- + +. Open the *OpenShift CLI* and execute the copied command. ++ +[TIP] +For more information about *OpenShift CLI*, refer to the guide xref:registry-develop:study-project/index.adoc#preconditions-setup[Getting Started Preparations]. + +. Start the replication backups of the S3 buckets with the schedule desired by the user. To do this, run the following command: ++ +[source,bash] +---- +namespace="abc-02";schedule='19 12 * * *'; for cronJob in `oc get cronjob -n velero -o custom-columns="NAME:.metadata.name" --no-headers | grep "${namespace}"`;do oc -n velero patch cronjob/$cronJob -p '{"spec":{"schedule":"'$schedule'"}}'; echo 1;done +---- ++ +NOTE: Replace the value `namespace="abc-02"` with the name of your registry. For example, `namespace="test-registry"`. + +TIP: Also, familiarize yourself with the settings for automatic setup of S3 bucket replications on the page xref:admin:backup-restore/backup-schedule-registry-components.adoc[]. +==== -//* У разі успішного виконання job, створюється резервна копія реєстру з регламентом та завантажується до відповідної директорії сховища бекапів. -* If the job is successfully executed, a backup of the registry with its regulations is created and uploaded to the corresponding backup repository directory. +== Restoring registry -// image:admin:backup-restore-minio1.png[] +To restore a registry from the created backup, follow these steps: :: -//== Відновлення реєстру (Restore) -== Restoring registry +. Log in to the **Control Plane** using the previously created login and password. -//* Увійдіть до **Control Plane**, використовуючи створені попередньо логін та пароль. -* Login to the **Control Plane** using the previously created login and password. -//* Перейдіть до розділу **Реєстри** та оберіть реєстр, який необхідно відновити. -* Go to the **Registries** section and select the Registry that needs to be restored. -//* Перейдіть до Jenkins (CI) платформи та у вкладці **Всі** (**All**) знайдіть `Restore-registry-backup-test` job (див. зображення нижче). -* Go to the **Configuration** section, click on the link under **CI** to open Jenkins, navigate to the *All* tab, and find the `Restore-registry-backup-test` job (see the image below). +. Go to the **Registries** section and select the Registry that needs to be restored. +. Go to the **Configuration** section, click on the link under **CI** to open Jenkins, navigate to the *All* tab, and find the *Restore-registry-``* job, where `` means the name for your registry (_see the image below_). ++ image:backup-restore/registry/control-plane-create-restore.png[] -//* Відкрийте job та натисніть `Зібрати з параметрами`, щоб запустити `Restore-registry-backup-backup-test` job. -* Open the job and click `Build with Parameters` to launch the `Restore-registry-backup-backup-test` job. - +. Open the job and click *`Build with Parameters`* to launch the *Restore-registry* pipeline. ++ image:backup-restore/registry/control-plane-create-restore-01.png[] -//* Натисніть `Зібрати`. -* Click `Build`. - +. Click `Build`. ++ image:backup-restore/registry/control-plane-create-restore-02.png[] -//* Далі, на кроці введення параметрів, оберіть версію резервної копії для відновлення. Для цього перейдіть до виводу консолі (Секція **Console Output** на панелі зліва) та натисніть `Input Requested`. -* Next, in the parameter input step, select the backup version to restore. To do this, go to the console output (the **Console Output** section on the left panel) and click `Input Requested`. - +. Next, in the parameter input step, select the backup version to restore. To do this, go to the *Console Output* section on the left panel and click *`Input Requested`*. ++ image:backup-restore/registry/control-plane-create-restore-03.png[] -//* Оберіть версію резервної копії зі списку та натисніть `Proceed`. -* Select the backup version from the list and click `Proceed`. - +. Select the backup version from the list and click *`Proceed`*. ++ image:backup-restore/registry/control-plane-create-restore-04.png[] - -//* У разі успішного виконання job `Restore-registry-backup-test`, реєстр буде відновлено до стану обраної версії резервної копії. -* If the `Restore-registry-backup-test` job is successfully executed, the registry will be restored to the selected backup version. - ++ +If the *Restore-registry* pipeline is successfully executed, the registry will be restored to the selected backup version. ++ image:backup-restore/registry/control-plane-create-restore-05.png[] \ No newline at end of file diff --git a/docs/en/modules/admin/pages/backup-restore/control-plane-components-backup-restore.adoc b/docs/en/modules/admin/pages/backup-restore/control-plane-components-backup-restore.adoc index 2bdce39a28..314059941d 100644 --- a/docs/en/modules/admin/pages/backup-restore/control-plane-components-backup-restore.adoc +++ b/docs/en/modules/admin/pages/backup-restore/control-plane-components-backup-restore.adoc @@ -1,131 +1,105 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Manual backing up and restoring central components +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] + +include::platform:ROOT:partial$admonitions/language-en.adoc[] -//== Бекап центральних компонентів (резервне копіювання) == Central components backup -//Адміністратор Платформи має можливість створити резервну копію центральних компонентів, що буде збережена до захищеного сховища бекапів (для прикладу, Minio). -The platform administrator has the ability to create a backup of central components, which will be stored in a secure backup repository (for example, Minio). +include::partial$templates/snippets/backup-restore-planning-en.adoc[] -//*Для цього необхідно виконати наступні кроки:* -*To do this, follow these steps:* +The platform administrator has the ability to create a backup of central components, which will be stored in a secure backup repository—*MinIO*. -//* Виконайте логін до OpenShift відповідного кластера. -* Log into the OpenShift of the respective cluster. -//* Скопіюйте команду для логіна – на вкладці профайлу користувача натисніть кнопку `Copy Login Command`: -* Copy the login command—click the *Copy login command* button under the user profile name: -image:admin:backup-restore/central/backup-restore-central-copy-login-command.png[] +Follow these steps to create a backup: :: -//* Після переадресації на сторінку показу токена, натисніть на посилання `Display Token`: -* After being redirected to the token display page, click the `Display Token` link: +. Log into the OpenShift of the respective cluster. -image:admin:backup-restore/central/backup-restore-oauth-display-token.png[] +. Copy the login command—click the *`Copy login command`* button under the user profile name. ++ +image:admin:backup-restore/central/backup-restore-central-copy-login-command.png[] -//* Скопіюйте токен доступу до **OpenShift** відповідного кластера, куди буде виконане резервне копіювання: -* Copy the access token to the **OpenShift** of the cluster into which the backup will be performed: +. After being redirected to the token display page, click the *`Display Token`* link. ++ +image:admin:backup-restore/central/backup-restore-oauth-display-token.png[] +. Copy the access token to the **OpenShift** of the cluster into which the backup will be performed. ++ image:admin:backup-restore/central/backup-restore-openshift-token.png[] -//* Відкрийте **Git Bash**, вставте скопійований токен та натисніть `Enter`: -* Open **Git Bash**, paste the copied token, and press `Enter`: - +. Open **Git Bash**, paste the copied token, and press `Enter`. ++ [source,bash] ---- $ oc login --token=sha256~NyHYErh_JwJQаааааyIfmbbE-UY_Y3s_diQG422v9Rw --server=https://api.backup.mdtu-ddm.projects.epam.com:6443 ---- -//* Для перевірки наявних резервних копій, виконайте наступну команду: -* To check for existing backups, execute the following command: - +. To check for existing backups, execute the following command: ++ [source,bash] ---- $ velero get backups ---- -//* Для створення нової резервної копії, виконайте наступну команду: -* To create a new backup, execute the following command: - +. To create a new backup, execute the following command: ++ [source,bash] ---- $ velero backup create control-plane-nexus-release1-4-backup-28-10 --include-namespaces control-plane-nexus --ttl 120h ---- - -//TIP: де: + -//- `control-plane-nexus-release1-4-backup-28-10` -- назва папки у сховищі, де зберігатиметься резервна копія (для зручності вказана назва кластера та дата створення бекапу); + -//- `control-plane-nexus` -- назва центрального компонента, для якого буде виконане резервне копіювання; + -//- `--ttl 120h` -- час зберігання резервної копії. - -TIP: where: + -- `control-plane-nexus-release1-4-backup-28-10` -- is the folder name in the backup repository where the backup will be stored (the cluster name and backup creation date are provided for convenience); + -- `control-plane-nexus` -- is the name of the central component for which the backup will be performed; + -- `--ttl 120h` -- is the backup retention time. - -//* Для перевірки того, що резервна копія успішно створена, виконайте таку команду: -* To verify if the backup has been successfully created, execute the following command: - ++ +[TIP] +==== +where: + +* `control-plane-nexus-release1-4-backup-28-10` — is the folder name in the backup repository where the backup will be stored (_the cluster name and backup creation date are provided for convenience_); + +* `control-plane-nexus` -- is the name of the central component for which the backup will be performed; + +* `--ttl 120h` -- is the backup retention time. +==== + +. To verify if the backup has been successfully created, execute the following command: ++ [source,bash] ---- $ velero backup get ---- ++ image:admin:backup-restore/central/backup-restore-central-get.png[] ++ +[TIP] +==== +where: -//TIP: де: + -//- Status `New` -- запит на створення копії новий і знаходиться в черзі. + -//- Status `InProgress` -- копія в процесі створення. + -//- Status `Completed` -- копія створена. - -TIP: where: + -- Status `New` -- the backup request is new and is in the queue + -- Status `InProgress` -- the backup creation is in progress + -- Status `Completed` -- the backup has been created. -//// -Створені резервні копії центральних компонентів можна також перевірити у *Minio Console* у розділі *Buckets* - -image:admin:backup-restore/central/backup-restore-minio.png[] -//// +* Status `New` -- the backup request is new and is in the queue + +* Status `InProgress` -- the backup creation is in progress + +* Status `Completed` -- the backup has been created. +==== [buckup-bucket-delete] -//=== Видалення резервної копії зі сховища -=== Deletion of backup from storage -//Для видалення резервної копії, виконайте наступну команду: -To delete a backup from storage, execute the following command: +=== Deleting backup from storage + +Execute the following command to delete a backup from storage: [source,bash] ---- $ velero backup delete control-plane-nexus-release1-4-backup-28-10 ---- -//TIP: де `control-plane-nexus-release1-4-backup-28-10` -- назва резервної копії, яку необхідно видалити. - -TIP: `control-plane-nexus-release1-4-backup-28-10` -- is the name of the backup to be deleted. +TIP: where the `control-plane-nexus-release1-4-backup-28-10` is the name of the backup to be deleted. -//== Відновлення центральних компонентів (Restore) == Central components restoring -//CAUTION: Перед виконанням процесу відновлення центральних компонентів переконайтеся, що створена їх резервна копія та ці компоненти видалені. CAUTION: Before starting the process of restoring the central components, ensure that their backup has been created and these components have been removed. -//Для того, щоб відновити центральний компонент, для якого була створена його резервна копія, виконайте наступну команду: -To restore a central component for which the backup has been created, execute the following command: +Execute the following command to restore a central component for which the backup has been created: [source,bash] ---- $ velero restore control-plane-nexus --from-backup control-plane-nexus-backup-25-10 ---- -//TIP: де: + -//- `control-plane-nexus` -- назва центрального компонента, який буде відновлюватись; + -//- `backup control-plane-nexus-backup-25-10` -- назва папки у сховищі, де зберігається резервна копія, і з якої буде відновлюватися центральний компонент. +[TIP] +==== +where: -TIP: where: + -- `control-plane-nexus` -- is the name of the central component to be restored; + -- `backup control-plane-nexus-backup-25-10` -- is the folder name in the backup repository where the backup is stored and from which the central component will be restored. \ No newline at end of file +* `control-plane-nexus` -- is the name of the central component to be restored; + +* `backup control-plane-nexus-backup-25-10` -- is the folder name in the backup repository where the backup is stored and from which the central component will be restored. +==== \ No newline at end of file diff --git a/docs/en/modules/admin/pages/installation/okd-requirements.adoc b/docs/en/modules/admin/pages/installation/okd-requirements.adoc index ba50069794..983351e227 100644 --- a/docs/en/modules/admin/pages/installation/okd-requirements.adoc +++ b/docs/en/modules/admin/pages/installation/okd-requirements.adoc @@ -3,6 +3,8 @@ include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc include::platform:ROOT:partial$admonitions/language-en.adoc[] +*_OKD_* refers to the Kubernetes community distribution developed under Red Hat's guidance. It's an open project that provides a platform for deploying, managing, and scaling containerized applications. More information can be found on the official website https://www.okd.io/[OKD] and in the https://www.okd.io/docs/[documentation]. + Deploying the Platform for state registries into production requires officially supported virtual infrastructures. At present, these infrastructures include recognized cloud services like https://aws.amazon.com/[Amazon Web Services (AWS)], https://azure.microsoft.com/[Microsoft Azure (Azure)], https://cloud.google.com/[Google Cloud Platform (GCP)], and https://www.vmware.com/products/vsphere.html[VMWare vSphere]. These infrastructures should have an OKD cluster installed to ensure optimal compatibility and functionality. The version of this cluster needs to align with the Platform's specific requirements, as outlined below. diff --git a/docs/en/modules/admin/pages/installation/platform-deployment/platform-aws-deployment.adoc b/docs/en/modules/admin/pages/installation/platform-deployment/platform-aws-deployment.adoc index 30fc03d9e3..5181370fc8 100644 --- a/docs/en/modules/admin/pages/installation/platform-deployment/platform-aws-deployment.adoc +++ b/docs/en/modules/admin/pages/installation/platform-deployment/platform-aws-deployment.adoc @@ -320,7 +320,7 @@ This is necessary to download the generated pull secret later, as described in x To successfully install the cluster and Platform, you need AWS to run additional resources. The following figure shows them within the infrastructure. -image:installation/aws/installation-aws-1.png[image,width=468,height=375] +image:installation/aws/installation-aws-1.svg[image,width=468,height=375] //Це можна зробити самостійно за рекомендаціями зазначеними нижче або використати підготовлений Terraform-код. @@ -1520,14 +1520,16 @@ $ mkdir ~/installer $ cd ~/installer -$ sudo aws s3 cp --profile cross-account-role s3://mdtu-ddm-platform-installer//mdtu-ddm-platform-.zip mdtu-ddm-platform-.zip +$ sudo aws s3 cp --profile cross-account-role s3://mdtu-ddm-platform-installer//mdtu-ddm-platform-.tar.gz mdtu-ddm-platform-.tar.gz ---- //. Розпакуйте Інсталер в окрему директорію. . Unpack the Installer to a separate directory. + [source,bash] ---- -$ unzip mdtu-ddm-platform-(version).zip -d ./installer- +$ mkdir installer- + +$ tar -xf mdtu-ddm-platform-(version).tar.gz -C ./installer- ---- //. Перенесіть *_kubeconfig_* від встановленого кластера. . Copy *_kubeconfig_* from the installed cluster. @@ -1595,7 +1597,6 @@ $ sudo docker run --rm \ --env KUBECONFIG=/tmp/installer/kubeconfig \ --env idgovuaClientId=f90ab33dc272f047dc330c88e5663b75 \ --env idgovuaClientSecret=cba49c104faac8c718e6daf3253bc55f2bf11d9e \ - --env CUSTOM_INGRESS_CIDRS='["0.0.0.0/0", "85.223.209.0/24"]' \ --env deploymentMode= \ --entrypoint "/bin/sh" control-plane-installer: \ -c "./install.sh -i" @@ -1682,14 +1683,16 @@ $ mkdir ~/installer $ cd ~/installer -$ sudo aws s3 cp --profile cross-account-role s3://mdtu-ddm-platform-installer//mdtu-ddm-platform-.zip mdtu-ddm-platform-.zip +$ sudo aws s3 cp --profile cross-account-role s3://mdtu-ddm-platform-installer//mdtu-ddm-platform-.tar.gz mdtu-ddm-platform-.tar.gz ---- //. Розпакуйте Інсталер в окрему директорію. . Unpack the Installer to a separate directory. + [source,bash] ---- -$ unzip mdtu-ddm-platform-(version).zip -d ./installer- +$ mkdir installer- + +$ tar -xf mdtu-ddm-platform-(version).tar.gz -C ./installer- ---- //. Перенесіть *_kubeconfig_* від встановленого кластера. . Copy *_kubeconfig_* from the installed cluster. @@ -1779,7 +1782,6 @@ $ sudo docker run --rm \ --env KUBECONFIG=/tmp/installer/kubeconfig \ --env idgovuaClientId=f90ab33dc272f047dc330c88e5663b75 \ --env idgovuaClientSecret=cba49c104faac8c718e6daf3253bc55f2bf11d9e \ - --env CUSTOM_INGRESS_CIDRS='["0.0.0.0/0", "85.223.209.0/24"]' \ --env deploymentMode= \ --entrypoint "/bin/sh" control-plane-installer: \ -c "./install.sh -u" @@ -1963,7 +1965,6 @@ $ sudo docker run -it --rm \ --env KUBECONFIG=/tmp/installer/kubeconfig \ --env idgovuaClientId=f90ab33dc272f047dc330c88e5663b75 \ --env idgovuaClientSecret=cba49c104faac8c718e6daf3253bc55f2bf11d9e \ - --env CUSTOM_INGRESS_CIDRS='["0.0.0.0/0", "85.223.209.0/24"]' \ --env deploymentMode= control-plane-installer: bash ---- @@ -2020,4 +2021,4 @@ This error is related to *skopeo*, a tool that sends images to Nexus. If the ima //Виконувати встановлення Платформи із додаткової віртуальної машини, як описано в п. xref:#deploy-additional-recources-for-okd[]. -Install the Platform from an additional virtual machine as described in xref:#deploy-additional-resources-for-okd[]. \ No newline at end of file +Install the Platform from an additional virtual machine as described in xref:#deploy-additional-resources-for-okd[]. diff --git a/docs/en/modules/admin/pages/installation/platform-deployment/platform-vsphere-deployment.adoc b/docs/en/modules/admin/pages/installation/platform-deployment/platform-vsphere-deployment.adoc index 39583a9372..b62b8b1fdd 100644 --- a/docs/en/modules/admin/pages/installation/platform-deployment/platform-vsphere-deployment.adoc +++ b/docs/en/modules/admin/pages/installation/platform-deployment/platform-vsphere-deployment.adoc @@ -3,33 +3,26 @@ include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc include::platform:ROOT:partial$admonitions/language-en.adoc[] -//== Підготовка інфраструктури vSphere для встановлення OKDfootnote:[**OKD** - це дистрибутив Kubernetes, оптимізований для неперервної розробки додатків та розгортання декількох екземплярів ізольованого контейнерного середовища (у нашому випадку -- екземплярів реєстру). За детальною інформацією зверніться до https://docs.okd.io/[офіційного джерела].] -== Preparing the vSphere infrastructure for OKD installationfootnote:[**OKD** - is a Kubernetes distribution optimized for continuous application development and the deployment of multiple instances of isolated container environments (in our case, instances of a registry). For detailed information, please refer to the https://docs.okd.io/[official source].] +IMPORTANT: Please contact your vendor to obtain the required _vSphere_ installer. -//TODO: The numeration of footnotes in the headre looks a bit weird with the first bracket being small and the second being big, and it applies to all the three footnotes. Please take a look if you can remedy this. +== Preparing the vSphere infrastructure for OKD installation + +*_OKD_* is a Kubernetes distribution optimized for continuous application development and deploying multiple instances of isolated container environments. In our case, such environments are registry instances. For detailed information, please refer to the https://docs.okd.io/[official source]. -//=== Налаштування довіреного інтерфейсу vCenter API === Configuring the trusted vCenter API interface -//Інсталер вимагає доступу до довіреного інтерфейсу vCenter API, який надає можливість завантажити довірені кореневі сертифікати CA vCenter. The installer requires access to the trusted vCenter API interface, which allows for the retrieval of trusted vCenter root CA certificates. -//Перед підключенням до API, сертифікати vCenter root CA повинні бути додані до системи, з якої запускатиметься OKD-інсталер. Before connecting to the API, vCenter root CA certificates must be added to the system from which the OKD installer will be launched. -//=== Завантаження CA-сертифікатів === Downloading CA Certificates -//Сертифікати можуть бути завантажені з домашньої сторінки vCenter. Certificates can be downloaded from the vCenter homepage. -//За замовчуванням сертифікати зберігаються за посиланням `/certs/download.zip`. Після завантаження і розархівування буде створено директорію, що містить сертифікати для ОС Linux, MacOS та Windows. -By default, certificates are stored at `/certs/download.zip`. After downloading and unpacking, a directory containing certificates for Linux, MacOS, and Windows operating systems will be created. +By default, certificates are stored at `/certs/download.zip`. After downloading and unpacking, a directory containing certificates for Linux, macOS, and Windows operating systems will be created. -//==== Приклад перегляду структури ==== Example of directory structure viewing -//Структуру директорій із розміщеними в ній сертифікатами можна переглянути за допомогою команди: The directory structure with the certificates can be viewed using the following command: [source,bash] @@ -37,7 +30,6 @@ The directory structure with the certificates can be viewed using the following $ tree certs ---- -//В результаті буде зображено наступну структуру: The resulting structure will be as follows: [source,bash] @@ -84,13 +76,10 @@ certs 3 directories, 15 files ---- -//==== Приклад додавання сертифікатів ==== Example of adding certificates -//Необхідно додати відповідні сертифікати для вашої операційної системи. You need to add the relevant certificates for your operating system. -//**Приклад для ОС Fedora**: *Example for Fedora OS*: [source, bash] @@ -100,20 +89,10 @@ $ sudo cp certs/lin/* /etc/pki/ca-trust/source/anchors $ sudo update-ca-trust extract ---- -//=== Ресурси стандартної інсталяції === Standard installation resources -//Стандартна інсталяція (Installer-Provisioned Infrastructure) створює наступні ресурси інфраструктури: The standard installation (Installer-Provisioned Infrastructure) creates the following infrastructure resources: -//* одну папку (1 Folder) -//* одну тег-категорію (1 Tag Category) -//* 1 тег (1 Tag) -//* віртуальні машини (Virtual machines): -// - один шаблон (1 template) -// - одну тимчасову ноду bootstrap (1 temporary bootstrap node) -// - три ноди консолі для управління Платформою (3 control-plane nodes) -// - три обчислювальні машини (3 compute machines) * one folder (1 Folder) * one tag category (1 Tag Category) * one tag (1 Tag) @@ -123,83 +102,65 @@ The standard installation (Installer-Provisioned Infrastructure) creates the fol - three control plane nodes for Platform management (3 control-plane nodes) - three compute machines (3 compute machines) -//==== Необхідні вимоги до ресурсів ==== Resource requirements -//===== Сховище даних ===== Data storage -//Разом із ресурсами, описаними вище, стандартне розгортання OKD вимагає мінімум 800 Гб простору для сховища даних. Alongside the resources described above, the standard OKD deployment requires a minimum of 800 GB of storage space for data storage. ===== DHCP -//Розгортання вимагає налаштування DHCP-сервера для конфігурації мережі. The deployment requires configuring a DHCP server for network configuration. -//== Розгортання та налаштування DNS і DHCP-компонентів == Deploying and configuring DNS and DHCP components -//=== IP-адреси === IP addresses -//Розгортання інфраструктури vSphere (Іnstaller-provisioned vSphere) вимагає двох статичних IP-адрес: Deployment of the vSphere infrastructure (Installer-provisioned vSphere) requires two static IP addresses: -//* **Адреса програмного інтерфейсу (API)** - використовується для доступу до API-кластера. * *Program interface address (API)* -- used for accessing the cluster's API. -//* **Вхідна IP-адреса (Ingress)** - використовується для вхідного трафіку кластера. * *Incoming IP address (Ingress)* -- used for cluster ingress traffic. -//Віртуальні ІР-адреси для кожного з них повинні бути визначені у файлі Virtual IP addresses for each of them must be defined in the xref:create-install-config-yml[`install-config.yaml`] file. -//=== DNS-записи === DNS records -//DNS-записи (DNS records) повинні бути створені для двох ІР-адрес на будь-якому DNS-сервері, призначеному для середовища. Записи повинні містити значення, описані в таблиці: DNS records must be created for the two IP addresses on any DNS server designated for the environment. The records should contain the values described in the table: [options="header"] |================================================ -//|Назва| Значення + |Name| Value |`api.${cluster-name}.${base-domain}`|API VIP |`*.apps.${cluster-name}.${base-domain}``|Ingress VIP |================================================ -//NOTE: `${cluster-name}` та `${base-domain}` - це змінні, що взято із відповідних значень, вказаних у файлі xref:create-install-config-yml[`install-config.yaml`]. NOTE: ${cluster-name} and ${base-domain} are variables taken from the respective values specified in the xref:create-install-config-yml[`install-config.yaml`] file. [#create-install-config-yml] -//== Створення конфігураційного файлу install-config.yaml == Creating the install-config.yaml configuration file [WARNING] ==== -//Передумови :: Prerequisites :: -//. Увійдіть у свій обліковий запис Red Hat. Якщо у вас немає облікового запису, вам потрібно створити його. + . Log in to your Red Hat account. If you don't have one, you need to create it. -//. Придбайте платну підписку на DockerHub, якщо у вас її немає. + . Purchase a paid subscription for DockerHub should you not have one. -//. Згенеруйте та додайте ssh-ключ до вашого конфігураційного файлу. Це необхідно для доступу до консолей ваших нод. + . Generate and add an SSH key to your configuration file. This is necessary for accessing your node consoles. ==== -//Створення файлу `install-config.yaml`, необхідного для розгортання OKD кластеру, виконується наступною командою: To create the `install-config.yaml` file required for deploying the OKD cluster, use the following command: [source,bash] $ openshift-installer create install-config -//Після створення файлу потрібно заповнити необхідні параметри, які будуть представлені в контекстному меню. Створений конфігураційний файл включає лише необхідні параметри для мінімального розгортання кластера. Для кастомізації налаштувань можна звернутись до офіційної документації. After creating the file, you need to fill in the necessary parameters, which will be presented in the context menu. The created configuration file includes only the required parameters for a minimal cluster deployment. For customization, refer to the official documentation. -//._Конфігурація install-config.yaml_ -.The _install-config.yaml_ configuration: +._The install-config.yaml configuration example_ [%collapsible] ==== [source,yaml] @@ -250,18 +211,16 @@ sshKey: | [NOTE] ==== -//* Під час створення конфігураційного файлу замініть *``* на ваш пароль, а *``* -- на ваш згенерований ssh-ключ. + * During the creation of the configuration file, replace *``* with your password and *` with your generated SSH key. -//* Також скопіюйте параметри автентифікації з облікового запису Red Hat та підставте у поле *`pullSecret`*. + * Also, copy the authentication parameters from your Red Hat account and insert them into the *`pullSecret`* field. -//* Зверніть увагу, що деякі параметри, можливо, доведеться змінити, щоб вони відповідали вашій інфраструктурі та потребам. + * Please note that you may need to adjust some parameters to match your infrastructure and requirements. ==== -//== Запуск OKD4-інсталера та розгортання порожнього кластера OKD4 == Running the OKD4 installer and deploying an empty OKD4 cluster -//Після створення файлу `install-config.yaml`, для розгортання OKD-кластера необхідно виконати наступну команду: After creating the `install-config.yaml` file, to deploy the OKD cluster, execute the following command: [source,bash] @@ -269,46 +228,32 @@ After creating the `install-config.yaml` file, to deploy the OKD cluster, execut $ openshift-installer create cluster ---- -//NOTE: Процес розгортання кластера зазвичай займає до 1,5 години часу. NOTE: The cluster deployment process typically takes up to 1.5 hours. -//При успішному розгортанні, в результаті виконання команди будуть представлені наступні параметри доступу до кластера: Upon successful deployment, the following cluster access parameters will be provided: -//* логін; -//* пароль; -//* посилання на веб-консоль кластера. * Login; * Password; * Link to the cluster's web console. -//В директорії, де виконувалася команда, буде створено ряд файлів, що зберігають статус кластера, необдхіний для його деінсталяції. In the directory where the command was executed, a series of files storing the cluster's status, necessary for its uninstallation, will be created. -//Також в цій директорії з'явиться папка `/auth`, в якій буде збережено два файли для автентифікації для роботи з кластером через **веб-консоль** та **інтерфейс командного рядка** OKD (OKD CLI). Additionally, an `/auth` folder will appear in this directory, containing two authentication files for working with the cluster through the *OKD web console* and the *OKD CLI*. -//NOTE: Після запуску процесу розгортання кластера, Інсталер видаляє `install-config.yaml`, тому рекомендовано виконати резервування цього файлу, якщо є потреба розгортання кількох кластерів. NOTE: After starting the cluster deployment process, the Installer removes the `install-config.yaml` file. Therefore, it is recommended to make a backup of this file if you plan to deploy multiple clusters. -//== Заміна самопідписаних сертифікатів на довірені сертифікати == Replacing self-signed certificates with trusted certificates -//Для заміни самопідписаних (self-signed) сертифікатів на довірені (trusted) необхідно спочатку отримати ці сертифікати. To replace self-signed certificates with trusted certificates, you first need to obtain these certificates. -//В цьому пункті розглянуто отримання безкоштовних сертифікатів https://letsencrypt.org/[Let's Encrypt] та їх встановлення на сервер. In this section, we will discuss obtaining free https://letsencrypt.org/[Let's Encrypt] certificates and installing them on the server. -//Отримання сертифікатів Let's Encrypt здійснено за допомогою утиліти https://github.com/acmesh-official/acme.sh[acme.sh]. Acquiring Let's Encrypt certificates is done using the https://github.com/acmesh-official/acme.sh[acme.sh] utility. -//TIP: Для отримання розширених деталей щодо використання Let's Encrypt на базі ACME-протоколу, зверніться до https://letsencrypt.org/docs/client-options/[офіційного джерела]. TIP: For detailed information on using Let's Encrypt based on the ACME protocol, refer to the https://letsencrypt.org/docs/client-options/[official source]. -//=== Підготовка === Preparation -//Необхідно клонувати утиліту acme.sh із репозиторію GitHub: + Clone the acme.sh utility from the GitHub repository: [source,bash] @@ -318,50 +263,42 @@ $ git clone https://github.com/neilpang/acme.sh $ cd acme.sh ---- -//=== Запит на отримання сертифікатів === Certificate request -//1) Для того, щоб полегшити процес отримання сертифікатів, необхідно задати дві змінні середовища. Перша змінна повинна вказувати на API Endpoint. Переконайтесь, що ви увійшли до OKD як `system:admin` і використовуєте CLI-консоль Openshift, щоб знайти API Endpoint URL. -1) To simplify the certificate acquisition process, set two environment variables. The first variable should point to the API Endpoint. Make sure you are logged in to OKD as `system:admin` and use the Openshift CLI console to find the API Endpoint URL: - +. To simplify the certificate acquisition process, set two environment variables. The first variable should point to the API Endpoint. Make sure you are logged in to OKD as `system:admin` and use the Openshift CLI console to find the API Endpoint URL: ++ [source,bash] ---- $ oc whoami --show-server ---- - -//**Приклад отриманої відповіді**: -*Example response:* ++ +.Example response ---- https://api.e954.ocp4.opentlc.com:6443 ---- -//2) Тепер встановіть змінну `LE_API` для повністю визначеного доменного імені API: -2) Now set the `LE_API` variable for the fully qualified API domain: - +. Now, set the `LE_API` variable for the fully qualified API domain: ++ [source,bash] ---- $ export LE_API=$(oc whoami --show-server | cut -f 2 -d ':' | cut -f 3 -d '/' | sed 's/-api././') ---- -//3) Встановіть другу змінну `LE_WILDCARD` для вашого Wildcard Domain: -3) Set the `LE_WILDCARD` variable for your Wildcard Domain: - +. Set the `LE_WILDCARD` variable for your Wildcard Domain: ++ [source,bash] ---- $ export LE_WILDCARD=$(oc get ingresscontroller default -n openshift-ingress-operator -o jsonpath='{.status.domain}') ---- -//4) Запускаємо скрипт acme.sh: -4) Run the acme.sh script: - +. Run the `acme.sh` script: ++ [source,bash] ---- $ ${HOME}/acme.sh/acme.sh --issue -d ${LE_API} -d *.${LE_WILDCARD} --dns ---- - -//**Приклад отриманої відповіді**: -*Example response:* - ++ +.Example response [source, bash] ---- $ ./acme.sh --issue -d ${LE_API} -d \*.${LE_WILDCARD} --dns --yes-I-know-dns-manual-mode-enough-go-ahead-please @@ -385,41 +322,32 @@ $ ./acme.sh --issue -d ${LE_API} -d \*.${LE_WILDCARD} --dns --yes-I-know-dns-m [Wed Jul 28 18:37:38 EEST 2021] Please add the TXT records to the domains, and re-run with --renew. [Wed Jul 28 18:37:38 EEST 2021] Please add '--debug' or '--log' to check more details. ---- - -//CAUTION: DNS-записи з попередньої відповіді необхідно додати на DNS-сервері, що відповідає за зону `e954.ocp4.opentlc.com` (**значення зони тут є прикладом**). Таким чином, TXT-записи повинні мати наступний вигляд: ++ CAUTION: DNS records as mentioned in the previous response should be added to the DNS server responsible for the `e954.ocp4.opentlc.com` zone (*the zone value here is just an example*). The TXT records should have the following format: - -//**TXT-запис 1** -*TXT record 1* - ++ +.TXT record 1 [source,bash] ---- _acme-challenge.api.e954.ocp4.opentlc.com TXT value: 'VZ2z3XUe4cdNLwYF7UplBj7ZTD8lO9Een0yTD7m_Bbo' ---- - -//**TXT-запис 2** -*TXT record 2* ++ +.TXT record 2 [source,bash] ---- _acme-challenge.apps.e954.ocp4.opentlc.com TXT value: 'f4KeyXkpSissmiLbIIoDHm5BJ6tOBTA0D8DyK5sl46g' ---- -//6) Після цього необхідно повторно запустити команду `acme.sh`: -5) After this step, you need to run the `acme.sh` command again: -//TODO: Changed the numeration of the list item above, since the previous item was numbered "4". - +. After this step, you need to run the `acme.sh` command again. ++ [source,bash] ---- $ acme.sh --renew -d e954.ocp4.opentlc.com --yes-I-know-dns-manual-mode-enough-go-ahead-please ---- -//7) Після успішного виконання попередніх пунктів необхідно запустити наступні команди. -6) Upon successful completion of the previous steps, run the following commands. - -//Зазвичай, хорошим підходом є перенесення сертифікатів із шляху acme.sh за замовчуванням (default path) до більш зручної директорії. Для цього можна використати `—install-cert`-ключ скрипта `acme.sh` для копіювання сертифікатів до `$HOME/certificates`, для прикладу: +. Upon successful completion of the previous steps, run the following commands. ++ Usually, a good approach is to move certificates from the default acme.sh path to a more convenient directory. You can use the `—install-cert` key of the `acme.sh` script to copy certificates to `$HOME/certificates`, for example: - - ++ [source,bash] ---- $ export CERTDIR=$HOME/certificates @@ -427,31 +355,28 @@ $ export CERTDIR=$HOME/certificates $ mkdir -p ${CERTDIR} ${HOME}/acme.sh/acme.sh --install-cert -d ${LE_API} -d *.${LE_WILDCARD} --cert-file ${CERTDIR}/cert.pem --key-file ${CERTDIR}/key.pem --fullchain-file ${CERTDIR}/fullchain.pem --ca-file ${CERTDIR}/ca.cer ---- -//==== Встановлення сертифікатів для Router ==== Installing certificates for Router -//* Необхідно створити секрет. Для цього виконайте наступну команду: -* You need to create a secret for this. Execute the following command: +. Create a secret for this. Execute the following command: ++ [source,bash] ---- $ oc create secret tls router-certs --cert=${CERTDIR}/fullchain.pem --key=${CERTDIR}/key.pem -n openshift-ingress ---- -//* Після виконання попередніх кроків, необхідно оновити Custom Resource: -* After completing the previous steps, you need to update the Custom Resource: - +. After completing the previous steps, update the Custom Resource: ++ [source,bash] ---- $ oc patch ingresscontroller default -n openshift-ingress-operator --type=merge --patch='{"spec": { "defaultCertificate": { "name": "router-certs" }}}' ---- -//== Створення MachineSetfootnote:[**Ресурси MachineSet** - це групи машин. Набори машин призначені для машин як набори копій (реплік) для Pods, в яких розгорнуто контейнери. Якщо вам потрібно більше машин або, навпаки, необхідно зменшити їх кількість, можна змінити значенням поля реплік на рівні MachineSet, щоб задовольнити ваші обчислювальні потреби. Для детальної інформації щодо створення MachineSet зверніться до https://docs.openshift.com/container-platform/4.6/machine_management/creating_machinesets/creating-machineset-vsphere.html[офіційного джерела.]] для інфраструктури Ceph -== Creating a MachineSetfootnote:[*MachineSet resources* are groups of machines. MachineSets are intended for machines as sets of replicas for Pods where containers are deployed. If you need more machines or, conversely, need to reduce their quantity, you can adjust the replica field at the MachineSet level to meet your computational needs. For detailed information on creating MachineSets, please refer to the https://docs.openshift.com/container-platform/4.6/machine_management/creating_machinesets/creating-machineset-vsphere.html[official source.]] for Ceph Infrastructure +== Creating a MachineSet for Ceph infrastructure -//Для розгортання Платформи необхідно створити MachineSet для системи зберігання даних https://ceph.io/en/[Ceph]. Для цього необхідно використати конфігураційний файл `machine-set-ceph.yaml`, в якому необхідно змінити назву кластера. -To deploy the Platform, you need to create a MachineSet for the https://ceph.io/en/[Ceph] data storage system. To do this, use the `machine-set-ceph.yaml` configuration file and modify the cluster name accordingly. +TIP: *_MachineSet resources_* are groups of machines. MachineSets are intended for machines as sets of replicas for Pods where containers are deployed. If you need more machines or, conversely, need to reduce their quantity, you can adjust the replica field at the MachineSet level to meet your computational needs. For detailed information on creating MachineSets, please refer to the https://docs.openshift.com/container-platform/4.6/machine_management/creating_machinesets/creating-machineset-vsphere.html[official source.] + +To deploy the Platform, you must create a MachineSet for the https://ceph.io/en/[Ceph] data storage system. To do this, use the `machine-set-ceph.yaml` configuration file and modify the cluster name accordingly. -//._Приклад конфігураційного файлу machine-set-ceph.yaml_ ._Example machine-set-ceph.yaml configuration file_ [%collapsible] ==== @@ -512,55 +437,45 @@ spec: ---- ==== -//Після редагування файлу відповідно до назви кластера, необхідно виконати команду, що створить необхідний MachineSet та відповідну кількість нод для розгортання сховища даних Ceph. After editing the file according to the cluster name, execute the command to create the necessary MachineSet and the corresponding number of nodes for deploying the Ceph data storage. -//TIP: У нашому випадку назва кластера визначена в _.yaml_-файлі як `mdtuddm-b86zw`. TIP: In our case, the cluster name is defined in the _.yaml_ file as `mdtuddm-b86zw`. -//== Підготовка та запуск Інсталераfootnote:[_Інсталер_ -- набір команд (скрипт) для розгортання Платформи.] для розгортання Платформи на цільовому OKD-кластері -== Preparing and running the Installerfootnote:[_Installer_ -- is a set of commands or a script used for deploying the Platform] for Platform deployment on the target OKD cluster +== Preparing and running the Installer for Platform deployment on the target OKD cluster + +TIP: The *_Installer_* -- is a set of commands, a script used for deploying the Platform. -//Для запуску Інсталера, необхідно виконати ряд умов з підготовки робочої станції, з якої запускатиметься Інсталер. Нижче розглянуто приклад такої підготовки на базі Ubuntu 20.04 LTS. To run the Installer, you need to meet several conditions for preparing the workstation from which the Installer will be launched. Below is an example of such preparation on Ubuntu 20.04 LTS. -//=== Передумови === Prerequisites -//Встановіть Docker з офіційного джерела: https://docs.docker.com/engine/install/[]. -Install Docker from the official source: https://docs.docker.com/engine/install/[]. +Install Docker on the official source: https://docs.docker.com/engine/install/[]. -//=== Розгортання та оновлення Платформи === Deploying and updating the Platform -//==== Розгортання Платформи з нуля ==== Deploying the Platform from scratch -//===== Передумови ===== Prerequisites -//NOTE: Переконайтеся, що встановлено необхідні пакети: `docker`, `wget`, `unzip`. NOTE: Ensure that the required packages are installed: `docker`, `wget`, `unzip`. -//. Завантажте необхідну версію інсталера. . Download the necessary version of the installer. + [source,shellscript] ---- сd /tmp -wget -O mdtu-ddm-platform-.zip https://nexus-public-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/nexus/repository/edp-maven-releases/ua/gov/mdtu/ddm/infrastructure/mdtu-ddm-platform//mdtu-ddm-platform-.zip +wget -O mdtu-ddm-platform-.tar.gz https://nexus-public-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/nexus/repository/edp-maven-releases/ua/gov/mdtu/ddm/infrastructure/mdtu-ddm-platform//mdtu-ddm-platform-.tar.gz ---- -+ -//. Розпакуйте архів у домашній директорії. + . Unpack the archive in the home directory. + [source,shellscript] ---- -unzip /tmp/mdtu-ddm-platform-.zip -d /home//workdir/installer- +unzip /tmp/mdtu-ddm-platform-.tar.gz -d /home//workdir/installer- ---- + -//. Перенесіть _kubeconfig_ після встановлення кластера: + . Move the _kubeconfig_ file after cluster installation: + @@ -570,7 +485,7 @@ cd /home//workdir/installer- cp /path/to/kubeconfig ./ ---- + -//. Перенесіть папку _certificates_ для DSO: + . Move the _certificates_ folder for DSO: + @@ -579,14 +494,11 @@ cp /path/to/kubeconfig ./ cp /path/to/folder/certificates ./ ---- -//===== Додавання окремого конфігураційного файлу для розгортання у середовищі vSphere ===== Adding a separate configuration file for deployment in the vSphere environment - -//. Відредагуйте _exports.list_ для vSphere. . Edit _exports.list_ for vSphere. + -//Усі значення необхідно взяти після інсталяції кластера. Також необхідно уточнити актуальні значенння для `idgovuaClientId` та `idgovuaClientSecret`. + All values should be taken after the cluster installation. Also, ensure that you have up-to-date values for `idgovuaClientId` and `idgovuaClientSecret`. + @@ -615,7 +527,7 @@ export idgovuaClientId="" export idgovuaClientSecret="" ---- + -//. Відредагуйте _install.sh_, а саме після `source ./functions.sh` додайте `source ./exports.list`. + . Edit _install.sh_, specifically after `source ./functions.sh`, add `source ./exports.list`. + @@ -624,7 +536,7 @@ export idgovuaClientSecret="" vi install.sh ---- + -//Це виглядатиме наступним чином: + It should look like this: + @@ -637,10 +549,8 @@ source ./functions.sh source ./exports.list ---- -//===== Розгортання Інсталера ===== Deploying the Installer -//. Виконайте наступні команди: . Execute the following commands: + [source,shellscript] @@ -650,45 +560,40 @@ echo $IMAGE_CHECKSUM sudo docker tag ${IMAGE_CHECKSUM} control-plane-installer:; ---- + -//. Розгорніть нову версію Платформи з образами з нуля: + . Deploy a new version of the Platform with images from scratch: + [source,shellscript] ---- -sudo docker run --rm --name control-plane-installer- --user root:$(id -g) --net host -v $(pwd):/tmp/installer --env KUBECONFIG=/tmp/installer/kubeconfig --env idgovuaClientId=mock --env idgovuaClientSecret=mock --env CUSTOM_INGRESS_CIDRS="['0.0.0.0/0', '85.223.209.0/24']" --env deploymentMode=development --entrypoint "/bin/bash" control-plane-installer: -c "./install.sh -i" +sudo docker run --rm --name control-plane-installer- --user root:$(id -g) --net host -v $(pwd):/tmp/installer --env KUBECONFIG=/tmp/installer/kubeconfig --env idgovuaClientId=mock --env idgovuaClientSecret=mock --env deploymentMode=development --entrypoint "/bin/bash" control-plane-installer: -c "./install.sh -i" ---- + -//* де `deploymentMode` може бути `development` чи `production`. -* where `deploymentMode` can be either `development` or `production`. +TIP: The `deploymentMode` parameter can be set either to `development` or `production`. -//==== Оновлення Платформи ==== Updating the Platform -//===== Передумови ===== Prerequisites -//NOTE: Переконайтеся, що встановлено необхідні пакети: `docker`, `wget`, `unzip`. NOTE: Ensure that the required packages are installed: `docker`, `wget`, `unzip`. -//. Завантажте необхідну версію інсталера. . Download the necessary version of the installer. + [source,shellscript] ---- сd /tmp -wget -O mdtu-ddm-platform-.zip https://nexus-public-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/nexus/repository/edp-maven-releases/ua/gov/mdtu/ddm/infrastructure/mdtu-ddm-platform//mdtu-ddm-platform-.zip +wget -O mdtu-ddm-platform-.tar.gz https://nexus-public-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/nexus/repository/edp-maven-releases/ua/gov/mdtu/ddm/infrastructure/mdtu-ddm-platform//mdtu-ddm-platform-.tar.gz ---- + -//. Розпакуйте архів у домашній директорії. + . Unpack the archive in the home directory. + [source,shellscript] ---- -unzip /tmp/mdtu-ddm-platform-.zip -d /home//workdir/installer- +unzip /tmp/mdtu-ddm-platform-.tar.gz -d /home//workdir/installer- ---- + -//. Перенесіть _kubeconfig_ після встановлення кластера: + . Move the _kubeconfig_ file after cluster installation: + @@ -698,10 +603,10 @@ cd /home//workdir/installer- cp /path/to/kubeconfig ./ ---- + -//. Перенесіть папку _certificates_ для DSO. + . Move the _certificates_ folder for DSO. + -//NOTE: Якщо сертифікати не змінювалися, даний крок можна пропустити. + NOTE: If the certificates haven't changed, you can skip this step. + @@ -710,10 +615,8 @@ NOTE: If the certificates haven't changed, you can skip this step. cp /path/to/folder/certificates ./ ---- -//===== Додавання окремого конфігураційного файлу для розгортання у середовищі vSphere ===== Adding a separate configuration file for deployment in the vSphere environment -//. Перенесіть _exports.list_ з минулого релізу. . Move _exports.list_ from the previous release. + @@ -722,10 +625,10 @@ cp /path/to/folder/certificates ./ cp /home//workdir/installer-/exports.list ./ ---- + -//Також необхідно уточнити актуальні значенння для `idgovuaClientId` та `idgovuaClientSecret`. + Also, ensure that you have up-to-date values for `idgovuaClientId` and `idgovuaClientSecret`. + -//. Відредагуйте _install.sh_, а саме після `source ./functions.sh` додайте `source ./exports.list`. + . Edit _install.sh_, specifically after `source ./functions.sh`, add `source ./exports.list`. + @@ -734,7 +637,7 @@ Also, ensure that you have up-to-date values for `idgovuaClientId` and `idgovuaC vi install.sh ---- + -//Це виглядатиме наступним чином: + It should look as follows: + @@ -747,10 +650,8 @@ source ./functions.sh source ./exports.list ---- -//===== Налаштування компонента MinIO при оновленні кластера у середовищі vSphere ===== Configuring the MinIO component during cluster update in the vSphere environment -//. Перенесіть tfstate MinIO з минулого релізу для vSphere. . Transfer the tfstate for MinIO from the previous release for vSphere. + @@ -759,7 +660,7 @@ source ./exports.list cp /home//workdir/installer-/terraform/minio/vsphere/terraform.tfstate ./terraform/minio/vsphere/ ---- + -//. Перенесіть tfstate MinIO (Packer) з минулого релізу для vSphere. + . Transfer the tfstate for MinIO (Packer) from the previous release for vSphere. + @@ -768,10 +669,8 @@ cp /home//workdir/installer-/terraform/minio/vsphere/terraform.tf сp /home//workdir/installer-/terraform/minio/vsphere/packer/terraform.tfstate ./terraform/minio/vsphere/packer/ ---- -//===== Налаштування компонента Vault при оновленні кластера у середовищі vSphere ===== Configuring the vault component during cluster update in the vSphere environment -//. Перенесіть tfstate Vault з минулого релізу. . Transfer the tfstate for Vault from the previous release. + @@ -780,7 +679,7 @@ cp /home//workdir/installer-/terraform/minio/vsphere/terraform.tf cp /home//workdir/installer-/terraform/vault/vsphere/terraform.tfstate ./terraform/vault/vsphere/ ---- + -//. Перенесіть tfstate Vault (Packer) з минулого релізу. + . Transfer the tfstate for Vault (Packer) from the previous release. + @@ -789,10 +688,8 @@ cp /home//workdir/installer-/terraform/vault/vsphere/terraform.tf сp /home//workdir/installer-/terraform/vault/vsphere/packer/terraform.tfstate ./terraform/vault/vsphere/packer/ ---- -//===== Розгортання Інсталера ===== Deploying the Installer -//. Виконайте наступні команди: . Execute the following commands: + [source,shellscript] @@ -802,27 +699,23 @@ echo $IMAGE_CHECKSUM sudo docker tag ${IMAGE_CHECKSUM} control-plane-installer:; ---- + -//. Оновіть версію Платформи з образами оновлення. + . Update the Platform version with update images. + [source,shellscript] ---- -sudo docker run --rm --name control-plane-installer- --user root:$(id -g) --net host -v $(pwd):/tmp/installer --env KUBECONFIG=/tmp/installer/kubeconfig --env idgovuaClientId=mock --env idgovuaClientSecret=mock --env CUSTOM_INGRESS_CIDRS="['0.0.0.0/0', '85.223.209.0/24']" --env deploymentMode=development --entrypoint "/bin/bash" control-plane-installer: -c "./install.sh -u" +sudo docker run --rm --name control-plane-installer- --user root:$(id -g) --net host -v $(pwd):/tmp/installer --env KUBECONFIG=/tmp/installer/kubeconfig --env idgovuaClientId=mock --env idgovuaClientSecret=mock --env deploymentMode=development --entrypoint "/bin/bash" control-plane-installer: -c "./install.sh -u" ---- + -//TIP: де `deploymentMode` може бути `development` чи `production`, залежно від попереднього запуску. + TIP: Where `deploymentMode` can be either `development` or `production`, depending on the previous run. -//== Управління налаштуваннями Платформи == Managing Platform configuration -//Управління кластером відбувається за методологією https://about.gitlab.com/topics/gitops/[GitOps]. Це означає, що будь-які зміни в конфігурації кластера, компонентів кластера та компонентів Платформи відбувається через зміну конфігурації кластера в git-гілці відповідного компонента. Cluster management follows the https://about.gitlab.com/topics/gitops/[GitOps] methodology. This means that any changes in the cluster configuration, cluster components, and Platform components are made through modifying the cluster configuration in the git branch of the corresponding component. -//Метадані усіх компонентів, для яких реалізовано управління через GitOps-підхід, зберігаються в компоненті `cluster-mgmt`. Metadata for all components managed through the GitOps approach is stored in the `cluster-mgmt` component. -//Нижче представлено список компонентів, для яких наразі імплементований GitOps-підхід: Below is a list of components for which GitOps management is currently implemented: - `catalog-source` @@ -837,4 +730,4 @@ Below is a list of components for which GitOps management is currently implement - `cluster-kafka-operator` - `smtp-server` - `redis-operator` -- `postgres-operator` \ No newline at end of file +- `postgres-operator` diff --git a/docs/en/modules/admin/pages/migration/migrate-registry.adoc b/docs/en/modules/admin/pages/migration/migrate-registry.adoc index 74f7e58462..7d5a59f98e 100644 --- a/docs/en/modules/admin/pages/migration/migrate-registry.adoc +++ b/docs/en/modules/admin/pages/migration/migrate-registry.adoc @@ -9,107 +9,109 @@ This page provides a practical guide for seamlessly migrating between two OKD cl We use the following names to identify the clusters: -//* [.underline]#Кластер А# -- кластер, на якому розгорнуто наявний реєстр. -//* [.underline]#Кластер B# -- кластер, куди буде перенесено наявний реєстр (цільовий кластер). - * [.underline]#Cluster A# is the cluster that hosts the registry _before the migration_ (source cluster). * [.underline]#Cluster B# is the cluster that will host the registry _after the migration_ (target cluster). -//NOTE: Міграція реєстру виконується з останньої резервної копії наявного реєстру та, відповідно до інструкції, буде переноситися із кластера А до кластера B й відновлюватися вже на цьому кластері. NOTE: Registry migration is performed by first moving the latest backup copy of the registry from cluster A to cluster B, then restoring the registry on cluster B. -//== Передумови для міграції == Prerequisites for migration +[NOTE] +==== +📌 Note on organizing migration:: + +. _Planning_: It's crucial to develop a clear migration schedule. It should include: + +* Date and time for creating the backup. +* Restoration time. +* The time for service providers to complete their work before the backup. + +. _Communication_: It's vital to ensure all service provider users are duly informed: + +* Notify users via external communication channels outside of the Platform. +* Inform them about the need to finish their work by the time specified in the schedule. + +Following these recommendations will ensure a smooth migration process without unnecessary delays and inconveniences for the users. +==== + Before you start the migration, check these prerequisites and ensure that all requirements are met. -//. Процес міграції включає запуск bash-скрипту, що здійснює перенесення даних з кластера А до кластера B. Для успішної міграції, цей скрипт має бути виконаний на платформі Linux з архітектурою мікропроцесора `x86-64` (відомою також як `AMD64`, Intel 64, чи `x64`) . During the migration, you will need to run a bash script that transfers data from cluster A to cluster B. For a successful migration, this script must be executed on a Linux platform with an `x86-64` microprocessor architecture (also known as `AMD64`, `Intel 64`, or `x64`). -//. Користувач, який буде переносити реєстр на інший кластер, повинен бути доданий до адміністраторів Платформи на обох кластерах через *`control-plane-console`*. + . The user performing the migration must be added as the Platform administrator on both clusters via *`control-plane-console`*. + TIP: For details, see xref:admin:registry-management/control-plane-assign-platform-admins.adoc[]. + -//. На кластері, на який переноситься реєстр, повинна бути розгорнута та версія платформи, у якої версія `control-plane-gerrit` буде дорівнювати версії самого реєстру (наприклад, версія платформи -- *`1.9.4.11`*, версія реєстру -- *`1.9.4.7`*, версія `control-plane-gerrit` – *`1.9.4.7`*). Цю версію можна перевірити наявністю гілки у репозиторії *`cluster-mgmt`* в центральному *Gerrit*. Якщо гілка з версією реєстру існує, то версію реєстру можна переносити на кластер B. Якщо ні, то існує два шляхи: + . The Platform deployed on cluster B (target cluster) must have the same `control-plane-gerrit` version as the registry you are migrating. For example, Platform version `1.9.4.11` with `control-plane-gerrit` version `1.9.4.7` will be compatible with the registry version `1.9.4.7`. To verify the `control-plane-gerrit` version, check whether a corresponding branch exists in the `cluster-mgmt` repository of the central Gerrit component. If the branch that matches the registry version exists, the registry can be migrated to cluster B. If not, you have two options: -//* Оновити платформу на кластері B, яка буде відповідати версії самого реєстру. + * Update the Platform on cluster B to match the registry version. -//* Оновити реєстр на кластері A до версії, яка вже існує на кластері B. + * Update the registry on cluster A to match the version available on cluster B. -//. Одночасний доступ до кластера А та кластера B. + . Make sure you have simultaneous access to clusters A and B. -//. Наявність наступних команд в Terminal: + . During the migration, you will need the following terminal commands: * `oc` * `velero` * `rclone` * `vault` -//. Стабільне з'єднання з інтернетом. _Чим більша пропускна здатність, тим швидше буде проходити міграція_. В іншому випадку, можна використовувати *jumpbox* (із доступом до обох кластерів), який знаходиться або в AWS, або в іншого cloud-провайдера. Використання jumpbox зменшить час перенесення резервної копії з одного кластера на інший. + . Make sure you have a stable Internet connection. _The greater the bandwidth, the faster the migration will run_. Alternatively, you can use an AWS or other cloud provider's *jumpbox* with access to both clusters. Using a jumpbox reduces the time it takes to transfer the backup copy from one cluster to another. + [NOTE] ==== -//Якщо ви використовуєте *jumpbox*, то необхідно перевірити доступ до платформних Minio/Vault з IP-адреси *jumpbox*. Для отримання IP *jumpbox* виконайте наступну команду: + When using a *jumpbox*, you need to check whether the Platform's MinIO and Vault are accessible from the jumpbox's IP address. To get the jumpbox's IP, use the following command: ---- ssh sshmyip.com ---- -//Далі необхідно перевірити наявність або додати IP-адресу *jumpbox* до переліку дозволенних CIDR на рівні керування платформою для кластера А та кластера B ( _див. детальніше на сторінці xref:admin:registry-management/control-plane-cidr-access-endpoints.adoc[]_). Next, you need to make sure the jumpbox's IP address is added to the list of allowed CIDRs at the Platform management level for clusters A and B. For details, see xref:admin:registry-management/control-plane-cidr-access-endpoints.adoc[]. -//Якщо відсутній доступ до control-plane-console, зверніться до L2-команди для перевірки доступу. If you cannot access `control-plane-console`, contact the L2 support team to request access. ==== + [IMPORTANT] ==== -//При міграції реєстру, важливо щоб перед початком міграції, на кластері B не було ресурсів пов'язаних із реєстром. + Before migrating the registry, make sure cluster B does not contain any resources related to the registry. -//_Якщо раніше реєстр не існував на цьому кластері, то подальші дії можна не виконувати._ _If the registry was never deployed on cluster B previously, skip the rest of the steps in this section._ -//Якщо реєстр існував, то для видалення усіх ресурсів потрібно перевірити/видалити наступне: :: If the registry was previously deployed on cluster B, you need to remove all of its resources by checking the following: :: -//TODO: I changed the list style from bullets to numbers so it's easier to follow as a sequence -//* Видаліть реєстр через інтерфейс адміністративної панелі Control Plane. + . Delete the registry from cluster B using the Control Plane admin console. + TIP: For details, see xref:registry-management/control-plane-remove-registry.adoc[]. + -//// -//TODO: This text is commented out in the original doc: -Перейти в control-plane-console на кластері B (Openshift-консоль > Projects > control-plane > Networking > control-plane-console), пройти аутентифікацію через openshift-sso, перейти в підрозділ - Реєстри, та натиснути на кошик навпроти назви реєстру, підтвердити зміни та дочекатись видалення реєстру -//// -+ -//* Підтвердьте зміни та дочекатися видалення реєстру. + . Confirm the changes and wait until the registry is deleted. -//* Після видалення перевірте відсутність проєкту у центральному компоненті Gerrit. + . After deleting the registry, verify that the project is absent in the central Gerrit component. -//** Перейдіть до Gerrit (*Openshift*-консоль > *Projects* > *`control-plane`* > *Networking* > *Routes* > *`control-plane-gerrit`* ). + .. Open Gerrit (*Openshift* console > *Projects* > *`control-plane`* > *Networking* > *Routes* > *`control-plane-gerrit`*). -//** Автентифікуйтеся через *openshift-sso*, відкрийте меню *Browse* > *Repositories* та виконайте пошук за назвою реєстру. + .. Sign in with *openshift-sso*, go to *Browse* > *Repositories*, and search by registry name. -//** Якщо пошук знаходить репозиторій, то перейдіть до *Openshift*-консоль > *Projects* > *`control-plane`* > *Home* > *API Explorer* > у пошуку ( `Filter by kind ...` ) знайдіть `gerritproject` > `<назва реєстру>` > *Actions* > *`Delete GerritProject`*. -//TODO: I could not follow this path... + + .. If the repository appears in search results, go to *Openshift* console > *Projects* > *`control-plane`* > *Home* > *API Explorer* > search for `gerritproject` in the *Filter by kind* field -> `` -> *Actions* > *Delete GerritProject*. -//** Після видалення Gerrit-проєкту, перейдіть до Gerrit-консолі та перевірте, що репозиторій відсутній. Якщо репозиторій існує, видаліть його через Gerrit-консоль ( відкрийте репозиторій реєстру > *Commands* > *Delete project*). + .. After deleting the Gerrit project, go to the Gerrit console and verify that the repository is absent. If the repository exists, delete it via the Gerrit console by opening the registry repository > *Commands* > *Delete project*. -//* Видаліть директорію в Minio. + . Delete the directory in MinIO. -//** Для перевірки створених директорій в Minio, перейдіть до *MinioUI* (для кластерів vSphere цей Route можна знайти в *OpenShift*-консолі > *Projects* > *`control-plane`* > *Networking* > *Routes* > *`platform-minio-ui`*. + .. To check the MinIO directories, go to *MinioUI*. For vSphere clusters, you can find this route in *OpenShift* console > *Projects* > *`control-plane`* > *Networking* > *Routes* > *`platform-minio-ui`*. -//** У випадку відсутності Route, перейдіть до секретів за шляхом: + -//*Openshift*-консоль > *Project* > *`control-plane`* > *Workloads* > *Secrets* > *`backup-credentials`*, скопіюйте поле `backup-s3-like-storage-url` та додайте до URL порт (Наприклад, `https://endpoint.com:9001` ). + + .. If the route is missing, go to secrets using the following path: *Openshift* console > *Projects* > *`control-plane`* > *Workloads* > *Secrets* > *`backup-credentials`*, copy the `backup-s3-like-storage-url` field and add the port to the URL (for example, `https://endpoint.com:9001`). + -//TIP: Дані для аутентифікації в Minio знаходяться в *Openshift*-консолі > *Project* > *`control-plane`* > *Secrets* > *`backup-credentials`*, де *`username`* -- це поле *`backup-s3-like-storage-access-key-id`*, а `*password*` -- *`backup-s3-like-storage-secret-access-key`*. + TIP: To find MinIO credentials, go to *Openshift* console > *Projects* > *`control-plane`* > *Secrets* > *`backup-credentials`*. The *`backup-s3-like-storage-access-key-id`* is the username, and the *`backup-s3-like-storage-secret-access-key`* is the password. + -//** Після аутентифікації перевірте/видаліть директорії, пов'язані у реєстрі в бакеті. Такими є: + .. Sign in to MinIO and delete the directories in the registry's bucket: * _openshift-backups/backups/*_ * _openshift-backups/restic/_ @@ -117,21 +119,22 @@ TIP: To find MinIO credentials, go to *Openshift* console > *Projects* > *`contr ==== -//== Підготовка реєстру до міграції == Preparing the registry for migration -//. Зробіть резервну копію реєстру на кластері A. +[IMPORTANT, caption=Before Migration] +Before starting the migration, it is essential to restrict end-user access to this registry completely. + . Make a backup copy of the registry on cluster A. + -//Перед перенесенням реєстру на новий кластер, необхідно запустити Jenkins-процес *`Create-registry-backup-<назва реєстру>`*. + Before migrating the registry to a new cluster, run the *Create-registry-backup-``* Jenkins process. + -//Якщо Jenkins pipeline завершився зі статусом *`Success`*, то резервна копія виконана успішно. + If the Jenkins pipeline has completed with a *Success* status, the backup copy was created successfully. + [NOTE] ==== -//Для отримання назви резервної копії, перейдіть до логів/журналів подій останнього запуску Jenkins pipeline (*Console Output*), та за пошуком на сторінці знайдіть повідомлення накшталт: + To get the name of the backup copy, go to the output log from the latest Jenkins execution (*Console Output*) and look for a message similar to this: ---- @@ -150,57 +153,48 @@ In this case, *`abc-02-2023-04-18-19-03-14`* is the name of the backup copy. + [WARNING] ==== -//Для версій реєстру < 1.9.3 необхідно виконати у Terminal наступну команду: + If the registry version is earlier than 1.9.3, you need to execute the following command in the terminal: ---- velero backup describe ---- -//Назву бекапу можна знайти в логах останнього запуску Jenkins-процесу *`Create-registry-backup-<назва реєстру>`*. You can find the name of the backup in the output log from the last execution of the *Create-registry-backup-``* Jenkins process. ==== + [TIP] ==== -//Детальніше про створення резервних копій та відновлення реєстрів див. у розділі xref:backup-restore/overview.adoc[]. + For details on backing up and restoring registries, see xref:backup-restore/overview.adoc[]. ==== -//. Якщо останній velero backup завершився зі статусом *`Completed`*, то можна переходити далі. У випадку, коли статус velero backup відрізняється від `Completed`, необхідно долучати спеціалістів із технічної підтримки L2-L3 для перевірки працездатності Jenkins-пайплайну. + . If the latest Velero backup has a *Completed* status, you can proceed. If the status of the Velero backup is not *Completed*, you will need to contact an L2-L3 support team to ensure the Jenkins pipeline functions properly. -//. Забороніть робити зміни у реєстрі за допомогою Jenkins пайплайнів. + . Prevent modifying the registry using Jenkins pipelines. + -//У кожному пайплайні для реєстру перейдіть до секції *Configure* та знайдіть параметр *`Disable this project`* у секції *Build Triggers*, встановіть напроти нього прапорець та збережіть зміни за допомогою кнопки kbd:[*Save*]. + For each registry pipeline, go to *Configure* > *Build Triggers*, select the *Disable this project* option, then click *Save*. -//== Міграція резервної копії із кластера А до кластера B == Migrating the backup copy from cluster A to cluster B -//. Отримайте логін-команди для обох кластерів. . Get login commands for both clusters. + -//Для цього виконайте вхід до Openshift-консолі та у правому верхньому кутку, натисканням на свій username, перейдіть до *`Copy login command`*, скопіюйте токен доступу у полі *`Log in with token`* та збережіть його у текстовому редакторі. -To do this, sign in to the Openshift console, click your username in the upper-right corner, and select *Copy login command* from the menu. In the new window or tab that opens, copy the entire login command from the *Log in with this token* field and save it in any text editor. +To do this, sign in to the Openshift console, click your username in the upper-right corner, and select *Copy login command* from the menu. In the new window or tab that opens, copy the entire login command from the *Log in with this token* field and save it in any text editor. + -//NOTE: Операцію потрібно повторити для обох кластерів: А та B. NOTE: Do this for both clusters, A and B. -//. Отримайте назву останньої резервної копії, яка була створена на кластері А (наприклад, `abc-02-2023-04-18-19-03-14`). + . Get the name of the latest backup copy created on cluster A (for example, `abc-02-2023-04-18-19-03-14`). -//. Відкрийте термінал та виконайте наступні команди: + . Open the terminal and execute the following commands: -//.Експорт логіну для кластера А + .Export login for cluster A ---- export A_CLUSTER_LOGIN="oc login --token …" ---- + -//Вставте між лапок *`"..."`* після `--token` отриману в пункті 1 команду логіну для кластера А. В кінці логін-команди не повинно бути перенесення на наступний рядок. -//TODO: An example would be nice here. Also, can we replace "..." with smth like ""? Copy the login command for cluster A that you saved in step 1 and paste it after the `--token` parameter inside the double quotes. Make sure there are no line breaks at the end of the login command. -//.Експорт логіну для кластера В + .Export login for cluster B ---- @@ -208,28 +202,28 @@ export B_CLUSTER_LOGIN="oc login --token …" ---- + Copy the login command for cluster B that you saved in step 1 and paste it after the `--token` parameter inside the double quotes. Make sure there are no line breaks at the end of the login command. -//.Експорт назви реєстру + + .Export registry name ---- export REGISTRY_NAME="" ---- + -//TIP: Приклад назви реєстру: `*abc-02*`. + TIP: Here is an example of the registry name: `*abc-02*`. -//.Експорт назви резервної копії + + .Export backup copy name ---- export BACKUP_NAME="" ---- + -//TIP: Приклад назви резервної копії: `*abc-02-2023-04-18-19-03-14*`. + TIP: Here is an example of the backup name: `*abc-02-2023-04-18-19-03-14*`. + [WARNING] ==== -//У випадку, коли реєстр попередньо був мігрований на кластер A, а не розгорнутий на цій Платформі, виконайте додатковий *`export`*: + If the registry was previously migrated to cluster A instead of being deployed on its Platform directly, perform an additional *`export`*: [source,bash] @@ -237,7 +231,6 @@ If the registry was previously migrated to cluster A instead of being deployed o export VAULT_KEY="" ---- -//* де *`<назва ключа>`* -- ключ для unseal процесу, який можна знайти в *Openshift*-консолі ( Кластер А ) > *Projects* > `<назва реєстру>` > *ConfigMaps* > *`hashicorp-vault-config`*. Поле *key_name* і є назвою ключа. where `` is the key for the unseal process, which can be found in the Openshift console (Cluster A) > *Projects* -> `` -> *ConfigMaps* > *`hashicorp-vault-config`*. The *key_name* field is the name of the key. For example: @@ -251,80 +244,75 @@ key_name = "autounseal-migration" + [WARNING] ==== -//У випадку міграції великого реєстру, виконайте експорт наступної змінної: + When migrating a large registry, export the following variable: [source,bash] ---- export LARGE_DATA="true" ---- ==== -//. Збережіть link:{attachmentsdir}/migrate-registry/registry-migration.zip[архів], розархівуйте його в нову директорію наступною командою: + . Download the link:{attachmentsdir}/migrate-registry/registry-migration.zip[registry-migration.zip] file, then extract it to a new directory using the following command: + ---- unzip registry-migration.zip -d registry-migration ---- + -//Перейдіть в директорію registry-migration (`cd`) та виконайте команду: + Go to the _registry-migration_ directory (via `cd`) and execute this command: + ---- chmod +x && ./migration.sh ---- -//. Після виконання скрипту, виконайте логін у терміналі за допомогою *oc cli* на кластері B, та перевірте наступне: + . After running the script, log in to the terminal via *oc cli* on cluster B and verify the following: -//* Наявність velero backup на кластері B. + * Velero backup is present on cluster B. -//* Наявність директорій із назвою _keycloak-export-<назва реєстру>-*_ у папці, де знаходиться скрипт. + * A directory named _keycloak-export--*_ is present inside the directory with the script. -//== Підготовка до відновлення на кластері B == Preparing the restore on cluster B -//. Перенесіть реалми. . Migrate realms. + -//Для перенесення реалмів, виконайте вхід до Keycloak на кластері B: + To migrate realms, sign in to Keycloak on cluster B: -//* В Openshift-консолі знайдіть проєкт (namespace) *`user-management`*, відкрийте *Networking* > *Routes* та перейдіть за посиланням до сервісу *`keycloak`*. + .. In the Openshift console, find the *`user-management`* project (or namespace), go to *Networking* > *Routes*, and click the *`keycloak`* link. + -//TIP: Дані для логіну можна отримати із секретів keycloak у тому ж проєкті. Для цього перейдіть до Workloads > Secrets, знайдіть у пошуку секрет із назвою *`keycloak`*, та у розділі Data скопіюйте дані для входу до сервісу. + TIP: You can obtain Keycloak credentials from keycloak secrets in the same project. Go to *Workloads* > *Secrets*, search for a secret named *`keycloak`*, and copy the credentials from the *Data* section. -//* За допомогою `*Select realm*` (1) > *`Add realm`* (2) > *`Import`* (3), виберіть файл _keycloak-export-<назва реєстру>-*/*-realm.json_ та створити реалми (оберіть стратегію *`SKIP`*, запропоновану Keycloak). Так пройдіться по усіх директоріях із назвою _keycloak-export-<назва реєстру>-*_. + .. In Keycloak, go to `*Select realm*` (1) > *`Add realm`* (2) > *`Import`* (3), select the _keycloak-export--*/*-realm.json_ file, and create realms using the *SKIP* strategy suggested by Keycloak. Do this for all directories with the name _keycloak-export--*_. + image:admin:migrate-registry/migrate-registry-1.png[image,width=514,height=194] -//. Перенесіть користувачів. + . Migrate users. + -//Залишаючись в адмін-консолі Keycloak, перейдіть до реалму (1), який був створений за допомогою імпорту, та у лівому меню реалму оберіть *`Import`* (2) (при імпорті оберіть стратегію *`SKIP`*), далі натисніть *`Select file`* (3) та виберіть файл із директорії _keycloak-export-<назва реєстру>-<ім’я реалму>/<ім’я реалму>-users-*.json_. + Without leaving the Keycloak admin console, go to the realm (1) that was created via import. In the realm menu on the left, select *`Import`* (2) (when importing, select the *SKIP* strategy), then click *`Select file`* (3) and select the file from the following directory: _keycloak-export--/-users-*.json_. + -//NOTE: Якщо файлів більше одного, то виконайте імпорт усіх файлів. -//TODO: Імпорт усіх разом чи по одинці? NOTE: If there are several files in this directory, import all of them. + image:admin:migrate-registry/migrate-registry-2.png[image,width=601,height=417] -//. Створіть реєстр через *`control-plane-console`*. + . Create a registry via *`control-plane-console`*. -//* Створіть реєстр з тим же ім'ям, і такою ж версією на кластері B. При створенні реєстру призначте усіх адміністраторів, що були у реєстрі на кластері A, та вкажіть актуальні дані. + .. Create a registry with the same name and version on cluster B. When creating the registry, assign the same administrators as on cluster A and provide up-to-date information. + [NOTE] ==== -//Дані про ключ :: + Key info :: -//Поля заповніть або з актуальними ключами для цього реєстру, або використовуйте тестові ключі. У майбутньому, після міграції, інформацію про ключі можна актуалізувати через консоль *Control Plane*. За даними для ключів звертатись до L2-L3 підтримки. + You can provide valid keys for your registry or use test keys. After the migration, you can update the key data via the *Control Plane* admin console. To obtain the key data, contact an L2-L3 support team. + -//Детальніше про оновлення ключів реєстру -- див. на сторінці xref:admin:registry-management/system-keys/control-plane-registry-keys.adoc[]. + For details on updating registry keys, see xref:admin:registry-management/system-keys/control-plane-registry-keys.adoc[]. -//Шаблон реєстру :: Registry template :: -//Оберіть такий самий шаблон, як і шаблон цього реєстру на кластері A. Для отримання назви шаблону, перейдіть до *Openshift*-консолі > *Projects* > *`control-plane`* > *API Explorer* > У пошуку визначте `codebase` > Перейдіть до `codebase` > *Instances* > Відкрийте `codebase <назва реєстру>` > Перевірте наступні налаштування: + Select the same template as used by the registry on cluster A. To find the template name, go to the *Openshift* console > *Projects* > *`control-plane`* > *API Explorer* > search for `codebase` > go to `codebase` > *Instances* > open `codebase ` and check the following settings: + .codebase.yaml @@ -334,39 +322,39 @@ metadata: annotations: registry-parameters/template-name: templates/registry-tenant-template-minimal ---- -//* де *`templates/registry-tenant-template-minimal`* -- назва шаблону розгортання реєстру. + In this case, *`templates/registry-tenant-template-minimal`* is the name of the registry deployment template. ===== ==== + -//NOTE: Якщо функціональність консолі дозволяє додати DNS для keycloak або порталів, на цьому етапі необхідно пропустити цей крок, адже трафік поки налаштований на кластер A). + NOTE: If the console allows you to add DNS for Keycloak and user portals, skip this step, as traffic is still configured for cluster A. -//* Після створення, одразу перейдіть до Jenkins (namespace *`control-plane`* > *Networking* > *Routes* > *`jenkins`*), та зупиніть першу збірку *`MASTER-Build-<назва реєстру>`*. + .. Right after creating the registry, go to Jenkins (*`control-plane`* namespace > *Networking* > *Routes* > *`jenkins`*), and stop the first *MASTER-Build-``* build. + -//NOTE: Дочекайтеся створення директорії `<назва реєстру>` та створення Jenkins-пайплайну. Після запуску одразу зробити *Abort* збірки. + NOTE: Wait until the `` directory and Jenkins pipeline are created. Immediately after the build starts, select *Abort*. -//. Залишаючись у консолі Jenkins, змініть конфігурацію *MASTER-Build-`<назва реєстру>`*: + -//Перейдіть до *MASTER-Build-`<назва реєстру>`* > *Configure*, та у секції *Build Triggers* встановіть прапорець на параметрі *Disable this project*. Далі збережіть зміни кнопкою *`Save`*. + + . Without leaving the Jenkins console, edit the *MASTER-Build-``* configuration: + Go to *MASTER-Build-``* > *Configure* > *Build Triggers*, select the *Disable this project* option, then click *Save*. -//. Перенесіть файли конфігурації *_values.yaml_* та *_values.gotmpl_* з репозиторію реєстру кластера А на кластер B. + . Move the _values.yaml_ and _values.gotmpl_ configuration files from the registry's repository on cluster A to cluster B. -//* Перейдіть до репозиторію реєстру на кластері А: + + .. Go to the registry repository on cluster A: + -//Відкрийте *Control-plane-console* > +++Дашборд+++ > *Gerrit* > *Browse* > *Repositories* > оберіть репозиторій *`<назва реєстру>`*. + + ... Go to *Control-plane-console* > *Dashboard* > *Gerrit*. + ... In Gerrit, go to *Browse* > *Repositories* and open the `` repository. + -//У репозиторії реєстру перейдіть до *Branches* > `master`, далі перейдіть до *deploy-templates*, відкрийте файл *_values.yaml_* ( *_values.gotmpl_* ) > Скопіюйте *raw*-код до буфера обміну. + ... In the registry repository, go to *Branches* > `master`, switch to *deploy-templates*, and open the _values.yaml_ (_values.gotmpl_) file. Copy its raw code to the clipboard and save it in any text editor. -//* Далі перейдіть до репозиторію реєстру на кластері B: + + .. Go to the registry repository on cluster B: + -//*Control-plane-console* > +++Дашборд+++ > *Gerrit* ) > *Browse* > *Repositories* та оберіть репозиторій *`<назва реєстру>`*. Через *commands* > *`Create change`* створіть зміну (change) із наступними параметрами: + ... Go to *Control-plane-console* > *Dashboard* > *Gerrit*. + ... In Gerrit, go to *Browse* > *Repositories* and open the `` repository. @@ -376,27 +364,26 @@ Go to *MASTER-Build-``* > *Configure* > *Build Triggers*, select ** *Select branch for new change*: `master`. ** *Description*: `Update registry before migration`. + -//Після створення зміни, у самому change натисніть *`Edit`* > *`ADD/OPEN/UPLOAD`* -- знайдіть файл *_values.yaml_* (*_values.gotmpl_*). + Once the change is created, click *`Edit`* > *`ADD/OPEN/UPLOAD`* and locate the _values.yaml_ (_values.gotmpl_) file. -//Перенесіть до цього файлу скопійовану конфігурацію *_values.yaml_* (*_values.gotmpl_*) із кластера А. + Copy the configuration from the _values.yaml_ (_values.gotmpl_) file on cluster A that you saved earlier and paste it inside this file. -//* Повторіть операцію для обох файлів: *_values.yaml_* та *_values.gotmpl_*. + .. Do this for both files: _values.yaml_ and _values.gotmpl_. -//* Збережіть зміни, дочекайтеся проходження пайплайну *Code Review* (*СІ Jenkins `+1`*), проставте `*Code-review +2*`,та виконайте злиття змін до `master`-гілки кнопкою `*Submit*`. + .. Save your changes, wait until the *Code Review* (*СІ Jenkins `+1`*) pipeline completes, then apply *`Code-review +2`* and merge changes to the `master` branch using the `*Submit*` button. -//. Перевірка наявності `*CustomResourceDefintition*`. + . Check for `*CustomResourceDefintition*`. + [WARNING] ==== -//Якщо до цього на кластері не було жодного реєстру, обов'язково перевірте наявність існування *`CustomResourceDefintition`*. Для цього виконайте логін через *`oc cli`* на кластері B та виконати наступну команду: + If no registries were deployed on cluster B previously, be sure to check for *`CustomResourceDefintition`*. To do this, log in to cluster B via *`oc cli`* and execute the following command: ---- oc get customresourcedefinition ingressclassparameterses.configuration.konghq.com ---- -//Якщо команда завершиться з помилкою та видасть у консолі *`No resources found`*, то перейдіть до директорії, де знаходиться скрипт *_migration.sh_*, та з кореневого шляху виконайте наступну команду: If this command ends with an error and returns a *`No resources found`* message in the console, go to the directory where the _migration.sh_ script is located and execute the following command from the root: ---- @@ -404,31 +391,28 @@ for file in $(ls crds); do oc apply -f crds/$file; done ---- ==== -//== Відновлення реєстру на кластері B == Restoring the registry on cluster B -//TODO: "Відрийте до" = відкрийте -//. Відрийте до Jenkins (namespace *`control-plane`* > *Networking* > *Routes* > *`jenkins`*), перейдіть до папки із назвою реєстру та запустіть Jenkins-пайплайн *`Restore-registry-<назва реєстру>`*. Після запуску пайплайну оберіть версію (на етапі `cleanup-registry-before-restore`) та дочекайтеся, коли процес завершиться. -. Go to Jenkins (*`control-plane`* namespace > *Networking* > *Routes* > *`jenkins`*) and open the folder with your registry name, then run the *Restore-registry-``* pipeline. After starting the pipeline, select the version to restore at the `cleanup-registry-before-restore` stage, and wait until the process completes. +[IMPORTANT] +Only return access to the registry once the restoration process is complete. +. Go to Jenkins (*`control-plane`* namespace > *Networking* > *Routes* > *`jenkins`*) and open the folder with your registry name, then run the *Restore-registry-``* pipeline. After starting the pipeline, select the version to restore at the `cleanup-registry-before-restore` stage, and wait until the process completes. + -//NOTE: У випадку, коли процес завершується помилкою або триває понад 1-2 години, зверніться до спеціалістів команди технічної підтримки L2-L3 "ЕПАМ". NOTE: If the process ends with an error or runs for more than 1-2 hours, contact an L2-L3 support team. -//. Після завершення пайплайну перейдіть в Openshift-консоль > Projects > <назва реєстру>, та перевірте, що немає под у статусі помилок. + . After the pipeline completes, go to the Openshift console > *Projects* -> `` and ensure no pods have an error status. + [NOTE] ==== -//У випадку, коли пода із назвою *`bpms-*`* не запущена і має статус помилки, виправте паролі у `postgres` для *`operational-instance`* та *`analytical-instance`* под, для цього потрібно: + If the *`bpms-*`* pod is not running and has an error status, you must fix the passwords for the *`operational-instance`* and *`analytical-instance`* pods in `postgres`. To do this, perform these steps: -//* Перейдіть в *Openshift*-консоль > *Secrets*, знайдіть secret для `operational-instance` -- *`operational-pguser-postgres`* (для `analytical-instance` -- це *`analytical-pguser-postgres`*). .. Go to *Openshift* console > *Secrets* and find the following secrets: ** *`operational-pguser-postgres`* secret for `operational-instance` ** *`analytical-pguser-postgres`* secret for `analytical-instance` -//* Перейдіть в *Secret* та скопіюйте поле *`password`*. + .. Open the secrets and copy the *password* field. -//* Перейдіть в *Openshift*-консоль > *Pods* > знайдіть поду *`operational-instance`* або *`analytical-instance`* та виконайте по черзі наступні команди: + .. Go to *Openshift* console > *Pods* and find the *`operational-instance`* and *`analytical-instance`* pods. For each pod, execute the following commands successively: + [source,bash] @@ -440,19 +424,18 @@ psql ---- ALTER ROLE postgres WITH PASSWORD ''; ---- -//** де *``* -- поле `password`, скопійоване у *Secret*, для відповідного екземпляра -- `operational` або `analytical`. -where *``* is the password you copied from the secret for each corresponding pod instance, `operational` and `analytical`. + -//* Після виконання усіх операцій, видаліть поду *`bpms`* та дочекайтеся, коли вона буде у статусі *`Running`* (активна/запущена). +where *``* is the password you copied from the secret for each corresponding pod instance, `operational` and `analytical`. + + .. After performing these steps, delete the *`bpms`* pod and wait until its status changes to *Running*. ==== + [NOTE] ==== -//У випадку, коли пода *`registry-rest-api`* запускається з помилкою `ImagePullBackOff`, додайте IP кластера B до анотації *Openshift Route* > *Nexus*. + If the *`registry-rest-api`* pod returns an `ImagePullBackOff` error, add cluster B's IP to the *Openshift Route* > *Nexus* annotation. -//* Для цього перейдіть в *Openshift*-консоль > *Project* > `<назва реєстру>` > *Routes* > *Nexus* > *YAML* та перевірте наступне поле у _.yaml_-конфігурації:. To add the IP, go to *Openshift* console > *Projects* -> `` -> *Routes* > *Nexus* > *YAML* and check the following field in the _.yaml_ configuration: .route.yaml @@ -464,17 +447,16 @@ metadata: ---- ===== -//Якщо IP-адреса кластера B відсутня, додайте її до *`haproxy.router.openshift.io/ip_whitelist`* із маскою *`/32`*. If the IP address of cluster B is missing, add it to *`haproxy.router.openshift.io/ip_whitelist`* with a *`/32`* mask. ==== + -//. Після перевірки, що усі поди у статусі *`Running`*, перенесіть конфігурацію реєстру до *_values.yaml/values.gotmpl_*. + . After ensuring all pods have a *Running* status, transfer the registry configuration to _values.yaml/values.gotmpl_. + -//* Увійдіть до *_control-plane-gerrit_* (*Openshift*-консоль > *Projects* -> *`control-plane`* -> *Networking* -> *`gerrit`* > Логін через *`openshift-sso`*). + .. Go to *_control-plane-gerrit_* (*Openshift* console > *Projects* > *`control-plane`* > *Networking* > *`gerrit`* > sign in via *`openshift-sso`*). + -//У Gerrit перейдіть до *Browse* > *Repositories* та оберіть репозиторій *`<назва реєстру>`*. Через *`commands`* > *`Create change`* створіть зміну (change) із наступними параметрами: + .. In Gerrit, go to *Browse* > *Repositories* and select the repository with your registry name. + .. Go to *Commands* and click *`Create change`* to create a change with the following parameters: @@ -482,12 +464,12 @@ If the IP address of cluster B is missing, add it to *`haproxy.router.openshift. ** *Select branch for new change*: `master`. ** *Description*: `Update registry before migration`. + -//Після створення change, у самому change натисніть *`Edit`*. + .. Once the change is created, click *`Edit`*. -//* Додайте конфігурацію `vault` у *_values.gotmpl_*. + .. Add `vault` configuration to _values.gotmpl_. + -//Для цього візьміть актуальну конфігурацію `vault` з config-map *`hashicorp-vault-config`* (*Openshift*-консоль > *Projects* > `<назва реєстру>` > *Workloads* > *ConfigMaps* > *`hashicorp-vault-config`*) та скопіюйте поле як у наступному прикладі: + To do this, take the current `vault` configuration from the *`hashicorp-vault-config`* config-map (*Openshift* console > *Projects* -> `` -> *Workloads* > *ConfigMaps* > *`hashicorp-vault-config`*) and copy the field as shown in the following example: + ---- @@ -510,10 +492,10 @@ seal "transit" { } ---- + -//* де *``* -- посилання до *`vault`*, *``* -- назва ключа (у конфігурації з `config-map` будуть актуальні поля). + where *``* is the link to the *`vault`* and *``* is the name of the key. The `config-map` contains up-to-date values. + -//Далі в change натисніть *`ADD/OPEN/UPLOAD`*, у пошуку вкажіть *_values.gotmpl_* та виберіть потрібний файл. В самому файлі додайте конфігурацію як у прикладі: + .. Next, click *`ADD/OPEN/UPLOAD`* inside the change, search for _values.gotmpl_, and select the file. Inside the file, add the configuration as shown in the following example: + [source,yaml] @@ -548,9 +530,9 @@ vault: tls_skip_verify = "true" } ---- -//* Після додавання натисніть Save. + .. Click *`Save`*. -//* Змініть розмір `kafka`-дисків. Залишаючись у цьому файлі, знайдіть поле: + .. Resize `kafka` disks. Without leaving the template file, find the following field: + [source,yaml] @@ -562,8 +544,8 @@ storage: size: 20Gi ---- + -//* Змініть розмір `kafka.size` відповідно до розміру актуального диска в *Openshift*-консолі (*Openshift*-консоль > *Project* -> `<назва реєстру>` -> *Storage* > *`PersistentVolumeClaims`* ). У пошуку знайдіть *`data-0-kafka-cluster-kafka-0`* та його *`Capacity`*. Поверніться до редагування _values.gtmpl_ та встановіть бажаний розмір диска: -//TODO: .gtmpl or .gotmpl? + + .. Modify the `kafka.size` value according to the current disk size in *Openshift* (*Openshift* console > *Projects* -> `` -> *Storage* > *`PersistentVolumeClaims`*). Search for *`data-0-kafka-cluster-kafka-0`* and find out its *`Capacity`*. Go back to _values.gotmpl_ and set the desired disk size. For example: + ---- @@ -574,59 +556,55 @@ storage: size: 40Gi ---- + -//** де 40Gi - актуальний розмір диска з `Capacity`. + where 40Gi is the current disk size that matches `Capacity`. + -//* Видаліть усіх *`GerritGroupMember`*. Для цього виконайте вхід до кластера B через ос cli та виконати наступну команду: + .. Delete all *`GerritGroupMember`*. To do this, log in to cluster B via `os cli` and execute the following command: + ---- oc -n delete gerritgroupmember --all ---- + -//. Після застосування змін має запуститися Jenkins-процес *`MASTER-Build-<назва реєстру>`*. + . After the changes are applied, the *MASTER-Build-``* Jenkins process should start. -//. Після з завершення Jenkins-пайплайну *`MASTER-Build-<назва реєстру>`*, виправте Jenkins Credentials у Jenkins реєстру. + . After the *MASTER-Build-``* Jenkins process completes, fix Jenkins credentials in the Jenkins registry. + [NOTE] ==== -//У випадку, коли доступу немає, додайте себе як адміністратора реєстру через control-plane-console. + If you don't have access, add yourself as a registry administrator via *`control-plane-console`*. ==== -//* Для цього перейдіть в *Openshift-консоль* > *Projects* > `<назва реєстру>` > *Workloads* > *Secrets* > *`gerrit-control-plane-sshkey`* та скопіюйте поле *`id_rsa`*. + .. To do this, go to *Openshift* console > *Projects* -> `` -> *Workloads* > *Secrets* > *`gerrit-control-plane-sshkey`* and copy the *id_rsa* field. + -//* Після цього перейдіть у реєстровий Jenkins (*Networking* > *Routes* > `*jenkins*`) > Manage Jenkins > Manage Credentials > *`gerrit-ci-users-sshkey`* (*`gerrit-control-plane-sshkey`*) > натисніть *`Update`*. + .. Then go to the registry Jenkins (*Networking* > *Routes* > `*jenkins*`) and open *Manage Jenkins* > *Manage Credentials*, find *`gerrit-ci-users-sshkey`* (*`gerrit-control-plane-sshkey`*), and click *`Update`*. + -//* У полі *`Private Key`* за допомогою *`Replace`* вставте скопійоване значення. + .. In the *Private Key* field, paste and *`Replace`* the *id_rsa* value you copied earlier. + -//. Оновіть посилання на Nexus у репозиторії регламенту. + . Update Nexus URL in the regulations repository. + -//Для цього перейдіть до *Openshift*-консолі > *Project* -> <назва реєстру> > *Gerrit* та виконайте логін. To do this, go to *Openshift* console > *Projects* -> `` -> *Gerrit* and sign in to Gerrit. + -//Далі перевірте наявність доступу до проєктів у Gerrit та клонуйте локально репозиторій *_registry-regulations_*. Для цього: -//TODO: уточнення: "наявність доступу" - у користувача, я так розумію? Next, make sure you have access to projects in Gerrit and clone the *_registry-regulations_* repository locally. To do this, perform these steps: -+ -//* У вебінтерфейсі Gerrit, перейдіть у налаштування > *HTTP Credentials* > згенеруйте новий пароль за допомогою `*Generate New Password*`, та збережіть цей пароль у нотатках. + .. In the Gerrit web interface, go to settings > *HTTP Credentials* and click `*Generate New Password*` to generate a new password. Save this password in any text editor. + -//* Перейдіть до репозиторію *`registry-regulations`* > та скопіюйте команду для клону *Anonymous HTTP* > *`Clone with commit-msg hook`*. + + .. Go to the *`registry-regulations`* repository and copy the contents of the *Clone with commit-msg hook* text box in the *Anonymous HTTP* tab. + -//* Вставте команду для клону репозиторію до термінала та виконайте. Команда запитає логін та пароль. Логін в цьому випаду буде ваш email, а пароль -- той, який ви згенерували у першому підпункті. + .. Paste the repository clone command into the terminal and execute. The command will prompt you for a login and password. For the login, enter your email. For the password, paste the one you generated earlier in step A. + TIP: For details on working with Gerrit repositories, see xref:registry-develop:registry-admin/regulations-deploy/registry-admin-deploy-regulation.adoc[]. + [NOTE] ==== -//Якщо в системі git user відрізняється від вашого user на сервері Gerrit, виконайте наступні команди: + If your Git user is different from your Gerrit user, execute the following commands: ---- git config --global user.name "New Author Name" @@ -640,8 +618,8 @@ git config --global user.email "jong_doe@doemail.com" ---- ==== + -//. Змініть мінорну версію в _settings.yaml_ у кореневій (root) директорії репозиторію *_registry-regulations_* згідно із приладом: -//TODO: приладом - прикладом + + . Change the minor version in _settings.yaml_ in the root directory of the *_registry-regulations_* repository, as shown in the following example: + ---- @@ -661,13 +639,13 @@ settings: version: 2.21.1 ---- + -//. Замініть згадування DNS-кластера А на кластер B. Для цього у терміналі перейдіть до директорії *_registry-regulations/data-model_* + . Replace all mentions of cluster A DNS with cluster B. To do this, go to the *_registry-regulations/data-model_* directory in the terminal: + ---- cd registry-regulations/data-model ---- -//Та виконайте наступну команду по заміні DNS: ++ Then execute the following command to replace DNS: + ---- @@ -676,17 +654,16 @@ find "." \( -type d -name .git -prune \) -o -type f -print0 | xargs -0 sed -i -e + [TIP] ==== -//`Cluster A DNS wildcard/Cluster B DNS wildcard` -- це *`apps.*`* (наприклад, `*apps.reestr1.eua.gov.ua*`). + `Cluster A DNS wildcard/Cluster B DNS wildcard` refers to *`apps.*`* (for example, `*apps.reestr1.eua.gov.ua*`). -//Як повинно виглядати sed правило: Here is how a sed rule should look: ---- 's/apps.cluster-a.dns.wildcard.com/apps.cluster-b.dns.wildcard.com/g' ---- ==== + -//. Виконайте commit змін та push до репозиторію: + . Commit and push changes to the repository: + [source,git] @@ -704,25 +681,21 @@ git commit -m "Update nexus URL" git push origin refs/heads/master:refs/for/master ---- + -//. Перейдіть у реєстровий Gerrit, проставте відмітки *`Code-Review +2`*, та за допомогою кнопки kbd:[*Submit*] застосуйте зміни до master-гілки. + . Go to the registry Gerrit, apply *`Code-review +2`*, and merge changes to the `master` branch using the `*Submit*` button. + -//. Після внесення змін до master-гілки перейдіть до Jenkins реєстру та перевірте, що Jenkins-пайплайни у Jenkins Folder *registry-regulations* завершилися зі статусом *`Success`*. + . After updating the master branch, go to the registry Jenkins and make sure the pipelines in the *registry-regulations* folder have been completed with a *Success* status. -//== Перевірка реєстру == Testing the registry -//. Переконайтеся, що Кабінети користувачів працюють у штатному режимі, та бізнес-процеси мігрували успішно. . Make sure the user portals are working correctly and the business processes have migrated successfully. + -//. Усі Jenkins pipeline мають завершитися зі статусом *`Success`*. + . All Jenkins pipelines should complete with a *Success* status. -//== Перенесення конфігурації реєстру == Migrating the registry configuration -//Перенесіть конфігурацію реєстру із кластера А на кластер B відповідно до документації: :: Migrate the registry configuration from cluster A to cluster B according to the following documentation: :: * *Administrators* (for details, see xref:registry-develop:registry-admin/create-users/create-registry-admins.adoc[]). @@ -731,7 +704,7 @@ Migrate the registry configuration from cluster A to cluster B according to the * *Registry resources* + [NOTE] -//Перенесіть параметри налаштувань із файлу _values.yaml_ (секція `global.registry` ) реєстру на кластері А до налаштувань у файлі _values.yaml_ реєстру на кластері В. + Transfer registry configuration parameters (the `global.registry` section) from the _values.yaml_ file on cluster A to the _values.yaml_ file on cluster B. * *DNS* (for details, see xref:admin:registry-management/custom-dns/custom-dns-overview.adoc[]). diff --git a/docs/en/modules/admin/pages/registry-management/control-plane-create-registry.adoc b/docs/en/modules/admin/pages/registry-management/control-plane-create-registry.adoc index 245fa3590e..4700b934e9 100644 --- a/docs/en/modules/admin/pages/registry-management/control-plane-create-registry.adoc +++ b/docs/en/modules/admin/pages/registry-management/control-plane-create-registry.adoc @@ -3,13 +3,10 @@ include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc include::platform:ROOT:partial$admonitions/language-en.adoc[] -//Після успішного xref:installation/platform-deployment/platform-deployment-overview.adoc[встановлення Платформи на цільовому оточенні], адміністратор Платформи отримує доступ до адміністративної панелі, що має назву *Control Plane*. Вона дозволяє керувати конфігураціями інфраструктурних компонентів Платформи (`cluster-mgmt`), а також компонентів реєстру. - After successfully xref:installation/platform-deployment/platform-deployment-overview.adoc[deploying the Platform on a target environment], a Platform administrator can access the *Control Plane* admin console interface. In Control Plane, you can manage the configurations of the Platform infrastructure components (`cluster-mgmt`) and registry components. [TIP] ==== -//Посилання до сервісу *Control Plane* можливо отримати у консолі *Openshift*. Перейдіть до розділу *Networking* > *Routes*, у пошуку вкажіть значення *`control-plane`*, і посилання буде доступне у стовпці *Location*. You can find the link to *Control Plane* in the OpenShift console. Go to *Networking* > *Routes* and search for `control-plane`. The link is displayed in the *Location* column of search results. image:infrastructure/cluster-mgmt/cp-registry-deploy-12.png[] @@ -17,81 +14,61 @@ image:infrastructure/cluster-mgmt/cp-registry-deploy-12.png[] [IMPORTANT] ==== -//Розгорнути реєстр в адмін-панелі *Control Plane* може лише адміністратор Платформи з відповідними правами доступу. Для цього необхідна роль `cp-cluster-mgmt-admin` у реалмі `control-plane-admin` сервісу *Keycloak*. Only a Platform administrator with appropriate permissions can deploy a registry using the *Control Plane* admin console. This action requires a `cp-cluster-mgmt-admin` role in Keycloak's `control-plane-admin` realm. For details, see xref:admin:registry-management/control-plane-assign-platform-admins.adoc[]. ==== -//Для розгортання нового реєстру виконайте наступні кроки: :: To deploy a new registry, perform these steps: :: + -//. Увійдіть до адміністративної панелі *Control Plane*, використовуючи попередньо отримані логін та пароль. . Sign in to *Control Plane*. + image:admin:infrastructure/cluster-mgmt/update-cluster-mgmt-01.png[] -//. Перейдіть до розділу +++Реєстри+++ > далі натисніть `+++Створити новий+++`. + . Open the *Registries* section and click the *`Create New`* button. + image:infrastructure/cluster-mgmt/cp-registry-deploy-1.png[] -//. Заповніть параметри конфігурації відповідними даними. + . Configure your registry parameters. + -//TIP: Детальніше про кроки розгортання описано у розділах нижче. TIP: Read on for details on each deployment step. -//== Загальні налаштування +[#general-settings] == General settings -//На цьому кроці ви можете вказати службову (системну) назву реєстру, яка буде використовуватися у різних операціях обміну даними на Платформі. In this step, you can specify the registry's system name, which is used in various data exchange operations on the Platform. The registry name cannot be changed once the registry is created. [CAUTION] ==== -//* Назва повинна бути унікальною, і її неможливо буде змінити після створення реєстру. Поле +++Назва реєстру+++ є обов'язковим до заповнення. -//TODO: Slightly rearranged the contents of this list item. * The *Registry name* is a required field. * The name must be unique. -//* Для введення доступні лише латинські літери (`"a-z"`) та знак `"-"`. * Allowed characters are lowercase Latin letters (`a-z`) and hyphens (`-`). -//* Довжина не повинна перевищувати 12 символів. * The name cannot contain more than 12 characters. ==== -//Додатково ви можете вказати опис, який може містити офіційну назву реєстру чи його призначення. Це поле потрібне для інформаційних (бізнес- або юридичних) цілей. - You can describe the purpose of the registry or provide its official name in the *Description* field. This information may be helpful for business or legal reasons. -//Натисніть `+++Підтвердити+++` для переходу до наступного кроку. - Click *`Confirm`* to go to the next step. image:admin:registry-management/registry-create/cp-create-registry-1.png[] -//== Створення адміністраторів реєстру == Creating registry administrators -//На цьому кроці ви можете призначити _адміністраторів реєстру_. In this step, you can assign registry administrators. [NOTE] ==== -//Можливість внесення нових адміністраторів буде доступна і згодом після розгортання, через опцію редагування реєстру. You can also add administrators by editing the registry soon after its deployment. For details, see xref:registry-develop:registry-admin/create-users/create-registry-admins.adoc[]. ==== -//. У полі +++Адміністратори+++ вкажіть адміністраторів, яким буде надано доступ до реєстру. . In the *Administrators* field, specify the administrators who will have access to the registry. + -//CAUTION: Поле є обов'язковим до заповнення. -//TODO: Does it mean at least ONE admin must be added here? -CAUTION: This is a required field. +CAUTION: This is a required field. It means at least ONE admin must be added here. + image:admin:registry-management/registry-create/cp-create-registry-2-1.png[] + -//Натисніть `+` (`Додати`) та у новому вікні введіть дані кожного адміністратора реєстру, а саме: Click the *`+`* (*Add*) button and provide the following details for each registry administrator: + -- @@ -104,56 +81,42 @@ Click the *`+`* (*Add*) button and provide the following details for each regist image:admin:registry-management/registry-create/cp-create-registry-2.png[] + -//Для того, щоб надати доступ декільком особам, повторіть дію для кожного адміністратора окремо (`+` > вкажіть дані адміністратора > `+++Підтвердити+++`). To add several administrators, repeat this step for each user separately (click *`+`* > provide details > *`Confirm`*). + [NOTE] ==== -//Використовуйте нижній регістр для введення даних електронної пошти. -Use lower case for email addresses. +Use a lower case for email addresses. -//Доступні символи: `"0-9"`, `"a-z"`, `"_"`, `"-"`, `"@"`, `"."`, `","`. Allowed characters are: digits (`0-9`), Latin letters (`a-z`), underscores (`_`), hyphens (`-`), at sign (`@`), dots (`.`), and commas (`,`). ==== -//. Натисніть `+++Далі+++` для переходу до наступного кроку. -. Click *`Next`* to go to the next step. +. Click *`Next`* to go to the next step. + image:admin:registry-management/registry-create/cp-create-registry-2-2.png[] - + [NOTE] ==== -//Користувач-адміністратор реєстру автоматично створюється у реалмі `openshift` сервісу *Keycloak* із роллю `cp-registry-admin-` та групою `/cp-registry-admin-`, де `` -- назва реєстру. The registry administrator account is automatically created in the `openshift` realm of the *Keycloak* service with the `cp-registry-admin-` role in the `/cp-registry-admin-` group, where `` is the name of your registry. ==== -//== Шаблон розгортання реєстру == Registry deployment template -//На цьому кроці оберіть шаблон для розгортання реєстру. Залежно від навантаження, яке очікується на реєстр, ви можете обрати одну з доступних конфігурацій, тобто певний шаблон із відповідною кількістю ресурсів. Наприклад, мінімальна або рекомендована конфігурація, або конфігурація з геосервером тощо). - In this step, you can select a template for your registry. Templates are predefined registry configurations with a set number of resources that you can select depending on the expected workload. For example, you can choose between a minimum and recommended configuration, or select a configuration with GeoServer, and so on. -//Приблизну вартість обчислювальних ресурсів реєстру ви можете розрахувати на сторінці xref:arch:architecture/registry-cost.adoc[], або зверніться за консультацією до команди технічної підтримки Платформи. -//TODO: This feels like a TIP. -To calculate the approximate cost of the resources your registry will need, use the xref:arch:architecture/platform-system-requirements/registry-cost.adoc[] page or reach out to the Platform's technical support team. +TIP: To calculate the approximate cost of the resources your registry will need, use the xref:arch:architecture/platform-system-requirements/registry-cost.adoc[] page or reach out to the Platform's technical support team. image:admin:registry-management/registry-create/cp-create-registry-3.png[] -//. У полі +++Шаблон реєстру+++ оберіть зі списку шаблон конфігурації, відповідно до якого розгортатиметься реєстр. . Select the configuration template for your registry from the *Registry template* list. + -//Шаблон реєстру визначає параметри конфігурації та кількість інстансів для реєстру, що розгортається, тобто виділену кількість ресурсів, зокрема *CPU*, *RAM* тощо, та кількість нод у *MachineSets*. A registry template defines the configuration options and the allocated resources, including *CPU*, *RAM*, the number of nodes in *MachineSets*, and so on. + CAUTION: This is a required field. + image:admin:registry-management/registry-create/cp-create-registry-3-1.png[] -//. У полі +++Гілка шаблону реєстру+++ оберіть гілку, яка буде застосована при розгортанні реєстру. + . In the *Registry template branch* field, select the branch to use when deploying your registry. + -//NOTE: Мається на увазі версія гілки компонента у Gerrit-репозиторії, що містить відповідну версію шаблону реєстру. NOTE: This refers to the version of the component's branch in the Gerrit repository containing the corresponding registry template version. + CAUTION: This is a required field. @@ -161,27 +124,19 @@ CAUTION: This is a required field. image:admin:registry-management/registry-create/cp-create-registry-3-2.png[] . Click *`Next`* to go to the next step. - + image:admin:registry-management/registry-create/cp-create-registry-3-3.png[] -//== Вибір поштового сервера == Mail server settings -//На цьому кроці оберіть тип поштового сервера для відправлення email-повідомлень у реєстрі. - In this step, you can select the type of mail server your registry will use for sending email messages. -//CAUTION: Крок є опціональним. Ви можете пропустити ці налаштування. Їх можна змінити під час редагування реєстру. - CAUTION: The step is optional. You can skip it when creating a registry and return to these settings when editing it. image:admin:registry-management/registry-create/cp-create-registry-4.png[] -//* +++Внутрішній поштовий сервер+++ (`*platform-mail-server*`) — поштовий сервер, який розповсюджується як платформний сервіс та доступний для використання усіма реєстрами одного екземпляра Платформи. -//TODO: ua: "платформенний" * *Platform mail server* (`platform-mail-server`) is a mail server distributed as part of the Platform. This service is available to all registries within a single instance of the Platform. -//* +++Зовнішній поштовий сервер+++ (*`external-mail-server`*) — зовнішній відносно платформи поштовий сервіс (*gmail* тощо). + * *External mail server* (`external-mail-server`) is a mail server outside the Platform (such as *Gmail*). [TIP] @@ -191,22 +146,16 @@ For details, see xref:registry-develop:registry-admin/user-notifications/email/c Click *`Next`* to go to the next step. -//== Дані про ключ -== Key info -//TODO: This section contains a lot of ua-specific stuff. +== Information about keys -//На цьому кроці налаштуйте параметри конфігурації для ключів та сертифікатів цифрового підпису, які будуть використовуватись у реєстрі. Надалі дані про ключ можна оновлювати при редагуванні реєстру. In this step, you can configure your registry's digital signature keys and certificates. Once the registry is created, you will be able to update these settings by editing your registry. [IMPORTANT] ==== -//Крок є обов'язковим. This step is mandatory. -//Секція +++Дані про ключ+++ має містити налаштування для ініціалізації криптосервісу (*`digital-signature-ops`*) та накладання системного підпису (цифрової печатки системи). Без внесення цих даних пода криптосервісу не запуститься. Data in the *Key info* section is required to initialize the `digital-signature-ops` crypto service and apply the system signature, or system digital seal. Without this information, the crypto service will not start. -//Такі ключі використовуються для підпису витягів, сформованих Платформою, та підпису даних, що змінюються відповідно до логіки бізнес-процесів реєстру. Encryption keys are used to sign excerpts generated by the Platform and to sign data that is modified according to the logic of the registry's business processes. ==== @@ -215,31 +164,26 @@ Encryption keys are used to sign excerpts generated by the Platform and to sign For details on configuring keys, see xref:registry-management/system-keys/control-plane-registry-keys.adoc[]. ==== -//. У полі +++Тип носія+++ оберіть відповідний тип ключа, що використовується. . In the *Media type* field, select the type of key to use. -//. Оберіть електронний ключ. + . Provide the electronic key. + -//Поле +++Файловий ключ (розширення .dat)+++ заповнюється операційним ключем із розширенням `.dat` (_Key-6.dat_) адміністратора Платформи. Завантажте файл із ключем, натиснувши kbd:[*Browse*], оберіть ключ у відповідній директорії та натисніть kbd:[*Open*]. Upload the Platform administrator's operational key file (_Key-6.dat_) using the *File key (.dat)* field. Click kbd:[*Browse*], locate the key file on your computer, select it, and click kbd:[Open]. -//. У полі +++АЦСК, що видав ключ+++ показана повна назва АЦСКfootnote:[**АЦСК** - Акредитований центр сертифікації ключів.], що видав ключ. -//TODO: Removed the footnote to simplify this. + . The *AKCC that issued the key* field displays the full name of the AKCC (Accredited Key Certification Center). -//TODO: "АЦСК, що видав ключ" та "Емітент ключа" - це одне й те саме? -//. У полі +++Пароль до файлового ключа+++ введіть пароль до завантаженого ключа. + . In the *File key password* field, enter the password for the key you uploaded. -//. Секція +++Дані для перевірки ключа+++ містить дані публічних сертифікатів та перелік АЦСК: + . The *Key validation info* section contains public certificates data and a list of AKCCs: -//* У полі +++Публічні сертифікати АЦСК (розширення .p7b)+++ завантажте файл із переліком сертифікатів сумісних ЦСК (https://iit.com.ua/download/productfiles/CACertificates.p7b[CACertificates.p7b]), який можна отримати на сайті АТ "ІІТ" за посиланням https://iit.com.ua/downloads. + * Upload the https://iit.com.ua/download/productfiles/CACertificates.p7b[CACertificates.p7b] file that contains a list of certificates of compatible AKCCs using the *Public AKCC certificates (.p7b)* field. You can download this file from the IIT website: https://iit.com.ua/downloads. -//* У полі +++Список АЦСК (розширення .json)+++ завантажте файл із параметрами взаємодії сумісними ЦСК (link:https://iit.com.ua/download/productfiles/[CAs.json]), який можна отримати на сайті АТ "ІІТ" за посиланням: https://iit.com.ua/downloads. + * Upload the https://iit.com.ua/download/productfiles/[CAs.json] file that contains interaction parameters for compatible AKCCs using the *AKCCs list (.json)* field. You can download this file from the IIT website: https://iit.com.ua/downloads. -//. Вкажіть +++Перелік дозволених ключів+++, підпис яких може вважатися дійсним. + . In the *Allowed keys list*, specify the keys whose signatures are considered valid. + [NOTE] ==== -//У цьому блоці зазначається перелік ключів, у тому числі й старих (наприклад, при ротації ключів), щоб все, що раніше було підписано старим ключем, вважалося валідованим. Тобто перелік дозволених ключів повинен містити історію даних усіх ключів, що використовувались у системі для накладання підпису. This section contains a list of all keys, including old ones (for example, when rotating keys), so that everything previously signed with an old key is still considered validated. That is, the list of allowed keys should contain the data history of all the keys used in the system to apply a signature. ==== @@ -247,48 +191,39 @@ This section contains a list of all keys, including old ones (for example, when image:admin:registry-management/registry-create/cp-create-registry-5.png[] -//== Ресурси реєстру == Registry resources -//На цьому кроці ви можете визначити конфігурацію для ресурсів реєстру по певних сервісах, які у ньому розгортаються. Керування ресурсами, що використовуються контейнерами в рамках вашого екземпляра реєстру, дозволяє забезпечити оптимальну працездатність та ефективність. In this step, you can configure registry resources for specific services that are deployed in it. Properly managing the resources used by containers within your registry instance ensures optimal performance and efficiency. -//. Оберіть зі списку сервіс для конфігурації ресурсів і натисніть *`+`* (`Додати`). . Select the service you wish to configure from the list and click *`+`* (*Add*). + [CAUTION] ==== This step is optional. -//Під час розгортання реєстру усі наявні сервіси налаштовані та передзаповнені відповідними значеннями запитів, лімітів та змінних оточення за замовчуванням. -//TODO: про які "запити" тут йдеться? When the registry is deployed, all its services are configured using the default values for requests, limits, and environment variables. -//Навіть у випадку видалення сервісів зі списку, під час розгортання реєстру Платформа застосує стандартну конфігурацію. -//TODO: Not clear how services are removed from the list. Even if services are removed from the list, the Platform will apply the standard configuration when deploying the registry. ==== + image:admin:registry-management/registry-create/cp-create-registry-7.png[] -//. Встановіть власні значення для ресурсів. + . Customize resource parameters. + . Click *`Next`* to go to the next step. + image:admin:registry-management/registry-create/cp-create-registry-7-1.png[] TIP: For details on configuring the resources, see xref:registry-management/control-plane-registry-resources.adoc[]. -//== Налаштування DNS == DNS settings -//На цьому кроці ви можете встановити власні DNS-імена і завантажити SSL-сертифікати у `.pem`-форматі для сервісу Keycloak, а також Кабінетів користувачів. In this step, you can set custom DNS names and upload SSL certificates in `.pem` format for the Keycloak service and user portals. [CAUTION] ==== This step is optional. -//Якщо ви не вкажете тут жодних налаштувань, система використає значення за замовчуванням. If you do not configure anything here, the system will use the default values. ==== @@ -298,15 +233,12 @@ TIP: For details on configuring DNS, see xref:admin:registry-management/custom-d Click *`Next`* to go to the next step. -//== Обмеження доступу == Access restrictions -//На цьому кроці ви можете встановити обмеження доступу до певних компонентів, які використовуються у реєстрі, зокрема _Кабінетів посадової особи та отримувача послуг_, а також _адміністративних компонентів реєстру_. In this step, you can restrict access to specific registry components, such as user portals and administrative components. [CAUTION] ==== -//Крок є опціональним, але з метою безпеки рекомендовано встановити CIDR для відповідних компонентів. This step is optional, but we recommend configuring CIDR for these components for security purposes. ==== @@ -318,31 +250,28 @@ Click *`Next`* to go to the next step. == Officers (service providers) authentication -//На цьому кроці ви можете налаштувати тип автентифікації для надавачів послуг (посадових осіб), а також дозволити, або заборонити можливість автореєстрації. In this step, you can configure authentication for service providers (officers) and enable or disable self-registration. [CAUTION] ==== This step is optional. -//Якщо ви не вкажете тут жодних налаштувань, система використає значення за замовчуванням -- автентифікація з КЕП та вимкнена автореєстрація. If you do not configure anything here, the system will use the default values: authentication using Qualified Electronic Signature (QES) and disabled self-registration. ==== image:admin:registry-management/registry-create/cp-create-registry-9.png[] -//Ви можете обрати один із двох типів автентифікації, який буде доступний для ідентифікації особи в системі: Select the authentication type to use when identifying users in the system: -//TODO: ua-specific: I think we can keep the QES option without referring to IIT, but remove the id.gov.ua widget option. -//* КЕП (*IIT*-віджет) -* QES -//* Віджет *id.gov.ua* -* *id.gov.ua* widget +-- +* QES -- a widget to authenticate users via Qualified electronic signatures. +* *id.gov.ua* -- a widget to authenticate users via third-party digital identification providers. +-- + +include::ROOT:partial$admonitions/ua-specific.adoc[] TIP: For details, see xref:registry-develop:registry-admin/cp-auth-setup/cp-auth-setup-officers.adoc[]. -//Самостійна реєстрація посадових осіб дозволить вам спростити процес реєстрації користувачів без необхідності залучення адміністратора. You can enable the self-registration option for officers to simplify the user registration process by removing the need to involve an administrator. TIP: For details, see xref:registry-develop:registry-admin/cp-auth-setup/cp-officer-self-registration.adoc[]. @@ -353,45 +282,31 @@ Click *`Next`* to go to the next step. include::ROOT:partial$admonitions/ua-specific.adoc[] -//TODO: ua-specific, probably irrelevant to non-ua Platform -//На цьому кроці ви можете налаштувати перевірку наявності активного запису в ЄДР для бізнес-користувачів, що дозволяє встановити зв'язок між КЕП користувача та його юридичною особою чи фізичною особою-підприємцем, що зареєстровані в Єдиному державному реєстрі (ЄДР). Це важливий аспект безпеки та надійності системи, який допомагає забезпечити відповідність даних користувача та підтвердження їх особистості. In this step, you can set up validation to check whether business users have an active entry in the Unified state register (EDR). This allows the system to connect the user's QES with their legal records in the state register. This is an important aspect of the system's security and reliability that helps validate user data and confirm their identity. [CAUTION] ==== This step is optional. -//Якщо ви не вкажете тут жодних налаштувань, система використає значення за замовчуванням -- перевірка увімкнена. If you do not configure anything here, the system will use the default value: validation disabled. ==== image:admin:registry-management/registry-create/cp-create-registry-10.png[] -//TIP: For details, see xref:registry-develop:registry-admin/cp-auth-setup/cp-auth-setup-citizens.adoc[]. - Click *`Next`* to go to the next step. -//== Резервне копіювання == Backup settings -//На цьому кроці ви можете налаштувати розклад створення резервних копій компонентів реєстру, а також період зберігання таких копій у сховищі бекапів. In this step, you can set the backup schedule for your registry components and define the retention period for backup copies in the backup repository. -//Резервні копії компонентів створюються за допомогою інструменту *`velero`* та зберігаються у захищеному сховищі бекапів *`minio`*, що знаходиться поза межами кластера Платформи. Component backup copies are created using the *Velero* tool and stored in the *MinIO* secure backup storage outside the Platform cluster. -//Розклад резервного копіювання налаштовується у форматі https://uk.wikipedia.org/wiki/Cron[*unix-cron*] на інтерфейсі адміністративної панелі *Control Plane*. The backup schedule is configured using the https://uk.wikipedia.org/wiki/Cron[*unix-cron*] format in the *Control Plane* admin console interface. -//Також система виконує автоматичну реплікацію даних, які зберігаються в S3-бакетах. Ви можете налаштувати розклад резервного копіювання таких реплікацій. The system also performs automatic replication of data stored in S3 buckets. You can configure a backup schedule for these replications. image:admin:backup-restore/backup-schedule-registry-components/backup-schedule-registry-components-8-1.png[] -//TIP: Детальніше про автоматичне створення резервних копій реєстру, а також резервне копіювання реплікацій S3-бакетів, читайте на сторінці xref:admin:backup-restore/backup-schedule-registry-components.adoc[]. - -//TIP: Додатково ознайомтеся зі створенням бекапів у ручному режимі та відновленням з них середовища реєстру на сторінці xref:admin:backup-restore/control-plane-backup-restore.adoc[]. - [TIP] ==== * To learn about creating registry backups _automatically_ and configuring backups for S3 bucket replications, see xref:admin:backup-restore/backup-schedule-registry-components.adoc[]. @@ -400,26 +315,20 @@ image:admin:backup-restore/backup-schedule-registry-components/backup-schedule-r Click *`Next`* to go to the next step. -//== Підтвердження та процес розгортання == Confirmation and deployment -//Завершіть процедуру натисканням клавіші `+++Створити реєстр+++`. To complete the procedure, click the *Create registry* button. -//Ви можете також перевірити дані, внесені на попередніх кроках, переміщаючись між відповідними вкладками. You can go back to any of the settings tabs to double-check the data you provided. image:admin:registry-management/registry-create/cp-create-registry-12.png[] -//У результаті реєстр додається до переліку доступних у розділі +++Реєстри+++ адміністративної панелі *Control Plane*. As a result, the registry appears in the *Registries* section of the *Control Plane* admin console interface. -//У разі успішного розгортання, реєстр позначається зеленою піктограмою у стовпці +++Статус+++. If the registry is deployed successfully, a green check mark appears next to its name in the *Status* column. image:admin:registry-management/registry-create/cp-create-registry-12-2.png[] -//Розгортання реєстру займає певний час і виконується автоматично сервісом Jenkins. Сервіс запускає процес (пайплайн), що має назву *Master-Build-``*, де `` -- назва реєстру. Переглянути статус розгортання можна, перейшовши до розділу +++Реєстри+++ > відкрийте щойно створений реєстр > +++Конфігурація+++ > *CI*. Deploying the registry takes some time. The Jenkins service starts the deployment automatically by running the pipeline called *Master-Build-``*, where `` is the name of your registry. To monitor the deployment process, go to the *Registries* section and open the registry you just created, then scroll down to the *Configuration* section and click the *Jenkins* link icon in the *CI* column. image:admin:registry-management/registry-create/cp-create-registry-12-1.png[] diff --git a/docs/en/modules/admin/pages/registry-management/control-plane-edit-registry.adoc b/docs/en/modules/admin/pages/registry-management/control-plane-edit-registry.adoc index 3de0fe5d64..bf51a63e19 100644 --- a/docs/en/modules/admin/pages/registry-management/control-plane-edit-registry.adoc +++ b/docs/en/modules/admin/pages/registry-management/control-plane-edit-registry.adoc @@ -1,170 +1,129 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - -//= Перегляд та внесення змін до конфігурації реєстру = Viewing and editing registry configuration +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] + +include::platform:ROOT:partial$admonitions/language-en.adoc[] -//== Редагування основних налаштувань реєстру == Editing general settings -//Після успішного xref:registry-management/control-plane-create-registry.adoc[розгортання], ви можете переглядати поточні налаштування реєстру та вносити зміни до його конфігурацій. Зробити це можна у 2 простих кроки: After successfully xref:registry-management/control-plane-create-registry.adoc[deploying your registry], you can view and edit its settings. You can do this in two simple steps: -//. Увійдіть до адміністративної панелі *Control Plane* як xref:registry-develop:registry-admin/create-users/create-registry-admins.adoc[адміністратор реєстру]. . Sign in to the Control Plane admin console as the xref:registry-develop:registry-admin/create-users/create-registry-admins.adoc[registry administrator]. -//. Відкрийте розділ +++Реєстри+++, знайдіть необхідний та натисніть іконку редагування `🖉`. + . Open the *Registries* section, find the registry you wish to edit, and click the edit icon (🖉). image:registry-management/registry-edit/cp-edit-registry-1.png[] -//В результаті ви потрапите до розділу +++Редагування реєстру+++. Тут ви можете оновити налаштування, зокрема: As a result, the *Edit registry* page opens. Here you can update the following settings: -* xref:registry-management/control-plane-create-registry.adoc#general-settings[General settings] +* xref:admin:registry-management/control-plane-create-registry.adoc#general-settings[General settings] * xref:registry-develop:registry-admin/create-users/create-registry-admins.adoc[Adding or removing administrators] * xref:registry-develop:registry-admin/user-notifications/email/config-smtp-server.adoc[] * xref:registry-management/system-keys/control-plane-registry-keys.adoc[] -* xref:registry-management/сontrol-plane-registry-resources.adoc[] +* xref:registry-management/control-plane-registry-resources.adoc[] * xref:admin:registry-management/custom-dns/custom-dns-overview.adoc[] * xref:admin:registry-management/control-plane-cidr-access-endpoints.adoc[] * xref:registry-develop:registry-admin/cp-auth-setup/cp-auth-setup-officers.adoc[Service providers authentication] * xref:registry-develop:registry-admin/cp-auth-setup/cp-auth-setup-citizens.adoc[Service recipients authentication] * xref:admin:backup-restore/backup-schedule-registry-components.adoc[Backup] -//NOTE: Внесення змін до конфігурації реєстру відбувається за GitOps-підходом, подібно до процесу xref:registry-management/control-plane-create-registry.adoc[розгортання]. NOTE: Updating the registry configuration follows the GitOps approach, similar to the xref:registry-management/control-plane-create-registry.adoc[deployment] process. -//Ви можете також перейти до редагування згаданих вище налаштувань не одразу, а через перегляд відомостей про реєстр. You can open the *Edit registry* page either from the list of registries (using the edit icon) or the registry details page (using the *`Edit`* button in the upper-right corner). image:registry-management/registry-edit/cp-edit-registry-2.png[] -//== Перегляд відомостей про реєстр, налаштування доступу та зовнішніх інтеграцій == Viewing registry details, access settings, and external integrations -//Ви можете переглядати основну інформацію про реєстр, що розгорнуто на Платформі, додавати або видаляти доступи до реєстру, налаштовувати зовнішні інтеграції за SOAP-протоколом або REST, переглядати конфігурацію реєстру, а також підтверджувати або відхиляти запити на оновлення конфігурації. You can view basic information about the registries deployed on the Platform, manage access to your registry, configure external SOAP or REST integrations, view registry configuration, and approve or reject configuration update requests. -//. Увійдіть до адміністративної панелі *Control Plane* як xref:registry-develop:registry-admin/create-users/create-registry-admins.adoc[адміністратор реєстру]. . Sign in to the *Control Plane* admin console as the xref:registry-develop:registry-admin/create-users/create-registry-admins.adoc[registry administrator]. -//. Знайдіть розділ +++Реєстри+++ та відкрийте необхідний. + . Go to the *Registries* section and click the name of your registry. + -//На цій сторінці ви можете побачити 2 основні вкладки: The registry details page contains two tabs: - ++ [tabs] ==== -//Інформація про реєстр:: + Registry information:: + -- [#sections] -//+++Сторінка поділена декілька основних секцій:+++ :: + This tab contains the following sections: :: -//* +++Загальна інформація+++. + -//Ви можете переглянути її й відредагувати за необхідності. + * *General information*. You can view and edit it if needed. -//TODO: I cannot edit anything in this section, but maybe I just don't have permissions? + image:registry-management/registry-edit/cp-edit-registry-3.png[] + WARNING: The registry name cannot be changed. -//* +++Налаштування взаємодії з реєстрами через Трембіту+++. + -//Ви можете налаштувати інтеграцію із реєстрами-учасниками СЕВ ДЕІР "Трембіта" за *SOAP*-протоколом. -//TODO: ua-specific + * *Setting up interaction with registries via Trembita*. You can set up interaction with other registries that are part of the SEI SEIR Trembita system via the *SOAP* protocol. + image:registry-management/registry-edit/cp-edit-registry-4.png[] + TIP: For details, see xref:registry-develop:registry-admin/external-integration/cp-integrate-trembita.adoc[]. -//* +++Налаштування взаємодії з іншими системами+++. + -//Ви можете налаштувати інтеграцію з іншими реєстрами та зовнішніми системами за допомогою *REST*. + * *Setting up interaction with other systems*. You can set up interaction with other registries and external systems via the *REST* protocol. + image:registry-management/registry-edit/cp-edit-registry-5.png[] + TIP: For details, see xref:registry-develop:registry-admin/external-integration/cp-integrate-ext-system.adoc[]. -//* +++Доступ для реєстрів Платформи та зовнішніх систем+++. + -//Ви можете додавати або видаляти доступи до реєстру для інших реєстрів на Платформі або зовнішніх систем. + * *Access to Platform registries and external systems*. You can configure access to your registry for other registries on the Platform or external systems. + image:registry-management/registry-edit/cp-edit-registry-6.png[] + TIP: For details, see xref:registry-management/control-plane-registry-grant-access.adoc[]. -//* +++Конфігурація+++. + -//Секція містить посилання до: -//** *`VCSfootnote:[+++Система керування версіями +++ (СКВ, англ. **_Version Control System_**, VCS) — програмний інструмент для керування версіями одиниці інформації: початкового коду програми, скрипту, вебсторінки, вебсайту, 3D-моделі, текстового документа тощо. -//_Система керування версіями_ — інструмент, який дозволяє одночасно, не заважаючи один одному, проводити роботу над груповими проєктами.]`* -- сервісу інспекції та зберігання змін регламенту (Gerrit) -//** *`CIfootnote:[+++Неперервна інтеграція+++ (англ. **_Continuous Integration_**) — практика розробки програмного забезпечення, яка полягає у виконанні частих автоматизованих складань проєкту для якнайшвидшого виявлення та розв'язання інтеграційних проблем.]`* -- сервісу розгортання регламенту (Jenkins). + * *Configuration*. This section contains the following links: ** **VCS**footnote:[*Version Control System* (VCS) is a software tool for managing versions of information units such as the source code of a program, script, web page, website, 3D model, text document, and so on. VCS enables multiple people to collaborate on the same project without interfering with each other.]: Regulations changes review and storage service (Gerrit). ** **CI**footnote:[*Continuous Integration* (CI) is a software development practice involving frequent automated project builds to identify and resolve integration issues as quickly as possible.]: Regulations deployment service (Jenkins). + image:registry-management/registry-edit/cp-edit-registry-7.png[] -//* +++Запити на оновлення+++. + -//Ви можете вносити зміни до конфігурації реєстру шляхом редагування відповідних налаштувань. Такі зміни потрапляють на до секції +++Запити на оновлення+++, де їх можна переглянути та xref:registry-management/control-plane-submit-mr.adoc[підтвердити або відхилити]. + * *Update requests*. You can change your registry configuration by editing any of its settings. These changes go to the *Update requests* section, where you can review and either xref:registry-management/control-plane-submit-mr.adoc[approve or reject] them. + image:registry-management/registry-edit/cp-edit-registry-8.png[] -- -//Швидкі посилання :: Quick links :: + -//Секція містить швидкі посилання до вебінтерфейсів різних сервісів з коротким описом їх призначення. + This tab contains links to the web interfaces of the various services with brief descriptions. + TIP: For details, see xref:registry-management/control-plane-quick-links.adoc[]. - ==== [#registry-deploy-status] -//== Перевірка відомостей про розгортання змін == Monitoring the deployment of changes -//Розгортання змін до конфігурації займає певний час і виконується автоматично сервісом Jenkins. Сервіс запускає процес (пайплайн), що має назву *Master-Build-``*, де `` -- назва реєстру. Переглянути статус розгортання можна, перейшовши до розділу +++Реєстри+++ > ваш реєстр > +++Конфігурація+++ > *CI*. - Deploying configuration changes takes some time. The Jenkins service starts the deployment automatically by running the *Master-Build-``* pipeline, where `` is the name of your registry. To monitor the deployment process, go to the *Registries* section and open the registry you modified, then scroll down to the *Configuration* section and click the *Jenkins* link icon in the *CI* column. image:admin:registry-management/registry-create/cp-create-registry-12-1.png[] image:admin:registry-management/registry-create/cp-create-registry-12-3.png[] -//Загалом у центральному компоненті Jenkins передбачено декілька процесів (пайплайнів), зокрема: -//TODO: Is it OK to call these OOB? The central Jenkins component provides several out-of-the-box processes (pipelines): -//+++Службові процеси+++ :: Виконують різні службові функції та підготовчі дії до запуску основних пайплайнів. До таких відносять: Service processes :: Service processes perform various auxiliary functions and set the stage for the main pipelines. These include: -//* *Create-release-``* -- виконує ряд службових операцій, зокрема клонування репозиторію та створення нової гілки. Запускає службовий пайплайн із назвою `job-provisions » ci » default-` із підготовчими кроками для подальшого процесу CI/CD, де `` -- номер версії збірки, що відповідатиме git-тегу у Gerrit. * *Create-release-``* performs several service operations, including cloning the repository and creating a new branch. Starts a service pipeline named `job-provisions` > `ci` > `default-` (where `` is the version number of the build that corresponds to the Git tag in Gerrit), which prepares the stage for the subsequent CI/CD process. -//* *MASTER-Code-review-``* -- системний процес перевірки якості коду, який запускається автоматично через `git push` до `master`-гілки репозиторію Gerrit. + * *MASTER-Code-review-``* is a system process of code quality review that is launched automatically via `git push` to the `master` branch of the Gerrit repository. -//+++Основні процеси+++ :: -//Виконують збірку коду для розгортання різних функціональних складових реєстру. До таких відносять: + Main processes :: Main processes build the code used to deploy various functional components of the registry. These include: -//* *Master-Build-``* -- основний процес для збірки коду при розгортанні або оновленні конфігурації реєстру, зокрема виділення ресурсів, розгортання сервісів реєстру, як-то Кабінети користувачів, система виконання бізнес-процесів (BPMS), база даних, компоненти Фабрики даних, розгортання порожнього регламенту тощо. -//TODO: Складнувате речення, не зрозуміло, що до чого відноситься * *Master-Build-``* is the primary code build process for deploying or updating the registry configuration. This includes resource allocation, deployment of registry services such as user portals, Business Process Management System (BPMS), database, data factory components, empty regulations deployment, and so on. -//* *Create-registry-backup-``* -- процес, який створює резервні копії реєстру (бекапи) та поміщає їх до об'єктного сховища *Minio*. + * *Create-registry-backup-``* is a process that creates registry backups and puts them in the *MinIO* object storage. -//* *Restore-registry-``* -- процес, який дозволяє створити (відновити) реєстр із резервної копії. + * *Restore-registry-``* is a process that enables you to create (restore) a registry from a backup copy. -//* *Delete-release-``* -- процес, який дозволяє видалити реєстр. + * *Delete-release-``* is a process that enables you to delete a registry. + diff --git a/docs/en/modules/admin/pages/registry-management/control-plane-submit-mr.adoc b/docs/en/modules/admin/pages/registry-management/control-plane-submit-mr.adoc index 214f0e5d93..327fd724ec 100644 --- a/docs/en/modules/admin/pages/registry-management/control-plane-submit-mr.adoc +++ b/docs/en/modules/admin/pages/registry-management/control-plane-submit-mr.adoc @@ -1,91 +1,64 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - -//= Підтвердження запитів на внесення змін до реєстру = Approving registry configuration update requests +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] -//Адміністративна панель Control Plane дозволяє підтверджувати запити на внесення змін до конфігурації реєстру в Gerrit, тобто виконувати `git merge` до репозиторію, не виходячи за межі Control Plane. +include::platform:ROOT:partial$admonitions/language-en.adoc[] You can approve registry configuration update requests using the Control Plane admin console -- that is, perform a `git merge` to the repository from the Control Plane interface. -//TIP: Функціональність дозволяє вносити та підтверджувати будь-які зміни в адміністративній панелі. Ця інструкція показує приклад з додаванням нового адміністратора реєстру. - TIP: This feature enables you to make and confirm any changes via the admin console. This article shows an example of adding a new registry administrator. -[arabic] -//. Увійдіть до адміністративної панелі керування платформою та реєстрами *Control Plane*, використовуючи попередньо отримані логін та пароль. . Sign in to the *Control Plane* admin console. + image:admin:infrastructure/cluster-mgmt/update-cluster-mgmt-01.png[] -//. Перейдіть до розділу `Реєстри` та оберіть відповідний реєстр, до якого необхідно внести зміни. + . Open the *Registries* section and select the registry you wish to edit. + image:admin:infrastructure/cluster-mgmt/change-key/change-key-01.png[] -//. Натисніть кнопку `Редагувати`, що розташована у правому верхньому куті. + . Click the *`Edit`* button in the upper-right corner. + image:admin:infrastructure/cluster-mgmt/change-key/change-key-02.png[] -//. Перейдіть до секції `Адміністратори` та додайте нового адміністратора реєстру. + . Open the *Administrators* section and add a new registry administrator. + [TIP] ==== -//Детальніше про додавання адміністраторів платформи та реєстру ви можете переглянути за посиланнями: To learn more about adding Platform and registry administrators, see: -//* xref:admin:registry-management/control-plane-assign-platform-admins.adoc#add-platform-admin-cp[Призначення адміністраторів платформи] -* xref:admin:registry-management/control-plane-assign-platform-admins.adoc#add-platform-admin-cp[] -//* xref:admin:registry-management/control-plane-create-registry.adoc#add-registry-admin[Призначення адміністраторів реєстру] -* xref:admin:registry-management/control-plane-create-registry.adoc#add-registry-admin[] +* xref:admin:registry-management/control-plane-assign-platform-admins.adoc[] +* xref:registry-develop:registry-admin/create-users/create-registry-admins.adoc[] ==== - + image:registry-management/cp-submit-mr/cp-add-registry-admin-1.png[] + image:registry-management/cp-submit-mr/cp-add-registry-admin-2.png[] -//. Натисніть `Підтвердити`, щоб зберегти зміни. + . Click *`Confirm`* to save your changes. + image:registry-management/cp-submit-mr/cp-add-registry-admin-3.png[] - + -//В результаті буде сформовано запит на оновлення реєстру зі статусом `Новий`. As a result, the system generates a registry configuration update request with a `New` status. -//. Поверніться до розділу `Реєстри`, прокрутіть бігунок униз сторінки та знайдіть секцію `Запити на оновлення`. + . Go back to the *Registries* section and scroll down to the *Update requests* section. + image:registry-management/cp-submit-mr/cp-submit-mr-1.png[] -//. Відкрийте сформований запит, натиснувши іконку перегляду -- 👁. + . Click the view icon 👁 to open your request. + -//NOTE: Запропоновані зміни вносяться до конфігурації файлу _deploy-templates/values.yaml_ у разі підтвердження. NOTE: The proposed changes are applied to the _deploy-templates/values.yaml_ configuration file upon confirmation. -//. У новому вікні зіставте 2 версії змін, переконайтеся, що внесені вами дані вірні, та натисніть `Підтвердити`. + . Compare the changes between the two versions that open in a new window and make sure the data you entered is correct. Click *`Approve`*. + -//TIP: У вікні для порівняння можна зручно перевірити 2 версії змін: поточну (зліва) та нову (справа). TIP: The comparison window provides a convenient way of reviewing the differences between the two versions: the current (left) and the new (right). - + image:registry-management/cp-submit-mr/cp-submit-mr-2.png[] + image:registry-management/cp-submit-mr/cp-submit-mr-3.png[] + -//В результаті запит набуває статусу `Підтверджено`, а зміни набувають чинності. As a result, your request gains an `Approved` status and your changes are applied. + image:registry-management/cp-submit-mr/cp-submit-mr-4.png[] - + -//Ви також можете відразу відхилити зміни до конфігурації реєстру, натиснувши `Відхилити`. You can also reject the registry configuration changes by clicking *`Reject`* in the comparison window. - + image:registry-management/cp-submit-mr/cp-submit-mr-5.png[] \ No newline at end of file diff --git a/docs/en/modules/admin/pages/registry-management/custom-dns/cp-custom-dns-keycloak.adoc b/docs/en/modules/admin/pages/registry-management/custom-dns/cp-custom-dns-keycloak.adoc index a14472bd6a..a85441cfdd 100644 --- a/docs/en/modules/admin/pages/registry-management/custom-dns/cp-custom-dns-keycloak.adoc +++ b/docs/en/modules/admin/pages/registry-management/custom-dns/cp-custom-dns-keycloak.adoc @@ -1,225 +1,187 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - -//= Налаштування власного DNS-імені для Keycloak = Configuring custom DNS for Keycloak +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] -//== Загальний опис -== Introduction +include::platform:ROOT:partial$admonitions/language-en.adoc[] -//Адміністратори платформи мають змогу налаштовувати власні DNS-імена для сервісу управління користувачами та ролями Keycloak за допомогою адміністративної панелі Control Plane. Це дозволяє створити зручні URL-адреси для входу користувачів та забезпечує правильну роботу аутентифікації та міжсервісної взаємодії у приватних мережах. +== Introduction Platform administrators can configure custom DNS names for the Keycloak user and role management service using the Control Plane admin console. -//TODO: The last sentence of first paragraph repeats what's given below as a list, so I think it's OK to remove it. -//This enables you to create convenient URLs for users and ensure proper authentication and service-to-service interaction on private networks. -//Переваги використання функціональності: :: Why you should use this feature: :: -//* Власні DNS-імена: надає можливість створювати зручні та легко запам'ятовувані URL-адреси для входу користувачів у їхні особисті кабінети. * Custom DNS names enable you to create convenient and easy-to-remember URLs for users to sign in to the user portals. -//* Коректна робота в приватних мережах: добре працює у приватних мережах, забезпечуючи правильну перевірку сертифікатів та аутентифікацію за допомогою Keycloak для міжсервісної взаємодії. + * This setup ensures proper certificate validation and authentication via Keycloak for correct service-to-service interactions on private networks. -//Завдяки цьому адміністратори можуть легко та ефективно керувати налаштуваннями Keycloak, що сприяє полегшенню роботи користувачів із системою. This provides administrators with a simple and efficient way to manage Keycloak settings, making it easier to work with the system. -//Функціональні сценарії: :: Functional scenarios: :: -//* Конфігурація DNS-імен компонента Keycloak через адмін-консоль на рівні Платформи * Configuring DNS names for Keycloak via the admin console at the Platform level. -//* Вибір DNS-імені для логіна в кабінети користувачів через адмін-консоль на рівні реєстру + * Setting a DNS name for the user portal sign-in pages via the admin console at the registry level. -//* Видалення доданих DNS-імен до Keycloak + * Removing DNS names added to Keycloak. -//Загальні принципи та положення: :: General principles and provisions: :: -//* Технічний адміністратор Платформи відповідає за конфігурацію наявних Keycloak DNS-імен. -//TODO: "наявний" - мається на увазі початкове додавання днс, з яких потім може обирати адмін реєстру, так? + * The Platform administrator configures available DNS names for Keycloak. -//* Адміністратор завантажує SSL-сертифікат у форматі *_.pem_* для домену разом із DNS-іменем. -//TODO: мається ж на увазі адмін платформи? + + * The Platform administrator uploads the SSL certificate file in the *_.pem_* format for the domain along with the DNS name. -//* Технічний адміністратор реєстру налаштовує DNS-імена для реєстрових кабінетів користувачів. + * The registry administrator configures DNS names for the registry user portals. -//* Адміністратор реєстру обирає домен для Keycloak зі списку доступних. + * The registry administrator selects a domain for Keycloak from a list. -//* Список доступних доменів у системі формується з DNS-імен платформного Keycloak. + * The list of domains available in the system comes from the Platform's Keycloak DNS names. -//* У налаштуваннях кабінетів можна завантажити окремі SSL-сертифікати у форматі *_.pem_* для кожного користувацького кабінету. + * Individual SSL certificates in the *_.pem_* format can be downloaded for each user portal in portal settings. -//* Адміністратор Платформи забезпечує ротацію сертифікатів Keycloak та кабінетів користувачів. + * The Platform administrator ensures certificate rotation for Keycloak and user portals. -//* Система дозволяє редагувати встановлені раніше SSL-сертифікати та DNS-імена. + * The system allows editing previously installed SSL certificates and DNS names. -//* Адмін-консоль перевіряє, чи завантажений SSL-сертифікат відповідає введеному домену, чи не є самопідписаним, та чи строк його дії ще не сплив. + * The admin console checks whether the provided SSL certificate matches the domain, is not self-signed, and has not expired. -//* З міркувань безпеки, доступ до _HashiCorp Vault_ для читання сертифікатів здійснюється ЛИШЕ через окремого сервісного (системного) користувача. + * For security reasons, access to the _HashiCorp Vault_ to read certificates works ONLY through a separate service (system) account. -//* Якщо реєстр розгортається без порталу (надавача або отримувача послуг), відповідні UI-елементи для налаштування DNS-імен не відображаються. + * If the registry is deployed without user portals (officer portal or citizen portal), the corresponding UI elements for configuring DNS names are hidden. -//* Заданий URL для Keycloak та кабінетів обмежений 63 символами та проходить системну валідацію на правильність. + * The URL for Keycloak and user portals is limited to 63 characters and must be validated by the system. [#configure-dns-platform] -//== Конфігурація DNS-імен компонента Keycloak для Платформи + == Configuring DNS names for the Platform's Keycloak component -//Щоб налаштувати власні DNS-імена, а також завантажити SSL-сертифікати для Keycloak, виконайте наступні дії: To configure custom DNS names and upload SSL certificates for Keycloak, follow these steps: -//. Увійдіть до адміністративної панелі *Control Plane*. . Sign in to the *Control Plane* admin console. -//. Відкрийте розділ Керування Платформою та перейдіть до пункту *Keycloak DNS*. + . Go to *Platform management* and open the *Keycloak DNS* section. + -//У цьому розділі ви побачите системне значення DNS за замовчуванням, яке вже заповнене й недоступне для редагування. + This section displays the system's default DNS value that cannot be edited. + -//NOTE: Для додаткових DNS виконайте зовнішню конфігурацію записів у реєстратора доменних імен. Для цього скористайтеся інструкцією xref:#external-configuration[], яка також доступна за посиланням на інтерфейсі Control Plane. + NOTE: For additional DNS names, configure your DNS records on your DNS provider side. For details, jump to xref:#external-configuration[]. + image:registry-management/custom-dns/keycloak/custom-dns-keycloak-platform-1.png[] -//. Натисніть кнопку kbd:[Додати DNS], щоб відкрити вікно налаштувань. Введіть доменне ім'я для Keycloak, відповідно до підказок під полем, і завантажте SSL-сертифікат для Keycloak. + . Click the *Add DNS* button. . In the *Add DNS* window, enter the domain name for Keycloak into the *Keycloak domain name* field and upload Keycloak certificate using the *Upload SSL certificate* button. + -//NOTE: Конфігурація DNS за замовчуванням вичитується адмін-консоллю зі специфікації Keycloak CR у компоненті *`user-management`*. + NOTE: The admin console gets the default DNS configuration from the Keycloak CR (Custom Resource) specification in the *`user-management`* component. -//. У вікні налаштувань натисніть кнопку kbd:[Підтвердити], щоб зберегти дані та запустити валідаційні перевірки. + . In the *Add DNS* window, click the *Confirm* button to save your settings and start the validation checks. + -//TIP: Ви можете також натиснути кнопку kbd:[Відмінити], щоб закрити вікно без збереження внесених даних. + TIP: To close the window without saving your changes, click *Cancel*. + image:registry-management/custom-dns/keycloak/custom-dns-keycloak-platform-2.png[] + -//Всі додані DNS-імена будуть відображатися списком на сторінці *Keycloak DNS*. + The *Keycloak DNS* page lists all the DNS records you added. -//. Ви можете відредагувати будь-яке з доданих DNS-імен, натиснувши на іконку олівця поряд з обраним додатковим DNS. У вікні редагування змініть доменне ім'я та сертифікат. + . To edit additional DNS records, click the pencil icon next to one of the additional DNS records. Change the domain name and certificate in the editing window. + -//NOTE: Дія кнопок "Відмінити" та "Підтвердити" така сама, як і при додаванні нового DNS, і вони виконують ті ж самі валідації при збереженні даних. + NOTE: *Cancel* and *Confirm* buttons work the same as when adding a new DNS record. The same validation happens when you save the settings. -//. Також, ви можете видалити додатковий DNS, якщо він не використовується жодним із реєстрів. Якщо він використовується, спочатку змініть домен в відповідному реєстрі на інший. Для видалення потрібно натиснути на іконку корзини, що розташована навпроти обраного доданого DNS, і у вікні, що з'явиться, підтвердити дію. + . You can remove an additional DNS record if it is not used by any of the registries. To delete a DNS record, click the recycle bin icon next to it and confirm your action in a window that opens. + NOTE: If an additional DNS name is used by any registry, you need to first change this domain in the corresponding registry settings to something else. -//. Після завершення всіх дій із додатковими DNS, натисніть кнопку kbd:[Підтвердити] для збереження змін. Після виконання валідаційних перевірок, якщо всі дані введені коректно, вони збережуться. + . When you are finished working with additional DNS, click *Confirm* to save your changes. The changes are saved once the system validates them. + -//В результаті сформується запит на оновлення конфігурації реєстру, який можна переглянути у розділі +++ Керування Платформою > Запити на оновлення +++. + As a result, the system generates a registry configuration update request. You can view request details in the *Platform management* > *Update requests* section. -//. Підтвердьте внесення змін та дочекайтеся виконання Jenkins-процесу *MASTER-Build-cluster-mgmt*, який і застосує конфігурацію. + . Confirm the changes and wait until the *MASTER-Build-cluster-mgmt* Jenkins process completes and applies the new configuration. [#configure-dns-registry] -//== Конфігурація DNS-імен компонента Keycloak для реєстру + == Configuring DNS names for the registry’s Keycloak component -//Налаштовані у розділі xref:#configure-dns-platform[] DNS-імена можуть використовуватися при створенні або редагуванні реєстру. Для цього: DNS names configured as described in xref:#configure-dns-platform[] can be used when creating or editing a registry. -//. Увійдіть до інтерфейсу адмін-панелі *Control Plane*. . Sign in to the *Control Plane* admin console. -//. Відкрийте розділ +++ Реєстри +++ та оберіть один із реєстрів зі списку для редагування. + . Open the `Registries` section and select the registry you wish to edit. -//. Натисніть `Редагувати` > `+++Налаштування DNS +++`. + . On the registry information page, click the `Edit` button in the upper-right corner. . On the registry edit page, open the *DNS* section. -//. Знайдіть секцію +++ Сервіс управління користувачами та ролями (Keycloak) +++ та оберіть DNS-ім'я зі списку доступних. + . Under *User and role management service (Keycloak)*, select the DNS name from the *Keycloak domain name* list. -//. Натисніть kbd:[Підтвердити], що зберегти зміни. Після виконання валідаційних перевірок, якщо всі дані введені коректно, вони збережуться. + . Click *Confirm* to save your changes. The changes are saved once the system validates them. + -//В результаті сформується запит на оновлення конфігурації реєстру, який можна переглянути у розділі +++ Реєстри > Запити на оновлення +++. As a result, the system generates a registry configuration update request. You can view request details in the *Registries* > *Update requests* section. -//. Підтвердьте внесення змін та дочекайтеся виконання Jenkins-процесу *MASTER-Build-*, який і застосує конфігурацію. + . Confirm the changes and wait until the *MASTER-Build-* Jenkins process completes and applies the new configuration. image:registry-management/custom-dns/keycloak/custom-dns-keycloak-registry.png[] [#external-configuration] -//== Додаткова конфігурація за межами OpenShift-кластера та реєстру == Additional configuration outside the OpenShift cluster and registry -//Виконайте зовнішню конфігурацію за межами OpenShift-кластера та реєстру. Perform additional configuration outside the OpenShift cluster and registry. -//. Створіть `CNAME`-запис у свого постачальника DNS. . Create a `CNAME` record with your DNS provider. + -//Він має вказувати на _Load Balancer_ прив'язаного до OpenShift роутера (_HAProxy_). Домен роутера OpenShift відрізняється для кожного кластера. Записи `CNAME` завжди повинні вказуватися на інше доменне ім’я, а не на IP-адресу. -//TODO: Можна "інше доменне ім'я" замінити на "канонічне ім'я"? This record should point to the _Load Balancer_ bound to the OpenShift router (_HAProxy_). An OpenShift router domain is different for each cluster. `CNAME` records must always point to another domain name, not an IP address. + [TIP] ==== -//`CNAME` (Запис канонічного імені) -- це тип запису ресурсу в системі доменних імен (DNS), який порівнює одне доменне ім’я (псевдонім) з іншим (канонічне ім’я). + A `CNAME` (Canonical Name) record is a type of DNS record that maps a domain name (alias) to a true or canonical domain name. ==== + -//`CNAME` запис може виглядати так: Here is an example of a `CNAME` record: + ---- www.example.net. CNAME www.example.com. ---- + -//Подивитись на поточні встановлені CNAME записи можна за допомогою сервісу link:https://dns.google[dns.google]. You can view the current CNAME records using the link:https://dns.google[Google Public DNS] service. + [WARNING] ==== -//`CNAME` не може бути встановлений для *apex*-доменів (example.com), а піддомен повинен бути вказаний (www.example.com). + A `CNAME` record cannot be set for *apex* domains (such as example.com); a subdomain must be specified (such as www.example.com). ==== -//. Напишіть у Telegram-каналі `[EPAM] IIT Digital Signature Library Questions`, щоб додати нову адресу до тестового віджету link:https://eu.iit.com.ua/[eu.iit.com.ua]. -//TODO: probably ua-specific -. To request adding a new address to the link:https://eu.iit.com.ua/[eu.iit.com.ua] test widget, use the `[EPAM] IIT Digital Signature Library Questions` Telegram channel. + +. Please contact the _technical administrator's support service of the Platform instance_ through your channel and submit a request to add a new address to the test https://eu.iit.com.ua/[eu.iit.com.ua] widget. + +include::ROOT:partial$admonitions/ua-specific.adoc[] + -- -//Кабінет посадової особи та отримувача послуг стає доступний за налаштованими DNS-іменами після додаткової (ручної) зовнішньої конфігурації адміністратором. - -The user portals become available using the configured DNS names after the external configuration takes effect. +The Keycloak's new DNS name becomes available after the external configuration takes effect. [CAUTION] -//Зазвичай оновлення DNS-імен відбувається впродовж однієї години, хоча глобальне оновлення може тривати до 48 годин. -Typically, DNS names are updated within one hour, although a global update can take up to 48 hours. + +Typically, DNS names are updated within one hour, although a global update can take up to 48 hours but in exceptional cases can last up to 72 hours. -- -//== Застосування змін до конфігурації == Applying configuration changes -//Коли ви підтверджуєте зміни після налаштувань в адмін-панелі, на рівні Платформи та реєстру відбувається наступне: When you confirm the changes in the admin console, the following happens at the Platform and registry levels. -//Для налаштувань платформи: :: Platform settings: :: -//. SSL-сертифікати, які ви завантажили для власних доменів Keycloak, зберігаються у _Підсистемі управління секретами та шифруванням_, *HashiCorp Vault*. . The SSL certificates you uploaded for custom Keycloak domains are saved to the *HashiCorp Vault* secrets and encryption management subsystem. -//. У файлі *_deploy-templates/values.yaml_* компонента `*cluster-mgmt*` додаються записи із доменами та шляхами до SSL-сертифікатів, що відповідають прикладу: + . Domain records and SSL certificate paths are added to the *_deploy-templates/values.yaml_* file of the `*cluster-mgmt*` component. For example: + [source,yaml] @@ -232,13 +194,11 @@ keycloak: certificatePath: registry-kv/.... ---- -//Для налаштувань реєстру: :: Registry settings: :: -//. SSL-сертифікати, які ви завантажили для кастомних доменів Кабінетів надавача та отримувача послуг, також зберігаються до *HashiCorp Vault*. . The SSL certificates you uploaded for custom user portal domains are saved to *HashiCorp Vault*. -//. У файлі *_deploy-templates/values.yaml_* відповідного реєстрового репозиторію додаються записи із доменами та шляхами до SSL-сертифікатів, що відповідають прикладу: + . Domain records and SSL certificate paths are added to the *_deploy-templates/values.yaml_* file in the corresponding registry repository. For example: + [source,yaml] @@ -252,15 +212,11 @@ portals: ---- [ssl-certificates-saving-convention] -//=== Конвенція зберігання SSL-сертифікатів -=== SSL certificate storage convention -//Конвенція зберігання SSL-сертифікатів у HashiCorp Vault визначає шляхи для платформних та реєстрових сертифікатів. +=== SSL certificate storage convention HashiCorp Vault's SSL certificate storage convention defines the paths for Platform and registry certificates. -//Платформні сертифікати зберігаються за шляхом: - Platform certificates are saved to: ---- @@ -271,7 +227,6 @@ key:certificate value: key:key value: ---- -//Реєстрові сертифікати зберігаються за шляхом: Registry certificates are saved to: @@ -281,4 +236,4 @@ registry-kv/registry//domains// key:caCertificate value: key:certificate value: key:key value: ----- \ No newline at end of file +---- diff --git a/docs/en/modules/admin/pages/registry-management/custom-dns/cp-custom-dns-portals.adoc b/docs/en/modules/admin/pages/registry-management/custom-dns/cp-custom-dns-portals.adoc index e3c0890591..2decadddb7 100644 --- a/docs/en/modules/admin/pages/registry-management/custom-dns/cp-custom-dns-portals.adoc +++ b/docs/en/modules/admin/pages/registry-management/custom-dns/cp-custom-dns-portals.adoc @@ -1,38 +1,19 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - -//= Налаштування власного DNS-імені для Кабінетів = Configuring custom DNS for user portals +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] -//== Загальний опис -== Introduction +include::platform:ROOT:partial$admonitions/language-en.adoc[] -//В адміністративному інтерфейсі керування Платформою та реєстрами *Control Plane* реалізовано можливість використання власного DNS-імені для публічних Кабінетів отримувача послуг та посадової особи. +== Introduction *Control Plane* admin console interface enables you to use custom DNS names for the public officer and citizen portals. [TIP] ==== -//*DNS* _(англ. Domain Name System)_ система доменних імен -- ієрархічна розподілена система перетворення імені будь-якого мережевого пристрою в IP-адресу. The *DNS* (Domain Name System) is a hierarchical and distributed naming system that converts network resource names into IP addresses. ==== -//Для налаштування власного DNS-імені для Кабінетів отримувача послуг та/або посадової особи необхідно мати зареєстроване доменне ім'я (наприклад, `registry.example.com`) та SSL-сертифікат для домену чи субдомену `registry.example.com`, або одночасно для всіх субдоменів першого рівня -- `*.example.com`. -//TODO: Please double-check the phrasing of the examples To set up custom DNS names for the user portals, you need to register a domain name (for example, `registry.example.com`) and get an SSL certificate for the domain (`example.com`), specific subdomain (`registry.example.com`), or all first-level subdomains (`*.example.com`). -//Інтерфейс адміністрування розділяє отриманий сертифікат на CA-сертифікат (_Certificate Authority_) і ключ, зберігає їх в центральному HashiCorp Vault, використовуючи KV engine, та додає отримані DNS-імена до налаштувань _values.yaml_ у наступному форматі: - -The admin console extracts the CA (Certificate Authority) certificate and key from the SSL certificate, saves them to the central HashiCorp Vault using the KV engine, and adds the DNS names to the _values.yaml_ settings file in the following format: - -//.Формат налаштувань customDNS для кабінетів у values.yml .customDNS user portal settings in values.yml ==== [source, yaml] @@ -44,150 +25,117 @@ global: ---- ==== -//== Налаштування DNS-імен для Кабінетів == Configuring DNS names for user portals -//Налаштування DNS-імен доступно на етапі створення нового реєстру або при редагуванні заведеного реєстру. Розглянемо принцип налаштування на прикладі реєстру, що вже існує. - You can configure DNS names when creating a new registry or editing an existing registry. In this section, we will use editing an existing registry as an example. To set up custom DNS names for the user portals, perform the following steps. -//=== Обрання реєстру та перехід до налаштувань === Selecting a registry and opening its settings [arabic] -//. Увійдіть до адміністративної панелі керування платформою та реєстрами *Control Plane*, використовуючи попередньо отримані логін та пароль. . Sign in to the *Control Plane* admin console. + image:admin:infrastructure/cluster-mgmt/update-cluster-mgmt-01.png[] -//. Перейдіть до розділу `Реєстри` та оберіть відповідний реєстр, в якому необхідно налаштувати DNS-ім'я. + . Open the `Registries` section and select the registry for which you wish to configure the DNS name. + image:admin:infrastructure/cluster-mgmt/change-key/change-key-01.png[] -//. Натисніть кнопку `Редагувати`, що розташована у правому верхньому куті. + . Click the `Edit` button in the upper-right corner. + image:admin:infrastructure/cluster-mgmt/change-key/change-key-02.png[] -//=== Налаштування DNS-імен для Кабінету посадової особи -=== Configuring DNS names for the officer portal - -//Налаштуйте доменне ім'я для _Кабінету посадової особи_: +=== Configuring DNS names for the Officer portal -Set up a DNS name for the _officer portal_: +Set up a DNS name for the _Officer portal_: -//. Відкрийте секцію *DNS* та активуйте перемикач, щоб встановити власні значення DNS-імені. . Open the *DNS* section and turn on the *Configure DNS for officer portal* switch. + [NOTE] ==== -//Функція за замовчуванням вимкнена. Після її активації та застосування змін до конфігурації реєстру, Кабінет посадової особи стане доступним за новим ім’ям. + This feature is disabled by default. Once it is enabled and changes to the registry configuration are applied, the officer portal will be available using the new DNS name. -//Щоб повернутися до налаштувань за замовчуванням і скинути встановлені значення, просто вимкніть перемикач. Після наступного застосування змін до реєстру, ви побачите стандартне значення DNS-імені для Кабінету. To restore the default setting and reset the DNS, simply turn the switch off. The next time changes to the registry are applied, the portal will revert to the default DNS name. ==== + image:admin:registry-management/custom-dns/custom-dns-1.png[] -//. Вкажіть доменне ім'я для Кабінету посадової особи у форматі *`officer.example.com`*. + . Specify the domain name to use for the officer portal. Use the following format: *`officer.example.com`*. + -//. Натисніть kbd:[Browse...] (`Вибрати файл`) у полі `SSL-сертифікат для кабінету чиновника (розширення .pem)`. . Click kbd:[Browse...] in the `SSL certificate for officer portal (.pem extension)` field. + image:admin:registry-management/custom-dns/custom-dns-05.png[] -//. У відповідній директорії оберіть необхідний сертифікат (розширення _.pem_) і натисніть kbd:[Відкрити]. + . Browse to a corresponding certificate file with a .pem extension, select it and click kbd:[Open]. + image:admin:registry-management/custom-dns/custom-dns-06.png[0,400] -//. Натисніть kbd:[Підтвердити], щоб зберегти налаштування. -. Click *Confirm* to save your settings. -//=== Налаштування DNS-імен для Кабінету отримувача послуг -=== Configuring DNS names for the citizen portal +. Click *Confirm* to save your settings. -//Налаштуйте доменне ім'я для _Кабінету отримувача послуг_: +=== Configuring DNS names for the Citizen portal -Set up a DNS name for the _citizen portal_: +Set up a DNS name for the _Citizen portal_: -//. Відкрийте секцію *DNS* та активуйте перемикач, щоб встановити власні значення DNS-імені. . Open the *DNS* section and turn on the *Configure DNS for citizen portal* switch. + [NOTE] ==== -//TODO: "Кабінет громадянина", а не посадової особи -//Функція за замовчуванням вимкнена. Після її активації та застосування змін до конфігурації реєстру, Кабінет посадової особи стане доступним за новим ім’ям. + This feature is disabled by default. Once it is enabled and changes to the registry configuration are applied, the citizen portal will be available using the new DNS name. -//Щоб повернутися до налаштувань за замовчуванням і скинути встановлені значення, просто вимкніть перемикач. Після наступного застосування змін до реєстру, ви побачите стандартне значення DNS-імені для Кабінету. To restore the default setting and reset the DNS, simply turn the switch off. The next time changes to the registry are applied, the portal will revert to the default DNS name. ==== + image:admin:registry-management/custom-dns/custom-dns-1.png[] -//. Вкажіть доменне ім'я для Кабінету отримувача послуг у форматі `citizen.example.com`. + . Specify the domain name to use for the citizen portal. Use the following format: *`citizen.example.com`*. -//. Натисніть kbd:[Browse...] (`Вибрати файл`) у полі `SSL-сертифікат для кабінету громадянина (розширення .pem)`. + . Click kbd:[Browse...] in the `SSL certificate for citizen portal (.pem extension)` field. + image:admin:registry-management/custom-dns/custom-dns-04.png[] -//. У відповідній директорії оберіть необхідний сертифікат (розширення _.pem_) і натисніть `Відкрити`. + . Browse to a corresponding certificate file with a .pem extension, select it and click kbd:[Open]. + image:admin:registry-management/custom-dns/custom-dns-03.png[0,400] -//. Натисніть kbd:[Підтвердити], щоб зберегти налаштування. + . Click *Confirm* to save your settings. -//=== Додаткова конфігурація за межами OpenShift-кластера та реєстру === Additional configuration outside the OpenShift cluster and registry -//Виконайте зовнішню конфігурацію за межами OpenShift-кластера та реєстру. - Perform additional configuration outside the OpenShift cluster and registry. -//. Створіть `CNAME`-запис у свого постачальника DNS. . Create a `CNAME` record with your DNS provider. + -//Він має вказувати на _Load Balancer_ прив'язаного до OpenShift роутера (_HAProxy_). Домен роутера OpenShift відрізняється для кожного кластера. Записи `CNAME` завжди повинні вказуватися на інше доменне ім’я, а не на IP-адресу. -//TODO: Можна "інше доменне ім'я" замінити на "канонічне ім'я"? This record should point to the _Load Balancer_ bound to the OpenShift router (_HAProxy_). An OpenShift router domain is different for each cluster. `CNAME` records must always point to another domain name, not an IP address. + [TIP] ==== -//`CNAME` (Запис канонічного імені) -- це тип запису ресурсу в системі доменних імен (DNS), який порівнює одне доменне ім’я (псевдонім) з іншим (канонічне ім’я). A `CNAME` (Canonical Name) record is a type of DNS record that maps a domain name (alias) to a true or canonical domain name. ==== + -//`CNAME` запис може виглядати так: Here is an example of a `CNAME` record: + ---- www.example.net. CNAME www.example.com. ---- + -//Подивитись на поточні встановлені CNAME записи можна за допомогою сервісу link:https://dns.google[dns.google]. You can view the current CNAME records using the link:https://dns.google[Google Public DNS] service. + [WARNING] ==== -//`CNAME` не може бути встановлений для *apex*-доменів (example.com), а піддомен повинен бути вказаний (www.example.com). A `CNAME` record cannot be set for *apex* domains (such as example.com); a subdomain must be specified (such as www.example.com). ==== -//. Напишіть у Telegram-каналі `[EPAM] IIT Digital Signature Library Questions`, щоб додати нову адресу до тестового віджету link:https://eu.iit.com.ua/[eu.iit.com.ua]. -//TODO: probably ua-specific -. To request adding a new address to the link:https://eu.iit.com.ua/[eu.iit.com.ua] test widget, use the `[EPAM] IIT Digital Signature Library Questions` Telegram channel. + +. Please contact the _technical administrator's support service of the Platform instance_ through your channel and submit a request to add a new address to the test https://eu.iit.com.ua/[eu.iit.com.ua] widget. + +include::ROOT:partial$admonitions/ua-specific.adoc[] + -- -//Кабінет посадової особи та отримувача послуг стає доступний за налаштованими DNS-іменами після додаткової (ручної) зовнішньої конфігурації адміністратором. The user portals become available using the configured DNS names after the external configuration takes effect. [CAUTION] -//Зазвичай оновлення DNS-імен відбувається впродовж однієї години, хоча глобальне оновлення може тривати до 48 годин. -Typically, DNS names are updated within one hour, although a global update can take up to 48 hours. +Typically, DNS names are updated within one hour, although a global update can take up to 48 hours but in exceptional cases can last up to 72 hours. -- - -//TODO додати аналогічний опис до інструкції xref:admin:registry-management/control-plane-create-registry.adoc[Розгортання екземпляру реєстру] \ No newline at end of file diff --git a/docs/en/modules/admin/pages/registry-management/system-keys/control-plane-platform-certificates.adoc b/docs/en/modules/admin/pages/registry-management/system-keys/control-plane-platform-certificates.adoc new file mode 100644 index 0000000000..65b0f41668 --- /dev/null +++ b/docs/en/modules/admin/pages/registry-management/system-keys/control-plane-platform-certificates.adoc @@ -0,0 +1,132 @@ += = Setting up certificates for verification of digital signature platform keys +//= Налаштування сертифікатів для перевірки ключів цифрового підпису Платформи +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] + + +== General overview +//// +[.underline]#_Сертифікати для перевірки ключів цифрового підпису_# слугують для підтвердження автентичності публічного ключа, який використовується в процесі цифрового підписання. Їх випускає довірена організація, відома як _Акредитований Центр Сертифікації Ключів (АЦСК)_, і вони відіграють важливу роль у створенні довіри до електронних документів та транзакцій. + +[.underline]#_Ключі системного підпису_# призначені для підписання та перевірки даних системами або програмами. Іншими словами, вони допомагають гарантувати, що відповідний пакет даних чи програмне забезпечення походить від відомого джерела і не було змінено. + +[.underline]#_КЕП (Кваліфікований електронний підпис)_# -- це покращена версія ЕЦП (Електронний цифровий підпис). Він забезпечує вищий рівень безпеки та довіри, адже для його створення використовуються більш надійні криптографічні алгоритми та процедури. КЕП часто має правову силу і дозволяє підтверджувати автентичність електронних документів в юридичних ситуаціях. + +*_CACertificates.p7b_* та *_CA.json_*: :: + +* *_CACertificates.p7b_*: цей файл містить один або декілька сертифікатів у форматі `PKCS#7`. Формат `PKCS#7` широко використовується для обміну та зберігання сертифікатів або цілого ланцюжка сертифікатів. + +* *_CA.json_*: це файл у форматі JSON, який може містити деталі про сертифікати. Формат JSON інформацію про сертифікати у форматі JSON, який легко читається людиною та машиною. + ++ +Платформа надає широкі можливості для управління сертифікатами: забезпечує їх безпечне _завантаження_, _зберігання_, _використання_ та _оновлення_. +//// + +[.underline]#_Certificates for verifying digital signature keys_# are used to confirm the authenticity of the public key used in the digital signing process. They are issued by a trusted organization, known as the _Accredited Key Certification Center (AKCC)_, and they play an important role in generating trust in electronic documents and transactions. + +[.underline]#_System signature keys_# are designed for data signing and verification by systems or programs. In other words, they help ensure that the corresponding data package or software originates from a known source and has not been altered. + +[.underline]#_QES (Qualified electronic signature)_# -- is an enhanced version of DES (Digital Electronic Signature). It provides a higher level of security and trust, as more reliable cryptographic algorithms and procedures are used for its creation. QES often has legal force and allows confirming the authenticity of electronic documents in legal situations." + +*_CACertificates.p7b_* та *_CA.json_*: :: + +* *_CACertificates.p7b_*: this file contains one or more certificates in `PKCS#7` format. The `PKCS#7`format is widely used for exchanging and storing certificates or an entire chain of certificates." + +* *_CA.json_*: this is a JSON format file that can contain details about certificates. The JSON format presents certificate information in a format that is easy to read by both humans and machines." + ++ +The platform provides extensive capabilities for certificate management: it ensures their secure _upload_, _storage_, _usage_, and _update_. + +//== Додавання сертифікатів +== Adding certificates + +//NOTE: Сертифікати АЦСК для перевірки ключів системного підпису, внесені у секції +++Дані для перевірки підписів+++, будуть застосовані до налаштувань Платформи. + +NOTE: The AKCC certificates for verifying the system signature keys, added in the *Signature Verification Data* section, will be applied to the Platform settings. + +//Щоб додати сертифікати АЦСК, виконайте наступні кроки: +To add AKCC certificates, follow these steps: + +. Log in to the registry management administrative panel *Control Plane* using the previously received login and password. +//. Увійдіть до адміністративної панелі керування Платформою *Control Plane*, використовуючи попередньо отримані логін та пароль. ++ +image:admin:infrastructure/cluster-mgmt/update-cluster-mgmt-01.png[] + +. Open menu *Platform management* +//. Відкрийте меню +++Керування Платформою+++. + +. Click the `*Edit*` button located in the upper right corner. +//. У правому верхньому куті сторінки натисніть `+++Редагувати+++`. ++ +image:admin:infrastructure/cluster-mgmt/update-cluster-mgmt-1.png[] + +. Go to the *Signature Verification Data* section. +//. Перейдіть до секції +++Дані для перевірки підписів+++. ++ +image:admin:infrastructure/cluster-mgmt/cp-platform-certificates/01-platform-certificates.png[] + +. Add the public AKCC certificates (*_CACertificates.p7b_*). +//. Додайте публічні сертифікати АЦСК (*_CACertificates.p7b_*). + +. Add the list of compatible certificates (_.p7b_). +//.. Додайте список сертифікатів сумісних ЦСК (link:https://iit.com.ua/download/productfiles/CACertificates.p7b[CACertificates.p7b]), який можна отримати на сайті АТ "ІІТ" за посиланням https://iit.com.ua/downloads. + +.. Add the certificate file by clicking the button *Choose file* at the *Public AKCC certificates (.p7b extension)*. In the new window, navigate to the folder where the certificate file is stored, select it and press kbd:[Open]. +//.. Додайте файл сертифіката, натиснувши кнопку `+++Обрати файл+++` у полі у полі +++Публічні сертифікати АЦСК (розширення .p7b)+++. У новому вікні перейдіть до теки, де зберігається файл сертифіката, оберіть його і натисніть kbd:[Відкрити]. ++ +image:admin:infrastructure/cluster-mgmt/cp-platform-certificates/02-platform-certificates.png[] + +. Add the AKCC list (*_CA.json_*). +//. Додайте перелік АЦСК (*_CA.json_*). + +.. Add interaction parameters with compatible Key Certification Center (_.json_). +//.. Додайте параметри взаємодії із сумісними ЦСК (link:https://iit.com.ua/download/productfiles/CAs.json[CAs.json]). Файл можна отримати на сайті АТ "ІІТ" за посиланням https://iit.com.ua/downloads. + +.. Add the certificate file by clicking the button *Choose file* at the *List of AKCC (.json extension)*. In the new window, navigate to the folder where the certificate file is stored, select it and press kbd:[Open]. +//.. Додайте файл сертифіката, натиснувши кнопку `+++Обрати файл+++` у полі +++Перелік АЦСК (розширення .json)+++. У новому вікні перейдіть до теки, де зберігається файл з параметрами, оберіть його і натисніть kbd:[Відкрити]. ++ +image:admin:infrastructure/cluster-mgmt/cp-platform-certificates/03-platform-certificates.png[] + +. At the end, check the information entered and press the button `*Confirm*` +//. На завершення перевірте внесену інформацію і натисніть кнопку `+++Підтвердити+++`. ++ +[NOTE] +==== +As a result of updating the key information on the Control Plane interface, a new request to update the registry configuration is created, which needs to be confirmed. +//У результаті оновлення даних про ключ на інтерфейсі Control Plane, створюється новий запит на оновлення конфігурації *`cluster-mgmt`*, який необхідно підтвердити. +==== + +. In the Control Plane admin panel interface, go back to the *Platform management* section, scroll down the page and find the *Update requests* section. +//. В інтерфейсі адмін-панелі Control Plane поверніться до розділу +++Керування Платформою+++, прокрутіть бігунок униз сторінки та знайдіть секцію +++Запити на оновлення+++. Знайдіть потрібний запит та натисніть іконку перегляду 👁. ++ +image::admin:infrastructure/cluster-mgmt/change-key/change-key-41.png[] + +.Find the required request and click on the view icon 👁. +//. Відкрийте сформований запит, натиснувши іконку перегляду -- 👁. + +. Scroll down the page and click on the *Confirm* button. +//. Прокрутіть донизу та натисніть кнопку `+++Підтвердити+++`. ++ +image:admin:infrastructure/cluster-mgmt/cp-registry-certificates/04-registry-certificates.png[] + ++ +NOTE: Proposed changes are made to the _deploy-templates/values.yaml_ file configuration of the *`cluster-mgmt`* component upon confirmation. +//Запропоновані зміни вносяться до конфігурації файлу _deploy-templates/values.yaml_ компонента *`cluster-mgmt`* у разі підтвердження. ++ +Next, the *`Master-Build-cluster-mgmt`* pipeline is automatically launched, which applies the parameters of the given configuration and creates secrets for digital signature keys. +//Далі відбувається автоматичний запуск пайплайну *`Master-Build-cluster-mgmt`*, який застосовує параметри заданої конфігурації та створює секрети для ключів цифрового підпису. + +. Wait for the code build to complete. This can take approximately 15 minutes. +//. Зачекайте, доки виконається збірка коду. Це може зайняти декілька хвилин. ++ +You can check the current status and execution result via the *`CI`* link on the interface. +//Ви можете перевірити поточний статус та результат виконання за посиланням *`CI`* на інтерфейсі. ++ +image::admin:infrastructure/cluster-mgmt/change-key/change-key-42.png[] ++ +In the Jenkins interface, find the appropriate pipeline and track the execution status. +//В інтерфейсі Jenkins знайдіть відповідний пайплайн та відстежуйте статус виконання. ++ +image:registry-management/cp-platform-admins/cp-platform-admins-25.png[] + diff --git a/docs/en/modules/admin/pages/registry-management/system-keys/control-plane-platform-keys.adoc b/docs/en/modules/admin/pages/registry-management/system-keys/control-plane-platform-keys.adoc index 51c50e44e4..5a07bb77e2 100644 --- a/docs/en/modules/admin/pages/registry-management/system-keys/control-plane-platform-keys.adoc +++ b/docs/en/modules/admin/pages/registry-management/system-keys/control-plane-platform-keys.adoc @@ -1,7 +1,5 @@ = Updating the Platform digital signature keys and certificates -//= Оновлення ключів та сертифікатів цифрового підпису для Платформи -{empty} + -include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] diff --git a/docs/en/modules/admin/pages/registry-management/system-keys/control-plane-registry-certificates.adoc b/docs/en/modules/admin/pages/registry-management/system-keys/control-plane-registry-certificates.adoc new file mode 100644 index 0000000000..32e624e081 --- /dev/null +++ b/docs/en/modules/admin/pages/registry-management/system-keys/control-plane-registry-certificates.adoc @@ -0,0 +1,177 @@ += Setting up certificates for verification of digital signature registry keys +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] + +include::platform:ROOT:partial$admonitions/language-en.adoc[] + +== General overview +//// +[.underline]#_Сертифікати для перевірки ключів цифрового підпису_# слугують для підтвердження автентичності публічного ключа, який використовується в процесі цифрового підписання. Їх випускає довірена організація, відома як _Акредитований Центр Сертифікації Ключів (АЦСК)_, і вони відіграють важливу роль у створенні довіри до електронних документів та транзакцій. + +[.underline]#_Ключі системного підпису_# призначені для підписання та перевірки даних системами або програмами. Іншими словами, вони допомагають гарантувати, що відповідний пакет даних чи програмне забезпечення походить від відомого джерела і не було змінено. + +[.underline]#_КЕП (Кваліфікований електронний підпис)_# -- це покращена версія ЕЦП (Електронний цифровий підпис). Він забезпечує вищий рівень безпеки та довіри, адже для його створення використовуються більш надійні криптографічні алгоритми та процедури. КЕП часто має правову силу і дозволяє підтверджувати автентичність електронних документів в юридичних ситуаціях. + +*_CACertificates.p7b_* та *_CA.json_*: :: + +* *_CACertificates.p7b_*: цей файл містить один або декілька сертифікатів у форматі `PKCS#7`. Формат `PKCS#7` широко використовується для обміну та зберігання сертифікатів або цілого ланцюжка сертифікатів. + +* *_CA.json_*: це файл у форматі JSON, який може містити деталі про сертифікати. Формат JSON інформацію про сертифікати у форматі JSON, який легко читається людиною та машиною. + ++ +Платформа надає широкі можливості для управління сертифікатами: забезпечує їх безпечне _завантаження_, _зберігання_, _використання_ та _оновлення_. +//// + +[.underline]#_Certificates for verifying digital signature keys_# are used to confirm the authenticity of the public key used in the digital signing process. They are issued by a trusted organization, known as the _Accredited Key Certification Center (AKCC)_, and they play an important role in generating trust in electronic documents and transactions. + +[.underline]#_System signature keys_# are designed for data signing and verification by systems or programs. In other words, they help ensure that the corresponding data package or software originates from a known source and has not been altered. + +[.underline]#_QES (Qualified electronic signature)_# -- is an enhanced version of DES (Digital Electronic Signature). It provides a higher level of security and trust, as more reliable cryptographic algorithms and procedures are used for its creation. QES often has legal force and allows confirming the authenticity of electronic documents in legal situations." + +*_CACertificates.p7b_* та *_CA.json_*: :: + +* *_CACertificates.p7b_*: this file contains one or more certificates in `PKCS#7` format. The `PKCS#7`format is widely used for exchanging and storing certificates or an entire chain of certificates." + +* *_CA.json_*: this is a JSON format file that can contain details about certificates. The JSON format presents certificate information in a format that is easy to read by both humans and machines." + ++ +The platform provides extensive capabilities for certificate management: it ensures their secure _upload_, _storage_, _usage_, and _update_. + + +//== Додавання сертифікатів +== Adding certificates + +//NOTE: Сертифікати АЦСК для перевірки ключів системного підпису та КЕП користувачів, внесені у секції +++Дані для перевірки підписів+++, будуть застосовані до налаштувань реєстру. + +NOTE: The AKCC certificates for verifying the system signature keys and user's QES, added in the *Signature Verification Data* section, will be applied to the registry settings. + +//Щоб додати сертифікати АЦСК, виконайте наступні кроки: +To add AKCC certificates, follow these steps: + +. Log in to the registry management administrative panel *Control Plane* using the previously received login and password. +//. Увійдіть до адміністративної панелі керування реєстрами *Control Plane*, використовуючи попередньо отримані логін та пароль. ++ +image:admin:infrastructure/cluster-mgmt/update-cluster-mgmt-01.png[] + +. Go to the *Registers* section and select the appropriate register where you need to upload the signature verification certificates. ++ +//. Перейдіть до розділу +++Реєстри+++ та оберіть відповідний реєстр, в якому необхідно завантажити сертифікати для перевірки підпису. ++ +image:admin:infrastructure/cluster-mgmt/change-key/change-key-01.png[] + +. Click the `*Edit*` button located in the upper right corner. +//. Натисніть кнопку `+++Редагувати+++`, що розташована у правому верхньому куті. ++ +image:admin:infrastructure/cluster-mgmt/change-key/change-key-02.png[] + +. Go to the *Signature Verification Data* section. +//. Перейдіть до секції +++Дані для перевірки підписів+++. + +. Add the public AKCC certificates (*_CACertificates.p7b_*). +//. Додайте публічні сертифікати АЦСК (*_CACertificates.p7b_*). + +. Add the list of compatible certificates (_.p7b_). +//.. Додайте список сертифікатів сумісних ЦСК (_.p7b_). Файл можна отримати на сайті АТ "ІІТ" за посиланням https://iit.com.ua/downloads. ++ +[NOTE] +==== +When deploying and working with a test registry, use the test AKCC certificates, otherwise the registry deployment pipeline will not pass, and you will receive an initialization error of the crypto service `digital-signature-ops`. This will happen because the certificate files for the production environment simply do not contain data about test AKCC. + +For the production environment, use the appropriate prod-certificates + +include::ROOT:partial$admonitions/ua-specific.adoc[] + +* Test environment AKCC certificates: https://iit.com.ua/download/productfiles/CACertificates.Test.All.p7b[]. +* Production environment AKCC certificates: https://iit.com.ua/download/productfiles/CACertificates.p7b[]. +==== ++ +//// ++ +[NOTE] +==== +При розгортанні та роботі з тестовим реєстром, використовуйте сертифікати тестового АЦСК, інакше пайплайн розгортання реєстру не пройде, а ви отримаєте помилку ініціалізації криптосервісу `digital-signature-ops`. Це станеться через те, що файли сертифікатів для виробничого середовища просто не містять даних про тестові АЦСК. + +Для промислового середовища використовуйте відповідні prod-сертифікати. + +* Сертифікати АЦСК тестового середовища: https://iit.com.ua/download/productfiles/CACertificates.Test.All.p7b[]. +* Сертифікати АЦСК промислового середовища: https://iit.com.ua/download/productfiles/CACertificates.p7b[]. +==== +//// ++ + +.. Add the certificate file by clicking the button *Choose file* at the *Public AKCC certificates (.p7b extension)*. In the new window, navigate to the folder where the certificate file is stored, select it and press kbd:[Open]. ++ +//.. Додайте файл сертифіката, натиснувши кнопку `+++Обрати файл+++` у полі +++Публічні сертифікати АЦСК (розширення .p7b)+++. У новому вікні перейдіть до теки, де зберігається файл сертифіката, оберіть його і натисніть kbd:[Відкрити]. ++ +image:admin:infrastructure/cluster-mgmt/cp-registry-certificates/01-registry-certificates.png[] + +. Add the AKCC list (*_CA.json_*). +//. Додайте перелік АЦСК (*_CA.json_*). + +.. Add interaction parameters with compatible Key Certification Center (_.json_). +//.. Додайте параметри взаємодії із сумісними ЦСК (_.json_). Файл можна отримати на сайті АТ "ІІТ" за посиланням https://iit.com.ua/downloads. ++ +[NOTE] +==== +When deploying and working with a test registry, use the test AKCC certificates, otherwise the registry deployment pipeline will not pass, and you will receive an initialization error of the crypto service `digital-signature-ops`. This will happen because the certificate files for the production environment simply do not contain data about test AKCC. + +For the production environment, use the appropriate prod-certificates + +include::ROOT:partial$admonitions/ua-specific.adoc[] + +* Test environment AKCC certificates: https://iit.com.ua/download/productfiles/CAs.Test.All.json[]. +* Production environment AKCC certificates: https://iit.com.ua/download/productfiles/CAs.json[]. +==== ++ +//// +[NOTE] +==== +При розгортанні та роботі з тестовим реєстром, використовуйте сертифікати тестового АЦСК, інакше пайплайн розгортання реєстру не пройде, а ви отримаєте помилку ініціалізації криптосервісу `digital-signature-ops`. Це станеться через те, що файли сертифікатів для виробничого середовища просто не містять даних про тестові АЦСК. + +Для промислового середовища використовуйте відповідні prod-сертифікати. + +* Сертифікати АЦСК тестового середовища: https://iit.com.ua/download/productfiles/CAs.Test.All.json[]. +* Сертифікати АЦСК промислового середовища: https://iit.com.ua/download/productfiles/CAs.json[]. +==== +//// ++ + .. Add the certificate file by clicking the button *Choose file* at the *List of AKCC (.json extension)*. In the new window, navigate to the folder where the certificate file is stored, select it and press kbd:[Open]. ++ +//.. Додайте файл сертифіката, натиснувши кнопку `+++Обрати файл+++` у полі +++Перелік АЦСК (розширення .json)+++. У новому вікні перейдіть до теки, де зберігається файл з параметрами, оберіть його і натисніть kbd:[Відкрити]. ++ +image:admin:infrastructure/cluster-mgmt/cp-registry-certificates/02-registry-certificates.png[] + +. At the end, check the information entered and press the button `*Confirm*` +//. На завершення перевірте внесену інформацію і натисніть кнопку `+++Підтвердити+++`. ++ +[NOTE] +As a result of updating the key information on the Control Plane interface, a new request to update the registry configuration is created, which needs to be confirmed. +//У результаті оновлення даних про ключ на інтерфейсі Control Plane, створюється новий запит на оновлення конфігурації реєстру, який необхідно підтвердити. + +. In the Control Plane admin panel interface, go back to the *Registers* section, scroll down the page and find the *Update requests* section. Find the required request and click on the view icon 👁. +//. В інтерфейсі адмін-панелі Control Plane поверніться до розділу +++Реєстри+++, прокрутіть бігунок униз сторінки та знайдіть секцію +++Запити на оновлення+++. Знайдіть потрібний запит та натисніть іконку перегляду 👁. ++ +image:admin:infrastructure/cluster-mgmt/cp-registry-certificates/03-registry-certificates.png[] + +. Scroll down the page and click on the *Confirm* button. +//. Прокрутіть донизу та натисніть кнопку `+++Підтвердити+++`. ++ +image:admin:infrastructure/cluster-mgmt/cp-registry-certificates/04-registry-certificates.png[] ++ +Next, the *MASTER-Build-``* pipeline is automatically launched, which applies the parameters of the given configuration and creates secrets for digital signature keys. +//Далі відбувається автоматичний запуск пайплайну *MASTER-Build-``*, який застосовує параметри заданої конфігурації та створює секрети для ключів цифрового підпису. + +. Wait for the code build to complete. This can take approximately 15 minutes, but it will depend on the configuration of a specific registry. +//. Зачекайте, доки виконається збірка коду. Це може зайняти приблизно 15 хвилин, але все залежатиме від конфігурації певного реєстру. ++ +You can check the current status and execution result via the *`CI`* link on the interface. +//Ви можете перевірити поточний статус та результат виконання за посиланням *`CI`* на інтерфейсі. ++ +image:registry-develop:registry-admin/cp-auth-setup-officers/cp-id-gov-ua-iit-setup-6.png[] ++ +image:registry-develop:registry-admin/cp-auth-setup-officers/cp-id-gov-ua-iit-setup-7.png[] ++ +image:registry-develop:registry-admin/cp-auth-setup-officers/cp-id-gov-ua-iit-setup-8.png[] + + + + diff --git a/docs/en/modules/admin/pages/registry-management/system-keys/control-plane-registry-keys.adoc b/docs/en/modules/admin/pages/registry-management/system-keys/control-plane-registry-keys.adoc index 19b4c19a37..229df645c9 100644 --- a/docs/en/modules/admin/pages/registry-management/system-keys/control-plane-registry-keys.adoc +++ b/docs/en/modules/admin/pages/registry-management/system-keys/control-plane-registry-keys.adoc @@ -1,33 +1,27 @@ = Updating registry digital signature keys and certificates -include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] When you deploy xref:admin:registry-management/control-plane-create-registry.adoc[a registry instance], you must configure the digital signature key. After that, you can update key information as part of the registry editing. The configuration mechanism on the part of the administrator is the same both when initially adding and updating the key data. -//Під час xref:admin:registry-management/control-plane-create-registry.adoc[розгортання екземпляра реєстру] необхідно налаштувати ключ цифрового підпису. Після цього ви можете оновлювати інформацію про ключі в рамках редагування реєстру. Механізм налаштування з боку адміністратора є однаковим як при початковому додаванні, так і при оновленні даних про ключ. To replace the digital key of the registry, follow the steps hereunder. -//Для заміни цифрового ключа реєстру дотримуйтеся кроків, описаних нижче в поточній інструкції. == Editing key data . Log in to *Control Plane*, the administrative control panel of the registries, using the previously received login and password. -//. Увійдіть до адміністративної панелі управління реєстрами *Control Plane*, використовуючи попередньо отримані логін та пароль. + image:admin:infrastructure/cluster-mgmt/update-cluster-mgmt-01.png[] . Go to the `Registries` section and select the corresponding registry in which you want to change the system key. -//. Перейдіть до розділу `Реєстри` та оберіть відповідний реєстр, в якому необхідно змінити системний ключ. + image:admin:infrastructure/cluster-mgmt/change-key/change-key-01.png[] . Click the `Edit` button in the upper right corner. -//. Натисніть кнопку `Редагувати`, що розташована у правому верхньому куті. + image:admin:infrastructure/cluster-mgmt/change-key/change-key-02.png[] . Go to the *Key data* section and make further settings. -//. Перейдіть до секції [.underline]#Дані про ключ# та виконайте подальші налаштування. + image:admin:infrastructure/cluster-mgmt/change-key/change-key-03.png[] @@ -37,20 +31,16 @@ image:admin:infrastructure/cluster-mgmt/change-key/change-key-03.png[] You can configure two types of keys: * `file key`: stored in the user storage in the `*.dat` format. -//* `файловий ключ` -- зберігається на користувацькому носії у форматі `*.dat`; + * `hardware key`: stored in the network cryptomodule and controlled by the corresponding software. -//* `апаратний ключ` -- зберігаються на мережевому криптомодулі та управляється програмним забезпеченням АТ "ІІТ". === Setting the file keys -//=== Налаштування ключа на файловому носії . Select `Storage type` -- `File-based key storage` (default). -//. Оберіть `Тип носія` -- `Файловий носій` (встановлюється за замовчуванням). + image:admin:infrastructure/cluster-mgmt/change-key/change-key-04.png[] . Press the kbd:[Select file] button to add the new system key. In the new window, navigate to the folder where the key file in the `*.dat` format is stored, select it, and click kbd:[Open]. -//. Додайте новий системний ключ, натиснувши кнопку kbd:[Вибрати файл]. У новому вікні перейдіть до теки, де зберігається файл ключа формату `*.dat`, оберіть його і натисніть kbd:[Відкрити]. + [NOTE] ==== @@ -60,210 +50,138 @@ Accredited key certification centers (AKCC) are state-accredited organizations t image:admin:infrastructure/cluster-mgmt/change-key/change-key-05.png[] . The following step is to enter the name of the Accredited key certification center (AKCC) in the `AKCC that issued the key` field. The name of the AKCC that issued the key can be found in the certificate of the key. -//. Наступним кроком зазначте назву АЦСК у полі `АЦСК, що видав ключ`. -//* 3.1. Щоб дізнатися назву АЦСК ключа, завантажте додаток _«Користувач центру сертифікації ключів. Інсталяційний пакет (ОС Microsoft Windows)»_ з офіційного ресурсу АТ "ІІТ" за посиланням https://iit.com.ua/downloads. -//Далі відкрийте завантажений файл для інсталяції ПЗ. -//[NOTE] -//==== -//Подальший приклад буде розглянуто для користувача ОС Microsoft Windows з додатком _EUInstall.exe_. -//==== -//image:admin:infrastructure/cluster-mgmt/change-key/change-key-07.png[] -//* 3.2. Інсталюйте та запустіть програму _«ІІТ Користувач ЦСК»_, пройшовши всі запропоновані кроки. -//image:admin:infrastructure/cluster-mgmt/change-key/change-key-08.png[] -//[#key_info] -//* 3.3. У вікні програми натисніть `Зчитати`. -//image:admin:infrastructure/cluster-mgmt/change-key/change-key-09.png[] -//* 3.4. Оберіть ключ у відповідній директорії. Далі введіть пароль ключа і натисніть kbd:[Зчитати]. -//image:admin:infrastructure/cluster-mgmt/change-key/change-key-10.png[] -//* 3.5. Після зчитування ключа в інтерфейсі програми _«ІІТ Користувач ЦСК»_ з’явиться нове меню `Переглянути власний сертифікат` -- натисніть на нього. -//image:admin:infrastructure/cluster-mgmt/change-key/change-key-11.png[] -//* 3.6. У новому вікні буде зазначена інформація з назвою АЦСК у полі `ЦСК`. -//image:admin:infrastructure/cluster-mgmt/change-key/change-key-12.png[] -//* 3.7. Скопіюйте назву ЦСК на попередньому кроці й вставте її значення у поле `АЦСК, що видав ключ` у налаштуваннях реєстру *Control Plane*. -//image:admin:infrastructure/cluster-mgmt/change-key/change-key-13.png[] . Enter the password of the selected system key into the corresponding field. -//. Введіть пароль обраного системного ключа у відповідному полі. + image:admin:infrastructure/cluster-mgmt/change-key/change-key-06.png[] . Enter the list of certificates from the appropriate key certification centers (_.p7b_). You can get your _.p7b_ file on the site of your regional competent authority. -//. Наступним кроком додайте список сертифікатів сумісних ЦСК (_.p7b_). Файл можна отримати на сайті АТ "ІІТ" за посиланням https://iit.com.ua/downloads. + [NOTE] ==== When deploying and working with the test registry, use the certificates of the test AKCC, otherwise the registry deployment pipeline will not work, and you will receive the `digital-signature-ops` cryptoservice initialization error. This happens because the certificate files for the production environment simply do not contain data about the test AKCC. -//При розгортанні та роботі з тестовим реєстром, використовуйте сертифікати тестового АЦСК, інакше пайплайн розгортання реєстру не пройде, а ви отримаєте помилку ініціалізації криптосервісу `digital-signature-ops`. Це станеться через те, що файли сертифікатів для виробничого середовища просто не містять даних про тестові АЦСК. include::ROOT:partial$admonitions/ua-specific.adoc[] For the prod environment, use the appropriate prod certificates. -//Для промислового середовища використовуйте відповідні prod-сертифікати. * AKCC certificates for the test environment: https://iit.com.ua/download/productfiles/CACertificates.Test.All.p7b[]. -//* Сертифікати АЦСК тестового середовища: https://iit.com.ua/download/productfiles/CACertificates.Test.All.p7b[]. + * AKCC certificates for the prod environment: https://iit.com.ua/download/productfiles/CACertificates.p7b[]. -//* Сертифікати АЦСК промислового середовища: https://iit.com.ua/download/productfiles/CACertificates.p7b[]. + ==== + Add the certificate file by clicking the kbd:[Select File] button in the `AKCC public certificates (.p7b extension)` field. In the new window, navigate to the folder where the certificate file is stored, select it, and click kbd:[Open]. -//Додайте файл сертифіката, натиснувши кнопку kbd:[Вибрати файл] у полі `Публічні сертифікати АЦСК (розширення .p7b)`. У новому вікні перейдіть до теки, де зберігається файл сертифіката, оберіть його і натисніть kbd:[Відкрити]. + image:admin:infrastructure/cluster-mgmt/change-key/change-key-14.png[] . Add the parameters to interact with the compatible key certification centers (_.json_). -//. Далі додайте параметри взаємодії із сумісними ЦСК (_.json_). Файл можна отримати на сайті АТ "ІІТ" за посиланням https://iit.com.ua/downloads. + [NOTE] ==== When deploying and working with the test registry, use the certificates of the test AKCC, otherwise the registry deployment pipeline will not work, and you will receive the `digital-signature-ops` cryptoservice initialization error. This happens because the certificate files for the production environment simply do not contain data about the test AKCC. -//При розгортанні та роботі з тестовим реєстром, використовуйте сертифікати тестового АЦСК, інакше пайплайн розгортання реєстру не пройде, а ви отримаєте помилку ініціалізації криптосервісу `digital-signature-ops`. Це станеться через те, що файли сертифікатів для виробничого середовища просто не містять даних про тестові АЦСК. include::ROOT:partial$admonitions/ua-specific.adoc[] For the prod environment, use the appropriate prod certificates. -//Для промислового середовища використовуйте відповідні prod-сертифікати. * AKCC certificates for the test environment: https://iit.com.ua/download/productfiles/CAs.Test.All.json[]. -//* Сертифікати АЦСК тестового середовища: https://iit.com.ua/download/productfiles/CAs.Test.All.json[]. + * AKCC certificates for the prod environment: https://iit.com.ua/download/productfiles/CAs.json[]. -//* Сертифікати АЦСК промислового середовища: https://iit.com.ua/download/productfiles/CAs.json[]. + ==== + Add the certificate file by clicking the kbd:[Select File] button in the `AKCC list (extension .json)` field. In the new window, navigate to the folder where the file containing parameters is stored, select it, and click kbd:[Open]. -//Додайте файл сертифіката, натиснувши кнопку kbd:[Вибрати файл] у полі `Перелік АЦСК (розширення .json)`. У новому вікні перейдіть до теки, де зберігається файл з параметрами, оберіть його і натисніть kbd:[Відкрити]. + image:admin:infrastructure/cluster-mgmt/change-key/change-key-15.png[] . Next, indicate the `List of allowed keys` whose signature can be considered true. -//. Далі вкажіть `Перелік дозволених ключів`, підпис яких може вважатися правдивим. + [NOTE] This block specifies a list of keys, including the old ones _(for example, when replacing keys)_, so that everything previously signed with the old key is verified (validated). That is, the list of allowed keys must contain the data history of all keys used in the system for signing. -//У цьому блоці зазначається перелік ключів, у тому числі й старих _(наприклад, при ротації ключів)_, щоб все, що раніше було підписано старим ключем, вважалося перевіреним (провалідованим). Тобто перелік дозволених ключів повинен містити історію даних усіх ключів, що використовувались у системі для накладання підпису. + The list of allowed keys contains the following key data: -//У переліку дозволених ключів вказуються наступні дані ключа: - -** `"Key issuer"` -//** `«Емітент ключа»` _(див. кроки xref:#issuer_key[7.1.-7.2. цієї інструкції])_; -** `"Key serial number"` -//** `«Серійний номер ключа»` _(див. кроки xref:#serial_number[7.3.-7.4. цієї інструкції])_. +* `"Key issuer"` +* `"Key serial number"` + image:admin:infrastructure/cluster-mgmt/change-key/change-key-16.png[] - + [#issuer_key] -//* 7.1. Для отримання інформації для поля `Емітент ключа` відкрийте детальну інформацію про ключ, після його зчитування у програмі _«ІІТ Користувач ЦСК»_ _(див. кроки xref:#key_info[4.3.-4.6. цієї інструкції])_, натиснувши `Детальна інформація`. -//image:admin:infrastructure/cluster-mgmt/change-key/change-key-17.png[] -//* 7.2. У новому вікні оберіть рядок `Реквізити ЦСК`, і в нижньому полі скопіюйте його повне значення для заповнення поля `Емітент ключа` у *Control Plane*. -//image:admin:infrastructure/cluster-mgmt/change-key/change-key-18.png[] -//* 7.3. Для отримання інформації для поля `Серійний номер ключа` відкрийте детальну інформацію про ключ, після його зчитування в програмі _«ІІТ Користувач ЦСК»_ _(див. кроки xref:#key_info[4.3.-4.6. цієї інструкції])_, натиснувши `Детальна інформація`. -//image:admin:infrastructure/cluster-mgmt/change-key/change-key-17.png[] -//* 7.4. У новому вікні оберіть рядок `Реєстраційний номер`, і в нижньому полі скопіюйте його повне значення для заповнення поля `Серійний номер ключа` у *Control Plane*. -//image:admin:infrastructure/cluster-mgmt/change-key/change-key-19.png[] - . Finally, check the entered information and click *`Confirm`*. -//. На завершення перевірте внесену інформацію і натисніть кнопку kbd:[Підтвердити]. + image:admin:infrastructure/cluster-mgmt/change-key/change-key-20.png[] + [NOTE] ==== As a result of updating the key data in the Control Plane interface, a new request is created to update the *`cluster-mgmt`* configuration, which xref:#confirm-changes[must be confirmed]. -//У результаті внесення змін у дані про ключ на інтерфейсі Control Plane, створюється новий запит на оновлення конфігурації реєстру, який xref:#confirm-changes[необхідно підтвердити]. ==== === Setting the hardware key -//=== Налаштування апаратного ключа . Select `Storage type` -- `Hardware-based key storage`. -//. Оберіть `Тип носія` -- `Апаратний носій`. + image:admin:infrastructure/cluster-mgmt/change-key/change-key-21.png[] . By default, the value of the `Key type` field is set to the `cryptomod. IIT Hryada-301` value. IIT Hryada-301 is a hardware cryptomodule. -//. Значення поля `Тип ключа` зазначається за замовчуванням значенням `криптомод. ІІТ Гряда-301`. + include::ROOT:partial$admonitions/ua-specific.adoc[] + image:admin:infrastructure/cluster-mgmt/change-key/change-key-22.png[] . Enter the hardware key password into the corresponding field. -//. Введіть пароль апаратного ключа у відповідному полі. + [NOTE] ==== The key password has the following structure `##User##Password`. -//Пароль ключа має наступну структуру `##User##Password`. + include::ROOT:partial$admonitions/ua-specific.adoc[] ==== + image:admin:infrastructure/cluster-mgmt/change-key/change-key-23.png[] . Then, enter the name of your Accredited key certification center (AKCC) into the `AKCC name` field. -//. Наступним кроком зазначте назву АЦСК у полі «`Ім'я АЦСК`». ++ For example, the AKCC's name is in your key's digital signature certificate. + -//* 4.1. Отримати інформацію про назву АЦСК можливо у програмі _«ІІТ Користувач ЦСК»_, відкрийте її. -//[TIP] -//Кроки інсталяції програми описані у xref:#iit[пунктах 4.1-4.3] попереднього розділу. -//* 4.2. У вікні програми натисніть «`Зчитати`». -//image:admin:infrastructure/cluster-mgmt/change-key/change-key-09.png[] -//* 4.3. Оберіть ключ у директорії «`криптомод. ІІТ Гряда-301`». Далі введіть пароль ключа _(у форматі `##User##Password`)_ і натисніть «`Зчитати`». -//image:admin:infrastructure/cluster-mgmt/change-key/change-key-24.png[] -//* 4.4. Після зчитування ключа в інтерфейсі програми _«ІІТ Користувач ЦСК»_ з’явиться нове меню «`Переглянути власний сертифікат`» - натисніть на нього. -//image:admin:infrastructure/cluster-mgmt/change-key/change-key-11.png[] -//* 4.5. Натисніть «`Детальна інформація`» -//image:admin:infrastructure/cluster-mgmt/change-key/change-key-17.png[] -//* 4.6. Скопіюйте назву ЦСК. -//image:admin:infrastructure/cluster-mgmt/change-key/change-key-25.png[] -//* 4.7. Вставте значення в поле `Ім'я АЦСК` в налаштуваннях реєстру Control Plane. image:admin:infrastructure/cluster-mgmt/change-key/change-key-28-01.png[] . In the next step, enter the `AKCC host` parameter. -//. Наступним кроком вкажіть параметр `Хост АЦСК`. + image:admin:infrastructure/cluster-mgmt/change-key/change-key-28.png[] + [TIP] ==== You can find the value in the file of interaction parameters provided by your corresponding accredited key certification center (example: https://iit.com.ua/downloads). -//Значення можна переглянути у файлі параметрів взаємодії із сумісними ЦСК, який можна отримати на сайті АТ "ІІТ" за посиланням https://iit.com.ua/downloads. + include::ROOT:partial$admonitions/ua-specific.adoc[] * AKCC certificates for the test environment: https://iit.com.ua/download/productfiles/CAs.Test.All.json[]. -//* Сертифікати АЦСК тестового середовища: https://iit.com.ua/download/productfiles/CAs.Test.All.json[]. + * AKCC certificates for the prod environment: https://iit.com.ua/download/productfiles/CAs.json[]. -//* Сертифікати АЦСК промислового середовища: https://iit.com.ua/download/productfiles/CAs.json[]. image:admin:infrastructure/cluster-mgmt/change-key/change-key-26.png[] ==== . Then, enter the `AKCC port` parameter. -//. Далі заповніть параметр `Порт АЦСК`. + image:admin:infrastructure/cluster-mgmt/change-key/change-key-29.png[] + [TIP] ==== You can find the value in the file of interaction parameters provided by your corresponding accredited key certification center (example: https://iit.com.ua/downloads). -//Значення можна переглянути у файлі параметрів взаємодії із сумісними ЦСК, який можна отримати на сайті АТ "ІІТ" за посиланням https://iit.com.ua/downloads. include::ROOT:partial$admonitions/ua-specific.adoc[] * AKCC certificates for the test environment: https://iit.com.ua/download/productfiles/CAs.Test.All.json[]. -//* Сертифікати АЦСК тестового середовища: https://iit.com.ua/download/productfiles/CAs.Test.All.json[]. + * AKCC certificates for the prod environment: https://iit.com.ua/download/productfiles/CAs.json[]. -//* Сертифікати АЦСК промислового середовища: https://iit.com.ua/download/productfiles/CAs.json[]. image:admin:infrastructure/cluster-mgmt/change-key/change-key-27.png[] ==== . Enter the `Device serial number` (the hardware key serial number). -//. Вкажіть `Серійний номер пристрою`. + image:admin:infrastructure/cluster-mgmt/change-key/change-key-32.png[] + @@ -271,7 +189,6 @@ include::ROOT:partial$admonitions/ua-specific.adoc[] + [NOTE] ==== -//Наступні параметри зазначаються під час створення і налаштування мережевого криптомодуля. The following parameters are specified when creating and configuring a network cryptographic module. .Configuring Ukrainian network cryptographic module IIT Hryada-301 @@ -281,182 +198,150 @@ image:admin:infrastructure/cluster-mgmt/change-key/change-key-31.png[] [TIP] ==== The device serial number is shown in the key name, for example: -//Серійний номер пристрою відображається в назві ключа, наприклад: `001:3016(10.0.200.102)`, where -//`001:3016(10.0.200.102)`, де * `001`: serial device number. -//* `001` -- серійний номер пристрою; + * `3016`: key port. -//* `3016` -- порт ключа; + * `10.0.200.102`: key host. -//* `10.0.200.102` -- хост ключа. image:admin:infrastructure/cluster-mgmt/change-key/change-key-30.png[] ==== . Enter `Key port`. -//. Вкажіть `Порт ключа`. + image:admin:infrastructure/cluster-mgmt/change-key/change-key-33.png[] . Enter `Key host` (IP address). -//. Вкажіть `Хост ключа` (IP-адреса). + image:admin:infrastructure/cluster-mgmt/change-key/change-key-34.png[] . Enter `Key mask`. -//. Вкажіть `Маску ключа`. + image:admin:infrastructure/cluster-mgmt/change-key/change-key-35.png[] + [TIP] ==== The default value is `255.255.255.255`. -//За замовчуванням встановлюється значення `255.255.255.255`. + ==== . Based on all the previously entered parameters, the `INI` file will be automatically configured. Detailed information on its content and additional parameters is displayed in the corresponding `*INI* configuration` editable field. -//. На підставі усіх раніше вказаних параметрів буде автоматично сконфігуровано `INI`-файл. Детальна інформація щодо його вмісту і додаткових параметрів відображається у відповідному полі `*INI* конфігурація`, яке доступне до редагування. + image:admin:infrastructure/cluster-mgmt/change-key/change-key-36.png[] . Next, add the list of certificates from the appropriate key certification centers (_.p7b_). -//. Наступним кроком додайте список сертифікатів сумісних ЦСК (_.p7b_). Файл можна отримати на сайті АТ "ІІТ" за посиланням https://iit.com.ua/downloads. + You can get your _.p7b_ file on the site of your regional competent authority. + [NOTE] ==== When deploying and working with the test registry, use the certificates of the test AKCC, otherwise the registry deployment pipeline will not work, and you will receive the `digital-signature-ops` cryptoservice initialization error. This happens because the certificate files for the production environment simply do not contain data about the test AKCC. -//При розгортанні та роботі з тестовим реєстром, використовуйте сертифікати тестового АЦСК, інакше пайплайн розгортання реєстру не пройде, а ви отримаєте помилку ініціалізації криптосервісу `digital-signature-ops`. Це станеться через те, що файли сертифікатів для виробничого середовища просто не містять даних про тестові АЦСК. + include::ROOT:partial$admonitions/ua-specific.adoc[] For the prod environment, use the appropriate prod certificates. -//Для промислового середовища використовуйте відповідні prod-сертифікати. * AKCC certificates for the test environment: https://iit.com.ua/download/productfiles/CACertificates.Test.All.p7b[]. -//* Сертифікати АЦСК тестового середовища: https://iit.com.ua/download/productfiles/CACertificates.Test.All.p7b[]. + * AKCC certificates for the prod environment: https://iit.com.ua/download/productfiles/CACertificates.p7b[]. -//* Сертифікати АЦСК промислового середовища: https://iit.com.ua/download/productfiles/CACertificates.p7b[]. + ==== + Add the certificate file by clicking the kbd:[Select File] button in the `AKCC public certificates (.p7b extension)` field. In the new window, navigate to the folder where the certificate file is stored, select it, and click kbd:[Open]. -//Додайте файл сертифіката, натиснувши кнопку kbd:[Вибрати файл] у полі `Публічні сертифікати АЦСК (розширення .p7b)`. У новому вікні перейдіть до теки, де зберігається файл сертифіката, оберіть його та натисніть kbd:[Відкрити]. + image:admin:infrastructure/cluster-mgmt/change-key/change-key-14.png[] . Add the parameters to interact with the compatible key certification centers (_.json_). -//. Далі додайте параметри взаємодії із сумісними ЦСК (_.json_). Файл можна отримати на сайті АТ "ІІТ" за посиланням https://iit.com.ua/downloads. + You can get your _.json_ file from your corresponding local provider. + [NOTE] ==== When deploying and working with the test registry, use the certificates of the test AKCC, otherwise the registry deployment pipeline will not work, and you will receive the `digital-signature-ops` cryptoservice initialization error. This happens because the certificate files for the production environment simply do not contain data about the test AKCC. -//При розгортанні та роботі з тестовим реєстром, використовуйте сертифікати тестового АЦСК, інакше пайплайн розгортання реєстру не пройде, а ви отримаєте помилку ініціалізації криптосервісу `digital-signature-ops`. Це станеться через те, що файли сертифікатів для виробничого середовища просто не містять даних про тестові АЦСК. + include::ROOT:partial$admonitions/ua-specific.adoc[] For the prod environment, use the appropriate prod certificates. -//Для промислового середовища використовуйте відповідні prod-сертифікати. * AKCC certificates for the test environment: https://iit.com.ua/download/productfiles/CAs.Test.All.json[]. -//* Сертифікати АЦСК тестового середовища: https://iit.com.ua/download/productfiles/CAs.Test.All.json[]. + * AKCC certificates for the prod environment: https://iit.com.ua/download/productfiles/CAs.json[]. -//* Сертифікати АЦСК промислового середовища: https://iit.com.ua/download/productfiles/CAs.json[]. + ==== + Add the certificate file by clicking the kbd:[Select File] button in the `AKCC list (extension .json)` field. In a new window, navigate to the folder where the file containing parameters is stored, select it, and click kbd:[Open]. -//Додайте файл сертифіката, натиснувши кнопку kbd:[Вибрати файл] у полі `Перелік АЦСК (розширення .json)`. У новому вікні перейдіть до директорії, де зберігається файл з параметрами, оберіть його та натисніть kbd:[Відкрити]. + image:admin:infrastructure/cluster-mgmt/change-key/change-key-15.png[] . Enter the `List of allowed keys` whose signature can be considered true. -//. Вкажіть `Перелік дозволених ключів`, підпис яких може вважатися правдивим. + [NOTE] -//У цьому блоці зазначається перелік ключів, у тому числі й старих _(наприклад, при ротації ключів)_, щоб все, що раніше було підписано старим ключем, вважалося перевіреним (провалідованим). Тобто перелік дозволених ключів повинен містити історію даних усіх ключів, що використовувались у системі для накладання підпису. This block specifies a list of keys, including the old ones _(for example, when replacing keys)_, so that everything previously signed with the old key is verified (validated). That is, the list of allowed keys must contain the data history of all keys used in the system for signing. + The list of allowed keys contains the following key data: -//У переліку дозволених ключів вказуються наступні дані ключа: -** `"Key issuer"` -//** `«Емітент ключа»` _(як отримати інформацію, показано у кроках xref:#issuer_key[7.1.-7.2. попереднього розділу])_; -** `"Key serial number"` -//** `«Серійний номер ключа»` _(як отримати інформацію, показано у кроках xref:#serial_number[7.3.-7.4. попереднього розділу])_. +* `"Key issuer"` +* `"Key serial number"` + image:admin:infrastructure/cluster-mgmt/change-key/change-key-16.png[] . Finally, check the entered information and click *`Confirm`*. -//. На завершення перевірте внесену інформацію та натисніть kbd:[Підтвердити]. + image:admin:infrastructure/cluster-mgmt/change-key/change-key-37.png[] + [NOTE] ==== As a result of updating the key data on the Control Plane interface, a new request is created to update the registry configuration that you need to xref:#confirm-changes [confirm]. -//У результаті внесення змін у дані про ключ на інтерфейсі Control Plane, створюється новий запит на оновлення конфігурації реєстру, який xref:#confirm-changes[необхідно підтвердити]. ==== == Confirming changes and applying configuration -//== Підтвердження змін та застосування конфігурації Platform keys are updated by changing the configuration of the Digital signature service. -//Оновлення реєстрових ключів виконується через внесення змін до конфігурації Сервісу цифрового підпису. === Digital signature key configuration algorithm -//=== Алгоритм конфігурації ключів цифрового підпису The general configuration algorithm is as follows for Platform and registry keys: :: -//Загальний алгоритм конфігурації наступний для ключів платформи та реєстру: :: * The administrator edits the Platform or registry's digital signature keys in the Control Plane administrative interface. -//* Адміністратор редагує платформні, або реєстрові ключі цифрового підпису в інтерфейсі адміністративної панелі Control Plane. + * The Control Plane web interface stores changes made by the administrator to the HashiCorp Vault service of the Secret and encryption management subsystem or to the Gerrit service of the Platform and registries deployment and configuration subsystem. -//* Вебінтерфейс Control Plane зберігає внесені адміністратором зміни до сервісу HashiCorp Vault підсистеми управління секретами та шифруванням, або до сервісу Gerrit підсистеми розгортання та налаштування Платформи та реєстрів. + * The Control Plane web interface displays the path to values and files in the corresponding _values.yaml_ configurations. -//* Вебінтерфейс Control Plane відображає шлях до значень та файлів у відповідних конфігураціях _values.yaml_. + * The pipeline takes the required data from HashiCorp Vault or Gerrit and creates the necessary secrets in OpenShift. -//* Пайплайн забирає необхідні дані із HashiCorp Vault або Gerrit та створює необхідні секрети в OpenShift. Below is the diagram for updating the Platform and registry's keys and the configuration of the digital signature service. -//Нижче подано схему оновлення платформних та реєстрових ключів та конфігурацію сервісу цифрового підпису. image::arch:architecture/platform/administrative/config-management/keys-update-subsystem.svg[registry-platform-keys] .Updating platform and registry keys and digital signature service configuration -//.Оновлення платформних та реєстрових ключів та конфігурація сервісу цифрового підпису + image::arch:architecture/platform/administrative/config-management/keys-update-config.svg[registry-platform-keys] === Configuration and secret creation parameters -//=== Параметри конфігурації та створення секретів The Control Plane administration panel stores the following data in the vault for the Digital signatures service (DSS): -//Адміністративна панель Control Plane зберігає наступні дані у Vault для Сервісу цифрового підпису (DSO): * AKCC list -//* Перелік АЦСК + * `KeySecretData` * `CASecretData` * `AllowedKeysSecretData` * `osplm.ini` * Data of the DSS environment variables -//* Дані для змінних середовища DSO (DSO env vars) The path to the engine for the Platform keys looks as follows: -//Шлях до engine для реєстрових ключів виглядає так: ---- registry-kv/registry/<назва-реєстру>/key-management/ ---- Parameters and paths are added to the *_deploy-templates/values.yaml_* registry configuration. -//Параметри та шляхи додаються до конфігурації реєстру *_deploy-templates/values.yaml_*. .Configuration of the registry's values.yaml for updating data about a file key -//.Конфігурація values.yaml реєстру для оновлення даних про файловий ключ ==== [source,yaml] ---- @@ -478,7 +363,6 @@ digital-signature: ==== .Configuration of the registry's values.yaml for updating data about a hardware key -//.Конфігурація values.yaml реєстру для оновлення даних про апаратний ключ ==== [source,yaml] ---- @@ -500,17 +384,14 @@ digital-signature: ==== The *`MASTER-Build-`* pipeline creates secrets for *`digital-signature-env-vars`* and *`digital-signature-data` and stores them in OpenShift. -//Пайплайн *`MASTER-Build-<назва-реєстру>`* створює секрети для *`digital-signature-env-vars`* та *`digital-signature-data`* і зберігає їх в OpenShift. [NOTE] ==== * The Control Plane administrative panel overwrites the data in Vault when updating the key data. -//* Адміністративна панель перезаписує дані у Vault при оновленні інформації про ключі. * The pipeline recreates secrets when updating the key data. Therefore, it is idempotent. -//* Пайплайн при оновленні даних про ключ, перестворює секрети, тобто є ідемпотентним. ==== -//Зміст секретів, які створює пайплайн на основі values.yaml: :: + The pipeline creates the following secrets based on values.yaml: configuration:: + .Secrets for a file key @@ -553,49 +434,38 @@ digital-signature-env-vars: [#confirm-changes] === Confirming changes and launching the pipeline -//=== Підтвердження змін та запуск пайплайну As a result of updating the key data on the Control Plane interface, a new request is created to update the registry configuration, which you have to confirm. -//У результаті оновлення даних про ключ на інтерфейсі Control Plane, створюється новий запит на оновлення конфігурації реєстру, який необхідно підтвердити. . In the Control Plane admin panel interface, return to the [.underline]#Platform management# section, scroll down to the bottom of the page, and find the *Update Requests* section. -//. В інтерфейсі адмін-панелі Control Plane поверніться до розділу [.underline]#Реєстри#, прокрутіть бігунок униз сторінки та знайдіть секцію `Запити на оновлення`. + image:registry-management/cp-submit-mr/cp-submit-mr-1.png[] . Open the generated request by clicking the view icon: 👁. -//. Відкрийте сформований запит, натиснувши іконку перегляду -- 👁. + NOTE: The suggested changes are made to the _deploy-templates/values.yaml_ file configuration when confirmed. -//NOTE: Запропоновані зміни вносяться до конфігурації файлу _deploy-templates/values.yaml_ у разі підтвердження. . In the new window, compare 2 versions of the changes, ensuring the data you entered is correct, and click kbd:[Confirm]. -//. У новому вікні зіставте 2 версії змін, переконайтеся, що внесені вами дані вірні, та натисніть kbd:[Підтвердити]. + .Applying data about a file key to the values.yaml configuration -//.Внесення даних про файловий ключ до конфігурації values.yaml image::admin:infrastructure/cluster-mgmt/change-key/change-key-38.png[] + .Applying data about a hardware key to the values.yaml configuration -//.Внесення даних про апаратний ключ до конфігурації values.yaml -image::admin:infrastructure/cluster-mgmt/change-key/change-key-39.png[] +image::admin:infrastructure/cluster-mgmt/change-key/change-key-39.png[] + image:registry-management/cp-submit-mr/cp-submit-mr-3.png[] + As a result, the request becomes `Confirmed` and the changes take effect. -//В результаті запит набуває статусу `Підтверджено`, а зміни набувають чинності. + + image:registry-management/cp-submit-mr/cp-submit-mr-4.png[] + Next, the *`MASTER-Build-`* pipeline automatically starts, which applies the parameters of the specified configuration and creates secrets for the digital signature keys. -//Далі відбувається автоматичний запуск пайплайну *`MASTER-Build-<назва-реєстру>`*, який застосовує параметри заданої конфігурації та створює секрети для ключів цифрового підпису. . Wait while the code is compiled. This may take about 15 minutes, but this time depends on the configuration of a particular registry. -//. Зачекайте, доки виконається збірка коду. Це може зайняти приблизно 15 хвилин, але все залежатиме від конфігурації певного реєстру. + You can check the current status and the result of the execution using the *`CI`* link on the interface. -//Ви можете перевірити поточний статус та результат виконання за посиланням *`CI`* на інтерфейсі. + image:registry-develop:registry-admin/cp-auth-setup-officers/cp-id-gov-ua-iit-setup-6.png[] + @@ -604,6 +474,5 @@ image:registry-develop:registry-admin/cp-auth-setup-officers/cp-id-gov-ua-iit-se image:registry-develop:registry-admin/cp-auth-setup-officers/cp-id-gov-ua-iit-setup-8.png[] == Related pages -//== Пов'язані сторінки * xref:admin:registry-management/system-keys/create-qes-keys-test-ca-iit.adoc[] \ No newline at end of file diff --git a/docs/en/modules/admin/pages/scaling/scaling-resources.adoc b/docs/en/modules/admin/pages/scaling/scaling-resources.adoc index a79790dc9f..5b95ac3a7c 100644 --- a/docs/en/modules/admin/pages/scaling/scaling-resources.adoc +++ b/docs/en/modules/admin/pages/scaling/scaling-resources.adoc @@ -1,7 +1,7 @@ = Scaling registry resources -include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] -include::platform:ROOT:partial$admonitions/language-ua.adoc[] +include::platform:ROOT:partial$admonitions/language-en.adoc[] // Page content include::platform:ROOT:partial$templates/snippets/scale-resources-en.adoc[] \ No newline at end of file diff --git a/docs/en/modules/admin/partials/nav.adoc b/docs/en/modules/admin/partials/nav.adoc index 19b64224cd..a126de9fc4 100644 --- a/docs/en/modules/admin/partials/nav.adoc +++ b/docs/en/modules/admin/partials/nav.adoc @@ -31,7 +31,8 @@ *** xref:admin:registry-management/control-plane-cidr-access-endpoints.adoc[CIDR: Restricting access to Platform and registry components] *** xref:admin:registry-management/control-plane-submit-mr.adoc[Approving registry configuration update requests] *** xref:admin:registry-management/control-plane-digital-documents.adoc[Managing restrictions on digital document uploads] -*** xref:admin:registry-management/control-plane-quick-links.adoc[Quick links to registry services] +*** Quick links to services +**** xref:admin:registry-management/control-plane-quick-links.adoc[Quick links to registry services] // ===================== MIGRATING REGISTRIES ======================== + ** xref:admin:migration/migration-overview.adoc[Migration] diff --git a/docs/en/modules/admin/partials/templates/snippets/backup-restore-planning-en.adoc b/docs/en/modules/admin/partials/templates/snippets/backup-restore-planning-en.adoc new file mode 100644 index 0000000000..5e8e800645 --- /dev/null +++ b/docs/en/modules/admin/partials/templates/snippets/backup-restore-planning-en.adoc @@ -0,0 +1 @@ +NOTE: It's vital to schedule backups when your system is least busy. We recommend doing this at night. This way, everything will proceed smoothly and without any inconveniences. \ No newline at end of file diff --git a/docs/en/modules/arch/attachments/architecture/platform-api/services/bp-webservice-gateway-core-image-swagger.yml b/docs/en/modules/arch/attachments/architecture/platform-api/services/bp-webservice-gateway-core-image-swagger.yml new file mode 100644 index 0000000000..482c472ab5 --- /dev/null +++ b/docs/en/modules/arch/attachments/architecture/platform-api/services/bp-webservice-gateway-core-image-swagger.yml @@ -0,0 +1,170 @@ +openapi: 3.0.3 +info: + title: Business process web service gateway API + description: This document describes REST API of 'Business process web service gateway' + version: "1.0" +tags: + - name: bp-webservice-gateway-api + description: Business process web service gateway Rest API +paths: + /api/start-bp: + post: + tags: + - bp-webservice-gateway-api + summary: Start process instance + description: |- + ### Endpoint purpose: + This endpoint allows you to start a business process instance based on the provided _businessProcessDefinitionKey_ in request body. + ### Business process start validation: + This endpoint requires valid _businessProcessDefinitionKey_ and _startVariables_. If no business process definition found or required parameters are missing, then _422_ response code returned. + operationId: startBp + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/BusinessProcessStartDataRequest' + example: + businessProcessDefinitionKey: my-business-process + startVariables: + variable1: value1 + variable2: value2 + variable3: null + required: true + responses: + "200": + description: Returns result variable of business process + content: + application/json: + schema: + $ref: '#/components/schemas/BusinessProcessStartResponse' + example: + resultVariables: + return_var_1: return_value_1 + return_var_2: null + "404": + description: Business process definition not found in trembita.process_definitions + content: + application/json: + schema: + $ref: '#/components/schemas/SystemErrorDto' + "422": + description: Business process definition cannot be started or missing required + start variable for the business process + content: + application/json: + schema: + $ref: '#/components/schemas/SystemErrorDto' + "500": + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/SystemErrorDto' + /api/start-bp/{key}: + post: + tags: + - bp-webservice-gateway-api + summary: Start process instance by key + description: |- + ### Endpoint purpose: + This endpoint allows you to start a business process instance by process definition key. + ### Business process start validation: + This endpoint requires valid process definition key and _startVariables_. If no business process definition found or required parameters are missing, then _422_ response code returned. + operationId: startBpByDefinitionKey + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: key + in: path + description: Process definition key + required: true + schema: + type: string + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/BusinessProcessStartVariableRequest' + example: + startVariables: + variable1: value1 + variable2: value2 + variable3: null + required: true + responses: + "200": + description: Returns result variable of business process + content: + application/json: + schema: + $ref: '#/components/schemas/BusinessProcessStartResponse' + example: + resultVariables: + return_var_1: return_value_1 + return_var_2: null + "404": + description: Business process definition not found in trembita.process_definitions + content: + application/json: + schema: + $ref: '#/components/schemas/SystemErrorDto' + "422": + description: Business process definition cannot be started or missing required + start variable for the business process + content: + application/json: + schema: + $ref: '#/components/schemas/SystemErrorDto' + "500": + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/SystemErrorDto' +components: + schemas: + BusinessProcessStartDataRequest: + type: object + properties: + businessProcessDefinitionKey: + type: string + startVariables: + type: object + additionalProperties: + type: object + BusinessProcessStartResponse: + type: object + properties: + resultVariables: + type: object + additionalProperties: + type: object + SystemErrorDto: + type: object + properties: + traceId: + type: string + code: + type: string + message: + type: string + localizedMessage: + type: string + BusinessProcessStartVariableRequest: + type: object + properties: + startVariables: + type: object + additionalProperties: + type: object \ No newline at end of file diff --git a/docs/en/modules/arch/attachments/architecture/platform-api/services/bpms-swagger.yml b/docs/en/modules/arch/attachments/architecture/platform-api/services/bpms-swagger.yml new file mode 100644 index 0000000000..adfb2358ce --- /dev/null +++ b/docs/en/modules/arch/attachments/architecture/platform-api/services/bpms-swagger.yml @@ -0,0 +1,1530 @@ +openapi: 3.0.1 +info: + title: "Business-process-management-service REST API" + description: "OpenApi Spec for Business-process management service REST API. Contains Camunda REST API and extended Business-process management service API." + version: "Camunda version 7.16.0" +servers: + - url: "/api" + description: "The API server for the default process engine" + - url: "{url}" + description: "The API server with a custom url" + variables: + url: + default: "" +paths: + /extended/authorizations/process-instance/create: + post: + operationId: createProcessInstanceAuthorizations + summary: Create authorizations for process instances. + description: | + ### Endpoint purpose + The purpose of the endpoint is to create authorizations for list of roles to be able to create [process instances](https://docs.camunda.org/manual/7.16/user-guide/process-engine/process-engine-concepts/#process-instances). It takes a list of group names as input and creates authorizations for those groups and returns the count of created authorizations. + + Created authorizations are [Camunda Process-Instance authorizations](https://docs.camunda.org/manual/7.16/webapps/admin/authorization-management/) with permissions `CREATE` and resource id `'*'` + requestBody: + required: true + content: + application/json: + schema: + type: array + description: List of group names + example: ["officer", "citizen", "custom-registry-role"] + items: + type: string + description: Not empty group name + example: "custom-registry-role" + nullable: false + minLength: 1 + example: ["officer", "citizen", "custom-registry-role"] + responses: + '200': + description: Authorizations created + content: + application/json: + schema: + $ref: '#/components/schemas/DdmCountResultDto' + '500': + $ref: '#/components/responses/SystemError' + tags: + - Extended authorizations + + /extended/authorizations/process-definition/create: + post: + operationId: createProcessDefinitionAuthorizations + summary: Create authorizations for process definitions. + description: | + ### Endpoint purpose + The purpose of the endpoint is to create a list of authorizations for role for exact [process definition](https://docs.camunda.org/manual/7.16/user-guide/process-engine/process-engine-concepts/#process-definitions) to be able to read them and create instances of these processes. It takes a list of pairs group name/process definition key as input and creates authorizations for them and returns the count of created authorizations. + + Created authorizations are [Camunda Process-Definition authorizations](https://docs.camunda.org/manual/7.16/webapps/admin/authorization-management/) with permissions `READ,CREATE_INSTANCE` + requestBody: + required: true + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/DdmProcessDefinitionAuthDto' + responses: + '200': + description: Successful response + content: + application/json: + schema: + $ref: '#/components/schemas/DdmCountResultDto' + '500': + $ref: '#/components/responses/SystemError' + tags: + - Extended authorizations + + /extended/authorizations/delete: + delete: + summary: Delete authorizations for process instances and process definitions. + description: | + ### Endpoint purpose + The purpose of the endpoint is to delete all created authorizations created by [/extended/authorizations/process-instance/create](#Extended%20authorizations/createProcessInstanceAuthorizations) and [/extended/authorizations/process-definition/create](#Extended%20authorizations/createProcessDefinitionAuthorizations) at once. + + It returns the count of deleted authorizations. + + __*WARNING:*__ If there are any authorizations that match the endpoint search criteria and were created _manually_ or with a _different endpoint_, they will be __deleted__ as well. This applies to process definitions with permissions `READ, CREATE_INSTANCE` and to process instances with `CREATE` permission and resource ID `'*'`. + responses: + '200': + description: Successful response + content: + application/json: + schema: + $ref: '#/components/schemas/DdmCountResultDto' + '500': + $ref: '#/components/responses/SystemError' + tags: + - Extended authorizations + + /extended/process-definition/key/{key}: + get: + summary: Get process definition by key. + description: | + ### Endpoint purpose + The purpose of the endpoint is to retrieve a [process definition](https://docs.camunda.org/manual/7.16/user-guide/process-engine/process-engine-concepts/#process-definitions) object by its key with start-form. + + This endpoint was created to join Camunda [get process definition endpoint](https://docs.camunda.org/manual/7.16/reference/rest/process-definition/get/) and [get start form key endpoint](https://docs.camunda.org/manual/7.16/reference/rest/process-definition/get-start-form-key/). + + It takes the key as a path parameter and returns the corresponding process definition object with it's start form key if present. + parameters: + - in: path + name: key + required: true + description: Unique process definition key + schema: + type: string + example: awesome-process-definition + responses: + '200': + description: Successful response + content: + application/json: + schema: + $ref: '#/components/schemas/DdmProcessDefinitionDto' + '404': + description: Business process not found + content: + application/json: + schema: + $ref: '#/components/schemas/ErrorDto' + example: | + { + "traceId": "ac3bee6c5cdb10142947264715dd5559", + "code": "RestException", + "message": "No matching process definition with key: awesome-process-definition and no tenant-id", + "localizedMessage": "No matching process definition with key: awesome-process-definition and no tenant-id" + } + '500': + $ref: '#/components/responses/SystemError' + tags: + - Extended Process Definition + + /extended/process-definition: + post: + summary: Search process definitions by params. + description: | + ### Endpoint purpose + The purpose of the endpoint is to search a [process definition](https://docs.camunda.org/manual/7.16/user-guide/process-engine/process-engine-concepts/#process-definitions) objects by search parameters. + + This endpoint was created to join Camunda [get process definition list endpoint](https://docs.camunda.org/manual/7.16/reference/rest/process-definition/get-query/) and [get start form key endpoint](https://docs.camunda.org/manual/7.16/reference/rest/process-definition/get-start-form-key/) in complex POST method with limited query parameters that won't have query size restrictions. + requestBody: + required: true + content: + application/json: + schema: + $ref: '#/components/schemas/ProcessDefinitionQueryDto' + responses: + '200': + description: Successful response + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/DdmProcessDefinitionDto' + '500': + $ref: '#/components/responses/SystemError' + tags: + - Extended Process Definition + + /extended/task: + post: + operationId: getByParams + summary: Get list of user tasks by provided query params + description: | + ### Endpoint purpose + The purpose of the endpoint is to search a [user tasks](https://docs.camunda.org/manual/7.16/reference/bpmn20/tasks/user-task/) objects by search parameters. + + This endpoint was created to extend Camunda [get task list endpoint](https://docs.camunda.org/manual/7.16/reference/rest/task/get-query/) with returning process definition name and business key with task info. + + Request has same structure as Camunda [get task list endpoint](https://docs.camunda.org/manual/7.16/reference/rest/task/get-query/). + parameters: + - in: query + name: firstResult + description: Defines how many tasks will be skipped + required: false + schema: + type: integer + example: 20 + - in: query + description: Defines how many tasks will be returned + name: maxResults + required: false + schema: + type: integer + example: 10 + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/TaskQueryDto' + required: true + responses: + '200': + description: Successful response + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/DdmTaskDto' + '500': + $ref: '#/components/responses/SystemError' + tags: + - Extended Task + + /extended/task/lightweight: + post: + summary: Method for getting list of lightweight Camunda user tasks + description: 'Lightweight version of [/extended/task](#Extended%20task/getByParams) endpoint that returns only task id and its assignee.' + parameters: + - in: query + name: firstResult + description: Defines how many tasks will be skipped + required: false + schema: + type: integer + example: 20 + - in: query + description: Defines how many tasks will be returned + name: maxResults + required: false + schema: + type: integer + example: 10 + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/DdmTaskQueryDto' + required: true + responses: + '200': + description: Successful response + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/DdmLightweightTaskDto' + '500': + $ref: '#/components/responses/SystemError' + tags: + - Extended Task + + /extended/task/{id}: + get: + summary: Method for getting extended camunda user task + description: | + ### Endpoint purpose + The purpose of the endpoint is to get a [user task](https://docs.camunda.org/manual/7.16/reference/bpmn20/tasks/user-task/) object by id. + + This endpoint was created to extend Camunda [get task endpoint](https://docs.camunda.org/manual/7.16/reference/rest/task/get/) with returning process definition name, id of a root process instance, indicator if that task is signable, signature validation pack and business process form variables with task info. + parameters: + - name: id + description: Unique identificator of a task + in: path + example: fa1fdc6e-361a-4236-8d9e-a7ce126a03a5 + required: true + schema: + type: string + responses: + '200': + description: Successful response + content: + application/json: + schema: + $ref: '#/components/schemas/DdmSignableTaskDto' + '404': + description: Task not found + content: + application/json: + example: | + { + "type": "RestException", + "message": "No matching task with id fa1fdc6e-361a-4236-8d9e-a7ce126a03a5" + } + '500': + $ref: '#/components/responses/SystemError' + tags: + - Extended Task + + /extended/task/{id}/complete: + post: + summary: Complete user task by ID + description: | + ### Endpoint purpose + The purpose of the endpoint is to complete a [user task](https://docs.camunda.org/manual/7.16/reference/bpmn20/tasks/user-task/) by id. + + This endpoint was created to extend Camunda [complete task endpoint](https://docs.camunda.org/manual/7.16/reference/rest/task/post-complete/) with returning root process instance id and whether the root process instance has ended. + operationId: completeTaskById + parameters: + - name: id + description: Unique identificator of a task + in: path + example: fa1fdc6e-361a-4236-8d9e-a7ce126a03a5 + required: true + schema: + type: string + requestBody: + required: true + content: + application/json: + schema: + $ref: '#/components/schemas/DdmCompleteTaskDto' + responses: + '200': + description: Successful response + content: + application/json: + schema: + $ref: '#/components/schemas/DdmCompletedTaskDto' + '404': + description: Task not found + content: + application/json: + example: | + { + "type": "RestException", + "message": "No matching task with id fa1fdc6e-361a-4236-8d9e-a7ce126a03a5" + } + '422': + description: Client validation exception + content: + application/json: + schema: + $ref: '#/components/schemas/ClientValidationException' + '500': + $ref: '#/components/responses/SystemError' + tags: + - Extended Task + +components: + responses: + Unauthenticated: + description: Unauthenticated + Unauthorized: + description: Unauthorized + SystemError: + description: Some system error occurred + content: + application/json: + schema: + $ref: '#/components/schemas/ErrorDto' + schemas: + DdmProcessDefinitionDto: + type: object + description: DTO that represents the process definition resource + properties: + id: + type: string + example: awesome-process-definition:5:9b1d903c-51bc-41b0-b5bc-360362e0d7cb + nullable: false + description: The ID of the specific version of business-process. + key: + type: string + example: awesome-process-definition + nullable: false + description: The ID of the specific business-process. It is same for all versions of the business-process. + name: + type: string + example: Awesome process definition + nullable: false + description: Human readable name of business process definition. Unlike base Camunda, the name cannot be null. + suspended: + type: boolean + example: false + nullable: false + description: Flag that indicates whether this business process is suspended for starting process instances. + formKey: + type: string + example: awesome-process-definition-start-form-key + nullable: true + description: Key of the process definition start form. Can be null if business process doesn't require start form. + + DdmProcessDefinitionAuthDto: + type: object + description: DTO that represents the pair of a group and process-definition for which an authorization is required to be created. + properties: + groupId: + type: string + description: Not empty group name + example: "custom-registry-role" + nullable: false + minLength: 1 + processDefinitionId: + type: string + nullable: false + description: Process-definition key. + example: "awesome-business-process" + + DdmCountResultDto: + type: object + description: DTO that represents the result of a count operation. + example: {"count": 42} + properties: + count: + type: number + minimum: 0 + description: Result count of entities + example: 42 + + ProcessDefinitionQueryDto: + type: object + description: DTO that represents the set of query parameters for searching process definitions. + properties: + active: + type: boolean + example: true + nullable: true + default: false + description: | + Flag that indicates that it's needed to search only active process definitions (suspension state = ACTIVE). + + NOTE: If suspended flag is set to true then this flag is ignored. + latestVersion: + type: boolean + example: true + nullable: true + default: false + description: | + Flag that indicates that it's needed to search only latest versions of the process definitions for each process definition key. + + NOTE: Cannot be used with processDefinitionId. + processDefinitionId: + type: string + example: awesome-process-definition:5:9b1d903c-51bc-41b0-b5bc-360362e0d7cb + nullable: true + default: null + description: | + Specifies the ID of the process definition specific version to retrieve. Can be null. + + NOTE: Cannot be used with latestVersion. And shouldn't be used with processDefinitionIdIn. + processDefinitionIdIn: + type: array + example: ["awesome-process-definition:5:9b1d903c-51bc-41b0-b5bc-360362e0d7cb", "awesome-process-definition:4:0c7ee46d-7e43-46c2-b440-6b30b2267a6a"] + nullable: true + default: null + description: | + Specifies an array of process definition IDs to retrieve. Can be null. Ignored if empty array is set. + + NOTE: Shouldn't be used with processDefinitionId as conflict search criteria. + items: + type: string + sortBy: + type: string + example: name + nullable: true + default: null + description: Specifies the field to sort the process definitions by. Can be null. + enum: + - "category" + - "key" + - "id" + - "name" + - "version" + - "deploymentId" + - "deployTime" + - "tenantId" + - "versionTag" + - null + sortOrder: + type: string + example: asc + nullable: true + default: null + description: Specifies the order in which the process definitions should be sorted. Can be null. Cannot work without sortBy. + enum: + - asc + - desc + - null + suspended: + type: boolean + example: false + nullable: true + default: false + description: | + Flag that indicates that it's needed to search only suspended process definitions (suspension state = SUSPENDED). + + NOTE: If this flag is set to true then active flag is ignored. + + DdmTaskDto: + type: object + description: DTO that represents task resource along with process definition name and process instance business key + properties: + id: + type: string + example: 9402afe5-ce88-4af4-be0b-5035bbe47722 + nullable: false + description: Represents the unique identifier of the task. + taskDefinitionKey: + type: string + example: awesome-task-definition + nullable: false + description: Represents the key of the task's definition in business process. + name: + type: string + example: Awesome task definition + nullable: false + description: Represents the human readable name of the task. + assignee: + type: string + example: some_username + nullable: true + description: Represents the username of a user that assigned to the task. + created: + type: string + format: date-time + nullable: false + description: Represents the date and time when the task was created. + description: + type: string + example: Task that assigned to business process initiator + nullable: true + description: Represents the description of the task. + processDefinitionName: + type: string + example: Awesome process definition + nullable: false + description: Represents the human readable name of the process definition associated with the task. + processInstanceId: + type: string + example: 31b15466-2743-438a-b4cb-fa1a7d1478e9 + nullable: false + description: Represents the unique identifier of the process instance associated with the task. + processDefinitionId: + type: string + example: awesome-process-definition:5:9b1d903c-51bc-41b0-b5bc-360362e0d7cb + nullable: false + description: Represents the unique identifier of the process definition associated with the task. + formKey: + type: string + example: awesome-task-form + nullable: false + description: Represents the form key associated with the task. + suspended: + type: boolean + example: false + nullable: false + description: Represents the status of the task (suspended or not). + businessKey: + type: string + example: null + nullable: true + description: Represents the business key of the process instance associated with the task. + + + TaskQueryDto: + type: object + properties: + processInstanceId: + type: string + description: Restrict to tasks that belong to process instances with the given + id. + nullable: true + processInstanceIdIn: + type: array + description: Restrict to tasks that belong to process instances with the given + ids. + nullable: true + items: + type: string + processInstanceBusinessKey: + type: string + description: Restrict to tasks that belong to process instances with the given + business key. + nullable: true + processInstanceBusinessKeyExpression: + type: string + description: "Restrict to tasks that belong to process instances with the given + business key which \nis described by an expression. See the \n[user guide](https://docs.camunda.org/manual/7.16/user-guide/process-engine/expression-language/#internal-context-functions)\n for + more information on available functions." + nullable: true + processInstanceBusinessKeyIn: + type: array + description: "Restrict to tasks that belong to process instances with one of + the give business keys. \nThe keys need to be in a comma-separated list." + nullable: true + items: + type: string + processInstanceBusinessKeyLike: + type: string + description: "Restrict to tasks that have a process instance business key that + has the parameter \n value as a substring." + nullable: true + processInstanceBusinessKeyLikeExpression: + type: string + description: "Restrict to tasks that have a process instance business key that + has the parameter \n value as a substring and is described by an expression. + See the\n[user guide](https://docs.camunda.org/manual/7.16/user-guide/process-engine/expression-language/#internal-context-functions) + \n for more information on available functions." + nullable: true + processDefinitionId: + type: string + description: Restrict to tasks that belong to a process definition with the + given id. + nullable: true + processDefinitionKey: + type: string + description: Restrict to tasks that belong to a process definition with the + given key. + nullable: true + processDefinitionKeyIn: + type: array + description: "Restrict to tasks that belong to a process definition with one + of the given keys. The \n keys need to be in a comma-separated list." + nullable: true + items: + type: string + processDefinitionName: + type: string + description: Restrict to tasks that belong to a process definition with the + given name. + nullable: true + processDefinitionNameLike: + type: string + description: "Restrict to tasks that have a process definition name that has + the parameter value as \na substring." + nullable: true + executionId: + type: string + description: Restrict to tasks that belong to an execution with the given id. + nullable: true + caseInstanceId: + type: string + description: Restrict to tasks that belong to case instances with the given + id. + nullable: true + caseInstanceBusinessKey: + type: string + description: Restrict to tasks that belong to case instances with the given + business key. + nullable: true + caseInstanceBusinessKeyLike: + type: string + description: "Restrict to tasks that have a case instance business key that + has the parameter value \nas a substring." + nullable: true + caseDefinitionId: + type: string + description: Restrict to tasks that belong to a case definition with the given + id. + nullable: true + caseDefinitionKey: + type: string + description: Restrict to tasks that belong to a case definition with the given + key. + nullable: true + caseDefinitionName: + type: string + description: Restrict to tasks that belong to a case definition with the given + name. + nullable: true + caseDefinitionNameLike: + type: string + description: "Restrict to tasks that have a case definition name that has the + parameter value as a \n substring." + nullable: true + caseExecutionId: + type: string + description: Restrict to tasks that belong to a case execution with the given + id. + nullable: true + activityInstanceIdIn: + type: array + description: "Only include tasks which belong to one of the passed and comma-separated + activity \n instance ids." + nullable: true + items: + type: string + tenantIdIn: + type: array + description: "Only include tasks which belong to one of the passed and comma-separated + \n tenant ids." + nullable: true + items: + type: string + withoutTenantId: + type: boolean + description: "Only include tasks which belong to no tenant. Value may only be + `true`, \nas `false` is the default behavior." + nullable: true + default: false + assignee: + type: string + description: Restrict to tasks that the given user is assigned to. + nullable: true + assigneeExpression: + type: string + description: "Restrict to tasks that the user described by the given expression + is assigned to. See the\n[user guide](https://docs.camunda.org/manual/7.16/user-guide/process-engine/expression-language/#internal-context-functions) + \n for more information on available functions." + nullable: true + assigneeLike: + type: string + description: "Restrict to tasks that have an assignee that has the parameter + \n value as a substring." + nullable: true + assigneeLikeExpression: + type: string + description: "Restrict to tasks that have an assignee that has the parameter + value described by the \n given expression as a substring. See the \n[user + guide](https://docs.camunda.org/manual/7.16/user-guide/process-engine/expression-language/#internal-context-functions) + \n for more information on available functions." + nullable: true + assigneeIn: + type: array + description: Only include tasks which are assigned to one of the passed and + comma-separated user ids. + nullable: true + items: + type: string + assigneeNotIn: + type: array + description: Only include tasks which are not assigned to one of the passed + and comma-separated user ids. + nullable: true + items: + type: string + owner: + type: string + description: Restrict to tasks that the given user owns. + nullable: true + ownerExpression: + type: string + description: "Restrict to tasks that the user described by the given expression + owns. See the \n[user guide](https://docs.camunda.org/manual/7.16/user-guide/process-engine/expression-language/#internal-context-functions) + \n for more information on available functions." + nullable: true + candidateGroup: + type: string + description: Only include tasks that are offered to the given group. + nullable: true + candidateGroupExpression: + type: string + description: "Only include tasks that are offered to the group described by + the given expression. \nSee the \n[user guide](https://docs.camunda.org/manual/7.16/user-guide/process-engine/expression-language/#internal-context-functions) + \n for more information on available functions." + nullable: true + candidateUser: + type: string + description: Only include tasks that are offered to the given user or to one + of his groups. + nullable: true + candidateUserExpression: + type: string + description: "Only include tasks that are offered to the user described by the + given expression. \nSee the \n[user guide](https://docs.camunda.org/manual/7.16/user-guide/process-engine/expression-language/#internal-context-functions) + \n for more information on available functions." + nullable: true + includeAssignedTasks: + type: boolean + description: "Also include tasks that are assigned to users in candidate queries. + Default is to only \n include tasks that are not assigned to any user if you + query by candidate user or\n group(s)." + nullable: true + default: false + involvedUser: + type: string + description: "Only include tasks that the given user is involved in. A user + is involved in a task if \nan identity link exists between task and user (e.g., + the user is the assignee)." + nullable: true + involvedUserExpression: + type: string + description: |- + Only include tasks that the user described by the given expression is involved in. + A user is involved in a task if an identity link exists between task and user + (e.g., the user is the assignee). See the + [user guide](https://docs.camunda.org/manual/7.16/user-guide/process-engine/expression-language/#internal-context-functions) + for more information on available functions. + nullable: true + assigned: + type: boolean + description: If set to `true`, restricts the query to all tasks that are assigned. + nullable: true + default: false + unassigned: + type: boolean + description: If set to `true`, restricts the query to all tasks that are unassigned. + nullable: true + default: false + taskDefinitionKey: + type: string + description: Restrict to tasks that have the given key. + nullable: true + taskDefinitionKeyIn: + type: array + description: Restrict to tasks that have one of the given keys. The keys need + to be in a comma-separated list. + nullable: true + items: + type: string + taskDefinitionKeyLike: + type: string + description: Restrict to tasks that have a key that has the parameter value + as a substring. + nullable: true + name: + type: string + description: Restrict to tasks that have the given name. + nullable: true + nameNotEqual: + type: string + description: Restrict to tasks that do not have the given name. + nullable: true + nameLike: + type: string + description: Restrict to tasks that have a name with the given parameter value + as substring. + nullable: true + nameNotLike: + type: string + description: |- + Restrict to tasks that do not have a name with the given parameter + value as substring. + nullable: true + description: + type: string + description: Restrict to tasks that have the given description. + nullable: true + descriptionLike: + type: string + description: |- + Restrict to tasks that have a description that has the parameter + value as a substring. + nullable: true + priority: + type: integer + description: Restrict to tasks that have the given priority. + format: int32 + nullable: true + maxPriority: + type: integer + description: Restrict to tasks that have a lower or equal priority. + format: int32 + nullable: true + minPriority: + type: integer + description: Restrict to tasks that have a higher or equal priority. + format: int32 + nullable: true + dueDate: + type: string + description: |- + Restrict to tasks that are due on the given date. By + [default](https://docs.camunda.org/manual/7.16/reference/rest/overview/date-format/), the date must have the format + `yyyy-MM-dd'T'HH:mm:ss.SSSZ`, e.g., `2013-01-23T14:42:45.546+0200`. + format: date-time + nullable: true + dueDateExpression: + type: string + description: |- + Restrict to tasks that are due on the date described by the given expression. See the + [user guide](https://docs.camunda.org/manual/7.16/user-guide/process-engine/expression-language/#internal-context-functions) + for more information on available functions. The expression must evaluate to a + `java.util.Date` or `org.joda.time.DateTime` object. + nullable: true + dueAfter: + type: string + description: |- + Restrict to tasks that are due after the given date. By + [default](https://docs.camunda.org/manual/7.16/reference/rest/overview/date-format/), the date must have + the format `yyyy-MM-dd'T'HH:mm:ss.SSSZ`, e.g., `2013-01-23T14:42:45.435+0200`. + format: date-time + nullable: true + dueAfterExpression: + type: string + description: |- + Restrict to tasks that are due after the date described by the given expression. + See the + [user guide](https://docs.camunda.org/manual/7.16/user-guide/process-engine/expression-language/#internal-context-functions) + for more information on available functions. The expression must evaluate to a + `java.util.Date` or `org.joda.time.DateTime` object. + nullable: true + dueBefore: + type: string + description: |- + Restrict to tasks that are due before the given date. By + [default](https://docs.camunda.org/manual/7.16/reference/rest/overview/date-format/), the date must have + the format `yyyy-MM-dd'T'HH:mm:ss.SSSZ`, e.g., `2013-01-23T14:42:45.243+0200`. + format: date-time + nullable: true + dueBeforeExpression: + type: string + description: |- + Restrict to tasks that are due before the date described by the given expression. + See the + [user guide](https://docs.camunda.org/manual/7.16/user-guide/process-engine/expression-language/#internal-context-functions) + for more information on available functions. The expression must evaluate to a + `java.util.Date` or `org.joda.time.DateTime` object. + nullable: true + withoutDueDate: + type: boolean + description: "Only include tasks which have no due date. Value may only be `true`, + \nas `false` is the default behavior." + nullable: true + default: false + followUpDate: + type: string + description: |- + Restrict to tasks that have a followUp date on the given date. By + [default](https://docs.camunda.org/manual/7.16/reference/rest/overview/date-format/), the date + must have the format `yyyy-MM-dd'T'HH:mm:ss.SSSZ`, e.g., `2013-01-23T14:42:45.342+0200`. + format: date-time + nullable: true + followUpDateExpression: + type: string + description: |- + Restrict to tasks that have a followUp date on the date described by the given + expression. See the + [user guide](https://docs.camunda.org/manual/7.16/user-guide/process-engine/expression-language/#internal-context-functions) + for more information on available functions. The expression must evaluate to a + `java.util.Date` or `org.joda.time.DateTime` object. + nullable: true + followUpAfter: + type: string + description: |- + Restrict to tasks that have a followUp date after the given date. By + [default](https://docs.camunda.org/manual/7.16/reference/rest/overview/date-format/), the date must have + the format `yyyy-MM-dd'T'HH:mm:ss.SSSZ`, e.g., `2013-01-23T14:42:45.542+0200`. + format: date-time + nullable: true + followUpAfterExpression: + type: string + description: |- + Restrict to tasks that have a followUp date after the date described by the given + expression. See the + [user guide](https://docs.camunda.org/manual/7.16/user-guide/process-engine/expression-language/#internal-context-functions) + for more information on available functions. The expression must evaluate to a + `java.util.Date` or `org.joda.time.DateTime` object. + nullable: true + followUpBefore: + type: string + description: |- + Restrict to tasks that have a followUp date before the given date. By + [default](https://docs.camunda.org/manual/7.16/reference/rest/overview/date-format/), the date must have + the format `yyyy-MM-dd'T'HH:mm:ss.SSSZ`, e.g., `2013-01-23T14:42:45.234+0200`. + nullable: true + followUpBeforeExpression: + type: string + description: |- + Restrict to tasks that have a followUp date before the date described by the given + expression. See the + [user guide](https://docs.camunda.org/manual/7.16/user-guide/process-engine/expression-language/#internal-context-functions) + for more information on available functions. The expression must evaluate to a + `java.util.Date` or `org.joda.time.DateTime` object. + nullable: true + followUpBeforeOrNotExistent: + type: string + description: |- + Restrict to tasks that have no followUp date or a followUp date before the given date. + By [default](https://docs.camunda.org/manual/7.16/reference/rest/overview/date-format/), the date must have + the format `yyyy-MM-dd'T'HH:mm:ss.SSSZ`, e.g., `2013-01-23T14:42:45.432+0200`. The typical use case + is to query all `active` tasks for a user for a given date. + format: date-time + nullable: true + followUpBeforeOrNotExistentExpression: + type: string + description: |- + Restrict to tasks that have no followUp date or a followUp date before the date + described by the given expression. See the + [user guide](https://docs.camunda.org/manual/7.16/user-guide/process-engine/expression-language/#internal-context-functions) + for more information on available functions. The expression must evaluate to a + `java.util.Date` or `org.joda.time.DateTime` object. + nullable: true + createdOn: + type: string + description: |- + Restrict to tasks that were created on the given date. By + [default](https://docs.camunda.org/manual/7.16/reference/rest/overview/date-format/), the date must have + the format `yyyy-MM-dd'T'HH:mm:ss.SSSZ`, e.g., `2013-01-23T14:42:45.324+0200`. + format: date-time + nullable: true + createdOnExpression: + type: string + description: |- + Restrict to tasks that were created on the date described by the given expression. + See the + [user guide](https://docs.camunda.org/manual/7.16/user-guide/process-engine/expression-language/#internal-context-functions) + for more information on available functions. The expression must evaluate to a + `java.util.Date` or `org.joda.time.DateTime` object. + nullable: true + createdAfter: + type: string + description: |- + Restrict to tasks that were created after the given date. By + [default](https://docs.camunda.org/manual/7.16/reference/rest/overview/date-format/), the date must + have the format `yyyy-MM-dd'T'HH:mm:ss.SSSZ`, e.g., `2013-01-23T14:42:45.342+0200`. + format: date-time + nullable: true + createdAfterExpression: + type: string + description: |- + Restrict to tasks that were created after the date described by the given expression. + See the + [user guide](https://docs.camunda.org/manual/7.16/user-guide/process-engine/expression-language/#internal-context-functions) + for more information on available functions. The expression must evaluate to a + `java.util.Date` or `org.joda.time.DateTime` object. + nullable: true + createdBefore: + type: string + description: |- + Restrict to tasks that were created before the given date. By + [default](https://docs.camunda.org/manual/7.16/reference/rest/overview/date-format/), the date must + have the format `yyyy-MM-dd'T'HH:mm:ss.SSSZ`, e.g., `2013-01-23T14:42:45.332+0200`. + format: date-time + nullable: true + createdBeforeExpression: + type: string + description: |- + Restrict to tasks that were created before the date described by the given expression. + See the + [user guide](https://docs.camunda.org/manual/7.16/user-guide/process-engine/expression-language/#internal-context-functions) + for more information on available functions. The expression must evaluate to a + `java.util.Date` or `org.joda.time.DateTime` object. + nullable: true + delegationState: + type: string + description: |- + Restrict to tasks that are in the given delegation state. Valid values are + `PENDING` and `RESOLVED`. + nullable: true + enum: + - PENDING + - RESOLVED + candidateGroups: + type: array + description: |- + Restrict to tasks that are offered to any of the given candidate groups. Takes a + comma-separated list of group names, so for example + `developers,support,sales`. + nullable: true + items: + type: string + candidateGroupsExpression: + type: string + description: |- + Restrict to tasks that are offered to any of the candidate groups described by the + given expression. See the + [user guide](https://docs.camunda.org/manual/7.16/user-guide/process-engine/expression-language/#internal-context-functions) + for more information on available functions. The expression must evaluate to + `java.util.List` of Strings. + nullable: true + withCandidateGroups: + type: boolean + description: |- + Only include tasks which have a candidate group. Value may only be `true`, + as `false` is the default behavior. + nullable: true + default: false + withoutCandidateGroups: + type: boolean + description: |- + Only include tasks which have no candidate group. Value may only be `true`, + as `false` is the default behavior. + nullable: true + default: false + withCandidateUsers: + type: boolean + description: |- + Only include tasks which have a candidate user. Value may only be `true`, + as `false` is the default behavior. + nullable: true + default: false + withoutCandidateUsers: + type: boolean + description: |- + Only include tasks which have no candidate users. Value may only be `true`, + as `false` is the default behavior. + nullable: true + default: false + active: + type: boolean + description: |- + Only include active tasks. Value may only be `true`, as `false` + is the default behavior. + nullable: true + default: false + suspended: + type: boolean + description: |- + Only include suspended tasks. Value may only be `true`, as + `false` is the default behavior. + nullable: true + default: false + taskVariables: + type: array + description: |- + A JSON array to only include tasks that have variables with certain values. The + array consists of JSON objects with three properties `name`, `operator` and `value`. + `name` is the variable name, `operator` is the comparison operator to be used and + `value` the variable value. `value` may be of type `String`, `Number` or `Boolean`. + + Valid `operator` values are: + `eq` - equal to; + `neq` - not equal to; + `gt` - greater than; + `gteq` - greater than or equal to; + `lt` - lower than; + `lteq` - lower than or equal to; + `like`. + `key` and `value` may not contain underscore or comma characters. + nullable: true + items: + type: string + processVariables: + type: array + description: |- + A JSON array to only include tasks that belong to a process instance with variables + with certain values. The array consists of JSON objects with three properties + `name`, `operator` and `value`. `name` is the variable name, `operator` is the + comparison operator to be used and `value` the variable value. `value` may be of + type `String`, `Number` or `Boolean`. + + Valid `operator` values are: + `eq` - equal to; + `neq` - not equal to; + `gt` - greater than; + `gteq` - greater than or equal to; + `lt` - lower than; + `lteq` - lower than or equal to; + `like`; + `notLike`. + `key` and `value` may not contain underscore or comma characters. + nullable: true + items: + type: string + caseInstanceVariables: + type: array + description: |- + A JSON array to only include tasks that belong to a case instance with variables + with certain values. The array consists of JSON objects with three properties + `name`, `operator` and `value`. `name` is the variable name, `operator` is the + comparison operator to be used and `value` the variable value. `value` may be of + type `String`, `Number` or `Boolean`. + + Valid `operator` values are: + `eq` - equal to; + `neq` - not equal to; + `gt` - greater than; + `gteq` - greater than or equal to; + `lt` - lower than; + `lteq` - lower than or equal to; + `like`. + `key` and `value` may not contain underscore or comma characters. + nullable: true + items: + type: string + variableNamesIgnoreCase: + type: boolean + description: |- + Match all variable names in this query case-insensitively. If set + `variableName` and `variablename` are treated as equal. + nullable: true + default: false + variableValuesIgnoreCase: + type: boolean + description: |- + Match all variable values in this query case-insensitively. If set + `variableValue` and `variablevalue` are treated as equal. + nullable: true + default: false + parentTaskId: + type: string + description: Restrict query to all tasks that are sub tasks of the given task. + Takes a task id. + nullable: true + orQueries: + type: array + description: |- + A JSON array of nested task queries with OR semantics. A task matches a nested query if it fulfills + *at least one* of the query's predicates. With multiple nested queries, a task must fulfill at least one predicate of *each* query ([Conjunctive Normal Form](https://en.wikipedia.org/wiki/Conjunctive_normal_form)). + + All task query properties can be used except for: `sorting`, `withCandidateGroups`, + `withoutCandidateGroups`, `withCandidateUsers`, `withoutCandidateUsers` + + See the [User guide](https://docs.camunda.org/manual/7.16/user-guide/process-engine/process-engine-api/#or-queries) + for more information about OR queries. + nullable: true + items: + $ref: '#/components/schemas/TaskQueryDto' + sorting: + type: array + description: Apply sorting of the result + nullable: true + items: + type: string + taskId: + type: string + rootProcessInstanceId: + type: string + description: A Task query which defines a group of Tasks. + + DdmTaskQueryDto: + type: object + description: DTO that represents a set of query parameters to find user tasks + properties: + taskId: + type: string + example: c3436d47-6b47-498d-89c6-4f65510a1735 + nullable: true + default: null + description: Defines if task with specific taskId has to be found. + assignee: + type: string + example: some_username + nullable: true + default: null + description: Defines if tasks assigned on specific user have to be found. + unassigned: + type: boolean + example: false + nullable: true + default: false + description: Defines if only tasks that don't have assignee have to found. + processInstanceId: + type: string + example: 09c079eb-fea0-4d07-b450-86348840df1f + nullable: true + default: null + description: Defines if tasks of specific process instance have to be found. + rootProcessInstanceId: + type: string + example: 09c079eb-fea0-4d07-b450-86348840df1f + nullable: true + default: null + description: Defines if tasks of this process instance or its subprocesses have to be found. + orQueries: + type: array + example: null + nullable: true + default: null + description: | + A JSON array of nested task queries with OR semantics. A task matches a nested query if it fulfills + *at least one* of the query's predicates. With multiple nested queries, a task must fulfill at least one predicate of *each* query ([Conjunctive Normal Form](https://en.wikipedia.org/wiki/Conjunctive_normal_form)). + + All task query properties can be used except for: `sorting` + + See the [User guide](https://docs.camunda.org/manual/7.16/user-guide/process-engine/process-engine-api/#or-queries) + for more information about OR queries. + items: + $ref: '#/components/schemas/DdmTaskQueryDto' + processInstanceIdIn: + type: array + example: [09c079eb-fea0-4d07-b450-86348840df1f] + nullable: true + default: null + description: Defines if tasks of specific process instances have to be found. + items: + type: string + sorting: + type: object + nullable: true + default: null + description: DTO that represents set of sorting query parameters + properties: + sortBy: + type: string + example: created + nullable: true + description: Specifies the field to sort the tasks by. Can be null. + enum: + - instanceId + - caseInstanceId + - dueDate + - followUpDate + - executionId + - caseExecutionId + - assignee + - created + - description + - id + - name + - nameCaseInsensitive + - priority + - tenantId + - processVariable + - executionVariable + - taskVariable + - caseInstanceVariable + - caseExecutionVariable + sortOrder: + type: string + example: asc + nullable: true + default: null + description: Specifies the order in which the tasks should be sorted. Can be null. Cannot work without sortBy. + enum: + - asc + - desc + - null + + DdmLightweightTaskDto: + type: object + properties: + id: + type: string + example: 9402afe5-ce88-4af4-be0b-5035bbe47722 + nullable: false + description: Represents the unique identifier of the task. + assignee: + type: string + example: some_username + nullable: true + description: Represents the username of a user that assigned to the task. + + DdmSignableTaskDto: + type: object + description: DTO that represents a user task that may require digital signature. + properties: + id: + type: string + nullable: false + example: fa1fdc6e-361a-4236-8d9e-a7ce126a03a5 + description: Represents the ID of the task. + taskDefinitionKey: + type: string + nullable: false + example: signable-task + description: Represents the key of the task that is defined in process definition. + name: + type: string + nullable: false + example: Signable task + description: Represents the human readable name of the task. + assignee: + type: string + nullable: true + example: some_username + description: Represents the username of a user that assigned to the task. + created: + type: string + format: date-time + nullable: false + description: Represents the date and time when the task was created. + description: + type: string + nullable: true + example: null + description: Represents the description of the task. + processDefinitionName: + type: string + example: Awesome process definition + nullable: false + description: Represents the human readable name of the process definition associated with the task. + processInstanceId: + type: string + example: 31b15466-2743-438a-b4cb-fa1a7d1478e9 + nullable: false + description: Represents the unique identifier of the process instance associated with the task. + rootProcessInstanceId: + type: string + example: 31b15466-2743-438a-b4cb-fa1a7d1478e9 + nullable: false + description: Represents the unique identifier of the root process instance associated with the task. (Can be same as processInstanceId) + processDefinitionId: + type: string + example: awesome-process-definition:5:9b1d903c-51bc-41b0-b5bc-360362e0d7cb + nullable: false + description: Represents the unique identifier of the process definition associated with the task. + formKey: + type: string + example: awesome-task-form + nullable: false + description: Represents the form key associated with the task. + suspended: + type: boolean + example: false + nullable: false + description: Represents the status of the task (suspended or not). + eSign: + type: boolean + example: true + nullable: false + description: Represents whether the task requires digital signature. + signatureValidationPack: + type: array + example: [ENTREPRENEUR, LEGAL] + nullable: true + description: Represents a set of subjects used for signature validation. + items: + type: string + enum: [INDIVIDUAL, ENTREPRENEUR, LEGAL] + formVariables: + type: object + nullable: true + example: {"formVariable1": "formVariableValue", "formVariable2": "formVariableValue2"} + description: Represents a map of form variables associated with the task. + + DdmCompleteTaskDto: + type: object + description: DTO that represents the data required to complete a task in a business process management system (BPMS). + properties: + variables: + type: object + nullable: true + default: null + description: Represents the variables needed for the completed task. Each task may have it's own set of variables. + additionalProperties: + $ref: '#/components/schemas/DdmVariableValueDto' + withVariablesInReturn: + type: boolean + nullable: false + default: false + description: Indicates whether the variables should be included in the response or not. + + DdmCompletedTaskDto: + type: object + properties: + id: + type: string + nullable: false + example: fa1fdc6e-361a-4236-8d9e-a7ce126a03a5 + description: Represents the ID of the task. + processInstanceId: + type: string + example: 31b15466-2743-438a-b4cb-fa1a7d1478e9 + nullable: false + description: Represents the unique identifier of the process instance associated with the task. + rootProcessInstanceId: + type: string + example: 31b15466-2743-438a-b4cb-fa1a7d1478e9 + nullable: false + description: Represents the unique identifier of the root process instance associated with the task. (Can be same as processInstanceId) + rootProcessInstanceEnded: + type: boolean + example: true + nullable: false + description: Indicates whether root process instance is ended. + variables: + type: object + example: null + description: Represents process variables. Will be null if request doesn't contain withVariablesInReturn or it's false. + additionalProperties: + $ref: '#/components/schemas/DdmVariableValueDto' + + DdmVariableValueDto: + type: object + description: DTO that represents a variable value in a process engine + properties: + type: + type: string + example: string + description: Indicates the type of the variable value. + value: + description: Holds the actual value of the variable. Can be any value. + valueInfo: + type: object + additionalProperties: + description: Can be any value. + description: Stores additional information about the variable value in the form of a key-value map. + + ErrorDto: + type: object + description: DTO that represents the occurred error. + example: { "traceId": "ac3bee6c5cdb10142947264715dd5559", "code":"500", "message": "Something went wrong", "localizedMessage": null } + properties: + traceId: + type: string + nullable: false + example: ac3bee6c5cdb10142947264715dd5559 + description: Request ID that is read from X-B3-TraceId request header if present or else is generated new one. + code: + type: string + nullable: false + description: The code of an occurred error. + message: + type: string + nullable: false + description: The message of an occurred error. + localizedMessage: + type: string + nullable: true + description: The message of an occurred error based on servers locale. May be null. + + ClientValidationException: + type: object + description: Represent a validation error that occurs on the client side + properties: + traceId: + type: string + nullable: false + example: ac3bee6c5cdb10142947264715dd5559 + description: Request ID that is read from X-B3-TraceId request header if present or else is generated new one. + code: + type: string + nullable: false + description: The code of an occurred error. + details: + $ref: '#/components/schemas/ErrorsListDto' + + ErrorsListDto: + type: object + properties: + errors: + type: array + items: + $ref: '#/components/schemas/ErrorDetailDto' + + ErrorDetailDto: + type: object + properties: + message: + type: string + nullable: false + example: "Value cannot be null" + description: The message of an occurred error. + field: + type: string + nullable: false + example: "nonNullableField" + description: The field name where an error occurred. + value: + type: string + nullable: false + example: null + description: The field value where an error occurred. diff --git a/docs/en/modules/arch/attachments/architecture/platform-api/services/ddm-notification-service-swagger.yml b/docs/en/modules/arch/attachments/architecture/platform-api/services/ddm-notification-service-swagger.yml new file mode 100644 index 0000000000..3fce0e7de2 --- /dev/null +++ b/docs/en/modules/arch/attachments/architecture/platform-api/services/ddm-notification-service-swagger.yml @@ -0,0 +1,344 @@ +openapi: 3.0.3 +info: + title: User notifications service + description: This document describes REST API of 'User notifications service' + version: "1.0" +tags: +- name: notification-template-api + description: User notification template management Rest API +- name: notification-inbox-api + description: User inbox notification management Rest API +paths: + /api/notifications/templates/{channel}:{name}: + put: + tags: + - notification-template-api + summary: Model notification templates separately for each of the communication + channels + description: "### Endpoint purpose: \n This endpoint provides an opportunity\ + \ to model notification templates separately for each of the communication\ + \ channels. \n ### Authorization:\n This endpoint requires valid user authentication.\ + \ To access this endpoint, the request must include a valid access token in\ + \ the _X-Access-Token_ header, otherwise, the API will return a _401 Unauthorized_\ + \ status code" + operationId: saveTemplate + parameters: + - name: X-Access-Token + in: header + description: User access token + schema: + type: string + - name: channel + in: path + description: |- + Communication channel for using the message template. Unique in combination with name + + inbox - Citizen portal + + email - email + + diia - Diia application (Ukrainian citizen-facing solution, UA-specific) + required: true + schema: + type: string + - name: name + in: path + description: Template message internal name. Unique in combination with channel + required: true + schema: + type: string + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/SaveNotificationTemplateInputDto' + example: + title: New notification + content: Hello world + attributes: + - name: attribute1 + value: value1 + - name: attribute2 + value: value2 + required: true + responses: + "200": + description: OK. Notification templates successfully saved. + content: + application/json: + schema: + $ref: '#/components/schemas/SaveNotificationTemplateOutputDto' + example: + name: Notification Template 1 + channel: email + title: New notification + content: Hello world + checksum: "1234567890" + attributes: + - name: attribute1 + value: value1 + - name: attribute2 + value: value2 + createdAt: 2022-01-01T12:00:00.000Z + updatedAt: 2022-01-02T12:00:00.000Z + externalTemplateId: abcd1234 + externallyPublishedAt: 2022-01-03T12:00:00.000Z + "400": + description: Bad Request. + content: + application/json: {} + "401": + description: Unauthorized. Missing or invalid access token or digital signature. + content: + application/json: {} + "500": + description: Internal Server Error. Server error while processing the request. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + /api/notifications/inbox/{id}/ack: + post: + tags: + - notification-inbox-api + summary: Confirmation of in-app message + description: "### Endpoint purpose: \n This endpoint is used for confirming\ + \ notification about the status or result of the business process, receiving\ + \ official messages.\n ### Authorization:\n This endpoint requires valid user\ + \ authentication. To access this endpoint, the request must include a valid\ + \ access token in the _X-Access-Token_ header, otherwise, the API will return\ + \ a _401 Unauthorized_ status code. If the user's ID provided in the JWT token\ + \ does not match the recipient ID of the message, a 403 Forbidden error will\ + \ be returned. Only the recipient of the notification can update its state" + operationId: acknowledgeNotification + parameters: + - name: X-Access-Token + in: header + description: User access token + required: true + schema: + type: string + - name: id + in: path + description: Notification id + required: true + schema: + type: string + format: uuid + responses: + "200": + description: OK. Inbox notification successfully acknowledged. + "400": + description: Bad Request. + content: + application/json: {} + "401": + description: Unauthorized. Missing or invalid access token or digital signature. + content: + application/json: {} + "403": + description: Forbidden. Insufficient permissions to perform the operation. + content: + application/json: {} + "500": + description: Internal Server Error. Server error while processing the request. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + /api/notifications/templates/: + get: + tags: + - notification-template-api + operationId: getAllTemplates + responses: + "200": + description: OK + content: + '*/*': + schema: + type: array + items: + $ref: '#/components/schemas/NotificationTemplateShortInfoResponseDto' + /api/notifications/inbox: + get: + tags: + - notification-inbox-api + summary: Viewing the list of in-app messages + description: "### Endpoint purpose: \n This endpoint is used for viewing notifications\ + \ about the status or result of the business process, receiving official messages.\n\ + \ ### Authorization:\n This endpoint requires valid user authentication. To\ + \ access this endpoint, the request must include a valid access token in the\ + \ _X-Access-Token_ header, otherwise, the API will return a _401 Unauthorized_\ + \ status code" + operationId: getInboxNotifications + parameters: + - name: X-Access-Token + in: header + description: User access token + required: true + schema: + type: string + - name: offset + in: query + description: Record offset + required: true + schema: + type: integer + default: 0 + - name: limit + in: query + description: Maximum number of records to return + required: true + schema: + type: integer + default: 10 + - name: sort + in: query + description: "Field and order for sorting the records. Example: asc()\ + \ / desc()" + required: true + schema: + type: string + default: desc(endTime) + - name: request + in: query + required: true + schema: + $ref: '#/components/schemas/InboxOffsetBasedPageRequest' + responses: + "200": + description: OK. List of inbox notifications successfully retrieved. + content: + application/json: + schema: + $ref: '#/components/schemas/SaveNotificationTemplateOutputDto' + example: + - id: 3fa85f64-5717-4562-b3fc-2c963f66afa6 + subject: Some subject + message: Some message + isAcknowledged: true + createdAt: 2021-08-10T10:30:00.000Z + "400": + description: Bad Request. + content: + application/json: {} + "401": + description: Unauthorized. Missing or invalid access token or digital signature. + content: + application/json: {} + "500": + description: Internal Server Error. Server error while processing the request. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + /api/notifications/templates/{id}: + delete: + tags: + - notification-template-api + operationId: deleteTemplate + parameters: + - name: id + in: path + required: true + schema: + type: string + format: uuid + responses: + "200": + description: OK +components: + schemas: + NotificationTemplateAttributeDto: + type: object + properties: + name: + type: string + value: + type: string + SaveNotificationTemplateInputDto: + type: object + properties: + title: + type: string + content: + type: string + attributes: + type: array + items: + $ref: '#/components/schemas/NotificationTemplateAttributeDto' + SaveNotificationTemplateOutputDto: + type: object + properties: + name: + type: string + channel: + type: string + title: + type: string + content: + type: string + checksum: + type: string + attributes: + type: array + items: + $ref: '#/components/schemas/NotificationTemplateAttributeDto' + createdAt: + type: string + format: date-time + updatedAt: + type: string + format: date-time + externalTemplateId: + type: string + externallyPublishedAt: + type: string + format: date-time + DetailedErrorResponse: + type: object + properties: + traceId: + type: string + code: + type: string + details: + type: object + NotificationTemplateShortInfoResponseDto: + type: object + properties: + id: + type: string + format: uuid + name: + type: string + channel: + type: string + InboxOffsetBasedPageRequest: + type: object + properties: + offset: + type: integer + format: int64 + sort: + $ref: '#/components/schemas/Sort' + pageNumber: + type: integer + format: int32 + pageSize: + type: integer + format: int32 + paged: + type: boolean + unpaged: + type: boolean + Sort: + type: object + properties: + empty: + type: boolean + sorted: + type: boolean + unsorted: + type: boolean diff --git a/docs/en/modules/arch/attachments/architecture/platform-api/services/digital-document-service-swagger.yml b/docs/en/modules/arch/attachments/architecture/platform-api/services/digital-document-service-swagger.yml new file mode 100644 index 0000000000..e67666e7e2 --- /dev/null +++ b/docs/en/modules/arch/attachments/architecture/platform-api/services/digital-document-service-swagger.yml @@ -0,0 +1,609 @@ +openapi: 3.0.3 +info: + title: Digital document service API + description: This document describes REST API of 'Digital document service' + version: "1.0" +tags: +- name: digital-document-service-api + description: Digital document service Rest API +- name: digital-document-service-internal-api-v2 + description: Digital document service internal Rest API +- name: digital-document-service-internal-api + description: Digital document service internal Rest API +paths: + /internal-api/v2/documents/{rootProcessInstanceId}: + post: + tags: + - digital-document-service-internal-api-v2 + summary: Upload MultiPart document + description: |- + ### Endpoint purpose: + This endpoint allows to upload a document as part of a specified process instance. It accepts a multi-part file and an optional file name. The uploaded document's metadata is returned upon successful storage. + ### Validation: + The file size should not exceed the system limit; otherwise, a _413 Payload Too Large_ status code is returned. For batch file uploads, the total file size should not exceed the expected limit. Media type validation accepts the following formats: PDF, PNG, JPG/JPEG, CSV, ASICs, P7S. If a different format is used, a _422 Unprocessable Entity_ status code is returned. + operationId: upload + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: rootProcessInstanceId + in: path + required: true + schema: + type: string + - name: filename + in: query + required: false + schema: + type: string + requestBody: + content: + multipart/form-data: {} + application/json: + schema: + required: + - file + type: object + properties: + file: + type: string + format: binary + required: true + responses: + "200": + description: "Document uploaded, returns uploaded document metadata" + content: + '*/*': + schema: + $ref: '#/components/schemas/InternalApiDocumentMetadataDto' + example: |- + { + "id": "my-file-id", + "name": "my-file-name.pdf", + "type": "application/pdf", + "checksum": "039058c6f2c0cb492c533b0a4d14ef77cc0f78abccced5287d84a1a2011cfb81", + "size": 3, + } + "401": + description: Unauthorized + content: + application/json: {} + "415": + description: Unsupported Media Type + content: + application/json: {} + "422": + description: Unprocessable Entity + content: + application/json: {} + "500": + description: Internal server error + content: + application/json: {} + /internal-api/documents/{rootProcessInstanceId}: + post: + tags: + - digital-document-service-internal-api + summary: Upload document + description: |- + ### Endpoint purpose: + This endpoint downloads document from remote URL passed in request body and using root process instance ID to save document. It returns the uploaded document's metadata. + ### Validation: + The file size should not exceed the system limit; otherwise, a _413 Payload Too Large_ status code is returned. Media type validation accepts the following formats: PDF, PNG, JPG/JPEG, CSV, ASICs, P7S. If a different format is used, a _422 Unprocessable Entity_ status code is returned. + operationId: upload_1 + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: rootProcessInstanceId + in: path + required: true + schema: + type: string + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/RemoteDocumentDto' + example: |- + { + "remoteFileLocation": "https://somefilelocation.com", + "filename": "my-file-name.png", + } + required: true + responses: + "200": + description: Returns uploaded document metadata + content: + '*/*': + schema: + $ref: '#/components/schemas/RemoteDocumentMetadataDto' + example: |- + { + "id": "my-file-id", + "name": "my-file-name.png", + "type": "image/png", + "checksum": "039058c6f2c0cb492c533b0a4d14ef77cc0f78abccced5287d84a1a2011cfb81", + "size": 3, + } + "401": + description: Unauthorized + content: + application/json: {} + "415": + description: Unsupported Media Type + content: + application/json: {} + "422": + description: Unprocessable Entity. Can happen when remote file size more + than allowed. + content: + application/json: {} + "500": + description: Internal server error + content: + application/json: {} + /documents/{rootProcessInstanceId}/{taskId}/{fieldName}: + post: + tags: + - digital-document-service-api + summary: Upload document in business process + description: |- + ### Endpoint purpose: + This endpoint allows to upload a document as part of a specified process instance and task. It accepts a multi-part file and associated parameters, such as the task ID, form field name, and an optional file name. The uploaded document's metadata is returned upon successful storage. + ### Authorization: + This endpoint requires valid user authentication. To access this endpoint, the request must include a valid access token in the _X-Access-Token_ header, otherwise, the API will return a _401 Unauthorized_ status code. Also if _rootProcessInstanceId_ not in task, which retrieved by _taskId_, or task is suspended, or assignee of task is not the same as provided in _X-Access-Token_ then _403_ status code returned. + ### Validation: + This endpoint requires a valid _fieldName_. If the provided field name is not found in the form related to the user task retrieved by _taskId_, a _422_ status code is returned. The file size should not exceed the system limit; otherwise, a _413 Payload Too Large_ status code is returned. For batch file uploads, the total file size should not exceed the expected limit. Media type validation accepts the following formats: PDF, PNG, JPG/JPEG, CSV, ASICs, P7S. If a different format is used, a _422 Unprocessable Entity_ status code is returned. + operationId: upload_2 + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: x-forwarded-host + in: header + required: true + schema: + type: string + - name: rootProcessInstanceId + in: path + required: true + schema: + type: string + - name: taskId + in: path + required: true + schema: + type: string + - name: fieldName + in: path + required: true + schema: + type: string + - name: filename + in: query + required: false + schema: + type: string + requestBody: + content: + multipart/form-data: {} + application/json: + schema: + required: + - file + type: object + properties: + file: + type: string + format: binary + required: true + responses: + "200": + description: "Document uploaded, returns uploaded document metadata" + content: + '*/*': + schema: + $ref: '#/components/schemas/DocumentMetadataDto' + example: |- + { + "id": "my-file-id", + "url": "https://my-file-url", + "name": "my-file-name.pdf", + "type": "application/pdf", + "checksum": "039058c6f2c0cb492c533b0a4d14ef77cc0f78abccced5287d84a1a2011cfb81", + "size": 3, + } + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden. Validation of rootProcessInstanceId or taskId not + passed. + content: + application/json: {} + "413": + description: Payload Too Large. Uploaded document size more than allowed. + content: + application/json: {} + "415": + description: Unsupported Media Type + content: + application/json: {} + "500": + description: Internal server error + content: + application/json: {} + /documents/{rootProcessInstanceId}/{taskId}/search: + post: + tags: + - digital-document-service-api + summary: Search documents metadata + description: |- + ### Endpoint purpose: + This endpoint allows to search for document metadata associated with a specified process instance and task. Document IDs and field names are provided in the request body, and a list of matching document metadata is returned. Server returns every metadata that found and missing files are ignored. + ### Authorization: + This endpoint requires valid user authentication. To access this endpoint, the request must include a valid access token in the _X-Access-Token_ header, otherwise, the API will return a _401 Unauthorized_ status code. Also if _rootProcessInstanceId_ not in task, which retrieved by _taskId_, or task is suspended, or assignee of task is not the same as provided in _X-Access-Token_ then _403_ status code returned. This endpoint requires a valid _fieldName_. If the provided field name is not found in the form related to the user task retrieved by _taskId_, a _403_ status code is returned. + operationId: searchMetadata + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: x-forwarded-host + in: header + required: true + schema: + type: string + - name: rootProcessInstanceId + in: path + required: true + schema: + type: string + - name: taskId + in: path + required: true + schema: + type: string + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/RemoteDocumentDto' + example: + - id: file-id-1 + fieldName: form-field-name-1 + - id: file-id-2 + fieldName: form-field-name-2 + required: true + responses: + "200": + description: Returns list of document metadata + content: + '*/*': + schema: + $ref: '#/components/schemas/DocumentMetadataDto' + example: + - id: file-id-1 + url: https://my-file-url + name: my-file-name.pdf + type: application/pdf + checksum: 039058c6f2c0cb492c533b0a4d14ef77cc0f78abccced5287d84a1a2011cfb81 + size: 3 + - id: file-id-2 + url: https://my-file-url2 + name: my-file-name2.pdf + type: application/pdf + checksum: 039058c6f2c0cb492c533b0a4d14ef77cc0f78abccced5287d84a1a2011cfb81 + size: 5 + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden. Validation of rootProcessInstanceId or taskId not + passed. + content: + application/json: {} + "500": + description: Internal server error + content: + application/json: {} + /internal-api/documents/{rootProcessInstanceId}/{id}: + get: + tags: + - digital-document-service-internal-api + summary: Download document by id + description: |- + ### Endpoint purpose: + This endpoint allows to download a document associated with a specified process instance and document ID. The document is returned as a downloadable resource. + operationId: download + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: rootProcessInstanceId + in: path + required: true + schema: + type: string + - name: id + in: path + required: true + schema: + type: string + responses: + "200": + description: Returns uploaded document metadata + content: + application/octet-stream: {} + "401": + description: Unauthorized + content: + application/json: {} + "404": + description: Not Found + content: + application/json: {} + "500": + description: Internal server error + content: + application/json: {} + /internal-api/documents/{rootProcessInstanceId}/{id}/metadata: + get: + tags: + - digital-document-service-internal-api + summary: Get document metadata by id + description: |- + ### Endpoint purpose + This endpoint allows users to retrieve document metadata based on a specific document ID associated with a given root process instance. Document metadata includes information such as the document's name, content type, size, and other relevant details. + operationId: getMetadata + parameters: + - name: rootProcessInstanceId + in: path + required: true + schema: + type: string + - name: id + in: path + required: true + schema: + type: string + responses: + "200": + description: Returns uploaded document metadata + content: + '*/*': + schema: + $ref: '#/components/schemas/InternalApiDocumentMetadataDto' + example: |- + { + "id": "my-file-id", + "name": "my-file-name.png", + "type": "image/png", + "checksum": "039058c6f2c0cb492c533b0a4d14ef77cc0f78abccced5287d84a1a2011cfb81", + "size": 3, + } + "401": + description: Unauthorized + content: + application/json: {} + "500": + description: Internal server error + content: + application/json: {} + /documents/{rootProcessInstanceId}/{taskId}/{fieldName}/{id}: + get: + tags: + - digital-document-service-api + summary: Download document + description: |- + ### Endpoint purpose: + This endpoint allows users to download a document associated with a specified process instance, task, field, and document ID. The document is returned as a downloadable resource. + ### Authorization: + This endpoint requires valid user authentication. To access this endpoint, the request must include a valid access token in the _X-Access-Token_ header, otherwise, the API will return a _401 Unauthorized_ status code. Also if _rootProcessInstanceId_ not in task, which retrieved by _taskId_, or task is suspended, or assignee of task is not the same as provided in _X-Access-Token_ then _403_ status code returned. This endpoint requires a valid _fieldName_. If the provided field name is not found in the form related to the user task retrieved by _taskId_, a _403_ status code is returned. + operationId: download_1 + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: rootProcessInstanceId + in: path + required: true + schema: + type: string + - name: taskId + in: path + required: true + schema: + type: string + - name: fieldName + in: path + required: true + schema: + type: string + - name: id + in: path + required: true + schema: + type: string + responses: + "200": + description: Document is returned + content: + application/octet-stream: {} + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden. Validation of rootProcessInstanceId or taskId not + passed. + content: + application/json: {} + "404": + description: Document not found + content: + application/json: {} + "500": + description: Internal server error + content: + application/json: {} + /documents/{rootProcessInstanceId}: + delete: + tags: + - digital-document-service-api + summary: Delete all documents by process instance ID + description: |- + ### Endpoint purpose: + This endpoint is intended for internal system use only and should be restricted to the internal network. It allows the deletion of all documents associated with the specified business process, typically for cleaning temporary data. + operationId: delete + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: rootProcessInstanceId + in: path + required: true + schema: + type: string + responses: + "200": + description: Documents deleted successfully. + "401": + description: Unauthorized + content: + application/json: {} + "500": + description: Internal server error + content: + application/json: {} + /documents/{rootProcessInstanceId}/{taskId}/{fieldName}/{fileId}: + delete: + tags: + - digital-document-service-api + summary: Delete document by id + description: |- + ### Endpoint purpose: + This endpoint allows the deletion of a specific document associated with the specified process instance ID, task ID, field name, and file ID. + ### Authorization: + This endpoint requires valid user authentication. To access this endpoint, the request must include a valid access token in the _X-Access-Token_ header, otherwise, the API will return a _401 Unauthorized_ status code. Also if _rootProcessInstanceId_ not in task, which retrieved by _taskId_, or task is suspended, or assignee of task is not the same as provided in _X-Access-Token_ then _403_ status code returned. This endpoint requires a valid _fieldName_. If the provided field name is not found in the form related to the user task retrieved by _taskId_, a _403_ status code is returned. + operationId: deleteByFileId + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: rootProcessInstanceId + in: path + required: true + schema: + type: string + - name: taskId + in: path + required: true + schema: + type: string + - name: fieldName + in: path + required: true + schema: + type: string + - name: fileId + in: path + required: true + schema: + type: string + responses: + "200": + description: Document deleted successfully + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden. Validation of rootProcessInstanceId or taskId not + passed. + content: + application/json: {} + "500": + description: Internal server error + content: + application/json: {} +components: + schemas: + InternalApiDocumentMetadataDto: + type: object + properties: + id: + type: string + name: + type: string + type: + type: string + checksum: + type: string + size: + type: integer + format: int64 + RemoteDocumentDto: + type: object + properties: + remoteFileLocation: + type: string + format: url + filename: + type: string + RemoteDocumentMetadataDto: + type: object + properties: + id: + type: string + name: + type: string + type: + type: string + checksum: + type: string + size: + type: integer + format: int64 + DocumentMetadataDto: + type: object + properties: + id: + type: string + url: + type: string + name: + type: string + type: + type: string + checksum: + type: string + size: + type: integer + format: int64 diff --git a/docs/en/modules/arch/attachments/architecture/platform-api/services/digital-signature-ops-swagger.yml b/docs/en/modules/arch/attachments/architecture/platform-api/services/digital-signature-ops-swagger.yml new file mode 100644 index 0000000000..e6c6a0a2e4 --- /dev/null +++ b/docs/en/modules/arch/attachments/architecture/platform-api/services/digital-signature-ops-swagger.yml @@ -0,0 +1,357 @@ +openapi: 3.0.1 +info: + title: OpenAPI definition + version: v0 +paths: + /api/key/decrypt: + post: + tags: + - digital-key-controller + summary: Returns decrypted user info data + description: Decrypts user info data + operationId: decryptUserInfo + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/DecryptUserInfoRequest' + required: true + responses: + '200': + description: Request processed successfully and user info data is returned in body + content: + '*/*': + schema: + $ref: '#/components/schemas/UserInfoResponse' + /api/file/sign: + post: + tags: + - digital-signature-file-controller + summary: Signs file in specified Ceph bucket + description: Applies system signature to file in Ceph and updates it in storage + operationId: sign + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/SignFileRequestDto' + required: true + responses: + '200': + description: File signed and updated successfully + content: + '*/*': + schema: + $ref: '#/components/schemas/SignFileResponseDto' + '404': + description: File not found in storage + content: + '*/*': + schema: + $ref: '#/components/schemas/SignFileResponseDto' + '500': + description: Internal server error in case of error at any processing steps + content: + '*/*': + schema: + $ref: '#/components/schemas/SignFileResponseDto' + /api/esignature/owner: + post: + tags: + - digital-signature-controller + summary: Returns information about signature owner verifies auth timeout + description: Signature owner information retrieval includes verification of signature + operationId: getOwner + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/VerificationRequestDto' + required: true + responses: + '200': + description: Request processed successfully owner information is returned in body + content: + '*/*': + schema: + $ref: '#/components/schemas/VerificationResponseDto' + /api/esignature/owner-infinite: + post: + tags: + - digital-signature-controller + summary: Returns information about signature owner + description: Signature owner information retrieval includes verification of signature + operationId: getOwnerInfinite + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/VerificationRequestDto' + required: true + responses: + '200': + description: Request processed successfully owner information is returned in body + content: + '*/*': + schema: + $ref: '#/components/schemas/VerificationResponseDto' + /api/esignature/officer/verify: + post: + tags: + - digital-signature-controller + summary: Verifies digital signature for officer role + operationId: verifyOfficer + parameters: + - name: X-Access-Token + in: header + required: false + schema: + pattern: ^[A-Za-z0-9-_=]+\.[A-Za-z0-9-_=]+\.?[A-Za-z0-9-_.+/=]*$ + type: string + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/VerificationRequestDto' + required: true + responses: + '200': + description: OK + content: + '*/*': + schema: + $ref: '#/components/schemas/VerificationResponseDto' + /api/esignature/citizen/verify: + post: + tags: + - digital-signature-controller + summary: Verifies digital signature for citizen role + operationId: verifyCitizen + parameters: + - name: X-Access-Token + in: header + required: false + schema: + pattern: ^[A-Za-z0-9-_=]+\.[A-Za-z0-9-_=]+\.?[A-Za-z0-9-_.+/=]*$ + type: string + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/VerifySubjectRequestDto' + required: true + responses: + '200': + description: OK + content: + '*/*': + schema: + $ref: '#/components/schemas/VerifySubjectResponseDto' + /api/eseal/verify: + post: + tags: + - digital-seal-controller + summary: Verifies digital seal applied to data hash + description: Verifies that signature is valid and created by authorized key + operationId: verify + parameters: + - name: X-Access-Token + in: header + required: false + schema: + pattern: ^[A-Za-z0-9-_=]+\.[A-Za-z0-9-_=]+\.?[A-Za-z0-9-_.+/=]*$ + type: string + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/VerificationRequestDto' + required: true + responses: + '200': + description: Request processed successfully verification status is shown in body + content: + '*/*': + schema: + $ref: '#/components/schemas/VerificationResponseDto' + '400': + description: Passed headers or request body has invalid syntax + content: + '*/*': + schema: + $ref: '#/components/schemas/VerificationResponseDto' + /api/eseal/sign: + post: + tags: + - digital-seal-controller + summary: Signs data passed in request + description: Applies digital signature by system key for requested data + operationId: sign_1 + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/SignRequestDto' + required: true + responses: + '200': + description: Request processed successfully signature returned in body + content: + '*/*': + schema: + $ref: '#/components/schemas/SignResponseDto' + '400': + description: Passed headers or request body has invalid syntax + content: + '*/*': + schema: + $ref: '#/components/schemas/SignResponseDto' + '500': + description: Internal server error in case of error at any processing steps + content: + '*/*': + schema: + $ref: '#/components/schemas/SignResponseDto' + /api/key/certificate: + get: + tags: + - digital-key-controller + summary: Returns private key certificate initialized in application + description: Certificate is Base64 cert file encoded to url representation + operationId: certificate + responses: + '200': + description: Request processed successfully and certificate is returned in body + content: + '*/*': + schema: + $ref: '#/components/schemas/CertificateResponse' +components: + schemas: + DecryptUserInfoRequest: + type: object + properties: + encryptedUserInfo: + type: string + UserInfoResponse: + type: object + properties: + issuer: + type: string + issuercn: + type: string + serial: + type: string + subject: + type: string + subjectcn: + type: string + locality: + type: string + state: + type: string + o: + type: string + ou: + type: string + title: + type: string + lastname: + type: string + middlename: + type: string + givenname: + type: string + email: + type: string + address: + type: string + phone: + type: string + dns: + type: string + edrpoucode: + type: string + drfocode: + type: string + SignFileRequestDto: + required: + - cephKey + type: object + properties: + cephKey: + type: string + SignFileResponseDto: + type: object + properties: + signed: + type: boolean + VerificationRequestDto: + required: + - data + - signature + type: object + properties: + signature: + type: string + data: + type: string + ErrorDto: + type: object + properties: + code: + type: string + message: + type: string + localizedMessage: + type: string + VerificationResponseDto: + type: object + properties: + error: + $ref: '#/components/schemas/ErrorDto' + valid: + type: boolean + VerifySubjectRequestDto: + required: + - allowedSubjects + - data + - signature + type: object + properties: + allowedSubjects: + type: array + items: + type: string + enum: + - INDIVIDUAL + - ENTREPRENEUR + - LEGAL + signature: + type: string + data: + type: string + VerifySubjectResponseDto: + type: object + properties: + error: + $ref: '#/components/schemas/ErrorDto' + valid: + type: boolean + SignRequestDto: + required: + - data + type: object + properties: + data: + type: string + SignResponseDto: + type: object + properties: + signature: + type: string + CertificateResponse: + type: object + properties: + certificate: + type: string diff --git a/docs/en/modules/arch/attachments/architecture/platform-api/services/excerpt-service-api-swagger.yml b/docs/en/modules/arch/attachments/architecture/platform-api/services/excerpt-service-api-swagger.yml new file mode 100644 index 0000000000..689029df68 --- /dev/null +++ b/docs/en/modules/arch/attachments/architecture/platform-api/services/excerpt-service-api-swagger.yml @@ -0,0 +1,251 @@ +openapi: 3.0.3 +info: + title: Excerpts management service + description: This document describes REST API of 'Excerpts management service' + version: "1.0" +tags: +- name: excerpts-service-api + description: Excerpts management service Rest API +paths: + /excerpts: + post: + tags: + - excerpts-service-api + summary: Create an excerpt generation record + description: |- + ### Endpoint purpose: + Creates an excerpt generation record by sending required parameters as JSON data. Returns the UUID of the generated excerpt, which can be used to access the generated document. + ### Authorization: + This endpoint requires valid user authentication. To access this endpoint, the request must include a valid access token in the _X-Access-Token_ header, otherwise, the API will return a _401 Unauthorized_ status code + operationId: generate + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/ExcerptEventDto' + example: + excerptType: subject-laboratories-accreditation-excerpt + requiresSystemSignature: true + excerptInputData: + subjectId: + required: true + responses: + "200": + description: OK. Excerpt ID successfully generated. + content: + application/json: + schema: + $ref: '#/components/schemas/ExcerptEntityId' + example: + excerptIdentifier: + "400": + description: Bad Request. Invalid excerpt type or incorrect request parameters. + content: + application/json: {} + "401": + description: Unauthorized. Missing or invalid access token or digital signature. + content: + application/json: {} + "500": + description: Internal Server Error. Error occurred during the excerpt generation + process. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + /excerpts/{id}: + get: + tags: + - excerpts-service-api + summary: Retrieve an excerpt file + description: "### Endpoint purpose:\n This endpoint allows users to download\ + \ an excerpt file based on the provided excerpt ID. Returns the excerpt file\ + \ as a downloadable resource.\n ### Authorization:\n This endpoint requires\ + \ valid user authentication. To access this endpoint, the request must include\ + \ a valid access token in the _X-Access-Token_ header, otherwise, the API\ + \ will return a _401 Unauthorized_ status code. \n ### Validation: During\ + \ excerpt creation, the system performs validation of the digital signature\ + \ if enabled, and validation of the template associated with the excerpt type.\ + \ If these validations fail, an exception is thrown. If all input data is\ + \ correct, a new excerpt is created and its ID is returned in the response.\ + \ \n ### Validation: During excerpt creation, the system performs validation\ + \ of the digital signature if enabled, and validation of the template associated\ + \ with the excerpt type. If these validations fail, an exception is thrown.\ + \ If all input data is correct, a new excerpt is created and its ID is returned\ + \ in the response." + operationId: retrieve + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: excerptId + in: path + description: The UUID of the excerpt to retrieve + required: true + schema: + type: string + - name: id + in: path + required: true + schema: + type: string + format: uuid + - name: securityContext + in: query + required: true + schema: + $ref: '#/components/schemas/SecurityContext' + responses: + "200": + description: OK. Excerpt file successfully retrieved. + content: + application/octet-stream: {} + "400": + description: Bad Request. Invalid request parameters or data. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "401": + description: Unauthorized. Missing or invalid access token. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "500": + description: Internal Server Error. Error occurred while retrieving the + excerpt. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + /excerpts/{id}/status: + get: + tags: + - excerpts-service-api + summary: Get the status of an excerpt generation + description: "### Endpoint purpose: \n This endpoint is used for getting the\ + \ status of an excerpt generation based on the provided excerpt ID. Returns\ + \ the status of the generation as a JSON object.\n ### Authorization:\n This\ + \ endpoint requires valid user authentication. To access this endpoint, the\ + \ request must include a valid access token in the _X-Access-Token_ header,\ + \ otherwise, the API will return a _401 Unauthorized_ status code" + operationId: status + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: excerptId + in: path + description: The UUID of the excerpt to retrieve + required: true + schema: + type: string + - name: id + in: path + required: true + schema: + type: string + format: uuid + responses: + "200": + description: OK. Excerpt generation status successfully retrieved. + content: + application/json: + schema: + $ref: '#/components/schemas/StatusDto' + example: + status: FAILED + statusDetails: Technical description of the error + "400": + description: Bad Request. Invalid request parameters or data. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "401": + description: Unauthorized. Missing or invalid access token. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "404": + description: Not Found. No generation status found for the provided excerpt + ID. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "500": + description: Internal Server Error. Error occurred while retrieving the + generation status. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' +components: + schemas: + ExcerptEventDto: + required: + - excerptType + type: object + properties: + recordId: + type: string + format: uuid + excerptType: + type: string + excerptInputData: + type: object + additionalProperties: + type: object + requiresSystemSignature: + type: boolean + ExcerptEntityId: + type: object + properties: + excerptIdentifier: + type: string + format: uuid + DetailedErrorResponse: + type: object + properties: + traceId: + type: string + code: + type: string + details: + type: object + SecurityContext: + type: object + properties: + accessToken: + type: string + digitalSignature: + type: string + digitalSignatureDerived: + type: string + StatusDto: + type: object + properties: + status: + type: string + enum: + - IN_PROGRESS + - FAILED + - COMPLETED + statusDetails: + type: string diff --git a/docs/en/modules/arch/attachments/architecture/platform-api/services/form-schema-provider-swagger.yml b/docs/en/modules/arch/attachments/architecture/platform-api/services/form-schema-provider-swagger.yml new file mode 100644 index 0000000000..d7bd0a30ff --- /dev/null +++ b/docs/en/modules/arch/attachments/architecture/platform-api/services/form-schema-provider-swagger.yml @@ -0,0 +1,224 @@ +openapi: 3.0.3 +info: + title: UI form schemes providing service + description: This document describes REST API of 'UI form schemes providing service' + version: "1.0" +tags: +- name: form-schemes-providing-api + description: UI form schemes providing service +paths: + /api/forms/{key}: + get: + tags: + - form-schemes-providing-api + summary: Download form by key + description: |- + ### Endpoint purpose: + This endpoint allows to download a form. The form is returned as a JSON object. + operationId: getForm + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: key + in: path + description: Form key + required: true + schema: + type: string + responses: + "200": + description: Returns uploaded form metadata + content: + application/json: + schema: + type: string + example: |- + { + "title": "Test Form", + "path": "test-form", + "name": "test-form", + "display": "form", + "components": [ + { + "type": "button", + "label": "Submit", + "key": "submit", + "size": "md", + "..." + } + ], + } + "401": + description: You are not authorized to get the form + content: + application/json: {} + "404": + description: Form Not Found + content: + application/json: {} + "500": + description: Internal server error + content: + application/json: {} + put: + tags: + - form-schemes-providing-api + summary: Update form for business process + description: |- + ### Endpoint purpose: + This endpoint allows to update a form that being used by process instance for get user input data. Input form being validated for DuplicateNames, and required properties fillment, and validation of form schema structure + operationId: updateForm + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: key + in: path + description: Form key + required: true + schema: + type: string + requestBody: + content: + application/json: + schema: + type: string + example: |- + { + "title": "Test Form", + "path": "test-form", + "name": "test-form", + "display": "form", + "components": [ + { + "type": "button", + "label": "Submit", + "key": "submit", + "size": "md", + "..." + } + ], + } + required: true + responses: + "200": + description: Form updated successfully + "400": + description: Bad Request. + content: + application/json: {} + "401": + description: You are not authorized to update the form + content: + application/json: {} + "422": + description: Form scheme is not valid + content: + application/json: {} + "500": + description: Internal server error + content: + application/json: {} + delete: + tags: + - form-schemes-providing-api + summary: Delete form by key + description: |- + ### Endpoint purpose: + This endpoint allows the deletion of a specific form. + operationId: deleteFormByKey + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: key + in: path + description: Form key + required: true + schema: + type: string + responses: + "204": + description: Form deleted successfully + "401": + description: You are not authorized to delete the form + content: + application/json: {} + "403": + description: Forbidden + content: + application/json: {} + "500": + description: Internal server error + content: + application/json: {} + /api/forms: + post: + tags: + - form-schemes-providing-api + summary: Upload form for business process + description: "### Endpoint purpose:\n This endpoint allows to upload a form\ + \ that being used by process instance for get user input data. Input form\ + \ being validated for duplicate names, validation of form schema structure\ + \ and required properties fillment. Example : property `name` is required\ + \ and should be unique for registry " + operationId: saveForm + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + requestBody: + content: + text/plain: + schema: + type: string + example: |- + { + "title": "Test Form", + "path": "test-form", + "name": "test-form", + "display": "form", + "components": [ + { + "type": "button", + "label": "Submit", + "key": "submit", + "size": "md", + "..." + } + ], + } + required: true + responses: + "201": + description: Form saved successfully + "400": + description: Bad Request. + content: + application/json: {} + "401": + description: You are not authorized to add the form + content: + application/json: {} + "422": + description: Form scheme is not valid + content: + application/json: {} + "500": + description: Internal server error + content: + application/json: {} +components: {} diff --git a/docs/en/modules/arch/attachments/architecture/platform-api/services/form-submission-validation-swagger.yml b/docs/en/modules/arch/attachments/architecture/platform-api/services/form-submission-validation-swagger.yml new file mode 100644 index 0000000000..b908f50bed --- /dev/null +++ b/docs/en/modules/arch/attachments/architecture/platform-api/services/form-submission-validation-swagger.yml @@ -0,0 +1,476 @@ +openapi: 3.0.0 +paths: + /api/form-submissions/{formKey}/validate: + post: + operationId: FormSubmissionsController_validate + summary: Validate form data against scheme + description: |- + ### Endpoint purpose: + This endpoint allows you to validate form data against a specified UI-form scheme. It accepts the form key in the URL, user authentication, and the form schema in the request body. + ### Validation: + This endpoint requires a valid _formKey_ in the URL, which is the unique identifier of the UI-form scheme. If the provided form key does not exist, a _404 Not Found_ status code is returned. The endpoint also validates the form data against the specified UI-form scheme. Validation includes checking for required fields and the overall structure of the submitted data. In case of validation errors, the endpoint returns _422 Unprocessable Entity_. The response body includes details about the errors found during validation. + parameters: + - &ref_0 + name: X-Request-Id + in: header + required: false + schema: + type: string + - &ref_1 + name: X-B3-SpanId + in: header + required: false + schema: + type: string + - &ref_2 + name: X-B3-TraceId + in: header + required: false + schema: + type: string + - name: X-Access-Token + required: true + in: header + description: Token used for endpoint security + schema: + type: string + - name: formKey + required: true + in: path + description: Unique identifier of UI-form scheme + examples: + "1": + value: "1" + user: + value: user + admin: + value: admin + edit-personprofile-firstbpmn: + value: edit-personprofile-firstbpmn + edit-personprofile-secondbpmn: + value: edit-personprofile-secondbpmn + add-startform: + value: add-startform + add-lab-file: + value: add-lab-file + sign-lab-file: + value: sign-lab-file + edit-lab-file: + value: edit-lab-file + sign-edited-lab-file: + value: sign-edited-lab-file + mdtuddm-12887: + value: mdtuddm-12887 + mdtuddm-11573: + value: mdtuddm-11573 + mdtuddm-16614-complex-validation: + value: mdtuddm-16614-complex-validation + day-and-datetime: + value: day-and-datetime + test-password: + value: test-password + form-with-all-fields-for-validation: + value: form-with-all-fields-for-validation + auto-form-with-files-upload-validation-soma: + value: auto-form-with-files-upload-validation-soma + submission-conversions-day: + value: submission-conversions-day + submission-conversions-phone: + value: submission-conversions-phone + schema: + type: string + requestBody: + required: true + content: + application/json: + schema: + $ref: "#/components/schemas/FormSchemaDTO" + responses: + "200": + description: OK + "400": + description: Bad request + "401": + description: Authentication error (X-Access-Token missing) + content: + application/json: + schema: + properties: + traceId: + type: string + example: 6bf6c1c1d713ec2f + message: + type: string + "404": + description: Form scheme not found + content: + application/json: + schema: + properties: + traceId: + type: string + example: 6bf6c1c1d713ec2f + message: + type: string + "422": + description: Failed form data validation against UI-form scheme + content: + application/json: + schema: + properties: + traceId: + type: string + example: 6bf6c1c1d713ec2f + code: + type: string + example: VALIDATION_ERROR + details: + type: object + properties: + errors: + type: array + items: + properties: + value: + type: string + example: '"null"' + field: + type: string + example: entities + message: + type: string + example: must not be null + example: + - value: "null" + field: entities + message: must not be null + "500": + description: Internal server error + content: + application/json: + schema: + properties: + traceId: + type: string + example: 6bf6c1c1d713ec2f + message: + type: string + tags: &ref_3 + - Form submission validation + /api/form-submissions/{formKey}/fields/{fieldKey}/validate: + post: + operationId: FormSubmissionsController_validateField + summary: Validate form file field value + description: |- + ### Endpoint purpose: + This endpoint allows to validate a specific file field against a UI form schema. + ### Validation: + This endpoint provides validation of file field by size, content type and validation for existance in form scheme. + parameters: + - *ref_0 + - *ref_1 + - *ref_2 + - name: X-Access-Token + required: true + in: header + description: Token used for endpoint security + schema: + type: string + - name: formKey + required: true + in: path + description: Unique identifier of UI-form scheme + examples: + "1": + value: "1" + user: + value: user + admin: + value: admin + edit-personprofile-firstbpmn: + value: edit-personprofile-firstbpmn + edit-personprofile-secondbpmn: + value: edit-personprofile-secondbpmn + add-startform: + value: add-startform + add-lab-file: + value: add-lab-file + sign-lab-file: + value: sign-lab-file + edit-lab-file: + value: edit-lab-file + sign-edited-lab-file: + value: sign-edited-lab-file + mdtuddm-12887: + value: mdtuddm-12887 + mdtuddm-11573: + value: mdtuddm-11573 + mdtuddm-16614-complex-validation: + value: mdtuddm-16614-complex-validation + day-and-datetime: + value: day-and-datetime + test-password: + value: test-password + form-with-all-fields-for-validation: + value: form-with-all-fields-for-validation + auto-form-with-files-upload-validation-soma: + value: auto-form-with-files-upload-validation-soma + submission-conversions-day: + value: submission-conversions-day + submission-conversions-phone: + value: submission-conversions-phone + schema: + type: string + - name: fieldKey + required: true + in: path + description: Unique identifier of field within UI-form + schema: + type: string + requestBody: + required: true + content: + application/json: + schema: + $ref: "#/components/schemas/FormFieldValidationDTO" + responses: + "200": + description: OK with return result + content: + application/json: + schema: + properties: + isValid: + type: boolean + example: true + "400": + description: Bad request + "401": + description: Authentication error (X-Access-Token missing) + content: + application/json: + schema: + properties: + traceId: + type: string + example: 6bf6c1c1d713ec2f + message: + type: string + "404": + description: Form scheme not found by provided {form-key} + content: + application/json: + schema: + properties: + traceId: + type: string + example: 6bf6c1c1d713ec2f + message: + type: string + "422": + description: Failed form data validation against UI-form scheme + content: + application/json: + schema: + properties: + traceId: + type: string + example: 6bf6c1c1d713ec2f + code: + type: string + example: VALIDATION_ERROR + details: + type: object + properties: + errors: + type: array + items: + properties: + field: + type: string + example: entities + message: + type: string + example: must not be null + example: + - field: entities + message: must not be null + "500": + description: Internal server error + content: + application/json: + schema: + properties: + traceId: + type: string + example: 6bf6c1c1d713ec2f + message: + type: string + "501": + description: Not Implemented + tags: *ref_3 + /api/form-submissions/{formKey}/fields/check: + post: + operationId: FormSubmissionsController_checkFields + summary: Check form fields for existance + description: |- + ### Endpoint purpose: + This endpoint allows to check list of form firlds for existance. + ### Validation: + Endpoint retrieves form scheme by _formKey_ and checks for existance provided fields in request body, returns _422_ status code if no such fields. + parameters: + - *ref_0 + - *ref_1 + - *ref_2 + - name: X-Access-Token + required: true + in: header + description: Token used for endpoint security + schema: + type: string + - name: formKey + required: true + in: path + description: Unique identifier of UI-form scheme + examples: + "1": + value: "1" + user: + value: user + admin: + value: admin + edit-personprofile-firstbpmn: + value: edit-personprofile-firstbpmn + edit-personprofile-secondbpmn: + value: edit-personprofile-secondbpmn + add-startform: + value: add-startform + add-lab-file: + value: add-lab-file + sign-lab-file: + value: sign-lab-file + edit-lab-file: + value: edit-lab-file + sign-edited-lab-file: + value: sign-edited-lab-file + mdtuddm-12887: + value: mdtuddm-12887 + mdtuddm-11573: + value: mdtuddm-11573 + mdtuddm-16614-complex-validation: + value: mdtuddm-16614-complex-validation + day-and-datetime: + value: day-and-datetime + test-password: + value: test-password + form-with-all-fields-for-validation: + value: form-with-all-fields-for-validation + auto-form-with-files-upload-validation-soma: + value: auto-form-with-files-upload-validation-soma + submission-conversions-day: + value: submission-conversions-day + submission-conversions-phone: + value: submission-conversions-phone + schema: + type: string + requestBody: + required: true + content: + application/json: + schema: + $ref: "#/components/schemas/FormFieldsCheckDTO" + responses: + "200": + description: OK with reurn result + content: + application/json: + schema: + properties: + code: + type: number + example: 200 + fields: + type: object + example: + name: true + email: true + "422": + description: Failed form data validation against UI-form scheme + content: + application/json: + schema: + properties: + traceId: + type: string + example: 6bf6c1c1d713ec2f + code: + type: string + example: VALIDATION_ERROR + details: + type: object + properties: + errors: + type: array + items: + properties: + field: + type: string + example: entities + message: + type: string + example: must not be null + example: + - field: entities + message: must not be null + tags: *ref_3 +info: + title: Form submission validation API + description: "" + version: "1.0" + contact: {} +tags: [] +servers: [] +components: + schemas: + FormSchemaDTO: + type: object + properties: + data: + type: object + example: + formField1: value1 + formField2: value2 + processInstanceId: + type: string + example: d5a40376-6360-11ee-88e8-0a580a81041b + required: + - data + FormFieldValidationDTO: + type: object + properties: + fileName: + type: string + example: file.csv + contentType: + type: string + example: text/csv + size: + type: number + example: 10 + required: + - fileName + - contentType + - size + FormFieldsCheckDTO: + type: object + properties: + fields: + description: List of form fields for verification + example: + - name + - email + type: array + items: + type: string + required: + - fields diff --git a/docs/en/modules/arch/attachments/architecture/platform-api/services/keycloak-rest-api-ext-swagger.yml b/docs/en/modules/arch/attachments/architecture/platform-api/services/keycloak-rest-api-ext-swagger.yml new file mode 100644 index 0000000000..206577864d --- /dev/null +++ b/docs/en/modules/arch/attachments/architecture/platform-api/services/keycloak-rest-api-ext-swagger.yml @@ -0,0 +1,293 @@ +openapi: 3.0.3 +info: + title: Keycloak rest api extension API + description: This document describes Rest API of 'Keycloak rest api extension' + version: "1.0" +tags: + - name: keycloak-rest-api-extension-api + description: Keycloak rest api extension API + - name: keycloak-rest-api-extension-api-v2 + description: Keycloak rest api extension API v2 +paths: + /admin/search/{realm}: + post: + tags: + - keycloak-rest-api-extension-api + summary: Search users by attributes + operationId: searchUsersByAttribute + parameters: + - in: path + name: realm + required: true + schema: + type: string + requestBody: + required: true + content: + application/json: + schema: + $ref: '#/components/schemas/SearchUserRequestDto' + deprecated: true + responses: + '200': + description: Successful response + content: + application/json: + schema: + $ref: '#/components/schemas/UserRepresentation' + + /admin/search-by-attributes/{realm}: + post: + tags: + - keycloak-rest-api-extension-api + summary: Search users by attributes + operationId: searchUsersByAttributesDeprecated + parameters: + - in: path + name: realm + required: true + schema: + type: string + requestBody: + required: true + content: + application/json: + schema: + $ref: '#/components/schemas/SearchUsersByEqualsAndStartsWithAttributesRequestDto' + deprecated: true + responses: + '200': + description: Successful response + content: + application/json: + schema: + $ref: '#/components/schemas/UserRepresentation' + + /admin/v2/search-by-attributes/{realm}: + post: + tags: + - keycloak-rest-api-extension-api-v2 + summary: Search users by attributes (v2) + description: |- + ### Endpoint purpose: + This endpoint allows to search users by attributes. Pagination implemented with using of _imit_ as a page size and _continueToken_. Any response will provide a continue token that must be used for the next page. Returns -1 on the last page. If -1 was passed to a request as continue token it will return empty list of users with _continueToken=-1_. If 0 or _null_ was passed as continue token it will return first page. If 0 or _null_ was passed as _limit_ then pagination is disabled and request will return all found users. + operationId: searchUsersByAttributesV2 + parameters: + - name: X-Access-Token + required: true + in: header + description: Token used for endpoint security + schema: + type: string + - in: path + name: realm + required: true + schema: + type: string + requestBody: + required: true + description: attributesEquals - contains a map of attributes that user must have with exact match to be returned, attributesStartsWith - contains a map of attributes that user must have with starts with match to be returned, attributesThatAreStartFor - contains a map of attributes that user must have a start for to be returned. + content: + application/json: + schema: + $ref: '#/components/schemas/SearchUsersByAttributesRequestDto' + example: + attributesEquals: + attribute1: + - value1 + - value2 + attributesStartsWith: + hierarchyCode: + - "100" + - "101.201" + attributesThatAreStartFor: + hierarchyCode: + - "100.200.300" + - "101" + responses: + '200': + description: Successful response + content: + application/json: + schema: + $ref: '#/components/schemas/SearchUsersByAttributesResponseDto' + example: + users: + - attributes: + attribute1: value1 + hierarchyCode: "100" + email: user@email.com + firstName: John + lastName: Doe + - attributes: + attribute1: value2 + hierarchyCode: "101.200" + email: user2@email.com + firstName: Steve + lastName: Doe + '401': + description: Unauthorized. Missing auth token or wrong _realm_ in token + content: + application/json: {} + '403': + description: Forbidden users search request for specified realm + content: + application/json: {} + '404': + description: Can happen when could not find client for authorization + content: + application/json: {} + +components: + schemas: + SearchUserRequestDto: + type: object + properties: + attributes: + type: object + additionalProperties: + type: string + + SearchUsersByEqualsAndStartsWithAttributesRequestDto: + type: object + properties: + attributesEquals: + type: object + additionalProperties: + type: string + attributesStartsWith: + type: object + additionalProperties: + type: array + items: + type: string + + SearchUsersByAttributesRequestDto: + type: object + properties: + attributesEquals: + type: object + additionalProperties: + type: array + items: + type: string + attributesStartsWith: + type: object + additionalProperties: + type: array + items: + type: string + attributesThatAreStartFor: + type: object + additionalProperties: + type: array + items: + type: string + pagination: + type: object + properties: + limit: + type: integer + continueToken: + type: integer + + SearchUsersByAttributesResponseDto: + type: object + properties: + users: + type: array + items: + $ref: '#/components/schemas/UserRepresentation' + pagination: + type: object + properties: + limit: + type: integer + continueToken: + type: integer + + UserRepresentation: + type: object + properties: + self: + type: string + id: + type: string + createdTimestamp: + type: integer + firstName: + type: string + lastName: + type: string + email: + type: string + username: + type: string + enabled: + type: boolean + totp: + type: boolean + emailVerified: + type: boolean + attributes: + type: object + additionalProperties: + type: array + items: + type: string + credentials: + type: array + items: + type: object + requiredActions: + type: array + items: + type: string + federatedIdentities: + type: array + items: + type: object + socialLinks: + type: array + items: + type: object + realmRoles: + type: array + items: + type: string + clientRoles: + type: object + additionalProperties: + type: array + items: + type: string + clientConsents: + type: array + items: + type: object + notBefore: + type: integer + applicationRoles: + type: object + additionalProperties: + type: array + items: + type: string + federationLink: + type: string + serviceAccountClientId: + type: string + groups: + type: array + items: + type: string + origin: + type: string + disableableCredentialTypes: + type: array + items: + type: string + access: + type: object + additionalProperties: + type: boolean \ No newline at end of file diff --git a/docs/en/modules/arch/attachments/architecture/platform-api/services/platform-gateway-swagger.yml b/docs/en/modules/arch/attachments/architecture/platform-api/services/platform-gateway-swagger.yml new file mode 100644 index 0000000000..12b1291b12 --- /dev/null +++ b/docs/en/modules/arch/attachments/architecture/platform-api/services/platform-gateway-swagger.yml @@ -0,0 +1,78 @@ +openapi: 3.0.1 +info: + title: Platform-gateway rest API + description: This document describes Rest API of 'Platform-gateway' + version: "1.0" +tags: + - name: platform-gateway-rest-api + description: Platform gateway rest API +paths: + /data-factory/{registry}/**: + get: + tags: + - platform-gateway-rest-api + summary: Access data from the data factory service + description: |- + ### Endpoint purpose: + Retrieves authentication information from Vault, obtains a token from Keycloak based on this authentication information, replaces the existing token in the request header with the new token, passes the request further down the filter chain for processing.. + parameters: + - in: path + name: registry + required: true + schema: + type: string + responses: + '200': + description: Successful response + '404': + description: Resource not found + '500': + description: Internal server error + + /bp-gateway/{registry}/**: + post: + tags: + - platform-gateway-rest-api + summary: Send data to the bp-gateway service + description: |- + ### Endpoint purpose: + The purpose of this filter is to dynamically adjust the URL routing based on the target registry extracted from the request. It enables routing to different destinations or services in a Kubernetes environment by manipulating the route information in the request. + parameters: + - in: path + name: registry + required: true + schema: + type: string + requestBody: + required: true + content: + application/json: + schema: + type: object + properties: + data: + type: string + description: Data to be sent to bp-gateway + responses: + '200': + description: Successful response + '400': + description: Bad request + '500': + description: Internal server error + + /api/public/data-factory/**: + get: + tags: + - platform-gateway-rest-api + summary: Access public data from the data factory service + description: |- + ### Endpoint purpose: + This filter is responsible for adding basic authentication headers to incoming requests based on the configuration provided in the basic authentication (based on login/password). It's used to protect certain routes or resources by ensuring that the client provides valid basic authentication credentials.. + responses: + '200': + description: Successful response + '404': + description: Resource not found + '500': + description: Internal server error \ No newline at end of file diff --git a/docs/en/modules/arch/attachments/architecture/platform-api/services/process-history-service-api-swagger.yml b/docs/en/modules/arch/attachments/architecture/platform-api/services/process-history-service-api-swagger.yml new file mode 100644 index 0000000000..75fdc3d9a5 --- /dev/null +++ b/docs/en/modules/arch/attachments/architecture/platform-api/services/process-history-service-api-swagger.yml @@ -0,0 +1,347 @@ +openapi: 3.0.3 +info: + title: Business processes history service + description: This document describes REST API of 'Business processes history service' + version: "1.0" +tags: +- name: process-history-service-api + description: Business processes history management Rest API +- name: process-history-service-runtime-api + description: Business processes history management at runtime Rest API +paths: + /api/runtime/process-instances: + get: + tags: + - process-history-service-runtime-api + summary: Get a list of historical data of processes in an unfinished state + description: "### Endpoint assignment: \n This endpoint is used to retrieve\ + \ a list of historical data of processes that are in an incomplete state based\ + \ on specified filtering criteria, including offset, constraint, and sorting\ + \ parameters. Incomplete processes are defined as processes that are currently\ + \ running and have not yet been completed." + operationId: getProcesses + parameters: + - name: X-Access-Token + in: header + description: User access token + schema: + type: string + - name: offset + in: query + description: Record offset + required: true + schema: + type: integer + default: 0 + - name: limit + in: query + description: Maximum number of records to return + required: true + schema: + type: integer + default: 10 + - name: sort + in: query + description: "Field and order for sorting the records. Example: asc()\ + \ / desc()" + required: true + schema: + type: string + default: desc(endTime) + - name: securityContext + in: query + required: true + schema: + $ref: '#/components/schemas/SecurityContext' + responses: + "200": + description: OK. List of historical process data successfully retrieved. + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/ProcessResponse' + example: + - processInstanceId: "1234" + superProcessInstanceId: "5678" + processDefinitionId: "91011" + processDefinitionKey: myProcess + processDefinitionName: My Process + businessKey: 1234-5678 + startTime: 2021-01-01T00:00:00Z + startUserId: john.doe + status: + code: InProgress + title: In Progress + "400": + description: Bad Request. Invalid excerpt type or incorrect request parameters. + content: + application/json: {} + "401": + description: Unauthorized. Missing or invalid access token or digital signature. + content: + application/json: {} + "500": + description: Internal Server Error. Server error while processing the request. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + /api/runtime/process-instances/count: + get: + tags: + - process-history-service-runtime-api + summary: Get the count of unfinished process instances + description: Returns a count of unfinished process instances based on specified + filtering criteria. Unfinished processes refer to those processes that are + currently executing and have not yet completed. + operationId: count + parameters: + - name: X-Access-Token + in: header + description: User access token + schema: + type: string + - name: securityContext + in: query + required: true + schema: + $ref: '#/components/schemas/SecurityContext' + responses: + "200": + description: OK. Count of unfinished process instances successfully retrieved. + content: + application/json: + schema: + type: integer + example: + count: 10 + "400": + description: Bad Request. Invalid request parameters. + content: + application/json: {} + "401": + description: Unauthorized. Missing or invalid access token or digital signature. + content: + application/json: {} + "500": + description: Internal Server Error. Server error while processing the request. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + /api/history/tasks: + get: + tags: + - process-history-service-api + summary: Get a list of historical data of tasks + description: "### Endpoint assignment: \n This endpoint is used to retrieve\ + \ a list of historical data of tasks based on specified filtering criteria,\ + \ including offset, constraint, and sorting parameters." + operationId: getTasks + parameters: + - name: X-Access-Token + in: header + description: User access token + schema: + type: string + - name: offset + in: query + description: Record offset + required: true + schema: + type: integer + default: 0 + - name: limit + in: query + description: Maximum number of records to return + required: true + schema: + type: integer + default: 10 + - name: sort + in: query + description: "Field and order for sorting the records. Example: asc()\ + \ / desc()" + required: true + schema: + type: string + default: desc(endTime) + - name: securityContext + in: query + required: true + schema: + $ref: '#/components/schemas/SecurityContext' + responses: + "200": + description: OK. List of historical tasks data successfully retrieved. + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/ProcessResponse' + example: + - activityInstanceId: "10001" + taskDefinitionKey: task1 + taskDefinitionName: First task + processInstanceId: "1234" + processDefinitionId: "91011" + processDefinitionKey: myProcess + processDefinitionName: My Process + startTime: 2021-04-01T09:00:00Z + endTime: 2021-04-01T12:00:00Z + assignee: john.doe + "400": + description: Bad Request. Invalid excerpt type or incorrect request parameters. + content: + application/json: {} + "401": + description: Unauthorized. Missing or invalid access token or digital signature. + content: + application/json: {} + "500": + description: Internal Server Error. Server error while processing the request. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + /api/history/process-instances: + get: + tags: + - process-history-service-api + summary: Get a list of historical data of processes + description: "### Endpoint assignment: \n This endpoint is used to retrieve\ + \ a list of historical data of processes based on specified filtering criteria,\ + \ including offset, constraint, and sorting parameters." + operationId: getProcesses_1 + parameters: + - name: X-Access-Token + in: header + description: User access token + schema: + type: string + - name: offset + in: query + description: Record offset + required: true + schema: + type: integer + default: 0 + - name: limit + in: query + description: Maximum number of records to return + required: true + schema: + type: integer + default: 10 + - name: sort + in: query + description: "Field and order for sorting the records. Example: asc()\ + \ / desc()" + required: true + schema: + type: string + default: desc(endTime) + - name: securityContext + in: query + required: true + schema: + $ref: '#/components/schemas/SecurityContext' + responses: + "200": + description: OK. List of historical process data successfully retrieved. + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/ProcessResponse' + example: + - processInstanceId: "1234" + superProcessInstanceId: "5678" + processDefinitionId: "91011" + processDefinitionKey: myProcess + processDefinitionName: My Process + businessKey: 1234-5678 + startTime: 2021-01-01T00:00:00Z + endTime: 2021-01-01T00:01:00Z + startUserId: john.doe + excerptId: "4321" + status: + code: COMPLETED + title: COMPLETED + "400": + description: Bad Request. Invalid excerpt type or incorrect request parameters. + content: + application/json: {} + "401": + description: Unauthorized. Missing or invalid access token or digital signature. + content: + application/json: {} + "500": + description: Internal Server Error. Server error while processing the request. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' +components: + schemas: + ProcessResponse: + type: object + properties: + processInstanceId: + type: string + superProcessInstanceId: + type: string + processDefinitionId: + type: string + processDefinitionKey: + type: string + processDefinitionName: + type: string + businessKey: + type: string + startTime: + type: string + format: date-time + startUserId: + type: string + status: + $ref: '#/components/schemas/StatusModel' + StatusModel: + type: object + properties: + code: + type: string + enum: + - ACTIVE + - PENDING + - SUSPENDED + - COMPLETED + - EXTERNALLY_TERMINATED + title: + type: string + DetailedErrorResponse: + type: object + properties: + traceId: + type: string + code: + type: string + details: + type: object + SecurityContext: + type: object + properties: + accessToken: + type: string + digitalSignature: + type: string + digitalSignatureDerived: + type: string + digitalSignatureChecksum: + type: string + digitalSignatureDerivedChecksum: + type: string diff --git a/docs/en/modules/arch/attachments/architecture/platform-api/services/registry-regulation-management-swagger.yml b/docs/en/modules/arch/attachments/architecture/platform-api/services/registry-regulation-management-swagger.yml new file mode 100644 index 0000000000..7a4debeb3c --- /dev/null +++ b/docs/en/modules/arch/attachments/architecture/platform-api/services/registry-regulation-management-swagger.yml @@ -0,0 +1,3874 @@ +openapi: 3.0.3 +info: + title: Registry regulations management + description: This document describes REST API of 'Registry regulations admin-portal' + version: "1.0" +tags: +- name: candidate-version-business-processes-api + description: Registry regulations version-candidate Business processes management + Rest API +- name: candidate-version-tables-api + description: Registry regulations version-candidate tables management Rest API +- name: candidate-version-api + description: Registry regulations version-candidate management Rest API +- name: master-version-api + description: Registry regulations master version management Rest API +- name: master-version-data-model-tables-api + description: Registry regulations master version data-model tables file management + Rest API +- name: master-version-tables-api + description: Registry regulations master version tables management Rest API +- name: candidate-version-business-process-groups-api + description: Registry regulations candidate version Groups management Rest API +- name: candidate-version-settings-api + description: Registry regulations version candidates settings Rest API +- name: candidate-version-data-model-tables-api + description: Registry regulations version-candidate data-model tables file management + Rest API +- name: master-version-settings-api + description: Registry regulations Master version settings Rest API +- name: users-batch-loads-api + description: Users bulk upload RestAPI +- name: master-version-forms-api + description: Registry regulations Master version Forms management Rest API +- name: candidate-version-forms-api + description: Registry regulations version-candidate Forms management Rest API +- name: master-version-business-process-groups-api + description: Registry regulations Master version Groups management Rest API +- name: master-version-business-processes-api + description: Registry regulations master Business processes management Rest API +paths: + /versions/master/forms/{formName}: + get: + tags: + - master-version-forms-api + summary: Get specific form full details + description: | + ### Endpoint purpose: + This endpoint is used for retrieving a JSON representation of a user __form__ directly from the __master__ version. This operation retrieves a single _form_ based on the specified __formName__. If you need to retrieve list of _forms_, you can use the [GET](#master-version-forms-api/getFormsFromMaster) endpoint. + operationId: getForm + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: formName + in: path + description: Form name + required: true + schema: + type: string + responses: + "200": + description: Form successfully retrieved. + content: + application/json: + example: |- + { + "display": "form", + "components": [], + "path": "my-awesome-form", + "name": "my-awesome-form", + "title": "Form human-readable title", + } + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden + content: + application/json: {} + "404": + description: Not Found + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "500": + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + put: + tags: + - master-version-forms-api + summary: Update existing form within master version. + description: "### Endpoint purpose: \n This endpoint is used for updating a\ + \ json representation of a user __form__ directly in __master__ version. Just\ + \ as if _version-candidate_ was created, the _form_ was updated in that _version-candidate_\ + \ and then the _version-candidate_ was submitted. It can be used if there\ + \ is needed to update __a single form__. If you need to make some changes\ + \ in several _forms_ and/or _business-processes_ at one time, it's still preferred\ + \ to make this changes through a _version-candidate_. \n ### Conflict resolving:\n\ + \ In this endpoint [Conditional requests](https://datatracker.ietf.org/doc/html/rfc9110#name-conditional-requests)\ + \ are supported. You can use an __ETag__ header value, that can be previously\ + \ obtained in [GET](#master-version-forms-api/getForm) request, as a value\ + \ for __If-Match__ header so you can be sure that you're updating the last\ + \ version of a _form_. But if your __If-Match__ value is differs from the\ + \ servers you will receive a _409 Conflict_ instead of _412 Precondition Failed_.\ + \ For _registry-regulation-management_ service this situation's considered\ + \ as a conflict. If __If-Match__ is not present then conflict checking won't\ + \ be performed.\n### Form validation: \nBefore saving the content to the storage,\ + \ the __validation__ of a _form_ is executed. The _form_ must be a __json__\ + \ document and must have a non-empty __\"title\"__ field. Also the field __\"\ + name\"__ must be present and equal to __\"path\"__ field, that must be present\ + \ too. Also _both_ this values must be equal to __\"formName\"__ pathVariable.\ + \ In other case the _form_ won't be working as expected. Changing __\"name\"\ + __ or __\"path\"__ is not supported. If you need to change these fields then\ + \ you need to copy the _form_ with new name and delete the previous _form_.\ + \ \n ### Missing form handling: \n If the updated _form_ is missing and the\ + \ _If-Match_ header is not present (or equal to __\"*\"__) then the _form_\ + \ will be __created__ instead.\n ### Created and modified dates handling:\n\ + \ If there any of __\"created\"__ or __\"modified\"__ fields present in the\ + \ request body they will be ignored. Value for the __\"created\"__ field is\ + \ automatically getting from the previous _form_ content (if present, in other\ + \ case it's getting from the git log). And for the __\"updated\"__ value the\ + \ current servers datetime in UTC is set." + operationId: updateForm + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: If-Match + in: header + description: ETag to verify whether user has latest data + schema: + type: string + - name: formName + in: path + description: Name of the form to be updated + required: true + schema: + type: string + requestBody: + content: + application/json: + schema: + type: string + example: + display: form + components: [] + path: my-awesome-form + name: my-awesome-form + title: Form human-readable title + required: true + responses: + "200": + description: Form successfully updated. + headers: + ETag: + description: New ETag value for conflict verification + style: simple + schema: + type: string + content: + application/json: + example: + display: form + components: [] + path: my-awesome-form + name: my-awesome-form + title: Form human-readable title + created: 2023-03-28T09:18:41.941Z + modified: 2023-03-29T09:58:44.100Z + "400": + description: Request body is not a valid json + "401": + description: Unauthorized + "403": + description: Forbidden + "409": + description: Conflict. __If-Match__ input value doesn't equal to servers + value. It means that form already has been updated/deleted after user + obtained __ETag__. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "422": + description: Unprocessable Entity. User form is not valid. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "500": + description: Internal server error. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + post: + tags: + - master-version-forms-api + summary: Create new form within master + description: "### Endpoint purpose: \n This endpoint is used for creating a\ + \ JSON representation of a user __form__ directly in the __master__ version.\ + \ It is intended for situations that require the creation of a new _form_.\ + \ This operation creates a single _form_ and should be used when multiple\ + \ _forms_ and/or _business-processes_ do not need to be created or modified\ + \ simultaneously. If you need to create or modify several _forms_ and/or _business-processes_\ + \ at once, it is still recommended to use a _version-candidate_. \n ### Form\ + \ validation: \nBefore saving the new _form_ to the storage, the server validates\ + \ the _form_. The _form_ must be a __json__ document and must have a non-empty\ + \ __\"title\"__ field. Also the field __\"name\"__ must be present and equal\ + \ to __\"path\"__ field, that must be present too. Also _both_ this values\ + \ must be equal to __\"formName\"__ pathVariable. In other case the _form_\ + \ won't be working as expected. \n ### Missing form handling: \n If the specified\ + \ _form_ does not already exist, the server will create a new _form_ with\ + \ the provided data. If the _form_ does exists, the server will return a _409\ + \ Conflict_ error indicating that the _form_ already exists.\n ### Created\ + \ and modified dates handling:\n If there any of __\"created\"__ or __\"modified\"\ + __ fields present in the request body they will be ignored. The __\"created\"\ + __ and __\"updated\"__ fields are automatically set to the current server\ + \ time in UTC." + operationId: formCreate + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: formName + in: path + description: Name of the new form to be created + required: true + schema: + type: string + requestBody: + content: + application/json: + schema: + type: string + example: + display: form + components: [] + path: my-awesome-form + name: my-awesome-form + title: Form human-readable title + required: true + responses: + "201": + description: Form successfully created + headers: + ETag: + description: New ETag value for conflict verification + style: simple + schema: + type: string + content: + application/json: + example: + display: form + components: [] + path: my-awesome-form + name: my-awesome-form + title: Form human-readable title + created: 2023-03-28T09:18:41.941Z + modified: 2023-03-28T09:18:41.941Z + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden + content: + application/json: {} + "409": + description: Conflict. It means that form already has been created. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "422": + description: Unprocessable Entity. User form is not valid. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "500": + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + delete: + tags: + - master-version-forms-api + summary: Delete existing form within master + description: |- + ### Endpoint purpose: + This endpoint is used for deleting a JSON representation of a user __form__ directly from the __master__ version. + ### Conflict resolving: + In this endpoint, [Conditional requests](https://datatracker.ietf.org/doc/html/rfc9110#name-conditional-requests) are supported. You can use an __ETag__ header value, which can be previously obtained in a [GET](#master-version-forms-api/getForm) request, as a value for the __If-Match__ header. This ensures that you're deleting the latest version of the _form_. However, if your __If-Match__ value differs from the server's value, you will receive _409 Conflict_ instead of _412 Precondition Failed_. For the _registry-regulation-management_ service, this situation is considered a conflict. If the __If-Match__ header is not present, conflict checking will not be performed. + ### Missing form handling: + If the specified _form_ is missing and the _If-Match_ header is not present (or equal to __"*"__), the server will return a 404 Not Found error indicating that the specified _form_ does not exist. + operationId: deleteForm + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: If-Match + in: header + description: ETag to verify whether user has latest data + schema: + type: string + - name: formName + in: path + description: Name of the form to be deleted + required: true + schema: + type: string + responses: + "204": + description: No Content. Form successfully deleted. + content: + application/json: {} + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden + content: + application/json: {} + "404": + description: Not Found + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "409": + description: Conflict. __If-Match__ input value doesn't equal to servers + value. It means that form already has been updated/deleted after user + obtained __ETag__. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "500": + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + /versions/master/business-processes/{businessProcessName}: + get: + tags: + - master-version-business-processes-api + summary: Get specific business process full details + description: | + ### Endpoint purpose: + This endpoint is used for retrieving a XML representation of a user __business-process__ directly from the __master__ version. This operation retrieves a single _business-process_ based on the specified __businessProcessName__ with full details in _XML_ format. If you need to retrieve list of _business-processes_ with brief information and in _json_ format, you can use the [GET](#master-version-business-processes-api/getBusinessProcessesFromMaster). + operationId: getBusinessProcess + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: businessProcessName + in: path + description: Process name + required: true + schema: + type: string + responses: + "200": + description: OK. Business process successfully retrieved. + content: + text/plain: + example: |- + + + + + + + + + + + + + + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden + content: + application/json: {} + "404": + description: Not Found + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "500": + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + put: + tags: + - master-version-business-processes-api + summary: Update business process within master version. + description: "### Endpoint purpose: \n This endpoint is used for updating a\ + \ xml representation of a user __business process__ directly in __master__\ + \ version. Just as if _version-candidate_ was created, the _business process_\ + \ was updated in that _version-candidate_ and then the _version-candidate_\ + \ was submitted. It can be used if there is needed to update __a single business\ + \ process__. If you need to make some changes in several _business processes_\ + \ at one time, it's still preferred to make this changes through a _version-candidate_.\ + \ \n ### Conflict resolving:\n In this endpoint [Conditional requests](https://datatracker.ietf.org/doc/html/rfc9110#name-conditional-requests)\ + \ are supported. You can use an __ETag__ header value, that can be previously\ + \ obtained in [GET](#master-version-business-processes-api/getBusinessProcess)\ + \ request, as a value for __If-Match__ header so you can be sure that you're\ + \ updating the last version of a _business-process_. But if your __If-Match__\ + \ value is differs from the servers you will receive a _409 Conflict_ instead\ + \ of _412 Precondition Failed_. For _registry-regulation-management_ service\ + \ this situation's considered as a conflict. If __If-Match__ is not present\ + \ then conflict checking won't be performed.\n### Business process validation:\ + \ \nBefore saving the content to the storage, the __validation__ of a _business-process_\ + \ is executed. The _business-process_ must be a __xml__ document, must conform\ + \ to the BPMN20.xsd schema (available at https://github.com/bpmn-io/bpmn-moddle/blob/master/resources/bpmn/xsd/BPMN20.xsd)\ + \ and must have a non-empty __\"name\"__ field (attribute as part of tCallableElement).\ + \ Also _name_ values must be equal to __\"businessProcessName\"__ pathVariable.\ + \ In other case the _business-process_ won't be working as expected. Changing\ + \ __\"name\"__ is not supported. If you need to change this field then you\ + \ need to copy the _business-process_ with new name and delete the previous\ + \ _business-process_. \n ### Missing business process handling: \n If the\ + \ updated _business-process_ is missing and the _If-Match_ header is not present\ + \ (or equal to __\"*\"__) then the _business-process_ will be __created__\ + \ instead." + operationId: updateBusinessProcess + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: If-Match + in: header + description: ETag to verify whether user has latest data + schema: + type: string + - name: businessProcessName + in: path + description: Process name + required: true + schema: + type: string + requestBody: + content: + text/plain: + schema: + type: string + example: |- + + + + + + + + + + + + + + required: true + responses: + "200": + description: OK. Business process successfully updated. + content: + text/plain: + example: |- + + + + + + + + + + + + + + + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden + content: + application/json: {} + "409": + description: Conflict. __If-Match__ input value doesn't equal to servers + value. It means that business process already has been updated/deleted + after user obtained __ETag__. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "422": + description: Unprocessable Entity. User business process is not valid. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "500": + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + post: + tags: + - master-version-business-processes-api + summary: Create new business process + description: "### Endpoint purpose: \n This endpoint is used for creating a\ + \ xml representation of a user __business process__ directly in __master__\ + \ version. Just as if _version-candidate_ was created, the _business process_\ + \ was created in that _version-candidate_ and then the _version-candidate_\ + \ was submitted. It can be used if there is needed to create __a single business\ + \ process__. If you need to create several _business processes_ at one time,\ + \ it's still preferred to make this changes through a _version-candidate_.\ + \ \n ### Business process validation: \nBefore saving the content to the storage,\ + \ the __validation__ of a _business-process_ is executed. The _business-process_\ + \ must be a __xml__ document, must conform to the BPMN20.xsd schema (available\ + \ at https://github.com/bpmn-io/bpmn-moddle/blob/master/resources/bpmn/xsd/BPMN20.xsd)\ + \ and must have a non-empty __\"name\"__ field (attribute as part of tCallableElement).\ + \ Also _name_ values must be equal to __\"businessProcessName\"__ pathVariable.\ + \ In other case the _business-process_ won't be working as expected. \n###\ + \ Missing business process handling: \n If the specified _business-process_\ + \ does not already exist, the server will create a new _business-process_\ + \ with the provided data. Otherwise, the server will return a _409 Conflict_\ + \ error indicating that the _business-process_ already exists." + operationId: createBusinessProcess + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: businessProcessName + in: path + description: Name of the new process to be created + required: true + schema: + type: string + requestBody: + content: + text/plain: + schema: + type: string + example: |- + + + + + + + + + + + + + + required: true + responses: + "201": + description: Business process successfully created. + content: + text/plain: + example: |- + + + + + + + + + + + + + + + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden + content: + application/json: {} + "409": + description: Conflict. It means that business process already has been created. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "422": + description: Unprocessable Entity. User business process is not valid. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "500": + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + delete: + tags: + - master-version-business-processes-api + summary: Delete existing business process + description: |- + ### Endpoint purpose: + This endpoint is used for deleting a user __business-process__ directly from the __master__ version. + ### Conflict resolving: + In this endpoint, [Conditional requests](https://datatracker.ietf.org/doc/html/rfc9110#name-conditional-requests) are supported. You can use an __ETag__ header value, which can be previously obtained in a [GET](#master-version-business-processes-api/getBusinessProcess) request, as a value for the __If-Match__ header. This ensures that you're deleting the latest version of the _business process_. However, if your __If-Match__ value differs from the server's value, you will receive _409 Conflict_ instead of _412 Precondition Failed_. For the _registry-regulation-management_ service, this situation is considered a conflict. If the __If-Match__ header is not present, conflict checking will not be performed. + ### Missing business process handling: + If the specified _business process_ is missing and the _If-Match_ header is not present (or equal to __"*"__), the server will return a 404 Not Found error indicating that the specified _business process_ does not exist. + operationId: deleteBusinessProcess + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: If-Match + in: header + description: ETag to verify whether user has latest data + schema: + type: string + - name: businessProcessName + in: path + description: Process name + required: true + schema: + type: string + responses: + "204": + description: No Content. Business process successfully deleted. + content: + application/json: {} + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden + content: + application/json: {} + "404": + description: Not Found + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "409": + description: Conflict. __If-Match__ input value doesn't equal to servers + value. It means that business process already has been updated/deleted + after user obtained __ETag__. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "500": + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + /versions/candidates/{versionCandidateId}/settings: + get: + tags: + - candidate-version-settings-api + summary: Get settings for version-candidate + description: |- + ### Endpoint purpose: + This endpoint is used for retrieving a JSON representations of existing _settings_ for version candidate + operationId: getSettings_1 + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: versionCandidateId + in: path + description: Version candidate identifier + required: true + schema: + type: string + responses: + "200": + description: OK. Settings information retrieved successfully + content: + application/json: + schema: + $ref: '#/components/schemas/SettingsInfoDto' + example: + themeFile: white-theme.js + title: mdtuddm + titleFull: <Назва реєстру> + supportEmail: support@registry.gov.ua + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden + content: + application/json: {} + "404": + description: Not Found + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "500": + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + put: + tags: + - candidate-version-settings-api + summary: Update settings for version-candidate + description: |- + ### Endpoint purpose: + This endpoint is used to update/create a _settings_ for the version candidate. A conflict can arise when two or more commits have made changes to the same part of a file. This can happen when two developers are working on the same branch at the same time, and both make changes to the same piece of code without being aware of each other's changes. + operationId: updateSettings + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: versionCandidateId + in: path + description: Version candidate identifier + required: true + schema: + type: string + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/SettingsInfoDto' + example: + themeFile: white-theme.js + title: mdtuddm + titleFull: <Назва реєстру> + supportEmail: support@registry.gov.ua + required: true + responses: + "200": + description: OK. Settings information updated successfully + content: + application/json: + schema: + $ref: '#/components/schemas/SettingsInfoDto' + example: + themeFile: white-theme.js + title: mdtuddm + titleFull: <Назва реєстру> + supportEmail: support@registry.gov.ua + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden + content: + application/json: {} + "404": + description: Not Found + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "409": + description: Conflict. It means that settings file content already has been + updated/deleted. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "422": + description: Unprocessable Entity + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "500": + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + /versions/candidates/{versionCandidateId}/rebase: + put: + tags: + - candidate-version-api + summary: Rebase changes from master version + description: This operation applies the changes made to the _master_ version + onto a __version-candidate__. The purpose is to ensure that the __version + candidate__ has all the latest changes from the _master_ version before merging + it. + operationId: rebase + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: versionCandidateId + in: path + description: Version candidate identifier + required: true + schema: + type: string + responses: + "200": + description: OK. Rebase was successful + content: + application/json: {} + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden + content: + application/json: {} + "404": + description: Not Found + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "500": + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + /versions/candidates/{versionCandidateId}/forms/{formName}: + get: + tags: + - candidate-version-forms-api + summary: Get full details of the specific form within version-candidate + description: | + ### Endpoint purpose: + This endpoint is used for retrieving a JSON representation of a user __form__ from the __version-candidate__. This operation retrieves a single _form_ based on the specified __formName__. If you need to retrieve list of _forms_, you can use the [GET](#candidate-version-forms-api/getFormsByVersionId) endpoint. + operationId: getForm_1 + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: versionCandidateId + in: path + description: Version candidate identifier + required: true + schema: + type: string + - name: formName + in: path + description: Form name + required: true + schema: + type: string + responses: + "200": + description: Form successfully retrieved. + content: + application/json: + example: |- + { + "display": "form", + "components": [], + "path": "my-awesome-form", + "name": "my-awesome-form", + "title": "Form human-readable title", + } + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden + content: + application/json: {} + "404": + description: Not Found + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "500": + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + put: + tags: + - candidate-version-forms-api + summary: Update existing form within version-candidate + description: "### Endpoint purpose: \n This endpoint is used for updating a\ + \ json representation of a user __form__ in __version-candidate__.\n### Conflict\ + \ resolving:\n In this endpoint [Conditional requests](https://datatracker.ietf.org/doc/html/rfc9110#name-conditional-requests)\ + \ are supported. You can use an __ETag__ header value, that can be previously\ + \ obtained in [GET](#candidate-version-forms-api/getForm) request, as a value\ + \ for __If-Match__ header so you can be sure that you're updating the last\ + \ version of a _form_. But if your __If-Match__ value is differs from the\ + \ servers you will receive a _409 Conflict_ instead of _412 Precondition Failed_.\ + \ For _registry-regulation-management_ service this situation's considered\ + \ as a conflict. If __If-Match__ is not present then conflict checking won't\ + \ be performed.\n### Form validation: \nBefore saving the content to the storage,\ + \ the __validation__ of a _form_ is executed. The _form_ must be a __json__\ + \ document and must have a non-empty __\"title\"__ field. Also the field __\"\ + name\"__ must be present and equal to __\"path\"__ field, that must be present\ + \ too. Also _both_ this values must be equal to __\"formName\"__ pathVariable.\ + \ In other case the _form_ won't be working as expected. Changing __\"name\"\ + __ or __\"path\"__ is not supported. If you need to change these fields then\ + \ you need to copy the _form_ with new name and delete the previous _form_.\n\ + ### Missing form handling: \nIf the updated _form_ is missing and the _If-Match_\ + \ header is not present (or equal to __\"*\"__) then the _form_ will be __created__\ + \ instead.\n### Created and modified dates handling:\nIf there any of __\"\ + created\"__ or __\"modified\"__ fields present in the request body they will\ + \ be ignored. Value for the __\"created\"__ field is automatically getting\ + \ from the previous _form_ content (if present, in other case it's getting\ + \ from the git log). And for the __\"updated\"__ value the current servers\ + \ datetime in UTC is set." + operationId: updateForm_1 + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: If-Match + in: header + description: ETag to verify whether user has latest data + schema: + type: string + - name: versionCandidateId + in: path + description: Version candidate identifier + required: true + schema: + type: string + - name: formName + in: path + description: Name of the form to be updated + required: true + schema: + type: string + requestBody: + content: + application/json: + schema: + type: string + example: + display: form + components: [] + path: my-awesome-form + name: my-awesome-form + title: Form human-readable title + required: true + responses: + "200": + description: Form successfully updated. + headers: + ETag: + description: New ETag value for conflict verification + style: simple + schema: + type: string + content: + application/json: + example: + display: form + components: [] + path: my-awesome-form + name: my-awesome-form + title: Form human-readable title + created: 2023-03-28T09:18:41.941Z + modified: 2023-03-29T09:58:44.100Z + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden + content: + application/json: {} + "409": + description: Conflict. __If-Match__ input value doesn't equal to servers + value. It means that form already has been updated/deleted after user + obtained __ETag__. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "422": + description: Unprocessable Entity. User form is not valid. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "500": + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + post: + tags: + - candidate-version-forms-api + summary: Create new form within specific version-candidate + description: "### Endpoint purpose: \n This endpoint is used for creating a\ + \ JSON representation of a user __form__ in the __version-candidate__.\n###\ + \ Form validation: \nBefore saving the new _form_ to the storage, the server\ + \ validates the _form_. The _form_ must be a __json__ document and must have\ + \ a non-empty __\"title\"__ field. Also the field __\"name\"__ must be present\ + \ and equal to __\"path\"__ field, that must be present too. Also _both_ this\ + \ values must be equal to __\"formName\"__ pathVariable. In other case the\ + \ _form_ won't be working as expected. \n ### Missing form handling: \n If\ + \ the specified _form_ does not already exist, the server will create a new\ + \ _form_ with the provided data. Otherwise, the server will return a _409\ + \ Conflict_ error indicating that the _form_ already exists.\n ### Created\ + \ and modified dates handling:\n If there any of __\"created\"__ or __\"modified\"\ + __ fields present in the request body they will be ignored. The __\"created\"\ + __ and __\"updated\"__ fields are automatically set to the current server\ + \ time in UTC." + operationId: formCreate_1 + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: versionCandidateId + in: path + description: Version candidate identifier + required: true + schema: + type: string + - name: formName + in: path + description: Name of the new form to be created + required: true + schema: + type: string + requestBody: + content: + application/json: + schema: + type: string + example: + display: form + components: [] + path: my-awesome-form + name: my-awesome-form + title: Form human-readable title + required: true + responses: + "201": + description: Form successfully created + headers: + ETag: + description: New ETag value for conflict verification + style: simple + schema: + type: string + content: + application/json: + example: + display: form + components: [] + path: my-awesome-form + name: my-awesome-form + title: Form human-readable title + created: 2023-03-28T09:18:41.941Z + modified: 2023-03-28T09:18:41.941Z + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden + content: + application/json: {} + "409": + description: Conflict. It means that form already has been created. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "422": + description: Unprocessable Entity. User form is not valid. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "500": + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + delete: + tags: + - candidate-version-forms-api + summary: Delete existing form within version-candidate + description: |- + ### Endpoint purpose: + This endpoint is used for deleting a JSON representation of a user __form__ from the __version-candidate__. + ### Conflict resolving: + In this endpoint, [Conditional requests](https://datatracker.ietf.org/doc/html/rfc9110#name-conditional-requests) are supported. You can use an __ETag__ header value, which can be previously obtained in a [GET](#candidate-version-forms-api/getForm) request, as a value for the __If-Match__ header. This ensures that you're deleting the latest version of the _form_. However, if your __If-Match__ value differs from the server's value, you will receive _409 Conflict_ instead of _412 Precondition Failed_. For the _registry-regulation-management_ service, this situation is considered a conflict. If the __If-Match__ header is not present, conflict checking will not be performed. + ### Missing form handling: + If the specified _form_ is missing and the _If-Match_ header is not present (or equal to __"*"__), the server will return a 404 Not Found error indicating that the specified _form_ does not exist. + operationId: deleteForm_1 + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: If-Match + in: header + description: ETag to verify whether user has latest data + schema: + type: string + - name: versionCandidateId + in: path + description: Version candidate identifier + required: true + schema: + type: string + - name: formName + in: path + description: Name of the form to be deleted + required: true + schema: + type: string + responses: + "204": + description: No Content. Form successfully deleted. + content: + application/json: {} + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden + content: + application/json: {} + "404": + description: Not Found + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "409": + description: Conflict. __If-Match__ input value doesn't equal to servers + value. It means that form already has been updated/deleted after user + obtained __ETag__. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "500": + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + /versions/candidates/{versionCandidateId}/data-model/tables: + get: + tags: + - candidate-version-data-model-tables-api + summary: Get data-model tables file content from requested version-candidate + description: |- + ### Endpoint purpose: + This endpoint is used for retrieving a XML representation of the _content of the data-model tables_ file from the _version-candidate_. + operationId: getTablesFileContent_1 + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: versionCandidateId + in: path + description: Version candidate identifier + required: true + schema: + type: integer + format: int32 + responses: + "200": + description: OK. Tables file content retrieved successfully + content: + text/plain: + example: |- + + + + + + + + + + + + + + + + + + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden + content: + application/json: {} + "404": + description: Version-candidate doesn't exist or tables file doesn't exists + in requested version + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "500": + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + put: + tags: + - candidate-version-data-model-tables-api + summary: Put data-model tables file content to specified version-candidate + description: |- + ### Endpoint purpose: + This endpoint is used for updating a XML representation of the _content of the data-model tables_ file from the _version-candidate_. A conflict can arise when two or more commits have made changes to the same part of a file. This can happen when two developers are working on the same branch at the same time, and both make changes to the same piece of code without being aware of each other's changes. In this situation, the system cannot automatically determine which change is the correct one, and will require human intervention to resolve the conflict. + operationId: putTablesFileContent + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: If-Match + in: header + description: ETag to verify whether user has latest data + schema: + type: string + - name: versionCandidateId + in: path + description: Version candidate identifier + required: true + schema: + type: integer + format: int32 + requestBody: + content: + text/plain: + schema: + type: string + example: |- + + + + + + + + + + + + + + + + + + required: true + responses: + "200": + description: OK. Tables file content updated successfully + content: + text/plain: + example: |- + + + + + + + + + + + + + + + + + + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden + content: + application/json: {} + "404": + description: Version-candidate doesn't exist + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "409": + description: Conflict. It means that tables file content already has been + updated/deleted. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "422": + description: Unprocessable Entity. Tables file content is not valid. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "500": + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + /versions/candidates/{versionCandidateId}/business-processes/{businessProcessName}: + get: + tags: + - candidate-version-business-processes-api + summary: Get specific business process full details + description: |- + ### Endpoint purpose: + This endpoint is used for retrieving a XML representation of a user __business-process__ from the __version-candidate__. This operation retrieves a single _business-process_ based on the specified __businessProcessName__ with full details in _XML_ format. If you need to retrieve list of _business-processes_ with brief information and in _json_ format, you can use the [GET](#candidate-version-business-processes-api/getBusinessProcessesByVersionId) endpoint. + operationId: getBusinessProcess_1 + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: versionCandidateId + in: path + description: Version candidate identifier + required: true + schema: + type: string + - name: businessProcessName + in: path + description: Process name + required: true + schema: + type: string + responses: + "200": + description: OK. Business process successfully retrieved. + content: + text/plain: + example: |- + + + + + + + + + + + + + + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden + content: + application/json: {} + "404": + description: Not Found + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "500": + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + put: + tags: + - candidate-version-business-processes-api + summary: Update business process within version-candidate. + description: "### Endpoint purpose: \n This endpoint is used for updating a\ + \ xml representation of a user __business process__ in __version-candidate__.\n\ + ### Conflict resolving:\n In this endpoint [Conditional requests](https://datatracker.ietf.org/doc/html/rfc9110#name-conditional-requests)\ + \ are supported. You can use an __ETag__ header value, that can be previously\ + \ obtained in [GET](#candidate-version-business-processes-api/getBusinessProcess)\ + \ request, as a value for __If-Match__ header so you can be sure that you're\ + \ updating the last version of a _business-process_. But if your __If-Match__\ + \ value is differs from the servers you will receive a _409 Conflict_ instead\ + \ of _412 Precondition Failed_. For _registry-regulation-management_ service\ + \ this situation's considered as a conflict. If __If-Match__ is not present\ + \ then conflict checking won't be performed.\n### Business process validation:\ + \ \nBefore saving the content to the storage, the __validation__ of a _business-process_\ + \ is executed. The _business-process_ must be a __xml__ document, must conform\ + \ to the BPMN20.xsd schema (available at https://github.com/bpmn-io/bpmn-moddle/blob/master/resources/bpmn/xsd/BPMN20.xsd)\ + \ and must have a non-empty __\"name\"__ field (attribute as part of tCallableElement).\ + \ Also _name_ values must be equal to __\"businessProcessName\"__ pathVariable.\ + \ In other case the _business-process_ won't be working as expected. Changing\ + \ __\"name\"__ is not supported. If you need to change this field then you\ + \ need to copy the _business process_ with new name and delete the previous\ + \ _business process_.\n### Missing business process handling: \n If the updated\ + \ _business-process_ is missing and the _If-Match_ header is not present (or\ + \ equal to __\"*\"__) then the _business process_ will be __created__ instead." + operationId: updateBusinessProcess_1 + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: If-Match + in: header + description: ETag to verify whether user has latest data + schema: + type: string + - name: versionCandidateId + in: path + description: Version candidate identifier + required: true + schema: + type: string + - name: businessProcessName + in: path + description: Process name + required: true + schema: + type: string + requestBody: + content: + text/plain: + schema: + type: string + example: |- + + + + + + + + + + + + + + required: true + responses: + "200": + description: OK. Business process successfully updated. + content: + text/plain: + example: |- + + + + + + + + + + + + + + + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden + content: + application/json: {} + "409": + description: Conflict. __If-Match__ input value doesn't equal to servers + value. It means that business process already has been updated/deleted + after user obtained __ETag__. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "422": + description: Unprocessable Entity. User business process is not valid. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "500": + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + post: + tags: + - candidate-version-business-processes-api + summary: Create new business process + description: "### Endpoint purpose: \n This endpoint is used for creating a\ + \ xml representation of a user __business process__ in __version-candidate__\ + \ version. \n ### Business process validation: \nBefore saving the content\ + \ to the storage, the __validation__ of a _business-process_ is executed.\ + \ The _business-process_ must be a __xml__ document, must conform to the BPMN20.xsd\ + \ schema (available at https://github.com/bpmn-io/bpmn-moddle/blob/master/resources/bpmn/xsd/BPMN20.xsd)\ + \ and must have a non-empty __\"name\"__ field (attribute as part of tCallableElement).\ + \ Also _name_ values must be equal to __\"businessProcessName\"__ pathVariable.\ + \ In other case the _business-process_ won't be working as expected. \n###\ + \ Missing business process handling: \n If the specified _business-process_\ + \ does not already exist, the server will create a new _business-process_\ + \ with the provided data. Otherwise, the server will return a _409 Conflict_\ + \ error indicating that the _business-process_ already exists." + operationId: createBusinessProcess_1 + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: versionCandidateId + in: path + description: Version candidate identifier + required: true + schema: + type: string + - name: businessProcessName + in: path + description: Name of the new process to be created + required: true + schema: + type: string + requestBody: + content: + text/plain: + schema: + type: string + example: |- + + + + + + + + + + + + + + required: true + responses: + "201": + description: Business process successfully created. + content: + text/plain: + example: |- + + + + + + + + + + + + + + + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden + content: + application/json: {} + "409": + description: Conflict. It means that business process already has been created. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "422": + description: Unprocessable Entity. User business process is not valid. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "500": + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + delete: + tags: + - candidate-version-business-processes-api + summary: Delete existing business process + description: |- + ### Endpoint purpose: + This endpoint is used for deleting a user __business-process__ from the __version-candidate__. + ### Conflict resolving: + In this endpoint, [Conditional requests](https://datatracker.ietf.org/doc/html/rfc9110#name-conditional-requests) are supported. You can use an __ETag__ header value, which can be previously obtained in a [GET](#candidate-version-business-processes-api/getBusinessProcess) request, as a value for the __If-Match__ header. This ensures that you're deleting the latest version of the _business process_. However, if your __If-Match__ value differs from the server's value, you will receive _409 Conflict_ instead of _412 Precondition Failed_. For the _registry-regulation-management_ service, this situation is considered a conflict. If the __If-Match__ header is not present, conflict checking will not be performed. + ### Missing business process handling: + If the specified _business process_ is missing and the _If-Match_ header is not present (or equal to __"*"__), the server will return a 404 Not Found error indicating that the specified _business process_ does not exist. + operationId: deleteBusinessProcess_1 + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: If-Match + in: header + description: ETag to verify whether user has latest data + schema: + type: string + - name: versionCandidateId + in: path + description: Version candidate identifier + required: true + schema: + type: string + - name: businessProcessName + in: path + description: Process name + required: true + schema: + type: string + responses: + "204": + description: No Content. Business process successfully deleted. + content: + application/json: {} + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden + content: + application/json: {} + "404": + description: Not Found + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "409": + description: Conflict. __If-Match__ input value doesn't equal to servers + value. It means that business process already has been updated/deleted + after user obtained __ETag__. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "500": + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + /versions/candidates: + get: + tags: + - candidate-version-api + summary: Get list of existing opened version-candidates + description: |- + ### Endpoint purpose: + This endpoint is used for retrieving a list of JSON representations of __version information__ from the __version-candidate__, containing only brief information about each __version information__. If you need to retrieve full details of a single __version information__ based on its __versionCandidateId__, you can use the [GET](#candidate-version-api/getVersionDetails) endpoint. + operationId: getVersionsList + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + responses: + "200": + description: OK. Version details successfully retrieved. + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/VersionInfo' + example: + - id: "1" + name: JohnDoe's version candidate + description: Version candidate to change form + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden + content: + application/json: {} + "500": + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + post: + tags: + - candidate-version-api + summary: Create new version-candidate from current state of master version. + description: |- + ### Endpoint purpose: + This endpoint is used to create a new __version-candidate__ from the current state of the _master_ version. The purpose is to allow making changes to the data elements without affecting the stability of the _master_ version. The endpoint requires the `X-Access-Token` header for security. Once the new __version-candidate__ is created, it can be developed independently from other __version-candidates__ or the _master_ version. When the changes are ready, the __version-candidate__ can be merged back into the _master_ version. If the operation is _successful_, the resulting `VersionInfoDetailed` object is returned along with a _`201 Created`_ status code. If the request _fails_ due to invalid input or server issues, a _`4xx` or `5xx`_ HTTP response code may be returned along with a detailed error message. + operationId: createNewVersion + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/CreateVersionRequest' + example: + name: JohnDoe's version candidate + description: Version candidate to change form + required: true + responses: + "201": + description: OK. Version candidate successfully created + content: + application/json: + schema: + $ref: '#/components/schemas/VersionInfoDetailed' + example: + id: "1" + name: JohnDoe's version candidate + description: Version candidate to change form + author: JohnDoe@epam.com + creationDate: 2022-08-10T11:30:00 + latestUpdate: 2022-08-10T11:40:00 + hasConflicts: false + inspections: null + validations: + - name: Validation 1 + result: SUCCESS + message: Validation passed + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden + content: + application/json: {} + "422": + description: Unprocessable Entity. Version request is not valid + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "500": + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + /versions/candidates/{versionCandidateId}/submit: + post: + tags: + - candidate-version-api + summary: Integrate version-candidate changes into master version of registry + regulation + description: |- + ### Endpoint purpose: + This endpoint is used to merge an available open __version-candidate__, identified by the _versionCandidateId_ parameter, into master version of the registry regulation after the changes have been reviewed. Once the merge operation is completed, the __version-candidate__ will no longer accept any new changes. Successful completion of the merge operation is indicated by a _204 No Content_ response. In case of any conflicts between the __version-candidate__ and the _master version_, such as duplicate names for data elements or changes made to data elements already changed in the _master version_, this API returns a __409 Conflict__ HTTP response. In such cases, the resulting _conflict_ must be resolved before attempting the merge operation again. + operationId: submitVersionCandidate + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: versionCandidateId + in: path + description: Version candidate identifier to be merged into master version + required: true + schema: + type: string + responses: + "204": + description: No Content. Version candidate successfully merged into master + version. + content: + application/json: {} + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden + content: + application/json: {} + "404": + description: Not Found + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "409": + description: Conflict. The same data has been updated or deleted in the + master version by another merge commit. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "500": + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + /versions/candidates/{versionCandidateId}/forms/{formName}/rollback: + post: + tags: + - candidate-version-forms-api + summary: Rollback existing form within version-candidate + description: |- + ### Endpoint purpose: + This endpoint is used for rolling back a user __form__ from the __version-candidate__. It is intended for situations where a __form__ needs to be reverted to a prior version, such as to mitigate data corruption or to restore a previous state. + operationId: rollbackForm + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: versionCandidateId + in: path + description: Version candidate identifier + required: true + schema: + type: string + - name: formName + in: path + description: Name of the form to be rolled back + required: true + schema: + type: string + responses: + "200": + description: OK. Form successfully rolled back. + content: + application/json: {} + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden + content: + application/json: {} + "404": + description: Not Found + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "500": + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + /versions/candidates/{versionCandidateId}/decline: + post: + tags: + - candidate-version-api + summary: Abandon the existing opened version-candidate. + description: |- + ### Endpoint purpose: + This endpoint is used to decline an available open __version-candidate__. It is intended for situations where the __candidate version__ is no longer needed. After this operation the __version-candidate__ won't take any changes anymore. + operationId: declineVersionCandidate + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: versionCandidateId + in: path + description: Version candidate identifier to abandon + required: true + schema: + type: string + responses: + "200": + description: OK. Version candidate successfully abandoned + content: + application/json: {} + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden + content: + application/json: {} + "404": + description: Not Found + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "500": + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + /versions/candidates/{versionCandidateId}/data-model/tables/rollback: + post: + tags: + - candidate-version-data-model-tables-api + summary: Rollback data-model tables file content to specified version-candidate + description: |- + ### Endpoint purpose: + This endpoint is used for rolling back a __tables file content__ from the __version-candidate__. It is intended for situations where a __tables file content__ needs to be reverted to a prior version, such as to mitigate data corruption or to restore a previous state. + operationId: rollbackTables + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: versionCandidateId + in: path + description: Version candidate identifier + required: true + schema: + type: string + responses: + "200": + description: OK. Tables file content successfully rolled back. + content: + application/json: {} + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden + content: + application/json: {} + "404": + description: Version-candidate doesn't exist + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "500": + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + /versions/candidates/{versionCandidateId}/business-processes/{businessProcessName}/rollback: + post: + tags: + - candidate-version-business-processes-api + summary: Rollback business process + description: |- + ### Endpoint purpose: + This endpoint is used for rolling back a user __business-process__ from the __version-candidate__. It is intended for situations where a __business process__ needs to be reverted to a prior version, such as to mitigate data corruption or to restore a previous state. + operationId: rollbackProcess + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: versionCandidateId + in: path + description: Version candidate identifier + required: true + schema: + type: string + - name: businessProcessName + in: path + description: Process name + required: true + schema: + type: string + responses: + "200": + description: OK. Business process successfully rolled back. + content: + application/json: {} + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden + content: + application/json: {} + "404": + description: Not Found + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "500": + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + /versions/candidates/{versionCandidateId}/business-process-groups: + get: + tags: + - candidate-version-business-process-groups-api + summary: Get business process groups for candidate + description: |- + ### Endpoint purpose: + This endpoint is used to retrieve a list of JSON representations of _business process groups_ for the version candidate. + operationId: getBusinessProcessGroups_1 + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: versionCandidateId + in: path + description: Version candidate identifier + required: true + schema: + type: string + responses: + "200": + description: OK. Successful retrieval of business process groups + content: + application/json: + schema: + $ref: '#/components/schemas/BusinessProcessGroupsResponse' + example: + groups: + - name: Перша група + processDefinitions: [] + - name: Друга група + processDefinitions: [] + - name: Третя група + processDefinitions: [] + ungrouped: + - id: bp-4-process_definition_id + name: John Doe added new component + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden + content: + application/json: {} + "500": + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + post: + tags: + - candidate-version-business-process-groups-api + summary: Save business process groups for version-candidate + description: "### Endpoint purpose:\n This endpoint is used to create/update\ + \ a _business process groups_ for the version candidate. A conflict can arise\ + \ when two or more commits have made changes to the same part of a file. This\ + \ can happen when two developers are working on the same branch at the same\ + \ time, and both make changes to the same piece of code without being aware\ + \ of each other's changes. ### Group validation: \nBefore saving the new _bp\ + \ groups_, the server validates it. The _groups_ must be a __yaml__ document\ + \ and must have a __\"groups\"__ field. Also the field __\"groups.name\"__\ + \ must be present, unique and valid (name is match with regex). Also _groups.processDefinitions_\ + \ field cannot be empty." + operationId: saveBusinessProcessGroups + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: versionCandidateId + in: path + description: Version candidate identifier + required: true + schema: + type: string + requestBody: + content: + application/json: + schema: + type: string + example: + groups: + - name: Перша група + processDefinitions: + - bp-1-process_definition_id + - name: Четверта група + processDefinitions: + - bp-3-process_definition_id + - name: Третя група + ungrouped: + - bp-4-process_definition_id + - bp-5-process_definition_id + required: true + responses: + "200": + description: OK. Business process groups successfully created/updated + content: + application/json: + schema: + $ref: '#/components/schemas/BusinessProcessGroupsResponse' + example: + groups: + - name: Перша група + processDefinitions: [] + - name: Друга група + processDefinitions: [] + - name: Третя група + processDefinitions: [] + ungrouped: + - id: bp-4-process_definition_id + name: John Doe added new component + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden + content: + application/json: {} + "404": + description: Not Found + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "409": + description: Conflict. It means that bp group file content already has been + updated/deleted. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "422": + description: Unprocessable Entity + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "500": + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + /versions/candidates/{versionCandidateId}/business-process-groups/rollback: + post: + tags: + - candidate-version-business-process-groups-api + summary: Rollback business process groups for version-candidate + description: |- + ### Endpoint purpose: + This endpoint is used for rolling back a __bp groups__ from the __version-candidate__. It is intended for situations where a __bp groups__ needs to be reverted to a prior version, such as to mitigate data corruption or to restore a previous state. + operationId: rollbackBusinessProcessGroups + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: versionCandidateId + in: path + description: Version candidate identifier + required: true + schema: + type: string + responses: + "200": + description: OK. Business process groups successfully rolled back. + content: + application/json: {} + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden + content: + application/json: {} + "404": + description: Not Found + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "500": + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + /batch-loads/users: + get: + tags: + - users-batch-loads-api + summary: Get file information + description: |- + ### Endpoint purpose: + This endpoint is used for retrieving a JSON representation of a __file__ metadata. Since the file is mapped to a username, the file information of the user who executed the given endpoint is returned. + operationId: getFileInfo + parameters: + - name: securityContext + in: query + required: true + schema: + type: string + responses: + "200": + description: OK + content: + '*/*': + schema: + $ref: '#/components/schemas/CephFileInfoDto' + example: + id: "123456789" + name: example_file.txt + size: 1024 + "400": + description: Bad Request + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "500": + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + post: + tags: + - users-batch-loads-api + summary: Store file endpoint + description: "### Endpoint purpose: \n This endpoint is used for downloading\ + \ a file with registry user data. \n ### File validation: \nBefore saving\ + \ the new _file_ to the storage, the server validates the _file_. The _file_\ + \ must be a __csv__ document and must have a non-empty __\"name\"__. Also\ + \ the __\"file\"__ must not be null and empty. Also _file_ encoding must be\ + \ UTF-8.\n ### Existing file handling: \n The _file_ in the ceph is tied to\ + \ the user who uploads it, so when you try to upload a second _file_, the\ + \ first _file_ in the ceph is overwritten." + operationId: handleFileUpload + parameters: + - name: securityContext + in: query + schema: + type: string + requestBody: + content: + application/json: + schema: + required: + - file + type: object + properties: + file: + type: string + format: binary + securityContext: + $ref: '#/components/schemas/SecurityContext' + responses: + "201": + description: Created. Returns uploaded file metadata + content: + '*/*': + schema: + $ref: '#/components/schemas/CephFileInfoDto' + example: + id: "123456789" + name: example_file.txt + size: 1024 + "400": + description: Bad Request + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "403": + description: Forbidden + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "500": + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + /batch-loads/users/imports: + post: + tags: + - users-batch-loads-api + summary: Start import endpoint + description: |- + ### Endpoint purpose: + This endpoint is used for starting the process of importing the downloaded file with registry user data. + operationId: imports + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/SecurityContext' + responses: + "202": + description: Accepted + content: + '*/*': {} + "400": + description: Bad Request + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "404": + description: Not found + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "500": + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + /versions/master: + get: + tags: + - master-version-api + summary: Acquire master version full details + description: "This endpoint retrieves a JSON representation containing detailed\ + \ information about the last master version, if it exists. Otherwise, an empty\ + \ object will be returned." + operationId: getMasterVersionInfo + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + responses: + "200": + description: OK. Version details successfully retrieved. + content: + application/json: + schema: + $ref: '#/components/schemas/MasterVersionInfoDetailed' + example: + id: "123" + name: Example Master Release + description: This is an example master release. + author: John Doe + latestUpdate: 2022-11-01T13:30:00 + published: true + inspector: Jane Smith + validations: + - name: Example Validation 1 + status: PASSED + - name: Example Validation 2 + status: PASSED + status: APPROVED + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden + content: + application/json: {} + "500": + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + /versions/master/tables: + get: + tags: + - master-version-tables-api + summary: '"Get a list of tables with brief details for the master version' + description: |- + ### Endpoint purpose: + This endpoint is used for retrieving a list of JSON representations of __tables__ directly from the __master__ version, containing only brief information about each _table_. If you need to retrieve full details of a single _table_ based on its __tableName__, you can use the [GET](#master-version-tables-api/getTable) endpoint. + operationId: getTables + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + responses: + "200": + description: OK. Tables successfully retrieved. + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/TableInfoShort' + example: + - name: John Doe's table + description: John Doe get table + objectReference: true + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden + content: + application/json: {} + "500": + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + /versions/master/tables/{tableName}: + get: + tags: + - master-version-tables-api + summary: Get specific table full details + description: |- + ### Endpoint purpose: + This endpoint is used for retrieving a JSON representation of a __table__ directly from the __master__ version. This operation retrieves a single _table_ based on the specified __tableName__. If you need to retrieve list of _tables_, you can use the [GET](#master-version-tables-api/getTables) endpoint. + operationId: getTable + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: tableName + in: path + description: Table name + required: true + schema: + type: string + responses: + "200": + description: OK. Table successfully retrieved. + content: + application/json: + schema: + $ref: '#/components/schemas/TableInfo' + example: + name: ExampleTable + description: Example description + objectReference: true + columns: + id: + name: id + description: Table column id + type: INTEGER + defaultValue: "0" + notNullFlag: true + name: + name: name + description: Table column name + type: VARCHAR + defaultValue: null + notNullFlag: true + foreignKeys: + fk_example: + name: fk_example + targetTable: AnotherTable + columnPairs: + - sourceColumnName: id + targetColumnName: example_id + primaryKey: + name: pk_example + columns: + - name: id + sorting: ASC + uniqueConstraints: + uk_example: + name: uk_example + columns: + - name: name + sorting: ASC + indices: + idx_example: + name: idx_example + columns: + - name: id + sorting: ASC + - name: name + sorting: DESC + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden + content: + application/json: {} + "404": + description: Not Found + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "500": + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + /versions/master/settings: + get: + tags: + - master-version-settings-api + summary: Get settings for master version + description: |- + ### Endpoint purpose: + This endpoint is used for retrieving a JSON representations of existing _settings_ for master version + operationId: getSettings + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + responses: + "200": + description: OK. Settings information retrieved successfully + content: + application/json: + schema: + $ref: '#/components/schemas/SettingsInfoDto' + example: + themeFile: white-theme.js + title: mdtuddm + titleFull: <Назва реєстру> + supportEmail: support@registry.gov.ua + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden + content: + application/json: {} + "500": + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + /versions/master/forms: + get: + tags: + - master-version-forms-api + summary: Get a list of forms with brief details for the master version + description: |- + ### Endpoint purpose: + This endpoint is used for retrieving a list of JSON representations of user __forms__ directly from the __master__ version, containing only brief information about each _form_. If you need to retrieve full details of a single _form_ based on its __formName__, you can use the [GET](#master-version-forms-api/getForm) endpoint. + operationId: getFormsFromMaster + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + responses: + "200": + description: OK. Forms successfully retrieved. + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/FormDetailsShort' + example: + - name: ExampleFormService + title: Example Form + created: 2022-10-01T10:00:00 + updated: 2022-11-15T13:30:00 + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden + content: + application/json: {} + "500": + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + /versions/master/data-model/tables: + get: + tags: + - master-version-data-model-tables-api + summary: Get data-model tables file content from master version + description: |- + ### Endpoint purpose: + This endpoint is used for retrieving a XML representation of the _content of the data-model tables_ file from the master version. + operationId: getTablesFileContent + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + responses: + "200": + description: OK. Tables file content retrieved successfully + content: + text/plain: + example: |- + + + + + + + + + + + + + + + + + + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden + content: + application/json: {} + "404": + description: Tables file doesn't exists in master version + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "500": + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + /versions/master/business-processes: + get: + tags: + - master-version-business-processes-api + summary: Get a list of business processes with brief details for the master + version + description: |- + ### Endpoint purpose: + This endpoint is used for retrieving a list of JSON representations of user __business processes__ directly from the __master__ version, containing only brief information about each _business process_. If you need to retrieve full details of a single _business process_ based on its __businessProcessName__, you can use the [GET](#master-version-business-processes-api/getBusinessProcess) endpoint. + operationId: getBusinessProcessesFromMaster + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + responses: + "200": + description: OK. Business processes successfully retrieved. + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/BusinessProcessDetailsShort' + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden + content: + application/json: {} + "500": + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + /versions/master/business-process-groups: + get: + tags: + - master-version-business-process-groups-api + summary: Get business process groups for master version + description: |- + ### Endpoint purpose: + This endpoint is used to retrieve a list of JSON representations of _business process groups_ for the master version. + operationId: getBusinessProcessGroups + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + responses: + "200": + description: OK. Successful retrieval of business process groups + content: + application/json: + schema: + $ref: '#/components/schemas/BusinessProcessGroupsResponse' + example: + groups: + - name: Перша група + processDefinitions: [] + - name: Друга група + processDefinitions: [] + - name: Третя група + processDefinitions: [] + ungrouped: + - id: bp-4-process_definition_id + name: John Doe added new component + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden + content: + application/json: {} + "500": + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + /versions/candidates/{versionCandidateId}: + get: + tags: + - candidate-version-api + summary: Acquire version-candidate full details + description: |- + ### Endpoint purpose: + This endpoint is used for retrieving a JSON representations of _version information_ from the __version-candidate__. This operation retrieves a single __version information__ based on the specified __versionCandidateId__ with full details. If you need to retrieve a list of __version information__ with brief details, you can use the [GET](#candidate-version-api/getVersionsList) endpoint. + operationId: getVersionDetails + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: versionCandidateId + in: path + description: Version-candidate identifier + required: true + schema: + type: string + responses: + "200": + description: OK. Version details successfully retrieved. + content: + application/json: + schema: + $ref: '#/components/schemas/VersionInfoDetailed' + example: + id: "1" + name: JohnDoe's version candidate + description: Version candidate to change form + author: JohnDoe@epam.com + creationDate: 2022-08-10T11:30:00.000Z + latestUpdate: 2022-08-10T11:40:00.000Z + hasConflicts: false + inspections: null + validations: + - result: SUCCESS + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden + content: + application/json: {} + "404": + description: Not Found + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "500": + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + /versions/candidates/{versionCandidateId}/tables: + get: + tags: + - candidate-version-tables-api + summary: Get a list of tables with brief details for the version-candidate + description: |- + ### Endpoint purpose: + This endpoint is used for retrieving a list of JSON representations of __tables__ from the __version-candidate__, containing only brief information about each _table_. If you need to retrieve full details of a single _table_ based on its __tableName__, you can use the [GET](#candidate-version-tables-api/getTable) endpoint. + operationId: getTables_1 + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: versionCandidateId + in: path + description: Version candidate identifier + required: true + schema: + type: integer + format: int32 + responses: + "200": + description: OK. Tables successfully retrieved. + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/TableInfoShort' + example: + - name: John Doe's table + description: John Doe get table + objectReference: true + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden + content: + application/json: {} + "404": + description: Version-candidate not found + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "500": + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + /versions/candidates/{versionCandidateId}/tables/{tableName}: + get: + tags: + - candidate-version-tables-api + summary: Get specific table full details from version-candidate + description: |- + ### Endpoint purpose: + This endpoint is used for retrieving a JSON representation of a __table__ directly from version-candidate. This operation retrieves a single _table_ based on the specified __tableName__. If you need to retrieve list of _tables_, you can use the [GET](#candidate-version-tables-api/getTables) endpoint. + operationId: getTable_1 + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: versionCandidateId + in: path + description: Version candidate identifier + required: true + schema: + type: integer + format: int32 + - name: tableName + in: path + description: Table name + required: true + schema: + type: string + responses: + "200": + description: OK. Table successfully retrieved. + content: + application/json: + schema: + $ref: '#/components/schemas/TableInfo' + example: + name: ExampleTable + description: Example description + objectReference: true + columns: + id: + name: id + description: Table column id + type: INTEGER + defaultValue: "0" + notNullFlag: true + name: + name: name + description: Table column name + type: VARCHAR + defaultValue: null + notNullFlag: true + foreignKeys: + fk_example: + name: fk_example + targetTable: AnotherTable + columnPairs: + - sourceColumnName: id + targetColumnName: example_id + primaryKey: + name: pk_example + columns: + - name: id + sorting: ASC + uniqueConstraints: + uk_example: + name: uk_example + columns: + - name: name + sorting: ASC + indices: + idx_example: + name: idx_example + columns: + - name: id + sorting: ASC + - name: name + sorting: DESC + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden + content: + application/json: {} + "404": + description: Version candidate or table not found + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "500": + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + /versions/candidates/{versionCandidateId}/forms: + get: + tags: + - candidate-version-forms-api + summary: Acquire list of forms with brief details for specific version-candidate + description: |- + ### Endpoint purpose: + This endpoint is used for retrieving a list of JSON representations of user __forms__ from the __version-candidate__, containing only brief information about each _form_. If you need to retrieve full details of a single _form_ based on its __formName__, you can use the [GET](#candidate-version-forms-api/getForm) endpoint. + operationId: getFormsByVersionId + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: versionCandidateId + in: path + description: Version candidate identifier + required: true + schema: + type: string + responses: + "200": + description: OK. Forms successfully retrieved. + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/FormDetailsShort' + example: + - name: john-does-form + title: John Doe added new component + created: 2022-07-29T18:55:00.000Z + updated: 2022-07-29T18:56:00.000Z + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden + content: + application/json: {} + "500": + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + /versions/candidates/{versionCandidateId}/changes: + get: + tags: + - candidate-version-api + summary: Get version changes by version-candidate id + description: |- + ### Endpoint purpose: + This operation retrieves _changes_ made to the data elements in a __version-candidate__ compared to the _master_ version. The endpoint allows you to review the changes made in a candidate version before merging with the main version. + operationId: getVersionChanges + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: versionCandidateId + in: path + description: Version candidate identifier + required: true + schema: + type: string + responses: + "200": + description: OK. Version changes successfully retrieved + content: + application/json: + schema: + $ref: '#/components/schemas/VersionChangesInfo' + example: + changedForms: + - name: formToBeUpdated + title: JohnDoe's form + status: CHANGED + changedBusinessProcesses: + - name: newProcess + title: JohnDoe's process + status: NEW + changedGroups: + - title: JohnDoe's group + status: NEW + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden + content: + application/json: {} + "404": + description: Not Found + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "500": + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + /versions/candidates/{versionCandidateId}/business-processes: + get: + tags: + - candidate-version-business-processes-api + summary: Get a list of business processes with brief details for the candidate + version + description: |- + ### Endpoint purpose: + This endpoint is used for retrieving a list of JSON representations of user __business processes__ from the __version-candidate__, containing only brief information about each _business process_. If you need to retrieve full details of a single _business process_ based on its __businessProcessName__, you can use the [GET](#candidate-version-business-processes-api/getBusinessProcess) endpoint. + operationId: getBusinessProcessesByVersionId + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: versionCandidateId + in: path + description: Version candidate identifier + required: true + schema: + type: string + responses: + "200": + description: OK. Business processes successfully retrieved. + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/BusinessProcessDetailsShort' + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden + content: + application/json: {} + "500": + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + /batch-loads/users/{id}: + delete: + tags: + - users-batch-loads-api + summary: Delete file endpoint + description: |- + ### Endpoint purpose: + This endpoint is used for deleting a __file__ from storage by id. + operationId: deleteFile + parameters: + - name: id + in: path + description: Resource identifier + required: true + schema: + type: string + responses: + "204": + description: No content. + content: + '*/*': + schema: + $ref: '#/components/schemas/CephFileInfoDto' + "500": + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' +components: + schemas: + DetailedErrorResponse: + required: + - code + - details + - traceId + type: object + properties: + traceId: + type: string + description: Request identifier + code: + type: string + description: Error code + details: + type: string + description: Error details + localizedMessage: + type: string + description: Localized error message + SettingsInfoDto: + type: object + properties: + titleFull: + type: string + title: + type: string + themeFile: + type: string + supportEmail: + type: string + CreateVersionRequest: + required: + - description + - name + type: object + properties: + name: + type: string + description: Name from request + description: + type: string + description: Description from request + Inspection: + required: + - inspector + - name + - result + - resultDetails + type: object + properties: + name: + type: string + description: Name of inspection + inspector: + type: string + description: Person who performed inspection + result: + type: string + description: Inspection result + enum: + - PENDING + - SUCCESS + - FAILED + resultDetails: + type: string + description: Inspection result detailsN + description: Version candidate inspections + Validation: + required: + - name + - result + - resultDetails + - type + type: object + properties: + name: + type: string + description: Validation name + type: + type: string + description: Validation type + enum: + - REGULATION_INTEGRITY + - TEST + - DEPLOYMENT_STATUS + result: + type: string + description: Validation result + enum: + - PENDING + - SUCCESS + - FAILED + resultDetails: + type: string + description: Validation result details + description: Version candidate validations + VersionInfoDetailed: + required: + - author + - creationDate + - hasConflicts + - id + - name + type: object + properties: + id: + type: string + description: Version candidate identifier + name: + type: string + description: Version candidate name + description: + type: string + description: Version candidate description + author: + type: string + description: Version candidate author + creationDate: + type: string + description: Version candidate creation time + format: date-time + latestUpdate: + type: string + description: Version candidate update time + format: date-time + latestRebase: + type: string + description: Version candidate last rebase time + format: date-time + hasConflicts: + type: boolean + description: Version candidate conflicts flag + inspections: + type: array + description: Version candidate inspections + items: + $ref: '#/components/schemas/Inspection' + validations: + type: array + description: Version candidate validations + items: + $ref: '#/components/schemas/Validation' + BusinessProcessDefinition: + type: object + properties: + id: + type: string + name: + type: string + BusinessProcessGroupsResponse: + type: object + properties: + groups: + type: array + items: + $ref: '#/components/schemas/GroupDetailsResponse' + ungrouped: + type: array + items: + $ref: '#/components/schemas/BusinessProcessDefinition' + GroupDetailsResponse: + type: object + properties: + name: + type: string + processDefinitions: + type: array + items: + $ref: '#/components/schemas/BusinessProcessDefinition' + CephFileInfoDto: + type: object + properties: + id: + type: string + name: + type: string + size: + type: integer + format: int64 + SecurityContext: + type: object + properties: + accessToken: + type: string + MasterVersionInfoDetailed: + type: object + properties: + id: + type: string + description: Last version candidate identifier + name: + type: string + description: Last version candidate name + description: + type: string + description: Last version candidate description + author: + type: string + description: Last version candidate author + latestUpdate: + type: string + description: Last version candidate update time + format: date-time + published: + type: boolean + description: Last version candidate publication flag + inspector: + type: string + description: Last version candidate inspector + validations: + type: array + description: Last version candidate validations + items: + $ref: '#/components/schemas/Validation' + status: + type: string + description: Last version candidate status + TableInfoShort: + required: + - name + - objectReference + type: object + properties: + name: + type: string + description: Table name + objectReference: + type: boolean + description: Flag that indicates that the entity is an object in the subject + data-model + description: + type: string + description: Table description + nullable: true + Column: + required: + - name + - sorting + type: object + properties: + name: + type: string + description: Name of the column from current table + sorting: + type: string + description: Column index sorting + enum: + - ASC + - DESC + - NONE + description: Array of index columns + ColumnPair: + required: + - sourceColumnName + - targetColumnName + type: object + properties: + sourceColumnName: + type: string + description: Name of the column from current table + targetColumnName: + type: string + description: Name of the column from target table + description: List of related column pairs + ColumnShortInfo: + required: + - name + - notNullFlag + - type + type: object + properties: + name: + type: string + description: Table column name + description: + type: string + description: Table column description + type: + type: string + description: Table column data type + defaultValue: + type: string + description: Table column default value + notNullFlag: + type: boolean + description: Flag that indicates if table column can not be nullable + description: Current table column map + ForeignKeyShortInfo: + required: + - name + - targetTable + type: object + properties: + name: + type: string + description: Table foreign key name + targetTable: + type: string + description: Foreign key target table name + columnPairs: + minItems: 1 + type: array + items: + $ref: '#/components/schemas/ColumnPair' + description: Current table foreign key map + IndexShortInfo: + required: + - name + type: object + properties: + name: + type: string + description: Table index name + columns: + minItems: 1 + type: array + items: + $ref: '#/components/schemas/Column' + description: Current table index map (unique constraints and primary key excluded) + PrimaryKeyConstraintShortInfo: + required: + - name + type: object + properties: + name: + type: string + description: Table index name + columns: + minItems: 1 + type: array + items: + $ref: '#/components/schemas/Column' + description: Current table primary key index + TableInfo: + required: + - columns + - name + - objectReference + type: object + properties: + name: + type: string + description: Table name + objectReference: + type: boolean + description: Flag that indicates that the entity is an object in the subject + data-model + description: + type: string + description: Table description + nullable: true + columns: + type: object + additionalProperties: + $ref: '#/components/schemas/ColumnShortInfo' + description: Current table column map + foreignKeys: + type: object + additionalProperties: + $ref: '#/components/schemas/ForeignKeyShortInfo' + description: Current table foreign key map + primaryKey: + $ref: '#/components/schemas/PrimaryKeyConstraintShortInfo' + uniqueConstraints: + type: object + additionalProperties: + $ref: '#/components/schemas/UniqueConstraintShortInfo' + description: Current table unique constraint index map (primary key excluded) + indices: + type: object + additionalProperties: + $ref: '#/components/schemas/IndexShortInfo' + description: Current table index map (unique constraints and primary key + excluded) + UniqueConstraintShortInfo: + required: + - name + type: object + properties: + name: + type: string + description: Table index name + columns: + minItems: 1 + type: array + items: + $ref: '#/components/schemas/Column' + description: Current table unique constraint index map (primary key excluded) + FormDetailsShort: + required: + - created + - name + - title + type: object + properties: + name: + type: string + description: Form service name + title: + type: string + description: Form name + created: + type: string + description: Form creation date + format: date-time + updated: + type: string + description: Form updated date + format: date-time + BusinessProcessDetailsShort: + type: object + properties: + name: + type: string + title: + type: string + created: + type: string + format: date-time + updated: + type: string + format: date-time + VersionInfo: + required: + - id + - name + type: object + properties: + id: + type: string + description: Version candidate identifier + name: + type: string + description: Version candidate name + description: + type: string + description: Version candidate description + DataModelChangesInfo: + required: + - name + type: object + properties: + name: + type: string + description: Data model file name + fileType: + type: string + description: Data model file type. + enum: + - TABLES_FILE + status: + type: string + description: Data model file status. It's NEW or CHANGED + enum: + - NEW + - CHANGED + conflicted: + type: boolean + description: Is data model has conflicts + nullable: true + description: List of changed data-model files + EntityChangesInfo: + required: + - name + - status + - title + type: object + properties: + name: + type: string + description: Changed entity name + title: + type: string + description: Changed entity title + status: + type: string + description: "Entity status. It's NEW, CHANGED or DELETED" + enum: + - NEW + - CHANGED + - DELETED + conflicted: + type: boolean + description: Is entity has conflicts + nullable: true + description: List of changed groups + VersionChangesInfo: + required: + - changedBusinessProcesses + - changedDataModelFiles + - changedForms + - changedGroups + type: object + properties: + changedForms: + type: array + description: List of changed forms + items: + $ref: '#/components/schemas/EntityChangesInfo' + changedBusinessProcesses: + type: array + description: List of changed business processes + items: + $ref: '#/components/schemas/EntityChangesInfo' + changedDataModelFiles: + type: array + description: List of changed data-model files + items: + $ref: '#/components/schemas/DataModelChangesInfo' + changedGroups: + type: array + description: List of changed groups + items: + $ref: '#/components/schemas/EntityChangesInfo' diff --git a/docs/en/modules/arch/attachments/architecture/platform-api/services/user-process-management-swagger.yml b/docs/en/modules/arch/attachments/architecture/platform-api/services/user-process-management-swagger.yml new file mode 100644 index 0000000000..9615c8ad68 --- /dev/null +++ b/docs/en/modules/arch/attachments/architecture/platform-api/services/user-process-management-swagger.yml @@ -0,0 +1,649 @@ +openapi: 3.0.3 +info: + title: User process management API + description: All user process management operations + version: "1.0" +tags: +- name: user-process-instance-api + description: User process instance Rest API +- name: user-process-definition-api + description: User process definition Rest API +- name: grouped-user-process-definition-api + description: Grouped user process definition Rest API +paths: + /api/process-definition/{key}/start: + post: + tags: + - user-process-definition-api + summary: Start process instance + description: |- + ### Endpoint purpose: + This endpoint allows you to initiate a new process instance based on the provided process definition key + operationId: startProcessInstance + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: key + in: path + required: true + schema: + type: string + responses: + "200": + description: Returns started process instance + content: + '*/*': + schema: + $ref: '#/components/schemas/StartProcessInstanceResponse' + example: + id: d81fd894-6842-11ee-b71c-0a580a811836 + processDefinitionId: fcfea78f-66c2-11ee-b586-0a580a80065a + ended: false + "401": + description: Unauthorized + content: + application/json: {} + "404": + description: Business process definition hasn't found + content: + '*/*': + schema: + $ref: '#/components/schemas/SystemErrorDto' + "500": + description: Internal server error + content: + '*/*': + schema: + $ref: '#/components/schemas/SystemErrorDto' + /api/process-definition/{key}/start-with-form: + post: + tags: + - user-process-definition-api + summary: Start process instance with form + description: |- + ### Endpoint purpose: + This endpoint allows to start process instance by process definition key with start form data + ### Form validation: + This endpoint requires valid form, if form provided in request body does not match form structure assigned to task, then _422_ status code returned. + operationId: startProcessInstanceWithForm + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: key + in: path + required: true + schema: + type: string + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/FormDataDto' + example: + data: + formFieldName1: field value 1 + formFieldName2: field value 2 + required: true + responses: + "200": + description: Returns started process instance + content: + '*/*': + schema: + $ref: '#/components/schemas/StartProcessInstanceResponse' + example: + id: d81fd894-6842-11ee-b71c-0a580a811836 + processDefinitionId: fcfea78f-66c2-11ee-b586-0a580a80065a + ended: false + "404": + description: Business process definition hasn't found + content: + '*/*': + schema: + $ref: '#/components/schemas/SystemErrorDto' + "422": + description: Form validation failed + content: + '*/*': + schema: + $ref: '#/components/schemas/ValidationErrorDto' + "500": + description: Internal server error + content: + '*/*': + schema: + $ref: '#/components/schemas/SystemErrorDto' + /api/process-instance/count: + get: + tags: + - user-process-instance-api + summary: Returns business process instances count + description: |- + ### Endpoint purpose: + This endpoint allows to retrieve count of all unfinished process instances with root process instance + operationId: countProcessInstances + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + responses: + "200": + description: Count of process instances + content: + '*/*': + schema: + $ref: '#/components/schemas/CountResponse' + example: + count: 10 + "401": + description: Unauthorized + content: + application/json: {} + "500": + description: Internal server error + content: + '*/*': + schema: + $ref: '#/components/schemas/SystemErrorDto' + /api/process-definition: + get: + tags: + - user-process-definition-api + summary: Retrieve all process definitions + description: |- + ### Endpoint purpose: + This endpoint allows to retrieve a list of process definitions based on the provided parameters, like _active_ or _suspended_ query parameters + operationId: getProcessDefinitions + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: suspended + in: query + description: Parameter used to retrieve suspended processes + schema: + type: boolean + - name: active + in: query + description: Parameter used to retrieve active processes + schema: + type: boolean + - name: params + in: query + required: true + schema: + $ref: '#/components/schemas/GetProcessDefinitionsParams' + responses: + "200": + description: List of process definitions + content: + '*/*': + schema: + $ref: '#/components/schemas/ProcessDefinitionResponse' + example: + - id: ea4430c8-66c2-11ee-b586-0a580a80065a + key: business-process-key + name: Business process name + suspended: false + formKey: null + "401": + description: Unauthorized + content: + application/json: {} + "500": + description: Internal server error + content: + '*/*': + schema: + $ref: '#/components/schemas/SystemErrorDto' + /api/process-definition/{key}: + get: + tags: + - user-process-definition-api + summary: Retrieve process definition by key + description: |- + ### Endpoint purpose: + This endpoint allows you to retrieve a process definition based on its unique key. + operationId: getProcessDefinitionByKey + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: key + in: path + required: true + schema: + type: string + responses: + "200": + description: Process definition + content: + '*/*': + schema: + $ref: '#/components/schemas/ProcessDefinitionResponse' + example: + id: ea4430c8-66c2-11ee-b586-0a580a80065a + key: business-process-key + name: Business process name + suspended: false + formKey: null + "401": + description: Unauthorized + content: + application/json: {} + "404": + description: Business process definition hasn't found + content: + '*/*': + schema: + $ref: '#/components/schemas/SystemErrorDto' + "500": + description: Internal server error + content: + '*/*': + schema: + $ref: '#/components/schemas/SystemErrorDto' + /api/process-definition/count: + get: + tags: + - user-process-definition-api + summary: Retrieve count of process definitions + description: |- + ### Endpoint purpose: + This endpoint allows you to retrieve the total count of available process definitions that match the specified parameters. You can filter the count by specifying criteria like _active_ or _suspended_ query parameters + operationId: countProcessDefinitions + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: suspended + in: query + description: Parameter used to retrieve suspended processes + schema: + type: boolean + - name: active + in: query + description: Parameter used to retrieve active processes + schema: + type: boolean + - name: params + in: query + required: true + schema: + $ref: '#/components/schemas/GetProcessDefinitionsParams' + responses: + "200": + description: Count of process definitions + content: + '*/*': + schema: + $ref: '#/components/schemas/CountResponse' + example: + count: 10 + "401": + description: Unauthorized + content: + application/json: {} + "500": + description: Internal server error + content: + '*/*': + schema: + $ref: '#/components/schemas/SystemErrorDto' + /api/officer/process-instance: + get: + tags: + - user-process-instance-api + summary: Retrieve all process instances for the officer role + description: |- + ### Endpoint purpose: + Retrieve a list of process instances assigned to the currently authenticated officer user. This endpoint returns a paginated list of process instances that are assigned to the authenticated officer user. The provided pageable parameters allow for customization of pagination settings. + operationId: getOfficerProcessInstances + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: firstResult + in: query + description: Pagination of results. Specifies the index of the first result + to return. + schema: + type: integer + - name: maxResult + in: query + description: Pagination of results. Specifies the maximum number of results + to return. Will return less results if there are no more results left. + schema: + type: integer + - name: sortBy + in: query + description: "Sort the results lexicographically by a given criterion. Valid\ + \ values are instanceId, caseInstanceId, dueDate, executionId, caseExecutionId,assignee,\ + \ created, description, id, name, nameCaseInsensitive and priority. Must\ + \ be used in conjunction with the sortOrder parameter." + schema: + type: string + - name: sortOrder + in: query + description: Sort the results in a given order. Values may be asc for ascending + order or desc for descending order. Must be used in conjunction with the + sortBy parameter. + schema: + type: string + responses: + "200": + description: Business process instances list + content: + '*/*': + schema: + uniqueItems: true + type: array + items: + $ref: '#/components/schemas/GetProcessInstanceResponse' + example: + - id: 4ce5cc26-33ab-11eb-adc1-0242ac120002 + processDefinitionId: processDefinitionId + processDefinitionName: processDefinition + startTime: 2020-12-01T12:00:00 + status: + code: in_progress + title: У виконанні + "401": + description: Unauthorized + content: + application/json: {} + "500": + description: Internal server error + content: + '*/*': + schema: + $ref: '#/components/schemas/SystemErrorDto' + /api/grouped-process-definition: + get: + tags: + - grouped-user-process-definition-api + summary: Retrieve all process definitions with groups + description: |- + ### Endpoint purpose: + This endpoint allows users to retrieve grouped and ungrouped business process definitions ordered lists based on their system role in X-Access-Token + operationId: getProcessDefinitions_1 + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: params + in: query + required: true + schema: + $ref: '#/components/schemas/GetProcessDefinitionsParams' + responses: + "200": + description: List of process definitions with groups + content: + '*/*': + schema: + $ref: '#/components/schemas/GroupedProcessDefinitionResponse' + example: |- + { + "groups": [ + { + "name": "Business processes group name", + "processDefinitions": [ + { + "id": "fcfea78f-66c2-11ee-b586-0a580a80065a", + "key": "business-process-in-group", + "name": "Business process in group name", + "suspended": false, + "formKey": null + } + ] + }, + "ungrouped": [ + { + "id": "fcd4151b-66c2-11ee-b586-0a580a80065a", + "key": "ungrouped-process", + "name": "Ungrouped process name", + "suspended": false, + "formKey": null + } + ] + } + "401": + description: Unauthorized + content: + application/json: {} + "500": + description: Internal server error + content: + application/json: {} + /api/citizen/process-instance: + get: + tags: + - user-process-instance-api + summary: Retrieve all process instances for the citizen role + description: |- + ### Endpoint purpose: + Retrieve a list of process instances assigned to the currently authenticated citizen user. This endpoint returns a paginated list of process instances that are assigned to the authenticated citizen user. The provided pageable parameters allow for customization of pagination settings. + operationId: getCitizenProcessInstances + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: firstResult + in: query + description: Pagination of results. Specifies the index of the first result + to return. + schema: + type: integer + - name: maxResult + in: query + description: Pagination of results. Specifies the maximum number of results + to return. Will return less results if there are no more results left. + schema: + type: integer + - name: sortBy + in: query + description: "Sort the results lexicographically by a given criterion. Valid\ + \ values are instanceId, caseInstanceId, dueDate, executionId, caseExecutionId,assignee,\ + \ created, description, id, name, nameCaseInsensitive and priority. Must\ + \ be used in conjunction with the sortOrder parameter." + schema: + type: string + - name: sortOrder + in: query + description: Sort the results in a given order. Values may be asc for ascending + order or desc for descending order. Must be used in conjunction with the + sortBy parameter. + schema: + type: string + responses: + "200": + description: Business process instances list + content: + '*/*': + schema: + uniqueItems: true + type: array + items: + $ref: '#/components/schemas/GetProcessInstanceResponse' + example: + - id: 4ce5cc26-33ab-11eb-adc1-0242ac120002 + processDefinitionId: processDefinitionId + processDefinitionName: processDefinition + startTime: 2020-12-01T12:00:00 + status: + code: citizen_in_progress + title: Прийнято в обробку + "401": + description: Unauthorized + content: + application/json: {} + "500": + description: Internal server error + content: + '*/*': + schema: + $ref: '#/components/schemas/SystemErrorDto' +components: + schemas: + StartProcessInstanceResponse: + type: object + properties: + id: + type: string + processDefinitionId: + type: string + ended: + type: boolean + SystemErrorDto: + type: object + properties: + traceId: + type: string + code: + type: string + message: + type: string + localizedMessage: + type: string + FormDataDto: + type: object + properties: + data: + type: object + additionalProperties: + type: object + signature: + type: string + x-access-token: + type: string + ErrorDetailDto: + type: object + properties: + message: + type: string + field: + type: string + value: + type: string + ErrorsListDto: + type: object + properties: + errors: + type: array + items: + $ref: '#/components/schemas/ErrorDetailDto' + ValidationErrorDto: + type: object + properties: + traceId: + type: string + code: + type: string + message: + type: string + details: + $ref: '#/components/schemas/ErrorsListDto' + CountResponse: + type: object + properties: + count: + type: integer + format: int64 + ProcessDefinitionResponse: + type: object + properties: + id: + type: string + key: + type: string + name: + type: string + suspended: + type: boolean + formKey: + type: string + GetProcessDefinitionsParams: + type: object + properties: + active: + type: boolean + suspended: + type: boolean + GetProcessInstanceResponse: + type: object + properties: + id: + type: string + processDefinitionId: + type: string + processDefinitionName: + type: string + startTime: + type: string + format: date-time + status: + $ref: '#/components/schemas/StatusModel' + StatusModel: + type: object + properties: + code: + type: string + enum: + - ACTIVE + - PENDING + - SUSPENDED + - COMPLETED + - EXTERNALLY_TERMINATED + - INTERNALLY_TERMINATED + title: + type: string + GroupedProcessDefinitionResponse: + type: object + properties: + groups: + type: array + items: + $ref: '#/components/schemas/ProcessDefinitionGroup' + ungrouped: + type: array + items: + $ref: '#/components/schemas/ProcessDefinitionResponse' + ProcessDefinitionGroup: + type: object + properties: + name: + type: string + processDefinitions: + type: array + items: + $ref: '#/components/schemas/ProcessDefinitionResponse' diff --git a/docs/en/modules/arch/attachments/architecture/platform-api/services/user-settings-service-api-swagger.yml b/docs/en/modules/arch/attachments/architecture/platform-api/services/user-settings-service-api-swagger.yml new file mode 100644 index 0000000000..e113792eab --- /dev/null +++ b/docs/en/modules/arch/attachments/architecture/platform-api/services/user-settings-service-api-swagger.yml @@ -0,0 +1,404 @@ +openapi: 3.0.3 +info: + title: User settings service API + description: This document describes REST API of 'User settings service' + version: "1.0" +tags: +- name: user-settings-service-api + description: User settings service Rest API +paths: + /api/settings/me/channels/{channel}/verify: + post: + tags: + - user-settings-service-api + summary: Verify channel address + description: |- + ### Endpoint purpose: + This endpoint allows to send verification code to channel address + ### User verification: + For _diia_ channel expecting not one of _unregistered-officer_ or _officer_ user roles from _X-Access-Token_, for other channels user roles must not be empty, otherwise _403 Forbidden_ status code returned. + operationId: verifyChannelAddress + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: channel + in: path + required: true + schema: + type: string + enum: + - email + - diia + - inbox + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/VerificationInputDto' + example: + address: new@email.com + required: true + responses: + "200": + description: Returns verification code expiration in seconds + content: + '*/*': + schema: + $ref: '#/components/schemas/VerificationCodeExpirationDto' + example: + verificationCodeExpirationSec: 30 + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: User role verification failed + content: + '*/*': + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "500": + description: Internal server error + content: + '*/*': + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + /api/settings/me/channels/{channel}/deactivate: + post: + tags: + - user-settings-service-api + summary: Deactivate channel + description: |- + ### Endpoint purpose: + This endpoint allows to deactivate one of predefined communication channels: _email_, _diia_ or _inbox_. + ### User verification: + For _diia_ channel expecting not one of _unregistered-officer_ or _officer_ user roles from _X-Access-Token_, for other channels user roles must not be empty, otherwise _403 Forbidden_ status code returned. + operationId: deactivateChannel + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: channel + in: path + required: true + schema: + type: string + enum: + - email + - diia + - inbox + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/SettingsDeactivateChannelInputDto' + example: + address: new@email.com + deactivationReason: User deactivated + required: true + responses: + "200": + description: Channel deactivated successfully + "400": + description: Communication channel verification failed + content: + '*/*': + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: User role verification failed + content: + '*/*': + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "500": + description: Internal server error + content: + '*/*': + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + /api/settings/me/channels/{channel}/activate: + post: + tags: + - user-settings-service-api + summary: Activate channel + description: |- + ### Endpoint purpose: + This endpoint allows to activate for user one of predefined communication channels: _email_, _diia_ or _inbox_. Accepts verification code in request body, which can be received using [POST](#user-settings-service-api/verifyChannelAddress) endpoint. + ### User verification: + For _diia_ channel expecting not one of _unregistered-officer_ or _officer_ user roles from _X-Access-Token_, for other channels user roles must not be empty, otherwise _403 Forbidden_ status code returned. + operationId: activateChannel + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: channel + in: path + required: true + schema: + type: string + enum: + - email + - diia + - inbox + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/ActivateChannelInputDto' + example: + address: new@email.com + verificationCode: "123456" + required: true + responses: + "200": + description: Channel activated successfully + "400": + description: Communication channel verification failed + content: + '*/*': + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: User role verification failed + content: + '*/*': + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "500": + description: Internal server error + content: + '*/*': + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + /api/settings/me/channels/email/validate: + post: + tags: + - user-settings-service-api + summary: Validate email address + description: |- + ### Endpoint purpose: + This endpoint allows to validate user's email address for restricted symbols in it, or verify if it's empty + operationId: validateEmailAddress + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/SettingsEmailInputDto' + example: + address: new@email.com + required: true + responses: + "200": + description: Email address validation passed + "401": + description: Unauthorized + content: + application/json: {} + "422": + description: Email address not valid or empty + content: + '*/*': + schema: + $ref: '#/components/schemas/DetailedValidationErrorResponse' + "500": + description: Internal server error + content: + '*/*': + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + /api/settings/{userId}: + get: + tags: + - user-settings-service-api + summary: Retrieve user settings based on user identifier + description: |- + ### Endpoint purpose: + This endpoint allows to retrieve the personal settings of the user, such as channels of communication. + operationId: findUserSettingsById + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: userId + in: path + required: true + schema: + type: string + format: uuid + responses: + "200": + description: Returns JSON representation of user settings + content: + '*/*': + schema: + $ref: '#/components/schemas/SettingsReadDto' + example: + settingsId: a6bf7765-1daf-4a51-8510-f1cbf2e943b0 + channels: + - channel: email + activated: true + address: new@email.com + "401": + description: Unauthorized + content: + application/json: {} + "500": + description: Internal server error + content: + '*/*': + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + /api/settings/me: + get: + tags: + - user-settings-service-api + summary: Retrieve user settings based on X-Access-Token + description: |- + ### Endpoint purpose: + This endpoint allows to retrieve the personal settings of the authenticated user, such as channels of communication. + operationId: findUserSettingsFromToken + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + responses: + "200": + description: Returns JSON representation of user settings + content: + '*/*': + schema: + $ref: '#/components/schemas/SettingsReadDto' + example: + settingsId: a6bf7765-1daf-4a51-8510-f1cbf2e943b0 + channels: + - channel: email + activated: true + address: new@email.com + "401": + description: Unauthorized + content: + application/json: {} + "500": + description: Internal server error + content: + '*/*': + schema: + $ref: '#/components/schemas/DetailedErrorResponse' +components: + schemas: + VerificationInputDto: + required: + - address + type: object + properties: + address: + type: string + VerificationCodeExpirationDto: + type: object + properties: + verificationCodeExpirationSec: + type: integer + format: int32 + DetailedErrorResponse: + type: object + properties: + traceId: + type: string + code: + type: string + details: + type: object + SettingsDeactivateChannelInputDto: + required: + - deactivationReason + type: object + properties: + address: + type: string + deactivationReason: + type: string + ActivateChannelInputDto: + required: + - address + - verificationCode + type: object + properties: + address: + type: string + verificationCode: + type: string + SettingsEmailInputDto: + required: + - address + type: object + properties: + address: + type: string + DetailedValidationErrorResponse: + type: object + properties: + traceId: + type: string + code: + type: string + message: + type: string + localizedMessage: + type: string + ChannelReadDto: + type: object + properties: + channel: + type: string + enum: + - email + - diia + - inbox + activated: + type: boolean + address: + type: string + deactivationReason: + type: string + SettingsReadDto: + type: object + properties: + settingsId: + type: string + format: uuid + channels: + type: array + items: + $ref: '#/components/schemas/ChannelReadDto' diff --git a/docs/en/modules/arch/attachments/architecture/platform-api/services/user-task-management-swagger.yml b/docs/en/modules/arch/attachments/architecture/platform-api/services/user-task-management-swagger.yml new file mode 100644 index 0000000000..87d1dd1ed7 --- /dev/null +++ b/docs/en/modules/arch/attachments/architecture/platform-api/services/user-task-management-swagger.yml @@ -0,0 +1,754 @@ +openapi: 3.0.3 +info: + title: User task management API + description: All user task management operations + version: "1.0" +tags: +- name: user-task-management-api + description: User task management Rest API +paths: + /api/task/{id}/save: + post: + tags: + - user-task-management-api + summary: Save form data + description: |- + ### Endpoint purpose: + This endpoint allows to save form data to temporary storage without task completion. + ### Authorization: + If user assigned to task does not match user retrieved from _X-Access-Token_ then _403 Forbidden_ status code returned. + ### Form validation: + This endpoint requires valid form, if form provided in request body does not match form structure assigned to task, then _422_ status code returned. + operationId: saveFormData + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: id + in: path + required: true + schema: + type: string + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/FormDataDto' + example: + data: + formFieldName1: field value 1 + formFieldName2: field value 2 + required: true + responses: + "200": + description: Form data successfully saved + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden + content: + '*/*': + schema: + $ref: '#/components/schemas/SystemErrorDto' + "404": + description: Task hasn't found + content: + '*/*': + schema: + $ref: '#/components/schemas/SystemErrorDto' + "422": + description: Form data validation error + content: + '*/*': + schema: + $ref: '#/components/schemas/ValidationErrorDto' + "500": + description: Internal server error + content: + '*/*': + schema: + $ref: '#/components/schemas/SystemErrorDto' + /api/task/{id}/complete: + post: + tags: + - user-task-management-api + summary: Complete task by id + description: |- + ### Endpoint purpose: + This endpoint allows users to complete a specific task by providing its unique identifier. Users must include the necessary data in the request body using a FormDataDto. Upon successful completion, information about the completed task is returned. + ### Authorization: + If user assigned to task does not match user retrieved from _X-Access-Token_ then _403 Forbidden_ status code returned. + ### Form validation: + This endpoint requires valid form, if form provided in request body does not match form structure assigned to task, then _422_ status code returned. + operationId: completeTaskById + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: id + in: path + required: true + schema: + type: string + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/FormDataDto' + example: + data: + formFieldName1: field value 1 + formFieldName2: field value 2 + required: true + responses: + "200": + description: Task successfully completed + content: + '*/*': + schema: + $ref: '#/components/schemas/CompletedTaskResponse' + example: + id: d5a4eddf-6360-11ee-88e8-0a580a81041b + processInstanceId: d5a40376-6360-11ee-88e8-0a580a81041b + rootProcessInstanceId: d5a40376-6360-11ee-88e8-0a580a81041b + rootProcessInstanceEnded: false + variables: {} + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden + content: + '*/*': + schema: + $ref: '#/components/schemas/SystemErrorDto' + "404": + description: Task hasn't found + content: + '*/*': + schema: + $ref: '#/components/schemas/SystemErrorDto' + "422": + description: Form data is not valid + content: + '*/*': + schema: + $ref: '#/components/schemas/SystemErrorDto' + "500": + description: Internal server error + content: + '*/*': + schema: + $ref: '#/components/schemas/SystemErrorDto' + /api/task/{id}/claim: + post: + tags: + - user-task-management-api + summary: Claim task by id + description: |- + ### Endpoint purpose: + This endpoint allows users to claim a task by its unique identifier. Once a task is claimed, it becomes the responsibility of the user who claimed it and is no longer available for other users to claim. + operationId: claimTaskById + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: id + in: path + required: true + schema: + type: string + responses: + "204": + description: Task successfully claimed + "404": + description: Task hasn't found or already completed + content: + '*/*': + schema: + $ref: '#/components/schemas/SystemErrorDto' + "409": + description: Task already assigned on another person + content: + '*/*': + schema: + $ref: '#/components/schemas/SystemErrorDto' + "500": + description: Internal server error + content: + '*/*': + schema: + $ref: '#/components/schemas/SystemErrorDto' + /api/officer/task/{id}/sign-form: + post: + tags: + - user-task-management-api + summary: Sign and complete officer task by id + description: |- + ### Endpoint purpose: + This endpoint allows officer to sign form data for a specific task. Users must provide the task's unique identifier and the required form data with signature in the request body. Upon successful signing, information about the task is returned. + ### Authorization: + If user assigned to task does not match user retrieved from _X-Access-Token_ then _403 Forbidden_ status code returned. + ### Form and signature validation: + This endpoint requires valid form, if form provided in request body does not match form structure assigned to task or verification of provided signature is failed, then _422_ status code returned. + operationId: singOfficerForm + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: id + in: path + required: true + schema: + type: string + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/FormDataDto' + example: + data: + formFieldName1: field value 1 + formFieldName2: field value 2 + signature: Key-6.dat + required: true + responses: + "200": + description: Task successfully signed and completed + content: + '*/*': + schema: + $ref: '#/components/schemas/CompletedTaskResponse' + example: + id: fed535d9-6360-11ee-88e8-0a580a81041b + processInstanceId: d5a40376-6360-11ee-88e8-0a580a81041b + rootProcessInstanceId: d5a40376-6360-11ee-88e8-0a580a81041b + rootProcessInstanceEnded: true + variables: {} + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden + content: + '*/*': + schema: + $ref: '#/components/schemas/SystemErrorDto' + "404": + description: Task hasn't found + content: + '*/*': + schema: + $ref: '#/components/schemas/SystemErrorDto' + "422": + description: Task hasn't verified + content: + '*/*': + schema: + $ref: '#/components/schemas/ValidationErrorDto' + "500": + description: Internal server error + content: + '*/*': + schema: + $ref: '#/components/schemas/SystemErrorDto' + /api/citizen/task/{id}/sign-form: + post: + tags: + - user-task-management-api + summary: Sign and complete citizen task by id + description: |- + ### Endpoint purpose: + This endpoint allows citizen to sign form data for a specific task. Users must provide the task's unique identifier and the required form data with signature in the request body. Upon successful signing, information about the task is returned. + ### Authorization: + If user assigned to task does not match user retrieved from _X-Access-Token_ then _403 Forbidden_ status code returned. + ### Form and signature validation: + This endpoint requires valid form, if form provided in request body does not match form structure assigned to task or verification of provided signature is failed, then _422_ status code returned. + operationId: signCitizenForm + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: id + in: path + required: true + schema: + type: string + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/FormDataDto' + example: + data: + formFieldName1: field value 1 + formFieldName2: field value 2 + signature: Key-6.dat + required: true + responses: + "200": + description: Task successfully signed and completed + content: + '*/*': + schema: + $ref: '#/components/schemas/CompletedTaskResponse' + example: + id: fed535d9-6360-11ee-88e8-0a580a81041b + processInstanceId: d5a40376-6360-11ee-88e8-0a580a81041b + rootProcessInstanceId: d5a40376-6360-11ee-88e8-0a580a81041b + rootProcessInstanceEnded: true + variables: {} + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden + content: + '*/*': + schema: + $ref: '#/components/schemas/SystemErrorDto' + "404": + description: Task hasn't found + content: + '*/*': + schema: + $ref: '#/components/schemas/SystemErrorDto' + "422": + description: Task hasn't verified + content: + '*/*': + schema: + $ref: '#/components/schemas/ValidationErrorDto' + "500": + description: Internal server error + content: + '*/*': + schema: + $ref: '#/components/schemas/SystemErrorDto' + /api/task: + get: + tags: + - user-task-management-api + summary: Retrieve all tasks + description: |- + ### Endpoint purpose: + This endpoint allows users to retrieve a list of tasks associated with a specified process instance or user. Users can optionally filter tasks by providing a process instance ID. Pagination is supported via the pageable parameter. The endpoint returns a list of UserTaskResponse objects, each representing a retrieved task. + operationId: getTasks + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: processInstanceId + in: query + required: false + schema: + type: string + - name: firstResult + in: query + description: Pagination of results. Specifies the index of the first result + to return. + schema: + type: integer + - name: maxResult + in: query + description: Pagination of results. Specifies the maximum number of results + to return. Will return less results if there are no more results left. + schema: + type: integer + - name: sortBy + in: query + description: "Sort the results lexicographically by a given criterion. Valid\ + \ values are instanceId, caseInstanceId, dueDate, executionId, caseExecutionId,assignee,\ + \ created, description, id, name, nameCaseInsensitive and priority. Must\ + \ be used in conjunction with the sortOrder parameter." + schema: + type: string + - name: sortOrder + in: query + description: Sort the results in a given order. Values may be asc for ascending + order or desc for descending order. Must be used in conjunction with the + sortBy parameter. + schema: + type: string + responses: + "200": + description: List of user tasks + content: + '*/*': + schema: + $ref: '#/components/schemas/UserTaskResponse' + example: + - id: 0b52527c-62ae-11ee-be57-0a580a810416 + taskDefinitionKey: UserTask_AddStatus + name: my task name + assignee: user + created: 2023-10-04T12:03:34.884Z + description: some description + processDefinitionName: my process name + processInstanceId: fd3187f5-62ad-11ee-be57-0a580a810415 + processDefinitionId: Process_160gicr:14:b8fa558e-62aa-11ee-be57-0a580a810416 + formKey: null + suspended: false + businessKey: null + "401": + description: Unauthorized + content: + application/json: {} + "500": + description: Internal server error + content: + application/json: {} + /api/task/{id}: + get: + tags: + - user-task-management-api + summary: Get task by id + description: |- + ### Endpoint purpose: + This endpoint allows users to retrieve detailed information about a specific task by providing its unique identifier (ID). The task details include information such as task status, assignee, due date, and other relevant data. + operationId: getTaskById + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: id + in: path + required: true + schema: + type: string + responses: + "200": + description: Returns detailed task information + content: + '*/*': + schema: + $ref: '#/components/schemas/SignableDataUserTaskResponse' + example: + id: 97839db1-62b2-11ee-be57-0a580a810415 + taskDefinitionKey: UserTask_SignSuccessfulStatusActivity + name: Sign data + assignee: user + created: 2023-10-04T12:36:08.075Z + description: null + processInstanceId: 81ae5334-62b2-11ee-be57-0a580a810415 + rootProcessInstanceId: 81ae5334-62b2-11ee-be57-0a580a810415 + processDefinitionId: Process_160gicr:15:4ef94837-62b0-11ee-be57-0a580a810415 + processDefinitionName: my-process + formKey: my-user-task-form + suspended: false + formVariables: {} + signatureValidationPack: [] + data: + myField: myValue + submit: true + esign: true + "401": + description: Unauthorized + content: + application/json: {} + "404": + description: Not found + content: + '*/*': + schema: + $ref: '#/components/schemas/SystemErrorDto' + "500": + description: Internal server error + content: + application/json: {} + /api/task/lightweight: + get: + tags: + - user-task-management-api + summary: Retrieve all tasks + description: |- + ### Endpoint purpose: + This endpoint allows users to retrieve a lightweight list of tasks associated with a specified process instance or user. Users can optionally filter tasks by providing a root process instance ID. The endpoint returns a list of lightweight user tasks. This lightweight version of the task list provides essential task details for efficient display purposes. + operationId: getLightweightTasks + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: rootProcessInstanceId + in: query + required: false + schema: + type: string + - name: firstResult + in: query + description: Pagination of results. Specifies the index of the first result + to return. + schema: + type: integer + - name: maxResult + in: query + description: Pagination of results. Specifies the maximum number of results + to return. Will return less results if there are no more results left. + schema: + type: integer + - name: sortBy + in: query + description: "Sort the results lexicographically by a given criterion. Valid\ + \ values are instanceId, caseInstanceId, dueDate, executionId, caseExecutionId,assignee,\ + \ created, description, id, name, nameCaseInsensitive and priority. Must\ + \ be used in conjunction with the sortOrder parameter." + schema: + type: string + - name: sortOrder + in: query + description: Sort the results in a given order. Values may be asc for ascending + order or desc for descending order. Must be used in conjunction with the + sortBy parameter. + schema: + type: string + responses: + "200": + description: List of user lightweight tasks + content: + '*/*': + schema: + $ref: '#/components/schemas/UserTaskLightweightResponse' + example: |- + [ + { + "id": "0b52527c-62ae-11ee-be57-0a580a810416", + "assignee": "user", + }, + { + "id": "0b52527c-62ae-11ee-be57-0a580a2132312", + "assignee": "user", + } + ] + "401": + description: Unauthorized + content: + application/json: {} + "500": + description: Internal server error + content: + application/json: {} + /api/task/count: + get: + tags: + - user-task-management-api + summary: Retrieve count of all tasks + description: |- + ### Endpoint purpose: + This endpoint allows to retrieve the total count of all available tasks for user. + operationId: countTasks + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + responses: + "200": + description: Returns detailed task information + content: + '*/*': + schema: + $ref: '#/components/schemas/CountResponse' + example: |- + { + "count": 10, + } + "401": + description: Unauthorized + content: + application/json: {} +components: + schemas: + FormDataDto: + type: object + properties: + data: + type: object + additionalProperties: + type: object + signature: + type: string + x-access-token: + type: string + SystemErrorDto: + type: object + properties: + traceId: + type: string + code: + type: string + message: + type: string + localizedMessage: + type: string + ErrorDetailDto: + type: object + properties: + message: + type: string + field: + type: string + value: + type: string + ErrorsListDto: + type: object + properties: + errors: + type: array + items: + $ref: '#/components/schemas/ErrorDetailDto' + ValidationErrorDto: + type: object + properties: + traceId: + type: string + code: + type: string + message: + type: string + details: + $ref: '#/components/schemas/ErrorsListDto' + CompletedTaskResponse: + type: object + properties: + id: + type: string + processInstanceId: + type: string + rootProcessInstanceId: + type: string + rootProcessInstanceEnded: + type: boolean + variables: + type: object + additionalProperties: + $ref: '#/components/schemas/VariableValueResponse' + VariableValueResponse: + type: object + properties: + type: + type: string + value: + type: object + valueInfo: + type: object + additionalProperties: + type: object + UserTaskResponse: + type: object + properties: + id: + type: string + taskDefinitionKey: + type: string + name: + type: string + assignee: + type: string + created: + type: string + format: date-time + description: + type: string + processDefinitionName: + type: string + processInstanceId: + type: string + processDefinitionId: + type: string + formKey: + type: string + suspended: + type: boolean + businessKey: + type: string + SignableDataUserTaskResponse: + type: object + properties: + id: + type: string + taskDefinitionKey: + type: string + name: + type: string + assignee: + type: string + created: + type: string + format: date-time + description: + type: string + processInstanceId: + type: string + rootProcessInstanceId: + type: string + processDefinitionId: + type: string + processDefinitionName: + type: string + formKey: + type: string + suspended: + type: boolean + formVariables: + type: object + additionalProperties: + type: object + signatureValidationPack: + uniqueItems: true + type: array + items: + type: string + enum: + - INDIVIDUAL + - ENTREPRENEUR + - LEGAL + data: + type: object + additionalProperties: + type: object + esign: + type: boolean + UserTaskLightweightResponse: + type: object + properties: + id: + type: string + assignee: + type: string + CountResponse: + type: object + properties: + count: + type: integer + format: int64 diff --git a/docs/en/modules/arch/attachments/architecture/platform-system-requirements/registry-cost-calculator.xlsx b/docs/en/modules/arch/attachments/architecture/platform-system-requirements/registry-cost-calculator.xlsx new file mode 100644 index 0000000000..3ac313c65b Binary files /dev/null and b/docs/en/modules/arch/attachments/architecture/platform-system-requirements/registry-cost-calculator.xlsx differ diff --git a/docs/en/modules/arch/attachments/architecture/platform/operational/monitoring/camunda-metrics/camunda-metrics.json b/docs/en/modules/arch/attachments/architecture/platform/operational/monitoring/camunda-metrics/camunda-metrics.json new file mode 100644 index 0000000000..18bc9b397d --- /dev/null +++ b/docs/en/modules/arch/attachments/architecture/platform/operational/monitoring/camunda-metrics/camunda-metrics.json @@ -0,0 +1,2014 @@ +{ + "annotations": { + "list": [ + { + "builtIn": 1, + "datasource": "-- Grafana --", + "enable": true, + "hide": true, + "iconColor": "rgba(0, 211, 255, 1)", + "name": "Annotations & Alerts", + "type": "dashboard" + } + ] + }, + "description": "Camunda Metrics Dashboard", + "editable": true, + "gnetId": null, + "graphTooltip": 0, + "id": 1, + "links": [], + "panels": [ + { + "collapsed": true, + "datasource": null, + "gridPos": { + "h": 1, + "w": 24, + "x": 0, + "y": 0 + }, + "id": 21, + "panels": [ + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": null, + "fieldConfig": { + "defaults": { + "custom": {} + }, + "overrides": [] + }, + "fill": 1, + "fillGradient": 0, + "gridPos": { + "h": 8, + "w": 12, + "x": 0, + "y": 1 + }, + "hiddenSeries": false, + "id": 6, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "nullPointMode": "null", + "options": { + "alertThreshold": true + }, + "percentage": false, + "pluginVersion": "7.3.6", + "pointradius": 2, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "camunda_active_process_instances", + "interval": "", + "legendFormat": "", + "refId": "A" + } + ], + "thresholds": [], + "timeFrom": null, + "timeRegions": [], + "timeShift": null, + "title": "Active Process Instances", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": null, + "fieldConfig": { + "defaults": { + "custom": {} + }, + "overrides": [] + }, + "fill": 1, + "fillGradient": 0, + "gridPos": { + "h": 8, + "w": 12, + "x": 12, + "y": 1 + }, + "hiddenSeries": false, + "id": 8, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "nullPointMode": "null", + "options": { + "alertThreshold": true + }, + "percentage": false, + "pluginVersion": "7.3.6", + "pointradius": 2, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "camunda_completed_process_instances", + "interval": "", + "legendFormat": "", + "refId": "A" + } + ], + "thresholds": [], + "timeFrom": null, + "timeRegions": [], + "timeShift": null, + "title": "Completed Process Instances", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + } + ], + "title": "Process Instances", + "type": "row" + }, + { + "collapsed": true, + "datasource": null, + "gridPos": { + "h": 1, + "w": 24, + "x": 0, + "y": 1 + }, + "id": 48, + "panels": [ + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": null, + "fieldConfig": { + "defaults": { + "custom": {} + }, + "overrides": [] + }, + "fill": 1, + "fillGradient": 0, + "gridPos": { + "h": 8, + "w": 12, + "x": 0, + "y": 1 + }, + "hiddenSeries": false, + "id": 50, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "nullPointMode": "null", + "options": { + "alertThreshold": true + }, + "percentage": false, + "pluginVersion": "7.3.6", + "pointradius": 2, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "camunda_active_process_definitions", + "interval": "", + "legendFormat": "", + "refId": "A" + } + ], + "thresholds": [], + "timeFrom": null, + "timeRegions": [], + "timeShift": null, + "title": "Active Process Definitions", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + } + ], + "title": "Process Definitions", + "type": "row" + }, + { + "collapsed": true, + "datasource": null, + "gridPos": { + "h": 1, + "w": 24, + "x": 0, + "y": 2 + }, + "id": 56, + "panels": [ + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": null, + "description": "", + "fieldConfig": { + "defaults": { + "custom": {} + }, + "overrides": [] + }, + "fill": 1, + "fillGradient": 0, + "gridPos": { + "h": 8, + "w": 12, + "x": 0, + "y": 1 + }, + "hiddenSeries": false, + "id": 58, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "nullPointMode": "null", + "options": { + "alertThreshold": true + }, + "percentage": false, + "pluginVersion": "7.3.6", + "pointradius": 2, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "camunda_deployments", + "interval": "", + "legendFormat": "", + "refId": "A" + } + ], + "thresholds": [], + "timeFrom": null, + "timeRegions": [], + "timeShift": null, + "title": "Active Deployments", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + } + ], + "title": "Deployments", + "type": "row" + }, + { + "collapsed": true, + "datasource": null, + "gridPos": { + "h": 1, + "w": 24, + "x": 0, + "y": 3 + }, + "id": 19, + "panels": [ + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": null, + "fieldConfig": { + "defaults": { + "custom": {} + }, + "overrides": [] + }, + "fill": 1, + "fillGradient": 0, + "gridPos": { + "h": 8, + "w": 12, + "x": 0, + "y": 9 + }, + "hiddenSeries": false, + "id": 10, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "nullPointMode": "null", + "options": { + "alertThreshold": true + }, + "percentage": false, + "pluginVersion": "7.3.6", + "pointradius": 2, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "camunda_active_incidents", + "interval": "", + "legendFormat": "", + "refId": "A" + } + ], + "thresholds": [], + "timeFrom": null, + "timeRegions": [], + "timeShift": null, + "title": "Active Incidents", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + } + ], + "title": "Incidents", + "type": "row" + }, + { + "collapsed": true, + "datasource": null, + "gridPos": { + "h": 1, + "w": 24, + "x": 0, + "y": 4 + }, + "id": 36, + "panels": [ + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": null, + "description": "Timers that are ready to be executed (past due date)", + "fieldConfig": { + "defaults": { + "custom": {} + }, + "overrides": [] + }, + "fill": 1, + "fillGradient": 0, + "gridPos": { + "h": 8, + "w": 6, + "x": 0, + "y": 4 + }, + "hiddenSeries": false, + "id": 38, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "nullPointMode": "null", + "options": { + "alertThreshold": true + }, + "percentage": false, + "pluginVersion": "7.3.6", + "pointradius": 2, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "camunda_executable_timer_jobs", + "interval": "", + "legendFormat": "", + "refId": "A" + } + ], + "thresholds": [], + "timeFrom": null, + "timeRegions": [], + "timeShift": null, + "title": "Executable Timer Jobs", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": null, + "fieldConfig": { + "defaults": { + "custom": {} + }, + "overrides": [] + }, + "fill": 1, + "fillGradient": 0, + "gridPos": { + "h": 8, + "w": 6, + "x": 6, + "y": 4 + }, + "hiddenSeries": false, + "id": 34, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "nullPointMode": "null", + "options": { + "alertThreshold": true + }, + "percentage": false, + "pluginVersion": "7.3.6", + "pointradius": 2, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "camunda_timer_jobs", + "interval": "", + "legendFormat": "", + "refId": "A" + } + ], + "thresholds": [], + "timeFrom": null, + "timeRegions": [], + "timeShift": null, + "title": "Timer Jobs", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + } + ], + "title": "Timers", + "type": "row" + }, + { + "collapsed": true, + "datasource": null, + "gridPos": { + "h": 1, + "w": 24, + "x": 0, + "y": 5 + }, + "id": 25, + "panels": [ + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": null, + "fieldConfig": { + "defaults": { + "custom": {} + }, + "overrides": [] + }, + "fill": 1, + "fillGradient": 0, + "gridPos": { + "h": 8, + "w": 12, + "x": 0, + "y": 6 + }, + "hiddenSeries": false, + "id": 4, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "nullPointMode": "null", + "options": { + "alertThreshold": true + }, + "percentage": false, + "pluginVersion": "7.3.6", + "pointradius": 2, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "camunda_active_user_tasks", + "interval": "", + "legendFormat": "", + "refId": "A" + } + ], + "thresholds": [], + "timeFrom": null, + "timeRegions": [], + "timeShift": null, + "title": "Active User Tasks", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + } + ], + "title": "User Tasks", + "type": "row" + }, + { + "collapsed": true, + "datasource": null, + "gridPos": { + "h": 1, + "w": 24, + "x": 0, + "y": 6 + }, + "id": 46, + "panels": [ + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": null, + "description": "Jobs ready to be executed (past due date)", + "fieldConfig": { + "defaults": { + "custom": {} + }, + "overrides": [] + }, + "fill": 1, + "fillGradient": 0, + "gridPos": { + "h": 7, + "w": 6, + "x": 0, + "y": 6 + }, + "hiddenSeries": false, + "id": 44, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "nullPointMode": "null", + "options": { + "alertThreshold": true + }, + "percentage": false, + "pluginVersion": "7.3.6", + "pointradius": 2, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "camunda_executable_jobs", + "interval": "", + "legendFormat": "", + "refId": "A" + } + ], + "thresholds": [], + "timeFrom": null, + "timeRegions": [], + "timeShift": null, + "title": "Executable Jobs", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": null, + "fieldConfig": { + "defaults": { + "custom": {} + }, + "overrides": [] + }, + "fill": 1, + "fillGradient": 0, + "gridPos": { + "h": 7, + "w": 6, + "x": 6, + "y": 6 + }, + "hiddenSeries": false, + "id": 40, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "nullPointMode": "null", + "options": { + "alertThreshold": true + }, + "percentage": false, + "pluginVersion": "7.3.6", + "pointradius": 2, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "camunda_message_jobs", + "interval": "", + "legendFormat": "", + "refId": "A" + } + ], + "thresholds": [], + "timeFrom": null, + "timeRegions": [], + "timeShift": null, + "title": "Message Jobs", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + } + ], + "title": "Jobs", + "type": "row" + }, + { + "collapsed": true, + "datasource": null, + "gridPos": { + "h": 1, + "w": 24, + "x": 0, + "y": 7 + }, + "id": 14, + "panels": [ + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": null, + "fieldConfig": { + "defaults": { + "custom": {} + }, + "overrides": [] + }, + "fill": 1, + "fillGradient": 0, + "gridPos": { + "h": 8, + "w": 7, + "x": 0, + "y": 10 + }, + "hiddenSeries": false, + "id": 12, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "nullPointMode": "null", + "options": { + "alertThreshold": true + }, + "percentage": false, + "pluginVersion": "7.3.6", + "pointradius": 2, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "camunda_active_external_tasks", + "interval": "", + "legendFormat": "", + "refId": "A" + } + ], + "thresholds": [], + "timeFrom": null, + "timeRegions": [], + "timeShift": null, + "title": "Active External Tasks", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": null, + "fieldConfig": { + "defaults": { + "custom": {} + }, + "overrides": [] + }, + "fill": 1, + "fillGradient": 0, + "gridPos": { + "h": 8, + "w": 7, + "x": 7, + "y": 10 + }, + "hiddenSeries": false, + "id": 16, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "nullPointMode": "null", + "options": { + "alertThreshold": true + }, + "percentage": false, + "pluginVersion": "7.3.6", + "pointradius": 2, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "camunda_active_locked_external_tasks", + "interval": "", + "legendFormat": "", + "refId": "A" + } + ], + "thresholds": [], + "timeFrom": null, + "timeRegions": [], + "timeShift": null, + "title": "Active Locked External Tasks", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": null, + "fieldConfig": { + "defaults": { + "custom": {} + }, + "overrides": [] + }, + "fill": 1, + "fillGradient": 0, + "gridPos": { + "h": 8, + "w": 7, + "x": 14, + "y": 10 + }, + "hiddenSeries": false, + "id": 17, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "nullPointMode": "null", + "options": { + "alertThreshold": true + }, + "percentage": false, + "pluginVersion": "7.3.6", + "pointradius": 2, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "camunda_active_not_locked_external_tasks", + "interval": "", + "legendFormat": "", + "refId": "A" + } + ], + "thresholds": [], + "timeFrom": null, + "timeRegions": [], + "timeShift": null, + "title": "Active Not Locked External Tasks", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + } + ], + "title": "External Tasks", + "type": "row" + }, + { + "collapsed": true, + "datasource": null, + "gridPos": { + "h": 1, + "w": 24, + "x": 0, + "y": 8 + }, + "id": 27, + "panels": [ + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": null, + "fieldConfig": { + "defaults": { + "custom": {} + }, + "overrides": [] + }, + "fill": 1, + "fillGradient": 0, + "gridPos": { + "h": 7, + "w": 5, + "x": 0, + "y": 8 + }, + "hiddenSeries": false, + "id": 29, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "nullPointMode": "null", + "options": { + "alertThreshold": true + }, + "percentage": false, + "pluginVersion": "7.3.6", + "pointradius": 2, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "camunda_active_message_event_subscriptions", + "interval": "", + "legendFormat": "", + "refId": "A" + } + ], + "thresholds": [], + "timeFrom": null, + "timeRegions": [], + "timeShift": null, + "title": "Active Message Event Subscriptions", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": null, + "fieldConfig": { + "defaults": { + "custom": {} + }, + "overrides": [] + }, + "fill": 1, + "fillGradient": 0, + "gridPos": { + "h": 7, + "w": 5, + "x": 5, + "y": 8 + }, + "hiddenSeries": false, + "id": 30, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "nullPointMode": "null", + "options": { + "alertThreshold": true + }, + "percentage": false, + "pluginVersion": "7.3.6", + "pointradius": 2, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "camunda_active_signal_event_subscriptions", + "interval": "", + "legendFormat": "", + "refId": "A" + } + ], + "thresholds": [], + "timeFrom": null, + "timeRegions": [], + "timeShift": null, + "title": "Active Signal Event Subscriptions", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": null, + "fieldConfig": { + "defaults": { + "custom": {} + }, + "overrides": [] + }, + "fill": 1, + "fillGradient": 0, + "gridPos": { + "h": 7, + "w": 5, + "x": 10, + "y": 8 + }, + "hiddenSeries": false, + "id": 31, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "nullPointMode": "null", + "options": { + "alertThreshold": true + }, + "percentage": false, + "pluginVersion": "7.3.6", + "pointradius": 2, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "camunda_active_compensate_event_subscriptions", + "interval": "", + "legendFormat": "", + "refId": "A" + } + ], + "thresholds": [], + "timeFrom": null, + "timeRegions": [], + "timeShift": null, + "title": "Active Compensate Event Subscriptions", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": null, + "fieldConfig": { + "defaults": { + "custom": {} + }, + "overrides": [] + }, + "fill": 1, + "fillGradient": 0, + "gridPos": { + "h": 7, + "w": 5, + "x": 15, + "y": 8 + }, + "hiddenSeries": false, + "id": 32, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "nullPointMode": "null", + "options": { + "alertThreshold": true + }, + "percentage": false, + "pluginVersion": "7.3.6", + "pointradius": 2, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "camunda_active_conditional_event_subscriptions", + "interval": "", + "legendFormat": "", + "refId": "A" + } + ], + "thresholds": [], + "timeFrom": null, + "timeRegions": [], + "timeShift": null, + "title": "Active Conditional Event Subscriptions", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + } + ], + "title": "Event Subscriptions", + "type": "row" + }, + { + "collapsed": true, + "datasource": null, + "gridPos": { + "h": 1, + "w": 24, + "x": 0, + "y": 9 + }, + "id": 23, + "panels": [ + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": null, + "fieldConfig": { + "defaults": { + "custom": {} + }, + "overrides": [] + }, + "fill": 1, + "fillGradient": 0, + "gridPos": { + "h": 9, + "w": 12, + "x": 0, + "y": 6 + }, + "hiddenSeries": false, + "id": 2, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "nullPointMode": "null", + "options": { + "alertThreshold": true + }, + "percentage": false, + "pluginVersion": "7.3.6", + "pointradius": 2, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "camunda_user_count", + "interval": "", + "legendFormat": "", + "refId": "A" + } + ], + "thresholds": [], + "timeFrom": null, + "timeRegions": [], + "timeShift": null, + "title": "User Count", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + } + ], + "title": "Users", + "type": "row" + }, + { + "collapsed": true, + "datasource": null, + "gridPos": { + "h": 1, + "w": 24, + "x": 0, + "y": 10 + }, + "id": 54, + "panels": [ + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": null, + "fieldConfig": { + "defaults": { + "custom": {} + }, + "overrides": [] + }, + "fill": 1, + "fillGradient": 0, + "gridPos": { + "h": 8, + "w": 12, + "x": 0, + "y": 7 + }, + "hiddenSeries": false, + "id": 52, + "legend": { + "avg": false, + "current": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "nullPointMode": "null", + "options": { + "alertThreshold": true + }, + "percentage": false, + "pluginVersion": "7.3.6", + "pointradius": 2, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "camunda_tenant_count", + "interval": "", + "legendFormat": "", + "refId": "A" + } + ], + "thresholds": [], + "timeFrom": null, + "timeRegions": [], + "timeShift": null, + "title": "Tenant Count", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + } + ], + "title": "Tenants", + "type": "row" + } + ], + "refresh": "5s", + "schemaVersion": 26, + "style": "dark", + "tags": [ + "camunda" + ], + "templating": { + "list": [] + }, + "time": { + "from": "now-1h", + "to": "now" + }, + "timepicker": {}, + "timezone": "", + "title": "Camunda Metrics Dashboard", + "uid": "YpL9Um9Mk", + "version": 4 +} \ No newline at end of file diff --git a/docs/en/modules/arch/attachments/architecture/registry/administrative/regulation-management/admin-portal/DataModelSnapshot.json b/docs/en/modules/arch/attachments/architecture/registry/administrative/regulation-management/admin-portal/DataModelSnapshot.json new file mode 100644 index 0000000000..ef9b7b7d30 --- /dev/null +++ b/docs/en/modules/arch/attachments/architecture/registry/administrative/regulation-management/admin-portal/DataModelSnapshot.json @@ -0,0 +1,1295 @@ +{ + "ddmTables" : { + "refusal_reason" : { + "name" : "refusal_reason", + "historyFlag" : null, + "objectReference" : null, + "description" : "Довідник підстав для відмов", + "columns" : { + "name" : { + "name" : "name", + "description" : "Підстава для відмови", + "type" : "text", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "refusal_reason" + }, + "constant_code" : { + "name" : "constant_code", + "description" : "Символьна константа", + "type" : "text", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "refusal_reason" + }, + "refusal_reason_id" : { + "name" : "refusal_reason_id", + "description" : "Ідентифікатор підстав для відмов", + "type" : "uuid", + "defaultValue" : "uuid_generate_v4()", + "notNullFlag" : true, + "tableName" : "refusal_reason" + }, + "document_type" : { + "name" : "document_type", + "description" : "Класифікаційна ознака", + "type" : "text", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "refusal_reason" + } + }, + "foreignKeys" : { }, + "primaryKey" : { + "name" : "pk_refusal_reason_id", + "columns" : [ { + "name" : "refusal_reason_id", + "sorting" : "ASC" + } ], + "tableName" : "refusal_reason" + }, + "uniqueConstraints" : { + "refusal_reason_name_key" : { + "name" : "refusal_reason_name_key", + "columns" : [ { + "name" : "name", + "sorting" : "ASC" + } ], + "tableName" : "refusal_reason" + } + }, + "indices" : { } + }, + "application_type" : { + "name" : "application_type", + "historyFlag" : null, + "objectReference" : null, + "description" : "Довідник типів заяв", + "columns" : { + "name" : { + "name" : "name", + "description" : "Тип заяви", + "type" : "text", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "application_type" + }, + "application_type_id" : { + "name" : "application_type_id", + "description" : "Ідентифікатор типів заяв", + "type" : "uuid", + "defaultValue" : "uuid_generate_v4()", + "notNullFlag" : true, + "tableName" : "application_type" + }, + "constant_code" : { + "name" : "constant_code", + "description" : "Символьна константа", + "type" : "text", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "application_type" + } + }, + "foreignKeys" : { }, + "primaryKey" : { + "name" : "pk_application_type_id", + "columns" : [ { + "name" : "application_type_id", + "sorting" : "ASC" + } ], + "tableName" : "application_type" + }, + "uniqueConstraints" : { + "application_type_name_key" : { + "name" : "application_type_name_key", + "columns" : [ { + "name" : "name", + "sorting" : "ASC" + } ], + "tableName" : "application_type" + } + }, + "indices" : { } + }, + "solution_type" : { + "name" : "solution_type", + "historyFlag" : null, + "objectReference" : null, + "description" : "Довідник типів рішень", + "columns" : { + "solution_type_id" : { + "name" : "solution_type_id", + "description" : "Ідентифікатор типів рішень", + "type" : "uuid", + "defaultValue" : "uuid_generate_v4()", + "notNullFlag" : true, + "tableName" : "solution_type" + }, + "name" : { + "name" : "name", + "description" : "Тип рішення", + "type" : "text", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "solution_type" + }, + "constant_code" : { + "name" : "constant_code", + "description" : "Символьна константа", + "type" : "text", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "solution_type" + } + }, + "foreignKeys" : { }, + "primaryKey" : { + "name" : "pk_solution_type_id", + "columns" : [ { + "name" : "solution_type_id", + "sorting" : "ASC" + } ], + "tableName" : "solution_type" + }, + "uniqueConstraints" : { + "solution_type_name_key" : { + "name" : "solution_type_name_key", + "columns" : [ { + "name" : "name", + "sorting" : "ASC" + } ], + "tableName" : "solution_type" + } + }, + "indices" : { } + }, + "staff" : { + "name" : "staff", + "historyFlag" : null, + "objectReference" : null, + "description" : "Кадровий склад", + "columns" : { + "researches" : { + "name" : "researches", + "description" : "Масив ідентифікаторів досліджень", + "type" : "_uuid", + "defaultValue" : null, + "notNullFlag" : false, + "tableName" : "staff" + }, + "specialization_end_date" : { + "name" : "specialization_end_date", + "description" : "Дата закінчення спеціалізації", + "type" : "date", + "defaultValue" : null, + "notNullFlag" : false, + "tableName" : "staff" + }, + "education" : { + "name" : "education", + "description" : "Освіта, фах", + "type" : "text", + "defaultValue" : null, + "notNullFlag" : false, + "tableName" : "staff" + }, + "laboratory_id" : { + "name" : "laboratory_id", + "description" : "Ідентифікатор лабораторії", + "type" : "uuid", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "staff" + }, + "hygienist_flag" : { + "name" : "hygienist_flag", + "description" : "Лікар з гігієни праці (true) / Лаборант (false)", + "type" : "bool", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "staff" + }, + "orders_file" : { + "name" : "orders_file", + "description" : "Додатки про копії наказів", + "type" : "type_file", + "defaultValue" : null, + "notNullFlag" : false, + "tableName" : "staff" + }, + "hire_staff_file" : { + "name" : "hire_staff_file", + "description" : "Відомості про прийняття", + "type" : "type_file", + "defaultValue" : null, + "notNullFlag" : false, + "tableName" : "staff" + }, + "salary" : { + "name" : "salary", + "description" : "Ставка", + "type" : "float8", + "defaultValue" : null, + "notNullFlag" : false, + "tableName" : "staff" + }, + "hygienist_certificate_file" : { + "name" : "hygienist_certificate_file", + "description" : "Сертифікат для лікаря з гігієни праці", + "type" : "type_file", + "defaultValue" : null, + "notNullFlag" : false, + "tableName" : "staff" + }, + "contract_end_date" : { + "name" : "contract_end_date", + "description" : "Дата закінчення строкового трудового договору", + "type" : "date", + "defaultValue" : null, + "notNullFlag" : false, + "tableName" : "staff" + }, + "staff_status_id" : { + "name" : "staff_status_id", + "description" : "Ідентифікатор статусів співробітників", + "type" : "uuid", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "staff" + }, + "full_name" : { + "name" : "full_name", + "description" : "Прізвище, ім'я, по батькові", + "type" : "text", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "staff" + }, + "specialization_date" : { + "name" : "specialization_date", + "description" : "Дата проходження спеціалізації", + "type" : "date", + "defaultValue" : null, + "notNullFlag" : false, + "tableName" : "staff" + }, + "staff_id" : { + "name" : "staff_id", + "description" : "Ідентифікатор кадрової одиниці", + "type" : "uuid", + "defaultValue" : "uuid_generate_v4()", + "notNullFlag" : true, + "tableName" : "staff" + }, + "full_time_flag" : { + "name" : "full_time_flag", + "description" : "Основне місце роботи (true) / Сумісництво (false)", + "type" : "bool", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "staff" + }, + "dismissal_date" : { + "name" : "dismissal_date", + "description" : "Дата зміни статусу", + "type" : "date", + "defaultValue" : null, + "notNullFlag" : false, + "tableName" : "staff" + }, + "seniority" : { + "name" : "seniority", + "description" : "Стаж роботи за фахом", + "type" : "text", + "defaultValue" : null, + "notNullFlag" : false, + "tableName" : "staff" + }, + "fixed_term_contract_flag" : { + "name" : "fixed_term_contract_flag", + "description" : "Трудовий договір строковий?", + "type" : "bool", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "staff" + } + }, + "foreignKeys" : { + "fk_staff_status" : { + "name" : "fk_staff_status", + "targetTable" : "staff_status", + "columnPairs" : [ { + "sourceColumnName" : "staff_status_id", + "targetColumnName" : "staff_status_id" + } ], + "sourceTable" : "staff" + }, + "fk_staff_laboratory" : { + "name" : "fk_staff_laboratory", + "targetTable" : "laboratory", + "columnPairs" : [ { + "sourceColumnName" : "laboratory_id", + "targetColumnName" : "laboratory_id" + } ], + "sourceTable" : "staff" + } + }, + "primaryKey" : { + "name" : "pk_staff_id", + "columns" : [ { + "name" : "staff_id", + "sorting" : "ASC" + } ], + "tableName" : "staff" + }, + "uniqueConstraints" : { }, + "indices" : { + "ix_staff_staff_status__staff_status_id" : { + "name" : "ix_staff_staff_status__staff_status_id", + "columns" : [ { + "name" : "staff_status_id", + "sorting" : "ASC" + } ], + "tableName" : "staff" + }, + "ix_staff_laboratory__laboratory_id" : { + "name" : "ix_staff_laboratory__laboratory_id", + "columns" : [ { + "name" : "laboratory_id", + "sorting" : "ASC" + } ], + "tableName" : "staff" + } + } + }, + "staff_status" : { + "name" : "staff_status", + "historyFlag" : null, + "objectReference" : null, + "description" : "Довідник статусів співробітників", + "columns" : { + "staff_status_id" : { + "name" : "staff_status_id", + "description" : "Ідентифікатор статусів співробітників", + "type" : "uuid", + "defaultValue" : "uuid_generate_v4()", + "notNullFlag" : true, + "tableName" : "staff_status" + }, + "name" : { + "name" : "name", + "description" : "Назва статуса співробітника", + "type" : "text", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "staff_status" + }, + "constant_code" : { + "name" : "constant_code", + "description" : "Символьна константа", + "type" : "text", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "staff_status" + } + }, + "foreignKeys" : { }, + "primaryKey" : { + "name" : "pk_staff_status_id", + "columns" : [ { + "name" : "staff_status_id", + "sorting" : "ASC" + } ], + "tableName" : "staff_status" + }, + "uniqueConstraints" : { + "staff_status_name_key" : { + "name" : "staff_status_name_key", + "columns" : [ { + "name" : "name", + "sorting" : "ASC" + } ], + "tableName" : "staff_status" + } + }, + "indices" : { } + }, + "research" : { + "name" : "research", + "historyFlag" : null, + "objectReference" : null, + "description" : "Довідник типів досліджень", + "columns" : { + "research_id" : { + "name" : "research_id", + "description" : "Ідентифікатор дослідження", + "type" : "uuid", + "defaultValue" : "uuid_generate_v4()", + "notNullFlag" : true, + "tableName" : "research" + }, + "research_type" : { + "name" : "research_type", + "description" : "Тип дослідження", + "type" : "text", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "research" + } + }, + "foreignKeys" : { }, + "primaryKey" : { + "name" : "pk_research_id", + "columns" : [ { + "name" : "research_id", + "sorting" : "ASC" + } ], + "tableName" : "research" + }, + "uniqueConstraints" : { + "research_research_type_key" : { + "name" : "research_research_type_key", + "columns" : [ { + "name" : "research_type", + "sorting" : "ASC" + } ], + "tableName" : "research" + } + }, + "indices" : { } + }, + "ownership" : { + "name" : "ownership", + "historyFlag" : null, + "objectReference" : null, + "description" : "Довідник форм власності", + "columns" : { + "ownership_id" : { + "name" : "ownership_id", + "description" : "", + "type" : "uuid", + "defaultValue" : "uuid_generate_v4()", + "notNullFlag" : true, + "tableName" : "ownership" + }, + "code" : { + "name" : "code", + "description" : "Код", + "type" : "text", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "ownership" + }, + "name" : { + "name" : "name", + "description" : "Назва", + "type" : "text", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "ownership" + } + }, + "foreignKeys" : { }, + "primaryKey" : { + "name" : "pk_ownership_id", + "columns" : [ { + "name" : "ownership_id", + "sorting" : "ASC" + } ], + "tableName" : "ownership" + }, + "uniqueConstraints" : { + "ownership_name_key" : { + "name" : "ownership_name_key", + "columns" : [ { + "name" : "name", + "sorting" : "ASC" + } ], + "tableName" : "ownership" + } + }, + "indices" : { } + }, + "laboratory" : { + "name" : "laboratory", + "historyFlag" : null, + "objectReference" : null, + "description" : "Лабораторії що атестуються", + "columns" : { + "ownership_id" : { + "name" : "ownership_id", + "description" : "", + "type" : "uuid", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "laboratory" + }, + "address" : { + "name" : "address", + "description" : "", + "type" : "text", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "laboratory" + }, + "notes" : { + "name" : "notes", + "description" : "", + "type" : "text", + "defaultValue" : null, + "notNullFlag" : false, + "tableName" : "laboratory" + }, + "laboratory_id" : { + "name" : "laboratory_id", + "description" : "", + "type" : "uuid", + "defaultValue" : "uuid_generate_v4()", + "notNullFlag" : true, + "tableName" : "laboratory" + }, + "accreditation_file" : { + "name" : "accreditation_file", + "description" : "Свідоцтво про акредитацію", + "type" : "type_file", + "defaultValue" : null, + "notNullFlag" : false, + "tableName" : "laboratory" + }, + "kopfg_id" : { + "name" : "kopfg_id", + "description" : "", + "type" : "uuid", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "laboratory" + }, + "koatuu_id" : { + "name" : "koatuu_id", + "description" : "", + "type" : "uuid", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "laboratory" + }, + "accreditation_end_date" : { + "name" : "accreditation_end_date", + "description" : "", + "type" : "date", + "defaultValue" : null, + "notNullFlag" : false, + "tableName" : "laboratory" + }, + "edrpou" : { + "name" : "edrpou", + "description" : "", + "type" : "dn_edrpou", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "laboratory" + }, + "accreditation_flag" : { + "name" : "accreditation_flag", + "description" : "", + "type" : "bool", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "laboratory" + }, + "name" : { + "name" : "name", + "description" : "", + "type" : "text", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "laboratory" + }, + "head_name" : { + "name" : "head_name", + "description" : "", + "type" : "text", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "laboratory" + }, + "phone_number" : { + "name" : "phone_number", + "description" : "", + "type" : "text", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "laboratory" + }, + "premises_file" : { + "name" : "premises_file", + "description" : "Документи про приміщення", + "type" : "type_file", + "defaultValue" : null, + "notNullFlag" : false, + "tableName" : "laboratory" + } + }, + "foreignKeys" : { + "fk_laboratory_ownership" : { + "name" : "fk_laboratory_ownership", + "targetTable" : "ownership", + "columnPairs" : [ { + "sourceColumnName" : "ownership_id", + "targetColumnName" : "ownership_id" + } ], + "sourceTable" : "laboratory" + }, + "fk_laboratory_kopfg" : { + "name" : "fk_laboratory_kopfg", + "targetTable" : "kopfg", + "columnPairs" : [ { + "sourceColumnName" : "kopfg_id", + "targetColumnName" : "kopfg_id" + } ], + "sourceTable" : "laboratory" + }, + "fk_laboratory_koatuu" : { + "name" : "fk_laboratory_koatuu", + "targetTable" : "koatuu", + "columnPairs" : [ { + "sourceColumnName" : "koatuu_id", + "targetColumnName" : "koatuu_id" + } ], + "sourceTable" : "laboratory" + } + }, + "primaryKey" : { + "name" : "pk_laboratory_id", + "columns" : [ { + "name" : "laboratory_id", + "sorting" : "ASC" + } ], + "tableName" : "laboratory" + }, + "uniqueConstraints" : { + "laboratory_name_edrpou_key" : { + "name" : "laboratory_name_edrpou_key", + "columns" : [ { + "name" : "name", + "sorting" : "ASC" + }, { + "name" : "edrpou", + "sorting" : "ASC" + } ], + "tableName" : "laboratory" + } + }, + "indices" : { + "ix_laboratory_ownership__ownership_id" : { + "name" : "ix_laboratory_ownership__ownership_id", + "columns" : [ { + "name" : "ownership_id", + "sorting" : "ASC" + } ], + "tableName" : "laboratory" + }, + "ix_laboratory_koatuu__koatuu_id" : { + "name" : "ix_laboratory_koatuu__koatuu_id", + "columns" : [ { + "name" : "koatuu_id", + "sorting" : "ASC" + } ], + "tableName" : "laboratory" + }, + "ix_laboratory_subject__subject_id" : { + "name" : "ix_laboratory_subject__subject_id", + "columns" : [ { + "name" : "subject_id", + "sorting" : "ASC" + } ], + "tableName" : "laboratory" + }, + "ix_laboratory_kopfg__kopfg_id" : { + "name" : "ix_laboratory_kopfg__kopfg_id", + "columns" : [ { + "name" : "kopfg_id", + "sorting" : "ASC" + } ], + "tableName" : "laboratory" + } + } + }, + "koatuu" : { + "name" : "koatuu", + "historyFlag" : null, + "objectReference" : null, + "description" : "", + "columns" : { + "koatuu_id" : { + "name" : "koatuu_id", + "description" : "", + "type" : "uuid", + "defaultValue" : "uuid_generate_v4()", + "notNullFlag" : true, + "tableName" : "koatuu" + }, + "code" : { + "name" : "code", + "description" : "", + "type" : "text", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "koatuu" + }, + "name" : { + "name" : "name", + "description" : "", + "type" : "text", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "koatuu" + }, + "level1" : { + "name" : "level1", + "description" : "", + "type" : "text", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "koatuu" + }, + "type" : { + "name" : "type", + "description" : "", + "type" : "text", + "defaultValue" : null, + "notNullFlag" : false, + "tableName" : "koatuu" + }, + "category" : { + "name" : "category", + "description" : "", + "type" : "bpchar", + "defaultValue" : null, + "notNullFlag" : false, + "tableName" : "koatuu" + }, + "level2" : { + "name" : "level2", + "description" : "", + "type" : "text", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "koatuu" + } + }, + "foreignKeys" : { }, + "primaryKey" : { + "name" : "pk_koatuu_id", + "columns" : [ { + "name" : "koatuu_id", + "sorting" : "ASC" + } ], + "tableName" : "koatuu" + }, + "uniqueConstraints" : { }, + "indices" : { } + }, + "kopfg" : { + "name" : "kopfg", + "historyFlag" : null, + "objectReference" : null, + "description" : "Класифікація організаційно-правових форм господарювання (КОПФГ)", + "columns" : { + "kopfg_id" : { + "name" : "kopfg_id", + "description" : "", + "type" : "uuid", + "defaultValue" : "uuid_generate_v4()", + "notNullFlag" : true, + "tableName" : "kopfg" + }, + "code" : { + "name" : "code", + "description" : "Код", + "type" : "text", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "kopfg" + }, + "name" : { + "name" : "name", + "description" : "Назва", + "type" : "text", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "kopfg" + } + }, + "foreignKeys" : { }, + "primaryKey" : { + "name" : "pk_kopfg_id", + "columns" : [ { + "name" : "kopfg_id", + "sorting" : "ASC" + } ], + "tableName" : "kopfg" + }, + "uniqueConstraints" : { + "kopfg_name_key" : { + "name" : "kopfg_name_key", + "columns" : [ { + "name" : "name", + "sorting" : "ASC" + } ], + "tableName" : "kopfg" + } + }, + "indices" : { } + }, + "registration" : { + "name" : "registration", + "historyFlag" : null, + "objectReference" : null, + "description" : "Реєстраційна послуга", + "columns" : { + "exclusion_order_date" : { + "name" : "exclusion_order_date", + "description" : "Дата наказу про рішення", + "type" : "date", + "defaultValue" : null, + "notNullFlag" : false, + "tableName" : "registration" + }, + "letter_date" : { + "name" : "letter_date", + "description" : "Дата листа щодо рішення", + "type" : "date", + "defaultValue" : null, + "notNullFlag" : false, + "tableName" : "registration" + }, + "registration_source" : { + "name" : "registration_source", + "description" : "Джерело надходження заяви", + "type" : "text", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "registration" + }, + "health_ministry_letter_number" : { + "name" : "health_ministry_letter_number", + "description" : "Номер листа-відповіді МОЗ", + "type" : "text", + "defaultValue" : null, + "notNullFlag" : false, + "tableName" : "registration" + }, + "notes" : { + "name" : "notes", + "description" : "Примітки", + "type" : "text", + "defaultValue" : null, + "notNullFlag" : false, + "tableName" : "registration" + }, + "laboratory_id" : { + "name" : "laboratory_id", + "description" : "Ідентифікатор лабораторії", + "type" : "uuid", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "registration" + }, + "solution_type_id" : { + "name" : "solution_type_id", + "description" : "Ідентифікатор типів рішень", + "type" : "uuid", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "registration" + }, + "letter_no" : { + "name" : "letter_no", + "description" : "Номер листа щодо рішення", + "type" : "text", + "defaultValue" : null, + "notNullFlag" : false, + "tableName" : "registration" + }, + "zvt_file" : { + "name" : "zvt_file", + "description" : "Відомості про засоби вимірювальної техніки", + "type" : "type_file", + "defaultValue" : null, + "notNullFlag" : false, + "tableName" : "registration" + }, + "reagent_availability_file" : { + "name" : "reagent_availability_file", + "description" : "Наявність необхідних реактивів", + "type" : "type_file", + "defaultValue" : null, + "notNullFlag" : false, + "tableName" : "registration" + }, + "registration_id" : { + "name" : "registration_id", + "description" : "Ідентифікатор реєстраційної послуги", + "type" : "uuid", + "defaultValue" : "uuid_generate_v4()", + "notNullFlag" : true, + "tableName" : "registration" + }, + "accepted_by" : { + "name" : "accepted_by", + "description" : "ПІБ особи, що прийняла заяву", + "type" : "text", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "registration" + }, + "certified_by" : { + "name" : "certified_by", + "description" : "Назва та реквізити документу, що підтверджує наявність повноважень", + "type" : "text", + "defaultValue" : null, + "notNullFlag" : false, + "tableName" : "registration" + }, + "solution_date" : { + "name" : "solution_date", + "description" : "Дата рішення", + "type" : "date", + "defaultValue" : null, + "notNullFlag" : false, + "tableName" : "registration" + }, + "refusal_reasons" : { + "name" : "refusal_reasons", + "description" : "Масив ідентифікаторів підстав для відмов", + "type" : "_uuid", + "defaultValue" : null, + "notNullFlag" : false, + "tableName" : "registration" + }, + "exclusion_order_no" : { + "name" : "exclusion_order_no", + "description" : "Номер наказу про рішення", + "type" : "text", + "defaultValue" : null, + "notNullFlag" : false, + "tableName" : "registration" + }, + "registration_no" : { + "name" : "registration_no", + "description" : "Номер реєстраційної заяви", + "type" : "text", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "registration" + }, + "factors" : { + "name" : "factors", + "description" : "Масив ідентифікаторів факторів", + "type" : "_uuid", + "defaultValue" : null, + "notNullFlag" : false, + "tableName" : "registration" + }, + "zvt_certificate_file" : { + "name" : "zvt_certificate_file", + "description" : "Свідоцтво або документ про відповідність", + "type" : "type_file", + "defaultValue" : null, + "notNullFlag" : false, + "tableName" : "registration" + }, + "received_by" : { + "name" : "received_by", + "description" : "ПІБ представника лабораторії, якому вручено лист щодо рішення", + "type" : "text", + "defaultValue" : null, + "notNullFlag" : false, + "tableName" : "registration" + }, + "application_type_id" : { + "name" : "application_type_id", + "description" : "Ідентифікатор типу заяви", + "type" : "uuid", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "registration" + }, + "health_ministry_letter_date" : { + "name" : "health_ministry_letter_date", + "description" : "Дата листа-відповіді МОЗ", + "type" : "date", + "defaultValue" : null, + "notNullFlag" : false, + "tableName" : "registration" + }, + "reagent_file" : { + "name" : "reagent_file", + "description" : "Накладні на реактиви", + "type" : "type_file", + "defaultValue" : null, + "notNullFlag" : false, + "tableName" : "registration" + }, + "created_date" : { + "name" : "created_date", + "description" : "Дата надходження заяви", + "type" : "date", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "registration" + } + }, + "foreignKeys" : { + "fk_registration_laboratory" : { + "name" : "fk_registration_laboratory", + "targetTable" : "laboratory", + "columnPairs" : [ { + "sourceColumnName" : "laboratory_id", + "targetColumnName" : "laboratory_id" + } ], + "sourceTable" : "registration" + }, + "fk_registration_application_type" : { + "name" : "fk_registration_application_type", + "targetTable" : "application_type", + "columnPairs" : [ { + "sourceColumnName" : "application_type_id", + "targetColumnName" : "application_type_id" + } ], + "sourceTable" : "registration" + }, + "fk_registration_solution_type" : { + "name" : "fk_registration_solution_type", + "targetTable" : "solution_type", + "columnPairs" : [ { + "sourceColumnName" : "solution_type_id", + "targetColumnName" : "solution_type_id" + } ], + "sourceTable" : "registration" + } + }, + "primaryKey" : { + "name" : "pk_registration_id", + "columns" : [ { + "name" : "registration_id", + "sorting" : "ASC" + } ], + "tableName" : "registration" + }, + "uniqueConstraints" : { }, + "indices" : { + "ix_registration_solution_type__solution_type_id" : { + "name" : "ix_registration_solution_type__solution_type_id", + "columns" : [ { + "name" : "solution_type_id", + "sorting" : "ASC" + } ], + "tableName" : "registration" + }, + "ix_registration_laboratory__laboratory_id" : { + "name" : "ix_registration_laboratory__laboratory_id", + "columns" : [ { + "name" : "laboratory_id", + "sorting" : "ASC" + } ], + "tableName" : "registration" + }, + "ix_registration_application_type__application_type_id" : { + "name" : "ix_registration_application_type__application_type_id", + "columns" : [ { + "name" : "application_type_id", + "sorting" : "ASC" + } ], + "tableName" : "registration" + } + } + }, + "factor" : { + "name" : "factor", + "historyFlag" : null, + "objectReference" : null, + "description" : "Довідник всіх факторів", + "columns" : { + "code" : { + "name" : "code", + "description" : "Код", + "type" : "text", + "defaultValue" : null, + "notNullFlag" : false, + "tableName" : "factor" + }, + "notes" : { + "name" : "notes", + "description" : "Підстава внесення", + "type" : "text", + "defaultValue" : null, + "notNullFlag" : false, + "tableName" : "factor" + }, + "factor_type" : { + "name" : "factor_type", + "description" : "Тип фактору (фізичний, біологічний, трудового процессу, хім гігієнічних, ГОСТ, ОБРВ)", + "type" : "text", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "factor" + }, + "name" : { + "name" : "name", + "description" : "Назва фактору", + "type" : "text", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "factor" + }, + "factor_id" : { + "name" : "factor_id", + "description" : "Ідентифікатор фактору", + "type" : "uuid", + "defaultValue" : "uuid_generate_v4()", + "notNullFlag" : true, + "tableName" : "factor" + } + }, + "foreignKeys" : { }, + "primaryKey" : { + "name" : "pk_factor_id", + "columns" : [ { + "name" : "factor_id", + "sorting" : "ASC" + } ], + "tableName" : "factor" + }, + "uniqueConstraints" : { + "factor_factor_type_name_key" : { + "name" : "factor_factor_type_name_key", + "columns" : [ { + "name" : "factor_type", + "sorting" : "ASC" + }, { + "name" : "name", + "sorting" : "ASC" + } ], + "tableName" : "factor" + } + }, + "indices" : { } + }, + "edu_type" : { + "name" : "edu_type", + "historyFlag" : null, + "objectReference" : null, + "description" : "Довідник Тип закладу", + "columns" : { + "edu_type_id" : { + "name" : "edu_type_id", + "description" : "Ідентифікатор Типу закладу", + "type" : "uuid", + "defaultValue" : "uuid_generate_v4()", + "notNullFlag" : true, + "tableName" : "edu_type" + }, + "name" : { + "name" : "name", + "description" : "Тип закладу", + "type" : "text", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "edu_type" + } + }, + "foreignKeys" : { }, + "primaryKey" : { + "name" : "pk_edu_type_id", + "columns" : [ { + "name" : "edu_type_id", + "sorting" : "ASC" + } ], + "tableName" : "edu_type" + }, + "uniqueConstraints" : { }, + "indices" : { } + } + }, + "ddmRolePermissions" : { + "1" : { + "permissionId" : 1, + "roleName" : "isAuthenticated", + "objectName" : "laboratory", + "columnName" : "edrpou", + "operation" : "SELECT" + }, + "2" : { + "permissionId" : 2, + "roleName" : "isAuthenticated", + "objectName" : "laboratory", + "columnName" : "name", + "operation" : "SELECT" + }, + "3" : { + "permissionId" : 3, + "roleName" : "officer", + "objectName" : "laboratory", + "columnName" : "edrpou", + "operation" : "SELECT" + }, + "4" : { + "permissionId" : 4, + "roleName" : "officer", + "objectName" : "laboratory", + "columnName" : "edrpou", + "operation" : "UPDATE" + }, + "5" : { + "permissionId" : 5, + "roleName" : "officer", + "objectName" : "laboratory", + "columnName" : "name", + "operation" : "SELECT" + }, + "6" : { + "permissionId" : 6, + "roleName" : "officer", + "objectName" : "laboratory", + "columnName" : "name", + "operation" : "UPDATE" + }, + "7" : { + "permissionId" : 7, + "roleName" : "officer", + "objectName" : "laboratory", + "columnName" : "head_name", + "operation" : "SELECT" + }, + "8" : { + "permissionId" : 8, + "roleName" : "head_name_officer", + "objectName" : "laboratory", + "columnName" : "head_name", + "operation" : "UPDATE" + }, + "9" : { + "permissionId" : 9, + "roleName" : "accreditation_officer", + "objectName" : "laboratory", + "columnName" : "accreditation_flag", + "operation" : "UPDATE" + }, + "10" : { + "permissionId" : 10, + "roleName" : "create_officer", + "objectName" : "laboratory", + "columnName" : null, + "operation" : "INSERT" + }, + "11" : { + "permissionId" : 11, + "roleName" : "delete_officer", + "objectName" : "laboratory", + "columnName" : null, + "operation" : "DELETE" + } + } +} \ No newline at end of file diff --git a/docs/en/modules/arch/attachments/architecture/registry/administrative/regulation-management/admin-portal/DataModelSnapshotSchema-role-permission.json b/docs/en/modules/arch/attachments/architecture/registry/administrative/regulation-management/admin-portal/DataModelSnapshotSchema-role-permission.json new file mode 100644 index 0000000000..bbf05f5e2e --- /dev/null +++ b/docs/en/modules/arch/attachments/architecture/registry/administrative/regulation-management/admin-portal/DataModelSnapshotSchema-role-permission.json @@ -0,0 +1,51 @@ +{ + "$schema": "http://json-schema.org/draft-04/schema#", + "$ref": "#/$defs/ddmRolePermission", + "$defs": { + "required": [ + "ddmRolePermissions" + ], + "ddmRolePermission": { + "type": "object", + "description": "Type of the role permission entity", + "properties": { + "permissionId": { + "type": "integer", + "description": "Id of the role permission" + }, + "roleName": { + "type": "string", + "description": "Role name to which permission is granted" + }, + "objectName": { + "type": "string", + "description": "Table name on which permission is granted" + }, + "columnName": { + "type": [ + "string", + "null" + ], + "description": "Column name on which permission is granted. If null permission is granted on whole table" + }, + "operation": { + "type": "string", + "description": "Operation that is granted to a role on an object", + "enum": [ + "SELECT", + "INSERT", + "UPDATE", + "DELETE" + ] + } + }, + "required": [ + "permissionId", + "roleName", + "objectName", + "columnName", + "operation" + ] + } + } +} \ No newline at end of file diff --git a/docs/en/modules/arch/attachments/architecture/registry/administrative/regulation-management/admin-portal/DataModelSnapshotSchema-table.json b/docs/en/modules/arch/attachments/architecture/registry/administrative/regulation-management/admin-portal/DataModelSnapshotSchema-table.json new file mode 100644 index 0000000000..53d53155d9 --- /dev/null +++ b/docs/en/modules/arch/attachments/architecture/registry/administrative/regulation-management/admin-portal/DataModelSnapshotSchema-table.json @@ -0,0 +1,222 @@ +{ + "$schema": "http://json-schema.org/draft-04/schema#", + "$ref": "#/$defs/ddmTable", + "$defs": { + "required": [ + "ddmTables" + ], + "ddmTable": { + "type": "object", + "description": "Type of the table entity", + "properties": { + "name": { + "type": "string", + "description": "Name of the table" + }, + "historyFlag": { + "type": [ + "boolean", + "null" + ], + "description": "Flag that indicates if table history has to be saved" + }, + "objectReference": { + "type": [ + "boolean", + "null" + ], + "description": "Flag that indicates if table is an object reference to a subject" + }, + "description": { + "type": "string", + "description": "Description (remarks) of the table" + }, + "columns": { + "type": "object", + "description": "Map of table columns", + "additionalProperties": { + "$ref": "#/$defs/ddmColumn" + } + }, + "foreignKeys": { + "type": "object", + "description": "Map of table foreign keys", + "additionalProperties": { + "$ref": "#/$defs/ddmForeignKey" + } + }, + "primaryKey": { + "$ref": "#/$defs/ddmIndex", + "description": "Table primary key" + }, + "uniqueConstraints": { + "type": "object", + "description": "Map of table unique constraints (indices)", + "additionalProperties": { + "$ref": "#/$defs/ddmIndex" + } + }, + "indices": { + "type": "object", + "description": "Map of table other indices", + "additionalProperties": { + "$ref": "#/$defs/ddmIndex" + } + } + }, + "required": [ + "name", + "historyFlag", + "objectReference", + "description", + "columns", + "foreignKeys", + "primaryKey", + "uniqueConstraints", + "indices" + ] + }, + "ddmColumn": { + "type": "object", + "description": "Type of the column entity", + "properties": { + "name": { + "type": "string", + "description": "Name of the table column" + }, + "description": { + "type": "string", + "description": "Description (remarks) of the table column" + }, + "type": { + "type": "string", + "$comment": "Should be enum", + "description": "Table column type" + }, + "defaultValue": { + "type": [ + "string", + "null" + ], + "description": "Table column default value computed" + }, + "notNullFlag": { + "type": "boolean", + "description": "Table column not null flag" + }, + "tableName": { + "type": "string", + "description": "Table name" + } + }, + "required": [ + "name", + "description", + "type", + "defaultValue", + "notNullFlag", + "tableName" + ] + }, + "ddmForeignKey": { + "type": "object", + "description": "Type of the foreign key entity", + "properties": { + "name": { + "type": "string", + "description": "Name of the table foreign key" + }, + "targetTable": { + "type": "string", + "description": "Name of the foreign key target table" + }, + "sourceTable": { + "type": "string", + "description": "Name of the foreign key source table" + }, + "columnPairs": { + "type": "array", + "items": { + "$ref": "#/$defs/ddmForeignKey/$nestedDefs/columnPair" + } + } + }, + "required": [ + "name", + "targetTable", + "sourceTable", + "columnPairs" + ], + "$nestedDefs": { + "columnPair": { + "type": "object", + "description": "Type of the foreign key column pair entity", + "properties": { + "sourceColumnName": { + "type": "string", + "description": "Name of source column in foreign key relation" + }, + "targetColumnName": { + "type": "string", + "description": "Name of target column in foreign key relation" + } + }, + "required": [ + "sourceColumnName", + "targetColumnName" + ] + } + } + }, + "ddmIndex": { + "type": "object", + "description": "Type of the index entity", + "properties": { + "name": { + "type": "string", + "description": "Table index name" + }, + "tableName": { + "type": "string", + "description": "Table name" + }, + "columns": { + "type": "array", + "items": { + "$ref": "#/$defs/ddmIndex/$nestedDefs/column" + } + } + }, + "required": [ + "name", + "tableName", + "columns" + ], + "$nestedDefs": { + "column": { + "type": "object", + "description": "Type of the index column entity", + "properties": { + "name": { + "type": "string", + "description": "Name of the index column" + }, + "sorting": { + "type": "string", + "description": "Index column sorting", + "enum": [ + "ASC", + "DESC", + "NONE" + ] + } + }, + "required": [ + "name", + "sorting" + ] + } + } + } + } +} \ No newline at end of file diff --git a/docs/en/modules/arch/attachments/architecture/registry/administrative/regulation-management/admin-portal/DataModelSnapshotSchema.json b/docs/en/modules/arch/attachments/architecture/registry/administrative/regulation-management/admin-portal/DataModelSnapshotSchema.json new file mode 100644 index 0000000000..5de0ed0420 --- /dev/null +++ b/docs/en/modules/arch/attachments/architecture/registry/administrative/regulation-management/admin-portal/DataModelSnapshotSchema.json @@ -0,0 +1,264 @@ +{ + "$schema": "http://json-schema.org/draft-04/schema#", + "$ref": "#/$defs/ddmDataBaseSnapshot", + "$defs": { + "ddmDataBaseSnapshot":{ + "type": "object", + "description": "Type of the whole data base snapshot entity", + "properties": { + "ddmTables": { + "type": "object", + "description": "Tables map", + "additionalProperties": { + "$ref":"#/$defs/ddmTable" + } + }, + "ddmRolePermissions": { + "type": "object", + "description": "Role permission map", + "additionalProperties": { + "$ref":"#/$defs/ddmRolePermission" + } + } + }, + "required":[ + "ddmTables", + "ddmRolePermissions" + ] + }, + "ddmTable": { + "type": "object", + "description": "Type of the table entity", + "properties": { + "name": { + "type": "string", + "description": "Name of the table" + }, + "historyFlag": { + "type": ["boolean", "null"], + "description": "Flag that indicates if table history has to be saved" + }, + "objectReference": { + "type": ["boolean", "null"], + "description": "Flag that indicates if table is an object reference to a subject" + }, + "description": { + "type": "string", + "description": "Description (remarks) of the table" + }, + "columns": { + "type": "object", + "description": "Map of table columns", + "additionalProperties": { + "$ref": "#/$defs/ddmColumn" + } + }, + "foreignKeys": { + "type": "object", + "description": "Map of table foreign keys", + "additionalProperties": { + "$ref": "#/$defs/ddmForeignKey" + } + }, + "primaryKey": { + "$ref": "#/$defs/ddmIndex", + "description": "Table primary key" + }, + "uniqueConstraints": { + "type": "object", + "description": "Map of table unique constraints (indices)", + "additionalProperties": { + "$ref": "#/$defs/ddmIndex" + } + }, + "indices": { + "type": "object", + "description": "Map of table other indices", + "additionalProperties": { + "$ref": "#/$defs/ddmIndex" + } + } + }, + "required": [ + "name", + "historyFlag", + "objectReference", + "description", + "columns", + "foreignKeys", + "primaryKey", + "uniqueConstraints", + "indices" + ] + }, + "ddmColumn": { + "type": "object", + "description": "Type of the column entity", + "properties": { + "name": { + "type": "string", + "description": "Name of the table column" + }, + "description": { + "type": "string", + "description": "Description (remarks) of the table column" + }, + "type": { + "type": "string", + "$comment": "Should be enum", + "description": "Table column type" + }, + "defaultValue": { + "type": ["string", "null"], + "description": "Table column default value computed" + }, + "notNullFlag": { + "type": "boolean", + "description": "Table column not null flag" + }, + "tableName": { + "type": "string", + "description": "Table name" + } + }, + "required": [ + "name", + "description", + "type", + "defaultValue", + "notNullFlag", + "tableName" + ] + }, + "ddmForeignKey": { + "type": "object", + "description": "Type of the foreign key entity", + "properties": { + "name": { + "type": "string", + "description": "Name of the table foreign key" + }, + "targetTable": { + "type": "string", + "description": "Name of the foreign key target table" + }, + "sourceTable": { + "type": "string", + "description": "Name of the foreign key source table" + }, + "columnPairs": { + "type": "array", + "items": { + "$ref": "#/$defs/ddmForeignKey/$nestedDefs/columnPair" + } + } + }, + "required": [ + "name", + "targetTable", + "sourceTable", + "columnPairs" + ], + "$nestedDefs": { + "columnPair": { + "type": "object", + "description": "Type of the foreign key column pair entity", + "properties": { + "sourceColumnName": { + "type": "string", + "description": "Name of source column in foreign key relation" + }, + "targetColumnName": { + "type": "string", + "description": "Name of target column in foreign key relation" + } + }, + "required": [ + "sourceColumnName", + "targetColumnName" + ] + } + } + }, + "ddmIndex":{ + "type": "object", + "description": "Type of the index entity", + "properties": { + "name":{ + "type": "string", + "description": "Table index name" + }, + "tableName": { + "type": "string", + "description": "Table name" + }, + "columns": { + "type": "array", + "items": { + "$ref": "#/$defs/ddmIndex/$nestedDefs/column" + } + } + }, + "required": [ + "name", + "tableName", + "columns" + ], + "$nestedDefs": { + "column": { + "type": "object", + "description": "Type of the index column entity", + "properties": { + "name": { + "type": "string", + "description": "Name of the index column" + }, + "sorting": { + "type": "string", + "description": "Index column sorting", + "enum": ["ASC", "DESC", "NONE"] + } + }, + "required": [ + "name", + "sorting" + ] + } + } + }, + "ddmRolePermission": { + "type": "object", + "description": "Type of the role permission entity", + "properties": { + "permissionId": { + "type": "integer", + "description": "Id of the role permission" + }, + "roleName": { + "type": "string", + "description": "Role name to which permission is granted" + }, + "objectName": { + "type": "string", + "description": "Table name on which permission is granted" + }, + "columnName": { + "type": ["string", "null"], + "description": "Column name on which permission is granted. If null permission is granted on whole table" + }, + "operation": { + "type": "string", + "description": "Operation that is granted to a role on an object", + "enum": ["SELECT", "INSERT", "UPDATE", "DELETE"] + } + }, + "required":[ + "permissionId", + "roleName", + "objectName", + "columnName", + "operation" + ] + } + } +} \ No newline at end of file diff --git a/docs/en/modules/arch/attachments/architecture/registry/administrative/regulation-management/admin-portal/data-model-snapshot-current-version.json b/docs/en/modules/arch/attachments/architecture/registry/administrative/regulation-management/admin-portal/data-model-snapshot-current-version.json new file mode 100644 index 0000000000..61e9e11eeb --- /dev/null +++ b/docs/en/modules/arch/attachments/architecture/registry/administrative/regulation-management/admin-portal/data-model-snapshot-current-version.json @@ -0,0 +1,181 @@ +{ + "ddmTables" : { + "staff" : { + "name" : "staff", + "historyFlag" : null, + "objectReference" : null, + "remarks" : "Склад", + "columns" : { + "specialization_end_date" : { + "name" : "specialization_end_date", + "remarks" : "Дата закінчення спеціалізації", + "type" : "date", + "defaultValue" : null, + "notNullFlag" : false, + "tableName" : "staff" + }, + "education" : { + "name" : "education", + "remarks" : "", + "type" : "text", + "defaultValue" : null, + "notNullFlag" : false, + "tableName" : "staff" + }, + "laboratory_id" : { + "name" : "laboratory_id", + "remarks" : "Ідентифікатор лабораторії", + "type" : "uuid", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "staff" + }, + "hygienist_flag" : { + "name" : "hygienist_flag", + "remarks" : "Лікар з гігієни праці (true) / Лаборант (false)", + "type" : "bool", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "staff" + }, + "orders_file" : { + "name" : "orders_file", + "remarks" : "Додатки про копії наказів", + "type" : "type_file", + "defaultValue" : null, + "notNullFlag" : false, + "tableName" : "staff" + }, + "hire_staff_file" : { + "name" : "hire_staff_file", + "remarks" : "Відомості про прийняття", + "type" : "type_file", + "defaultValue" : null, + "notNullFlag" : false, + "tableName" : "staff" + }, + "salary" : { + "name" : "salary", + "remarks" : "Ставка", + "type" : "float8", + "defaultValue" : null, + "notNullFlag" : false, + "tableName" : "staff" + }, + "hygienist_certificate_file" : { + "name" : "hygienist_certificate_file", + "remarks" : "Сертифікат для лікаря з гігієни праці", + "type" : "type_file", + "defaultValue" : null, + "notNullFlag" : false, + "tableName" : "staff" + }, + "contract_end_date" : { + "name" : "contract_end_date", + "remarks" : "Дата закінчення строкового трудового договору", + "type" : "date", + "defaultValue" : null, + "notNullFlag" : false, + "tableName" : "staff" + }, + "staff_status_id" : { + "name" : "staff_status_id", + "remarks" : "Ідентифікатор статусів співробітників", + "type" : "uuid", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "staff" + }, + "full_name" : { + "name" : "full_name", + "remarks" : "Прізвище, ім'я, по батькові", + "type" : "text", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "staff" + }, + "specialization_date" : { + "name" : "specialization_date", + "remarks" : "Дата проходження спеціалізації", + "type" : "date", + "defaultValue" : null, + "notNullFlag" : false, + "tableName" : "staff" + }, + "staff_id" : { + "name" : "staff_id", + "remarks" : "Ідентифікатор кадрової одиниці", + "type" : "uuid", + "defaultValue" : "uuid_generate_v4()", + "notNullFlag" : true, + "tableName" : "staff" + }, + "full_time_flag" : { + "name" : "full_time_flag", + "remarks" : "Основне місце роботи (true) / Сумісництво (false)", + "type" : "bool", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "staff" + }, + "dismissal_date" : { + "name" : "dismissal_date", + "remarks" : "Дата зміни статусу", + "type" : "date", + "defaultValue" : null, + "notNullFlag" : false, + "tableName" : "staff" + }, + "seniority" : { + "name" : "seniority", + "remarks" : "Стаж роботи за фахом", + "type" : "text", + "defaultValue" : null, + "notNullFlag" : false, + "tableName" : "staff" + }, + "fixed_term_contract_flag" : { + "name" : "fixed_term_contract_flag", + "remarks" : "Трудовий договір строковий?", + "type" : "bool", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "staff" + } + }, + "foreignKeys" : { + "fk_staff_laboratory" : { + "name" : "fk_staff_laboratory", + "targetTable" : "laboratory", + "columnPairs" : [ { + "sourceColumnName" : "laboratory_id", + "targetColumnName" : "laboratory_id" + } ], + "sourceTable" : "staff" + } + }, + "primaryKey" : { + "name" : "pk_staff_id", + "columns" : [ { + "name" : "staff_id", + "sorting" : "ASC" + } ], + "tableName" : "staff" + }, + "uniqueConstraints" : { }, + "indices" : { + + "ix_staff_laboratory__laboratory_id" : { + "name" : "ix_staff_laboratory__laboratory_id", + "columns" : [ { + "name" : "laboratory_id", + "sorting" : "ASC" + } ], + "tableName" : "staff" + } + } + } + }, + "ddmRolePermissions" : { + } +} \ No newline at end of file diff --git a/docs/en/modules/arch/attachments/architecture/registry/administrative/regulation-management/admin-portal/data-model-snapshot-new-version.json b/docs/en/modules/arch/attachments/architecture/registry/administrative/regulation-management/admin-portal/data-model-snapshot-new-version.json new file mode 100644 index 0000000000..c37894ae38 --- /dev/null +++ b/docs/en/modules/arch/attachments/architecture/registry/administrative/regulation-management/admin-portal/data-model-snapshot-new-version.json @@ -0,0 +1,265 @@ +{ + "ddmTables" : { + "staff" : { + "name" : "staff", + "historyFlag" : null, + "objectReference" : null, + "remarks" : "Кадровий склад", + "columns" : { + "researches" : { + "name" : "researches", + "remarks" : "Масив ідентифікаторів досліджень", + "type" : "_uuid", + "defaultValue" : null, + "notNullFlag" : false, + "tableName" : "staff" + }, + "specialization_end_date" : { + "name" : "specialization_end_date", + "remarks" : "Дата закінчення спеціалізації", + "type" : "date", + "defaultValue" : null, + "notNullFlag" : false, + "tableName" : "staff" + }, + "education" : { + "name" : "education", + "remarks" : "Освіта, фах", + "type" : "text", + "defaultValue" : "Юридичний факультет", + "notNullFlag" : false, + "tableName" : "staff" + }, + "laboratory_id" : { + "name" : "laboratory_id", + "remarks" : "Ідентифікатор лабораторії", + "type" : "uuid", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "staff" + }, + "hygienist_flag" : { + "name" : "hygienist_flag", + "remarks" : "Лікар з гігієни праці (true) / Лаборант (false)", + "type" : "bool", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "staff" + }, + "orders_file" : { + "name" : "orders_file", + "remarks" : "Додатки про копії наказів", + "type" : "type_file", + "defaultValue" : null, + "notNullFlag" : false, + "tableName" : "staff" + }, + "hire_staff_file" : { + "name" : "hire_staff_file", + "remarks" : "Відомості про прийняття", + "type" : "type_file", + "defaultValue" : null, + "notNullFlag" : false, + "tableName" : "staff" + }, + "salary" : { + "name" : "salary", + "remarks" : "Ставка", + "type" : "float8", + "defaultValue" : null, + "notNullFlag" : false, + "tableName" : "staff" + }, + "hygienist_certificate_file" : { + "name" : "hygienist_certificate_file", + "remarks" : "Сертифікат для лікаря з гігієни праці", + "type" : "type_file", + "defaultValue" : null, + "notNullFlag" : false, + "tableName" : "staff" + }, + "contract_end_date" : { + "name" : "contract_end_date", + "remarks" : "Дата закінчення строкового трудового договору", + "type" : "date", + "defaultValue" : null, + "notNullFlag" : false, + "tableName" : "staff" + }, + "staff_status_id" : { + "name" : "staff_status_id", + "remarks" : "Ідентифікатор статусів співробітників", + "type" : "uuid", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "staff" + }, + "full_name" : { + "name" : "full_name", + "remarks" : "Прізвище, ім'я, по батькові", + "type" : "text", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "staff" + }, + "specialization_date" : { + "name" : "specialization_date", + "remarks" : "Дата проходження спеціалізації", + "type" : "date", + "defaultValue" : null, + "notNullFlag" : false, + "tableName" : "staff" + }, + "staff_id" : { + "name" : "staff_id", + "remarks" : "Ідентифікатор кадрової одиниці", + "type" : "uuid", + "defaultValue" : "uuid_generate_v4()", + "notNullFlag" : true, + "tableName" : "staff" + }, + "full_time_flag" : { + "name" : "full_time_flag", + "remarks" : "Основне місце роботи (true) / Сумісництво (false)", + "type" : "bool", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "staff" + }, + "dismissal_date" : { + "name" : "dismissal_date", + "remarks" : "Дата зміни статусу", + "type" : "date", + "defaultValue" : null, + "notNullFlag" : false, + "tableName" : "staff" + }, + "seniority" : { + "name" : "seniority", + "remarks" : "Стаж роботи за фахом", + "type" : "text", + "defaultValue" : null, + "notNullFlag" : false, + "tableName" : "staff" + }, + "fixed_term_contract_flag" : { + "name" : "fixed_term_contract_flag", + "remarks" : "Трудовий договір строковий?", + "type" : "bool", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "staff" + } + }, + "foreignKeys" : { + "fk_staff_status" : { + "name" : "fk_staff_status", + "targetTable" : "staff_status", + "columnPairs" : [ { + "sourceColumnName" : "staff_status_id", + "targetColumnName" : "staff_status_id" + } ], + "sourceTable" : "staff" + }, + "fk_staff_laboratory_new" : { + "name" : "fk_staff_laboratory_new", + "targetTable" : "laboratory", + "columnPairs" : [ { + "sourceColumnName" : "laboratory_id", + "targetColumnName" : "laboratory_id" + } ], + "sourceTable" : "staff" + } + }, + "primaryKey" : { + "name" : "pk_staff_id", + "columns" : [ { + "name" : "staff_id", + "sorting" : "ASC" + } ], + "tableName" : "staff" + }, + "uniqueConstraints" : { }, + "indices" : { + "ix_staff_staff_status__staff_status_id" : { + "name" : "ix_staff_staff_status__staff_status_id", + "columns" : [ { + "name" : "staff_status_id", + "sorting" : "ASC" + } ], + "tableName" : "staff" + }, + "ix_staff_laboratory__laboratory_id_new" : { + "name" : "ix_staff_laboratory__laboratory_id_new", + "columns" : [ { + "name" : "laboratory_id", + "sorting" : "ASC" + } ], + "tableName" : "staff" + } + } + }, + "application_type" : { + "name" : "application_type", + "historyFlag" : null, + "objectReference" : null, + "remarks" : "Довідник типів заяв", + "columns" : { + "name" : { + "name" : "name", + "remarks" : "Тип заяви", + "type" : "text", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "application_type" + }, + "application_type_id" : { + "name" : "application_type_id", + "remarks" : "Ідентифікатор типів заяв", + "type" : "uuid", + "defaultValue" : "uuid_generate_v4()", + "notNullFlag" : true, + "tableName" : "application_type" + }, + "constant_code" : { + "name" : "constant_code", + "remarks" : "Символьна константа", + "type" : "text", + "defaultValue" : null, + "notNullFlag" : true, + "tableName" : "application_type" + } + }, + "foreignKeys" : { }, + "primaryKey" : { + "name" : "pk_application_type_id", + "columns" : [ { + "name" : "application_type_id", + "sorting" : "ASC" + } ], + "tableName" : "application_type" + }, + "uniqueConstraints" : { + "application_type_name_key" : { + "name" : "application_type_name_key", + "columns" : [ { + "name" : "name", + "sorting" : "ASC" + } ], + "tableName" : "application_type" + } + }, + "indices" : { } + } + }, + + "ddmRolePermissions" : { + "1" : { + "permissionId" : 1, + "roleName" : "isAuthenticated", + "objectName" : "laboratory", + "columnName" : "edrpou", + "operation" : "SELECT" + } + } +} \ No newline at end of file diff --git a/docs/en/modules/arch/attachments/architecture/registry/administrative/regulation-management/admin-portal/role-permission-example.json b/docs/en/modules/arch/attachments/architecture/registry/administrative/regulation-management/admin-portal/role-permission-example.json new file mode 100644 index 0000000000..f037cba07b --- /dev/null +++ b/docs/en/modules/arch/attachments/architecture/registry/administrative/regulation-management/admin-portal/role-permission-example.json @@ -0,0 +1,7 @@ +{ + "permissionId": 1, + "roleName": "isAuthenticated", + "objectName": "laboratory", + "columnName": "edrpou", + "operation": "SELECT" +} \ No newline at end of file diff --git a/docs/en/modules/arch/attachments/architecture/registry/administrative/regulation-management/admin-portal/table-example.json b/docs/en/modules/arch/attachments/architecture/registry/administrative/regulation-management/admin-portal/table-example.json new file mode 100644 index 0000000000..0c208f5e3b --- /dev/null +++ b/docs/en/modules/arch/attachments/architecture/registry/administrative/regulation-management/admin-portal/table-example.json @@ -0,0 +1,56 @@ +{ + "name": "application_type", + "historyFlag": null, + "objectReference": null, + "description": "Довідник типів заяв", + "columns": { + "name": { + "name": "name", + "description": "Тип заяви", + "type": "text", + "defaultValue": null, + "notNullFlag": true, + "tableName": "application_type" + }, + "application_type_id": { + "name": "application_type_id", + "description": "Ідентифікатор типів заяв", + "type": "uuid", + "defaultValue": "uuid_generate_v4()", + "notNullFlag": true, + "tableName": "application_type" + }, + "constant_code": { + "name": "constant_code", + "description": "Символьна константа", + "type": "text", + "defaultValue": null, + "notNullFlag": true, + "tableName": "application_type" + } + }, + "foreignKeys": {}, + "primaryKey": { + "name": "pk_application_type_id", + "columns": [ + { + "name": "application_type_id", + "sorting": "ASC" + } + ], + "tableName": "application_type" + }, + "uniqueConstraints": { + "application_type_name_key": { + "name": "application_type_name_key", + "columns": [ + { + "name": "name", + "sorting": "ASC" + } + ], + "tableName": "application_type" + } + }, + "indices": {} +} \ No newline at end of file diff --git a/docs/en/modules/arch/attachments/architecture/registry/administrative/regulation-management/bp-groups/rrm-swagger.yml b/docs/en/modules/arch/attachments/architecture/registry/administrative/regulation-management/bp-groups/rrm-swagger.yml new file mode 100644 index 0000000000..84d838a767 --- /dev/null +++ b/docs/en/modules/arch/attachments/architecture/registry/administrative/regulation-management/bp-groups/rrm-swagger.yml @@ -0,0 +1,267 @@ +openapi: 3.0.3 +info: + title: Registry regulations admin-portal + description: This document describes REST API of 'Registry regulations admin-portal' + version: '1.0' +servers: + - url: http://localhost:7070 + description: Generated server url +paths: + /versions/master/business-process-groups: + get: + tags: + - Registry regulations master Business process Groups management Rest API + summary: Get Business Process Groups for master version + operationId: getBusinessProcessGroupsFromMaster + parameters: + - name: X-Access-Token + in: header + schema: + type: string + responses: + '200': + description: OK + content: + application/json: + schema: + $ref: '#/components/schemas/BusinessProcessGroupsResponse' + '401': + description: Unauthorized + content: + application/json: {} + '403': + description: Forbidden + content: + application/json: {} + '422': + description: Unprocessable Entity + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + '500': + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + /versions/candidates/{versionCandidateId}/business-process-groups: + get: + tags: + - Registry regulations version-candidate Business process Groups management Rest API + summary: Get Business Process Groups + operationId: getBusinessProcessGroups + parameters: + - name: X-Access-Token + in: header + schema: + type: string + - name: versionCandidateId + in: path + required: true + schema: + type: string + responses: + '200': + description: OK + content: + application/json: + schema: + $ref: '#/components/schemas/BusinessProcessGroupsResponse' + '401': + description: Unauthorized + content: + application/json: {} + '403': + description: Forbidden + content: + application/json: {} + '422': + description: Unprocessable Entity + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + '500': + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + post: + tags: + - Registry regulations version-candidate Business process Groups management Rest API + summary: Create or replace Business Process Groups + operationId: groupsCreate + parameters: + - name: X-Access-Token + in: header + schema: + type: string + - name: versionCandidateId + in: path + required: true + schema: + type: string + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/BusinessProcessGroups' + required: true + responses: + '201': + description: Created + content: + application/json: {} + '401': + description: Unauthorized + content: + application/json: {} + '403': + description: Forbidden + content: + application/json: {} + '422': + description: Unprocessable Entity + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + '500': + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + /versions/candidates/{versionCandidateId}/changes: + get: + tags: + - Registry regulations version-candidate management Rest API + description: Get version changes by id + operationId: getVersionChanges + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: versionCandidateId + in: path + description: Version candidate identifier + required: true + schema: + type: string + responses: + '200': + description: OK + content: + application/json: + schema: + $ref: '#/components/schemas/VersionChangesDto' + '401': + description: Unauthorized + content: + application/json: {} + '403': + description: Forbidden + content: + application/json: {} + '404': + description: Not Found + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + '500': + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' +components: + schemas: + DetailedErrorResponse: + type: object + properties: + traceId: + type: string + code: + type: string + details: + type: string + localizedMessage: + type: string + BusinessProcessGroups: + type: object + properties: + groups: + type: array + items: + type: object + properties: + name: + type: string + processDefinitions: + type: array + items: + type: string + ungrouped: + type: array + items: + type: string + BusinessProcessGroupsResponse: + type: object + properties: + groups: + type: array + items: + type: object + properties: + name: + type: string + processDefinitions: + type: array + items: + $ref: '#/components/schemas/ProcessDefinition' + ungrouped: + type: array + items: + $ref: '#/components/schemas/ProcessDefinition' + ProcessDefinition: + type: object + properties: + id: + type: string + name: + type: string + EntityChangesInfoDto: + type: object + properties: + name: + type: string + title: + type: string + status: + type: string + enum: + - NEW + - CHANGED + - CURRENT + - DELETED + VersionChangesDto: + type: object + properties: + changedForms: + type: array + items: + $ref: '#/components/schemas/EntityChangesInfoDto' + changedBusinessProcesses: + type: array + items: + $ref: '#/components/schemas/EntityChangesInfoDto' + changedGroups: + type: array + items: + $ref: '#/components/schemas/EntityChangesInfoDto' \ No newline at end of file diff --git a/docs/en/modules/arch/attachments/architecture/registry/administrative/regulation-management/bp-groups/upm-swagger.yml b/docs/en/modules/arch/attachments/architecture/registry/administrative/regulation-management/bp-groups/upm-swagger.yml new file mode 100644 index 0000000000..69e156cb20 --- /dev/null +++ b/docs/en/modules/arch/attachments/architecture/registry/administrative/regulation-management/bp-groups/upm-swagger.yml @@ -0,0 +1,100 @@ +openapi: 3.0.1 +info: + title: 'v1-alpha: User process management API' + description: All user process management operations + version: '1.0' +servers: + - url: https://user-proc-mng-platform-sit.apps.cicd2.mdtu-ddm.projects.epam.com/user-process-management + description: Generated server url +paths: + /api/grouped-process-definition: + get: + tags: + - process-definition-controller + summary: Retrieve all process definitions with groups + description: Returns grouped and ungrouped business process definitions ordered lists + operationId: getProcessDefinitions + parameters: + - name: params + in: query + required: true + schema: + $ref: '#/components/schemas/GetProcessDefinitionsParams' + responses: + '200': + description: OK + content: + '*/*': + schema: + $ref: '#/components/schemas/GroupedProcessDefinitionResponse' + '403': + description: Forbidden + content: + application/json: {} + '500': + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + '503': + description: Service unavailable + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + '504': + description: Request timed out + content: + application/json: {} +components: + schemas: + GetProcessDefinitionsParams: + type: object + properties: + active: + type: boolean + suspended: + type: boolean + ProcessDefinitionResponse: + type: object + properties: + id: + type: string + key: + type: string + name: + type: string + suspended: + type: boolean + formKey: + type: string + GroupedProcessDefinitionResponse: + type: object + properties: + groups: + type: array + items: + type: object + properties: + name: + type: string + processDefinitions: + type: array + items: + $ref: '#/components/schemas/ProcessDefinitionResponse' + ungrouped: + type: array + items: + $ref: '#/components/schemas/ProcessDefinitionResponse' + DetailedErrorResponse: + type: object + properties: + traceId: + type: string + type: + type: string + message: + type: string + localizedMessage: + type: string \ No newline at end of file diff --git a/docs/en/modules/arch/attachments/architecture/registry/administrative/regulation-management/platform-evolution/form-scripts/form-provider-swagger.yml b/docs/en/modules/arch/attachments/architecture/registry/administrative/regulation-management/platform-evolution/form-scripts/form-provider-swagger.yml new file mode 100644 index 0000000000..2a381600ab --- /dev/null +++ b/docs/en/modules/arch/attachments/architecture/registry/administrative/regulation-management/platform-evolution/form-scripts/form-provider-swagger.yml @@ -0,0 +1,183 @@ +openapi: 3.0.3 +info: + title: Form Provider + description: This document describes REST API of 'Form provider scripts' + version: '1.0' +servers: + - url: http://localhost:7070 + description: Generated server url +paths: + /form-scripts: + get: + summary: Get all form scripts + operationId: getFormScriptList + responses: + '200': + description: OK + content: + application/json: + schema: + $ref: '#/components/schemas/ScriptListResponseBody' + '401': + description: Unauthorized + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + '403': + description: Forbidden + content: + application/json: { } + '500': + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + /form-scripts/{formScriptName}: + post: + summary: Add form script + operationId: createFormScript + parameters: + - name: formScriptName + in: path + required: true + schema: + type: string + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/ScriptRequestBody' + required: true + responses: + '200': + description: OK + content: + application/json: { } + '401': + description: Unauthorized + content: + application/json: { } + '403': + description: Forbidden + content: + application/json: { } + '422': + description: Unprocessable Entity + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + '500': + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + put: + summary: Update form script + operationId: updateFormScript + parameters: + - name: formScriptName + in: path + required: true + schema: + type: string + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/ScriptRequestBody' + required: true + responses: + '200': + description: OK + content: + application/json: {} + '401': + description: Unauthorized + content: + application/json: {} + '403': + description: Forbidden + content: + application/json: {} + '422': + description: Unprocessable Entity + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + '500': + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + delete: + summary: Delete form script + operationId: deleteFormScript + parameters: + - name: formScriptName + in: path + required: true + schema: + type: string + responses: + '200': + description: OK + content: + application/json: {} + '401': + description: Unauthorized + content: + application/json: {} + '403': + description: Forbidden + content: + application/json: {} + '422': + description: Unprocessable Entity + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + '500': + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' +components: + schemas: + Script: + type: object + properties: + name: + type: string + content: + type: string + ScriptListResponseBody: + type: object + properties: + scripts: + type: array + items: + $ref: '#/components/schemas/Script' + ScriptRequestBody: + type: object + properties: + content: + type: string + DetailedErrorResponse: + type: object + properties: + traceId: + type: string + type: + type: string + message: + type: string + localizedMessage: + type: string diff --git a/docs/en/modules/arch/attachments/architecture/registry/administrative/regulation-management/platform-evolution/form-scripts/registry-regulation-swagger.yml b/docs/en/modules/arch/attachments/architecture/registry/administrative/regulation-management/platform-evolution/form-scripts/registry-regulation-swagger.yml new file mode 100644 index 0000000000..bdb119d274 --- /dev/null +++ b/docs/en/modules/arch/attachments/architecture/registry/administrative/regulation-management/platform-evolution/form-scripts/registry-regulation-swagger.yml @@ -0,0 +1,73 @@ +openapi: 3.0.3 +info: + title: Registry regulations admin-portal + description: This document describes REST API of 'Get Form Scripts' + version: '1.0' +servers: + - url: http://localhost:7070 + description: Generated server url +paths: + /versions/candidates/{versionCandidateId}/form-scripts/: + get: + summary: Get Form Scripts + operationId: getFormScripts + parameters: + - name: versionCandidateId + in: path + required: true + schema: + type: string + responses: + '200': + description: OK + content: + application/json: + schema: + $ref: '#/components/schemas/FormScriptsResponse' + '401': + description: Unauthorized + content: + application/json: { } + '403': + description: Forbidden + content: + application/json: { } + '422': + description: Unprocessable Entity + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + '500': + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' +components: + schemas: + Script: + type: object + properties: + name: + type: string + content: + type: string + FormScriptsResponse: + type: object + properties: + scripts: + type: array + items: + $ref: '#/components/schemas/Script' + DetailedErrorResponse: + type: object + properties: + traceId: + type: string + type: + type: string + message: + type: string + localizedMessage: + type: string diff --git a/docs/en/modules/arch/attachments/architecture/registry/administrative/regulation-management/platform-evolution/master-development/rrm-swagger.yml b/docs/en/modules/arch/attachments/architecture/registry/administrative/regulation-management/platform-evolution/master-development/rrm-swagger.yml new file mode 100644 index 0000000000..912ffbea47 --- /dev/null +++ b/docs/en/modules/arch/attachments/architecture/registry/administrative/regulation-management/platform-evolution/master-development/rrm-swagger.yml @@ -0,0 +1,672 @@ +{ + "openapi": "3.0.3", + "info": { + "title": "Registry regulations admin-portal", + "description": "This document describes changes in REST API of 'Registry regulations admin-portal'", + "version": "1.0" + }, + "servers": [ + { + "url": "http://localhost:7070", + "description": "Generated server url" + } + ], + "tags": [ + { + "name": "Registry regulations master Business processes management Rest API" + }, + { + "name": "Registry regulations Master version Forms management Rest API" + } + ], + "paths": { + "/versions/master/forms/{formName}": { + "put": { + "tags": [ + "Registry regulations Master version Forms management Rest API" + ], + "description": "Update existing form within master version", + "operationId": "updateForm", + "parameters": [ + { + "name": "X-Access-Token", + "in": "header", + "description": "Token used for endpoint security", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "If-Match", + "in": "header", + "description": "ETag to verify whether user has latest data", + "schema": { + "type": "string" + } + }, + { + "name": "formName", + "in": "path", + "description": "Name of the form to be updated", + "required": true, + "schema": { + "type": "string" + } + } + ], + "requestBody": { + "content": { + "application/json": { + "schema": { + "type": "string" + } + } + }, + "required": true + }, + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + + } + } + }, + "401": { + "description": "Unauthorized", + "content": { + "application/json": { + + } + } + }, + "403": { + "description": "Forbidden", + "content": { + "application/json": { + + } + } + }, + "404": { + "description": "Not Found", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/DetailedErrorResponse" + } + } + } + }, + "412": { + "description": "Precondition Failed", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/DetailedErrorResponse" + } + } + } + }, + "422": { + "description": "Unprocessable Entity", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/DetailedErrorResponse" + } + } + } + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/DetailedErrorResponse" + } + } + } + } + } + }, + "post": { + "tags": [ + "Registry regulations Master version Forms management Rest API" + ], + "description": "Create new form within master versionn", + "operationId": "formCreate", + "parameters": [ + { + "name": "X-Access-Token", + "in": "header", + "description": "Token used for endpoint security", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "formName", + "in": "path", + "description": "Name of the new form to be created", + "required": true, + "schema": { + "type": "string" + } + } + ], + "requestBody": { + "content": { + "application/json": { + "schema": { + "type": "string" + } + } + }, + "required": true + }, + "responses": { + "201": { + "description": "Created", + "content": { + "application/json": { + + } + } + }, + "401": { + "description": "Unauthorized", + "content": { + "application/json": { + + } + } + }, + "403": { + "description": "Forbidden", + "content": { + "application/json": { + + } + } + }, + "404": { + "description": "Not Found", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/DetailedErrorResponse" + } + } + } + }, + "412": { + "description": "Precondition Failed", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/DetailedErrorResponse" + } + } + } + }, + "422": { + "description": "Unprocessable Entity", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/DetailedErrorResponse" + } + } + } + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/DetailedErrorResponse" + } + } + } + } + } + }, + "delete": { + "tags": [ + "Registry regulations Master version Forms management Rest API" + ], + "description": "Delete existing form within master version", + "operationId": "deleteForm", + "parameters": [ + { + "name": "X-Access-Token", + "in": "header", + "description": "Token used for endpoint security", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "If-Match", + "in": "header", + "description": "ETag to verify whether user has latest data", + "schema": { + "type": "string" + } + }, + { + "name": "formName", + "in": "path", + "description": "Name of the form to be updated", + "required": true, + "schema": { + "type": "string" + } + } + ], + "responses": { + "204": { + "description": "No Content", + "content": { + "application/json": { + + } + } + }, + "401": { + "description": "Unauthorized", + "content": { + "application/json": { + + } + } + }, + "403": { + "description": "Forbidden", + "content": { + "application/json": { + + } + } + }, + "404": { + "description": "Not Found", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/DetailedErrorResponse" + } + } + } + }, + "412": { + "description": "Precondition Failed", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/DetailedErrorResponse" + } + } + } + }, + "422": { + "description": "Unprocessable Entity", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/DetailedErrorResponse" + } + } + } + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/DetailedErrorResponse" + } + } + } + } + } + }, + }, + "/versions/master/business-processes/{businessProcessName}": { + "put": { + "tags": [ + "Registry regulations master Business processes management Rest API" + ], + "description": "Update business process", + "operationId": "updateBusinessProcess", + "parameters": [ + { + "name": "X-Access-Token", + "in": "header", + "description": "Token used for endpoint security", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "businessProcessName", + "in": "path", + "description": "Process name", + "required": true, + "schema": { + "type": "string" + } + } + ], + "requestBody": { + "content": { + "application/json": { + "schema": { + "type": "string" + } + } + }, + "required": true + }, + "responses": { + "200": { + "description": "OK", + "content": { + "text/xml": { + + } + } + }, + "401": { + "description": "Unauthorized", + "content": { + "application/json": { + + } + } + }, + "403": { + "description": "Forbidden", + "content": { + "application/json": { + + } + } + }, + "404": { + "description": "Not Found", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/DetailedErrorResponse" + } + } + } + }, + "412": { + "description": "Precondition Failed", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/DetailedErrorResponse" + } + } + } + }, + "422": { + "description": "Unprocessable Entity", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/DetailedErrorResponse" + } + } + } + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/DetailedErrorResponse" + } + } + } + } + } + }, + "post": { + "tags": [ + "Registry regulations master Business processes management Rest API" + ], + "description": "Create new business process", + "operationId": "createBusinessProcess", + "parameters": [ + { + "name": "X-Access-Token", + "in": "header", + "description": "Token used for endpoint security", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "businessProcessName", + "in": "path", + "description": "Name of the new process to be created", + "required": true, + "schema": { + "type": "string" + } + } + ], + "requestBody": { + "content": { + "application/json": { + "schema": { + "type": "string" + } + } + }, + "required": true + }, + "responses": { + "201": { + "description": "Created", + "content": { + "text/xml": { + + } + } + }, + "401": { + "description": "Unauthorized", + "content": { + "application/json": { + + } + } + }, + "403": { + "description": "Forbidden", + "content": { + "application/json": { + + } + } + }, + "404": { + "description": "Not Found", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/DetailedErrorResponse" + } + } + } + }, + "412": { + "description": "Precondition Failed", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/DetailedErrorResponse" + } + } + } + }, + "422": { + "description": "Unprocessable Entity", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/DetailedErrorResponse" + } + } + } + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/DetailedErrorResponse" + } + } + } + } + } + }, + "delete": { + "tags": [ + "Registry regulations master Business processes management Rest API" + ], + "description": "Delete business process", + "operationId": "deleteBusinessProcess", + "parameters": [ + { + "name": "X-Access-Token", + "in": "header", + "description": "Token used for endpoint security", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "businessProcessName", + "in": "path", + "description": "Process name", + "required": true, + "schema": { + "type": "string" + } + } + ], + "responses": { + "204": { + "description": "No content", + "content": { + "text/xml": { + + } + } + }, + "401": { + "description": "Unauthorized", + "content": { + "application/json": { + + } + } + }, + "403": { + "description": "Forbidden", + "content": { + "application/json": { + + } + } + }, + "404": { + "description": "Not Found", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/DetailedErrorResponse" + } + } + } + }, + "412": { + "description": "Precondition Failed", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/DetailedErrorResponse" + } + } + } + }, + "422": { + "description": "Unprocessable Entity", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/DetailedErrorResponse" + } + } + } + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/DetailedErrorResponse" + } + } + } + } + } + }, + } + }, + "components": { + "schemas": { + "DetailedErrorResponse": { + "required": [ + "code", + "details", + "traceId" + ], + "type": "object", + "properties": { + "traceId": { + "type": "string", + "description": "Request identifier" + }, + "code": { + "type": "string", + "description": "Error code" + }, + "details": { + "type": "string", + "description": "Error details" + }, + "localizedMessage": { + "type": "string", + "description": "Localized error message" + } + } + } + } + } +} \ No newline at end of file diff --git a/docs/en/modules/arch/attachments/architecture/registry/operational/excerpts/excerpt-generation.bpmn b/docs/en/modules/arch/attachments/architecture/registry/operational/excerpts/excerpt-generation.bpmn new file mode 100644 index 0000000000..4d2116ea4a --- /dev/null +++ b/docs/en/modules/arch/attachments/architecture/registry/operational/excerpts/excerpt-generation.bpmn @@ -0,0 +1,513 @@ + + + + + Flow_0lrcgpt + + DataStoreReference_1rateyh + + + + + Flow_1m31ww7 + Flow_07gnijz + Flow_1e48eap + + DataStoreReference_1c6uxer + + + + Flow_0lrcgpt + Flow_1m31ww7 + + + DataStoreReference_1rateyh + Property_0yhbkz7 + + def cephData = [:] + +['name', 'edrpou', 'registrationSource', 'registrationNo', 'createdDate', 'acceptedBy'].each { cephData[it] = addAppFormData.prop(it).stringValue() } + +['chemfactgost', 'chemfacthyge', 'chemfactobrv', 'chemfactodovilni'].each { + cephData[it] = addChemFactorsFormData.prop(it).elements().stream().map(elem -> { + return ["factorId": elem.prop('factorId').value(), "name": elem.prop("name").value()] + }).collect() +} + +['FactorsPhys', 'laborfact', 'biofactors'].each { + cephData[it] = addBioPhysLaborFactorsFormData.prop(it).elements().stream().map(elem -> { + return ["factorId": elem.prop("factorId").value(), "name": elem.prop("name").value()] + }).collect() +} + +['solutionName', 'solutionDate', 'letterNo', 'letterDate'].each { cephData[it] = addDecisionIncludeFormData.prop(it).stringValue() } + +['receivedBy', 'certifiedBy', 'notes'].each { cephData[it] = addLetterDataFormData.prop(it).stringValue() } + +execution.removeVariable('payload') +execution.setVariableLocalTransient('payload', S(cephData, 'application/json')) + + + + + + Flow_04lycdn + Flow_1mrtudh + + DataStoreReference_0r1fakj + + + + Flow_0b91xwq + + + Flow_0cowu3a + Flow_0b91xwq + + + + Flow_08mj7ek + Flow_0cowu3a + + + Flow_1dsfsy1 + Flow_16gkby4 + Flow_08mj7ek + + + Flow_07gnijz + + + + + Flow_16gkby4 + Flow_119o52y + Flow_00kay14 + + + Flow_00kay14 + + + + + + + + Flow_04bkd5l + + Flow_1gnskcx + + + Flow_0ldx84j + Flow_0bkg27q + Flow_1pgqsvp + + + Flow_1pgqsvp + Flow_0g37bui + Flow_1txexko + + + + Flow_0g37bui + Flow_0ldx84j + + + + + + Flow_1txexko + + + + Flow_1gnskcx + Flow_0bkg27q + + + + + Перевірка стану за ${excerptIdentifier} від імені системного користувача + + + + + Flow_119o52y + + + + + + Flow_1mrtudh + Flow_04bkd5l + Flow_1dsfsy1 + + + + + Flow_1e48eap + Flow_1w3koxr + + def cephData = [:] + +['name', 'edrpou', 'registrationSource', 'registrationNo', 'createdDate', 'acceptedBy'].each { cephData[it] = addAppFormData.prop(it).stringValue() } + +['chemfactgost', 'chemfacthyge', 'chemfactobrv', 'chemfactodovilni'].each { + cephData[it] = addChemFactorsFormData.prop(it).elements().stream().map(elem -> { + return ["factorId": elem.prop('factorId').value(), "name": elem.prop("name").value()] + }).collect() +} + +['FactorsPhys', 'laborfact', 'biofactors'].each { + cephData[it] = addBioPhysLaborFactorsFormData.prop(it).elements().stream().map(elem -> { + return ["factorId": elem.prop("factorId").value(), "name": elem.prop("name").value()] + }).collect() +} + +['solutionName', 'solutionDate', 'letterNo', 'letterDate'].each { cephData[it] = addDecisionIncludeFormData.prop(it).stringValue() } + +['receivedBy', 'certifiedBy', 'notes'].each { cephData[it] = addLetterDataFormData.prop(it).stringValue() } + +execution.removeVariable('payload') +execution.setVariableLocalTransient('payload', S(cephData, 'application/json')) + + + + Flow_1w3koxr + Flow_04lycdn + + DataStoreReference_0tykv0m + + + + + + + Заповнення стартової форми даними, необхідними для генерації витягу + + + + SYS_VAR_PROCESS_EXCERPT_ID = ${excerptIdentifier} + + + + SYS_VAR_PROCESS_COMPLETION_RESULT + + + + Збереження змінної excerptIdentifier + + + + + Перевірка стану за ${excerptIdentifier} + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/docs/en/modules/arch/attachments/architecture/registry/operational/external-integrations/mocking/dia-post_info-response.json b/docs/en/modules/arch/attachments/architecture/registry/operational/external-integrations/mocking/dia-post_info-response.json new file mode 100644 index 0000000000..b5825f7968 --- /dev/null +++ b/docs/en/modules/arch/attachments/architecture/registry/operational/external-integrations/mocking/dia-post_info-response.json @@ -0,0 +1,3 @@ +{ + "info": "string" +} \ No newline at end of file diff --git a/docs/en/modules/arch/attachments/architecture/registry/operational/external-integrations/mocking/diia.json b/docs/en/modules/arch/attachments/architecture/registry/operational/external-integrations/mocking/diia.json new file mode 100644 index 0000000000..d5e6bc7c61 --- /dev/null +++ b/docs/en/modules/arch/attachments/architecture/registry/operational/external-integrations/mocking/diia.json @@ -0,0 +1,29 @@ +{ + "mappings": [ + { + "request": { + "urlPath": "/api/partner-token/post-info", + "method": "POST", + "headers": { + "Accept": { + "contains": ".*" + } + }, + "bodyPatterns": [{ + "matchesJsonPath": "$.info" + }] + }, + "response": { + "status": 200, + "body": "{\n \"info\": \"string\"\n}", + "headers": { + "Content-Type": "text/xml" + }, + "transformers": [ + "response-template", + "body-transformer" + ] + } + } + ] +} \ No newline at end of file diff --git a/docs/en/modules/arch/attachments/architecture/registry/operational/external-integrations/mocking/edr-response.xml b/docs/en/modules/arch/attachments/architecture/registry/operational/external-integrations/mocking/edr-response.xml new file mode 100644 index 0000000000..8f27bd4e6a --- /dev/null +++ b/docs/en/modules/arch/attachments/architecture/registry/operational/external-integrations/mocking/edr-response.xml @@ -0,0 +1,52 @@ + + + token + MDTUDDM + + SEVDEIR-TEST + GOV + 43395033 + IDGOV_TEST_01 + + + SEVDEIR-TEST + GOV + 00015622 + 2_MJU_EDR_prod + SearchSubjects + + 4.0 + MDTUDDM + YzS4MYmFiW8tkoncbQL624RllowfcK8B8FGNTWZ5QFE= + + + + + + {{#each (soapXPath request.body '/SearchSubjects/code/text()') as |thing|}} + {{#if (contains thing '101')}} + 1 + зареєстровано + Сидоренко Василь Леонідович + http://zqedr-api.nais.gov.ua/1.0/subjects/3 + {{thing}} + 3 + {{else if (contains thing '123213123')}} + 1 + зареєстровано + Петренко Петро Петрович + http://zqedr-api.nais.gov.ua/1.0/subjects/3 + {{thing}} + 3 + {{/if}} + {{/each}} + + + + + + \ No newline at end of file diff --git a/docs/en/modules/arch/attachments/architecture/registry/operational/external-integrations/mocking/edr.json b/docs/en/modules/arch/attachments/architecture/registry/operational/external-integrations/mocking/edr.json new file mode 100644 index 0000000000..62b8965ae5 --- /dev/null +++ b/docs/en/modules/arch/attachments/architecture/registry/operational/external-integrations/mocking/edr.json @@ -0,0 +1,21 @@ +{ + "mappings": [ + { + "request": { + "urlPath": "/mockEdr", + "method": "POST" + }, + "response": { + "status": 200, + "body": "\n \n token\n MDTUDDM\n \n SEVDEIR-TEST\n GOV\n 43395033\n IDGOV_TEST_01\n \n \n SEVDEIR-TEST\n GOV\n 00015622\n 2_MJU_EDR_prod\n SearchSubjects\n \n 4.0\n MDTUDDM\n YzS4MYmFiW8tkoncbQL624RllowfcK8B8FGNTWZ5QFE=\n \n \n \n \n \n {{#each (soapXPath request.body '/SearchSubjects/code/text()') as |thing|}}\n {{#if (contains thing '101')}}\n 1\n зареєстровано\n Сидоренко Василь Леонідович\n http://zqedr-api.nais.gov.ua/1.0/subjects/3\n {{thing}}\n 3\n {{else if (contains thing '123213123')}}\n 1\n зареєстровано\n Петренко Петро Петрович\n http://zqedr-api.nais.gov.ua/1.0/subjects/3\n {{thing}}\n 3\n {{/if}}\n {{/each}}\n \n \n \n \n \n", + "headers": { + "Content-Type": "text/xml" + }, + "transformers": [ + "response-template", + "body-transformer" + ] + } + } + ] +} \ No newline at end of file diff --git a/docs/en/modules/arch/attachments/architecture/registry/operational/notifications/bpm/send-multi-notifications.bpmn b/docs/en/modules/arch/attachments/architecture/registry/operational/notifications/bpm/send-multi-notifications.bpmn new file mode 100644 index 0000000000..b672804659 --- /dev/null +++ b/docs/en/modules/arch/attachments/architecture/registry/operational/notifications/bpm/send-multi-notifications.bpmn @@ -0,0 +1,100 @@ + + + + + Flow_0oqwaed + Flow_06l376d + + + Flow_1lvxu1r + + + + + ${user.userName} + specific_excerpt_generated + ${templateModel} + Excerpt successfully generated + + + Flow_0j0my9i + Flow_1lvxu1r + + + Flow_115apxf + Flow_0j0my9i + + + Flow_115apxf + + + + + + + Flow_0p3a1xv + + + Flow_0p3a1xv + Flow_0oqwaed + + + Flow_06l376d + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/docs/en/modules/arch/attachments/architecture/registry/operational/notifications/bpm/send-single-notification.bpmn b/docs/en/modules/arch/attachments/architecture/registry/operational/notifications/bpm/send-single-notification.bpmn new file mode 100644 index 0000000000..343ec2b77d --- /dev/null +++ b/docs/en/modules/arch/attachments/architecture/registry/operational/notifications/bpm/send-single-notification.bpmn @@ -0,0 +1,58 @@ + + + + + Flow_0k1060u + Flow_1lcy31w + + + + + ${initiator().userName} + Excerpt successfully generated + specific_excerpt_generated + ${templateModel} + + + Flow_1lcy31w + Flow_1sa3eqx + + + Flow_1sa3eqx + + + Flow_0k1060u + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/docs/en/modules/arch/attachments/architecture/registry/operational/registry-management/sc-pagination-count/swagger.yml b/docs/en/modules/arch/attachments/architecture/registry/operational/registry-management/sc-pagination-count/swagger.yml new file mode 100644 index 0000000000..618d86edf2 --- /dev/null +++ b/docs/en/modules/arch/attachments/architecture/registry/operational/registry-management/sc-pagination-count/swagger.yml @@ -0,0 +1,130 @@ +openapi: 3.0.1 +info: + title: OpenAPI definition + version: v0 +servers: + - url: https://registry-rest-api.projects.epam.com + description: Generated server url +paths: + /pageable-search-condition: + get: + tags: + - pageable-search-condition-search-controller + summary: отримати список ресурсів + description: Використовується для отримання об’єктів. Не змінює стан ресурсу + operationId: search + parameters: + - name: searchConditions + in: query + required: true + schema: + $ref: '#/components/schemas/PageableSearchConditions' + - name: X-Access-Token + in: header + required: false + schema: + type: string + - name: X-Digital-Signature + in: header + required: false + schema: + type: string + - name: X-Digital-Signature-Derived + in: header + required: false + schema: + type: string + - name: X-Source-System + in: header + required: false + schema: + type: string + - name: X-Source-Application + in: header + required: false + schema: + type: string + - name: X-Source-Business-Process + in: header + required: false + schema: + type: string + - name: X-Source-Business-Process-Definition-Id + in: header + required: false + schema: + type: string + - name: X-Source-Business-Process-Instance-Id + in: header + required: false + schema: + type: string + - name: X-Source-Business-Activity + in: header + required: false + schema: + type: string + - name: X-Source-Business-Activity-Instance-Id + in: header + required: false + schema: + type: string + responses: + '200': + description: OK з результатом + content: + application/json: + schema: + $ref: '#/components/schemas/PageableSearchConditionResponse' + '400': + description: Некоректні вхідні дані (наприклад, неправильний тип поля) + '401': + description: Помилка аутентифікації (відсутній токен або цифровий підпис) + '500': + description: Внутрішня помилка сервера + '501': + description: Не імплементовано (використовується для заглушок) +components: + schemas: + PageableSearchConditions: + type: object + properties: + pageSize: + type: integer + format: int32 + pageNo: + type: integer + format: int32 + filter1: + type: string + filterN: + type: string + PageableSearchConditionResponse: + type: object + properties: + content: + type: array + items: + $ref: '#/components/schemas/ExampleDataResponse' + totalElements: + type: integer + format: int32 + totalPages: + type: integer + format: int32 + pageNo: + type: integer + format: int32 + pageSize: + type: integer + format: int32 + ExampleDataResponse: + type: object + properties: + exampleCode: + type: string + exampleName: + type: string + exampleId: + type: string + format: uuid \ No newline at end of file diff --git a/docs/en/modules/arch/attachments/architecture/registry/operational/registry-management/sc-post-migration/swagger.yml b/docs/en/modules/arch/attachments/architecture/registry/operational/registry-management/sc-post-migration/swagger.yml new file mode 100644 index 0000000000..5dc398b7b4 --- /dev/null +++ b/docs/en/modules/arch/attachments/architecture/registry/operational/registry-management/sc-post-migration/swagger.yml @@ -0,0 +1,184 @@ +openapi: 3.0.1 +info: + title: OpenAPI definition + version: v0 +servers: + - url: https://registry-rest-api.projects.epam.com + description: Generated server url +paths: + /some-sc: + get: + summary: отримати список ресурсів + description: Використовується для отримання об’єктів. Не змінює стан ресурсу + operationId: search + parameters: + - name: searchConditions + in: query + required: true + schema: + $ref: '#/components/schemas/PageableSearchConditions' + - name: X-Access-Token + in: header + required: false + schema: + type: string + - name: X-Digital-Signature + in: header + required: false + schema: + type: string + - name: X-Digital-Signature-Derived + in: header + required: false + schema: + type: string + - name: X-Source-System + in: header + required: false + schema: + type: string + - name: X-Source-Application + in: header + required: false + schema: + type: string + - name: X-Source-Business-Process + in: header + required: false + schema: + type: string + - name: X-Source-Business-Process-Definition-Id + in: header + required: false + schema: + type: string + - name: X-Source-Business-Process-Instance-Id + in: header + required: false + schema: + type: string + - name: X-Source-Business-Activity + in: header + required: false + schema: + type: string + - name: X-Source-Business-Activity-Instance-Id + in: header + required: false + schema: + type: string + responses: + '200': + description: OK з результатом + content: + application/json: + schema: + $ref: '#/components/schemas/PageableSearchConditionResponse' + '400': + description: Некоректні вхідні дані (наприклад, неправильний тип поля) + '401': + description: Помилка аутентифікації (відсутній токен або цифровий підпис) + '500': + description: Внутрішня помилка сервера + '501': + description: Не імплементовано (використовується для заглушок) + + post: + summary: отримати список ресурсів + description: Використовується для отримання об’єктів. Не змінює стан ресурсу + operationId: search + parameters: + - name: searchConditions + in: query + required: true + schema: + $ref: '#/components/schemas/PageableSearchConditions' + - name: X-Access-Token + in: header + required: false + schema: + type: string + - name: X-Digital-Signature + in: header + required: false + schema: + type: string + - name: X-Digital-Signature-Derived + in: header + required: false + schema: + type: string + - name: X-Source-System + in: header + required: false + schema: + type: string + - name: X-Source-Application + in: header + required: false + schema: + type: string + - name: X-Source-Business-Process + in: header + required: false + schema: + type: string + - name: X-Source-Business-Process-Definition-Id + in: header + required: false + schema: + type: string + - name: X-Source-Business-Process-Instance-Id + in: header + required: false + schema: + type: string + - name: X-Source-Business-Activity + in: header + required: false + schema: + type: string + - name: X-Source-Business-Activity-Instance-Id + in: header + required: false + schema: + type: string + responses: + '200': + description: OK з результатом + content: + application/json: + schema: + $ref: '#/components/schemas/PageableSearchConditionResponse' + '400': + description: Некоректні вхідні дані (наприклад, неправильний тип поля) + '401': + description: Помилка аутентифікації (відсутній токен або цифровий підпис) + '500': + description: Внутрішня помилка сервера + '501': + description: Не імплементовано (використовується для заглушок) +components: + schemas: + PageableSearchConditions: + type: object + properties: + someEqualColumn: + type: string + someInColumn: + type: array + items: + type: string + PageableSearchConditionResponse: + type: array + items: + $ref: '#/components/schemas/ExampleDataResponse' + ExampleDataResponse: + type: object + properties: + someId: + type: string + someEqualColumn: + type: string + someInColumn: + type: string \ No newline at end of file diff --git a/docs/en/modules/arch/attachments/architecture/registry_cost_calculator.xlsx b/docs/en/modules/arch/attachments/architecture/registry_cost_calculator.xlsx deleted file mode 100644 index 9dc16f12d5..0000000000 Binary files a/docs/en/modules/arch/attachments/architecture/registry_cost_calculator.xlsx and /dev/null differ diff --git a/docs/en/modules/arch/images/architecture/container-platform/container-orchestration.svg b/docs/en/modules/arch/images/architecture/container-platform/container-orchestration.svg index dc03446156..c7c48c381c 100644 --- a/docs/en/modules/arch/images/architecture/container-platform/container-orchestration.svg +++ b/docs/en/modules/arch/images/architecture/container-platform/container-orchestration.svg @@ -1,4 +1,4 @@ - + -
Internet
Internet
private network
private network
virtual master machines
virtual master m...
platform
virtual machines
platform...
Реєстри
Реєстри
Central components of the Platform
Central components of the Platform
kube-proxy
kube-proxy
kubelet
kubelet
API server
API server
etcd
etcd
ctrl manager
ctrl manag...
scheduler
scheduler
kube-proxy
kube-proxy
kubelet
kubelet
kube-proxy
kube-proxy
kubelet
kubelet
system operators
system operators
system operators
system operators
OVNKubernetes
OVNKubernetes
cloud ctrl manager
cloud ctrl...
VPC
VPC
public network
public network
NAT sluice
NAT sluice
register
virtual machines
register...
infrastructure virtual machines
infrastructure virtual ma...
load balancer
load ba...
load balancer
load ba...
Infrastructure
 Administrators
Infrastr...
Office 
Administrators
Office...
Users of
Registry
Users of...
Реєстри
Реєстри
Registers
RegistersText is not SVG - cannot display \ No newline at end of file +
Internet
Internet
private network
private network
virtual master machines
virtual master m...
platform
virtual machines
platform...
Реєстри
Реєстри
Central components of the Platform
Central components of the Platform
kube-proxy
kube-proxy
kubelet
kubelet
API server
API server
etcd
etcd
ctrl manager
ctrl manag...
scheduler
scheduler
kube-proxy
kube-proxy
kubelet
kubelet
kube-proxy
kube-proxy
kubelet
kubelet
system operators
system operators
system operators
system operators
OVNKubernetes
OVNKubernetes
cloud ctrl manager
cloud ctrl...
VPC
VPC
public network
public network
NAT gateway
NAT gateway
register
virtual machines
register...
infrastructure virtual machines
infrastructure virtual ma...
load balancer
load ba...
load balancer
load ba...
Infrastructure
 administrators
Infrastr...
System
administrators
System...
Registry users
Registry...
Реєстри
Реєстри
Registries
RegistriesText is not SVG - cannot display \ No newline at end of file diff --git a/docs/en/modules/arch/images/architecture/ddm-platform-structural-view.svg b/docs/en/modules/arch/images/architecture/ddm-platform-structural-view.svg index 44b1a4e11b..c81993ef1b 100644 --- a/docs/en/modules/arch/images/architecture/ddm-platform-structural-view.svg +++ b/docs/en/modules/arch/images/architecture/ddm-platform-structural-view.svg @@ -1,979 +1,4 @@ - + - - - - - - - - - - - -
-
-
- Platform resources status management component -
-
-
- - Platform resources stat... - - - - - - - - -
-
-
- - Platform for state registries - -
-
-
- - Platform for state registries - - - - - - -
-
-
- - Registries - -
-
-
- - Registries - - - - - - - - -
-
-
- Administrative zone of the registry -
-
-
- - Administrative zone of the... - - - - - - -
-
-
- Operational zone of the registry -
-
-
- - Operational zone of the registry - - - - - - -
-
-
- Registry audit events logging subsystem -
-
-
- - Registry audit event... - - - - - - -
-
-
- Registry data management subsystem -
-
-
- - Registry data manage... - - - - - - -
-
-
- Registry regulations modeling subsystem -
-
-
- - Registry regulations... - - - - - - -
-
-
- Registry regulations deployment subsystem -
-
-
- - Registry regulations... - - - - - - -
-
-
- External traffic management subsystem -
-
-
- - External traffic management subsystem - - - - - - -
-
-
- Business processes execution subsystem -
-
-
- - Business processes e... - - - - - - -
-
-
- Registry analytical reporting subsystem -
-
-
- - Registry analytical... - - - - - - -
-
-
- Registry excerpts generation subsystem -
-
-
- - Registry excerpts ge... - - - - - - -
-
-
- External systems simulation API subsystem -
-
-
- - External systems sim... - - - - - - -
-
-
- External integrations subsystem -
-
-
- - External integration... - - - - - - -
-
-
- Geodata management subsystem -
-
-
- - Geodata management s... - - - - - - -
-
-
- User notification subsystem -
-
-
- - User notification su... - - - - - - -
-
-
- Digital signatures subsystem -
-
-
- - Digital signatures s... - - - - - - -
-
-
- Registry's operational zone service subsystem -
-
-
- - Registry's operation... - - - - - - -
-
-
- User settings management subsystem -
-
-
- - User settings manage... - - - - - - -
-
-
- Asynchronous messaging subsystem -
-
-
- - Asynchronous messaging subsystem - - - - - - -
-
-
- External traffic management subsystem -
-
-
- - External traffic man... - - - - - - -
-
-
- Secrets and encryption management subsystem -
-
-
- - Secrets and encrypti... - - - - - - -
-
-
- Container orchestration platform -
-
-
- - Container orchestration platform - - - - - - -
-
-
- Infrastructure as a service -
-
-
- - Infrastructure as a service - - - - - - - - -
-
-
- Registry administrators -
-
-
- - Registry... - - - - - - - - - - -
-
-
- Infrastructure administrators -
-
-
- - Infrastr... - - - - - - - - -
-
-
- Unauthorized users -
-
-
- - Unauthor... - - - - - - - - -
-
-
- Citizens -
-
-
- - Citizens - - - - - - - - -
-
-
- Officers -
-
-
- - Officers - - - - - - - - - - - - -
-
-
- - Secure exchange gateway - -
-
-
- - Secure exchange gateway - - - - - - -
-
-
-
- Hardware and software cryptomodule -
-
-
-
- - Hardware and software c... - - - - - - -
-
-
- User portals subsystem -
-
-
- - User portals subsystem - - - - - - -
-
-
- Relational databases management subsystem -
-
-
- - Relational databases management subsystem - - - - - - -
-
-
- Non-relational databases management subsystem -
-
-
- - Non-relational databases management subsy... - - - - - - - - - - -
-
-
- - Platform's central components - -
-
-
- - Platform's central components - - - - - - - - -
-
-
- Administrative zone of the Platform -
-
-
- - Administrative zone of the Pla... - - - - - - -
-
-
- Platform / registries deployment and configuration subsystem -
-
-
- - Platform / registries d... - - - - - - -
-
-
- Platform and registries management subsystem -
-
-
- - Platform and registries... - - - - - - -
-
-
- Operational zone of the Platform -
-
-
- - Operational zone of the Platform - - - - - - -
-
-
- Users and roles management subsystem -
-
-
- - Users and roles mana... - - - - - - -
-
-
- Secrets and encryption management subsystem -
-
-
- - Secrets and encrypti... - - - - - - -
-
-
- Cross-service communication management subsystem -
-
-
- - Cross-service commun... - - - - - - -
-
-
- Backup and restore subsystem -
-
-
- - Backup and restore s... - - - - - - -
-
-
- Event monitoring and notification subsystem -
-
-
- - Event monitoring and... - - - - - - -
-
-
- Event logging subsystem -
-
-
- - Event logging subsys... - - - - - - -
-
-
- Request tracing subsystem -
-
-
- - Request tracing subs... - - - - - - -
-
-
- Email messaging subsystem -
-
-
- - Email messaging subs... - - - - - - -
-
-
- Distributed data storage subsystem -
-
-
- - Distributed data storage subsystem - - - - - - -
-
-
- External traffic management subsystem -
-
-
- - External traffic management subsystem - - - - - - - - - - - - - - - -
-
-
- Registry regulations developers -
-
-
- - Registry... - - - - - - - - -
-
-
- Platform management component -
-
-
- - Platform management component - - - - - - - -
-
-
- Registry subsystems -
-
-
- - Registry subsystems - - - - - - - -
-
-
- Platform subsystems -
-
-
- - Platform subsystems - - - - - - - -
-
-
- Container orchestration platform -
-
-
- - Container orchestration platform - - - - - - - -
-
-
- Infrastructure -
-
-
- - Infrastructure - - - - - - - -
-
-
- Software and hardware applications -
-
-
- - Software and hardware applications - - - - - - - -
-
-
- Platform's secrets central management service -
-
-
- - Platform's secrets cent... - - - - - - -
-
-
- Platform backups storage -
-
-
- - Platform backups storage - - - - - - - - - - - - -
-
-
- Platform administrator -
-
-
- - Platform... - - - - - - - Text is not SVG - cannot display - - - +
Component for managing the state of Platform resources
Component for managing...
Platform for state registries
Platform for state registries
Registries
Registries
Registry administrative zone
Registry administrative zo...
Registry operational zone
Registry operational zone
Registry audit events logging subsystem
Registry audit event...
Registry data management subsystem
Registry data manage...
Registry regulations modeling subsystem
Registry regulations...
Registry regulations deployment subsystem
Registry regulations...
External traffic management subsystem
External traffic management subsystem
Business processes execution subsystem
Business processes e...
Registry analytical reporting subsystem
Registry analytical...
Registry excerpts generation subsystem
Registry excerpts ge...
External API
simulation subsystem
External API...
External integrations subsystem
External integration...
Geodata management subsystem
Geodata management s...
User notification subsystem
User notification su...
Digital signatures subsystem
Digital signatures s...
Registry's operational zone service subsystem
Registry's operation...
User settings management subsystem
User settings manage...
Asynchronous messaging subsystem
Asynchronous messaging subsystem
External traffic management subsystem
External traffic man...
Secrets and encryption management subsystem
Secrets and encrypti...
Container orchestration platform
Container orchestration platform
Infrastructure as a service
Infrastructure as a service
Registry administrators
Registry...
Infrastructure administrators
Infrastr...
Unauthorized users
Unauthor...
Citizens
Citizens
Officers
Officers
Secure exchange gateway
Secure exchange gateway
Hardware and software cryptomodule
Hardware and software c...
User portals subsystem
User portals subsystem
Relational databases management subsystem
Relational databases management subsystem
Non-relational databases management subsystem
Non-relational databases management subsy...
Platform's central components
Platform's central components
Platform administrative zone
Platform administrative zone
Platform / registries deployment and configuration subsystem
Platform / registries d...
Platform and registries management subsystem
Platform and registries...
Platform operational zone
Platform operational zone
Users and roles management subsystem
Users and roles mana...
Secrets and encryption management subsystem
Secrets and encrypti...
Cross-service communication management subsystem
Cross-service commun...
Backup and restore subsystem
Backup and restore s...
Event monitoring and notification subsystem
Event monitoring and...
Event logging subsystem
Event logging subsys...
Request tracing subsystem
Request tracing subs...
Email messaging subsystem
Email messaging subs...
Distributed data storage subsystem
Distributed data storage subsystem
External traffic management subsystem
External traffic management subsystem
Registry regulations developers
Registry...
Platform management component
Platform management component
Registry subsystems
Registry subsystems
Platform subsystems
Platform subsystems
Container orchestration platform
Container orchestration platform
Infrastructure
Infrastructure
Software and hardware applications
Software and hardware applications
Platform's secrets central management service
Platform's secrets cent...
Platform backups storage
Platform backups storage
Platform administrator
Platform...Text is not SVG - cannot display \ No newline at end of file diff --git a/docs/en/modules/arch/images/architecture/platform-installer/platform-installer-subsystem.drawio.svg b/docs/en/modules/arch/images/architecture/platform-installer/platform-installer-subsystem.drawio.svg new file mode 100644 index 0000000000..75d0cf1002 --- /dev/null +++ b/docs/en/modules/arch/images/architecture/platform-installer/platform-installer-subsystem.drawio.svg @@ -0,0 +1,4 @@ + + + +
The Registries Platform
The Registries Platform
Cross-service interaction
Cross-service interaction
Platform subsystem
Platform subsystem
Target subsystem's component
Target subsystem's compone...
Deploy and update
Deploy and update
Configure
Configure
Component for managing the state of Platform resources
(control-plane-installer)
Component for managing the state of...
Platform subsystems
Platform subsystems
Container orchestration platform
Container orchestration platform
Launch process
Launch process
Technical Platform 
administrator
Technica...
Central service for managing Platform secrets
Central service for managing Platfor...
Platform backup storage
Platform backup storage
Deploy and update
Deploy and updateText is not SVG - cannot display \ No newline at end of file diff --git a/docs/en/modules/arch/images/architecture/platform-installer/platform-installer-subsystem.png b/docs/en/modules/arch/images/architecture/platform-installer/platform-installer-subsystem.png deleted file mode 100644 index a304deaed3..0000000000 Binary files a/docs/en/modules/arch/images/architecture/platform-installer/platform-installer-subsystem.png and /dev/null differ diff --git a/docs/en/modules/arch/images/architecture/platform/administrative/administrative-zone-subsystems.svg b/docs/en/modules/arch/images/architecture/platform/administrative/administrative-zone-subsystems.svg index 2242bbd705..45b7d77ed8 100644 --- a/docs/en/modules/arch/images/architecture/platform/administrative/administrative-zone-subsystems.svg +++ b/docs/en/modules/arch/images/architecture/platform/administrative/administrative-zone-subsystems.svg @@ -1,4 +1,4 @@ -
Platform administrative zone
Platform administrative zone
Operational zone of the Platform
Operational zone of the Platform
Secrets and encryption
management subsystem
Secrets and encryption...
Platform and registries management subsystem
Platform and registries management s...
Platform and registries deployment and configuration subsystem
Platform and registries deployment a...
Users and roles management subsystem
Users and roles management subsystem
Container orchestration Platform
Container orchestration Platform
Cross-service communication
Cross-service communication
Target subsystem
Target subsystem
Deployment and application of configuration changes
Deployment and application of con...
Platform subsystem
Platform subsystem
External traffic management subsystem
External traffic management subsyst...
Email messaging subsystem
Email messaging subsystem
Cross-service communication management subsystem
Cross-service communication managem...
Backup and recovery subsystem
Backup and recovery subsystem

Event logging subsystem
 Event logging subsystem
Event monitoring and notification subsystem
Event monitoring and notification s...
Request tracing subsystem
Request tracing subsystem
Distributed data storage subsystem
Distributed data storage subsystem
Registry subsystems
Registry subsystems
Service administrators
Service...
Registry subsystem
Registry subsystemText is not SVG - cannot display \ No newline at end of file +
Platform administrative zone
Platform administrative zone
Operational zone of the Platform
Operational zone of the Platform
Secrets and encryption
management subsystem
Secrets and encryption...
Platform and registries management subsystem
Platform and registries management s...
Platform and registries deployment and configuration subsystem
Platform and registries deployment a...
Users and roles management subsystem
Users and roles management subsystem
Container orchestration Platform
Container orchestration Platform
Cross-service communication
Cross-service communication
Target subsystem
Target subsystem
Deployment and application of configuration changes
Deployment and application of con...
Platform subsystem
Platform subsystem
External traffic management subsystem
External traffic management subsyst...
Email messaging subsystem
Email messaging subsystem
Cross-service communication management subsystem
Cross-service communication managem...
Backup and recovery subsystem
Backup and recovery subsystem

Event logging subsystem
 Event logging subsystem
Event monitoring and notification subsystem
Event monitoring and notification s...
Request tracing subsystem
Request tracing subsystem
Distributed data storage subsystem
Distributed data storage subsystem
Registry subsystems
Registry subsystems
Service administrators
Service...
Registry subsystem
Registry subsystemText is not SVG - cannot display \ No newline at end of file diff --git a/docs/en/modules/arch/images/architecture/platform/administrative/config-management/config-mgmt.drawio.svg b/docs/en/modules/arch/images/architecture/platform/administrative/config-management/config-mgmt.drawio.svg new file mode 100644 index 0000000000..374ca4bee8 --- /dev/null +++ b/docs/en/modules/arch/images/architecture/platform/administrative/config-management/config-mgmt.drawio.svg @@ -0,0 +1,3 @@ + + +
Platform administrative zone
Platform administrative zone
Platform and registries deployment and
configuration subsystem
Platform and registries deployment and...
Get secrets
Get secrets
Deployment
Deployment
Access to API,
state management
 of resources
Access to API,...
Configuration
deployment service 
(jenkins)
Configuration...
Deployment,
settings and
support
Deployment,...
Jenkins-оператор
(jenkins-operator)
Jenkins-оператор...
Platform
artifact repository
(nexus)
Platform...
Deployment,
settings and
support
Deployment,...
Nexus-operator
(nexus-operator)
Nexus-operator...
Settings
EDP abstractions
Settings...
Codebase-operator
(codebase-operator)
Codebase-operator...
Secrets and encryption
management subsystem
Secrets and encryption...
Container Orchestration Platform
Container Orchestration Platform
Service
administrators
Service...
Interservices interaction
Interservices interaction
Platform subsystem
Platform subsystem
Target subsystem component
Target subsystem component
Platform and registries management subsystem
Platform and registries management...
 Service for inspection and storage 
of configuration changes
(gerrit)
Service for inspection and stora...
Get configuration
Get configuration
Settings of
EDP abstractions
Settings of...
External traffic management subsystem
 of the Platform
External traffic management subsyst...
Access to the
web interface
Access to the...
Access to the
web interface
Access to the...
Registry subsystem
Registry subsystem
Підсистеми Платформи
Підсистеми Платформи
Підсистеми Платформи
Підсистеми Платформи
Platform subsystems
Platform subsystems
Підсистеми реєстру
Підсистеми реєстру
Підсистеми реєстру
Підсистеми реєстру
Registry subsystems
Registry subsystems
Settings
Settings
Registry 
configurations 
component
(registry-configuration)
Registry...Viewer does not support full SVG 1.1 \ No newline at end of file diff --git a/docs/en/modules/arch/images/architecture/platform/administrative/config-management/config-mgmt.svg b/docs/en/modules/arch/images/architecture/platform/administrative/config-management/config-mgmt.svg deleted file mode 100644 index 3919d3174e..0000000000 --- a/docs/en/modules/arch/images/architecture/platform/administrative/config-management/config-mgmt.svg +++ /dev/null @@ -1,4 +0,0 @@ - - - -
Platform and registries deployment and configuration subsystem
Platform and registries deployment and configuration subsystem
Configuration
deployment service 
(jenkins)
Configuration...
Jeknins-operator
(jenkins-operator)
Jeknins-operator...
Monitoring and
configuration changes
storage service (Gerrit)
Monitoring and...
Gerrit-operator
(gerrit-operator)
Gerrit-operator...
Platform
artifact repository
(nexus)
Platform...
Nexus-operator
(nexus-operator)
Nexus-operator...
Codebase-operator
(codebase-operator)
Codebase-operator...
External traffic management subsystem
External traffic management subsystem
Secrets and encryption
management sybsystem
Secrets and encryption...
User and role
management subsystem
User and role...
Container Orchestration Platform
Container Orchestration Platform
Service
administrators
Service...
Interservice interaction
Interservice interaction
Platform subsystem
Platform subsystem
Operator control action
Operator control action
Target subsystem component
Target subsystem componentText is not SVG - cannot display \ No newline at end of file diff --git a/docs/en/modules/arch/images/architecture/platform/administrative/config-management/secure-endpoints/operational-zones.png b/docs/en/modules/arch/images/architecture/platform/administrative/config-management/secure-endpoints/operational-zones.png index 64bfb58eb7..0273272d73 100644 Binary files a/docs/en/modules/arch/images/architecture/platform/administrative/config-management/secure-endpoints/operational-zones.png and b/docs/en/modules/arch/images/architecture/platform/administrative/config-management/secure-endpoints/operational-zones.png differ diff --git a/docs/en/modules/arch/images/architecture/platform/administrative/control-plane/control-plane.drawio.svg b/docs/en/modules/arch/images/architecture/platform/administrative/control-plane/control-plane.drawio.svg new file mode 100644 index 0000000000..7787bbea32 --- /dev/null +++ b/docs/en/modules/arch/images/architecture/platform/administrative/control-plane/control-plane.drawio.svg @@ -0,0 +1,4 @@ + + + +
Platform administrative zone
Platform administrative zone
Platform and registries
management subsystem
Platform and registries...
Save secrets
Save secrets
Access to API,
state management
 of resources
Access to API,...
Cluster management
web interface OpenShift
(console)
Cluster management...
Deployment, configuration
and support
Deployment, configuration...
OpenShift-console
operator
(console-operator)
OpenShift-console...
Configuration
 saving
Configuration...
Access to API,
state management
 of resources
Access to API,...
Platform and registries management web interface
(control-plane-console)
Platform and registries mana...
Deployment, configuration
and support
Deployment, configuration...
Operator
administrative console
(admin-console-
operator)
Operator...
Secrets and encryption
 management subsystem
Secrets and encryption...
Сontainer orchestration platform
Сontainer orchestration platform
Service
 administrators
Service...
Interservice interaction
Interservice interaction
Platform subsystem
Platform subsystem
Platform
documentation
(ddm-architecture)
Platform...
Target subsystem component
Target subsystem comp...
External traffic management subsystem
External traffic management subsyst...
Access to
documentation
Access to...
 Service for inspection
 and storage
of configuration
 changes (gerrit)
Service for inspection...
Deployment, configuration
and support
Deployment, configuration...
Gerrit-operator
(gerrit-operator)
Gerrit-operator...
Traffic redirection
Traffic redirection
Access to web interface
Access to web interface
Traffic redirection
Traffic redirection
ServiceMesh-gateway
(istio-ingressgateway-control-plane-main)
ServiceMesh-gateway...Text is not SVG - cannot display \ No newline at end of file diff --git a/docs/en/modules/arch/images/architecture/platform/administrative/control-plane/control-plane.png b/docs/en/modules/arch/images/architecture/platform/administrative/control-plane/control-plane.png deleted file mode 100644 index 64312acf7b..0000000000 Binary files a/docs/en/modules/arch/images/architecture/platform/administrative/control-plane/control-plane.png and /dev/null differ diff --git a/docs/en/modules/arch/images/architecture/platform/operational/secret-management/secret-management.drawio.svg b/docs/en/modules/arch/images/architecture/platform/operational/secret-management/secret-management.drawio.svg index 7819e44c26..058b838258 100644 --- a/docs/en/modules/arch/images/architecture/platform/operational/secret-management/secret-management.drawio.svg +++ b/docs/en/modules/arch/images/architecture/platform/operational/secret-management/secret-management.drawio.svg @@ -1,4 +1,4 @@ -
Platform operational zone
Platform operational zone
Secret and encryption management 
subsystem
Secret and encryption management...
Platform external traffic
management subsystem
Platform external traffic...
System
Administrators
System...
Inter-service interaction
Inter-service interaction
Platform subsystem
Platform subsystem
Secret and encryption
management service 
(hashicorp-vault)
Secret and encryption...
Storing secrets
Storing secrets
Platform and Registries managment subsystem
Platform and Registries managment s...
Target subsystem component
Target subsystem component
Receiving
secrets
Receiving...
Platform and Registries configuration changes deployment subsystem
Platform and Registries configurati...
Platform secrets central
management service
(hashicorp-vault)
Platform secrets central...
Platform component
Platform component
Auto-unseal operation in
Transit Secret Engine
Auto-unseal operation in...Text is not SVG - cannot display \ No newline at end of file +
Platform operational zone
Platform operational zone
Secret and encryption management 
subsystem
Secret and encryption management...
Platform external traffic
management subsystem
Platform external traffic...
System
Administrators
System...
Inter-service interaction
Inter-service interaction
Platform subsystem
Platform subsystem
Secret and encryption
management service 
(hashicorp-vault)
Secret and encryption...
Storing secrets
Storing secrets
Platform and registries management subsystem
Platform and registries management...
Target subsystem component
Target subsystem component
Receiving
secrets
Receiving...
Subsystem for deploying and configuring the Platform and registries
Subsystem for deploying and configu...
Platform central secrets 
management service
(hashicorp-vault)
Platform central secrets...
Platform component
Platform component
Auto-unseal operation in
Transit Secret Engine
Auto-unseal operation in...
Certificate issuance and management
Certificate issuance and management
Certificate and certificate
 issuers management service
 (cert-manager)
Certificate and certificate...
Request tracing subsystem
Request tracing subsystemText is not SVG - cannot display \ No newline at end of file diff --git a/docs/en/modules/arch/images/architecture/platform/operational/service-mesh/service-mesh-subsystem.drawio.svg b/docs/en/modules/arch/images/architecture/platform/operational/service-mesh/service-mesh-subsystem.drawio.svg new file mode 100644 index 0000000000..f5e3882323 --- /dev/null +++ b/docs/en/modules/arch/images/architecture/platform/operational/service-mesh/service-mesh-subsystem.drawio.svg @@ -0,0 +1,3 @@ + + +
Platform operation area
Platform operation area
Registry administrative area
Registry administrative area
Register operation area
Register operation area
Interservice interaction
 management subsystem
Interservice interaction...
Control subsystem
external traffic
Control subsystem...
Сontainer orchestration platform
Сontainer orchestration platform
Services
administrators
Services...
Interservice interaction
Interservice interaction
Registry subsystem
Registry subsystem
Platform subsystem
Platform subsystem
External
API gateway of
administrative
area
External...
Istio Envoy
Istio Envoy
Access to data
Access to data
Web interface
management
and monitoring
Service Mesh (kiali)
Web interface...
Data collection
Data collection
Prometheus
Prometheus
Deployment and 
configuration

Deployment and...
Deployment and 
configuration

Deployment and...
Istio-operator
(istio-operator)
Istio-operator...
Istio
Control Plane
(istiod)
Istio...
Request tracing
subsystem
Request tracing...
Subsystem component
Subsystem component
Container of the
component
Container of the...
Istio Envoy
Istio Envoy
External
API gateway
operating room
zones
External...
mTLS
mesh traffic
mTLS...
Istio Envoy
Istio Envoy
Subsystem component
Subsystem component
Container of the
component
Container of the...
mTLS
mesh traffic
mTLS...
Istio Envoy
Istio Envoy
mTLS
mesh traffic
mTLS...
Configuration and metrics
Configuration and metrics
Interservice mTLS interaction
Interservice mTLS interaction
Target subsystem component
Target subsystem component
Deployment and
 configuration

Deployment and...
Get information of
deployed applications
Get information of...
Data collection
Data collection
Redirection of
external traffic
Redirection of...
Registry subsystems
Registry subsystems
External traffic management subsystem
External traffic management subsystem
Control subsystem
external traffic
Control subsystem...
Registry subsystems
Registry subsystemsViewer does not support full SVG 1.1 \ No newline at end of file diff --git a/docs/en/modules/arch/images/architecture/platform/operational/service-mesh/service-mesh-subsystem.svg b/docs/en/modules/arch/images/architecture/platform/operational/service-mesh/service-mesh-subsystem.svg deleted file mode 100644 index c439c5bfc7..0000000000 --- a/docs/en/modules/arch/images/architecture/platform/operational/service-mesh/service-mesh-subsystem.svg +++ /dev/null @@ -1,4 +0,0 @@ - - - -
Операційна зона Платформи
Операційна зона Платформи
Administrative area of the register
Administrative area of the register
Register operation area
Register operation area
Interservice interaction management subsystem
Interservice interaction management subsystem
Control subsystem
external traffic
Control subsystem...
User and role
management subsystem
User and role...

Сontainer orchestration platform

Сontainer orchestration platform
Services
administrators
Services...
Interservice interaction
Interservice interaction
Підсистема реєстру
Підсистема реєстру
Control action of the operator
Control action of the ope...
Platform subsystem
Platform subsystem
Control subsystem
external traffic
Control subsystem...
External
API gateway
administrative
zones
External...
Istio Envoy
Istio Envoy
Web interface
management
and monitoring
Service Mesh (kiali)
Web interface...
Prometheus
Prometheus
Istio-operator
Istio-operator
Istio
Control Plane
(istiod)
Istio...
Trace subsystem
requests
Trace subsystem...
Registry subsystems
Registry subsystems
Subsystem component
Subsystem component
Container of the
component
Container of the...
Istio Envoy
Istio Envoy
Control subsystem
external traffic
Control subsystem...
External
API gateway
operating room
zones
External...
Istio Envoy
Istio Envoy
Registry subsystems
Registry subsystems
Компонент підсистеми
Компонент підсистеми
Container of the
component
Container of the...
Istio Envoy
Istio Envoy
1
1
1
1
1
1
Interservice mTLS interaction
Interservice mTLS interaction
N
N
Conditional connector
Conditional connect...
The target subsystem component
The target subsystem componentText is not SVG - cannot display \ No newline at end of file diff --git a/docs/en/modules/arch/images/architecture/registry/administrative/ext-api-management/registry-admin-ext-traffic-subsystem.drawio.svg b/docs/en/modules/arch/images/architecture/registry/administrative/ext-api-management/registry-admin-ext-traffic-subsystem.drawio.svg index 070bc404c9..131a55f93e 100644 --- a/docs/en/modules/arch/images/architecture/registry/administrative/ext-api-management/registry-admin-ext-traffic-subsystem.drawio.svg +++ b/docs/en/modules/arch/images/architecture/registry/administrative/ext-api-management/registry-admin-ext-traffic-subsystem.drawio.svg @@ -1,4 +1,4 @@ - + -
Administrative area of the register
Administrative area of the register
Control subsystem
external traffic
Control subsystem...
Incoming traffic
Incoming traffic
Control subsystem
external traffic
Platforms
Control subsystem...
Сontainer orchestration platform
Сontainer orchestration platform
Services 
administrators
Services...
Interservice interaction
Interservice interaction
Platform subsystem
Platform subsystem
Component
target subsystem
Component...
Service subsystem of the registry operating area
Service subsystem of the regi...
Registry regulation deployment subsystem
Registry regulation deploymen...
User and role management subsystem
User and role management subsystem
Subsystem for modeling the registry regulation
Subsystem for modeling the re...
Registry subsystem
Registry subsystem
Operator control action
Operator control action
Non-relational database management subsystem
Non-relational database manage...
sessions_admin_tools
sessions_admin_tools
Operational storage
user sessions
Operational storage...
ServiceMesh-gateway 
(istio-ingressgateway)
ServiceMesh-gateway...
External API gateway
administrative zone
(kong-admin-tools-kong-admin-tools)
External API gateway...
Istio Envoy
Istio Envoy
Saving sessions
users
Saving sessions...
Redirection
custom
traffic
Redirection...
Authentication
users
Authentication...
Kong Proxy
Kong Proxy
Receiving
  configurations
Receiving...
Ingress Controller
Ingress Controller
traffic
traffic
Settings
Settings
Interservice interaction with mTLS authentication
Interservice interaction with...Text is not SVG - cannot display \ No newline at end of file +
Administrative area of the register
Administrative area of the register
Control subsystem
external traffic
Control subsystem...
Incoming traffic
Incoming traffic
Control subsystem
external traffic
Platforms
Control subsystem...
Сontainer orchestration platform
Сontainer orchestration platform
Services 
administrators
Services...
Interservice interaction
Interservice interaction
Platform subsystem
Platform subsystem
Component
target subsystem
Component...
Service subsystem of the registry operating area
Service subsystem of the reg...
Registry regulation deployment subsystem
Registry regulation deployme...
User and role management subsystem
User and role management subsystem
Subsystem for modeling the registry regulation
Subsystem for modeling the r...
Registry subsystem
Registry subsystem
Operator control action
Operator control action
Non-relational database management subsystem
Non-relational database manage...
sessions_admin_tools
sessions_admin_tools
Operational storage
user sessions
Operational storage...
ServiceMesh-gateway 
(istio-ingressgateway)
ServiceMesh-gateway...
External API gateway
administrative zone
(kong-admin-tools-kong-admin-tools)
External API gateway...
Istio Envoy
Istio Envoy
Saving sessions
users
Saving sessions...
Redirection
custom
traffic
Redirection...
Authentication
users
Authentication...
Kong Proxy
Kong Proxy
Receiving
  configurations
Receiving...
Ingress Controller
Ingress Controller
traffic
traffic
Settings
Settings
Interservice interaction with mTLS authentication
Interservice interaction with...Text is not SVG - cannot display \ No newline at end of file diff --git a/docs/en/modules/arch/images/architecture/registry/administrative/regulation-management/ImportUsersFlow.drawio.png b/docs/en/modules/arch/images/architecture/registry/administrative/regulation-management/ImportUsersFlow.drawio.png index c9e3ca1427..0e5926a929 100644 Binary files a/docs/en/modules/arch/images/architecture/registry/administrative/regulation-management/ImportUsersFlow.drawio.png and b/docs/en/modules/arch/images/architecture/registry/administrative/regulation-management/ImportUsersFlow.drawio.png differ diff --git a/docs/en/modules/arch/images/architecture/registry/administrative/regulation-management/regulation-management-design-1.svg b/docs/en/modules/arch/images/architecture/registry/administrative/regulation-management/regulation-management-design-1.svg new file mode 100644 index 0000000000..238b248879 --- /dev/null +++ b/docs/en/modules/arch/images/architecture/registry/administrative/regulation-management/regulation-management-design-1.svg @@ -0,0 +1,4 @@ + + + +
Relational database
management subsystem
Relational database...
Administrative registry area 
Administrative registry area 
Temporary data bases 
for candidate versions
Temporary data bases...
Registry
administrators
Registry...
 Registry
regulations developers
Registr...
CRUD operations on the 
regulations components 
Import users
from a file
CRUD operations on the regulations components...
Git operations
with regulations
Git operations...
External traffic
management subsystem
External traffic...
Users and roles
management subsystem
Users and roles...
Launch of pipelines for
verification and publication of
changes to regulations
Launch of pipelines for...
Websocket protocol
Tips for development of
Groovy and XML
Websocket protocol...
External traffic management subsystem
External traffic management subsyst...
Registry regulations
deployment subsystem
Registry regulations...
Registry data management subsystem
Registry data management subsystem
Link to user import
event log
Link to user import...
Event logging subsystem
Event logging subsystem
SAML authentication/
authorization
SAML authentication/...
Веб-інтерфейс
моделювання звітів(3)
(redash-admin)
Веб-інтерфейс...
Distributed data storage subsystem
Distributed data storage subsystem
Secrets and encryption
management subsystem
Secrets and encryption...
Asynchronous messaging subsystem
Asynchronous messaging subsystem
Modeled reports
Report archives(1)
Modeled reports...
Search queries for forms
with the Select type fields
Search queries for forms...
Quick link to
candidate versions
Quick link to...
Launching
the import utility
Launching...
Decryption of the file
with users
Decryption of the file...
Saving file with
users
Saving file with...
Encryption of the file
with users
Encryption of the file...
Download file
with users
Download file...
Saving information
to the audit
Saving information...
1
1
Creation of
users
Creation of...
1
1
Modeled reports
Report archives(1)
Modeled reports...
Service interaction
Service interaction
Registry subsystem
Registry subsystem
Platform Subsystem
Platform Subsystem
N
N
Conditional connector
Conditional connector
Target subsystem component
Target subsystem comp...
Link in web application
Link in web application
2
2
2
2
Regulations modeling
web interface
(admin-portal)
Regulations modeling...
Service of monitoring and storing regulations changes
(gerrit)
Service of monitoring and storing r...
Report downloading
service
(report-exporter)
Report downloading...
Language server
(ddm-language-server)
Language server...
Registry management
service
(registry-regulation-management)
Registry management...
Utility to download 
officers
(publish-users-job)
Utility to download...
user-import
user-import
user-import-archive
user-import-archive
audit-events
audit-events
analytical:registry
analytical:registry
operational:registry-dev-*
operational:registry-dev-*
Execution of queries
to generate resulted reports
Execution of queries...
Deployment of temporary
databases for
candidate versions(2)
Deployment of temporary...
registry-regulations
registry-regulations
Service of inspection and
storage of changes to regulations
(gerrit)
Service of inspection and...Text is not SVG - cannot display \ No newline at end of file diff --git a/docs/en/modules/arch/images/architecture/registry/administrative/regulation-management/regulation-management-design.svg b/docs/en/modules/arch/images/architecture/registry/administrative/regulation-management/regulation-management-design.svg deleted file mode 100644 index e98dd610ab..0000000000 --- a/docs/en/modules/arch/images/architecture/registry/administrative/regulation-management/regulation-management-design.svg +++ /dev/null @@ -1,4 +0,0 @@ - - - -
Relational database
management subsystem
Relational database...
Administrative registry area 
Administrative registry area 
Temporary data bases 
for candidate versions
Temporary data bases...
Registry
administrators
Registry...
Developers of
registry
regulations
Develope...
CRUD operations on the 
regulations components 
Import users
from a file
CRUD operations on the regulations components...
Git operations
with regulations
Git operations...
External traffic
management subsystem
External traffic...
Users and roles
management subsystem
Users and roles...
Launch of pipelines for
verification and publication of
changes to regulations
Launch of pipelines for...
Websocket protocol
Tips for development of
Groovy and XML
Websocket protocol...
External traffic management subsystem
External traffic management subsyst...
Registry regulations
deployment subsystem
Registry regulations...
Registry data management subsystem
Registry data management subsystem
Link to user import
event log
Link to user import...
Event logging subsystem
Event logging subsystem
SAML authentication/
authorization
SAML authentication/...
Веб-інтерфейс
моделювання звітів(3)
(redash-admin)
Веб-інтерфейс...
Distributed data storage subsystem
Distributed data storage subsystem
Secrets and encryption
management subsystem
Secrets and encryption...
Asynchronous messaging subsystem
Asynchronous messaging subsystem
Modeled reports
Report archives(1)
Modeled reports...
Search queries for forms
with the Select type fields
Search queries for forms...
Quick link to
candidate versions
Quick link to...
Launching
the import utility
Launching...
Decryption of the file
with users
Decryption of the file...
Saving file with
users
Saving file with...
Encryption of the file
with users
Encryption of the file...
Download file
with users
Download file...
Saving information
to the audit
Saving information...
1
1
Creation of
users
Creation of...
1
1
Modeled reports
Report archives(1)
Modeled reports...
Service interaction
Service interaction
Registry subsystem
Registry subsystem
Platform Subsystem
Platform Subsystem
N
N
Conditional connector
Conditional connector
Target subsystem component
Target subsystem comp...
Link in web application
Link in web application
2
2
2
2
Regulations modeling
web interface
(admin-portal)
Regulations modeling...
Service of monitoring and storing regulations changes
(gerrit)
Service of monitoring and storing r...
Report downloading
service
(report-exporter)
Report downloading...
Language server
(ddm-language-server)
Language server...
Registry management
service
(registry-regulation-management)
Registry management...
Utility to download 
officers
(publish-users-job)
Utility to download...
user-import
user-import
user-import-archive
user-import-archive
audit-events
audit-events
analytical:registry
analytical:registry
operational:registry-dev-*
operational:registry-dev-*
Execution of queries
to generate resulted reports
Execution of queries...
Deployment of temporary
databases for
candidate versions(2)
Deployment of temporary...
registry-regulations
registry-regulations
Service of inspection and
storage of changes to regulations
(gerrit)
Service of inspection and...Text is not SVG - cannot display \ No newline at end of file diff --git a/docs/en/modules/arch/images/architecture/registry/operational/ext-api-management/registry-ext-traffic-subsystem.drawio.svg b/docs/en/modules/arch/images/architecture/registry/operational/ext-api-management/registry-ext-traffic-subsystem.drawio.svg index c0f2813a8b..3e87802a1d 100644 --- a/docs/en/modules/arch/images/architecture/registry/operational/ext-api-management/registry-ext-traffic-subsystem.drawio.svg +++ b/docs/en/modules/arch/images/architecture/registry/operational/ext-api-management/registry-ext-traffic-subsystem.drawio.svg @@ -1,4 +1,4 @@ - + -
Registry operational zone
Registry operational zone
External traffic management subsystem
External traffic management subsystem
Incoming traffic
Incoming traffic
External traffic management
subsystem
External traffic management...
Container orchestration platform
Container orchestration platform
Citizens
Citizens
Officers
Officers
Cross-service communication
Cross-service communicati...
Platform subsystem
Platform subsystem
Target subsystem component
Target subsystem component
Registry data management subsystem
Registry data management sub...
User and roles management
subsystem
User and roles management...
External integrations
subsystem
External integrations...
Registry subsystem
Registry subsystem
Business process
management subsystem
Business process...
User settings management
subsystem
User settings management...
Registry excerpt generation subsystem
Registry excerpt generation...
External systems simulation
API subsystem
External systems simulation...
User notification subsystem
User notification subsystem
Registry analytical
reporting subsystem
Registry analytical...
Geodata management
subsystem
Geodata management...
Operator's control action
Operator's control action
Non-relational database management system
Non-relational database manage...
sessions
sessions
Операційне сховище
сесій користувачів
Операційне сховище...
ServiceMesh-gateway
(istio-ingressgateway)
ServiceMesh-gateway...
External API gateway
of the registry operational zone (kong-kong)
External API gateway...
Istio Envoy
Istio Envoy
Save user sessions
Save user sessions
User authentication
User authentication
Redirect user traffic
Redirect user traffic
Kong Proxy
Kong Proxy
User traffic
redirectio
User traffic...
Unauthorized
users
Unauthor...
Redirect user traffic
Redirect user traffic
Get configuration
Get configuration
Ingress Controller
Ingress Controller
трафік
трафік
Налаштування
Налаштування
Cross-service communication with mTLS authentication
Cross-service communication w...
User portal subsystem
User portal subsystemText is not SVG - cannot display \ No newline at end of file +
Registry operational zone
Registry operational zone
External traffic management subsystem
External traffic management subsystem
Incoming traffic
Incoming traffic
External traffic management
subsystem
External traffic management...
Container orchestration platform
Container orchestration platform
Citizens
Citizens
Officers
Officers
Cross-service communication
Cross-service communicati...
Platform subsystem
Platform subsystem
Target subsystem component
Target subsystem component
Registry data management subsystem
Registry data management sub...
User and roles management
subsystem
User and roles management...
External integrations
subsystem
External integrations...
Registry subsystem
Registry subsystem
Business process
management subsystem
Business process...
User settings management
subsystem
User settings management...
Registry excerpt generation subsystem
Registry excerpt generation...
External systems simulation
API subsystem
External systems simulation...
User notification subsystem
User notification subsystem
Registry analytical
reporting subsystem
Registry analytical...
Geodata management
subsystem
Geodata management...
Operator's control action
Operator's control action
Non-relational database management system
Non-relational database manage...
sessions
sessions
Операційне сховище
сесій користувачів
Операційне сховище...
ServiceMesh-gateway
(istio-ingressgateway)
ServiceMesh-gateway...
External API gateway
of the registry operational zone (kong-kong)
External API gateway...
Istio Envoy
Istio Envoy
Save user sessions
Save user sessions
User authentication
User authentication
Redirect user traffic
Redirect user traffic
Kong Proxy
Kong Proxy
User traffic
redirectio
User traffic...
Unauthorized
users
Unauthor...
Redirect user traffic
Redirect user traffic
Get configuration
Get configuration
Ingress Controller
Ingress Controller
трафік
трафік
Налаштування
Налаштування
Cross-service communication with mTLS authentication
Cross-service communication w...
User portal subsystem
User portal subsystemText is not SVG - cannot display \ No newline at end of file diff --git a/docs/en/modules/arch/pages/architecture/container-platform/container-platform.adoc b/docs/en/modules/arch/pages/architecture/container-platform/container-platform.adoc index 3a9b658e30..75ffcc0043 100644 --- a/docs/en/modules/arch/pages/architecture/container-platform/container-platform.adoc +++ b/docs/en/modules/arch/pages/architecture/container-platform/container-platform.adoc @@ -3,31 +3,14 @@ include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] -//== Загальний опис == General description -//// -OpenShift — це платформа управління контейнерами з відкритим кодом, що забезпечує розширені можливості оркестрації та -розгортання контейнеризованого програмного забезпечення. Вона розроблена на базі Kubernetes, надає повноцінний стек рішень -та абстракцій для розробки, розгортання, керування та моніторингу контейнерів. Ця платформа надає можливість розгорнути своє програмне -забезпечення в будь-якому публічному хмарному середовищі, приватному хмарному середовищі або на власній локальній інфраструктурі, -забезпечуючи стійкість, надійність та безпеку для розгорнутого програмного забезпечення. -//// -OpenShift is an open source container management platform that provides advanced orchestration capabilities and +*_OpenShift_* is an open-source container management platform that provides advanced orchestration capabilities and deployment of containerized software. It is developed on the basis of Kubernetes, provides a full stack of solutions and abstractions for developing, deploying, managing, and monitoring containers. This platform provides an opportunity to deploy your software provision in any public cloud environment, private cloud environment or on your own local infrastructure, providing resilience, reliability and security for deployed software. -//// -OpenShift є гнучкою платформою, що може бути легко розширена, доповнена та інтегрована з іншими інструментами, -платформами та програмним забезпеченням. Це дозволяє мати: - -* можливості моніторингу та логування, які надають інформацію про стан та продуктивність програмного забезпечення та інфраструктури -* політики мережевої безпеки та контроль доступу на основі ролей (RBAC), що дозволяють безпечно публікувати та надавати доступ кінцевим користувачам -* резервне копіювання та масштабування платформи та розгорнутого програмного забезпечення, що дозволяє швидко відновлювати стан системи -та реагувати на збільшення чи зменшення навантаження. -* розподілені сховища даних для зберігання стану та інформації stateful-застосунків -//// + OpenShift is a flexible platform that can be easily extended, supplemented and integrated with other tools, platforms and software. This allows you to have: @@ -37,63 +20,27 @@ platforms and software. This allows you to have: and respond to load increases or decreases. * distributed data stores for storing state and information of stateful applications. -//// -OpenShift є ідеальним рішенням для організацій, які бажають модернізувати свою інфраструктуру програмного забезпечення -та прискорити процеси цифрової трансформації. В Платформі реєстрів, OpenShift використовується в якості основної платформи -для розгортання та управління контейнеризованими застосунками. -//// OpenShift is an ideal solution for organizations looking to modernize their software infrastructure and accelerate digital transformation processes. In Registry Platform, OpenShift is used as the main platform for deploying and managing containerized applications. -//// -== Функції платформи оркестрації контейнерів - -* Оркестрація контейнерів -* Балансування навантаження -* Масштабування застосунків -* Моніторинг застосунків -* Забезпечення безпеки та надійності -//// == Main features -* Container orchestration -* Load balancing -* Application scaling -* Application monitoring -* Ensuring safety and reliability - -//// -== Верхньорівнева архітектура платформи оркестрації контейнерів - -image::architecture/container-platform/container-orchestration.svg[width=750,float="center",align="center"] - -Архітектура OpenShift складається з декількох віртуальних машин, включаючи: - -* Мастер віртуальні машини. Відповідають за керування загальним станом кластера, включаючи планування та розгортання застосунків. -* Інфраструктурні та платформні віртуальні машини. Містят в собі системні оператори та застосунки що забезпечують роботу -Платформи оркестрації контейнерів та Платформи реєстрів. -* Реєстрові віртуальні машини. Запускають контейнери з програмним забезпеченням для роботи реєстру. -//// -The high-level architecture of the container orchestration platform +* [*] Container orchestration +* [*] Load balancing +* [*] Application scaling +* [*] Application monitoring +* [*] Ensuring safety and reliability +.The high-level architecture of the container orchestration platform image::architecture/container-platform/container-orchestration.svg[width=750,float="center",align="center"] The OpenShift architecture consists of several virtual machines, including: -* Master virtual machines. Responsible for managing the overall health of the cluster, including application planning and deployment. -* Infrastructure and platform virtual machines. They contain system operators and applications that provide work -Container Orchestration Platforms and Registry Platforms. -* Registered virtual machines. Run containers with registry software. - -//// -== Технологічний стек - -При проектуванні та розробці підсистеми, були використані наступні технології: - -* xref:arch:architecture/platform-technologies.adoc#okd[OKD] -* xref:arch:architecture/platform-technologies.adoc#kubernetes[Kubernetes] -//// +* *Master virtual machines*. Responsible for managing the overall health of the cluster, including application planning and deployment. +* *Infrastructure and Platform virtual machines*. They contain system operators and applications that provide work for +_Container orchestration Platform_ and _Registries Platforms_. +* *Registry virtual machines*. Run containers with registry software. == Technology stack @@ -102,53 +49,20 @@ During the design and development of the subsystem, the following technologies w * xref:arch:architecture/platform-technologies.adoc#okd[OKD] * xref:arch:architecture/platform-technologies.adoc#kubernetes[Kubernetes] -//// -== Атрибути якості платформи оркестрації контейнерів - -=== _Scalability_ - -Платформа оркестрації контейнерів Openshift має здатність ефективно масштабуватися відповідно до змін вимог до застосунків. -Це включає здатність автоматично створювати та розгортати додаткові ресурси, такі як нові контейнери або віртуальні машини, -для обробки збільшеного навантаження, а також здатність видаляти ресурси під час періодів зниженого попиту для оптимізації -використання ресурсів та коштів. - -Платформа досягає масштабованості за допомогою поєднання декларативної конфігурації, автоматичного масштабування (HPA) -та автоматичного масштабування самого кластера. Декларативна конфігурація дозволяє адміністраторам визначати та управляти -ресурсами застосунків у послідовний та повторюваний спосіб, що полегшує масштабування відповідно до потреб. HPA -відслідковує використання ресурсів окремих застосунків та масштабує їх кількість вгору або вниз залежно від попередньо -заданих правил, таких як використання CPU чи пам'яті. Автоматичне масштабування кластера, з іншого боку, автоматично -створює або видаляє віртуальні машини в кластері в залежності від попиту, що дозволяє ефективно використовувати ресурси -та оптимізувати витрати. -//// === Scalability -Openshift's container orchestration platform has the ability to scale efficiently as application requirements change. +OpenShift container orchestration platform has the ability to scale efficiently as application requirements change. This includes the ability to automatically create and deploy additional resources such as new containers or virtual machines, -to handle increased load, and the ability to remove resources during periods of reduced demand for optimization +to handle an increased load, and the ability to remove resources during periods of reduced demand for optimization use of resources and funds. -The platform achieves scalability through a combination of declarative configuration, auto scaling (HPA) +The platform achieves scalability through a combination of declarative configuration, auto-scaling (HPA) and automatic scaling of the cluster itself. Declarative configuration allows administrators to define and manage application resources in a consistent and repeatable manner that facilitates scaling as needed. HPA monitors the resource usage of individual applications and scales their amount up or down depending on the previous given rules, such as CPU or memory usage. Cluster autoscaling, on the other hand, is automatic -creates or deletes virtual machines in the cluster depending on demand, allowing efficient use of resources -and optimize costs. -//// -=== _Availability_ - -Платформа оркестрації контейнерів Openshift надає кілька функцій та механізмів для покращення доступності застосунків, -які працюють на платформі, зокрема: - -* Openshift підтримує автоматичне балансування навантаження та переключення на резервні екземпляри застосунків на -різніх віртуальних машинах кластеру. Це гарантує, що якщо віртуальна машина працює некоректно, то його роботу можна -безперешкодно перенести на інші здорові машини без впливу на доступність застосунку. -* Openshift підтримує концепцію реплік, яка дозволяє запускати кілька екземплярів застосунків одночасно. -Це гарантує, що навіть якщо один або декілька екземплярів вийдуть з ладу, застосунок все ще буде доступний для користувачів -через робочі екземпляри. -* Openshift дозволяє використовувати rolling оновлення для розгортання нових версій застосунків з мінімальним впливом -на користувачів. Це забезпечує можливість оновлення без перерв у роботі або призупинення надання послуг. -//// + and creates or deletes virtual machines in the cluster depending on demand, allowing efficient use of resources +and optimizing costs. === Availability * Openshift supports automatic load balancing and failover of application instances on @@ -160,25 +74,6 @@ through working instances. * Openshift allows you to use rolling updates to deploy new versions of applications with minimal impact on users. This ensures that updates can be made without interruptions or service interruptions. -//// -=== _Portability_ - -Платформа оркестрації контейнерів Openshift та розгорнуте на ній програмне забезпечення встановлюється та може бути перенесено -на різні інфраструктурні середовища, від публічних та приватних хмарних платформ, до власної локальної інфраструктури -без необхідності внесення значних змін до програмного забезпечення або основної інфраструктури. - -Платформа оркестрації контейнерів побудована шляхом абстрагування від деталей інфраструктури та забезпечує стандартне -runtime-середовище для застосунків незалежно від місця їх розгортання. Це досягається за допомогою контейнеризації, яка -дозволяє упаковувати застосунки у самодостатні та переносимі контейнери, та використання декларативної конфігурації, що -автоматизовує надання та налаштування інфраструктурних ресурсів. - -Крім того, Платформа оркестрації контейнерів надає набір API та абстракцій, що дозволяє командам -експлуатації керувати та оркеструвати контейнеризовані застосунки в стандартний та платформо-незалежний спосіб. - -Таким чином, платформа оркестрації контейнерів дозволяє розгортати та запускати застосунки у будь-яких середовищах без -змін вихідного коду, забезпечуючи зниження часу та зусиль для розгортання застосунків та забезпечуючи їхню переносимість. -//// - === Portability The Openshift container orchestration platform and the software @@ -197,19 +92,6 @@ operations to manage and orchestrate containerized applications in a standard an Thus, the container orchestration platform allows you to deploy and run applications in any environment without source code changes, reducing the time and effort to deploy applications and ensuring their portability. -//// -=== _Operability_ - -Платформа оркестрації контейнерів Openshift надає набір інструментів адміністратора та API для управління, експлуатації та вирішення -проблем з кластерами та застосунками на ній, включаючи візуальні інтерфейси, консоль утиліту `oc` та OpenShift API. - -Ці інструменти дозволяють адміністраторам переглядати та керувати станом кластера, розгортати нові додатки або оновлення, -контролювати метрики продуктивності та журнали, виконувати різного роду перевірки, аудит та масштабування. - -Операційність в платформі також досягається завдяки практикам інфраструктури-як-код (IaC) та інструментом автоматизації -Terraform, який дозволяє здійснювати послідовне та повторне розгортання та налаштування кластерів OpenShift та пов'язаних ресурсів. -//// - === Operability Openshift's container orchestration platform provides a set of admin tools and APIs for management, operation, and resolution @@ -221,24 +103,6 @@ monitor performance metrics and logs, perform various checks, audits, and scalin Platform interoperability is also achieved through infrastructure as code (IaC) practices and automation tools Terraform, which enables consistent and repeatable deployment and configuration of OpenShift clusters and related resources. -//// -=== _Security_ - -Платформа оркестрації контейнерів Openshift забезпечує широкий спектр функцій та можливостей для забезпечення безпеки -застосунків та їх даних. До них належать контроль доступу на основі ролей (RBAC), політики мережі, управління секретами, -безпека контейнерних образів, журналювання аудиту та обмеження security context (SCC). - -Контроль доступу на основі ролей дозволяє адміністраторам визначати контроль доступу та дозволи для користувачів та -застосунків, забезпечуючи доступ до ресурсів лише авторизованим користувачам. -Політики мережі дозволяють обмежувати мережевий трафік між застосунками та застосовувати правила для забезпечення -сегментації мережі. - -Управління секретами забезпечує безпечний механізм зберігання та використання чутливих даних, таких як паролі та -сертифікати. - -Таким чином, використовуючи ці функції безпеки Платформи OpenShift, можна забезпечити безпеку застосунків розгорнутих в -OpenShift, захищаючи їх від несанкціонованого доступу, порушень даних та інших загроз безпеці. -//// === Security The Openshift container orchestration platform provides a wide range of security features and capabilities for @@ -256,18 +120,6 @@ certificates Thus, using these security features of the OpenShift Platform, it is possible to ensure the security of applications deployed in OpenShift, protecting them from unauthorized access, data breaches and other security threats. -//// -=== _Observability_ - -Платформа оркестрації контейнерів Openshift надає можливість отримувати інформацію про продуктивність, поведінку та стан -контейнеризованих застосунків, що працюють на кластері. Це включає можливість моніторингу та аналізу метрик, що стосуються -продуктивності застосунків та інфраструктури, а також збирання та аналіз логів та трейсів застосунків. Платформа має -вбудовані можливості для спостережуваності, включаючи підтримку різноманітних рішень для моніторингу та можливість -інтеграції з зовнішніми системами логування та трейсингу. Крім того, вона надає API та інструменти для налаштування та -керування можливостями спостережуваності, що дозволяє командам експлуатації отримувати глибокі інсайти в поведінці та -стану своїх застосунків та інфраструктури. -//// - === Observability Openshift container orchestration platform provides performance, behavior, and health insights @@ -278,19 +130,10 @@ integration with external logging and tracing systems. In addition, it provides manage observability, enabling operations teams to gain deep insights into the behavior and state of their applications and infrastructure. -//// -=== _Extensibility_ -Платформа оркестрації контейнерів Openshift забезпечує широкі можливості по налаштуванню та розширенню самої платформи, щоб -вона відповідала конкретним потребам та вимогам. Вона надає багатий перелік точок розширення, таких як визначення -власних ресурсів (CRD), admission контролери та оператори, які дозволяють створювати власні контролери та інші -компоненти, які інтегруються з самою платформою. Це дозволяє будувати та розгортати власні рішення на основі -OpenShift, забезпечуючи при цьому використання основних функціональних можливостей та переваг платформи. -//// - === Extensibility The Openshift container orchestration platform provides extensive customization and extensibility of the platform itself to it met specific needs and requirements. It provides a rich list of extension points such as definitions -own resources (CRD), admission controllers and operators that allow you to create your own controllers and others +own resources (CRD), admission controllers and operators that allow you to create your own controllers and other components that integrate with the platform itself. This allows you to build and deploy your own solutions based on OpenShift, while ensuring the use of the main functionality and advantages of the platform. \ No newline at end of file diff --git a/docs/en/modules/arch/pages/architecture/libraries/liquibase-ddm-ext/alter-table-api.adoc b/docs/en/modules/arch/pages/architecture/libraries/liquibase-ddm-ext/alter-table-api.adoc index a1390b948b..8d59aa3719 100644 --- a/docs/en/modules/arch/pages/architecture/libraries/liquibase-ddm-ext/alter-table-api.adoc +++ b/docs/en/modules/arch/pages/architecture/libraries/liquibase-ddm-ext/alter-table-api.adoc @@ -1,6 +1,5 @@ -include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] - = alterTableApi extension +include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] diff --git a/docs/en/modules/arch/pages/architecture/libraries/liquibase-ddm-ext/create-table-api.adoc b/docs/en/modules/arch/pages/architecture/libraries/liquibase-ddm-ext/create-table-api.adoc index b2fb9fe9cc..34b2db9573 100644 --- a/docs/en/modules/arch/pages/architecture/libraries/liquibase-ddm-ext/create-table-api.adoc +++ b/docs/en/modules/arch/pages/architecture/libraries/liquibase-ddm-ext/create-table-api.adoc @@ -1,6 +1,5 @@ -include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] - = createTable extension +include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] diff --git a/docs/en/modules/arch/pages/architecture/libraries/liquibase-ddm-ext/overview.adoc b/docs/en/modules/arch/pages/architecture/libraries/liquibase-ddm-ext/overview.adoc index 852900b5b9..e76275bf5d 100644 --- a/docs/en/modules/arch/pages/architecture/libraries/liquibase-ddm-ext/overview.adoc +++ b/docs/en/modules/arch/pages/architecture/libraries/liquibase-ddm-ext/overview.adoc @@ -1,6 +1,5 @@ -include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] - = liquibase-ddm-ext library +include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] diff --git a/docs/en/modules/arch/pages/architecture/overview.adoc b/docs/en/modules/arch/pages/architecture/overview.adoc index c22f5d42c7..de01276112 100644 --- a/docs/en/modules/arch/pages/architecture/overview.adoc +++ b/docs/en/modules/arch/pages/architecture/overview.adoc @@ -22,98 +22,55 @@ The main objective of this solution is to implement a _decentralized_ and _regul * Each registry requires the development of its infrastructure. * There is a lack of centralized evolution of registry functionalities. -//TODO: - -//== Бізнес-драйвери == Business drivers -//* 100% державних послуг доступні громадянам та бізнесу у цифровому вигляді * 100% of government services available to citizens and businesses in digital format. -//== Бізнес-цілі == Business objectives -//* Побудова єдиного державного інформаційного простору * Building a unified government information space -//* Стандартизація процесу розробки та експлуатації реєстрів * Standardizing the process of developing and operating registries -//* Оптимізація витрат на розробку, розгортання та володіння реєстрами * Optimizing costs for registry development, deployment, and ownership -//* Зниження вимог до розробників та адміністраторів реєстрів * Reducing demands on registry developers and administrators -//* Забезпечення довіри суспільства та унеможливлення корупційних дій * Ensuring societal trust and preventing corrupt practices -//* Ефективна взаємодія реєстрів між собою * Facilitating efficient inter-registry interactions -//* Формування підґрунтя для надання цифрових послуг * Establishing the groundwork for providing digital services -//* Висока надійність зберігання даних реєстрів * Ensuring high data storage reliability for registries -//== Нефункціональні можливості == Non-functional capabilities -//* Розгортання _Платформи Реєстрів_ в публічному або приватному хмарному середовищі * Deploying _The Platform for state registries_ in a public or private cloud environment -//* Створення одного або групи реєстрів на базі єдиного екземпляра Платформи з підтримкою _SaaS_-моделі “_Реєстр як сервіс_” * Creating one or multiple registries based on a single instance of the Platform, supporting the "_Registry as a Service_" SaaS model -//* Централізований підхід до розповсюдження оновлень екземплярів _Платформи Реєстрів_ * Centralized distribution of updates to instances of _the Platform for state registries_ -//* Забезпечення відповідності реєстрів на _Платформі_ вимогам безпеки, масштабованості та відмовостійкості * Ensuring registry compliance of the platform registries with security, scalability, and fault-tolerance requirements -//* Аудит дій користувачів та системно-важливих подій * Auditing user actions and system-critical events -//* Підтримка версійності зберігання даних реєстру * Supporting data versioning in registries -//* Підтримка резервного копіювання та відновлення даних реєстру * Backup and data recovery for registries -//* Моніторинг та журналювання * Monitoring and logging functionalities -//* Шифрування даних реєстру * Encryption of registry data -//== Функціональні можливості == Functional capabilities -//* _Low-code_ підхід до розробки реєстрів включно з моделлю даних, бізнес-процесами інформаційних та адміністративних послуг, організаційною структурою, зовнішніми інтеграціями, тощо. * _Low-code_ approach to registry development, including data models, business processes for information and administrative services, organizational structure, external integrations, and more; -//* Веб-інтерфейси кабінетів користувачів для отримання та надання державних послуг * Web interface for accessing and providing government services; -//* Транзакційна модель внесення змін до реєстру з використанням _КЕП_ для підпису запитів на зміну даних * Transactional model for making changes to the registry using digital signatures for data change requests; -//* Підтримка швидкої побудови інтеграцій реєстрів на Платформі з зовнішніми системами та учасниками інформаційного обміну _СЕВДЕІР "Трембіта"_ * Support for quick integration of registries with external systems; //and participants through the SEVDEIR "Trembita" information exchange. -//TODO: UA specific, therefore I commented the above part linked to Trembita. -//* Публічний API до даних реєстрів та управління рейт-лімітами * Public API for registry data and rate limit management; -//* Управління правами доступу до даних реєстру за допомогою _RBAC_ * Data access rights management using _RBAC_; -//* Побудова аналітичних звітів по даним реєстру * Building analytical reports based on registry data; -//* Формування витягів по даним реєстрів -//* тощо. * Generating extracts based on registry data, and more. -//== Розділи архітектурної документації -== Sections of the architectural documentation - -//Пакет технічної документації _Платформи Реєстрів_ включає: -The technical documentation package of the Platform includes the following: - -//* xref:arch:architecture/platform-conceptual.adoc[] - опис концептуального дизайну рішення, кінцевих користувачів _Платформи Реєстрів_ та зовнішніх систем, з якими побудована взаємодія -* xref:arch:architecture/platform-conceptual.adoc[] -- describing the conceptual design of the solution, end-users of _the Platform for state registries_, and interactions with external systems; -//* xref:arch:architecture/platform-logical.adoc[] - високорівнева структура рішення з описом декомпозиції на складові (зони, підсистеми, тощо.) та взаємодію між ними -* xref:arch:architecture/platform-logical.adoc[Platform logical architecture] -- providing a high-level structure of the solution with a decomposition into components (zones, subsystems, etc.) and their interactions; -//* xref:arch:architecture/security/overview.adoc[] - технічна документація опису архітектури безпеки _Платформи Реєстрів_ -* xref:arch:architecture/security/overview.adoc[Platform security architecture] -- technical documentation describing the security architecture of _the Platform for state registries_; -//* xref:arch:architecture/platform-deployment.adoc[] - концептуальна діаграма розгортання _Платформи Реєстрів_ -* xref:arch:architecture/platform-deployment.adoc[] -- conceptual deployment diagram of _the Platform for state registries_; -//* xref:arch:architecture/platform-quality-attributes.adoc[] - ключові атрибути якості з описом підходів та техник до їх адресування -* xref:arch:architecture/platform-quality-attributes/overview.adoc[] -- key quality attributes with descriptions of approaches and techniques to address them; -//* xref:arch:architecture/platform-technologies.adoc[] - опис переліку та категорій ключових технологій , які застосовані для побудови рішення _Платформі Реєстрів_ -* xref:arch:architecture/platform-technologies.adoc[] -- a description of the key technologies and categories used to build _the Platform for state registries_ solution; -//* _Високорівневий дизайн зон та підсистем Платформи_ - набір розділів з високорівневою архітектурою, описом складових та їх взаємодії, ключових аспектів рішення, тощо. -* _High-level Design of the Platform's zones and subsystems_ -- a set of sections with high-level architecture, component descriptions, interactions, key aspects of the solution, and more; -//* xref:arch:architecture/registry-cost.adoc[] - опис підходу до оцінки вартості володіння реєстрами, які розгорнуті на _Платформі Реєстрів_ -* xref:architecture/platform-system-requirements/registry-cost.adoc[] -- a description of the approach to assessing the cost of owning registries deployed on _the Platform for state registries_. \ No newline at end of file +== Architectural documentation sections + +The _Registries Platform_ technical documentation package includes: + +* xref:arch:architecture/platform-conceptual.adoc[] -- description of the conceptual design of the solution, end-users of the _Registries Platform_, and external systems with which interaction is built +* xref:arch:architecture/platform-logical.adoc[] -- high-level structure of the solution with a description of its decomposition into components (zones, subsystems, etc.) and the interaction between them +* xref:arch:architecture/platform-deployment.adoc[] -- deployment architecture of the _Registries Platform_ +* xref:arch:architecture/platform-system-requirements/overview.adoc[] -- description of system requirements for deploying the _Registries Platform_ on the target infrastructure +* xref:arch:architecture/security/overview.adoc[] -- technical documentation describing the security architecture of the _Registries Platform_ +* xref:arch:architecture/platform-technologies.adoc[] -- description of the list and categories of key technologies applied in building the _Registries Platform_ solution +* xref:arch:architecture/platform-quality-attributes/overview.adoc[] -- key quality attributes with descriptions of approaches and techniques for addressing them +* _High-level design of zones and subsystems of the Platform_ -- a set of sections with a high-level architecture, descriptions of components and their interactions, key aspects of the solution, and so on. +* xref:arch:architecture/platform-api/overview.adoc[] -- documentation of the _API_ services of the _Registries Platform_ \ No newline at end of file diff --git a/docs/en/modules/arch/pages/architecture/platform-api/overview.adoc b/docs/en/modules/arch/pages/architecture/platform-api/overview.adoc new file mode 100644 index 0000000000..90c227bd24 --- /dev/null +++ b/docs/en/modules/arch/pages/architecture/platform-api/overview.adoc @@ -0,0 +1,57 @@ += Platform API documentation +include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] + +include::platform:ROOT:partial$admonitions/language-en.adoc[] + +== Target services + +|=== +|Service name|Repository + +|xref:architecture/platform-api/services/keycloak-rest-api-ext.adoc[_keycloak-rest-api-ext_] +|https://github.com/epam/edp-ddm-keycloak-rest-api-ext[github:/epam/edp-ddm-keycloak-rest-api-ext] + + +|xref:architecture/platform-api/services/bpms.adoc[_bpms_] +|https://github.com/epam/edp-ddm-bpms[github:/epam/edp-ddm-bpms] + +|xref:architecture/platform-api/services/platform-gateway.adoc[_platform-gateway_] +|https://github.com/epam/edp-ddm-platform-gateway[github:/epam/edp-ddm-platform-gateway] + +|xref:architecture/platform-api/services/digital-signature-ops.adoc[_digital-signature-ops_] +|https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/low-code-platform/platform/backend/applications/digital-signature-ops[gerrit:/mdtu-ddm/low-code-platform/platform/backend/applications/digital-signature-ops] + +|xref:architecture/platform-api/services/bp-webservice-gateway.adoc[_bp-webservice-gateway_] +|https://github.com/epam/edp-ddm-bp-webservice-gateway[github:/epam/edp-ddm-bp-webservice-gateway] + +|xref:architecture/platform-api/services/user-task-management.adoc[_user-task-management_] +|https://github.com/epam/edp-ddm-user-task-management[github:/epam/edp-ddm-user-task-management] + +|xref:architecture/platform-api/services/user-process-management.adoc[_user-process-management_] +|https://github.com/epam/edp-ddm-user-process-management[github:/epam/edp-ddm-user-process-management] + +|xref:architecture/platform-api/services/user-settings-service-api.adoc[_user-settings-service-api_] +|https://github.com/epam/edp-ddm-user-settings-service-api[github:/epam/edp-ddm-user-settings-service-api] + +|xref:architecture/platform-api/services/form-schema-provider.adoc[_form-schema-provider_] +|https://github.com/epam/edp-ddm-form-schema-provider[github:/epam/edp-ddm-form-schema-provider] + +|xref:architecture/platform-api/services/form-submission-validation.adoc[_form-submission-validation_] +|https://github.com/epam/edp-ddm-form-submission-validation[github:/epam/edp-ddm-form-submission-validation] + +|xref:architecture/platform-api/services/digital-document-service.adoc[_digital-document-service_] +|https://github.com/epam/edp-ddm-digital-document-service[github:/epam/edp-ddm-digital-document-service] + +|xref:architecture/platform-api/services/process-history-service-api.adoc[_process-history-service-api_] +|https://github.com/epam/edp-ddm-process-history-service-api[github:/epam/edp-ddm-process-history-service-api] + +|xref:architecture/platform-api/services/ddm-notification-service.adoc[_ddm-notification-service_] +|https://github.com/epam/edp-ddm-notification-service[github:/epam/edp-ddm-notification-service] + +|xref:architecture/platform-api/services/excerpt-service-api.adoc[_excerpt-service-api_] +|https://github.com/epam/edp-ddm-excerpt-service-api[github:/epam/edp-ddm-excerpt-service-api] + +|xref:architecture/platform-api/services/registry-regulation-management.adoc[_registry-regulation-management_] +|https://github.com/epam/edp-ddm-registry-regulation-management[github:/epam/edp-ddm-registry-regulation-management] + +|=== \ No newline at end of file diff --git a/docs/en/modules/arch/pages/architecture/platform-api/services/bp-webservice-gateway.adoc b/docs/en/modules/arch/pages/architecture/platform-api/services/bp-webservice-gateway.adoc new file mode 100644 index 0000000000..1b8e4e2a61 --- /dev/null +++ b/docs/en/modules/arch/pages/architecture/platform-api/services/bp-webservice-gateway.adoc @@ -0,0 +1,5 @@ += Business process invocation service for external systems: REST API documentation + +==== +swagger::{attachmentsdir}/architecture/platform-api/services/bp-webservice-gateway-core-image-swagger.yml[] +==== \ No newline at end of file diff --git a/docs/en/modules/arch/pages/architecture/platform-api/services/bpms.adoc b/docs/en/modules/arch/pages/architecture/platform-api/services/bpms.adoc new file mode 100644 index 0000000000..b4de3ec10d --- /dev/null +++ b/docs/en/modules/arch/pages/architecture/platform-api/services/bpms.adoc @@ -0,0 +1,5 @@ += Business processes management service (BPMS): REST API documentation + +==== +swagger::{attachmentsdir}/architecture/platform-api/services/bpms-swagger.yml[] +==== \ No newline at end of file diff --git a/docs/en/modules/arch/pages/architecture/platform-api/services/ddm-notification-service.adoc b/docs/en/modules/arch/pages/architecture/platform-api/services/ddm-notification-service.adoc new file mode 100644 index 0000000000..bf03cdeb20 --- /dev/null +++ b/docs/en/modules/arch/pages/architecture/platform-api/services/ddm-notification-service.adoc @@ -0,0 +1,5 @@ += User notifications service: REST API documentation + +==== +swagger::{attachmentsdir}/architecture/platform-api/services/ddm-notification-service-swagger.yml[] +==== \ No newline at end of file diff --git a/docs/en/modules/arch/pages/architecture/platform-api/services/digital-document-service.adoc b/docs/en/modules/arch/pages/architecture/platform-api/services/digital-document-service.adoc new file mode 100644 index 0000000000..20ef2e2872 --- /dev/null +++ b/docs/en/modules/arch/pages/architecture/platform-api/services/digital-document-service.adoc @@ -0,0 +1,5 @@ += Digital documents service: REST API documentation + +==== +swagger::{attachmentsdir}/architecture/platform-api/services/digital-document-service-swagger.yml[] +==== \ No newline at end of file diff --git a/docs/en/modules/arch/pages/architecture/platform-api/services/digital-signature-ops.adoc b/docs/en/modules/arch/pages/architecture/platform-api/services/digital-signature-ops.adoc new file mode 100644 index 0000000000..006c58e047 --- /dev/null +++ b/docs/en/modules/arch/pages/architecture/platform-api/services/digital-signature-ops.adoc @@ -0,0 +1,5 @@ += Digital signatures service: REST API documentation + +==== +swagger::{attachmentsdir}/architecture/platform-api/services/digital-signature-ops-swagger.yml[] +==== \ No newline at end of file diff --git a/docs/en/modules/arch/pages/architecture/platform-api/services/excerpt-service-api.adoc b/docs/en/modules/arch/pages/architecture/platform-api/services/excerpt-service-api.adoc new file mode 100644 index 0000000000..5eea1afd3f --- /dev/null +++ b/docs/en/modules/arch/pages/architecture/platform-api/services/excerpt-service-api.adoc @@ -0,0 +1,5 @@ += Excerpts management service: REST API documentation + +==== +swagger::{attachmentsdir}/architecture/platform-api/services/excerpt-service-api-swagger.yml[] +==== \ No newline at end of file diff --git a/docs/en/modules/arch/pages/architecture/platform-api/services/form-schema-provider.adoc b/docs/en/modules/arch/pages/architecture/platform-api/services/form-schema-provider.adoc new file mode 100644 index 0000000000..d2a63435b6 --- /dev/null +++ b/docs/en/modules/arch/pages/architecture/platform-api/services/form-schema-provider.adoc @@ -0,0 +1,5 @@ += UI form schemes providing service: REST API documentation + +==== +swagger::{attachmentsdir}/architecture/platform-api/services/form-schema-provider-swagger.yml[] +==== \ No newline at end of file diff --git a/docs/en/modules/arch/pages/architecture/platform-api/services/form-submission-validation.adoc b/docs/en/modules/arch/pages/architecture/platform-api/services/form-submission-validation.adoc new file mode 100644 index 0000000000..25e25096f0 --- /dev/null +++ b/docs/en/modules/arch/pages/architecture/platform-api/services/form-submission-validation.adoc @@ -0,0 +1,5 @@ += UI form data validation service: REST API documentation + +==== +swagger::{attachmentsdir}/architecture/platform-api/services/form-submission-validation-swagger.yml[] +==== \ No newline at end of file diff --git a/docs/en/modules/arch/pages/architecture/platform-api/services/keycloak-rest-api-ext.adoc b/docs/en/modules/arch/pages/architecture/platform-api/services/keycloak-rest-api-ext.adoc new file mode 100644 index 0000000000..e5a5a65e02 --- /dev/null +++ b/docs/en/modules/arch/pages/architecture/platform-api/services/keycloak-rest-api-ext.adoc @@ -0,0 +1,5 @@ += Service API extension module: REST API documentation + +==== +swagger::{attachmentsdir}/architecture/platform-api/services/keycloak-rest-api-ext-swagger.yml[] +==== \ No newline at end of file diff --git a/docs/en/modules/arch/pages/architecture/platform-api/services/platform-gateway.adoc b/docs/en/modules/arch/pages/architecture/platform-api/services/platform-gateway.adoc new file mode 100644 index 0000000000..d3b076a4a1 --- /dev/null +++ b/docs/en/modules/arch/pages/architecture/platform-api/services/platform-gateway.adoc @@ -0,0 +1,5 @@ += Cross-registry interaction API gateway: REST API documentation + +==== +swagger::{attachmentsdir}/architecture/platform-api/services/platform-gateway-swagger.yml[] +==== \ No newline at end of file diff --git a/docs/en/modules/arch/pages/architecture/platform-api/services/process-history-service-api.adoc b/docs/en/modules/arch/pages/architecture/platform-api/services/process-history-service-api.adoc new file mode 100644 index 0000000000..3ea44fa00b --- /dev/null +++ b/docs/en/modules/arch/pages/architecture/platform-api/services/process-history-service-api.adoc @@ -0,0 +1,5 @@ += Business processes history service: REST API documentation + +==== +swagger::{attachmentsdir}/architecture/platform-api/services/process-history-service-api-swagger.yml[] +==== \ No newline at end of file diff --git a/docs/en/modules/arch/pages/architecture/platform-api/services/registry-regulation-management.adoc b/docs/en/modules/arch/pages/architecture/platform-api/services/registry-regulation-management.adoc new file mode 100644 index 0000000000..051993bb13 --- /dev/null +++ b/docs/en/modules/arch/pages/architecture/platform-api/services/registry-regulation-management.adoc @@ -0,0 +1,5 @@ += Registry regulations management service: REST API documentation + +==== +swagger::{attachmentsdir}/architecture/platform-api/services/registry-regulation-management-swagger.yml[] +==== \ No newline at end of file diff --git a/docs/en/modules/arch/pages/architecture/platform-api/services/user-process-management.adoc b/docs/en/modules/arch/pages/architecture/platform-api/services/user-process-management.adoc new file mode 100644 index 0000000000..1ee36698cb --- /dev/null +++ b/docs/en/modules/arch/pages/architecture/platform-api/services/user-process-management.adoc @@ -0,0 +1,5 @@ += User process management service: REST API documentation + +==== +swagger::{attachmentsdir}/architecture/platform-api/services/user-process-management-swagger.yml[] +==== \ No newline at end of file diff --git a/docs/en/modules/arch/pages/architecture/platform-api/services/user-settings-service-api.adoc b/docs/en/modules/arch/pages/architecture/platform-api/services/user-settings-service-api.adoc new file mode 100644 index 0000000000..2cb47a0b32 --- /dev/null +++ b/docs/en/modules/arch/pages/architecture/platform-api/services/user-settings-service-api.adoc @@ -0,0 +1,5 @@ += User settings management service: REST API documentation + +==== +swagger::{attachmentsdir}/architecture/platform-api/services/user-settings-service-api-swagger.yml[] +==== \ No newline at end of file diff --git a/docs/en/modules/arch/pages/architecture/platform-api/services/user-task-management.adoc b/docs/en/modules/arch/pages/architecture/platform-api/services/user-task-management.adoc new file mode 100644 index 0000000000..65fce80b7c --- /dev/null +++ b/docs/en/modules/arch/pages/architecture/platform-api/services/user-task-management.adoc @@ -0,0 +1,5 @@ += User task management service: REST API documentation + +==== +swagger::{attachmentsdir}/architecture/platform-api/services/user-task-management-swagger.yml[] +==== \ No newline at end of file diff --git a/docs/en/modules/arch/pages/architecture/platform-backup-storage/overview.adoc b/docs/en/modules/arch/pages/architecture/platform-backup-storage/overview.adoc index 04ffe51738..19f9ed4b82 100644 --- a/docs/en/modules/arch/pages/architecture/platform-backup-storage/overview.adoc +++ b/docs/en/modules/arch/pages/architecture/platform-backup-storage/overview.adoc @@ -1,74 +1,39 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Platform backup storage +include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] -NOTE: 🌐 This document is available in both English and Ukrainian. Use the language toggle in the top right corner to switch between versions. +include::platform:ROOT:partial$admonitions/language-en.adoc[] == General description S3-compatible data storage that provides reliable and scalable storage for backup copies of the Platform and registries. -//// -== Функції компоненти - -* Зберігання резервних копій центральних компонент -* Зберігання резервних копій реєстрів, розгорнутих на платформі -* Зберігання резервних копій даних операційних S3-сховищ -//// == Functions of the component * Storage of backup copies of central components * Keeping backup copies of registries deployed on the platform * Storage of backup copies of operational S3-storage data -//== Технічний дизайн компоненти == Technical design of the component image::architecture/platform-backup-storage/platform-backup-storage.drawio.svg[width=500,float="center",align="center"] == Components -//// -|=== -|Назва компоненти|Представлення|Походження|Призначення - -|_Сховище резервних копій Платформи_ -|`platform-minio` -|3rd-party -|S3-сумісне сховище даних, що забезпечує надійне та масштабоване сховище резервних копій Платформи та реєстрів -|=== -//// |=== |Component name|Representation|Source|Appointment -|_Repository of backup copies of the Platform_ +|_Platform backup copies repository_ |`platform-minio` |3rd-party |S3-compatible data storage that provides reliable and scalable storage of backup copies of the Platform and registries |=== -//== Технологічний стек - == Technology stack We use the following technologies in design and development: * xref:arch:architecture/platform-technologies.adoc#minio[MinIO] -//== Атрибути якості компоненти - -//=== _Reliability_ - -//_Сховище резервних копій Платформи_ забезпечує надійне та безпечне зберігання резервних копій Платформи та реєстрів. - == Component quality attributes [reliability] diff --git a/docs/en/modules/arch/pages/architecture/platform-conceptual.adoc b/docs/en/modules/arch/pages/architecture/platform-conceptual.adoc index 97fa2fee70..3e41309b2e 100644 --- a/docs/en/modules/arch/pages/architecture/platform-conceptual.adoc +++ b/docs/en/modules/arch/pages/architecture/platform-conceptual.adoc @@ -6,98 +6,78 @@ include::platform:ROOT:partial$admonitions/language-en.adoc[] == General context This contextual diagram shows the _Platform for state registries_ in the ecosystem of the interfaced national information systems, and categories of users interacting with the system. -//На даній контекстній діаграмі зображено _Платформу Реєстрів_ в екосистемі державних інформаційних систем, з якими побудована інформаційна взаємодія та категорії користувачів, які взаємодіють з системою. For interoperability purposes, the _Platform for state registries_ supports two main options for configuring data exchange: -//Для забезпечення інтероперабельності, _Платформа Реєстрів_ підтримує дві основні опції налаштування інформаційного обміну: * Using the Trembita safe exchange bus as a protected transport. -//* Через використання шини безпечного обміну "_Трембіта_" як захищеного транспорту. * Setting up direct integrations based on the _REST_ and _SOAP_ interaction protocols for the systems that are not participants of data exchange under _Trembita SEI SEIR_. -//* Через налаштування прямих інтеграцій на базі _REST_ та _SOAP_ протоколів взаємодії для систем, які не є учасниками інформаційного обміну _СЕВДЕІР "Трембіта"_. For integration purposes, the external systems can be both existing information systems and the registers deployed on the individual instances of the _Platform for state registries_. -//Зовнішніми системами для інтеграції можуть виступати як наявні інформаційні системи, так і реєстри, розгорнуті на окремих екземплярах _Платформи Реєстрів_. image::architecture/ddm-platform-context.svg[] [TIP] -- You can learn more about the technical design of the _Platform for state registries_ in xref:arch:architecture/platform-logical.adoc[]. -//Детальніше з технічним дизайном _Платформи Реєстрів_ можна ознайомитись у розділі xref:arch:architecture/platform-logical.adoc[]. -- == Platform users The main users of the _Platform for state registries_ can be divided into the following categories depending on the scenarios of their interaction with the system and access rights: -//Основних користувачів _Платформи Реєстрів_ можна поділити на наступні категорії в залежності від сценаріїв взаємодії з системою та прав доступу: * _Unauthorized users_: The users with access only to public data and the authentication page. -//* _Неавторизовані користувачі_ - користувачі, які мають доступ виключно до публічних даних та сторінки автентифікації. * _Citizens_: Natural persons or legal entities who passed authentication and self-registration in the register to have access to electronic services. -//* _Отримувачі послуг_ - фізичні або юридичні особи, які пройшли автентифікацію та самореєстрацію в реєстрі з метою отримання електронних послуг. * _Officers_: Official representatives of government bodies providing services under their official duties, or the entities registered as service providers (depending on the requirements of an individual register). -//* _Надавачі послуг_ - офіційні представники державних органів, які надають послуги в рамках своїх службових обов'язків або особи, які зареєструвались як надавачі послуг (залежно від вимог окремого реєстру). * _Developers of the Registry Regulations_: The users responsible for the _Lowcode_ development of the xref:arch:architecture/registry/administrative/regulation-management/registry-regulation/registry-regulation.adoc[Digital registry regulations] -//* _Розробники регламенту реєстру_ - користувачі, які відповідають за _Lowcode_-розробку xref:arch:architecture/registry/administrative/regulation-management/registry-regulation/registry-regulation.adoc[цифрового регламенту реєстру] * _Support Service (L2)_: The users responsible for monitoring of the system's technical metrics, incident response. -//* _Служба підтримки (L2)_ - користувачі, які відповідають за моніторинг технічних метрик системи, реакція на інциденти * _Service administrators_: A category of users responsible for maintaining and configuring registry instances. -//* _Службові адміністратори_ - категорія користувачів, які відповідають за обслуговування та налаштування екземплярів реєстрів * _Infrastructure administrators_: A category of users responsible for the installation and maintenance of the _Platform for state registries_. -//* _Адміністратори інфраструктури_ - категорія користувачів, які відповідають за встановлення та обслуговування _Платформи Реєстрів_ [TIP] -- -You can find out more about the categories of users of the Platform for state registries in xref:arch:architecture/platform/operational/user-management/platform-actors-roles.adoc[]. -//Детальніше з категоріями користувачів Платформи Реєстрів можна ознайомитися у розділі xref:arch:architecture/platform/operational/user-management/platform-actors-roles.adoc[]. +You can find out more about the user categories of the _Platform for state registries_ in xref:arch:architecture/platform/operational/user-management/platform-actors-roles.adoc[]. -- == Interaction with external systems -//== Взаємодія з зовнішніми системами === Accredited Key Certification Center (AKCC) -//=== _Акредитований Центр Сертифікації Ключів (АЦСК)_ The _Platform for state registries_ interacts with _Accredited Key Certification Centers_ for obtaining lists of revoked certificates, receiving a chain of user certificates and checking their status, forming a time stamp, etc. -//_Платформа Реєстрів_ взаємодіє з _Акредитованими Центрами Сертифікації Ключів_ з метою отримання переліку відкликаних сертифікатів, отримання ланцюжка сертифікатів користувача та перевірку їх статусу, формування мітки часу, тощо. [TIP] -- You can learn more about the design of the integrated subsystems in the relevant sections: -//Детальніше з дизайном підсистем, в яких залучена інтеграція, можна ознайомитися у відповідних розділах: * xref:arch:architecture/registry/operational/digital-signatures/overview.adoc[] * xref:arch:architecture/platform/operational/user-management/overview.adoc[] -- === _Digital identification service (id.gov.ua)_ -//=== _Сервіс цифрової ідентифікації (id.gov.ua)_ + +include::ROOT:partial$admonitions/ua-specific.adoc[] The _Platform for state registries_ allows authentication of citizens and officers -- the registry service users -- using the _Integrated Electronic Identification System (IEIS)_. -//_Платформа Реєстрів_ надає можливість здійснювати автентифікацію отримувачів та надавачів послуг реєстру за допомогою _Інтегрованої системи електронної ідентифікації (ІСЕІ)_. +//// [TIP] -- You can learn more about the design of the integrated subsystems in the relevant sections: -//Детальніше з дизайном підсистем, в яких залучена інтеграція, можна ознайомитись у відповідних розділах: * xref:arch:architecture/platform/operational/user-management/overview.adoc[] -- +//// === _Trembita SEI SEIR_ include::ROOT:partial$admonitions/ua-specific.adoc[] The _Platform for state registries_ is integrated into the _Trembita System of Electronic Interaction of State Electronic Information Resources (SEI SEIR)_ to ensure secure data exchange with the state registers and other information systems. -//_Платформа Реєстрів_ інтегрована до _Системи Електронної Взаємодії Державних Електронних Інформаційних Ресурсів (СЕВДЕІР) "Трембіта"_ з метою забезпечення захищеного інформаційного обміну даними державних реєстрів та інших інформаційних систем. [TIP] -- You can learn more about the design of the integrated subsystems in the relevant sections: -//Детальніше з дизайном підсистем, в яких залучена інтеграція, можна ознайомитись у відповідних розділах: * xref:arch:architecture/platform/operational/user-management/overview.adoc[] * xref:arch:architecture/registry/operational/bpms/overview.adoc[] @@ -106,43 +86,39 @@ You can learn more about the design of the integrated subsystems in the relevant -- === _Diia services (diia.gov.ua)_ -//=== _Сервіси Дії (diia.gov.ua)_ + +include::ROOT:partial$admonitions/ua-specific.adoc[] The _Platform for state registries_ is integrated with the ecosystem of digital public services _Diia_ to improve and ensure the integrity of the end-users' experience when receiving public services. -//_Платформа Реєстрів_ інтегрована з екосистемою державних сервісів цифрових послуг _Дія_ для покращення та забезпечення цілісності досвіду отримання державних послуг кінцевими користувачами. + +//// [TIP] -- You can learn more about the design of the integrated subsystems in the relevant sections: -//Детальніше з дизайном підсистем, в яких залучена інтеграція, можна ознайомитись у відповідних розділах: * xref:arch:architecture/registry/operational/notifications/overview.adoc[] -- +//// === _External mapping services_ -//=== _Зовнішні картографічні сервіси_ -The _Platform for state registries_ uses external cartographic services to download geospatial data, layers and geocoding to provide the ability to enter, search and display the register subjects that are connected to an area. -//_Платформа Реєстрів_ використовує зовнішні картографічні сервіси для завантаження геопросторових даних, шарів та геокодування з метою забезпечення можливостей внесення, пошуку та відображення об'єктів реєстру, які мають прив’язку до місцевості. +The _Platform for state registries_ uses external cartographic services to download geospatial data, layers, and geocoding to provide the ability to enter, search and display the register subjects that are connected to an area. [TIP] -- You can learn more about the design of the integrated subsystems in the relevant sections: -//Детальніше з дизайном підсистем, в яких залучена інтеграція, можна ознайомитись у відповідних розділах: * xref:arch:architecture/registry/operational/geo/overview.adoc[] -- === _External systems_ -//=== _Зовнішні системи_ The _Platform for state registries_ supports external integrations via _Trembita SEG_, or direct integrations according to the requirements of the target registers and the level of interoperability of external systems. -//_Платформа Реєстрів_ підтримує налаштування зовнішніх інтеграцій через _ШБО "Трембіта"_ або прямих інтеграцій згідно з вимогами цільових реєстрів та рівню інтероперабельності зовнішніх систем. [TIP] -- You can learn more about the design of the integrated subsystems in the relevant sections: -//Детальніше з дизайном підсистем, в яких залучена інтеграція, можна ознайомитись у відповідних розділах: * xref:arch:architecture/registry/operational/external-integrations/overview.adoc[] * xref:arch:architecture/registry/operational/bpms/overview.adoc[] diff --git a/docs/en/modules/arch/pages/architecture/platform-deployment.adoc b/docs/en/modules/arch/pages/architecture/platform-deployment.adoc index ecd7c583ba..93a83ddd9c 100644 --- a/docs/en/modules/arch/pages/architecture/platform-deployment.adoc +++ b/docs/en/modules/arch/pages/architecture/platform-deployment.adoc @@ -11,18 +11,15 @@ The installation procedure of the OpenShift container orchestration Platform is -- For more information about the _OpenShift container orchestration Platform_ and the _Registry Platform_, see the relevant sections: -* xref:admin:installation/platform-deployment/platform-deployment-overview.adoc[] +* xref:admin:installation/platform-deployment/platform-deployment-overview.adoc[Deploying the Platform of target environment] For more details about the technical design of the subsystems and components engaged in the installation process, see the following sections: -* xref:architecture/platform-installer/overview.adoc[Platform resources status management component] -//* xref:architecture/platform-installer/overview.adoc[Компонент керування станом ресурсів Платформи] +* xref:architecture/platform-installer/overview.adoc[Component for managing the state of Platform resources] * xref:architecture/container-platform/container-platform.adoc#_portability[Container orchestration platform] -//* xref:architecture/container-platform/container-platform.adoc#_portability[Платформа оркестрації контейнерів] -- The diagram below depicts the Registries Platform's infrastructure deployment in one region (AZ) of the AWS public cloud environment. .Platform architecture on AWS -//.Платформна архітектура на AWS image::architecture/ddm-platform-infrastructure-deployment.drawio.svg[] diff --git a/docs/en/modules/arch/pages/architecture/platform-installer/installer-structure.adoc b/docs/en/modules/arch/pages/architecture/platform-installer/installer-structure.adoc index 6531abc8c6..087b8eb0a0 100644 --- a/docs/en/modules/arch/pages/architecture/platform-installer/installer-structure.adoc +++ b/docs/en/modules/arch/pages/architecture/platform-installer/installer-structure.adoc @@ -1,27 +1,15 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Installer component structure +include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] -NOTE: 🌐 This document is available in both English and Ukrainian. Use the language toggle in the top right corner to switch between versions. +include::platform:ROOT:partial$admonitions/language-en.adoc[] -//== Визначення == Definitions -//Інсталятор:: набір програмних засобів для розгортання Платформи -Installer:: a set of software tools for deploying the Platform -//Для розгортання Платформи управління реєстрами застосовується Інсталятор, який постачається у вигляді zip архіву -To deploy the Registry Management Platform, the Installer is used, which is delivered in the form of a zip archive +*_Installer_* is a set of software tools for deploying the Platform + +The Installer is used to deploy the Platform for state registries, which is delivered as a zip archive. -//Структура Інсталятору: -Structure of the Installer: +.Installer structure [plantuml, structure, svg] ---- @startuml @@ -77,9 +65,9 @@ package "Installer" as installer { @enduml ---- - -//== Діаграма послідовності розгортання платформи == Platform deployment sequence diagram + +.Platform deployment sequence diagram [plantuml, install_flow, svg] ---- @startuml @@ -97,8 +85,8 @@ autonumber title Platform deployment sequence diagram group Preparing the Installer for deployment -devops -> jumpbox: Downloading the Installer archive -devops -> jumpbox: Downloading certificates digital-signature-ops +devops -> jumpbox: Uploading the Installer archive +devops -> jumpbox: Uploading certificates digital-signature-ops devops -> jumpbox: Server readiness check (prerequisites) devops -> docker_load: Authentication in Openshift devops -> docker_load: Setting parameters (env) @@ -115,16 +103,17 @@ install.sh -> minio: Deployment Minio install.sh -> openshift: Downloading docker images in nexus (control-plane-nexus) install.sh -> openshift: Deployment of user-management and downloading digital-signature-ops certificates install.sh -> openshift: Deployment Control Plane -install.sh -> openshift: Downloading xsd in nexus (control-plane-nexus) -install.sh -> openshift: Downloading access parameters in Minio +install.sh -> openshift: Loading xsd in nexus (control-plane-nexus) +install.sh -> openshift: Loading access parameters in Minio devops -> jumpbox: Checking the log and saving the Control Plane access parameters in a safe place end @enduml ---- -//== Діаграма послідовності оновлення платформи == Platform upgrade sequence diagram + +.Platform upgrade sequence diagram [plantuml, update_flow, svg] ---- @startuml @@ -142,8 +131,8 @@ autonumber title Platform deployment sequence diagram group Preparing the Installer for deployment -devops -> jumpbox: Downloading the Installer archive -devops -> jumpbox: Downloading certificates digital-signature-ops +devops -> jumpbox: Uploading the Installer archive +devops -> jumpbox: Uploading digital-signature-ops certificates devops -> jumpbox: Server readiness check (prerequisites) devops -> docker_load: Authentication in Openshift devops -> docker_load: Setting parameters (env) @@ -156,53 +145,35 @@ install.sh -> vault: Status update Vault install.sh -> minio: Status update Minio install.sh -> openshift: Downloading docker images in nexus (control-plane-nexus) install.sh -> openshift: Deployment of Control Plane -install.sh -> openshift: Downloading xsd in nexus (control-plane-nexus) -install.sh -> openshift: Downloading access parameters in Minio +install.sh -> openshift: Uploading xsd in nexus (control-plane-nexus) +install.sh -> openshift: Uploading access parameters in Minio devops -> jumpbox: Checking the log and the correctness of the update end @enduml ---- -//// -== Опис модулів Інсталятора (functions.sh) - -INIT-CHECK:: перевірка необхідних параметрів та наявності сертифікатів digital-signature-ops (тільки для початкового розгортання) -ENCRYPTION-ETCD:: налаштування шифрування ETCD та затвердження сертифікатів Openshift -INSTALL-CLUSTER-MGMT:: розгортання базових компонент cluster-mgmt -* catalog-source -* storage -* keycloak-operator-crd (підкомпонент control-plane-installer) -* logging -* service-mesh - -INSTALL-NEXUS:: розгортання control-plane-nexus (сховище докер образів та xsd) -VAULT-INSTALL:: розгортання центрального Vault -MINIO-INSTALL:: розгортання центрального Minio -INIT-NEXUS:: завантаження докер образів -INSTALL-ADDITIONAL-COMPONENTS:: завантаження digital-signature-ops сертифікатів та розгортання user-management -INSTALL-CONTROL-PLANE:: розгортання компонент Control Plane -NEXUS-RESOURCE-UPLOAD:: завантаження nexus ресурсів (xsd) -BACKUP-CREDENTIALS:: параметрів доступу в Minio -USAGE:: допоміжний модуль для виводу інформації про використання install.sh -//// -== Installer modules description (functions.sh) + +== Installer modules description (_functions.sh_) INIT-CHECK:: checking the necessary parameters and availability of certificates digital-signature-ops (for initial deployment only) + ENCRYPTION-ETCD:: setting up ETCD encryption and validating Openshift certificates -INSTALL-CLUSTER-MGMT:: deployment of basic components cluster-mgmt -* catalog-source -* storage -* keycloak-operator-crd (subcomponent control-plane-installer) -* logging -* service-mesh - -INSTALL-NEXUS:: deployment of control-plane-nexus (docker image repository and xsd) -VAULT-INSTALL:: deployment of central Vault -MINIO-INSTALL:: deployment of central Minio + +INSTALL-CLUSTER-MGMT:: deploying basic components of the `cluster-mgmt`: +* `catalog-source` +* `storage` +* `keycloak-operator-crd` (subcomponent of the `control-plane-installer`) +* `logging` +* `service-mesh` + +INSTALL-NEXUS:: deploying `control-plane-nexus` (docker image repository and xsd) + +VAULT-INSTALL:: deploying the central Vault +MINIO-INSTALL:: deploying the central Minio INIT-NEXUS:: loading docker images -INSTALL-ADDITIONAL-COMPONENTS:: downloading of digital-signature-ops certificates and deployment of user-management -INSTALL-CONTROL-PLANE:: deployment of Control Plane components -NEXUS-RESOURCE-UPLOAD:: downloading of nexus resources (xsd) +INSTALL-ADDITIONAL-COMPONENTS:: uploading `digital-signature-ops` certificates and deploying `user-management` +INSTALL-CONTROL-PLANE:: deploying the Control Plane components +NEXUS-RESOURCE-UPLOAD:: uploading nexus resources (xsd) BACKUP-CREDENTIALS:: access parameters in Minio -USAGE:: auxiliary module for displaying usage information install.sh \ No newline at end of file +USAGE:: auxiliary module for displaying usage information _install.sh_ \ No newline at end of file diff --git a/docs/en/modules/arch/pages/architecture/platform-installer/overview.adoc b/docs/en/modules/arch/pages/architecture/platform-installer/overview.adoc index 5b26a53b17..8c692434a1 100644 --- a/docs/en/modules/arch/pages/architecture/platform-installer/overview.adoc +++ b/docs/en/modules/arch/pages/architecture/platform-installer/overview.adoc @@ -1,42 +1,24 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Component for managing the state of Platform resources +include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] -NOTE: 🌐 This document is available in both English and Ukrainian. Use the language toggle in the top right corner to switch between versions. +include::platform:ROOT:partial$admonitions/language-en.adoc[] == General description -//Компонент, що забезпечує можливості встановлення та оновлення екземпляра Платформи Реєстрів. A Component that provides the ability to install and update an instance of the Registry Platform. -//== Функції компоненти Functions of the component -//// -* Встановлення Платформи реєстрів -* Оновлення Платформи реєстрів -* Розгортання компоненти xref:arch:architecture/platform-secret-management/overview.adoc[] -* Розгортання компоненти xref:arch:architecture/platform-backup-storage/overview.adoc[] -//// + * Installation of the Register Platform * Updating the Registers Platform * Deployment of the component xref:arch:architecture/platform-secret-management/overview.adoc[] * Deployment of the component xref:arch:architecture/platform-backup-storage/overview.adoc[] -//TODO: Check links == Technical design -//На даній діаграмі зображено компоненти, які входять в _Компонент керування станом ресурсів Платформи_ та їх взаємодію з іншими підсистемами. This diagram shows the components included in the _Platform resource state management component_ and their interaction with other subsystems. -image::architecture/platform-installer/platform-installer-subsystem.png[width=600,float="center",align="center"] +image::architecture/platform-installer/platform-installer-subsystem.drawio.svg[width=600,float="center",align="center"] == Components @@ -52,10 +34,8 @@ on the prepared infrastructure |=== -//== Технологічний стек == Technology stack -//При проектуванні та розробці підсистеми, були використані наступні технології: During the design and development of the subsystem, the following technologies were used: * xref:arch:architecture/platform-technologies.adoc#terraform[Terraform] @@ -66,22 +46,14 @@ During the design and development of the subsystem, the following technologies w === Usability -//_Компонент керування станом ресурсів Платформи_ проста для розуміння та використання та має чіткі і стислі інструкції застосування. The _Platform resource health component_ is easy to understand and use and has clear and concise application instructions. === Portability -//// -_Компонент керування станом ресурсів Платформи_ розроблена з урахуванням сумісності між різними постачальниками інфраструктури та встановлюється -як у хмарні інфраструктурні середовища (AWS), так і в локальне серверне обладнання (vSphere). -//// The _Platform resource state management component_ is designed with compatibility between different infrastructure providers in mind and is installed both in cloud infrastructure environments (AWS) and in local server equipment (vSphere). === Upgradability -//// -_Компонент керування станом ресурсів Платформи_ розроблено з урахуванням зворотної сумісності та зберігає наявні функції, інтеграції та взаємодію з користувачами, -тим самим зменшуючи порушення та забезпечуючи плавний перехід при впровадженні нових оновлень та поліпшень Платформи реєстрів. -//// + The _Platform resource state management component_ is designed with backward compatibility in mind and preserves existing features, integrations, and interactions with users, thereby reducing disruption and ensuring a smooth transition when implementing new updates and improvements to the Registries Platform. \ No newline at end of file diff --git a/docs/en/modules/arch/pages/architecture/platform-libraries.adoc b/docs/en/modules/arch/pages/architecture/platform-libraries.adoc index 22ee77daec..c255c7eba5 100644 --- a/docs/en/modules/arch/pages/architecture/platform-libraries.adoc +++ b/docs/en/modules/arch/pages/architecture/platform-libraries.adoc @@ -1,6 +1,5 @@ -include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] - = Platform libraries +include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] diff --git a/docs/en/modules/arch/pages/architecture/platform-logical.adoc b/docs/en/modules/arch/pages/architecture/platform-logical.adoc index 92ff230c3b..a332f0df33 100644 --- a/docs/en/modules/arch/pages/architecture/platform-logical.adoc +++ b/docs/en/modules/arch/pages/architecture/platform-logical.adoc @@ -1,156 +1,102 @@ = Platform logical architecture -include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] +include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] == Overview -The _Registry Platform_ is a distributed system with microservice architecture. Its design is based on the following fundamental ideas: +The _Registries Platform_ is a distributed system with microservice architecture. Its design is based on the following fundamental ideas: -//* Незалежність від інфраструктури для розгортання * Deployment infrastructure agnosticism -//* Централізованість розробки та розповсюдження оновлень + * Centralized development and updating -//* Забезпечення _достатнього_ рівня ізоляції реєстрів + * Provision of _sufficient_ level of registry isolation -//* Сумісне (_пере-_)використання типових служб реєстрами -* Joint (_re-_)using of typical services by the registries -//* Використання захищеного транспорту для інтеграцій + +* Joint (_re-_)use of typical services by the registries + * Usage of secure transport for integrations -//* Відповідність реєстрів вимогам безпеки, масштабованості та відмовостійкості + * Registry compliance with security, scalability and fault-tolerance requirements == Architecture principles -//* _Платформа Реєстрів_ побудована з використанням відкритих стандартів на базі технологій з відкритим кодом. -* The _Registry Platform_ is built using open standards, based on open source technologies. -//* _Платформа Реєстрів_ представляє собою розподілену систему з мікросервісною архітектурою, кожен компонент якої має чітко визначену функцію, а міжкомпонентна взаємодія базується на стандартизованих протоколах інформаційного обміну. -* The _Registry Platform_ is a distributed system with microservice architecture, where each component has a defined function, and inter-component interaction is based on standardized data exchange protocols. -//* _Платформа Реєстрів_ є _Cloud-native_ системою, яка побудована на базі платформи оркестрації контейнерів _OpenShift_ для забезпечення надійності, масштабованості та незалежності від інфраструктури. -The _Registry Platform_ is a _Cloud_native_ system, based on the _OpenShift_ container orchestration platform to ensure reliability, scalability and infrastructure agnosticism. -//* _Платформа Реєстрів_ використовує _GitOps_-підхід для автоматизації налаштування інфраструктури, розгортання компонентів та системи в цілому. -* The _Registry Platform_ uses _GitOps_-approach to automate infrastructure configuration, component deployment, and the system as a whole. -//* _Платформа Реєстрів_ базується на принципах безпеки _Zero-Trust_ для забезпечення захищеної міжсервісної взаємодії з використанням обов'язкової аутентифікації, авторизації та шифрування трафіку. -* The _Registry Platform_ is based on _Zero-Trusr_ security principles to ensure protected inter-service interaction with mandatory authentication, authorization, and traffic encryption. -//* Зовнішній доступ до компонентів _Платформа Реєстрів_ надається через _API_-шлюзи з обов'язковою автентифікацією та авторизацією. -* External access to the _Registry Platform_ components is provided via _API_-gateway with mandatory authentication and authorization. -//* Компоненти _Платформи Реєстрів_ використовують стандартизований підхід до експортування метрик моніторингу, даних трасування бізнес-транзакцій та журналювання подій. -* The _Registry Platform_ components use a standardized approach to monitoring metrics exporting, business-transactions data tracing, and event logging. -//* Екземпляри компонентів _Платформи Реєстрів_ не зберігають критичних даних стану системи або даних сесій користувачів в пам'яті. -* The _Registry Platform_ component instances don't store critical data on system state, or any user session data in the memory. -//* Всі дії користувачів над даними та системно-важливі події _Платформи Реєстрів_ підлягають обов'язковій фіксації в журналі аудиту. -* All user actions with the data, and system-critical events of the _Registry Platform_ are subject to mandatory recording in audit log. -//* Бізнес-дані реєстрів, які розгорнуті на _Платформи Реєстрів_ підлягають обов'язковому шифруванню для довгострокового зберігання. -* Registry business-data deployed _Registry Platform_ are subject to mandatory encryption for long-term storing. - -//== Високорівнева структура -== High-level structure +* The _Registries Platform_ is built using open standards based on open-source technologies. -//На даній структурній діаграмі зображено декомпозицію _Платформи Реєстрів_ на _рівні_, _зони_, _підсистеми_ та загальні сценарії їх взаємодії. -On this structure diagram you can see the decomposition of the _Registry Platform_ on the _zone_ and _subsystem levels_, and the general interaction scenarios. +* The _Registries Platform_ is a distributed system with microservice architecture, where each component has a defined function, and inter-component interaction is based on standardized data exchange protocols. -//Окремий рівень системи може включати дві зони з підсистемами, які відповідають за обслуговування адміністративного та операційного трафіку. -A separate system level may contain two zones with subsystems that are responsible for the servicing of administration and operational traffic. +The _Registries Platform_ is a _Cloud_native_ system based on the _OpenShift_ container orchestration platform to ensure reliability, scalability, and infrastructure agnosticism. -//Підсистеми, в свою чергу, складаються з сукупності сервісів, які адресують блок функціональних та нефункціональних вимог. -The subsystems are composed of services that address a block of functional and non-functional requirements. +* The _Registries Platform_ uses _GitOps_-approach to automatize infrastructure configuration, component deployment, and the system as a whole. +* The _Registries Platform_ is based on _Zero-Trust_ security principles to ensure protected inter-service interaction with mandatory authentication, authorization, and traffic encryption. -image::architecture/ddm-platform-structural-view.svg[] +* External access to the _Registries Platform_ components is provided via _API_-gateway with mandatory authentication and authorization. -//=== _Інфраструктура_ -=== _Infrastructure_ +* The _Registries Platform_ components use a standardized approach to monitoring metrics exporting, business-transactions data tracing, and event logging. -//_Платформа Реєстрів_ підтримує розгортання в публічному та приватному хмарному середовищі. -The _Registry Platform_ supports deployment in public and private cloud environment. +* The _Registries Platform_ component instances don't store critical data on the system state or any user session data in the memory. -//=== _Платформа оркестрації контейнерів_ -=== _Container orchestration platform_ +* All user actions with the data and system-critical events of the _Registries Platform_ are subject to mandatory recording in an audit log. -[TIP] --- -//Детальніше можна ознайомитись у відповідних розділах: -You can learn more about the container orchestration platform here: +* Registry business data deployed on the _Registries Platform_ are subject to mandatory encryption for long-term storing. -* xref:architecture/container-platform/container-platform.adoc[] --- +== High-level structure -//=== _Центральні компоненти Платформи_ -=== _Central components of the Platform_ +This structure diagram shows the decomposition of the _Registries Platform_ on the _zone_ and _subsystem levels_, and the general interaction scenarios. -//Кожен екземпляр _Платформи Реєстрів_ включає рівень _Центральних компонентів Платформи_, який складається з двох логічних зон: -Every _Registry Platform_ instance includes a level of _Central components of the Platform_, which is comprised of two logical zones: +A separate system level may contain two zones with subsystems responsible for servicing administration and operational traffic. -//* xref:architecture/platform/administrative/overview.adoc[] - сукупність підсистем, які забезпечують функції адміністрування екземпляра Платформи та реєстрів, які на ній розгорнуті -* xref:architecture/platform/administrative/overview.adoc[] - subsystems that provide administrative functions for the Platform instance and the registries deployed in it -//* xref:architecture/platform/operational/overview.adoc[] - сукупність підсистем, які забезпечують функції загального призначення для сумісного використання реєстрами -* xref:architecture/platform/operational/overview.adoc[] - subsystems that provide general functions for the joint platform usage +The subsystems consist of services that address both functional and non-functional requirements. -//=== _Реєстри_ -=== _Registries_ -//Один екземпляр _Платформи Реєстрів_ може обслуговувати групу реєстрів, ізольованих один від одного. Кожен тенант реєстру представлений двома окремими зонами: -One _Registry Platform_ instance can service a group of registries, isolated from each other. Each registry tenant is presented by two separate zones: +image::architecture/ddm-platform-structural-view.svg[] + +=== _Infrastructure_ -//* xref:architecture/registry/administrative/overview.adoc[] - cукупність підсистем, які забезпечують функції розробки, розгортання та обслуговування цифрового регламенту реєстру -* xref:architecture/registry/administrative/overview.adoc[] - subsystems that provide development functions, deployment functions, and the service of digital registry regulations -//* xref:architecture/registry/operational/overview.adoc[] - cукупність підсистем, які забезпечують функціонування реєстру згідно розгорнутого цифрового регламенту -* xref:architecture/registry/operational/overview.adoc[] - subsystems that provide the functioning of the registry according to the deployed digital regulations +The _Registries Platform_ supports deployment in public and private cloud environments. -//=== _Компонент керування станом ресурсів Платформи_ -=== _Platform resource state management component_ +=== _Container orchestration platform_ [TIP] -- -You can learn more about the Platform resource state management component here: -* xref:architecture/platform-installer/overview.adoc[] --- +You can learn more about the container orchestration platform here: -//// +* xref:architecture/container-platform/container-platform.adoc[] +-- -//=== _Шлюз безпечного обміну "Трембіта"_ -=== _"Trembita" secure exchange gateway_ +=== _Central components of the Platform_ -[TIP] --- -You can learn more about the "Trembita" secure exchange gateway here: +Every _Registries Platform_ instance includes a level of _Central components of the Platform_ and comprises two logical zones: -* xref:architecture/data-exchange/overview.adoc[] --- +* xref:architecture/platform/administrative/overview.adoc[] -- subsystems that provide administrative functions for the Platform instance and the registries deployed in it -//=== _Програмно-апаратний криптомодуль "Гряда"_ -=== _"Griada" software-hardware cryptomodule_ +* xref:architecture/platform/operational/overview.adoc[] -- subsystems that provide general functions for the joint platform usage -[TIP] --- -You can learn more about the "Griada" software-hardware cryptomodule here: +=== _Registries_ -* xref:architecture/network-crypto-module/overview.adoc[] --- +One _Registries Platform_ instance can service a group of isolated registries. Two separate zones present each registry tenant: -//// +* xref:architecture/registry/administrative/overview.adoc[] -- subsystems that provide development functions, deployment functions, and the service of digital registry regulations -//// -== Технологічний стек +* xref:architecture/registry/operational/overview.adoc[] -- subsystems that provide the functioning of the registry according to the deployed digital regulations -На даній високорівневій структурній діаграмі зображено ключові технології та їх застосування в реалізації функціональних та нефункціональних вимог _Платформою Реєстрів_. +=== _Component for managing the state of platform resources_ [TIP] -- -Детальніше з повним переліком технологій, які були використані при побудові _Платформи Реєстрів_ можна ознайомитись за xref:architecture/platform-technologies.adoc[посиланням]. --- - -image::architecture/ddm-platform-tech-view.svg[] +You can learn more about the Platform resource state management component here: -//// +* xref:architecture/platform-installer/overview.adoc[] +-- == Technology stack -The following high-level diagram displays the key technologies and their usage in the realization of functional and non-functional requirements of the _Registry Platform_. +The following high-level diagram displays the key technologies and their usage in realizing functional and non-functional requirements of the _Registries Platform_. [TIP] -- -The full list of technologies used in _Registry Platform_ development can be found xref:architecture/platform-technologies.adoc[here]. +The complete list of technologies used in the _Registries Platform_ development can be found xref:architecture/platform-technologies.adoc[here]. -- image::architecture/ddm-platform-tech-view.drawio.svg[] \ No newline at end of file diff --git a/docs/en/modules/arch/pages/architecture/platform-quality-attributes/overview.adoc b/docs/en/modules/arch/pages/architecture/platform-quality-attributes/overview.adoc index 1a69bb6e8b..cb0bc64701 100644 --- a/docs/en/modules/arch/pages/architecture/platform-quality-attributes/overview.adoc +++ b/docs/en/modules/arch/pages/architecture/platform-quality-attributes/overview.adoc @@ -5,63 +5,27 @@ include::platform:ROOT:partial$admonitions/language-en.adoc[] == General description -//В даному розділі задокументовані нефункціональні вимоги, яким має відповідати _Платформи Реєстрів_. This section shows the non-functional requirements that the _Registries Platform_ must fulfil. -//Для кожного атрибута якості наведено загальний опис підходу, яким чином він адресований в архітектурі рішення, ключові метрики та надано посилання на технічний дизайн відповідних підсистем та розділів з детальним описом. For each quality attribute, the following information is provided: overview of approach, implementation in solution architecture, key metrics. Additionally, links to the technical design of the corresponding subsystems, and sections with detailed descriptions are provided. -//При визначенні цільових значень для метрик, враховується класифікація реєстрів та умови їх експлуатації. Registry classification and operation conditions are taken into account when defining target values for metrics. -//Реєстри за цільовим призначенням поділяються на: By purpose, we differentiate the following Registries: +* _Strategic_ -- intended for general use by all subjects of information relations within given authority and (or) rights. +* _Tactical_ -- intended for specialized use by a restricted list of subjects within given authority. +* _Operative_ -- intended for dedicated use by a restricted list of subjects within given authority; typically not the master-Registry for other Registries. -//// -* _Стратегічні_ - призначені для загального користування усіма (найширшим переліком) суб'єктами інформаційних відносин в межах наданих їм повноважень та (чи) прав. -* _Тактичні_ - призначені для спеціалізованого використання обмеженим переліком суб'єктів в рамках наданих законодавством їм повноважень. -* _Оперативні_ - призначені для вузькоспеціалізованого використання обмеженим переліком суб'єктів в межах наданих їм законодавством повноважень; як правило, не є майстер-реєстром для інших реєстрів. -//// -* _Strategic_ - intended for general use by all subjects of information relations within given authority and (or) rights. -* _Tactical_ - intended for specialized use by a restricted list of subjects within given authority. -* _Operative_ - intended for dedicated use by a restricted list of subjects within given authority; typically not the master-Registry for other Registries. - -//Умови експлуатації реєстрів поділяються на: We differentiate the following Registry operation conditions: +* _Production hours_ -- officer's work hours, 8 to 18 on weekdays +* _Peak hours_ -- 3 hours during production hours +* _Evening hours_ -- +2 hours after production hours +* _Shadow hours_ -- all other hours -//// -* _Продуктивні години_ - робочі години чиновника з 8 по 18 протягом робочих днів -* _Години пік_ - 3 години протягом продуктивних годин -* _Вечірні години_ - +2 години після продуктивних годин -* _Тіньові години_ - всі інші години -//// -* _Production hours_ - officer's work hours, 8 to 18 on weekdays -* _Peak hours_ - 3 hours during production hours -* _Evening hours_ - +2 hours after production hours -* _Shadow hours_ - all other hours - -//== Атрибути якості == Quality attributes - -//// -[width="100%",cols="20%,80%",options="header"] -|=== -|Атрибут якості|Опис - -|xref:arch:architecture/platform-quality-attributes/platform-portability.adoc[Portability]|Атрибут якості визначає ступінь незалежності системи від типу інфраструктури, на якій вона може бути розгорнута. -|xref:arch:architecture/platform-quality-attributes/platform-scalability.adoc[Scalability]|Атрибут якості визначає здатність системи опрацьовувати підвищення навантаження без значного впливу на загальну продуктивність, або здатність швидко адаптуватись завдяки збільшенню ресурсів. -|xref:arch:architecture/platform-quality-attributes/platform-availability.adoc[Availability]|Атрибут якості визначає процентне відношення часу, в якій система перебуває в стані доступності та готовності для опрацювання запитів. -|xref:arch:architecture/platform-quality-attributes/platform-performance.adoc[Performance]|Атрибут якості визначає здатність системи опрацьовувати будь-який запит у межах визначеного інтервалу часу та забезпечувати обробку необхідної кількості запитів у визначений інтервал часу без погіршення показників часу, відведеного на їх опрацювання. -|xref:arch:architecture/platform-quality-attributes/platform-security.adoc[Security]|Атрибут якості визначає здатність системи захищати дані та інформацію від несанкціонованого доступу, забезпечуючи при цьому доступ авторизованим користувачам і системам. -|xref:arch:architecture/platform-quality-attributes/platform-observability.adoc[Observability]|Атрибут якості визначає здатність системи фіксувати та надавати детальну інформацію у вигляді журналів подій, метрик моніторингу та даних трасування транзакцій користувачів з ціллю спрощення ідентифікації та вирішення проблем адміністраторами системи. -|xref:arch:architecture/platform-quality-attributes/platform-auditability.adoc[Auditability]|Атрибут якості визначає здатність системи фіксувати та надавати інформацію про значимі технічні та бізнес події, пов'язані з експлуатацією системи кінцевими користувачами. Надана інформація може бути використана для виявлення та вирішення проблем в коректності функціонування системи. -|xref:arch:architecture/platform-quality-attributes/platform-interoperability.adoc[Interoperability]|Атрибут якості визначає здатність системи ефективно взаємодіяти з іншими системами з ціллю інформаційного обміну. -//// - - [width="100%",cols="20%,80%",options="header"] |=== |Quality attribute|Description @@ -69,7 +33,7 @@ We differentiate the following Registry operation conditions: |xref:arch:architecture/platform-quality-attributes/platform-portability.adoc[Portability]|This quality attribute defines the extent of system independence from the type of infrastructure it can be deployed on. |xref:arch:architecture/platform-quality-attributes/platform-scalability.adoc[Scalability]|This attribute defines the capability of a system to process growing workloads without serious drops in general performance, or the capability to instantly adapt by increasing resource provision. |xref:arch:architecture/platform-quality-attributes/platform-availability.adoc[Availability]|This attribute defines the percentage of time the system is available and ready to process requests. -|xref:arch:architecture/platform-quality-attributes/platform-performance.adoc[Performance]|This attribute defines the capability of a system to process any request within a restricted time interval, and provide the processing of the required number of requests in the set time interval without an increase in the time defined for their processing. +|xref:arch:architecture/platform-quality-attributes/platform-performance.adoc[Performance]|This attribute defines the capability of a system to process any request within a restricted time interval and provide the processing of the required requests number in the set time interval without an increase in the time defined for their processing. |xref:arch:architecture/platform-quality-attributes/platform-security.adoc[Security]|This attribute defines the capability of a system to protect data and information from unauthorized access, providing access to authorized users and systems at the same time. |xref:arch:architecture/platform-quality-attributes/platform-observability.adoc[Observability]|This quality attribute defines the capability of a system to record and provide detailed information in the form of event logs, monitoring metrics, and user transaction tracing data, in order to simplify problem identification and solving by system administrators. |xref:arch:architecture/platform-quality-attributes/platform-auditability.adoc[Auditability]|This quality attribute defines the capability of a system to record and provide information on important technical and business events, connected with system operation by end users. The provided information may be used to detect and solve problems in system functionality. diff --git a/docs/en/modules/arch/pages/architecture/platform-quality-attributes/platform-auditability.adoc b/docs/en/modules/arch/pages/architecture/platform-quality-attributes/platform-auditability.adoc index 0157e80e83..6bedc63307 100644 --- a/docs/en/modules/arch/pages/architecture/platform-quality-attributes/platform-auditability.adoc +++ b/docs/en/modules/arch/pages/architecture/platform-quality-attributes/platform-auditability.adoc @@ -1,24 +1,17 @@ = Auditability -include::ROOT:partial$templates/document-attributes/default-set-en.adoc[] +include::ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] -//== Overview - -//_Атрибут якості визначає здатність системи фіксувати та надавати інформацію про значимі технічні та бізнес події, пов'язані з експлуатацією системи кінцевими користувачами. Надана інформація може бути використана для виявлення та вирішення проблем в коректності функціонування системи._ _The quality attribute defines the capability of a system to record and provide information on important technical and business events, connected with system operation by end users. The provided information may be used to detect and solve problems in system functionality._ -//В архітектуру рішення _Платформи Реєстрів_ закладено транзакційну модель змін даних реєстру. Зміни до бази даних проводяться лише у межах регламентованих бізнес-процесів з обов'язковим збереженням версійності та підтвердженням змін цифровим підписом користувача або цифровою печаткою реєстру. -The _Registry Platform_ solution architecture includes a transactional model of Registry data changes. The changes to database are only performed within regulated Business Processes with mandatory versioning and confirmation of changes with the user's e-signature, or Registry digital stamp. +The _Registries Platform_ solution architecture includes a transactional model of Registry data changes. The changes to database are only performed within regulated Business Processes with mandatory versioning and confirmation of changes with the user's e-signature, or Registry digital stamp. -//Всі важливі системні та бізнес події, пов'язані з експлуатацією реєстру кінцевими користувачами, фіксуються в журналі аудиту для довготривалого зберігання та аналізу. -All important system and business events connected with system operation by end users are recorded in audit log for long-term storage and analysis. +All important system and business events connected with system operation by end users are recorded in the audit log for long-term storage and analysis. [TIP] -- -//Детальніше з технічним дизайном підсистем та компонент, які адресують атрибут якості, можна ознайомитись у розділах: -Find more details on relevant subsystems and components technical design in the following chapters: +Find more details on relevant subsystems and component technical design in the following chapters: -//* xref:arch:architecture/registry/operational/audit/overview.adoc[Підсистема журналювання подій аудиту] * xref:arch:architecture/registry/operational/audit/overview.adoc[Registry audit events logging subsystem] -- \ No newline at end of file diff --git a/docs/en/modules/arch/pages/architecture/platform-quality-attributes/platform-availability.adoc b/docs/en/modules/arch/pages/architecture/platform-quality-attributes/platform-availability.adoc index 231d8a1518..c2484555b2 100644 --- a/docs/en/modules/arch/pages/architecture/platform-quality-attributes/platform-availability.adoc +++ b/docs/en/modules/arch/pages/architecture/platform-quality-attributes/platform-availability.adoc @@ -1,47 +1,29 @@ = Availability -include::ROOT:partial$templates/document-attributes/default-set-en.adoc[] +include::ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] == Overview -//_Атрибут якості визначає процентне відношення часу, в якій система перебуває в стані доступності та готовності для опрацювання запитів._ _The quality attribute defines the percentage of time the system is available and ready to process requests._ -//_Платформа Реєстрів_ підтримує розгортання в режимі високої доступності як центральних компонентів Платформи, так і реєстрових компонентів. -The _Registry Platform_ supports highly-available deployment for central Platform components, and Registry components. +The _Registry Platform_ supports highly available deployment for central Platform components and Registry components. -//Висока доступність забезпечується завдяки застосуванню: -High-availability is achieved by using: +High availability is achieved by using: -//* _Active redundancy_ для критичних компонентів * _Active redundancy_ for critical components -//* _Affinity_ та _anti-affinity_ політик розподілу застосунків на віртуальних машинах кластера * _Affinity_ and _anti-affinity_ application distribution policies on cluster VMs -//* Автоматичному балансуванню навантаження на резервні екземпляри застосунків -* Automated load balancing to backup application instances -//* Використанню _rolling_-підходу до розгортання оновлень з мінімальним впливом на користувачів +* Automated load balancing to back up application instances * _Rolling_-approach to update deployments with minimal disruption for users [NOTE] -- -//Наведені показники передбачають розгортання _Платформи Реєстрів_ в 2-х дата-центрах або зонах доступності в залежності від типу обраної інфраструктури. The described values are calculated for the _Registry Platform_ deployment on two datacenters of availability zones, depending on the selected infrastructure. -- [TIP] -- -//Детальніше з технічним дизайном підсистем та компонент, які адресують атрибут якості, можна ознайомитись у розділах: -Find more details on relevant subsystems and components technical design in the following chapters: - - -//// -* xref:arch:architecture/container-platform/container-platform.adoc[Платформа оркестрації контейнерів] -* xref:arch:architecture/registry/operational/messaging/overview.adoc[Підсистема асинхронного обміну повідомленнями] -* xref:arch:architecture/registry/operational/relational-data-storage/overview.adoc[Підсистема управління реляційними базами даних] -* xref:arch:architecture/registry/operational/nonrelational-data-storage/overview.adoc[Підсистема управління нереляційними базами даних] -//// - +Find more details on relevant subsystems and component technical design in the following chapters: * xref:arch:architecture/container-platform/container-platform.adoc[Container orchestration platform] * xref:arch:architecture/registry/operational/messaging/overview.adoc[Asynchronous messaging subsystem] @@ -49,31 +31,15 @@ Find more details on relevant subsystems and components technical design in the * xref:arch:architecture/registry/operational/nonrelational-data-storage/overview.adoc[Non-relational database management subsystem] -- -//== Цільові метрики == Target metrics -//При визначенні цільових значень для вищезгаданих метрик, враховується класифікація реєстрів та умови їх експлуатації. -When defining target values for the abovementioned metrics, the classification of Registries, and operational conditions are taken into account. +When defining target values for the aforementioned metrics, the classification of Registries, and operational conditions are taken into account. [NOTE] -- -//Необхідно розгортати платформу більше ніж в 1 дата центрі для того, щоб досягнути ці цифри. To achieve these values, the Platform must be deployed on more than one datacenter. -- - -//// -.Цільові значення доступності для реєстрів -|=== -.2+|Метрика .2+|Клас реєстру 4+^|Цільове значення -|_Продуктивні години_|_Години пік_|_Вечірні години_|_Тіньові години_ - -.3+|_Availability_ |_Стратегічний_|`99.9%`|`99.9%`|`99.9%`|`95%` -|_Тактичний_|`99.9%`|`99.9%`|`99.9%`|`95%` -|_Оперативний_|`99%`|`99%`|`99%`|`90%` -|=== -//// - .Registry target availability values |=== .2+|Metric .2+|Registry class 4+^|Target value @@ -82,4 +48,4 @@ To achieve these values, the Platform must be deployed on more than one datacent .3+|_Availability_ |_Strategic_|`99.9%`|`99.9%`|`99.9%`|`95%` |_Tactical_|`99.9%`|`99.9%`|`99.9%`|`95%` |_Operative_|`99%`|`99%`|`99%`|`90%` -|=== +|=== \ No newline at end of file diff --git a/docs/en/modules/arch/pages/architecture/platform-quality-attributes/platform-interoperability.adoc b/docs/en/modules/arch/pages/architecture/platform-quality-attributes/platform-interoperability.adoc index 08a5efe566..4afb153868 100644 --- a/docs/en/modules/arch/pages/architecture/platform-quality-attributes/platform-interoperability.adoc +++ b/docs/en/modules/arch/pages/architecture/platform-quality-attributes/platform-interoperability.adoc @@ -1,22 +1,17 @@ = Interoperability -include::ROOT:partial$templates/document-attributes/default-set-en.adoc[] +include::ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] == Overview -//_Атрибут якості визначає здатність системи ефективно взаємодіяти з іншими системами з ціллю інформаційного обміну._ _The quality attribute defines the capability of a system to effectively interact with other systems for data exchange._ -//Для забезпечення інтероперабельності реєстрів, _Платформа Реєстрів_ підтримує дві основні опції налаштування інформаційного обміну: -To achieve Registry interoperability the _Registry Platform_ supports two main information exchange configuration options: +To achieve Registry interoperability, the _Registries Platform_ supports two main information exchange configuration options: -//* Через використання шини безпечного обміну "_Трембіта_" як захищеного транспорту. * Using Secure Exchange Gateway as protected transport. -//* Через налаштування прямих інтеграцій на базі _REST_ та _SOAP_ протоколів взаємодії для систем, які не є учасниками інформаційного обміну _СЕВДЕІР "Трембіта"_. * Configuring direct integrations based on _REST_ and _SOAP_ protocols for systems that don't participate in Secure Exchange Gateway connections. -//Зовнішніми системами для інтеграції можуть виступати як наявні інформаційні системи, так і реєстри, розгорнуті на окремих екземплярах _Платформи Реєстрів_. Existing information systems, and Registries deployed on separate _Registry Platform_ instances can act as external systems for integration. [TIP] diff --git a/docs/en/modules/arch/pages/architecture/platform-quality-attributes/platform-modifiability.adoc b/docs/en/modules/arch/pages/architecture/platform-quality-attributes/platform-modifiability.adoc index d9c38a80fc..6e2c888e48 100644 --- a/docs/en/modules/arch/pages/architecture/platform-quality-attributes/platform-modifiability.adoc +++ b/docs/en/modules/arch/pages/architecture/platform-quality-attributes/platform-modifiability.adoc @@ -1,42 +1,30 @@ = Modifiability -include::ROOT:partial$templates/document-attributes/default-set-en.adoc[] +include::ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] == Overview -//_Атрибут якості визначає рівень складності та швидкість внесення змін в систему з ціллю розширення функціональних можливостей та виправлення дефектів._ _The quality attribute defines complexity level and speed of applying changes into the system to extend functional capabilities, and fixing defects._ -//_Платформа Реєстрів_ забезпечує _Low-code_ підхід до розробки та розгортання реєстрів у вигляді _цифрового регламенту реєстру_, що включає декларативні описи моделі даних, бізнес-процесів інформаційних та адміністративних послуг, організаційної структури, зовнішніх інтеграцій та інших. The _Registry Platform_ provides a _Low-code_ approach to Registry development and deployment in the form of _registry digital regulations_ that includes declarative descriptions of the data model, Business Processes of informative and administrative, external integrations organizational structure, etc. -//_Підсистема моделювання регламенту реєстру_ надає _розробникам регламенту_ службові веб-інтерфейси для розробки функціональності реєстрів: -The _Registry regulations modeling subsystem_ provides _regulations developers_ with service web-interfaces for Registry functionality development: +The _Registry regulations modeling subsystem_ provides _regulations developers_ with service web interfaces for Registry functionality development: -//* Моделювання та внесення змін до регламенту реєстру -* Modelling and applying changes to Registry regulations -//* Проведення інспекції змін перед внесенням їх до регламенту реєстру +* Modeling and applying changes to Registry regulations * Performing changes inspection before applying them to Registry regulations -//* Перегляд результатів автоматичної перевірки змін в регламент реєстру * Viewing the results of automatic checking of the changes to Registry regulations -//* Версіонування регламенту реєстру з історією внесення змін * Registry regulations versioning with change history -//* Управління налаштуваннями реєстру * Registry configuration management -//_Підсистема розгортання регламенту реєстру_ забезпечує функції автоматизованого розгортання оновлень функціональності реєстрів: The _Registry regulations modeling subsystem_ provides the functionality for automated Registry update deployment: -//* Перевірка цілісності регламенту реєстру * Registry regulations integrity checking -//* Застосування змін та налаштування операційних сервісів реєстру * Applying changes and configuring Registry operational processes [TIP] -- -//Детальніше з технічним дизайном підсистем та компонент, які адресують атрибут якості, можна ознайомитись у розділах: -Find more details on relevant subsystems and components technical design in the following chapters: +Find more details on relevant subsystems and component technical design in the following chapters: * xref:arch:architecture/registry/administrative/regulation-management/registry-regulation/registry-regulation.adoc[] * xref:arch:architecture/registry/administrative/regulation-management/overview.adoc[] diff --git a/docs/en/modules/arch/pages/architecture/platform-quality-attributes/platform-observability.adoc b/docs/en/modules/arch/pages/architecture/platform-quality-attributes/platform-observability.adoc index 6541ed625e..d5903f7376 100644 --- a/docs/en/modules/arch/pages/architecture/platform-quality-attributes/platform-observability.adoc +++ b/docs/en/modules/arch/pages/architecture/platform-quality-attributes/platform-observability.adoc @@ -1,33 +1,19 @@ = Observability -include::ROOT:partial$templates/document-attributes/default-set-en.adoc[] +include::ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] -//== Загальний опис == Overview -//_Атрибут якості визначає наявність та рівень можливостей по оцінці та спостереженню поточного стану системи у процесі її експлуатації на базі згенерованих системою даних подій, метрик та трейсингових даних._ -_The quality attribute defines the existence and extent of the system capability to monitor current system state during operation, using system-generated event data, metrics, and tracing data._ - - -//_Платформа Реєстрів_ надає адміністраторам та службі підтримки широкі можливості для моніторингу стану підсистем платформи та розгорнутих на ній реєстрів завдяки постійному збору метрик, подій та трейсингових даних з подальшим їх збереженням для аналізу через візуальні дашборди службових веб-інтерфейсів. Швидкість реагування на інциденти забезпечується механізмом відправки сповіщень згідно налаштованих адміністратором правил. -The _Registry Platform_ provides the administrators and support service a wide variety capabilities for Platform subsystem state and deployed Registries monitoring thanks to metrics gathering of metrics, events and tracing data with further storing for analysis via visual dashboards of service interfaces. Incident reaction speed is achieved with the mechanism of notification sending, according to rules, set by the administrator. +_The quality attribute defines the existence and extent of the system capability to monitor the current system state during operation, using system-generated event data, metrics, and tracing data._ +The _Registries Platform_ provides the administrators and support service a wide variety of capabilities for Platform subsystem state and deployed Registries monitoring thanks to metrics gathering of metrics, events and tracing data with further storing for analysis via visual dashboards of service interfaces. Incident reaction speed is achieved with the mechanism of notification sending, according to rules set by the administrator. [TIP] -- -//Детальніше з технічним дизайном підсистем та компонент, які адресують атрибут якості, можна ознайомитись у розділах: -Find more details on relevant subsystems and components technical design in the following chapters: - +Find more details on relevant subsystems and component technical design in the following chapters: -//// -* xref:arch:architecture/platform/operational/monitoring/overview.adoc[Підсистема моніторингу подій та сповіщення] -* xref:arch:architecture/platform/operational/logging/overview.adoc[Підсистема журналювання подій] -* xref:arch:architecture/platform/operational/distributed-tracing/overview.adoc[Підсистема трасування запитів] -//// * xref:arch:architecture/platform/operational/monitoring/overview.adoc[Event monitoring and notification subsystem] * xref:arch:architecture/platform/operational/logging/overview.adoc[Event logging subsystem] * xref:arch:architecture/platform/operational/distributed-tracing/overview.adoc[Request tracing subsystem] - - -- \ No newline at end of file diff --git a/docs/en/modules/arch/pages/architecture/platform-quality-attributes/platform-operability.adoc b/docs/en/modules/arch/pages/architecture/platform-quality-attributes/platform-operability.adoc index eeb9a7e87f..9628f66250 100644 --- a/docs/en/modules/arch/pages/architecture/platform-quality-attributes/platform-operability.adoc +++ b/docs/en/modules/arch/pages/architecture/platform-quality-attributes/platform-operability.adoc @@ -1,20 +1,17 @@ = Operability -include::ROOT:partial$templates/document-attributes/default-set-en.adoc[] +include::ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] == Overview -//_Атрибут якості визначає наявність та рівень можливостей по обслуговуванню та управлінню налаштуваннями системи у процесі експлуатації._ _The quality attribute defines the existence and extent of the capabilities for maintenance and system configuration management during operation._ -//_Платформа Реєстрів_ надає технічним адміністратором широкі можливості по керуванню центральними компонентами _Платформи_ та розгорнутими на ній реєстрами за допомогою службових веб-інтерфейсів _Підсистеми управління Платформою та реєстрами_. -The _Registry Platform_ provides technical administrators with a wide variety of capabilities for _Platform_ central components and Registry components management, using service web-interfaces of the _Platform and registries management subsystem_. +The _Registry Platform_ provides technical administrators with a wide variety of capabilities for _Platform_ central components and Registry components management, using service web interfaces of the _Platform and registries management subsystem_. [TIP] -- -//Детальніше з технічним дизайном підсистем та компонент, які адресують атрибут якості, можна ознайомитись у розділах: -Find more details on relevant subsystems and components technical design in the following chapters: +Find more details on relevant subsystems and component technical design in the following chapters: * xref:arch:architecture/platform/administrative/control-plane/overview.adoc[] * xref:arch:architecture/platform/administrative/control-plane/configuration-structure/platform-configuration-structure.adoc[] diff --git a/docs/en/modules/arch/pages/architecture/platform-quality-attributes/platform-performance.adoc b/docs/en/modules/arch/pages/architecture/platform-quality-attributes/platform-performance.adoc index 3c06d4ada9..c21b7c0861 100644 --- a/docs/en/modules/arch/pages/architecture/platform-quality-attributes/platform-performance.adoc +++ b/docs/en/modules/arch/pages/architecture/platform-quality-attributes/platform-performance.adoc @@ -1,47 +1,28 @@ = Performance -include::ROOT:partial$templates/document-attributes/default-set-en.adoc[] +include::ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] == Overview -//_Атрибут якості визначає здатність системи опрацьовувати будь-який запит у межах визначеного інтервалу часу та забезпечувати обробку необхідної кількості запитів у визначений інтервал часу без погіршення показників часу, відведеного на їх опрацювання._ -_The quality attribute defines the capability of a system to process any request within a restricted time interval, and provide the processing of the required number of requests in the set time interval without an increase in the time defined for their processing._ +_The quality attribute defines the capability of a system to process any request within a restricted time interval, and provide the processing of the required requests number in the set time interval without an increase in the time defined for their processing._ -//Вимоги до продуктивності _Платформи Реєстрів_ представлені двома ключовими метриками: -The _Registry Platform_ preformance requirements are represented by two key metrics: +The _Registry Platform_ performance requirements are represented by two key metrics: -//* _Latency_ - часова затримка між відправкою запиту та отриманням відповіді системи (_95-й процентиль_) -* _Latency_ - time delay between request sending and receiving system response (95th percentile) -//* _Throughput_ - пропускна здатність системи, що задається кількістю опрацьованих запитів за визначений час -* _Throughput_ - system channe; capacity, defined by the amount of processed requests in set time period +* _Latency_ -- time delay between request sending and receiving system response (95th percentile) +* _Throughput_ -- system channel; capacity, defined by the number of processed requests in a set time period [TIP] -- You can read more on performance testing in xref:testing:performance-testing/performance-testing.adoc[] section. - -//* xref:testing:performance-testing/perf-report/1-9-5/perf-test-1-9-5-1500-1.adoc[Platform version 1.9.5 testing with 1500 users for 1-hour workload] -//* xref:testing:performance-testing/perf-report/1-9-5/perf-test-1-9-5-1500-8.adoc[Platform version 1.9.5 testing with 1500 users for 8-hour workload] -- -//== Цільові метрики == Target metrics -//При визначенні цільових значень для вищезгаданих метрик, враховується класифікація реєстрів, умови їх експлуатації та прогнозоване навантаження. -When defining target values for the abovementioned metrics, the classification of Registries, operational conditions and expected workload is taken into account. +When defining target values for the aforementioned metrics, the classification of Registries, operational conditions and expected workload is taken into account. -//.Цільові значення метрик продуктивності для стратегічного реєстру .Target performance metrics values for a strategic Registry -//// -|=== -.2+|Метрика .2+|Тип запиту 4+^|Цільове значення -|_Продуктивні години_|_Години пік_|_Вечірні години_|_Тіньові години_ -.2+|_Latency (мс)_|Операція читання (за ключем та одним полем, без запитів до сторонніх реєстрів)|`1000`|`1500`|`1000`|`1000` -|Операція запису|`3000`|`4500`|`3000`|`3000` -.2+|_Throughput (запитів/c)_|Операція читання|`500`|`1000`|`200`|`100` -|Операція запису|`5`|`10`|`5`|`0` -|=== -//// + |=== .2+|Metric .2+|Request type 4+^|Target value |_Production hours_|_Peak hours_|_Evening hours_|_Shadow hours_ @@ -51,19 +32,7 @@ When defining target values for the abovementioned metrics, the classification o |Write operation|`5`|`10`|`5`|`0` |=== - -//.Цільові значення метрик продуктивності для тактичного реєстру .Target performance metrics values for a tactical Registry -//// -|=== -.2+|Метрика .2+|Тип запиту 4+^|Цільове значення -|_Продуктивні години_|_Години пік_|_Вечірні години_|_Тіньові години_ -.2+|_Latency (мс)_|Операція читання (за ключем та одним полем, без запитів до сторонніх реєстрів)|`1500`|`2000`|`1500`|`1500` -|Операція запису|`3500`|`5000`|`3500`|`3500` -.2+|_Throughput (запитів/c)_|Операція читання|`200`|`400`|`75`|`50` -|Операція запису|`5`|`10`|`5`|`0` -|=== -//// |=== .2+|Metric .2+|Request type 4+^|Target value |_Production hours_|_Peak hours_|_Evening hours_|_Shadow hours_ @@ -74,18 +43,7 @@ When defining target values for the abovementioned metrics, the classification o |=== -//.Цільові значення метрик продуктивності для оперативного реєстру .Target performance metrics values for an operative Registry -//// -|=== -.2+|Метрика .2+|Тип запиту 4+^|Цільове значення -|_Продуктивні години_|_Години пік_|_Вечірні години_|_Тіньові години_ -.2+|_Latency (мс)_|Операція читання (за ключем та одним полем, без запитів до сторонніх реєстрів)|`1500`|`2000`|`1500`|`1500` -|Операція запису|`3500`|`5000`|`3500`|`3500` -.2+|_Throughput (запитів/c)_|Операція читання|`50`|`75`|`30`|`10` -|Операція запису|`5`|`10`|`5`|`0` -|=== -//// |=== .2+|Metric .2+|Request type 4+^|Target value |_Production hours_|_Peak hours_|_Evening hours_|_Shadow hours_ @@ -93,5 +51,4 @@ When defining target values for the abovementioned metrics, the classification o |Write operation|`3500`|`5000`|`3500`|`3500` .2+|_Throughput (requests/second)_|Read operation|`50`|`75`|`30`|`10` |Write operation|`5`|`10`|`5`|`0` -|=== - +|=== \ No newline at end of file diff --git a/docs/en/modules/arch/pages/architecture/platform-quality-attributes/platform-portability.adoc b/docs/en/modules/arch/pages/architecture/platform-quality-attributes/platform-portability.adoc index db574821eb..e8f6f00771 100644 --- a/docs/en/modules/arch/pages/architecture/platform-quality-attributes/platform-portability.adoc +++ b/docs/en/modules/arch/pages/architecture/platform-quality-attributes/platform-portability.adoc @@ -1,20 +1,16 @@ = Portability -include::ROOT:partial$templates/document-attributes/default-set-en.adoc[] +include::ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] == Overview -//_Атрибут якості визначає ступінь незалежності системи від типу інфраструктури, на якій вона може бути розгорнута._ _The quality attribute defines the extent of system independence from the type of infrastructure it can be deployed on._ -//В архітектуру рішення _Платформи Реєстрів_ закладено можливості розгортання в публічному та приватному хмарних середовищах або на власній локальній інфраструктурі. The _Registry Platform_ architecture includes the capabilities for deployment in private or public cloud environments, or custom local infrastructure. -//За процедуру встановлення відповідає xref:architecture/platform-installer/overview.adoc[Компонент керування станом ресурсів Платформи], який розроблено з урахуванням сумісності між різними постачальниками інфраструктури. -The installation procedure is managed by the xref:architecture/platform-installer/overview.adoc[Platform resource state management component], which is designed with different infrastructure providers compatibility. +The installation procedure is managed by the xref:architecture/platform-installer/overview.adoc[Component for managing the state of Platform resources], which is designed with different infrastructure providers compatibility. -//Поточна версія _Платформи Реєстрів_ підтримує розгортання у публічне та приватне хмарне середовище: The current version of the _Registry Platform_ support deployment in public and private cloud environments: * https://aws.amazon.com/[Amazon Web Services (AWS)] @@ -24,18 +20,12 @@ The current version of the _Registry Platform_ support deployment in public and [TIP] -- -//Детальніше з процедурою встановлення _Платформи Реєстрів_ можна ознайомитись у відповідних розділах: Find more information on installing the _Registry Platform_ in the corresponding sections: * xref:admin:installation/platform-deployment/platform-deployment-overview.adoc[] -//Детальніше з технічним дизайном підсистем та компонент, які адресують атрибут якості, можна ознайомитись у розділах: -Find more details on relevant subsystems and components technical design in the following chapters: +Find more details on relevant subsystems and component technical design in the following chapters: -//// -* xref:architecture/platform-installer/overview.adoc[Компонент керування станом ресурсів Платформи] -* xref:architecture/container-platform/container-platform.adoc#_portability[Платформа оркестрації контейнерів] -//// -* xref:architecture/platform-installer/overview.adoc[Platform resource state management component] +* xref:architecture/platform-installer/overview.adoc[Component for managing the state of Platform resources] * xref:architecture/container-platform/container-platform.adoc#_portability[Container orchestration platform] -- \ No newline at end of file diff --git a/docs/en/modules/arch/pages/architecture/platform-quality-attributes/platform-scalability.adoc b/docs/en/modules/arch/pages/architecture/platform-quality-attributes/platform-scalability.adoc index 5f29e03f3f..beea34160b 100644 --- a/docs/en/modules/arch/pages/architecture/platform-quality-attributes/platform-scalability.adoc +++ b/docs/en/modules/arch/pages/architecture/platform-quality-attributes/platform-scalability.adoc @@ -1,55 +1,31 @@ = Scalability -include::ROOT:partial$templates/document-attributes/default-set-en.adoc[] +include::ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] -//== Загальний опис == Overview -//_Атрибут якості визначає здатність системи опрацьовувати підвищення навантаження без значного впливу на загальну продуктивність, або здатність швидко адаптуватись завдяки збільшенню ресурсів._ _The quality attribute defines the capability of a system to process growing workloads without serious drops in general performance, or the capability to instantly adapt by increasing resource provision._ -//_Платформа Реєстрів_ побудована на базі xref:arch:architecture/container-platform/container-platform.adoc[платформи оркестрації контейнерів _OpenShift_], що забезпечує можливості ефективного масштабування підсистем та компонентів реєстру відповідно до поточного навантаження. The _Registry Platform_ is built on the xref:arch:architecture/container-platform/container-platform.adoc[_OpenShift_ container orchestration platform], which provides the capabilities for effective scaling of Registry subsystems and components according to the current workload. -//xref:arch:architecture/platform/administrative/control-plane/overview.adoc[Підсистема управління Платформою та Реєстрами] надає адміністраторам веб-інтерфейс управління ресурсами кластера та реєстрів з підтримкою двох підходів до масштабування: +xref:arch:architecture/platform/administrative/control-plane/overview.adoc[Platform and registries management subsystem] provides administrators with a web interface for cluster and Registry resources management, with support for two scaling approaches: -xref:arch:architecture/platform/administrative/control-plane/overview.adoc[Platform and registries management subsystemи] provides administrators with a web-interface for cluster and Registry resouce management, with support for two scaling approaches: - -//* _Вертикальне масштабування_ (_scale-up_) - виділення додаткових ресурсів CPU та пам'яті окремим компонентам, зміни типів та характеристик віртуальних машин кластера, збільшення розмірів системних дисків, тощо. -* _Scale-up_ - allotment of additional CPU and memory resources to separate components, changing cluster VM characteristics, increasing disk volume, etc. -//* _Горизонтальне масштабування_ (_scale-out_) - збільшення ресурсів кластера та реєстру шляхом розгортання додаткових віртуальних машин, створення додаткових копій компонентів з ціллю балансування навантаження, тощо. -* _Scale-out_ - increasing cluster and Registry resources by deploying additional VMs, additional component instances for load balancing, etc. +* _Scale-up_ -- allotment of additional CPU and memory resources to separate components, changing cluster VM characteristics, increasing disk volume, etc. +* _Scale-out_ -- increasing cluster and Registry resources by deploying additional VMs, additional component instances for load balancing, etc. [TIP] -- -//Детальніше з процедурою масштабування _Платформи Реєстрів_ можна ознайомитись у відповідних розділах: Find more details on _Registry Platform_ scaling procedure in the corresponding sections: - -//// -* xref:admin:scaling/vertical-scaling-master-nodes.adoc[Вертикальне масштабування master nodes для OKD у AWS та vSphere] -* xref:admin:file-system/ceph_scaling.adoc[Масштабування розміру файлової системи Ceph] -* xref:architecture/container-platform/cluster_node_autoscaler.adoc[Автоматичне горизонтальне масштабування екземплярів нод кластера] -//// * xref:admin:scaling/vertical-scaling-master-nodes.adoc[Master nodes vertical scaling for OKD in AWS and vSphere] * xref:admin:file-system/ceph_scaling.adoc[Scaling of Ceph file system size] * xref:architecture/container-platform/cluster_node_autoscaler.adoc[Automated horizontal scaling of cluster node instances] +Find more details on relevant subsystems and component technical design in the following chapters: -//Детальніше з технічним дизайном підсистем та компонент, які адресують атрибут якості, можна ознайомитись у розділах: -Find more details on relevant subsystems and components technical design in the following chapters: - - -//// -* xref:arch:architecture/container-platform/container-platform.adoc#_scalability[Платформа оркестрації контейнерів] -* xref:arch:architecture/registry/operational/relational-data-storage/overview.adoc#_scalability[Підсистема управління реляційними базами даних] -* xref:arch:architecture/registry/operational/nonrelational-data-storage/overview.adoc#_scalability[Підсистема управління нереляційними базами даних] -* xref:arch:architecture/platform/operational/distributed-data-storage/overview.adoc#_scalability[Підсистема розподіленого зберігання даних] -//// * xref:arch:architecture/container-platform/container-platform.adoc#_scalability[Container orchestration platform] * xref:arch:architecture/registry/operational/relational-data-storage/overview.adoc#_scalability[Relational database management subsystem] -* xref:arch:architecture/registry/operational/nonrelational-data-storage/overview.adoc#_scalability[Non-elational database management subsystem] +* xref:arch:architecture/registry/operational/nonrelational-data-storage/overview.adoc#_scalability[Non-relational database management subsystem] * xref:arch:architecture/platform/operational/distributed-data-storage/overview.adoc#_scalability[Distributed data storage subsystem] - --- +-- \ No newline at end of file diff --git a/docs/en/modules/arch/pages/architecture/platform-quality-attributes/platform-security.adoc b/docs/en/modules/arch/pages/architecture/platform-quality-attributes/platform-security.adoc index 2ffbde30fd..40ff5c5a5d 100644 --- a/docs/en/modules/arch/pages/architecture/platform-quality-attributes/platform-security.adoc +++ b/docs/en/modules/arch/pages/architecture/platform-quality-attributes/platform-security.adoc @@ -1,29 +1,20 @@ = Security -include::ROOT:partial$templates/document-attributes/default-set-en.adoc[] +include::ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] == Overview -//_Атрибут якості визначає здатність системи захищати дані та інформацію від несанкціонованого доступу, забезпечуючи при цьому доступ авторизованим користувачам і системам._ _The quality attribute defines the capability of a system to protect data and information from unauthorized access, providing access to authorized users and systems at the same time._ -//Архітектура безпеки _Платформи Реєстрів_ відповідає за три загальноприйняті характеристики: The _Registry Platform_ security architecture is responsible for three general characteristics: - -//// -* _Конфіденційність_ – властивість захисту даних або сервісів від несанкціонованого доступу. -* _Цілісність_ – властивість того, що дані або послуги не піддаються несанкціонованим маніпуляціям. -* _Доступність_ - властивість, що система буде доступна для цільового використання. -//// -* _Confidentiality_ – protection of data and resources from unauthorized access. -* _Integrity_ – avoidance of unauthorized tampering with data or services. -* _Availability_ - availability of the system for intended use. +* _Confidentiality_ -- protection of data and resources from unauthorized access. +* _Integrity_ - avoidance of unauthorized tampering with data or services. +* _Availability_ -- availability of the system for intended use. [TIP] -- -//Детальніше можна ознайомитись у відповідних розділах: Find more details in the corresponding sections: * xref:arch:architecture/security/overview.adoc[] diff --git a/docs/en/modules/arch/pages/architecture/platform-quality-attributes/platform-verifiability.adoc b/docs/en/modules/arch/pages/architecture/platform-quality-attributes/platform-verifiability.adoc index 3891d98ac0..efebfb81ed 100644 --- a/docs/en/modules/arch/pages/architecture/platform-quality-attributes/platform-verifiability.adoc +++ b/docs/en/modules/arch/pages/architecture/platform-quality-attributes/platform-verifiability.adoc @@ -1,27 +1,21 @@ = Verifiability -include::ROOT:partial$templates/document-attributes/default-set-en.adoc[] +include::ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] == Overview -//_Атрибут якості визначає рівень складності тестування та відлагодження системи у разі внесення змін._ _The quality attribute defines the complexity level of system testing and debugging when applying changes._ -//_Платформа Реєстрів_ забезпечує широкі можливості по контролю та забезпеченню якості у процесі розробки реєстрів: The _Registry Platform_ provides a wide range of capabilities for quality control and provision in the process of Registry development: -//* Перевірка регламенту реєстру на помилки при внесенні змін * Checking Registry regulations for errors when applying changes -//* Автоматизоване тестування за допомогою функціональних _BDD_-тестів при застосуванні змін * Automated testing using functional _BDD_-tests when applying changes -//* Налаштування симуляції зовнішніх інтеграцій з ціллю тестування реєстру в ізоляції * Configuring external integrations simulation to test Registry in isolated environment [TIP] -- -//Детальніше з технічним дизайном підсистем та компонент, які адресують атрибут якості, можна ознайомитись у розділах: -Find more details on relevant subsystems and components technical design in the following chapters: +Find more details on relevant subsystems and component technical design in the following chapters: * xref:arch:architecture/registry/administrative/regulation-management/registry-regulation/registry-regulation.adoc[] * xref:arch:architecture/registry/administrative/regulation-publication/overview.adoc[] diff --git a/docs/en/modules/arch/pages/architecture/platform-secret-management/overview.adoc b/docs/en/modules/arch/pages/architecture/platform-secret-management/overview.adoc index cb63f30e20..a95371029e 100644 --- a/docs/en/modules/arch/pages/architecture/platform-secret-management/overview.adoc +++ b/docs/en/modules/arch/pages/architecture/platform-secret-management/overview.adoc @@ -1,55 +1,28 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Central service for managing Platform secrets +include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] -NOTE: 🌐 This document is available in both English and Ukrainian. Use the language toggle in the top right corner to switch between versions. +include::platform:ROOT:partial$admonitions/language-en.adoc[] == General description -//Компонент, який забезпечує операції Auto unseal для підсистем управління секретами та шифруванням. A component that provides Auto unseal operations for secret management and encryption subsystems. -//== Функції компоненти == Component functions -//* Забезпечення можливостей автоматичного розблокування (unseal) підсистеми керування секретами та шифруванням Платформи * Provision of automatic unlocking (unseal) of the subsystem of managing secrets and encryption of the Platform -//== Технічний дизайн компоненти == Component technical design image::architecture/platform-secret-management/platform-secret-management.drawio.svg[width=500,float="center",align="center"] -//== Технологічний стек == Technology stack -//При проектуванні та розробці були використані наступні технології: The following technologies were used in the design and development: * xref:arch:architecture/platform-technologies.adoc#vault[HashiCorp Vault] == Components -//// -|=== -|Назва компоненти|Представлення|Походження|Призначення - -|_Центральний сервіс управління секретами Платформи_ -|`platform-vault` -|3rd-party -|Забезпечення операції Auto unseal для підсистем управління секретами та шифруванням - -|=== -//// - |=== |Component name|Representation|Source|Appointment @@ -65,5 +38,4 @@ The following technologies were used in the design and development: [security] === Security -//_Центральний сервіс управління секретами Платформи_ забезпечує операції автоматичного розпакування (_unseal_) підсистем управління секретами та шифруванням Платформи та Реєстрів. _Central Platform secrets management service_ provides automatic unpacking (_unseal_) of subsystems of secret management and encryption of the Platform and Registers. \ No newline at end of file diff --git a/docs/en/modules/arch/pages/architecture/platform-system-requirements/overview.adoc b/docs/en/modules/arch/pages/architecture/platform-system-requirements/overview.adoc index e590eb3b48..56f34058f2 100644 --- a/docs/en/modules/arch/pages/architecture/platform-system-requirements/overview.adoc +++ b/docs/en/modules/arch/pages/architecture/platform-system-requirements/overview.adoc @@ -1,7 +1,16 @@ -= Platform system requirements += System requirements +:sectanchors: +:sectlinks: -== Overview +include::platform:ROOT:partial$admonitions/language-en.adoc[] -This section contains the documented system requirements for the _Registries Platform_: +In this section, you will find straightforward and understandable system requirements that will help ensure the reliable operation of the Platform and the Registry instance. -* xref:arch:architecture/platform-system-requirements/registry-cost.adoc[Calculating registry cost] -- description of the approach to evaluating the ownership cost for registries deployed on the _Platform_. \ No newline at end of file +*_System requirements for the Platform instance_* detail the technical specifications for deploying your Platform in various environments, mainly _AWS_ and _vSphere_, and provide an overview of the infrastructure service costs. + +*_System requirements for the Registry instance_* provide specific characteristics and needs for deploying the registry on the _Platform_. This section also contains exhaustive information about the registry cost. + +== Section overview + +* xref:arch:architecture/platform-system-requirements/platform-requirements.adoc[System requirements for the Platform instance] +* xref:arch:architecture/platform-system-requirements/registry-requirements.adoc[System requirements for the Registry instance] \ No newline at end of file diff --git a/docs/en/modules/arch/pages/architecture/platform-system-requirements/platform-requirements.adoc b/docs/en/modules/arch/pages/architecture/platform-system-requirements/platform-requirements.adoc new file mode 100644 index 0000000000..615dced265 --- /dev/null +++ b/docs/en/modules/arch/pages/architecture/platform-system-requirements/platform-requirements.adoc @@ -0,0 +1,188 @@ += System requirements for the Platform instance +include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] + +include::platform:ROOT:partial$admonitions/language-en.adoc[] + +This document provides the system requirements for the Platform instance. The main aspects of these requirements include: + +. *_Requirements for the OKD cluster_*: The OKD cluster can be deployed in various environments, including public clouds like AWS or private solutions based on vSphere. Each environment requires its own approach and specifications. +. *_Requirements for the Platform's central services_*: These services include components common to all registries and ensure the overall functioning of the Platform. + +Details of these aspects are discussed in the following sections of the document. Analyze the provided information to ensure the optimal selection of resources and configuration for your Platform instance. + +== System requirements for the Platform deployment environment + +=== System requirements for OKD in the public cloud environment AWS + +Hosts in your OKD environment must meet the following technical specifications and system requirements. + +TIP: See more details on https://docs.okd.io/latest/installing/installing_aws/preparing-to-install-on-aws.html[Requirements for Installing OKD Cluster in AWS Environment]. + +//TODO: Check all the figures, as they are partially for the OKD 3.11 version. Update to 4.11 + +Key components: :: + +* *Master nodes*: Manage the cluster and resources, control application deployments, and have configuration storage. + +* *Worker nodes*: These are the nodes where container applications are deployed. + +* *Infrastructure nodes*: Deploy cluster support services such as routers, metrics, and logging. + +Hardware requirements: :: + +* *Master nodes*: +** CPU: 2 vCPU +** RAM: 16 GB RAM +** Disk Space: 40 GB + +* *Worker nodes*: +** CPU: 2 vCPU +** RAM: 8 GB RAM +** Disk Space: 15 GB + +* *Infrastructure nodes*: +** CPU: 2 vCPU +** RAM: 8 GB RAM +** Disk Space: 20 GB + +Network requirements: :: + +* *MTU*: The recommended MTU size for your network interfaces is 1500 bytes or more. +* *DNS*: All nodes in the cluster should be able to resolve the names of other nodes in the network. + +Additional software requirements: :: + +* *Docker*: Version 1.13.1 or newer for deploying containers. +* *Red Hat Enterprise Linux*: Version 8 or newer for nodes. + +AWS requirements: :: +It is recommended to use EC2 instances optimized for EBS. +Ensure proper access to AWS resources such as VPC, EC2, S3, etc. +Consider using Elastic Load Balancers for load distribution. + +=== System Requirements for OKD in the private cloud environment vSphere + +Hosts in your OKD environment must meet the following technical specifications and system requirements. + +//TODO: Check all the figures, as they are partially for the OKD 3.11 version. Update to 4.11 + +[minimal-okd-requirements] +==== Minimum requirements for installing OKD Cluster on VMware vSphere + +TIP: See more details on https://docs.okd.io/4.11/installing/installing_vsphere/installing-vsphere-installer-provisioned.html[Requirements for Installing OKD Cluster in vSphere Environment]. + +Key components: :: + +* *Master nodes*: Manage the cluster and resources, control application deployments, and have configuration storage. +* *Worker nodes*: These are the nodes where container applications are deployed. +* *Infrastructure nodes*: Deploy cluster support services such as routers, metrics, and logging. + +Hardware requirements: :: +* *Master nodes*: +** CPU: 2 vCPU +** RAM: 16 GB RAM +** Disk Space: 40 GB + +* *Worker nodes*: +** CPU: 1 vCPU +** RAM: 8 GB RAM +** Disk Space: 15 GB + +* *Infrastructure nodes*: +** CPU: 2 vCPU +** RAM: 8 GB RAM +** Disk Space: 20 GB + +Network requirements: :: +* *MTU*: Should be configured to support the largest packet size needed for your deployment. +* *DNS*: All nodes in the cluster should be able to resolve the names of other nodes in the network. + +Additional software requirements: :: +* *Docker*: For deploying containers. +* *Red Hat Enterprise Linux*: Version 7.3 or newer for nodes. + +vSphere requirements: :: +* *VM hardware*: Version 13 or newer +* *vSphere ESXi hosts*: 6.5 or newer +* *vCenter host*: 6.5 or newer +{empty} + +Minimum supported version of vSphere for VMware components: :: ++ +* *Hypervisor component*: Minimum supported version: vSphere 6.5 or newer, with HW version 13. ++ +This is the minimum version supported by Fedora CoreOS (see more details on the official resource: https://access.redhat.com/documentation/ru-ru/red_hat_enterprise_linux/8/html/configuring_and_managing_virtualization/feature-support-and-limitations-in-rhel-8-virtualization_configuring-and-managing-virtualization[Red Hat Enterprise Linux 8 supported hypervisors list]). + +* *Storage component with in-tree drivers*: Minimum supported version -- vSphere 6.5 or newer. ++ +This plugin creates vSphere storage using the in-tree storage drivers for vSphere included in OKD. +(Optional) Networking Component (NSX-T): Minimum supported version -- vSphere 6.5U3 or vSphere 6.7U2 and newer. ++ +OKD requires vSphere 6.5U3 or vSphere 6.7U2+. NSX container plugin (NCP) VMware is certified for OKD 4.6 and NSX-T 3.x. + +== System Requirements for the Platform's Central Services + +The Platform's central services system requirements outline the necessary resources for efficient operation. These resources are common to all registries. Among the primary services are: + +Openshift (master and workers):: An automatic deployment, scaling, and management system for container applications + +Ceph:: File storage distribution subsystem + +Logging:: Event logging subsystem + +Central Vault:: Platform secret management subsystem + +Minio:: Platform backup storage + +.Approximate system requirements for the Platform's central services +|=== +|Service|Machine type|Number of machines|Machine disk type|Machine disk size, Gb + +|Openshift master +|r5.2xlarge (8 CPU, 64 RAM) +|3 +|gp2 +|120 + +|Ceph +|r5.4xlarge (16 CPU, 128 RAM) +|3 +|gp2 +|1170 + +|Logging +|m5.2xlarge (8 CPU, 32 RAM) +|3 +|gp2 +|495 + +|Workers +|r5.2xlarge (8 CPU, 64 RAM) +|5 +|gp2 +|250 + +|Central Vault +|r5.2xlarge (8 CPU, 64 RAM) +|1 +|gp2 +|160 + +|Minio +|r5.2xlarge (8 CPU, 64 RAM) +|1 +|gp2 +|2080 + +|=== + +[infra-components-cost] +=== Calculation of the Platform's central services cost + +The computational cost of the Platform's central services reflects the funds invested in resources that support the shared services. Since one such complex of services can serve numerous registries, its cost is distributed proportionally among them. + +TIP: More details about what is included in the cost can be found in the electronic spreadsheet +xref:attachment$architecture/platform-system-requirements/registry-cost-calculator.xlsx[Registry cost calculation] on the _Cost Calculator_ page _>_ _Approximate calculation of common services cost_. + +== Related Pages +* xref:arch:architecture/platform-system-requirements/registry-requirements.adoc[System requirements for the Registry instance] \ No newline at end of file diff --git a/docs/en/modules/arch/pages/architecture/platform-system-requirements/registry-cost.adoc b/docs/en/modules/arch/pages/architecture/platform-system-requirements/registry-cost.adoc index aeb088ea0d..852b23150d 100644 --- a/docs/en/modules/arch/pages/architecture/platform-system-requirements/registry-cost.adoc +++ b/docs/en/modules/arch/pages/architecture/platform-system-requirements/registry-cost.adoc @@ -49,16 +49,15 @@ When deploying your registry using standard templates, refer to the following co The prices are based on Amazon Web Services cloud computing platform rates as of the end of 2022, assuming a 12-hour operation per day during the working week. //Більше деталей про те що входить у вартість можна знайти в електронній таблиці xref:attachment$/architecture/registry_cost_calculator.xlsx[розрахунок вартості реєстру] на сторінці _Калькулятор вартості_. -For a more detailed cost breakdown, download the xref:attachment$/architecture/registry_cost_calculator.xlsx[Registry cost calculator spreadsheet] and see the *Cost calculator* sheet. +For a more detailed cost breakdown, download the xref:attachment$/architecture/platform-system-requirements/registry-cost-calculator.xlsx[Registry cost calculator spreadsheet] and see the *Cost calculator* sheet. -//== Калькулятор вартості == Cost calculator //Для оцінки вартості ресурсів необхідних для роботи реєстру, який відповідає заданим вимогам, можна скористатися наступним калькулятором: Use the following calculator to estimate the cost of resources required to operate the registry that meets specific requirements: //xref:attachment$/architecture/registry_cost_calculator.xlsx[Розрахунок вартості реєстру - Excel] -xref:attachment$/architecture/registry_cost_calculator.xlsx[Registry cost calculator spreadsheet] +xref:attachment$architecture/platform-system-requirements/registry-cost-calculator.xlsx[Registry cost calculator spreadsheet] //На сторінці _Вибір розміру реєстру_ в рядку _Ваш реєстр_ можна побачити результати розрахунку, а нижче, під результатом, вибір параметрів реєстру. On the *Set registry size* sheet, the *Your registry* row contains calculation results. Underneath, you can configure your registry parameters. diff --git a/docs/en/modules/arch/pages/architecture/platform-system-requirements/registry-requirements.adoc b/docs/en/modules/arch/pages/architecture/platform-system-requirements/registry-requirements.adoc new file mode 100644 index 0000000000..37551097cd --- /dev/null +++ b/docs/en/modules/arch/pages/architecture/platform-system-requirements/registry-requirements.adoc @@ -0,0 +1,131 @@ += System requirements for the Registry instance +include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] + +include::platform:ROOT:partial$admonitions/language-en.adoc[] + +== System requirements + +Calculating the system requirements for a specific registry is a crucial aspect of planning its infrastructure and resources. Different registries may vary due to the volume of data, number of users, data structure, and other parameters that determine their specific system needs. + +This page presents recommendations and parameters for various registry configurations. The parameter *`1 VM calculation reference`* defines the reference value for one virtual machine (VM). Based on this, we propose three main deployment template configurations: + +Minimal:: +This configuration is intended for registries with small data and users. +It is optimally suited for pilot projects, testing, or registries in the early implementation stages. +Although this configuration has limited resources, it still provides reliability and basic performance. + +Recommended:: +This configuration is recommended for most registries operating in medium and high load modes. +It is well balanced between resources, performance, and cost, making it suitable for registries serving an average number of users and having a moderate amount of data. + +Large:: +This configuration is for large registries with significant data and high workloads. +It is designed for registries that serve many users, have complex business processes, and require high performance. +This configuration provides maximum performance and flexibility but requires more resources and costs. + +Each configuration has system characteristics, such as _machine type (CPU, RAM)_, _disk size_, _disk type_, file system storage size, expected traffic volume, etc. + +.Approximate system requirements for a single registry instance +|=== +|Template|Machine Type|Number of Machines|Machine Disk Type|Machine Disk Size, Gb|Ceph Disk Type|Ceph Storage Size, Gb|Expected Traffic Volume per Month, Gb + +|1 VM calculation reference + +|m5.2xlarge (8 CPU, 32 RAM) +|1 +|gp3 +|120 +|gp3 +|200 +|550 + +|minimal +|m5.2xlarge (8 CPU, 32 RAM) +|2 +|gp3 +|120 +|gp3 +|200 +|550 + +|recommended +|m5.2xlarge (8 CPU, 32 RAM) +|5 +|gp3 +|120 +|gp3 +|200 +|550 + +|large +|m5.2xlarge (8 CPU, 32 RAM) +|10 +|gp3 +|120 +|gp3 +|200 +|550 +|=== + +== Registry cost calculation + +The cost of computing resources for the registry consists of the cost of resources created exclusively for the registry and a portion of the cost of resources designed to support the operation of shared services. + +One set of shared services can support dozens of registries, and its operating cost is distributed among these registries (_see more on page xref:arch:architecture/platform-system-requirements/platform-requirements.adoc[]_). + +=== Typical configurations + +When deploying a registry with standard templates, you can refer to the following cost of computing resources. + +|=== +|Template|Number of VMs|Total VM Operating Cost, $ per month|Total VM Disk Cost, $ per month|Total Cost of Distributed Storage, $ per month|Total Traffic Cost, $ per month|Cost of Shared Services, $ per month|Total Cost, $ per month + +|Minimal|2|220.8|22.85|19.04|49.50|258.52|*570.71* +|Recommended|5|552.00|57.12|19.04|49.50|646.30|*1323.96* +|Large|10|1104.00|114.24|19.04|49.50|1292.61|*2579.39* +|=== + +NOTE: Prices are based on Amazon Web Services cloud computing platform rates as of the end of 2022, assuming 12 hours of operation per day during the working week. + +TIP: More details about what is included in the cost can be found in the electronic table +xref:attachment$architecture/platform-system-requirements/registry-cost-calculator.xlsx[Registry Cost Calculation] on the _Cost Calculator_ page. + +=== Cost calculator + +To estimate the cost of resources necessary for the operation of a registry that meets the specified requirements, you can use the following calculator: + +* xref:attachment$architecture/platform-system-requirements/registry-cost-calculator.xlsx[Registry cost calculation] + +On the _Select registry size_ page, in the _Your registry_ row, you can see the calculation results and the registry parameter selection below. + +==== Results + +Number of VMs:: The calculated number of virtual machines required for the registry operation that meets the parameters specified below. + +Cost:: The calculated monthly operating cost at Amazon Web Services cloud computing platform prices. It comprises the virtual machines required to operate the registry and the cost of using shared Platform services. + +==== Input parameters +===== Basic parameters + +High-availability mode:: Reserving additional instances of registry components and capacities for automatic horizontal scaling. +Operating mode:: The time when the registry is operational. + +===== Registry volume +Number of business entities:: The number of tables in the registry's data model. +Maximum number of business entity instances (rows in the table):: The number of rows in the largest table of the registry. +Approximate volume of historical data in GB:: The volume of data uploaded to the registry before the start of commercial operation (initial upload). + +===== Registry parameters +The following parameters are set separately for each of the three categories of users: _officials/service providers_, _citizens/service recipients_, _other systems_. + +Number of users:: The number of registered users who can use the registry. +Number of services (business processes):: The number of services the registry can provide to different categories of users. +Average number of user tasks per service:: The average number of tasks requiring user input. +Average number of automated tasks per service:: The average number of tasks that do not require user input. +Number of reports:: The total number of modeled reports used by officials. +Number of extracts:: The total number of modeled extracts. +Number of services provided per month:: The total number of services offered monthly. + +== Related pages + +* xref:arch:architecture/platform-system-requirements/platform-requirements.adoc[] \ No newline at end of file diff --git a/docs/en/modules/arch/pages/architecture/platform-technologies.adoc b/docs/en/modules/arch/pages/architecture/platform-technologies.adoc index cf0b630c02..c1c50c6473 100644 --- a/docs/en/modules/arch/pages/architecture/platform-technologies.adoc +++ b/docs/en/modules/arch/pages/architecture/platform-technologies.adoc @@ -14,50 +14,47 @@ image::architecture/ddm-platform-tech-view.svg[] |=== |Language|Version|License|Description -//|[[java]]https://www.java.com/en/[Java]|11.x|https://www.gnu.org/licenses/old-licenses/gpl-2.0.html[GPL v2]|Об'єктно орієнтована мова програмування |[[java]]https://www.java.com/en/[Java]|11.x|https://www.gnu.org/licenses/old-licenses/gpl-2.0.html[GPL v2]|Object-oriented programming language -//|[[groovy]]https://groovy-lang.org/[Groovy]|3.0.6|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Об'єктно орієнтована динамічна мова програмування, що працює в середовищі JRE + |[[groovy]]https://groovy-lang.org/[Groovy]|3.0.6|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Object-oriented dynamic programming language that works within the JRE environment -//|[[go]]https://go.dev/[Go]|1.19|https://go.dev/LICENSE[Copyright (c) 2009 The Go Authors. All rights reserved.]|Go мова программування розроблена компанією Google + |[[go]]https://go.dev/[Go]|1.19|https://go.dev/LICENSE[Copyright (c) 2009 The Go Authors. All rights reserved.]|Go programming language developed by Google -//|[[python]]https://www.python.org/[Python]|3.X|https://docs.python.org/3/license.html[PSF License]|Мова програмування + |[[python]]https://www.python.org/[Python]|3.X|https://docs.python.org/3/license.html[PSF License]|Programming language -//|[[javascript]]https://developer.mozilla.org/ru/docs/Web/JavaScript/[JavaScript]|V8|https://chromium.googlesource.com/v8/v8.git/+/master/LICENSE[BDS license]|Мова програмування для розробки веб-застосунків + |[[javascript]]https://developer.mozilla.org/ru/docs/Web/JavaScript/[JavaScript]|V8|https://chromium.googlesource.com/v8/v8.git/+/master/LICENSE[BDS license]|Programming language for web application development -//|[[typescript]]https://www.typescriptlang.org/[TypeScript]|4.5.5|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Мова програмування, представлена Microsoft восени 2012; позиціонується як засіб розробки веб-застосунків, що розширює можливості JavaScript + |[[typescript]]https://www.typescriptlang.org/[TypeScript]|4.5.5|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Programming language introduced by Microsoft in the fall of 2012; positioned as a tool for developing web applications, extending the capabilities of JavaScript |=== -//== Фреймворки клієнтських додатків == Client application frameworks |=== |Technology|Version|License|Description -//|[[vuejs]]https://vuejs.org/[VueJS]|3.2.45|https://opensource.org/licenses/MIT[MIT]|JavaScript бібліотека для створення інтерфейсів користувача при розробці односторінкових застосунків |[[vuejs]]https://vuejs.org/[VueJS]|3.2.45|https://opensource.org/licenses/MIT[MIT]|JavaScript library for creating user interfaces in single-page applications development |[[reactjs]]https://reactjs.org/[ReactJS]|5.0.1|https://opensource.org/licenses/MIT[MIT]|JavaScript library for creating user interfaces, aimed at solving issues of partial content updates on web pages, commonly encountered in single-page application development -//|[[reactjs]]https://reactjs.org/[ReactJS]|5.0.1|https://opensource.org/licenses/MIT[MIT]|JavaScript бібліотека для створення інтерфейсів користувача, яка покликана вирішувати проблеми часткового оновлення вмісту веб-сторінки, з якими стикаються в розробці односторінкових застосунків -//|[[redux]]https://redux.js.org/[Redux]|4.1.2|https://opensource.org/licenses/MIT[MIT]|JavaScript бібліотека призначена для управління станом програм JavaScript + + |[[redux]]https://redux.js.org/[Redux]|4.1.2|https://opensource.org/licenses/MIT[MIT]|JavaScript library designed for managing the state of JavaScript applications -//|[[material-ui]]https://mui.com/[Material UI]|4.11.4|https://github.com/mui/material-ui/blob/master/LICENSE[MIT]|Бібліотека UI компонентів яка реалізує систему https://m3.material.io/[material design]. Більшість компонентів для вводу користувацьких даних основані на компонентах цієї бібліотеки. + |[[material-ui]]https://mui.com/[Material UI]|4.11.4|https://github.com/mui/material-ui/blob/master/LICENSE[MIT]|UI component library that implements the material design system. Most user input components are based on this library. |=== == Server application frameworks |=== -//|Технологія|Версія|Ліцензія|Опис + |Technology|Version|License|Description -//|[[spring]]https://spring.io/[Spring]|5.3.13|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Java універсальний фреймворк для побудови серверних додатків + |[[spring]]https://spring.io/[Spring]|5.3.13|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Java universal framework for building server applications -//|[[spring-boot]]https://github.com/spring-projects/spring-boot[Spring Boot]|2.6.1|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Розширення до Spring Framework для спрощення побудови аплікацій на базі Spring завдяки автоматичній конфігурації та наявності spring boot стартерів + |[[spring-boot]]https://github.com/spring-projects/spring-boot[Spring Boot]|2.6.1|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|An extension to the Spring Framework for simplifying the development of Spring-based applications through automatic configuration and the availability of Spring Boot starters -//|[[spring-cloud]]https://spring.io/projects/spring-cloud[Spring Cloud]|2021.0.0|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Фреймворк для реалізації типових патернів побудови надійних розподілених систем + |[[spring-cloud]]https://spring.io/projects/spring-cloud[Spring Cloud]|2021.0.0|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|A framework for implementing common patterns in building reliable distributed systems -//|[[gin]]https://gin-gonic.com/[Gin Web Framework]|1.7.2|https://opensource.org/licenses/MIT[MIT]|Go фреймворк для побудови серверних додатків + |[[gin]]https://gin-gonic.com/[Gin Web Framework]|1.7.2|https://opensource.org/licenses/MIT[MIT]|Go framework for building server applications -//|[[nodejs]]https://nodejs.org/[Node.JS]|16.18.1|https://opensource.org/licenses/MIT[MIT]|Платформа для виконання високопродуктивних мережевих застосунків, написаних мовою JavaScript + |[[nodejs]]https://nodejs.org/[Node.JS]|16.18.1|https://opensource.org/licenses/MIT[MIT]|A platform for executing high-performance network applications written in JavaScript |=== @@ -65,7 +62,7 @@ image::architecture/ddm-platform-tech-view.svg[] |=== |Technology|Version|License|Description -//|[[bash]]https://www.gnu.org/software/bash/[bash]|4.2|https://www.gnu.org/licenses/gpl-3.0.html[GNU General Public License, version 3]|Сучасна командна оболонка середовища GNU/Linux. + |[[bash]]https://www.gnu.org/software/bash/[bash]|4.2|https://www.gnu.org/licenses/gpl-3.0.html[GNU General Public License, version 3]|Modern command-line shell for the GNU/Linux environment. |=== @@ -74,52 +71,48 @@ image::architecture/ddm-platform-tech-view.svg[] === Technologies |=== -//|Технологія|Версія|Ліцензія|Опис + |Technology|Version|License|Description -//|[[postgresql]]https://www.postgresql.org/[PostgreSQL]|14.5.0|https://opensource.org/licenses/postgresql[The PostgreSQL Licence]|Об'єктно реляційна система керування базами даних |[[postgresql]]https://www.postgresql.org/[PostgreSQL]|14.5.0|https://opensource.org/licenses/postgresql[The PostgreSQL Licence]|Object-relational database management system -//|[[redis]]https://redis.io/[Redis]|6.0.8|https://redis.io/docs/about/license/[Three clause BSD license]|Розподілене сховище пар ключ-значення, які зберігаються в оперативній пам'яті + |[[redis]]https://redis.io/[Redis]|6.0.8|https://redis.io/docs/about/license/[Three clause BSD license]|Distributed key-value store that stores data in memory -//|[[ceph]]https://ceph.io/en/[Ceph]|6.2.0-152|https://github.com/ceph/ceph/blob/main/COPYING[LGPL-2.1, LGPL-3, BSD 3-clause, Apache-2.0, MIT License, Boost Software License, Version 1.0, BSD 3-clause, CC0, Boost Software License, Version 1.0, GNU Affero General Public License, Version 3, ]|Розподілена файлова система + |[[ceph]]https://ceph.io/en/[Ceph]|6.2.0-152|https://github.com/ceph/ceph/blob/main/COPYING[LGPL-2.1, LGPL-3, BSD 3-clause, Apache-2.0, MIT License, Boost Software License, Version 1.0, BSD 3-clause, CC0, Boost Software License, Version 1.0, GNU Affero General Public License, Version 3, ]|Distributed file system |=== === Extensions |=== -//|Розширення|Версія|Ліцензія|Опис + |Extensions|Version|License|Description -//|[[redis-sentinel]]https://redis.io/[Redis Sentinel]|6.2.6|https://redis.io/docs/about/license/[Three clause BSD license]|High availability рішення для Redis -|[[redis-sentinel]]https://redis.io/[Redis Sentinel]|6.2.6|https://redis.io/docs/about/license/[Three clause BSD license]|High availability solution for Redis -//|[[pgpool]]https://www.pgpool.net/[Pgpool]|4.3.1|https://opensource.org/licenses/MIT[MIT]|Менеджер пула підключень над PostgreSQL, що також дозволяе організувати реплікацію даних, load balancing, кешування даних +|[[redis-sentinel]]https://redis.io/[Redis Sentinel]|6.2.6|https://redis.io/docs/about/license/[Three clause BSD license]|High-availability solution for Redis + |[[pgpool]]https://www.pgpool.net/[Pgpool]|4.3.1|https://opensource.org/licenses/MIT[MIT]|Connection pool manager for PostgreSQL that also allows organizing data replication, load balancing, and data caching -//|[[pgadmin]]https://www.pgadmin.org/[pgAdmin 4]|6.18|https://github.com/pgadmin-org/pgadmin4/blob/master/LICENSE[PostgreSQL licence]|Веб-застосунок розробки баз даних + |[[pgadmin]]https://www.pgadmin.org/[pgAdmin 4]|6.18|https://github.com/pgadmin-org/pgadmin4/blob/master/LICENSE[PostgreSQL licence]|ВWeb-based database development application |=== === Operators |=== -//|Оператор|Версія|Ліцензія|Опис + |Operator|Version|License|Description -//|[[crunchy-operator]]https://github.com/CrunchyData/postgres-operator[CrunchyData Postgres Operator]|5.1.1|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]| PostgresOperator для забезпечення менеджменту PostgreSQL кластеру |[[crunchy-operator]]https://github.com/CrunchyData/postgres-operator[CrunchyData Postgres Operator]|5.1.1|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]| PostgresOperator for managing the PostgreSQL cluster -//|[[redis-operator]]https://github.com/spotahome/redis-operator[Redis Operator]|1.1.1|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Оператор для налаштування Redis / Redis Sentinel + |[[redis-operator]]https://github.com/spotahome/redis-operator[Redis Operator]|1.1.1|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Operator for configuring Redis / Redis Sentinel |=== === Operators |=== -//|Оператор|Версія|Ліцензія|Опис + |Operator|Version|License|Description -//|[[ocs-operator]]https://github.com/red-hat-storage/ocs-operator[OCS Operator]|4.10.7|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Оператор для налаштування файлової підсистеми OKD |[[ocs-operator]]https://github.com/red-hat-storage/ocs-operator[OCS Operator]|4.10.7|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Operator for configuring the OKD file subsystem -//|[[rook-operator]]https://rook.io/[Rook]|4.9.8-2|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Operator для розгортання та менеджменту Ceph сховища в Kubernetes + |[[rook-operator]]https://rook.io/[Rook]|4.9.8-2|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Operator for deploying and managing Ceph storage in Kubernetes |=== @@ -130,27 +123,23 @@ image::architecture/ddm-platform-tech-view.svg[] |=== |Technology|Version|License|Description -//|[[terraform]]https://www.terraform.io/[Terraform]|>=1.0|https://github.com/hashicorp/terraform/blob/main/LICENSE[MPL-2.0]|Розгортання інфраструктури для платформенних компонентів |[[terraform]]https://www.terraform.io/[Terraform]|>=1.0|https://github.com/hashicorp/terraform/blob/main/LICENSE[MPL-2.0]|Infrastructure deployment for platform components |=== -//== Управління контейнерами == Container management -//=== Технології === Technologies |=== -//|Технологія|Версія|Ліцензія|Опис + |Technology|Version|License|Description -//|[[crio]]https://cri-o.io/[Cri-o]|1.24|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Технологія управління контейнерами, яка надає високорівневий API для взаємодії |[[crio]]https://cri-o.io/[Cri-o]|1.24|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Container management technology that provides a high-level API for interaction -//|[[kubernetes]]https://kubernetes.io/[Kubernetes]|1.24|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Платформа оркестрації контейнерів -[[kubernetes]]https://kubernetes.io/[Kubernetes]|1.24|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Container orchestration platform -//|[[okd]]https://www.okd.io/[OKD]|4.11|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Платформа для побудови, розгортання та управління контейнерами на базі Kubernetes + +|[[kubernetes]]https://kubernetes.io/[Kubernetes]|1.24|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Container orchestration platform + |[[okd]]https://www.okd.io/[OKD]|4.11|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Platform for building, deploying, and managing containers based on Kubernetes -//|[[helm]]https://helm.sh/[Helm]|3|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Пакетний менеджер для Kubernetes + |[[helm]]https://helm.sh/[Helm]|3|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Package manager for Kubernetes |=== @@ -159,14 +148,13 @@ image::architecture/ddm-platform-tech-view.svg[] === Technologies |=== -//|Технологія|Версія|Ліцензія|Опис + |Technology|Version|License|Description -//|[[jenkins]]https://www.jenkins.io/[Jenkins]|2.303.3|https://opensource.org/licenses/MIT[MIT]|Сервер для організації процесів Безперервної Інтеграції та Розгортання (CI/CD) |[[jenkins]]https://www.jenkins.io/[Jenkins]|2.303.3|https://opensource.org/licenses/MIT[MIT]|A server for organizing Continuous Integration and Continuous Deployment (CI/CD) processes -//|[[gerrit]]https://www.gerritcodereview.com/[Gerrit]|3.3.2|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Інструмент проведення перевірки та інтеграції коду + |[[gerrit]]https://www.gerritcodereview.com/[Gerrit]|3.3.2|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|A tool for code review and integration -//|[[nexus]]https://www.sonatype.com/products/nexus-repository[Nexus]|3.30.0|https://www.eclipse.org/legal/epl-v10.html[Eclipse Public License v1.0]|Репозиторій для збереження 3rd party та власних артефактів + |[[nexus]]https://www.sonatype.com/products/nexus-repository[Nexus]|3.30.0|https://www.eclipse.org/legal/epl-v10.html[Eclipse Public License v1.0]|A repository for storing 3rd party and custom artifacts |=== @@ -175,13 +163,12 @@ image::architecture/ddm-platform-tech-view.svg[] |=== |Operator|Version|License|Description -//|[[edp-codebase-operator]]https://github.com/epam/edp-codebase-operator[EDP Codebase Operator]|2.10|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Оператор для автоматизованого налаштування Git Server |[[edp-codebase-operator]]https://github.com/epam/edp-codebase-operator[EDP Codebase Operator]|2.10|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Operator for automated Git Server configuration -//|[[edp-gerrit-operator]]https://github.com/epam/edp-gerrit-operator[EDP Gerrit Operator]|2.10|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Оператор для автоматизованого налаштування Gerrit + |[[edp-gerrit-operator]]https://github.com/epam/edp-gerrit-operator[EDP Gerrit Operator]|2.10|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Operator for automated Gerrit configuration -//|[[edp-jenkins-operator]]https://github.com/epam/edp-jenkins-operator[EDP Jenkins Operator]|2.10|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Оператор для автоматизованого налаштування Jenkins + |[[edp-jenkins-operator]]https://github.com/epam/edp-jenkins-operator[EDP Jenkins Operator]|2.10|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|ОOperator for automated Jenkins configuration -//|[[edp-nexus-operator]]https://github.com/epam/edp-nexus-operator[EDP Nexus Operator]|2.10|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Оператор для автоматизованого налаштування Nexus + |[[edp-nexus-operator]]https://github.com/epam/edp-nexus-operator[EDP Nexus Operator]|2.10|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Operator for automated Nexus configuration |=== @@ -193,8 +180,7 @@ image::architecture/ddm-platform-tech-view.svg[] |=== |Technology|Version|License|Description -//|[[keycloak]]https://www.keycloak.org/[Keycloak]|15 -> 20|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Система для управління користувачами та їх доступом, автентифікації, інтеграції з зовнішніми Identity провайдерами -|[[keycloak]]https://www.keycloak.org/[Keycloak]|15 -> 20|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|A system for user and access management, authentication, and integration with external Identity providers +|[[keycloak]]https://www.keycloak.org/[Keycloak]|20.0.3|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|A system for user and access management, authentication, and integration with external Identity providers |=== === Operators @@ -202,9 +188,8 @@ image::architecture/ddm-platform-tech-view.svg[] |=== |Operator|Version|License|Description -//|[[edp-keycloak-operator]]https://github.com/epam/edp-keycloak-operator[EDP Keycloak Operator]|2.10|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Оператор для автоматизованого налаштування Keycloak |[[edp-keycloak-operator]]https://github.com/epam/edp-keycloak-operator[EDP Keycloak Operator]|2.10|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Operator for automated Keycloak configuration -//|[[group-sync-operator]]https://github.com/redhat-cop/group-sync-operator[Group Sync]|0.0.19|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2]|Operator для синхронізації груп користувачів між Keycloak та OKD + |[[group-sync-operator]]https://github.com/redhat-cop/group-sync-operator[Group Sync]|0.0.19|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2]|Operator for synchronizing user groups between Keycloak and OKD |=== @@ -215,11 +200,9 @@ image::architecture/ddm-platform-tech-view.svg[] |=== |Technology|Version|License|Description -//|[[kong]]https://github.com/Kong/kong[Kong]|3.0.1|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0] a|Рішення для управлінням доступом до внутрішніх ресурсів. Окрім основного функціоналу платформою також використовуються наступні розширення: -//* https://docs.konghq.com/hub/kong-inc/rate-limiting/[Rate Limiting] - дозволяє встановлювати ліміти на кількість викликів від клієнта базуючись на його IP адресі або заголовку запиту. -//* https://docs.konghq.com/hub/kong-inc/response-transformer/[Response Transformer] - дозволяє додавати власні заголовки до відповіді сервера. -//* OIDC - плагін власної розробки на основі https://github.com/nokia/kong-oidc. Відповідає за імплементацію OIDC автентифікації та управління сесіями. + + |[[kong]]https://github.com/Kong/kong[Kong]|3.0.1|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0] a|РA solution for managing access to internal resources. In addition to the main functionality, the following extensions are used: * https://docs.konghq.com/hub/kong-inc/rate-limiting/[Rate Limiting] -- allows setting limits on the number of calls from a client based on its IP address or request header. @@ -230,10 +213,9 @@ image::architecture/ddm-platform-tech-view.svg[] === Operators |=== -//|Оператор|Версія|Ліцензія|Опис + |Operator|Version|License|Description -//|[[kong-ingress-controller]]https://docs.konghq.com/kubernetes-ingress-controller/latest/[Kong Ingress Controller]|2.7.0|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Оператор для налаштування Kong |[[kong-ingress-controller]]https://docs.konghq.com/kubernetes-ingress-controller/latest/[Kong Ingress Controller]|2.7.0|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Operator for configuring Kong |=== @@ -244,9 +226,8 @@ image::architecture/ddm-platform-tech-view.svg[] |=== |Technology|Version|License|Description -//|[[nginx]]https://nginx.org/[Nginx]|1.22.1|https://www.freebsd.org/copyright/freebsd-license/[FreeBSD]|Рішення для постачання статичного контенту по запиту |[[nginx]]https://nginx.org/[Nginx]|1.22.1|https://www.freebsd.org/copyright/freebsd-license/[FreeBSD]|A solution for serving static content on demand -//|[[haproxy]]https://www.haproxy.org/[HAProxy]|2.2.24|https://www.gnu.org/licenses/old-licenses/gpl-2.0.html[GNU General Public License, version 2]|Рішення для балансування навантаження та забезпечення високої доступності + |[[haproxy]]https://www.haproxy.org/[HAProxy]|2.2.24|https://www.gnu.org/licenses/old-licenses/gpl-2.0.html[GNU General Public License, version 2]|A solution for load balancing and ensuring high availability |=== @@ -255,20 +236,18 @@ image::architecture/ddm-platform-tech-view.svg[] === Technologies |=== -//|Технологія|Версія|Ліцензія|Опис + |Technology|Version|License|Description -//|[[istio]]https://istio.io/[Istio]|1.18.0|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Рішення для організації надійного транспорту між сервісами, розгорнутими на платформі оркестрації контейнерів |[[istio]]https://istio.io/[Istio]|1.18.0|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|A solution for reliable transport between services deployed on the container orchestration platform |=== === Operators |=== -//|Оператор|Версія|Ліцензія|Опис + |Operator|Version|License|Description -//|[[istio-operator]]https://istio.io/latest/docs/setup/install/operator/[Istio Operator]|1.18.0 |https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Оператор для налаштування Istio |[[istio-operator]]https://istio.io/latest/docs/setup/install/operator/[Istio Operator]|1.18.0 |https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Operator for configuring Istio |=== @@ -279,19 +258,17 @@ image::architecture/ddm-platform-tech-view.svg[] |=== |Technology|Version|License|Description -//|[[kafka]]https://kafka.apache.org/[Kafka]|3.0.0|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Платформа розподілених потокових трансляцій із відкритим кодом |[[kafka]]https://kafka.apache.org/[Kafka]|3.0.0|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|An open-source distributed streaming platform -//|[[kafka-schema-registry]]https://docs.confluent.io/platform/current/schema-registry/index.html#sr-overview[Kafka Schema Registry]|6.1.1|https://www.confluent.io/confluent-community-license/[Confluent Community License Version 1.0]| Реєстр (сховище та пошук) для опису структур даних kafka messages (Avro schema, JSON schema, Protobuf schema) + |[[kafka-schema-registry]]https://docs.confluent.io/platform/current/schema-registry/index.html#sr-overview[Kafka Schema Registry]|6.1.1|https://www.confluent.io/confluent-community-license/[Confluent Community License Version 1.0]| A registry (store and search) for describing data structures of Kafka messages (Avro schema, JSON schema, Protobuf schema) |=== === Operators |=== -//|Оператор|Версія|Ліцензія|Опис + |Operator|Version|License|Description -//|[[strimzi-operator]]https://strimzi.io/[Strimzi]|0.28|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2]|Kafka operator для розгортування та менеджменту Kafla cluster |[[strimzi-operator]]https://strimzi.io/[Strimzi]|0.28|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2]|Kafka operator for deployment and management of Kafla cluster |=== @@ -301,10 +278,9 @@ image::architecture/ddm-platform-tech-view.svg[] === Technologies |=== -//|Технологія|Версія|Ліцензія|Опис + |Technology|Version|License|Description -//|[[vault]]https://www.vaultproject.io/[Hashicorp Vault]|1.9.7|https://www.mozilla.org/en-US/MPL/2.0/[Mozilla Public License Version 2.0]|Система управління секретами |[[vault]]https://www.vaultproject.io/[Hashicorp Vault]|1.9.7|https://www.mozilla.org/en-US/MPL/2.0/[Mozilla Public License Version 2.0]|A system for managing secrets |=== @@ -313,10 +289,9 @@ image::architecture/ddm-platform-tech-view.svg[] |=== |Operator|Version|License|Description -//|[[ext-secrets-operator]]https://external-secrets.io/[External Secrets Operator]|0.7.0|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Operator для забезпечення інтеграції Hashicorp Vault з Kubernetes Secrets |[[ext-secrets-operator]]https://external-secrets.io/[External Secrets Operator]|0.7.0|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Operator for integrating HashiCorp Vault with Kubernetes Secrets -//|[[reloader]]https://github.com/stakater/Reloader[Reloader]|1.0.25|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Operator для спостереження за змінами в ConfigMaps та Secrets та їх оновлення на подах компонентів реєстру |[[reloader]]https://github.com/stakater/Reloader[Reloader]|1.0.25|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Operator for observing changes in ConfigMaps and Secrets and updating them on registry components' pods +|[[cert-manager]]https://cert-manager.io/[cert-manager]|1.6.3|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Operates the certificates and certificate issuers as resource types in Kubernetes and OKD clusters, and simplifies the process of obtaining, renewing and using those certificates |=== == Business process management @@ -324,21 +299,18 @@ image::architecture/ddm-platform-tech-view.svg[] === Technologies |=== -//|Технологія|Версія|Ліцензія|Опис + |Technology|Version|License|Description -//|[[camunda]]https://camunda.com/[Camunda BPM]|7.16.0|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Рішення для автоматизованого розгортання та виконання бізнес-процесів описаних у BPMN нотації та DMN бізнес-правил |[[camunda]]https://camunda.com/[Camunda BPM]|7.16.0|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|A solution for automated deployment and execution of business processes described in BPMN notation and DMN business rules |=== -//=== Бібліотеки === Libraries |=== -//|Бібліотека|Версія|Ліцензія|Опис + |Library|Version|License|Description -//|[[bpmn]]https://bpmn.io/toolkit/bpmn-js/[BPMN.JS SDK]|10.0.0|https://github.com/bpmn-io/bpmn-js/blob/develop/LICENSE[Copyright (c) 2014-present Camunda Services GmbH]|JavaScript бібліотека для створення інструментів візуального моделювання бізнес-процесів згідно BPMN нотації |[[bpmn]]https://bpmn.io/toolkit/bpmn-js/[BPMN.JS SDK]|10.0.0|https://github.com/bpmn-io/bpmn-js/blob/develop/LICENSE[Copyright (c) 2014-present Camunda Services GmbH]|JavaScript library for creating tools for visual modeling of business processes according to BPMN notation |=== @@ -349,7 +321,6 @@ image::architecture/ddm-platform-tech-view.svg[] |=== |Library|Version|License|Description -//|[[formio]]https://formio.github.io/formio.js/app/sdk[Form.IO SDK]|4.13.12|https://opensource.org/licenses/MIT[MIT]|JavaScript бібліотека для створення інструментів моделювання користувацьких форм використовуючи Drag&Drop підхід з можливостями попереднього перегляду |[[formio]]https://formio.github.io/formio.js/app/sdk[Form.IO SDK]|4.13.12|https://opensource.org/licenses/MIT[MIT]|JavaScript library for creating tools for modeling user forms using the Drag&Drop approach with preview capabilities |=== @@ -360,7 +331,6 @@ image::architecture/ddm-platform-tech-view.svg[] |=== |Technology|Version|License|Description -//|[[geoserver]]https://github.com/geoserver/geoserver[GeoServer]|2.21.0|https://www.gnu.org/licenses/old-licenses/gpl-2.0.html[GNU General Public License, version 2]|Сервер, що дозволяє проводиті менеджмент та розповсюдження гео даних |[[geoserver]]https://github.com/geoserver/geoserver[GeoServer]|2.21.0|https://www.gnu.org/licenses/old-licenses/gpl-2.0.html[GNU General Public License, version 2]|A server that allows managing and distributing geospatial data |=== @@ -369,17 +339,15 @@ image::architecture/ddm-platform-tech-view.svg[] |=== |Extension|Version|License|Description -//|[[postgis]]https://postgis.net/[PostGIS]|3.2.1|https://opensource.org/licenses/gpl-2.0.php[GPL v2]|Geo розширення до PostgreSQL бази даних |[[postgis]]https://postgis.net/[PostGIS]|3.2.1|https://opensource.org/licenses/gpl-2.0.php[GPL v2]|Geo extension for PostgreSQL database |=== === Libraries |=== -//|Бібліотека|Версія|Ліцензія|Опис + |Library|Version|License|Description -//|[[leaflet]]https://leafletjs.com/[Leaflet]|1.8.0|https://github.com/Leaflet/Leaflet/blob/main/LICENSE[BSD 2-Clause "Simplified" License]|UI Javascript Бібліотека для побудови mobile-friendly інтерактивних карт |[[leaflet]]https://leafletjs.com/[Leaflet]|1.8.0|https://github.com/Leaflet/Leaflet/blob/main/LICENSE[BSD 2-Clause "Simplified" License]|UI Javascript Library for building mobile-friendly interactive maps |=== @@ -388,10 +356,9 @@ image::architecture/ddm-platform-tech-view.svg[] === Technologies |=== -//|Технологія|Версія|Ліцензія|Опис + |Technology|Version|License|Description -//|[[redash]]https://redash.io/[Redash]|10.1.0|https://github.com/getredash/redash/blob/master/LICENSE[BSD 2-Clause "Simplified" License]|Рішення для моделювання та візуалізації звітів на базі реляційних та нереляційних сховищ |[[redash]]https://redash.io/[Redash]|10.1.0|https://github.com/getredash/redash/blob/master/LICENSE[BSD 2-Clause "Simplified" License]|A solution for modeling and visualizing reports based on relational and non-relational data stores |=== @@ -399,16 +366,14 @@ image::architecture/ddm-platform-tech-view.svg[] include::ROOT:partial$admonitions/ua-specific.adoc[] -//=== Бібліотеки === Libraries |=== -//|Бібліотека|Версія|Ліцензія|Опис + |Library|Version|License|Description -//|[[eusigncp]]https://iit.com.ua/[EUSignCP-Java]|1.3.236|Commercial license|ІІТ Java бібліотека підпису |[[eusigncp]]https://iit.com.ua/[EUSignCP-Java]|1.3.236|Commercial license|IIIT Java signature library -//|[[eusign]]https://iit.com.ua/[eusign.js]|20220527|Commercial license|ІІТ JavaScript бібліотека електронного підпису. Використовується для інтеграції з віджетом підпису. + |[[eusign]]https://iit.com.ua/[eusign.js]|20220527|Commercial license|IIIT JavaScript e-signature library. Used for integration with the signature widget. |=== @@ -417,10 +382,9 @@ include::ROOT:partial$admonitions/ua-specific.adoc[] === Libraries |=== -//|Бібліотека|Версія|Ліцензія|Опис + |Library|Version|License|Description -//|[[i18next]]https://www.i18next.com/[i18next]|20.6.0|https://github.com/i18next/i18next/blob/master/LICENSE[MIT]|UI Javascript Фреймворк для інтернаціоналізації. Використовується разом з https://react.i18next.com/[react.i18next]. |[[i18next]]https://www.i18next.com/[i18next]|20.6.0|https://github.com/i18next/i18next/blob/master/LICENSE[MIT]|UI Javascript framework for internationalization. Used together with https://react.i18next.com/[react.i18next]. |=== @@ -431,7 +395,6 @@ include::ROOT:partial$admonitions/ua-specific.adoc[] |=== |Technology|Version|License|Description -//|[[liquibase]]https://www.liquibase.org/[Liquibase]|4.3|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Інструмент для інкрементального управління структурою БД та даними |[[liquibase]]https://www.liquibase.org/[Liquibase]|4.3|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|A tool for incremental management of database structure and data |=== @@ -440,20 +403,19 @@ include::ROOT:partial$admonitions/ua-specific.adoc[] === Technologies |=== -//|Технологія|Версія|Ліцензія|Опис + |Technology|Version|License|Description -//|[[mailu]]https://mailu.io/[Mailu]|1.8|?|Пакет ПЗ для відправки та отримання поштових повідомлень |[[mailu]]https://mailu.io/[Mailu]|1.8|?|Software package for sending and receiving email messages -//|[[postfix]]https://mailu.io/[Postfix]|?|?|Поштовий SMAP-агент + |[[postfix]]https://mailu.io/[Postfix]|?|?|Mail SMAP agent -//|[[dovecot]]https://mailu.io/[Dovecot]|?|?|Високопродуктивний IMAP / POP3 поштовий сервер + |[[dovecot]]https://mailu.io/[Dovecot]|?|?|High-performance IMAP / POP3 mail server -//|[[roundcube]]https://mailu.io/[Roundcube]|?|?|Поштовий IMAP-клієнт з веб-інтерфейсом + |[[roundcube]]https://mailu.io/[Roundcube]|?|?|Web-based IMAP client -//|[[clamav]]https://mailu.io/[ClamAV]|?|?|Пакет проти-вірусного ПЗ для виявлення троянів, вірусів, шкідливих програм та інших зловмисних загроз + |[[clamav]]https://mailu.io/[ClamAV]|?|?|Antivirus software package for detecting trojans, viruses, malware, and other malicious threats -//|[[rspamd]]https://mailu.io/[Rspamd]|?|?|ПЗ для виявлення та фільтрації поштового спаму + |[[rspamd]]https://mailu.io/[Rspamd]|?|?|Software for detecting and filtering email spam |=== @@ -463,26 +425,24 @@ include::ROOT:partial$admonitions/ua-specific.adoc[] === Technologies |=== -//|Технологія|Версія|Ліцензія|Опис + |Technology|Version|License|Description -//|[[wiremock]]https://wiremock.org/[Wiremock]|2.27.2|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Інструмент для задання тестовоє поведінки RestAPI сервісів |[[wiremock]]https://wiremock.org/[Wiremock]|2.27.2|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Tool for defining test behavior of RestAPI services -//|[[cucumber]]https://cucumber.io/[Cucumber]|7.3.0|https://opensource.org/licenses/MIT[MIT]|Інструмент для побудови Behavior-Driven Development (BDD) тестів + |[[cucumber]]https://cucumber.io/[Cucumber]|7.3.0|https://opensource.org/licenses/MIT[MIT]|Tool for building Behavior-Driven Development (BDD) tests -//|[[selenium]]https://www.selenium.dev/[Selenium]|4.4.0|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Інструмент для побудови UI WebBrowser UI тестів з використанням вебдрайверів + |[[selenium]]https://www.selenium.dev/[Selenium]|4.4.0|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Tool for building UI WebBrowser UI tests using web drivers |=== === Libraries |=== -//|Бібліотека|Версія|Ліцензія|Опис + |Library|Version|License|Description -//|[[junit]]https://junit.org/junit5/[JUnit]|5.6.2,5.8.2|https://www.eclipse.org/legal/epl-2.0/[Eclipse Public License v2.0]|Java бібліотека для написання Unit тестів |[[junit]]https://junit.org/junit5/[JUnit]|5.6.2,5.8.2|https://www.eclipse.org/legal/epl-2.0/[Eclipse Public License v2.0]|Java library for writing Unit tests -//|[[rest-assured]]https://rest-assured.io/[Rest-assured]|5.1.1|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Бібліотека для завдання валідації відповідей від Rest API сервісів використовуючи специфічну мову DSL + |[[rest-assured]]https://rest-assured.io/[Rest-assured]|5.1.1|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Library for specifying validation of responses from Rest API services using a specific DSL language |=== @@ -491,42 +451,39 @@ include::ROOT:partial$admonitions/ua-specific.adoc[] === Technologies |=== -//|Технологія|Версія|Ліцензія|Опис + |Technology|Version|License|Description -//|[[kiali]]https://kiali.io/[Kiali]|1.35.0|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]| UI застосунок для Istio Service Mesh -|[[kiali]]https://kiali.io/[Kiali]|1.35.0|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]| UI application for Istio Service Mesh -//|[[jaeger]]https://www.jaegertracing.io/[Jaeger]|1.24.0|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]| Система для забезпечення розподіленого трейсингу сервісів платформи -|[[jaeger]]https://www.jaegertracing.io/[Jaeger]|1.24.0|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]| System for providing distributed tracing of platform services -//|[[grafana]]https://grafana.com/[Grafana]|7.4.5|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Перегляд та аналіз метрик системи, налаштування нотифакацій по метрикам +|[[kiali]]https://kiali.io/[Kiali]|1.67.0|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]| UI application for Istio Service Mesh + +|[[jaeger]]https://www.jaegertracing.io/[Jaeger]|1.39.0|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]| System for providing distributed tracing of platform services + |[[grafana]]https://grafana.com/[Grafana]|7.4.5|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Viewing and analyzing system metrics, configuring notifications based on metrics -//|[[prometheus]]https://prometheus.io/[Prometheus]|2.24.0|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Timeseries база данних для збереження метрик платформи та query engine по цим даним + |[[prometheus]]https://prometheus.io/[Prometheus]|2.24.0|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Timeseries database for storing platform metrics and query engine for this data |=== === Extensions |=== -//|Розширення|Версія|Ліцензія|Опис + |Extension|Version|License|Description -//|[[thanosquerier]]https://github.com/thanos-io/thanos[Thanos querier]||https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Надбудова над Prometheus, що забезпечує необмежений розмір сховища для метрик та high-availability для декількох Prometheus instances |[[thanosquerier]]https://github.com/thanos-io/thanos[Thanos querier]||https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|An extension over Prometheus, providing unlimited storage for metrics and high-availability for multiple Prometheus instances |=== === Operators |=== -//|Оператор|Версія|Ліцензія|Опис + |Oparator|Version|License|Description -//|[[cluster-monitoring-operator]]https://www.okd.io/[Cluster Monitoring Operator]|4.11.0|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Оператор для налаштування підсистеми моніторингу OKD |[[cluster-monitoring-operator]]https://www.okd.io/[Cluster Monitoring Operator]|4.11.0|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Operator for configuring the monitoring subsystem of OKD -//|[[jaeger-operator]]https://github.com/jaegertracing/jaeger-operator[Jaeger Operator]|1.24.0|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Оператор для налаштування Jaeger + |[[jaeger-operator]]https://github.com/jaegertracing/jaeger-operator[Jaeger Operator]|1.24.0|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Operator for configuring Jaeger -//|[[kiali-operator]]https://github.com/kiali/kiali-operator[Kiali Operator]|1.25.0|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Оператор для налаштування Kiali + |[[kiali-operator]]https://github.com/kiali/kiali-operator[Kiali Operator]|1.25.0|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Operator for configuring Kiali -//|[[prometheus-operator]]https://github.com/prometheus-operator/prometheus-operator[Prometheus Operator]|4.11.0|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Оператор для налаштування Prometheus + |[[prometheus-operator]]https://github.com/prometheus-operator/prometheus-operator[Prometheus Operator]|4.11.0|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Operator for configuring Prometheus |=== @@ -535,24 +492,22 @@ include::ROOT:partial$admonitions/ua-specific.adoc[] === Technologies |=== -//|Технологія|Версія|Ліцензія|Опис + |Technology|Version|License|Description -//|[[elasticsearch]]https://www.elastic.co/[Elasticsearch]|7.16.2|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Пошуковий сервер що надає розподіленийбповнотекстовий пошуковий рушій з HTTP веб-інтерфейсом і підтримкою безсхемних JSON документів. Виступає в ролі сховища та пошукового сервісу для логів |[[elasticsearch]]https://www.elastic.co/[Elasticsearch]|7.16.2|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Search server that provides a distributed full-text search engine with an HTTP web interface and support for schema-less JSON documents. Acts as a repository and search service for logs -//|[[kibana]]https://www.elastic.co/kibana/[Kibana]|4.11|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Система для візуалізації даних з Elasticsearch + |[[kibana]]https://www.elastic.co/kibana/[Kibana]|4.11|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|System for data visualization from Elasticsearch -//|[[fluentd]]https://www.fluentd.org/[Fluentd]||https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Платформа для збереження даних логування. Відповідає за збір та зберігання логів в Elasticsearch + |[[fluentd]]https://www.fluentd.org/[Fluentd]||https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Platform for storing log data. Responsible for log collection and storage in Elasticsearch |=== === Operators |=== -//|Оператор|Версія|Ліцензія|Опис + |Operator|Version|License|Description -//|[[cluster-logging-operator]]https://www.okd.io/[Cluster Logging Operator]|5.5.4|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Оператор для налаштування підсистеми журналювання OKD |[[cluster-logging-operator]]https://www.okd.io/[Cluster Logging Operator]|5.5.4|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Operator for configuring the logging subsystem of OKD |=== @@ -562,14 +517,13 @@ include::ROOT:partial$admonitions/ua-specific.adoc[] === Technologies |=== -//|Технологія|Версія|Ліцензія|Опис + |Technology|Version|License|Description -//|[[minio]]https://min.io/[Minio]|RELEASE.2021-04-06T23-11-00Z|https://www.gnu.org/licenses/agpl-3.0.html[GNU AGPL v3]|S3 сумісний сервіс збереження об'єктів |[[minio]]https://min.io/[Minio]|RELEASE.2021-04-06T23-11-00Z|https://www.gnu.org/licenses/agpl-3.0.html[GNU AGPL v3]|S3 compatible object storage service -//|[[velero]]https://velero.io/[Velero]|2.14.7|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Надає інструменти для резервного копіювання та відновлення ресурсів кластера Kubernetes та постійних томів сховища + |[[velero]]https://velero.io/[Velero]|2.14.7|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Provides tools for backup and restore of Kubernetes cluster resources and persistent volumes of storage -//|[[pgbackrest]]https://pgbackrest.org/[pgBackRest]|2.38|https://opensource.org/licenses/MIT[MIT]|Рішення для забезпечення backup/restore баз даних PostgreSQL + |[[pgbackrest]]https://pgbackrest.org/[pgBackRest]|2.38|https://opensource.org/licenses/MIT[MIT]|Solution for providing backup/restore of PostgreSQL databases |=== @@ -578,9 +532,8 @@ include::ROOT:partial$admonitions/ua-specific.adoc[] === Technologies |=== -//|Технологія|Версія|Ліцензія|Опис + |Technology|Version|License|Description -//|[[antora]]https://antora.org/[Antora]|3.1.1|https://www.mozilla.org/en-US/MPL/2.0/[Mozilla Public License Version 2.0]|Генератор документації з asciidoc в html5 використовуючи Asciidoctor |[[antora]]https://antora.org/[Antora]|3.1.1|https://www.mozilla.org/en-US/MPL/2.0/[Mozilla Public License Version 2.0]|Documentation generator from asciidoc to html5 using Asciidoctor |=== diff --git a/docs/en/modules/arch/pages/architecture/platform/administrative/config-management/overview.adoc b/docs/en/modules/arch/pages/architecture/platform/administrative/config-management/overview.adoc index 92f0403cf4..f36c132867 100644 --- a/docs/en/modules/arch/pages/architecture/platform/administrative/config-management/overview.adoc +++ b/docs/en/modules/arch/pages/architecture/platform/administrative/config-management/overview.adoc @@ -28,14 +28,7 @@ The subsystem uses GitOps practices, storing the Platform and registry states in .Diagram of subsystem components and their interactions //.Діаграма компонентів підсистеми та їх взаємодії -image::architecture/platform/administrative/config-management/config-mgmt.svg[] - -== Registry configuration structure -//== Структура конфігурації реєстру - -.Registry configuration components -//.Складові конфігурації реєстрів -image::architecture/platform/administrative/config-management/registry-configuration-structure.svg[] +image::architecture/platform/administrative/config-management/config-mgmt.drawio.svg[] [#subsystem-components] == Subsystem components diff --git a/docs/en/modules/arch/pages/architecture/platform/administrative/config-management/registry-platform-keys.adoc b/docs/en/modules/arch/pages/architecture/platform/administrative/config-management/registry-platform-keys.adoc index 5a3a02427b..5fb1645ade 100644 --- a/docs/en/modules/arch/pages/architecture/platform/administrative/config-management/registry-platform-keys.adoc +++ b/docs/en/modules/arch/pages/architecture/platform/administrative/config-management/registry-platform-keys.adoc @@ -4,63 +4,58 @@ include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] This document contains information regarding general provisions and technical design related to updating the platform and registry keys and the configuration of the digital signature service. -//Даний документ містить інформацію про загальні положення та технічний дизайн оновлення платформних та реєстрових ключів та конфігурації сервісу цифрового підпису == General provisions * The administrator can edit the registry or platform keys of the digital signature using the Administrative platform management interface. -//* Адміністратор за допомогою Адміністративного інтерфейсу управління платформою може редагувати реєстрові або платформні ключі цифрового підпису. + * The platform management web interface saves the changes made by the administrator to the HashiCorp Vault service of the secret management and encryption subsystem, or to the Gerrit service of the Platform and registries deployment and configuration subsystem. -//* Веб-інтерфейс управління платформою зберігає внесені адміністратором зміни в сервіс HashiCorp Vault підсистеми управління секретами та шифруванням або в сервіс Gerrit підсистеми розгортання та налаштування Платформи та реєстрів. + * The platform management web interface shows the path to values and files in corresponding values.yaml. -//* Веб-інтерфейс управління платформою відображає шлях до значень та файлів у відповідних values.yaml. + * Pipeline fetches required data from HashiCorp Vault or Gerrit and generates required secrets in OpenShift. -//* Пайплайн забирає необхідні дані з HashiCorp Vault або Gerrit та створює необхідні секрети в OpenShift. == High-level technical design The following diagram shows the platform components engaged in the implementation of the requirements of the platform components and interaction between them. -//На даній діаграмі зображені залучені для реалізації вимог компоненти платформи та взаємодія між ними. image::architecture/platform/administrative/config-management/keys-update-subsystem.svg[registry-platform-keys] image::architecture/platform/administrative/config-management/keys-update-config.svg[registry-platform-keys] The table below shows the engaged components or those to be changed/created under implementation of the functional requirements in accordance with the technical design of the solution. -//В таблиці нижче зазначені компоненти які залучені або потребують змін/створення в рамках реалізації функціональних вимог згідно технічного дизайну рішення. -Table 1 -//Таблиця 1 + +.Components and functions |=== |Component|Official name|Function -//|Компонент|Службова назва|Призначення + |Platform administration interface -//|Інтерфейс адміністрування платформи + |control-plane-console |Setting available communication channels for the target registry environment -//|Внесення налаштувань доступних каналів зв’язку для цільового оточення реєстру + |Saving platform configuration and registries -//|Збереження конфігурації платформи та реєстрів + |control-plane-gerrit |The platform component for storing registry and platform configurations -//|Платформний компонент для зберігання конфігурацій реєстру та платформи. + |Platform and registries deployment -//|Розгортання платформи та реєстрів + |edp-library-stages-fork |Platform and registries deployment pipeline -//|Пайплайн для розгортання платформи та реєстрів + |Platform and registries deployment -//|Розгортання платформи та реєстрів + |edp-library-pipelines-fork |Stages for platform and registries deployment -//|Стейджи для розгортання платформи та реєстрів + |=== -Content of values.yaml when using a file key: -//Зміст values.yaml у випадку файлового ключа: +.Content of values.yaml when using a file key ---- digital-signature: data: @@ -77,8 +72,8 @@ digital-signature: sign.key.hardware.password: "" sign.key.hardware.type: "" ---- -Content of values.yaml when using a hardware key: -//Зміст values.yaml у випадку апаратного ключа: + +.Content of values.yaml when using a hardware key ---- digital-signature: data: @@ -97,10 +92,9 @@ digital-signature: ---- NOTE: The name of the secret in the vault must concatenate with the current date of secrets updating in the short ISO8601 format (without colons and dashes) and get updated in values.yaml of the registry and the platform. -//NOTE: Імʼя секрету в vault повинно конкатенуватись з поточною датою оновлення секретів в формати short ISO8601 (без двокрапок та тире) і оновлюватись в values.yaml реєстру та платформи + The path in the Gerrit repositories: -//Шлях в Gerrit репозиторіях: * cluster-mgmt.git: config/dso/ * registry-template.git: config/dso/ \ No newline at end of file diff --git a/docs/en/modules/arch/pages/architecture/platform/administrative/config-management/secure-endpoints/secure-endpoints-tech-design.adoc b/docs/en/modules/arch/pages/architecture/platform/administrative/config-management/secure-endpoints/secure-endpoints-tech-design.adoc index af4d765089..a87a0f4962 100644 --- a/docs/en/modules/arch/pages/architecture/platform/administrative/config-management/secure-endpoints/secure-endpoints-tech-design.adoc +++ b/docs/en/modules/arch/pages/architecture/platform/administrative/config-management/secure-endpoints/secure-endpoints-tech-design.adoc @@ -1,13 +1,9 @@ == Solution design -//🌐 This document is available in both English and Ukrainian. Use the language toggle in the top right corner to switch between versions. - -//На даній діаграмі зображені залучені для реалізації вимог компоненти платформи та взаємодія між ними. -The following diagram displays the Platform components involved in requirements realization, and interaction between them. +The following diagram displays the Platform components involved in requirement implementation and interaction between them. image::architecture/platform/administrative/config-management/secure-endpoints/design.png[secure-endpoints,float="center",align="center"] -//На діаграмі зображені основні потоки трафіку до основних операційних зон (кожна зона має свій список дозволених CIDR): -The diagram shows the main traffic flows to the main operational zones (each zone has its onw list of allowed CIDR): +The diagram shows the main traffic flows to the main operational zones (each zone has its list of allowed CIDRs): image::architecture/platform/administrative/config-management/secure-endpoints/operational-zones.png[operational-zones,float="center",align="center"] \ No newline at end of file diff --git a/docs/en/modules/arch/pages/architecture/platform/administrative/control-plane/configuration-structure/common/description.adoc b/docs/en/modules/arch/pages/architecture/platform/administrative/control-plane/configuration-structure/common/description.adoc index 5e453d4ee4..0345342c18 100644 --- a/docs/en/modules/arch/pages/architecture/platform/administrative/control-plane/configuration-structure/common/description.adoc +++ b/docs/en/modules/arch/pages/architecture/platform/administrative/control-plane/configuration-structure/common/description.adoc @@ -1,8 +1,5 @@ -//== Загальний опис == Overview -//В Платформі реєстрів параметри конфігурації зберігаються в сервісі інспекції та зберігання змін конфігурації (Gerrit) реалізуючи таким чином `GitOps` підхід до зберігання та застосування конфігурації. The Platform for state registries stores its settings in the configuration changes review and storage service (Gerrit) according to the `GitOps` approach. -//TIP: GitOps — це підхід до оркестрації інфраструктури Платформи та розгортання реєстрів заснований на використанні Git-репозиторію як єдиного джерела для конфігураційних файлів підсистем. GitOps забезпечує автоматизоване розгортання, спрощений контроль версій, легке скасування змін та підвищену видимість змін системи через організацію процесу роботи на базі Git та декларативного опису бажаного стану Платформи та реєстру. TIP: The GitOps approach relies on the Git repository as the sole source of the subsystem configuration files when orchestrating the Platform infrastructure and deploying registries. GitOps provides automated deployment, streamlined version control, effortless change reversals, and enhanced visibility of system changes through Git-based workflows and declarative descriptions of the desired state of the Platform and registry. \ No newline at end of file diff --git a/docs/en/modules/arch/pages/architecture/platform/administrative/control-plane/configuration-structure/platform-configuration-structure.adoc b/docs/en/modules/arch/pages/architecture/platform/administrative/control-plane/configuration-structure/platform-configuration-structure.adoc index 4a227d1a5c..8afc704eb4 100644 --- a/docs/en/modules/arch/pages/architecture/platform/administrative/control-plane/configuration-structure/platform-configuration-structure.adoc +++ b/docs/en/modules/arch/pages/architecture/platform/administrative/control-plane/configuration-structure/platform-configuration-structure.adoc @@ -6,23 +6,10 @@ include::platform:ROOT:partial$admonitions/language-en.adoc[] include::common/description.adoc[] [caption=] -//.Налаштування Платформи .Platform configuration |=== -//|Рівень налаштувань|Репозиторій|Шлях|Призначення |Configuration level |Repository |Path |Description -//.3+|_Платформа_ -//.3+|`cluster-mgmt` -//|`<>` -//|Загальні налаштування Платформи. Налаштовується адміністратором через адмін-консоль. - -//|`<>` -//|Містить шаблони та значення за замовчуванням для системних параметрів. У більшості випадків не потребує коригувань. - -//|`<>` -//|Файл містить інформацію про версії Вебінтерфейсу управління Платформою та реєстрами - .3+|_Platform_ .3+|`cluster-mgmt` |`<>` @@ -36,146 +23,119 @@ include::common/description.adoc[] |=== -//TIP: Детальніше про процеси розгортання конфігурації див. xref:architecture/platform/administrative/config-management/overview.adoc[] та xref:architecture/platform/administrative/control-plane/overview.adoc[] TIP: For details on configuration deployment processes, see xref:architecture/platform/administrative/config-management/overview.adoc[] and xref:architecture/platform/administrative/control-plane/overview.adoc[]. -//== Специфікація користувацької yaml конфігурації Платформи (values.yaml) == Platform custom yaml configuration specification (values.yaml) [[yaml]] -//У цьому розділі наведено список загальних параметрів налаштувань Платформи, що налаштовуються адміністраторами через адмін-консоль або через коміт в репозиторій. This section provides a list of general Platform settings that administrators configure via the admin console or a commit to the repository. -//=== Загальні параметри Платформи === General Platform settings -//Наступна таблиця містить рутові параметри Платформи. The following table provides the Platform's root parameters. -//TIP: Для зручної навігації по ієрархії специфікації обʼєктів, в таблицях присутні посилання на відповідні дочерні таблиці. TIP: Use links to the corresponding child tables for convenient navigation through the object specification hierarchy. [[root]] [cols="20%,15%,7%,7%,60%",options="header",caption=] -//.Загальні параметри Платформи .General Platform settings |=== -//|Назва|Тип|Значення за замовчуванням|Обовʼязкове|Призначення |Name |Type |Default value |Required |Description |`<>` |object |❌ |✅ -//|Глобальні налаштування Платформи |Global Platform settings. |`cdPipelineName` |string |platform |✅ -//|Назва Платформного CD пайплайну. Є сутністю xref:arch:architecture/platform-technologies.adoc#edp-codebase-operator[EDP] і частиною обслуговуючого пайплайну процесів розгортання Платформи. |The name of the Platform CD pipeline. This is an xref:arch:architecture/platform-technologies.adoc#edp-codebase-operator[EDP] entity and part of the servicing pipeline of the Platform deployment processes. |`cdPipelineStageName` |string |main |✅ -//|Назва етапу Платформного CD пайплайну. Є сутністю xref:arch:architecture/platform-technologies.adoc#edp-codebase-operator[EDP] і частиною обслуговуючого пайплайну процесів розгортання Платформи. |The name of the Platform CD pipeline stage. This is an xref:arch:architecture/platform-technologies.adoc#edp-codebase-operator[EDP] entity and part of the servicing pipeline of the Platform deployment processes. |`source_catalog_version` |string |4.6 |✅ -//|❌ Застарілий параметр. Буде видалений в наступних версіях Платформи. |❌ A deprecated parameter. Will be discontinued in the future Platform versions. |`<>` |[]object |❌ |✅ -//|Вказання переліку користувачів Платформи, що мають роль адміністратора Платформи (`cp-cluster-mgmt-admin`). |The list of users with the Platform administrator role (`cp-cluster-mgmt-admin`). |`<>` |object |❌ |❌ -//|Загальні налаштування компонента Keycloak. |General Keycloak component settings. |`<>` |object |❌ |✅ -//|Налаштування _сервісу цифрового підпису Платформи_ Підсистеми управління користувачами та ролями. |The Users and roles management subsystem's _Digital signature service_ settings. |`<>` |object |❌ |❌ -//|Налаштування сервісу резервного копіювання Платформи Velero. |Velero Platform backup service settings. |=== -//=== Глобальні параметри налаштувань Платформи === Global Platform settings -//`global` мість глобальні параметри Платформи, що не були класифіковані в окремі розділи. The `global` group contains the Platform's global parameters that are not classified into separate groups. [[global]] [cols="20%,10%,5%,5%,60%",options="header",caption=] -//.global | <> .global | <> |=== -//|Назва|Тип|Значення за замовчуванням|Обовʼязкове|Призначення |Name |Type |Default value |Required |Description |`deploymentMode` |string |development |✅ -//|Налаштування режиму розгортання Платформи. Визначає наявніть або відсутність `external-integration-mocks`. |The Platform deployment mode. Determines whether `external-integration-mocks` are present or not. |`<>` |object |❌ |✅ -//|Налаштування доступів до Платформних сервісів. |Platform services access parameters. |=== -//=== Параметри налаштувань доступів до Платформних сервісів === Platform service access parameters -//`whiteListIP` містить параметри конфігурації доступу до роутів адміністративних сервісів. The `whiteListIP` group contains access parameters for the administrative service routes. [[whitelistip]] [cols="20%,10%,5%,5%,60%",options="header",caption=] .global.whiteListIP | <> |=== -//|Назва|Тип|Значення за замовчуванням|Обовʼязкове|Призначення |Name |Type |Default value |Required |Description |`adminRoutes` |string |0.0.0.0/0 |✅ -//|Налаштування доступу до роутів адміністративних сервісів Платформи. |The Platform's administrative service route access parameters. |=== [source,yaml] -//.Приклад специфікації global. .global specification example ---- deploymentMode: production @@ -183,65 +143,55 @@ whiteListIP: adminRoutes: 0.0.0.0/0 ---- -//=== Параметри налаштувань адміністраторів Платформи === Platform administrators configuration parameters -//`administrators` містить перелік адміністраторів Платформи. The `administrators` group contains a list of Platform administrators. [[administrators]] [cols="20%,10%,5%,5%,60%",options="header",caption=] .administrators | <> |=== -//|Назва|Тип|Значення за замовчуванням|Обовʼязкове|Призначення |Name |Type |Default value |Required |Description |`email` |string |❌ |✅ -//|Адреса електронної пошти, що ідентифікує користувача. |The email address that identifies the user. |`firstName` |string |❌ |✅ -//|Імʼя користувача. |User's first name. |`lastName` |string |❌ |✅ -//|Прізвище користувача. |User's last name. |`passwordVaultSecret` |string |❌ |✅ -//|Шлях до тимчасового пароля в _Сервісі управління секретами та шифруванням_ Hashicorp Vault. |The path to the temporary password in the Hashicorp Vault _Secrets and encryption management service_. |`passwordVaultSecretKey` |string |❌ |✅ -//|Ключ для пошуку тимчасового пароля в _Сервісі управління секретами та шифруванням_ Hashicorp Vault. |The key to finding the temporary password in the Hashicorp Vault _Secrets and encryption management service_. |`username` |string |❌ |✅ -//|Імʼя акаунту користувача. Дорівнює полю `email`. |User account name. Equals the `email` field. |=== [source,yaml] -//.Приклад специфікації налаштування адміністраторів .Administrators configuration example ---- administrators: @@ -253,56 +203,47 @@ administrators: username: user@company.com ---- -//=== Параметри налаштувань сервісу управління користувачами та ролями === User and role management service configuration parameters -//`customHosts` містить перелік альтернативних DNS-імен для Keycloak. The `customHosts` group contains a list of alternative DNS names for Keycloak. [[keycloak]] [cols="20%,15%,7%,7%,60%",options="header",caption=] .keycloak | <> |=== -//|Назва|Тип|Значення за замовчуванням|Обовʼязкове|Призначення |Name |Type |Default value |Required |Description |`<>` |[]object |❌ |❌ -//|Перелік альтернативних DNS-імен для Keycloak. |A list of alternative DNS names for Keycloak. |=== -//`customHosts` містить перелік альтернативних DNS-імен для Keycloak та шлях до їх сертифікату. The `customHosts` group contains a list of alternative DNS names for Keycloak and paths to their certificates. [[customHosts]] [cols="20%,10%,5%,5%,60%",options="header",caption=] .keycloak.customHosts | <> |=== -//|Назва|Тип|Значення за замовчуванням|Обовʼязкове|Призначення |Name |Type |Default value |Required |Description |`certificatePath` |string |❌ |✅ -//|Шлях до TLS/SSL сертифікату в _Сервісі управління секретами та шифруванням_ Hashicorp Vault. |The path to the TLS/SSL certificate in the Hashicorp Vault _Secrets and encryption management service_. |`host` |string |❌ |✅ -//|Назва альтернативного DNS-імені. |The hostname of the alternative DNS name. |=== [source,yaml] -//.Приклад специфікації налаштувань сервісу управління користувачами та ролями .Secrets and encryption management service configuration example ---- keycloak: @@ -311,31 +252,26 @@ keycloak: host: example-keycloak.openshift.company.com ---- -//=== Параметри налаштувань сервісу цифрового підпису Платформи === Digital signature service configuration parameters -//`digitalSignature` містить перелік налаштувань сервісу цифрового підпису Платформи The `digitalSignature` group contains the Platform's _Digital signature service_ settings. [[digital-signature]] [cols="20%,10%,5%,5%,60%",options="header",caption=] .digitalSignature | <> |=== -//|Назва|Тип|Значення за замовчуванням|Обовʼязкове|Призначення |Name |Type |Default value |Required |Description |`<>` |object |❌ |✅ -//|Налаштування ключів сервісу цифрового підпису Платформи. |The Platform's _Digital signature service_ key settings. |`<>` |object |❌ |✅ -//|Налаштування оточення сервісу цифрового підпису Платформи. |The Platform's _Digital signature service_ environment settings. |=== @@ -344,28 +280,24 @@ The `digitalSignature` group contains the Platform's _Digital signature service_ [cols="20%,10%,5%,5%,60%",options="header",caption=] .digitalSignature.data | <> |=== -//|Назва|Тип|Значення за замовчуванням|Обовʼязкове|Призначення |Name |Type |Default value |Required |Description |`Key-6-dat` |string |❌ |✅ -//|Шлях до приватного файлового ключа організації в _Сервісі управління секретами та шифруванням_ Hashicorp Vault. |The path to the organization's private file key in the Hashicorp Vault _Secrets and encryption management service_. |`allowed-keys-yml` |string |❌ |✅ -//|Шлях до файлу з переліком атрибутів дозволених (або раніше виданих) ключів в _Сервісі управління секретами та шифруванням_ Hashicorp Vault. |The path to the file listing the attributes of authorized or previously issued keys in the Hashicorp Vault _Secrets and encryption management service_. |`osplm.ini` |string |❌ |✅ -//|Шлях до конфігураційного файлу програмно-апаратного криптомодуля "Гряда" в _Сервісі управління секретами та шифруванням_ Hashicorp Vault. Використовується тільки з апаратним типом ключа. |The path to the configuration file of the hardware and software cryptomodule in the Hashicorp Vault _Secrets and encryption management service_. Only used with the hardware key type. |=== @@ -374,55 +306,47 @@ The `digitalSignature` group contains the Platform's _Digital signature service_ [cols="20%,10%,5%,5%,60%",options="header",caption=] .digitalSignature.env | <> |=== -//|Назва|Тип|Значення за замовчуванням|Обовʼязкове|Призначення |Name |Type |Default value |Required |Description |`sign.key.device-type` |string |❌ |✅ -//|Визначає тип ключа що використовується Платформою. Допустимі значення `file` або `hardware`. |The type of the key used by the Platform. Possible values are `file` or `hardware`. |`sign.key.file.issuer` |string |❌ |✅ -//|Шлях до інформації про емітента приватного ключа організації. в _Сервісі управління секретами та шифруванням_ Hashicorp Vault. |The path to information about the issuer of the organization's private key in the Hashicorp Vault _Secrets and encryption management service_. |`sign.key.file.password` |string |❌ |✅ -//|Шлях до пароля приватного ключа організації. в _Сервісі управління секретами та шифруванням_ Hashicorp Vault. |The path to the organization's private key password in the Hashicorp Vault _Secrets and encryption management service_. |`sign.key.hardware.device` |string |❌ |✅ -//|Шлях до інформації про серійний номер, хост та порт апаратного екземпляра Гряди в _Сервісі управління секретами та шифруванням_ Hashicorp Vault. Використовується тільки з апаратним типом ключа. |The path to information about the serial number, host, and port of the hardware cryptomodule device in the Hashicorp Vault _Secrets and encryption management service_. Only used with the hardware key type. |`sign.key.hardware.password` |string |❌ |✅ -//|Шлях до пароля апаратного екземпляра Гряди в _Сервісі управління секретами та шифруванням_ Hashicorp Vault. Використовується тільки з апаратним типом ключа. |The path to the hardware cryptomodule device password in the Hashicorp Vault _Secrets and encryption management service_. Only used with the hardware key type. |`sign.key.hardware.type` |string |❌ |✅ -//|Шлях до типу апаратного екземпляра Гряди в _Сервісі управління секретами та шифруванням_ Hashicorp Vault. Використовується тільки з апаратним типом ключа. -|The path to the hardware cryptomodule device type in the Hashicorp Vault _Secrets and encryption management service_. Only used with the hardware key type. +|The path to the hardware crypto-module device type in the Hashicorp Vault _Secrets and encryption management service_. Only used with the hardware key type. |=== [source,yaml] -//.Приклад специфікації налаштування сервісу цифрового підпису Платформи .Platform's Digital signature service configuration example ---- digital-signature: @@ -439,24 +363,20 @@ digital-signature: sign.key.hardware.type: "" ---- -//=== Параметри налаштувань сервісу резервного копіювання та відновлення === Backup and restore service configuration parameters -//`velero` містить налаштування сервісу резервного копіювання та відновлення. The `velero` group contains the _Backup and restore service_ settings. [[backup]] [cols="20%,10%,5%,5%,60%",options="header",caption=] .velero | <> |=== -//|Назва|Тип|Значення за замовчуванням|Обовʼязкове|Призначення |Name |Type |Default value |Required |Description |`<>` |object |❌ |❌ -//|Налаштування резервного копіювання Платформних компонентів. |The backup configuration of the Platform components. |=== @@ -465,35 +385,30 @@ The `velero` group contains the _Backup and restore service_ settings. [cols="20%,10%,5%,5%,60%",options="header",caption=] .velero.backup | <> |=== -//|Назва|Тип|Значення за замовчуванням|Обовʼязкове|Призначення |Name |Type |Default value |Required |Description |`<>` |object |❌ |❌ -//|Налаштування резервного копіювання компонентів підсистеми управління Платформою та Реєстрами. |The backup configuration of the _Platform and registries management subsystem's_ components. |`<>` |object |❌ |❌ -//|Налаштування резервного копіювання сховища артефактів Платформи підсистеми розгортання змін налаштувань Платформи та реєстрів. |The backup configuration of the Platform artifacts repository in the _Platform and registries deployment and configuration subsystem_. |`<>` |object |❌ |❌ -//|Налаштування резервного копіювання компонентів підсистеми моніторингу та сповіщень Платформи. |The backup configuration of the _Event monitoring and notification subsystem's_ components. |`<>` |object |❌ |❌ -//|Налаштування резервного копіювання компонентів підсистеми управління користувачами та ролями Платформи. |The backup configuration of the _Users and roles management subsystem's_ components. |=== @@ -502,27 +417,23 @@ The `velero` group contains the _Backup and restore service_ settings. [cols="20%,10%,5%,5%,60%",options="header",caption=] .velero.backup. | <> |=== -//|Назва|Тип|Значення за замовчуванням|Обовʼязкове|Призначення |Name |Type |Default value |Required |Description |`expires_in_days` |string |❌ |❌ -//|Визначає кількість днів для зберігання резервної копії Платформного сервісу. |The number of days to store the backup copy of the Platform service. |`schedule` |string |❌ |❌ -//|Розклад резервного копіювання. Задається в UNIX cron форматі. |The backup schedule definition in the UNIX cron format. |=== [source,yaml] -//.Приклад специфікації налаштувань сервісу резервного копіювання Платформи Velero. .Velero Platform backup service configuration example ---- velero: @@ -541,103 +452,85 @@ velero: schedule: 30 9 * * * ---- -//== Специфікація технічної yaml конфігурації Платформи (values.gotmpl) == Platform technical yaml configuration specification (values.gotmpl) [[gotmpl]] -//У цьому розділі наведено список технічних параметрів Платформи. Їх значення встановлюються з використанням шаблонів для параметризації, що може мати вигляд `{{ env "" }}` — для визначення значення зі змінних оточення або виду `{{ $cluster_version := exec ... }}` — для виконання команди під час запуску пайплайну. This section lists the technical parameters of the Platform. Their values are set using parameterization templates, which can take one of the following forms: * `{{ env "" }}` to get values from environment variables. * `{{ $cluster_version := exec ... }}` to execute a command during pipeline execution. -//IMPORTANT: Власноруч вносити зміни в цей файл не рекомендується. IMPORTANT: We do not recommend making changes to this file manually. [[parent-tech-params]] [cols="20%,10%,10%,60%",options="header",caption=] -//.Технічні параметри Платформи .Platform technical parameters |=== -//|Назва|Тип|Обовʼязкове|Призначення |Name |Type |Required |Description |`<>` |object |✅ -//|Глобальні налаштування Платформи |Global Platform settings. |`<>` |object |✅ -//|Містить налаштування центрального сервісу управління секретами Платформи |Contains settings for the Platform's central _Secrets management service_. |`namespace` |string |✅ -//|Визначає зі специфікації `codebase` назву OKD namespace для розгортання компонентів підсистем та налаштувань в залежності від приналежності до Платформи або реєстру. |Defines the name of the OKD namespace for deploying subsystem components and configurations from the `codebase` specification based on whether they belong to the Platform or registry. |`baseDomain` |string |✅ -//|Отримує та встановлює базовий домен кластера OKD. Усі керовані записи DNS в кластері будуть піддоменами цього базового домену. Після розгортання кластера OKD, це значення не можна змінювати. Наприклад, `openshift.example.com`. |Receives and sets the base domain of the OKD cluster -- for example, `openshift.example.com`. All managed DNS records in the cluster become subdomains of the base domain. After the OKD cluster is deployed, this value cannot be changed. |`dnsWildcard` |string |✅ -//|Піддомен базового домена кластера OKD для маршрутизації трафіку до застосунків Платформи та реєстрів. Наприклад, `apps.openshift.example.com` |A subdomain of the base domain of the OKD cluster for routing traffic to Platform and registry applications -- for example, `apps.openshift.example.com`. |`cdPipelineName` |string |✅ -//|Назва Платформного CD пайплайну. Є сутністю xref:arch:architecture/platform-technologies.adoc#edp-codebase-operator[EDP] і частиною обслуговуючого пайплайну процесів розгортання Платформи. |The name of the Platform CD pipeline. This is an xref:arch:architecture/platform-technologies.adoc#edp-codebase-operator[EDP] entity and part of the servicing pipeline of the Platform deployment processes. |`dockerRegistry` |string |✅ -//|Містить URL до `control-plane-nexus` — сховища артефактів Платформи. |The URL for the `control-plane-nexus` Platform artifacts repository. |`dockerProxyRegistry` |string |✅ -//|Містить URL до `control-plane-nexus` — сховища артефактів Платформи. |The URL for the `control-plane-nexus` Platform artifacts repository. |`edpProject` |string |✅ -//|Визначає з параметрів технічного пайплайну назву OKD namespace для розгортання компонентів підсистем та налаштувань в залежності від приналежності до Платформи або реєстру. |Defines the name of the OKD namespace for deploying subsystem components and configurations from the technical pipeline parameters based on whether they belong to the Platform or registry. |`globalNexusNamespace` |string |✅ -//|Містить назву OKD namespace — сховища артефактів Платформи. |The OKD namespace for the Platform artifacts repository. |`ACCESS_KEY_ID` |string |✅ -//|❌ Застарілий параметр. Буде видалений в наступних версіях Платформи. |❌ A deprecated parameter. Will be discontinued in the future Platform versions. |`SECRET_ACCESS_KEY` |string |✅ -//|❌ Застарілий параметр. Буде видалений в наступних версіях Платформи. |❌ A deprecated parameter. Will be discontinued in the future Platform versions. |`backupBucket` |string |✅ -//|❌ Застарілий параметр. Буде видалений в наступних версіях Платформи. |❌ A deprecated parameter. Will be discontinued in the future Platform versions. |=== @@ -646,25 +539,21 @@ IMPORTANT: We do not recommend making changes to this file manually. [cols="20%,5%,5%,60%",options="header",caption=] .global | <> |=== -//|Назва|Тип|Обовʼязкове|Призначення |Name |Type |Required |Description |`clusterVersion` |string |✅ -//|Автоматично визначає поточну версію OKD кластеру. |Automatically determines the current version of the OKD cluster. |`storageClass` |string |✅ -//|Містить назву `StorageClass` що використовується в кластері OKD за замовчуванням. |Contains the `StorageClass` name used in the OKD cluster by default. |`imageRegistry` |string |✅ -//|Містить URL до `control-plane-nexus` — сховища артефактів Платформи. |The URL for the `control-plane-nexus` Platform artifacts repository. |=== @@ -673,70 +562,58 @@ IMPORTANT: We do not recommend making changes to this file manually. [cols="20%,5%,5%,60%",options="header",caption=] .vault | <> |=== -//|Назва|Тип|Обовʼязкове|Призначення |Name |Type |Required |Description |`platformVaultToken` |string |✅ -//|Містить токен доступу до центрального сервісу управління секретами Платформи. |The access token for the Platform's central _Secrets management service_. |`openshiftApiUrl` |string |✅ -//|Містить URL до OKD API-сервера. |The OKD API server URL. |`centralVaultUrl` |string |✅ -//|Містить URL до центрального сервісу управління секретами Платформи. |The Platform's central _Secrets management service_ URL. |=== -//=== Параметри налаштувань адмін-консолі === Admin console settings -//`consoleVersions` містить параметри кореляції версії реєстру та версії адмін-консолі в релізі. The `consoleVersions` group contains the registry-version-to-admin-console-version mapping parameters for the release. [[console-versions]] [cols="20%,10%,5%,5%,60%",options="header",caption=] .consoleVersions | <> |=== -//|Назва|Тип|Значення за замовчуванням|Обовʼязкове|Призначення |Name |Type |Default value |Required |Description |`consoleVersion` |string |❌ |✅ -//|Версія адмін-консолі |The admin console version. |`stream` |string |❌ |✅ -//|Гілка розгортання консолі |The console deployment branch. |`registryVersion` |string |❌ |✅ -//|Версія реєстру |The registry version. |=== -//NOTE: `consoleVersion` — містить технічні значення що оновлюються разом із Платформою реєстрів, тому змінювати їх нема потреби. NOTE: The `consoleVersion` parameter contains technical values that are updated together with the Platform, so there is no need to change them. [source,yaml] -//.Приклад специфікації consoleVersions. .consoleVersions specification example ---- consoleVersions: diff --git a/docs/en/modules/arch/pages/architecture/platform/administrative/control-plane/configuration-structure/registry-configuration-structure.adoc b/docs/en/modules/arch/pages/architecture/platform/administrative/control-plane/configuration-structure/registry-configuration-structure.adoc index e9bfc422b6..34e7c2bdaa 100644 --- a/docs/en/modules/arch/pages/architecture/platform/administrative/control-plane/configuration-structure/registry-configuration-structure.adoc +++ b/docs/en/modules/arch/pages/architecture/platform/administrative/control-plane/configuration-structure/registry-configuration-structure.adoc @@ -7,17 +7,8 @@ include::common/description.adoc[] .Registry configuration |=== -//|Рівень налаштувань|Репозиторій|Шлях|Призначення |Configuration level |Repository |Path |Description -//.2+|_Реєстр_ -//.2+|`` -//|`<>` -//|Загальні налаштування реєстру. Налаштовується адміністратором через адмін-консоль. - -//|`<>` -//|Містить шаблони та значення за замовчуванням для системних параметрів реєстру. У більшості випадків не потребує коригувань. - .2+|_Registry_ .2+|`` |`<>` @@ -28,35 +19,26 @@ include::common/description.adoc[] |=== -//TIP: Детальніше про процеси розгортання конфігурації див. xref:architecture/platform/administrative/config-management/overview.adoc[] та xref:architecture/platform/administrative/control-plane/overview.adoc[] TIP: For details on configuration deployment processes, see xref:architecture/platform/administrative/config-management/overview.adoc[] та xref:architecture/platform/administrative/control-plane/overview.adoc[]. -//=== Структура конфігурації реєстру === Registry configuration structure -//.Складові конфігурації реєстрів .Registry configuration components image::architecture/platform/administrative/control-plane/registry-configuration-structure.drawio.svg[] -//== Специфікація yaml конфігурації реєстру (values.yaml) == Registry yaml configuration specification (values.yaml) [[registry-yaml]] -//У цьому розділі наведено список загальних параметрів налаштувань реєстру, що задаються адміністраторами через адмін-консоль або через коміт у відповідний репозиторій. This section provides a list of general registry settings that administrators configure via the admin console or a commit to the repository. -//=== Загальні параметри реєстру === General registry settings -//Наступна таблиця містить рутові параметри реєстру. The following table provides the registry's root parameters. -//TIP: Для зручної навігації по ієрархії специфікації обʼєктів, в таблицях присутні посилання на відповідні дочерні таблиці. TIP: Use links to the corresponding child tables for convenient navigation through the object specification hierarchy. [[root]] [cols="20%,15%,7%,7%,60%",options="header",caption=] -//.Загальні параметри реєстру .General registry settings |=== |Name |Type |Default value |Required |Description @@ -65,114 +47,97 @@ TIP: Use links to the corresponding child tables for convenient navigation throu |[]object |❌ |✅ -//|Вказання переліку користувачів реєстру, що мають роль адміністратора реєстру (`cp-registry-admin-`). |A list of registry users with the registry administrator role (`cp-registry-admin-`). |`<>` |object |❌ |✅ -//|Налаштування _сервісу цифрового підпису_ Підсистеми цифрових підписів реєстру. |The registry Digital signatures subsystem's _Digital signature service_ settings. |`<>` |object |❌ |✅ -//|Налаштування обмежень _сервісу цифрових документів_ на завантаження файлів цифрових документів до реєстру користувачами та бізнес-процесами. |The _Digital document service_ limitation settings for the digital document files uploaded to the registry by users and business processes. |`<>` |object |❌ |✅ -//|Налаштування реплік _сервісу цифрового підпису_ Підсистеми цифрових підписів реєстру. |The registry Digital signatures subsystem's _Digital signature service_ replica settings. |`<>` |[]object |❌ |✅ -//|Налаштування взаємодії з іншими зовнішніми системами. |Configuration of interaction with external systems. |`<>` |object |❌ |✅ -//|Глобальні налаштування реєстру |Global registry settings. |`<>` |object |❌ |✅ -//|Налаштування програмно-апаратного криптомодуля "Гряда". -|Hardware and software cryptomodule settings. +|Hardware and software crypto-module settings. |`<>` |object |❌ |✅ -//|Налаштування _сервісу управління користувачами та ролями_. |_User and role management service_ settings. |`<>` |object |❌ |✅ -//|Налаштування плагінів _зовнішнього API-шлюзу операційної зони реєстру_. |The _external API gateway of the registry operational zone_ plugin configuration. |`<>` |[]object |❌ |✅ -//|Налаштування плагінів _зовнішнього API-шлюзу операційної зони реєстру_. |The _external API gateway of the registry operational zone_ plugin configuration. |`<>` |object |❌ |✅ -//|Налаштування кабінетів користувача. |User portal settings. -//TODO: Missing anchor: redash |`<>` |object |❌ |✅ -//|Налаштування підсистеми аналітичної звітності реєстру. |_Registry analytical reporting subsystem_ settings. |`registryVaultPath` |string |registry-kv/registry/ |✅ -//|Шлях до реєстрового Vault Engine в cервісі управління секретами та шифруванням Hashicorp Vault. |The path to the registry Vault Engine in the Hashicorp Vault _Secrets and encryption management service_. |`<>` |object |❌ |✅ -//|Налаштування IIT-віджету автентифікації. |Authentication widget settings. |`<>` |object |❌ |❌ -//|Налаштування _шлюзу безпечного обміну "Трембіта"_. + |Secure exchange gateway settings. |=== -//=== Параметри налаштувань сервісу цифрових документів === Digital document service settings -//`digitalDocuments` містить налаштування сервісу цифрових документів. The `digitalDocuments` group contains the _Digital document service_ settings. [[digital-documents]] @@ -185,20 +150,17 @@ The `digitalDocuments` group contains the _Digital document service_ settings. |string |100MB |✅ -//|Максимальний розмір файлу для завантаження, MB |The maximum size of a file for upload in MB. |`maxTotalFileSize` |string |100MB |✅ -//|Макс. сумарний розмір групи файлів для завантаження, MB |The maximum size of a group of files for upload in MB. |=== [source,yaml] -//.Приклад специфікації налаштування digitalDocuments .digitalDocuments configuration example ---- digitalDocuments: @@ -206,10 +168,8 @@ digitalDocuments: maxTotalFileSize: 100MB ---- -//=== Параметри налаштувань адміністраторів реєстру === Registry administrators configuration parameters -//`administrators` містить перелік адміністраторів реєстру. The `administrators` group contains a list of registry administrators. [[administrators]] @@ -222,48 +182,41 @@ The `administrators` group contains a list of registry administrators. |string |❌ |✅ -//|Адреса електронної пошти, що ідентифікує користувача. |The email address that identifies the user. |`firstName` |string |❌ |✅ -//|Імʼя користувача |User's first name. |`lastName` |string |❌ |✅ -//|Прізвище користувача |User's last name. |`passwordVaultSecret` |string |❌ |✅ -//|Шлях до тимчасового пароля в _Сервісі управління секретами та шифруванням_ Hashicorp Vault. |The path to the temporary password in the Hashicorp Vault _Secrets and encryption management service_. |`passwordVaultSecretKey` |string |❌ |✅ -//|Ключ для пошуку тимчасового пароля в _Сервісі управління секретами та шифруванням_ Hashicorp Vault. |The key to finding the temporary password in the Hashicorp Vault _Secrets and encryption management service_. |`username` |string |❌ |✅ -//|Імʼя акаунту користувача. Дорівнює полю `email`. |User account name. Equals the `email` field. |=== [source,yaml] -//.Приклад специфікації налаштування адміністраторів .Administrators configuration example ---- administrators: @@ -275,10 +228,8 @@ administrators: username: user@company.com ---- -//=== Параметри налаштувань сервісу управління користувачами та ролями === User and role management service configuration parameters -//`keycloak` містить перелік налаштувань сервісу управління користувачами та ролями. The `keycloak` group contains the _User and role management service_ settings. [[keycloak]] @@ -291,35 +242,30 @@ The `keycloak` group contains the _User and role management service_ settings. |object |❌ |✅ -//|Налаштування сутності `AuthFlow` в Keycloak. |The `AuthFlow` entity settings in Keycloak. |`<>` |object |❌ |✅ -//|Налаштування сутності `AuthFlow` в Keycloak для кабінету отримувача послуг. |The `AuthFlow` entity settings in Keycloak for the citizen portal. |`customHost` |string |❌ |❌ -//|Визначає keycloak хост з попередньо доданих на рівні Платформи для використання при автентифікації. |The Keycloak host to use for authentication from the ones previously added at the Platform level. |`<>` |object |❌ |✅ -//|Налаштування ідентифікаційних провайдерів в Keycloak. |Identity provider settings in Keycloak. |`<>` |object |❌ |✅ -//|Налаштування сутності `Realm` в Keycloak. |The `Realm` entity settings in Keycloak. |=== @@ -334,7 +280,6 @@ The `keycloak` group contains the _User and role management service_ settings. |object |❌ |✅ -//|Налаштування сутності `AuthFlow` в Keycloak для кабінету надавача послуг. |The `AuthFlow` entity settings in Keycloak for the officer portal. |=== @@ -349,15 +294,12 @@ The `keycloak` group contains the _User and role management service_ settings. |string |❌ |✅ -//|Визначає можливість використовувати власний віджет автентифікації або налаштувати інтеграцію з id.gov.ua. -//TODO: ua-specific generalized |The authentication widget to use. |`edrCheck` |bool |❌ |✅ -//|Визначає ввімкнена або вимкнена перевірка наявності активного запису в ЄДР для бізнес-користувачів. a|Determines whether the business users should be checked for an active record in the Unified state register. include::platform::partial$admonitions/ua-specific.adoc[] @@ -366,7 +308,6 @@ include::platform::partial$admonitions/ua-specific.adoc[] |bool |❌ |✅ -//|Налаштування ідентифікаційного провайдера id.gov.ua a|Identification provider settings. [NOTE,caption=UA-specific] @@ -376,7 +317,6 @@ The `idGovUa` identity provider with its respective settings is specific to the |bool |❌ |✅ -//|Налаштування виджету авторизації. |Authentication widget settings. |=== @@ -391,14 +331,12 @@ The `idGovUa` identity provider with its respective settings is specific to the |string |❌ |✅ -//|Визначає висоту віджету автентифікації. |The authentication widget height. |`url` |string |❌ |✅ -//|Визначає посилання на віджет автентифікації. |The authentication widget URL. |=== @@ -413,7 +351,6 @@ The `idGovUa` identity provider with its respective settings is specific to the |object |❌ |✅ -//|Налаштування ідентифікаційного провайдера id.gov.ua a|Identification provider settings. [NOTE,caption=UA-specific] @@ -435,21 +372,18 @@ The `idGovUa` identity provider with its respective settings is specific to the |string |❌ |✅ -//|Визначає клієнтський ідентифікатор. |The client ID. |`secretKey` |string |❌ |✅ -//|Визначає шлях в _Сервісі управління секретами та шифруванням_ Hashicorp Vault до секрету клієнта що був зареєстрований в id.gov.ua. |The path to the client secret in the Hashicorp Vault _Secrets and encryption management service_ for users registered at id.gov.ua. |`url` |string |❌ |✅ -//|Визначає посилання для id.gov.ua |The identity provider URL. |=== @@ -465,7 +399,6 @@ The `idGovUa` identity provider with its respective settings is specific to the |string |720 |✅ -//|Визначає висоту віджету автентифікації. |The authentication widget height. |=== @@ -480,7 +413,6 @@ The `idGovUa` identity provider with its respective settings is specific to the |object |❌ |✅ -//|Визначає налаштування рілму автентифікації кабінету надавача послуг. |Authentication realm settings for the officer portal. |=== @@ -495,14 +427,12 @@ The `idGovUa` identity provider with its respective settings is specific to the |string |dso-officer-auth-flow |✅ -//|Визначає назву використовуємого AuthFlow. |The name of the AuthFlow to use. |`selfRegistration` |bool |❌ |✅ -//|Визначає можливість автоматичного створення облікового запису при першому логіні користувача. |Determines whether the automatic account creation is enabled during the user's first sign-in. |=== @@ -532,10 +462,8 @@ keycloak: selfRegistration: false ---- -//=== Параметри налаштувань сервісу цифрового підпису реєстру === Registry's Digital signature service configuration parameters -//`digitalSignature` містить перелік налаштувань сервісу цифрового підпису реєстру The `digitalSignature` group contains the _Digital signature service_ settings. [[digital-signature]] @@ -548,14 +476,12 @@ The `digitalSignature` group contains the _Digital signature service_ settings. |object |❌ |✅ -//|Налаштування ключів сервісу цифрового підпису реєстру. |The registry's _Digital signature service_ key settings. |`<>` |object |❌ |✅ -//|Налаштування оточення сервісу цифрового підпису реєстру. |The registry's _Digital signature service_ environment settings. |=== @@ -570,21 +496,18 @@ The `digitalSignature` group contains the _Digital signature service_ settings. |string |❌ |✅ -//|Шлях до приватного файлового ключа організації в _Сервісі управління секретами та шифруванням_ Hashicorp Vault. |The path to the organization's private file key in the Hashicorp Vault _Secrets and encryption management service_. |`allowed-keys-yml` |string |❌ |✅ -//|Шлях до файлу з переліком атрибутів дозволених (або раніше виданих) ключів в _Сервісі управління секретами та шифруванням_ Hashicorp Vault. |The path to the file listing the attributes of authorized or previously issued keys in the Hashicorp Vault _Secrets and encryption management service_. |`osplm.ini` |string |❌ |✅ -//|Шлях до конфігураційного файлу програмно-апаратного криптомодуля "Гряда" в _Сервісі управління секретами та шифруванням_ Hashicorp Vault. Використовується тільки з апаратним типом ключа. |The path to the configuration file of the hardware and software cryptomodule in the Hashicorp Vault _Secrets and encryption management service_. Only used with the hardware key type. |=== @@ -599,48 +522,46 @@ The `digitalSignature` group contains the _Digital signature service_ settings. |string |❌ |✅ -//|Визначає тип ключа що використовується реєстром. Допустимі значення `file` або `hardware`. |The type of the key used by the registry. Possible values are `file` or `hardware`. |`sign.key.file.issuer` |string |❌ |✅ -//|Шлях до інформації про емітента приватного ключа організації. в _Сервісі управління секретами та шифруванням_ Hashicorp Vault. Використовується, коли `sign.key.device-type` = `file` |The path to information about the issuer of the organization's private key in the Hashicorp Vault _Secrets and encryption management service_. Used when `sign.key.device-type` = `file`. |`sign.key.file.password` |string |❌ |✅ -//|Шлях до пароля приватного ключа організації. в _Сервісі управління секретами та шифруванням_ Hashicorp Vault. Використовується, коли `sign.key.device-type` = `file` + |The path to the organization's private key password in the Hashicorp Vault _Secrets and encryption management service_. Used when `sign.key.device-type` = `file`. |`sign.key.hardware.device` |string |❌ |✅ -//|Опис носія ключової інформації (НКІ) згідно з описами ІІТ в _Сервісі управління секретами та шифруванням_ Hashicorp Vault. Використовується, коли `sign.key.device-type` = `hardware` + |The description of the key information carrier in the Hashicorp Vault _Secrets and encryption management service_. Used when `sign.key.device-type` = `hardware`. |`sign.key.hardware.password` |string |❌ |✅ -//|Шлях до пароля апаратного екземпляра Гряди в _Сервісі управління секретами та шифруванням_ Hashicorp Vault. Використовується, коли `sign.key.device-type` = `hardware` + |The path to the hardware cryptomodule device password in the Hashicorp Vault _Secrets and encryption management service_. Used when `sign.key.device-type` = `hardware`. |`sign.key.hardware.type` |string |❌ |✅ -//|Шлях до типу апаратного екземпляра Гряди в _Сервісі управління секретами та шифруванням_ Hashicorp Vault. Використовується, коли `sign.key.device-type` = `hardware` + |The path to the hardware cryptomodule device type in the Hashicorp Vault _Secrets and encryption management service_. Used when `sign.key.device-type` = `hardware`. |=== [source,yaml] -//.Приклад специфікації налаштування сервісу цифрового підпису реєстру + .Registry's Digital signature service configuration example ---- digital-signature: @@ -657,7 +578,6 @@ digital-signature: sign.key.hardware.type: "" ---- -//`dso` містить перелік налаштувань кількості реплік сервісу цифрового підпису реєстру The `dso` group contains the settings for the number of replicas of the registry's _Digital signature service_. [[dso]] @@ -670,7 +590,7 @@ The `dso` group contains the settings for the number of replicas of the registry |int |3 |❌ -//|Максимальна кількість реплік компонента. + |The maximum number of component replicas. @@ -678,13 +598,13 @@ The `dso` group contains the settings for the number of replicas of the registry |int |1 |❌ -//|Мінімальна кількість реплік компонента. + |The minimum number of component replicas. |=== [source,yaml] -//.Приклад специфікації налаштування сервісу цифрового підпису реєстру + .Registry's Digital signature service configuration example ---- dso: @@ -692,10 +612,8 @@ dso: minReplicas: 1 ---- -//=== Глобальні параметри налаштувань реєстру === Global registry settings -//`global` мість глобальні параметри реєстру, що не були класифіковані в окремі розділи. The `global` group contains the registry's global parameters that are not classified into separate groups. [[global]] @@ -708,92 +626,90 @@ The `global` group contains the registry's global parameters that are not classi |object |❌ |✅ -//|Налаштування віртуальних машин реєстру. + |Registry virtual machine configuration. |`deploymentMode` |string |development |✅ -//|Налаштування режиму розгортання реєстру. Детальніше див. xref:registry-develop:registry-admin/change-dev-prod-mode.adoc[Налаштування режиму розгортання реєстру]. + |The registry deployment mode. For details, see xref:registry-develop:registry-admin/change-dev-prod-mode.adoc[]. |`disableRequestsLimits` |bool |true |✅ -//|Визначає чи ввімкнені Requests/Limits для компонентів реєстру. + |Determines whether Requests/Limits are enabled for registry components. |`<>` |object |❌ |❌ -//|Налаштування доступів до реєстрових сервісів. + |Registry service access parameters. |`excludePortals` |[]object |[""] |❌ -//|Перелік користувацьких порталів, що не будуть розгортатись в реєстрі. Доступні значення в переліку `officer-portal`, `citizen-portal` або `admin-portal`. + |The list of user portals that will not be deployed in the registry. Possible values are: `officer-portal`, `citizen-portal`, or `admin-portal`. |`<>` |object |❌ |✅ -//|Налаштувань користувацького інтерфейсу для перегляду стану виконання та управління бізнес-процесами реєстру. + |User interface settings for managing and viewing the execution status of the registry's business processes. |`<>` |object |❌ |✅ -//|Налаштувань підсистеми управління реляційними базами даних. + |_Relational database management subsystem_ settings. |`<>` |object |❌ |✅ -//|Налаштування підсистеми асинхронного обміну повідомленнями. + |_Asynchronous messaging subsystem_ settings. |`<>` |object |❌ |✅ -//|Налаштування сповіщень. + |Notification settings. |`<>` |object |❌ |✅ -//|Реєстрові налаштування. + |Registry settings. |`<>` |object |❌ |❌ -//|Налаштування резервного копіювання компонентів реєстру. + |Registry component backup settings. |`<>` |object |❌ |✅ -//|Налаштування registry regulation management сервісів. + |_Registry regulations management service_ settings. |=== -//=== Параметри налаштувань реєстрових компонентів. === Registry components configuration parameters -//`registry` містить загальні налаштування реєстрових компонентів. The `registry` group contains the general settings of the registry components. [[registry]] @@ -806,28 +722,28 @@ The `registry` group contains the general settings of the registry components. |object |❌ |✅ -//|Визначає загальні налаштування компонента `bpms` реєстру. + |Defines the general settings of the registry's `geo-server` component. |`<>` |object |❌ |❌ -//|Визначає загальні налаштування компонента `bpms` реєстру. + |Defines the general settings of the registry's `bpms` component. |`<>` |object |❌ |❌ -//|Визначає загальні налаштування компонента `digital-document-service` реєстру. + |Defines the general settings of the registry's `digital-document-service` component. |`<>` |object |❌ |❌ -//|Визначає загальні налаштування компонента `digital-signature-ops` реєстру. + |Defines the general settings of the registry's `digital-signature-ops` component. @@ -835,56 +751,56 @@ The `registry` group contains the general settings of the registry components. |object |❌ |❌ -//|Визначає загальні налаштування компонента `registry-kafka-api` реєстру. + |Defines the general settings of the registry's `registry-kafka-api` component. |`<>` |object |❌ |❌ -//|Визначає загальні налаштування компонента `kong-kong` реєстру. + |Defines the general settings of the registry's `kong-kong` component. |`<>` |object |❌ |❌ -//|Визначає загальні налаштування компонента `redis` реєстру. + |Defines the general settings of the registry's `redis` component. |`<>` |object |❌ |❌ -//|Визначає загальні налаштування компонента `registry-rest-api` реєстру. + |Defines the general settings of the registry's `registry-rest-api` component. |`<>` |object |❌ |❌ -//|Визначає загальні налаштування компонента `redis-sentinel` реєстру. + |Defines the general settings of the registry's `redis-sentinel` component. |`<>` |object |❌ |❌ -//|Визначає загальні налаштування компонента `registry-soap-api` реєстру. + |Defines the general settings of the registry's `registry-soap-api` component. |`<>` |object |❌ |❌ -//|Визначає загальні налаштування компонента `user-process-management` реєстру. + |Defines the general settings of the registry's `user-process-management` component. |`<>` |object |❌ |❌ -//|Визначає загальні налаштування компонента `user-task-management` реєстру. + |Defines the general settings of the registry's `user-task-management` component. |=== @@ -899,7 +815,7 @@ The `registry` group contains the general settings of the registry components. |bool |❌ |✅ -//|Визначає наявніть або відсутність підсистеми управління геоданими. + |Determines whether the _Geodata management subsystem_ is enabled. |=== @@ -914,38 +830,35 @@ The `registry` group contains the general settings of the registry components. |int |❌ |❌ -//|Налаштування кількості реплік. + |The number of replicas. |<> |object |❌ |❌ -//|Налаштування Horizontal Pod Autoscaler для компонента реєстру. + |Horizontal Pod Autoscaler settings for the registry component. -//TODO: Missing anchor: requestslimits |<> |object |❌ |❌ -//|Налаштування Requests/Limits для компонента реєстру. + |Requests/Limits settings for the registry component. -//TODO: Missing anchor: istio |<> |object |❌ |❌ -//|Налаштування Istio Sidecar для компонента реєстру. + |Istio Sidecar settings for the registry component. -//TODO: Missing anchor: container |<> |object |❌ |❌ -//|Налаштування ресурсів контейнера компонента реєстру. + |Container resources settings for the registry component. |=== @@ -960,29 +873,27 @@ The `registry` group contains the general settings of the registry components. |bool |false |❌ -//|Визначає ввімкнене чи вимкнене автоматичне масштабування. + |Determines whether the automatic scaling is enabled. |`minReplicas` |integer |1 |❌ -//|Визначає мінімальну кількість реплік компонента. + |The minimum number of component replicas. |`maxReplicas` |integer |3 |❌ -//|Визначає максимальну кількість реплік компонента. + |The maximum number of component replicas. |=== -//=== Параметри налаштувань підсистеми резервного копіювання та відновлення. === Backup and restore subsystem configuration parameters -//`registryBackup` містить налаштування підсистеми резервного копіювання та відновлення. The `registryBackup` group contains the _Backup and restore subsystem_ settings. [[registryBackup]] @@ -995,28 +906,28 @@ The `registryBackup` group contains the _Backup and restore subsystem_ settings. |bool |❌ |❌ -//|Вмикає або вимикає резервне копіювання реєстру. + |Determines whether the registry backup is enabled. |`expiresInDays` |int |❌ |❌ -//|Визначає кількість днів для зберігання створеної резервної копії реєстру. + |The number of days to store the backup copy of the registry. |`schedule` |string |❌ |❌ -//|Розклад резервного копіювання реєстру. Задається в UNIX cron форматі. + |The registry backup schedule definition in the UNIX cron format. |`<>` |object |❌ |❌ -//|Визначає налаштування резервного копіювання S3-бакетів. + |The backup configuration of the S3 buckets. |=== @@ -1031,36 +942,34 @@ The `registryBackup` group contains the _Backup and restore subsystem_ settings. |string |❌ |❌ -//|Шлях до токена доступу в S3-бакети в _Сервісі управління секретами та шифруванням_ Hashicorp Vault. + |The path to the S3 buckets access token in the Hashicorp Vault _Secrets and encryption management service_. |`cronExpression` |string |❌ |❌ -//|Розклад резервного копіювання S3-бакетів. Задається в UNIX cron форматі. + |The S3 buckets backup schedule definition in the UNIX cron format. |`endpoint` |string |❌ |❌ -//|Визначає хост до S3-бакета. + |The S3 bucket endpoint. |`backupBucket` |string |❌ |❌ -//|Визначає назву S3-бакету для резервної копії. + |The name of the S3 bucket for the backup copy. |=== -//=== Параметри налаштувань сповіщень. === Notification settings -//`notifications` містить налаштування сповіщень реєстру. The `notifications` group contains the registry notification settings. [[notifications]] @@ -1073,7 +982,7 @@ The `notifications` group contains the registry notification settings. |object |❌ |✅ -//|Визначає налаштування сервісу поштових повідомлень реєстру + |The registry's _Email messaging service_ settings. |=== @@ -1088,57 +997,55 @@ The `notifications` group contains the registry notification settings. |string |❌ |✅ -//|Визначає тип поштового сервера використовуємого для відправки повідомлень. Доступні значення `external` або `internal`. + |The type of the email server to use for notifications. Possible values are `external` or `internal`. |`address` |string |❌ |✅ -//|Визначає поштову адресу поштового сервера типу `external`. + |The email address of the `external` email server. |`host` |string |❌ |✅ -//|Визначає хост поштового сервера типу `external`. + |The host of the `external` email server. |`port` |string |❌ |✅ -//|Визначає порт поштового сервера типу `external`. + |The port of the `external` email server. |`password` |string |❌ |✅ -//|❌ Застарілий параметр. Буде видалений в наступних версіях Платформи. + |❌ A deprecated parameter. Will be discontinued in the future Platform versions. |`vaultKey` |string |❌ |✅ -//|Ключ для пошуку пароля поштового сервера типу `external` в _Сервісі управління секретами та шифруванням_ Hashicorp Vault. + |The key to finding the `external` email server's password in the Hashicorp Vault _Secrets and encryption management service_. |`vaultPath` |string |❌ |✅ -//|Шлях до пароля поштового сервера типу `external` в _Сервісі управління секретами та шифруванням_ Hashicorp Vault. + |The path to the `external` email server's password in the Hashicorp Vault _Secrets and encryption management service_. |=== -//=== Параметри налаштувань підсистеми асинхронного обміну повідомленнями. === Asynchronous messaging subsystem configuration parameters -//`kafkaOperator` містить налаштування сервісів registry regulation management. The `kafkaOperator` group contains the _Registry regulations management service_ settings. [[kafkaOperator]] @@ -1151,7 +1058,7 @@ The `kafkaOperator` group contains the _Registry regulations management service_ |object |❌ |✅ -//|Налаштування сховища підсистеми асинхронного обміну повідомленнями. + |The _Asynchronous messaging subsystem's_ storage settings. |=== @@ -1166,7 +1073,7 @@ The `kafkaOperator` group contains the _Registry regulations management service_ |object |❌ |✅ -//|Налаштування сховища підсистеми асинхронного обміну повідомленнями. + |The _Asynchronous messaging subsystem's_ storage settings. |=== @@ -1181,15 +1088,13 @@ The `kafkaOperator` group contains the _Registry regulations management service_ |string |20Gi |✅ -//|Визначає розмір сховища підсистеми асинхронного обміну повідомленнями. + |The _Asynchronous messaging subsystem's_ storage size. |=== -//=== Параметри налаштувань registry regulation management сервісів. === Registry regulations management service configuration parameters -//`regulationManagement` містить налаштування сервісів registry regulation management. The `regulationManagement` group contains the _Registry regulations management service_ settings. [[regulationManagement]] @@ -1202,15 +1107,13 @@ The `regulationManagement` group contains the _Registry regulations management s |int |10 |✅ -//|Визначає максимальну кількість активних версій кандидатів регламенту реєстру. + |The maximum number of active version candidates of the registry regulations. |=== -//=== Параметри налаштувань підсистеми управління реляційними базами даних. === Relational database management subsystem configuration parameters -//`crunchyPostgres` містить налаштування сервісу управління виконанням бізнес-процесів. The `crunchyPostgres` group contains the _Business processes execution service_ settings. [[crunchyPostgres]] @@ -1223,21 +1126,21 @@ The `crunchyPostgres` group contains the _Business processes execution service_ |object |❌ |✅ -//|Параметри налаштувань резервного копіювання підсистеми управління реляційними базами даних. + |The backup settings of the _Relational database management subsystem_. |`<>` |object |❌ |✅ -//|Параметри налаштувань екземплярів СКБД підсистеми управління реляційними базами даних. + |The DBMS instance settings of the _Relational database management subsystem_. |`storageSize` |string |10Gi |✅ -//|Визначає розмір сховища екземплярів СКБД підсистеми управління реляційними базами даних. + |The DBMS instance storage size of the _Relational database management subsystem_. |=== @@ -1252,7 +1155,7 @@ The `crunchyPostgres` group contains the _Business processes execution service_ |string |❌ |✅ -//|Визначає розклад повного резервного копіювання екземплярів СКБД. + |The full backup schedule for the DBMS instances. |=== @@ -1267,7 +1170,7 @@ The `crunchyPostgres` group contains the _Business processes execution service_ |object |❌ |✅ -//|Параметри налаштувань резервного копіювання підсистеми управління реляційними базами даних. + |The backup settings of the _Relational database management subsystem_. |=== @@ -1282,15 +1185,13 @@ The `crunchyPostgres` group contains the _Business processes execution service_ |string |200 |✅ -//|Визначає максимальну кількість одночасних з'єднань з екземпляром СКБД. + |The maximum number of simultaneous connections to the DBMS instance. |=== -//=== Параметри налаштувань сервісу управління виконанням бізнес-процесів === Business processes execution service configuration parameters -//`bpAdminPortal` містить налаштування сервісу управління виконанням бізнес-процесів. The `bpAdminPortal` group contains the _Business processes execution service_ settings. [[bpAdminPortal]] @@ -1303,7 +1204,7 @@ The `bpAdminPortal` group contains the _Business processes execution service_ se |object |❌ |✅ -//|Параметри налаштувань користувацького інтерфейсу для перегляду стану виконання та управління бізнес-процесами реєстру. + |User interface settings for managing and viewing the execution status of the registry's business processes. |=== @@ -1318,22 +1219,20 @@ The `bpAdminPortal` group contains the _Business processes execution service_ se |bool |true |✅ -//|Визначає чи доступний інтерфейс для збору метрик підсистемою моніторингу подій та сповіщення. + |Determines whether the interface for collecting metrics is enabled for the _Event monitoring and notification subsystem_. |`scrapeInterval` |string |60s |✅ -//|Визначає часовий проміжок між зборами метрик підсистемою моніторингу подій та сповіщення. + |The time interval between metrics collection by the _Event monitoring and notification subsystem_. |=== -//=== Параметри налаштувань доступів до реєстрових сервісів === Registry services access parameters -//`whiteListIP` містить параметри конфігурації доступів до реєстрових сервісів. The `whiteListIP` group contains access parameters for the registry services. [[whitelistip]] @@ -1346,30 +1245,28 @@ The `whiteListIP` group contains access parameters for the registry services. |string |❌ |✅ -//|Налаштування доступу до роутів адміністративних сервісів реєстру. + |The registry's administrative service route access parameters. |`citizenPortal` |string |❌ |✅ -//|Налаштування доступу до кабінету отримувача послуг. + |Citizen portal access parameters. |`officerPortal` |string |❌ |✅ -//|Налаштування доступу до кабінету надавача послуг. + |Officer portal access parameters. |=== -//=== Параметри налаштувань IIT-віджету автентифікації -//TODO: ua-specific, generalized + === Authentication widget settings -//`signWidget` містить параметри конфігурації IIT-віджету автентифікації. The `signWidget` group contains the authentication widget configuration parameters. [[signWidget]] @@ -1382,29 +1279,27 @@ The `signWidget` group contains the authentication widget configuration paramete |bool |false |✅ -//TODO: Missing description + | |`height` |int |0 |✅ -//|Визначає висоту IIT-віджета, px. + |The authentication widget height in px. |`url` |string |❌ |✅ -//|Визначає посилання на IIT-віджет. + |The authentication widget URL. |=== -//=== Параметри налаштувань віртуальних машин реєстру === Registry virtual machine configuration parameters -//`computeResources` містить параметри конфігурації віртуальних машин реєстру. The `computeResources` group contains the registry's virtual machine configuration parameters. [[computeResources]] @@ -1417,69 +1312,69 @@ The `computeResources` group contains the registry's virtual machine configurati |int |2 |✅ -//|Визначає кількість віртуальних машин для розгортання реєстру з типом інфраструктури `AWS` або `vSphere`. + |The number of virtual machines for registry deployment using the `AWS` or `vSphere` infrastructure type. |`awsInstanceType` |string |r5.2xlarge |✅ -//|Визначає тип AWS EC2-інстансу для розгортання реєстру з типом інфраструктури `AWS`. + |The type of AWS EC2 instance for registry deployment using the `AWS` infrastructure type. |`awsSpotInstance` |bool |false |✅ -//|Визначає використання типу spot для AWS EC2-інстансу реєстру. + |Determines whether to use the Spot type for the AWS EC2 registry instance. |`awsSpotInstanceMaxPrice` |string |❌ |❌ -//|Визначає максимальну ціну для AWS EC2 spot-інстансу. + |The maximum price for the AWS EC2 Spot instance. |`awsInstanceVolumeType` |string |gp3 |✅ -//|Визначає тип системного диска AWS EC2-інстансу для розгортання реєстру з типом інфраструктури `AWS`. + |The system disk type of the AWS EC2 instance for registry deployment using the `AWS` infrastructure type. |`instanceVolumeSize` |int |80 |✅ -//|Визначає розмір системного диска віртуальної машини реєстру з типом інфраструктури `AWS` або `vSphere`. + |The system disk size of the registry virtual machine using the `AWS` or `vSphere` infrastructure type. |`vSphereInstanceCPUCount` |int |8 |✅ -//|Визначає кількість vCPU віртуальної машини реєстру з типом інфраструктури `vSphere`. + |The number of vCPUs of the registry virtual machine using the `vSphere` infrastructure type. |`vSphereInstanceCoresPerCPUCount` |int |1 |✅ -//|Визначає кількість ядер у кожного vCPU віртуальної машини реєстру з типом інфраструктури `vSphere`. + |The number of cores in each vCPU of the registry virtual machine using the `vSphere` infrastructure type. |`vSphereInstanceRAMSize` |int |32768 |✅ -//|Визначає кількість RAM віртуальної машини реєстру з типом інфраструктури `vSphere`. + |The amount of RAM of the registry virtual machine using the `vSphere` infrastructure type. |=== [source,yaml] -//.Приклади конфігурації загальних параметрів реєстру — bpAdminPortal. + .General registry configuration example -- bpAdminPortal ---- global: @@ -1492,7 +1387,7 @@ global: ---- [source,yaml] -//.Приклади конфігурації загальних параметрів реєстру — crunchyPostgres. + .General registry configuration example -- crunchyPostgres ---- global: @@ -1509,7 +1404,7 @@ global: ---- [source,yaml] -//.Приклади конфігурації загальних параметрів реєстру — computeResources. + .General registry configuration example -- computeResources ---- global: @@ -1522,7 +1417,7 @@ global: ---- [source,yaml] -//.Приклади конфігурації загальних параметрів реєстру — kafkaOperator. + .General registry configuration example -- kafkaOperator ---- global: @@ -1533,7 +1428,7 @@ global: ---- [source,yaml] -//.Приклади конфігурації загальних параметрів реєстру — notifications. + .General registry configuration example -- notifications ---- global: @@ -1543,7 +1438,7 @@ global: ---- [source,yaml] -//.Приклади конфігурації загальних параметрів реєстру — registry. + .General registry configuration example -- registry ---- global: @@ -1572,7 +1467,7 @@ global: ---- [source,yaml] -//.Приклади конфігурації загальних параметрів реєстру. + .General registry configuration example ---- global: @@ -1587,11 +1482,9 @@ global: officerPortal: "192.168.1.64/26 172.16.0.192/27" ---- -//=== Параметри налаштувань програмно-апаратного криптомодуля "Гряда" -//TODO: ua-specific, generalized + === Hardware and software cryptomodule configuration parameters -//`griada` містить налаштувань програмно-апаратного криптомодуля "Гряда". The `griada` group contains the hardware and software cryptomodule settings. include::platform::partial$admonitions/ua-specific.adoc[] @@ -1606,27 +1499,27 @@ include::platform::partial$admonitions/ua-specific.adoc[] |bool |true |✅ -//|Визначає використання або відсутність апаратного ключа в реєстрі. + |Determines whether the hardware key is enabled in the registry. |`ip` |string |❌ |✅ -//|Визначає ip-адресу програмно-апаратного криптомодуля "Гряда". + |The IP address of the hardware and software cryptomodule. |`port` |int |❌ |✅ -//|Визначає порт програмно-апаратного криптомодуля "Гряда". + |The port of the hardware and software cryptomodule. |=== [source,yaml] -//.Приклад налаштувань програмно-апаратного криптомодуля "Гряда" + .Hardware and software cryptomodule configuration example ---- griada: @@ -1635,15 +1528,13 @@ griada: port: 3080 ---- -//=== Параметри реєстрових налаштувань зовнішнього API-шлюзу операційної зони реєстру === Registry operational zone's external API gateway settings -//`kongPluginsConfig` містить перелік налаштувань зовнішнього API-шлюзу операційної зони реєстру. The `kongPluginsConfig` group contains the registry operational zone's external API gateway settings. [[kongPluginsConfig]] -//TODO: Since the descriptions in this table were missing, I removed the fourth column for now -//[cols="20%,15%,7%,7%,60%",options="header",caption=] + + [cols="30%,20%,30%,20%",options="header",caption=] .kongPluginsConfig | <> |=== @@ -1737,7 +1628,7 @@ The `kongPluginsConfig` group contains the registry operational zone's external |=== [source,yaml] -//.Приклад специфікації налаштуванm зовнішнього API-шлюзу операційної зони реєстру + .Registry operational zone's external API gateway configuration example ---- kongPluginsConfig: @@ -1760,10 +1651,8 @@ kongPluginsConfig: rateLimitingPluginEnable: false ---- -//=== Параметри налаштувань доступів для реєстрів Платформи та зовнішніх систем === Platform registries and external systems access parameters -//`nontrembita-external-registration` містить перелік налаштувань доступів для реєстрів Платформи та зовнішніх систем. The `nontrembita-external-registration` group contains the access parameters for the Platform registries and external systems. [[nontrembita-external-registration]] @@ -1776,27 +1665,27 @@ The `nontrembita-external-registration` group contains the access parameters for |bool |❌ |❌ -//|Визначає ввімкнена або вимкнена зовнішня інтеграція. + |Determines whether the external integration is enabled. |`external` |bool |❌ |❌ -//|Визначає тип зовнішньої інтеграції: інший реєстр на Платформі або за межами Платформи. + |Defines the type of external integration: another registry on the Platform or outside the Platform. |`name` |string |❌ |❌ -//|Визначає імʼя зовнішньої системи. + |The name of the external system. |=== [source,yaml] -//.Приклад специфікації налаштування доступів для реєстрів Платформи та зовнішніх систем + .Platform registries and external systems access configuration example ---- nontrembita-external-registration: @@ -1805,11 +1694,9 @@ nontrembita-external-registration: name: example-registry ---- -//TODO: ua-specific, generalized -//=== Параметри налаштувань шлюзу безпечного обміну "Трембіта" + === Secure exchange gateway configuration parameters -//`trembita` містить перелік налаштувань шлюзу безпечного обміну "Трембіта". The `trembita` group contains the secure exchange gateway (SEG) settings. include::platform::partial$admonitions/ua-specific.adoc[] @@ -1824,14 +1711,14 @@ include::platform::partial$admonitions/ua-specific.adoc[] |[]object |❌ |❌ -//|Визначає перелік IP-адрес ШБО Трембіта, з яких дозволен доступ до `bp-webservice-gateway` та `registry-soap-api`. Пусте значення поля дорівнює відсутності доступу до SOAP API. + |The list of SEG IP addresses from which access to `bp-webservice-gateway` and `registry-soap-api` is allowed. An empty field value means no access to the SOAP API. |`<>` |object |❌ |✅ -//|Містить налаштування взаємодію з реєстром через ШБО "Трембіта". + |Contains the registry SEG interaction settings. |=== @@ -1846,7 +1733,7 @@ include::platform::partial$admonitions/ua-specific.adoc[] |object |❌ |✅ -//|Налаштування системної інтеграції з ДРАЦС. Присутня за замовчуванням і недоступна для видалення. + a|System integration settings for the State registry of civil status acts. Enabled by default and cannot be removed. include::platform::partial$admonitions/ua-specific.adoc[] @@ -1855,7 +1742,7 @@ include::platform::partial$admonitions/ua-specific.adoc[] |object |❌ |✅ -//|Налаштування системної інтеграції з ЄДР. Присутня за замовчуванням і недоступна для видалення. + a|System integration settings for the Unified state register. Enabled by default and cannot be removed. include::platform::partial$admonitions/ua-specific.adoc[] @@ -1864,7 +1751,7 @@ include::platform::partial$admonitions/ua-specific.adoc[] |object |❌ |✅ -//|Налаштування системної інтеграції з ЄІБДВПО. Присутня за замовчуванням і недоступна для видалення. + a|System integration settings for the Unified information database of internally displaced persons. Enabled by default and cannot be removed. include::platform::partial$admonitions/ua-specific.adoc[] @@ -1873,7 +1760,7 @@ include::platform::partial$admonitions/ua-specific.adoc[] |object |❌ |❌ -//|Параметри іншої зовнішньої системи для інтеграції з реєстром. + |Another external system's integration parameters with the registry. |=== @@ -1888,63 +1775,63 @@ include::platform::partial$admonitions/ua-specific.adoc[] |object |❌ |✅ -//|Параметри заголовку, що визначають налаштування авторизації. + |Header parameters that define authorization settings. |`<>` |object |❌ |✅ -//|Параметри заголовку, що ідентифікують учасника сервісу. + |Header parameters that identify the service participant. |`<>` |object |❌ |✅ -//|Параметри заголовку, що ідентифікують сервіс. + |Header parameters that identify the service. |`mock` |bool |❌ |✅ -//|Визначає зовнішню систему як реальну, або як заглушку точки інтеграції. + |Determines whether the external system is real or an integration point mock. |`protocol` |string |SOAP |✅ -//|Визначає протокол інтеграційної взаємодії. Дозволені значення `SOAP`. + |The integration protocol. Possible value is `SOAP`. |`protocol-version` |string |❌ |✅ -//|Визначає версію протоколу, за яким обмінюються повідомленням з ШБО "Трембіта". + |The version of the protocol used to exchange messages with the SEG. |`type` |string |❌ |✅ -//|Визначає `platform` або `registry` тип взаємодії. + |Defines the interaction type as either `platform` or `registry`. |`url` |string |❌ |✅ -//|Визначає хост ШБО "Трембіта" + |The SEG URL. |`user-id` |string |❌ |✅ -//|Ідентифікатор користувача, що ініціює запит. + |The ID of the user initiating the request. |=== @@ -1959,14 +1846,14 @@ include::platform::partial$admonitions/ua-specific.adoc[] |string |❌ |✅ -//|Визначає тип авторизації. Доступні значення `AUTH_TOKEN` або `NO_AUTH` + |The authorization type. Possible values are `AUTH_TOKEN` or `NO_AUTH`. |`secret` |string |❌ |❌ -//|Шлях до токена авторизації в _Сервісі управління секретами та шифруванням_ Hashicorp Vault. + |The path to the authorization token in the Hashicorp Vault _Secrets and encryption management service_. |=== @@ -1981,28 +1868,28 @@ include::platform::partial$admonitions/ua-specific.adoc[] |string |❌ |✅ -//|Код середовища, що ідентифікує екземпляр сервісу або учасника. + |The environment code that identifies the instance of the service or member. |`member-class` |string |❌ |✅ -//|Ідентифікатор класу сервісу або учасника. + |The service or member class identifier. |`member-code` |string |❌ |✅ -//|Ідентифікатор сервісу або учасника. + |The service or member identifier. |`subsystem-code` |string |❌ |✅ -//|Код, що ідентифікує підсистему сервісу або учасника, якщо сервіс надається підсистемою. + |The code that identifies the subsystem of the service or member, if the service is provided by the subsystem. |=== @@ -2017,48 +1904,48 @@ include::platform::partial$admonitions/ua-specific.adoc[] |string |❌ |✅ -//|Код середовища, що ідентифікує екземпляр сервісу або учасника. + |The environment code that identifies the instance of the service or member. |`member-class` |string |❌ |✅ -//|Ідентифікатор класу сервісу або учасника. + |The service or member class identifier. |`member-code` |string |❌ |✅ -//|Ідентифікатор сервісу або учасника. + |The service or member identifier. |`subsystem-code` |string |❌ |✅ -//|Код, що ідентифікує підсистему сервісу або учасника, якщо сервіс надається підсистемою. + |The code that identifies the subsystem of the service or member, if the service is provided by the subsystem. |`service-code` |string |❌ |❌ -//|Код, що ідентифікує підсистему сервісу або учасника, якщо сервіс надається підсистемою. + |The code that identifies the subsystem of the service or member, if the service is provided by the subsystem. |`service-version` |string |❌ |❌ -//|Код, що ідентифікує підсистему сервісу або учасника, якщо сервіс надається підсистемою. + |The code that identifies the subsystem of the service or member, if the service is provided by the subsystem. |=== [source,yaml] -//.Приклад специфікації налаштування шлюзу безпечного обміну "Трембіта". + .Secure exchange gateway configuration example ---- trembita: @@ -2087,10 +1974,8 @@ trembita: ... ---- -//=== Параметри налаштувань інтеграції з зовнішніми системами === Parameters of integration with external systems -//`external-systems` налаштовують інтеграції з зовнішніми системами. The `external-systems` group contains the external system integration parameters. [[external-systems]] @@ -2103,7 +1988,7 @@ The `external-systems` group contains the external system integration parameters |object |❌ |✅ -//|Налаштування системної інтеграції з ДіЯ. Присутня за замовчуванням і недоступна для видалення. + a|System integration settings for the citizen-facing solution. Enabled by default and cannot be removed. include::platform::partial$admonitions/ua-specific.adoc[] @@ -2112,12 +1997,11 @@ include::platform::partial$admonitions/ua-specific.adoc[] |object |❌ |❌ -//|Параметри іншої зовнішньої системи для інтеграції з реєстром. + |Another external system's integration parameters with the registry. |=== -//TIP: `` — буде замінений на назву зовнішньої системи задану через адмін-консоль. TIP: The `` will be replaced by the name of the external system specified through the admin console. [[external-systems-spec]] @@ -2130,35 +2014,35 @@ TIP: The `` will be replaced by the name of the externa |string |❌ |✅ -//|Визначає протокол інтеграції з зовнішньою системою. Доступне значення `REST`. + |The external system integration protocol. Possible value is `REST`. |`type` |string |❌ |✅ -//|Визначає `platform` або `registry` тип взаємодії. + |Defines the interaction type as either `platform` or `registry`. |`url` |string |❌ |✅ -//|Визначає адресу зовнішньої системи. + |The external system's URL. |`mock` |string |❌ |✅ -//|Визначає зовнішню систему як реальну, або як заглушку точки інтеграції. + |Determines whether the external system is real or an integration point mock. |`<>` |object |❌ |✅ -//|Визначає налаштування автентифікації з зовнішньою системою. + |Defines the external system's authentication settings. |=== @@ -2173,7 +2057,7 @@ TIP: The `` will be replaced by the name of the externa |string |❌ |❌ -//|Шлях до токену зовнішньої системи в _Сервісі управління секретами та шифруванням_ Hashicorp Vault. + |The path to the external system's token in the Hashicorp Vault _Secrets and encryption management service_. @@ -2181,13 +2065,13 @@ TIP: The `` will be replaced by the name of the externa |string |❌ |✅ -//|Визначає метод автентифікації з зовнішньою системою. Доступні значення `NO_AUTH`, `AUTH_TOKEN`, `BEARER`, `BASIC`, `AUTH_TOKEN+BEARER`. + |The external system authorization type. Possible values are: `NO_AUTH`, `AUTH_TOKEN`, `BEARER`, `BASIC`, `AUTH_TOKEN+BEARER`. |=== [source,yaml] -//.Приклад специфікації налаштування сервісу цифрового підпису реєстру + .Registry Digital signature service configuration example ---- external-systems: @@ -2210,10 +2094,8 @@ external-systems: type: platform ---- -//=== Параметри налаштувань кабінетів користувачів === User portal configuration parameters -//`portals` налаштування кабінетів користувачів. The `portals` group contains the user portal settings. [[portals]] @@ -2222,25 +2104,48 @@ The `portals` group contains the user portal settings. |=== |Name |Type |Default value |Required |Description -|`<>` +|`<>` |object |❌ |✅ -//|Налаштування кабінету отримувача послуг. + |Citizen portal settings. -|`<>` +|`<>` |object |❌ |✅ -//|Налаштування кабінету надавача послуг. + |Officer portal settings. |=== -[[portals-spec]] +[[citizen-spec]] +[cols="20%,15%,7%,7%,60%",options="header",caption=] +.portals.citizen | <> +|=== +|Name |Type |Default value |Required |Description + +|`<>` +|object +|❌ +|❌ + +|The user portal custom DNS settings. + +|`<>` +|object +|❌ +|✅ + + +|The user portal's authentication widget settings. + +|=== + +[[officer-spec]] [cols="20%,15%,7%,7%,60%",options="header",caption=] -.portals. | <> +.portals.officer | <> |=== |Name |Type |Default value |Required |Description @@ -2255,10 +2160,15 @@ The `portals` group contains the user portal settings. |object |❌ |✅ -//|Налаштування IIT-віджету авторизації для кабінетів користувачів. -//TODO: ua-specific, generalized |The user portal's authentication widget settings. +|`individualAccessEnabled` +|bool +|❌ +|❌ +//|Визначає можливість використовування кабінету надавача послуг фізичною особою +|Determines if user can use officer portal with personal individual key + |=== [[customdns-spec]] @@ -2271,14 +2181,14 @@ The `portals` group contains the user portal settings. |bool |❌ |✅ -//|Визначає наявніть або відсутність заданого власного DNS-імені для кабінету. + |Determines whether a custom DNS name for the user portal is enabled. |`host` |string |❌ |❌ -//|Визначає хост власного DNS-імені для кабінету. + |The user portal's custom DNS hostname. |=== @@ -2293,41 +2203,38 @@ The `portals` group contains the user portal settings. |string |❌ |✅ -//|Визначає посилання на віджет автентифікації. + |The authentication widget URL. |`height` |object |❌ |✅ -//|Визначає візуальну висоту віджету автентифікації. + |The authentication widget height. |`copyFromAuthWidget` |bool |❌ |✅ -//TODO: Missing description + | |=== -//== Специфікація технічної yaml конфігурації реєстру (values.gotmpl) == Registry technical yaml configuration specification (values.gotmpl) [[registry-gotmpl]] -//У цьому розділі наведено список технічних параметрів реєстру. Їх значення встановлюються з використанням шаблонів для параметризації, що може мати вигляд `{{ env "" }}` — для визначення значення зі змінних оточення або виду `{{ $cluster_version := exec ... }}` — для виконання команди під час запуску пайплайну. This section lists the technical parameters of the registry. Their values are set using parameterization templates, which can take one of the following forms: * `{{ env "" }}` to get values from environment variables. * `{{ $cluster_version := exec ... }}` to execute a command during pipeline execution. -//IMPORTANT: Власноруч вносити зміни в цей файл не рекомендується. IMPORTANT: We do not recommend making changes to this file manually. [[parent-tech-params]] [cols="20%,15%,10%,10%,60%",options="header",caption=] -//.Технічні параметри реєстру + .Registry technical parameters |=== |Name |Type |Default value |Required |Description @@ -2336,84 +2243,84 @@ IMPORTANT: We do not recommend making changes to this file manually. |object |❌ |✅ -//|Глобальні налаштування реєстру + |Global registry settings. |`<>` |object |❌ |✅ -//|Містить налаштування центрального сервісу управління секретами реєстру. + |Contains settings for the registry's central _Secrets management service_. |`<>` |object |❌ |✅ -//|Містить налаштування S3-клієнту для взаємодії з S3 сховищем. + |Contains S3 client settings for interaction with S3 storage. |`<>` |object |❌ |✅ -//|Містить налаштування реєстру. + |Contains registry settings. |`namespace` |string |❌ |✅ -//|Визначає зі специфікації `codebase` назву OKD namespace для розгортання компонентів підсистем та налаштувань в залежності від приналежності до реєстру. + |Defines the name of the OKD namespace for deploying subsystem components and configurations from the `codebase` specification based on whether they belong to the registry. |`baseDomain` |string |❌ |✅ -//|Отримує та встановлює базовий домен кластера OKD. Усі керовані записи DNS в кластері будуть піддоменами цього базового домену. Після розгортання кластера OKD, це значення не можна змінювати. Наприклад, `openshift.example.com`. + |Receives and sets the base domain of the OKD cluster -- for example, `openshift.example.com`. All managed DNS records in the cluster become subdomains of the base domain. After the OKD cluster is deployed, this value cannot be changed. |`dnsWildcard` |string |❌ |✅ -//|Піддомен базового домена кластера OKD для маршрутизації трафіку до застосунків Платформи та реєстрів. Наприклад, `apps.openshift.example.com` + |A subdomain of the base domain of the OKD cluster for routing traffic to Platform and registry applications -- for example, `apps.openshift.example.com`. |`cdPipelineName` |string |❌ |✅ -//|Назва Платформного CD пайплайну. Є сутністю xref:arch:architecture/platform-technologies.adoc#edp-codebase-operator[EDP] і частиною обслуговуючого пайплайну процесів розгортання реєстру. + |The name of the Platform CD pipeline. This is an xref:arch:architecture/platform-technologies.adoc#edp-codebase-operator[EDP] entity and part of the servicing pipeline of the registry deployment processes. |`dockerRegistry` |string |❌ |✅ -//|Містить URL до `control-plane-nexus` — сховища артефактів Платформи. + |The URL for the `control-plane-nexus` Platform artifacts repository. |`dockerProxyRegistry` |string |❌ |✅ -//|Містить URL до `control-plane-nexus` — сховища артефактів Платформи. + |The URL for the `control-plane-nexus` Platform artifacts repository. |`edpProject` |string |❌ |✅ -//|Визначає з параметрів технічного пайплайну назву OKD namespace для розгортання компонентів підсистем та налаштувань в залежності від приналежності до Платформи або реєстру. + |Defines the name of the OKD namespace for deploying subsystem components and configurations from the technical pipeline parameters based on whether they belong to the Platform or registry. |`stageName` |string |❌ |✅ -//|Назва етапу реєстрового CD пайплайну. Є сутністю EDP і частиною обслуговуючого пайплайну процесів розгортання реєстру. + |The name of the registry CD pipeline stage. This is an EDP entity and part of the servicing pipeline of the registry deployment processes. |=== @@ -2428,73 +2335,70 @@ IMPORTANT: We do not recommend making changes to this file manually. |string |❌ |✅ -//|Автоматично визначає поточну версію OKD кластеру. + |Automatically determines the current version of the OKD cluster. |`storageClass` |string |ocs-storagecluster-ceph-rbd |✅ -//|Містить назву `StorageClass` що використовується в кластерів OKD за замовчуванням. + |Contains the `StorageClass` name used in the OKD cluster by default. |`imageRegistry` |string |❌ |✅ -//|Містить URL до `control-plane-nexus` — сховища артефактів Платформи. + |The URL for the `control-plane-nexus` Platform artifacts repository. -//TODO: Missing anchor: nexus |`<>` |object |❌ |✅ -//|❌ Застарілий параметр. Буде видалений в наступних версіях Платформи. + |❌ A deprecated parameter. Will be discontinued in the future Platform versions. -//TODO: Missing anchor: jenkins |`<>` |object |❌ |✅ -//|❌ Застарілий параметр. Буде видалений в наступних версіях Платформи. + |❌ A deprecated parameter. Will be discontinued in the future Platform versions. -//TODO: Missing anchor: gerrit |`<>` |object |❌ |✅ -//|❌ Застарілий параметр. Буде видалений в наступних версіях Платформи. + |❌ A deprecated parameter. Will be discontinued in the future Platform versions. |`<>` |object |❌ |✅ -//|Налаштування підсистеми асинхронного обміну повідомленнями. + |_Asynchronous messaging subsystem_ configuration. |`<>` |object |❌ |✅ -//|Параметри налаштувань підсистеми управління реляційними базами даних. + |_Relational database management subsystem_ configuration. |`<>` |object |❌ |✅ -//|Містить реєстрові налаштування. + |Contains registry settings. |`<>` |object |❌ |✅ -//|Містить загальні налаштування підсистеми поштових повідомлень. + |The _Email messaging subsystem's_ general settings. |=== @@ -2509,14 +2413,14 @@ IMPORTANT: We do not recommend making changes to this file manually. |object |❌ |✅ -//|Налаштування Redis. + |Redis settings. |`<>` |object |❌ |✅ -//|Налаштування Redis Sentinel. + |Redis Sentinel settings. |=== @@ -2531,14 +2435,14 @@ IMPORTANT: We do not recommend making changes to this file manually. |string |❌ |✅ -//|Визначає кількість екземплярів Redis. + |The number of Redis instances. |`<>` |string |❌ |✅ -//|Визначає налаштування контейнерів екземплярів Redis. + |Defines the Redis instance containers configuration. |=== @@ -2553,7 +2457,7 @@ IMPORTANT: We do not recommend making changes to this file manually. |[]object |["maxmemory 500m"] |✅ -//|Визначає додаткові налаштування для Redis контейнера. + |Defines additional settings for the Redis container. |=== @@ -2568,7 +2472,7 @@ IMPORTANT: We do not recommend making changes to this file manually. |string |❌ |✅ -//|Визначає кількість екземплярів Sentinel. + |The number of Sentinel instances. |=== @@ -2583,7 +2487,7 @@ IMPORTANT: We do not recommend making changes to this file manually. |object |❌ |✅ -//|Містить налаштування підсистеми поштових повідомлень. + |Contains the _Email messaging subsystem_ settings. |=== @@ -2598,7 +2502,7 @@ IMPORTANT: We do not recommend making changes to this file manually. |string |❌ |✅ -//|Визначає SMTP-пароль до підсистеми поштових повідомлень. + |The SMTP password for the _Email messaging subsystem_. |=== @@ -2613,7 +2517,7 @@ IMPORTANT: We do not recommend making changes to this file manually. |object |❌ |✅ -//|Містить налаштування екземплярів підсистеми управління реляційними базами даних. + |The _Relational database management subsystem's_ instances configuration. @@ -2621,7 +2525,7 @@ IMPORTANT: We do not recommend making changes to this file manually. |object |❌ |✅ -//|Містить налаштування сховища резервних копій підсистеми управління реляційними базами даних. + |Contains the _Relational database management subsystem's_ backup storage configuration. |=== @@ -2636,14 +2540,14 @@ IMPORTANT: We do not recommend making changes to this file manually. |object |❌ |✅ -//|Містить налаштування операційних екземплярів БД підсистеми управління реляційними базами даних. + |Contains the _Relational database management subsystem's_ operational DB instance settings. |`<>` |object |❌ |✅ -//|Містить налаштування аналітичних екземплярів БД підсистеми управління реляційними базами даних. + |Contains the _Relational database management subsystem's_ analytical DB instance settings. |=== @@ -2658,7 +2562,7 @@ IMPORTANT: We do not recommend making changes to this file manually. |int |❌ |✅ -//|Визначає кількість екземплярів відповідних БД підсистеми управління реляційними базами даних. + |The number of relevant DB instances of the _Relational database management subsystem_. |=== @@ -2673,14 +2577,14 @@ IMPORTANT: We do not recommend making changes to this file manually. |string |❌ |✅ -//|Містить налаштування сховища сервісу асинхронного обміну повідомленнями. + |_Asynchronous messaging service's_ storage settings. |`bucketName` |string |❌ |✅ -//|Містить налаштування сховища сервісу асинхронного обміну повідомленнями. + |_Asynchronous messaging service's_ storage settings. |=== @@ -2695,35 +2599,35 @@ IMPORTANT: We do not recommend making changes to this file manually. |object |❌ |✅ -//|Містить налаштування сховища сервісу асинхронного обміну повідомленнями. + |_Asynchronous messaging service's_ storage settings. |`kafkaBrokers` |int |3 |✅ -//|Визначає кількість екземплярів Kafka брокерів. + |The number of Kafka broker instances. |`zookeepers` |int |3 |✅ -//|Визначає кількість екземплярів Zookeepers. + |The number of Zookeeper instances. |`replicationFactor` |int |3 |✅ -//|Налаштовує фактор реплікації Kafka що визначає кількість копій даних, які зберігаються в кількох брокерах Kafka. + |Configures the Kafka replication factor that determines the number of data copies stored across multiple Kafka brokers. |`kafkaCentralNamespace` |string |❌ |✅ -//|Визначає namespace компонента Kafka. + |The namespace of the Kafka component. |=== @@ -2738,7 +2642,7 @@ IMPORTANT: We do not recommend making changes to this file manually. |object |❌ |✅ -//|Містить налаштування Kafka Zookeeper. + |Contains Kafka Zookeeper settings. |=== @@ -2753,7 +2657,7 @@ IMPORTANT: We do not recommend making changes to this file manually. |string |5Gi |✅ -//|Визначає розмір сховища Kafka Zookeeper. + |The size of the Kafka Zookeeper storage. |=== @@ -2768,7 +2672,7 @@ IMPORTANT: We do not recommend making changes to this file manually. |object |❌ |✅ -//|Містить налаштування безпеки реєстру. + |Contains registry security settings. |=== @@ -2783,7 +2687,7 @@ IMPORTANT: We do not recommend making changes to this file manually. |object |❌ |✅ -//|Містить налаштування захисту від підробки запитів Cross-Site Request Forgery (CSRF). + |Contains Cross-Site Request Forgery (CSRF) protection settings. |=== @@ -2798,7 +2702,7 @@ IMPORTANT: We do not recommend making changes to this file manually. |bool |true |✅ -//|Визначає чи ввімкнений або вимкнений захист від підробки запитів Cross-Site Request Forgery (CSRF). + |Determines whether the Cross-Site Request Forgery (CSRF) protection is enabled. |=== @@ -2813,7 +2717,7 @@ IMPORTANT: We do not recommend making changes to this file manually. |object |❌ |✅ -//|Містить налаштування S3-клієнту реєстрових компонентів для коректної взаємодії з S3 сховищем. + |Contains the registry components' S3 client settings for correct interaction with the S3 storage. |=== @@ -2828,14 +2732,14 @@ IMPORTANT: We do not recommend making changes to this file manually. |object |❌ |✅ -//|Містить налаштування S3-клієнту реєстрових компонентів для коректної взаємодії з S3 сховищем. + |Contains the registry components' S3 client settings for correct interaction with the S3 storage. |`<>` |object |❌ |✅ -//|Містить налаштування S3-клієнту реєстрових компонентів для коректної взаємодії з S3 сховищем. + |Contains the registry components' S3 client settings for correct interaction with the S3 storage. |=== @@ -2850,7 +2754,7 @@ IMPORTANT: We do not recommend making changes to this file manually. |object |http |✅ -//|Визначає протокол взаємодії S3-клієнта та сервера. + |Defines the S3 client and server interaction protocol. |=== @@ -2865,7 +2769,7 @@ IMPORTANT: We do not recommend making changes to this file manually. |object |true |✅ -//|Вмикає доступ типу `path-style` до сегментів S3-бакетів. + |Enables `path-style` access to S3 bucket segments. |=== @@ -2880,28 +2784,28 @@ IMPORTANT: We do not recommend making changes to this file manually. |string |❌ |✅ -//|Містить токен доступу до центрального сервісу управління секретами Платформи. + |Contains the access token for the Platform's central _Secrets and encryption management service_. |`openshiftApiUrl` |string |❌ |✅ -//|Містить URL до OKD API-сервера. + |The OKD API server URL. |`centralVaultUrl` |string |❌ |✅ -//|Містить URL до центрального сервісу управління секретами Платформи. + |The Platform's central _Secrets and encryption management service_ URL. |`<>` |object |❌ |✅ -//|Налаштування розгортання реєстрового Vault. + |Registry Vault deployment configuration. |=== @@ -2916,14 +2820,14 @@ IMPORTANT: We do not recommend making changes to this file manually. |string |❌ |✅ -//|Налаштування сховища для реєстрового Vault. + |Registry Vault storage configuration. |`<>` |string |❌ |✅ -//|Налаштування аудит-сховища для реєстрового Vault. + |Registry Vault audit storage configuration. |=== @@ -2938,7 +2842,7 @@ IMPORTANT: We do not recommend making changes to this file manually. |string |ocs-storagecluster-ceph-rbd |✅ -//|Містить назву `StorageClass` що використовується для розгортання Vault за замовчуванням. + |Contains the `StorageClass` name used in Vault deployment by default. |=== diff --git a/docs/en/modules/arch/pages/architecture/platform/administrative/control-plane/overview.adoc b/docs/en/modules/arch/pages/architecture/platform/administrative/control-plane/overview.adoc index 39473465b9..bcf03e314a 100644 --- a/docs/en/modules/arch/pages/architecture/platform/administrative/control-plane/overview.adoc +++ b/docs/en/modules/arch/pages/architecture/platform/administrative/control-plane/overview.adoc @@ -59,7 +59,7 @@ Each of the components of the subsystem and the connections with other subsystem //.Діаграма компонентів підсистеми .Diagram of subsystem components -image::architecture/platform/administrative/control-plane/control-plane.png[width=600,float="center",align="center"] +image::architecture/platform/administrative/control-plane/control-plane.drawio.svg[width=600,float="center",align="center"] //== Складові підсистеми [#subsystem-components] @@ -105,7 +105,7 @@ subsystem component. |`documentation` |`ddm-architecture` |origin -|https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/general/ddm-architecture[gerrit:/mdtu-ddm/general/ddm-architecture] +|https://github.com/epam/edp-ddm-architecture[github:/epam/edp-ddm-architecture] |A complete collection of architecture documentation and articles containing how-tos, feature descriptions, and APIs, use cases and other information necessary to understand and use the Registries Platform. diff --git a/docs/en/modules/arch/pages/architecture/platform/administrative/overview.adoc b/docs/en/modules/arch/pages/architecture/platform/administrative/overview.adoc index 742e609ff4..94043a81ba 100644 --- a/docs/en/modules/arch/pages/architecture/platform/administrative/overview.adoc +++ b/docs/en/modules/arch/pages/architecture/platform/administrative/overview.adoc @@ -9,30 +9,24 @@ The *_Platform administrative zone_* comprises subsystems that manage the state and settings of the Platform instance and its deployed registries. We utilize the _**GitOps** approach_ to handle updates. This method automatically applies modifications to the appropriate version control repositories. -//_Підсистема управління Платформою та Реєстрами_ адміністративної зони надає веб-інтерфейси для адміністраторів, за допомогою яких можна керувати оновленням, конфігурацією, масштабуванням, резервним копіюванням, відновленням та іншими службовими функціями _Платформи_. _The Platform and registries management subsystem_ in the administrative zone offers web interfaces for administrators to manage updates, configurations, scalability, backup, restoration, and other service functions. [TIP] -- -//Детальніше з ролями службових адміністраторів можна ознайомитись у розділі xref:arch:architecture/platform/operational/user-management/platform-actors-roles.adoc#_службові_адміністратори[Актори та ролі Платформи]. For more information on the roles of service administrators, please refer to the xref:arch:architecture/platform/operational/user-management/platform-actors-roles.adoc#службові_адміністратори[Actors and roles section of the Platform]. -- == Technical design -//На даній діаграмі зображено підсистеми, які входять в _Адміністративну зону Платформи_ та їх взаємодію з іншими підсистемами в рамках реалізації функціональних сценаріїв. This diagram illustrates the subsystems that are part of the Platform administrative zone and their interactions with other subsystems in the implementation of functional scenarios. image::architecture/platform/administrative/administrative-zone-subsystems.svg[] -//== Підсистеми адміністративної зони Платформи == Platform administrative zone subsystems |=== -//|Назва підсистеми|Службова назва |Subsystem name|Service name -//|xref:architecture/platform/administrative/control-plane/overview.adoc[Підсистема управління Платформою та реєстрами] |xref:architecture/platform/administrative/control-plane/overview.adoc[] |_control-plane_ diff --git a/docs/en/modules/arch/pages/architecture/platform/operational/backup-recovery/overview.adoc b/docs/en/modules/arch/pages/architecture/platform/operational/backup-recovery/overview.adoc index 3d94eca828..c18e7af281 100644 --- a/docs/en/modules/arch/pages/architecture/platform/operational/backup-recovery/overview.adoc +++ b/docs/en/modules/arch/pages/architecture/platform/operational/backup-recovery/overview.adoc @@ -5,59 +5,24 @@ include::platform:ROOT:partial$admonitions/language-en.adoc[] == Overview -//Підсистема, що забезпечує безпечне резервне копіювання та відновлення реєстрових та центральних компонентів Платформи, виконання аварійного відновлення Реєстру. -Subsystem that provides safe backup copy and restore operations for Registry and central Platform components, and performs Registry disaster recovery. +Subsystem that provides safe backup copy and restore operations for Registry and central Platform components and performs Registry disaster recovery. == Subsystem functions -//* Безпечне резервне копіювання та відновлення центральних і реєстрових компонентів Платформи реєстрів * Safe backup copy and restore operations for Registry and central Platform components -//* Безпечне резервне копіювання та відновлення даних реєстрів * Safe backup copy and restore operations for Registry data -//* Відновлення центральних та реєстрових компонентів Платформи реєстрів * Recovery of Registry and central Platform components -//* Виконання аварійного відновлення функціонування Платформи реєстрів * Registry operation disaster recovery -//* Міграція ресурсів реєстру на інший екземпляр Платформи реєстрів * Registry resources migration to another Registry Platform instance == Subsystem technical design -//На даній діаграмі зображено компоненти, які входять в _Підсистему резервного копіювання та відновлення_ та їх взаємодію з іншими підсистемами. -The following diagram displays the components that are included in _Backup and restore subsystem_, and their interaction with other subsystems within functional scenarios realization. +The following diagram displays the components included in the _Backup and restore subsystem_and their interaction with other subsystems within functional scenarios realization. image::architecture/platform/operational/backup-recovery/backup-subsystem.drawio1.svg[width=800,float="center",align="center"] == Subsystem components - -//// -|=== -|Назва компоненти|Namespace|Deployment|Походження|Репозиторій|Призначення - -|_Сервіс резервного копіювання та відновлення_ -|`velero` -|`velero` -|3rd-party -|https://github.com/epam/edp-ddm-backup-management[github:/epam/edp-ddm-backup-management] -|Компонент резервного копіювання та відновлення ресурсів у кластері - -|_Служба відновлення обʼєктів S3_ -|`velero` -|`restore-job` -|origin -|https://github.com/epam/edp-ddm-backup-management[github:/epam/edp-ddm-backup-management] -|Служба відновлення обʼєктів S3 реєстру - -|_Служба реплікації обʼєктів S3_ -|`velero` -|`replication-job` -|origin -|https://github.com/epam/edp-ddm-backup-management[github:/epam/edp-ddm-backup-management] -|Служба резервної реплікації обʼєктів S3 реєстру -|=== -//// - |=== |Component name|Namespace|Deployment|Source|Repository|Function @@ -83,29 +48,24 @@ image::architecture/platform/operational/backup-recovery/backup-subsystem.drawio |Replication service for the S3 objects of the Registry |=== - -//== Технологічний стек == Technological stack -//При проектуванні та розробці підсистеми, були використані наступні технології: The following technologies were used in system design and development: * xref:arch:architecture/platform-technologies.adoc#velero[Velero] * xref:arch:architecture/platform-technologies.adoc#okd[OKD] * xref:arch:architecture/platform-technologies.adoc#bash[bash] -//== Атрибути якості підсистеми == Subsystem quality attributes === _Reliability_ -//Підсистема резервного копіювання та відновлення розроблена із забезпеченням надійності створення резервних копій та надає можливість виконання резервного копіювання та відновлювальних операцій систематично та за потребою. -Backup and restore subsystem was designed to provide reliable creation of backup copies, and allows for the use of backup and recovery operations systematically, and on demand. + +The _Backup and restore subsystem_ was designed to provide reliable creation of backup copies and allows for the use of backup and recovery operations systematically and on demand. === _Scalability_ -//Підсистема резервного копіювання та відновлення має можливість працювати з великими обсягами даних реєстрів та Платформи та постійно зростаючими обʼємами даних. -Backup and restore subsystem can operate with large volumes of Registry and Platform data, as well as continuously growing amounts of data. + +The _Backup and restore subsystem_ can operate with large volumes of Registry and Platform data and continuously growing amounts of data. === _Recoverability_ -//Підсистема резервного копіювання та відновлення надає Платформі реєстрів можливість аварійно відновити дані реєстру та Платформи у випадку відмови або при виникненні нештатної ситуації. -Backup and restore subsystem allows the Registry Platform to recover Platform and Registry data in case of failure, or unplanned situations. +_Backup and restore subsystem_ allows the Registry Platform to recover Platform and Registry data in case of failure or unplanned situations. \ No newline at end of file diff --git a/docs/en/modules/arch/pages/architecture/platform/operational/secret-management/overview.adoc b/docs/en/modules/arch/pages/architecture/platform/operational/secret-management/overview.adoc index a5482634c2..629eecc01c 100644 --- a/docs/en/modules/arch/pages/architecture/platform/operational/secret-management/overview.adoc +++ b/docs/en/modules/arch/pages/architecture/platform/operational/secret-management/overview.adoc @@ -5,26 +5,20 @@ include::platform:ROOT:partial$admonitions/language-en.adoc[] == Overview -//Підсистема безпечного зберігання чутливої інформації та контролю доступу до токенів, паролів, сертифікатів та ключів шифрування Платформи та Реєстрів. -The subsystem for the storing of critical data and access control to tokens, passwords, certificates, and encryption keys for the Platform and Registries. +The *_Secret and encryption management subsystem_* stores sensitive data and controls access to tokens, passwords, certificates, and encryption keys for the Platform and registries. -//== Функції підсистеми == Subsystem functions -//* Зберігання токенів, паролів, сертифікатів -* Storing of tokens, passwords, certificates -//* Надання підсистемі моделювання регламенту реєстру ключів шифрування -* Provision of encryption keys to the regulations modeling subsystem -//* Контроль доступу до чутливої інформації збереженої в підсистемі -* Access control to the critical data stored in the subsystem +* Storing tokens, passwords, and certificates +* Provisioning encryption keys to the Registry regulations modeling subsystem +* Access control to the sensitive data stored in the subsystem -//== Технічний дизайн підсистеми == Subsystem technical design -image::architecture/platform/operational/secret-management/secret-management.drawio.png[width=600,float="center",align="center"] +image::architecture/platform/operational/secret-management/secret-management.drawio.svg[width=600,float="center",align="center"] //_Підсистема управління секретами та шифруванням_ складається з сервісу управління секретами та шифруванням HashiCorp Vault. -_Secret and encryption management subsystem_ is comprised of HashiCorp Vault secret and encryption management service. +_Secret and encryption management subsystem_ comprises HashiCorp Vault secret and encryption management service. [NOTE] -- @@ -68,6 +62,14 @@ _HashiCorp Vault_ is unsealed automatically in the Platform, using the _Secret a |3rd-party |https://github.com/epam/edp-ddm-platform-vault[github:/epam/edp-ddm-platform-vault] |The instrument for secure secret management, and critical data access protection in computing environments. + +|_Certificate management service_ +|`cert-manager` +|`cert-manager` +|3rd-party +|https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/infrastructure/service-mesh[gerrit:/mdtu-ddm/infrastructure/service-mesh] +|The instrument for managing certificates and certificate issuers as resource types in Kubernetes and OKD clusters. + |=== //== Технологічний стек @@ -77,6 +79,7 @@ _HashiCorp Vault_ is unsealed automatically in the Platform, using the _Secret a The following technologies were used in subsystem design and development: * xref:arch:architecture/platform-technologies.adoc#vault[HashiCorp Vault] +* xref:arch:architecture/platform-technologies.adoc#cert-manager[cert-manager] //== Атрибути якості підсистеми == Subsystem quality attributes diff --git a/docs/en/modules/arch/pages/architecture/platform/operational/service-mesh/overview.adoc b/docs/en/modules/arch/pages/architecture/platform/operational/service-mesh/overview.adoc index 3b4cf61943..cd74305986 100644 --- a/docs/en/modules/arch/pages/architecture/platform/operational/service-mesh/overview.adoc +++ b/docs/en/modules/arch/pages/architecture/platform/operational/service-mesh/overview.adoc @@ -45,7 +45,7 @@ and to analyze the operation of components of the registers and the Platform, in //== Технічний дизайн підсистеми == Subsystem technical design -image::architecture/platform/operational/service-mesh/service-mesh-subsystem.svg[width=600,float="center",align="center"] +image::architecture/platform/operational/service-mesh/service-mesh-subsystem.drawio.svg[width=600,float="center",align="center"] //== Компоненти підсистеми [#subsystem-components] diff --git a/docs/en/modules/arch/pages/architecture/registry/administrative/ext-api-management/overview.adoc b/docs/en/modules/arch/pages/architecture/registry/administrative/ext-api-management/overview.adoc index 55f3592bdd..cdbc451af0 100644 --- a/docs/en/modules/arch/pages/architecture/registry/administrative/ext-api-management/overview.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/administrative/ext-api-management/overview.adoc @@ -5,18 +5,7 @@ include::platform:ROOT:partial$admonitions/language-en.adoc[] == General description -//Підсистема, призначенням якої є управління зовнішнім трафіком та контроль доступу до API сервісів адміністративної зони Реєстру. -The subsystem, the purpose of which is to manage external traffic and control access to the API services of the administrative zone of the Registry. - -//// -== Функції підсистеми - -* Аутентифікація та авторизація запитів -* Маршрутизація трафіку до API-сервісів підсистем адміністративної зони реєстру -* Налаштування та контроль рейт-лімітів -* Трансформація запитів та відповідей -* Логування вхідних запитів -//// +The subsystem manages external traffic and controls access to the API services of the Registry administrative zone. == Subsystem functions @@ -33,38 +22,13 @@ image::architecture/registry/administrative/ext-api-management/registry-admin-ex [#subsystem-components] == Subsystem components -//// -|=== -|Назва компоненти|Представлення в реєстрі|Походження|Репозиторій|Призначення - -|_Зовнішній API-шлюз адміністративної зони_ -|`kong-admintools-kong` -|3rd-party -|https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/general/kong-admin-tools[gerrit:/mdtu-ddm/general/kong-admin-tools] -|Забезпечує керування трафіком, авторизацію, контроль доступу до API, балансування навантаження, -перетворення запитів/відповідей та аналітику/моніторинг. - -|_ServiceMesh шлюз_ -|`istio-ingressgateway` -|3rd-party -|https://github.com/istio/proxy[github:/istio/proxy] -|Мережевий шлюз що працює на межі istio service-mesh та отримує вхідні з'єднання HTTP/TCP. - -|xref:arch:architecture/registry/administrative/ext-api-management/redis-storage.adoc#_sessions_admin_tools[__Операційне сховище сесій користувача__] -|`redis:sessions_admin_tools` -|3rd-party -|- -|Зберігання користувацьких JWT-токенів -|=== -//// - |=== |Component name|Representation in the register|Source|Repository|Appointment |_Administrative zone external API gateway_ |`kong-admintools-kong` |3rd-party -|https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/general/kong-admin-tools[gerrit:/mdtu-ddm/general/kong-admin-tools] +|https://github.com/epam/edp-ddm-kong-admin-tools[github:/epam/edp-ddm-kong-admin-tools] |Provides traffic management, authorization, API access control, load balancing, request/response conversion and analytics/monitoring. @@ -81,12 +45,8 @@ request/response conversion and analytics/monitoring. |Storage of custom JWT tokens |=== - - -//== Технологічний стек == Technology stack -//При проектуванні та розробці підсистеми, були використані наступні технології: During the design and development of the subsystem, the following technologies were used: * xref:arch:architecture/platform-technologies.adoc#kong[Kong] @@ -94,29 +54,23 @@ During the design and development of the subsystem, the following technologies w * xref:arch:architecture/platform-technologies.adoc#redis[Redis] * xref:arch:architecture/platform-technologies.adoc#istio[Istio ServiceMesh] -//== Атрибути якості підсистеми == Subsystem quality attributes === Scalability -//Підсистема управління зовнішнім трафіком адміністративної зони реєстру підтримує як горизонтальне, так і вертикальне масштабування. The external traffic management subsystem of the registry administrative zone supports both horizontal and vertical scaling. [TIP] -- -//Детальніше з масштабуванням підсистем можна ознайомитись у розділі xref:architecture/container-platform/container-platform.adoc[] You can read more about scaling subsystems in the section xref:architecture/container-platform/container-platform.adoc[] -- === Observability -//Підсистема управління зовнішнім трафіком адміністративної зони реєстру підтримує журналювання вхідних запитів та збір метрик продуктивності для -//подальшого аналізу через веб-інтерфейси відповідних підсистем Платформи. The external traffic management subsystem of the registry administrative zone supports the logging of incoming requests and the collection of performance metrics for further analysis through the web interfaces of the corresponding subsystems of the Platform. [TIP] -- -//Детальніше з дизайном підсистем можна ознайомитись у відповідних розділах: You can read more about the design of subsystems in the relevant sections: * xref:arch:architecture/platform/operational/logging/overview.adoc[] @@ -125,14 +79,10 @@ You can read more about the design of subsystems in the relevant sections: === Portability -//Підсистема управління зовнішнім трафіком адміністративної зони реєстру може бути перенесена, розгорнута та керована однаково та надійно на різних -//платформах оркестрації контейнерів що розгорнуті в різних хмарних середовищах або власній інфраструктурі в дата-центрі. - The external traffic management subsystem of the registry administrative zone can be migrated, deployed and managed uniformly and reliably on different container orchestration platforms deployed in various cloud environments or own infrastructure in the data center. [TIP] -- -//Детальніше можна ознайомитись у розділі xref:arch:architecture/container-platform/container-platform.adoc[Платформа оркестрації контейнерів] -For more information, see xref:arch:architecture/container-platform/container-platform.adoc [Container Orchestration Platform] +For more information, see the xref:arch:architecture/container-platform/container-platform.adoc[Container orchestration platform]. -- diff --git a/docs/en/modules/arch/pages/architecture/registry/administrative/ext-api-management/redis-storage.adoc b/docs/en/modules/arch/pages/architecture/registry/administrative/ext-api-management/redis-storage.adoc index e3c6befc99..190ed38dde 100644 --- a/docs/en/modules/arch/pages/architecture/registry/administrative/ext-api-management/redis-storage.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/administrative/ext-api-management/redis-storage.adoc @@ -1,22 +1,12 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Non-relational data storage +include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] -NOTE: 🌐 This document is available in both English and Ukrainian. Use the language toggle in the top right corner to switch between versions. +include::platform:ROOT:partial$admonitions/language-en.adoc[] -//== Загальний опис == General description //_xref:arch:architecture/registry/administrative/ext-api-management/overview.adoc[Підсистема управління зовнішнім трафіком адміністративної зони реєстру]_ використовує розподілену _in-memory_ базу даних xref:arch:architecture/platform-technologies.adoc#redis[Redis] з xref:arch:architecture/registry/operational/nonrelational-data-storage/overview.adoc[_Підсистеми управління нереляційними базами даних_] для зберігання даних сесій користувачів (_JWT_-токенів). -_xref:arch:architecture/registry/administrative/ext-api-management/overview.adoc[Registry administrative zone external traffic management subsystem]_ uses a distributed _in-memory_ database xref:arch:architecture/platform-technologies.adoc#redis[ Redis] with xref:arch:architecture/registry/operational/nonrelational-data-storage/overview.adoc[_Non-relational database management subsystems_] for storing user session data (_JWT_-tokens). +_xref:arch:architecture/registry/administrative/ext-api-management/overview.adoc[The external traffic management subsystem of the Registry administrative zone]_ uses a distributed _in-memory_ database xref:arch:architecture/platform-technologies.adoc#redis[ Redis] with xref:arch:architecture/registry/operational/nonrelational-data-storage/overview.adoc[_Non-relational database management subsystems_] for storing user session data (_JWT_-tokens). [NOTE] -- //Детальніше з технічним підходом можна ознайомитися @@ -27,6 +17,7 @@ xref:arch:architecture/registry/operational/ext-api-management/api-gateway/kong- //== Структури даних == Data structure +[session-admin-tools] === sessions_admin_tools //Зберігання користувацьких _JWT_-токенів, ключ зберігається як стрічка в _HEX_-форматі. diff --git a/docs/en/modules/arch/pages/architecture/registry/administrative/ext-api-management/registry-admin-routes.yaml.adoc b/docs/en/modules/arch/pages/architecture/registry/administrative/ext-api-management/registry-admin-routes.yaml.adoc index 32fc97dc43..681d15c7d7 100644 --- a/docs/en/modules/arch/pages/architecture/registry/administrative/ext-api-management/registry-admin-routes.yaml.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/administrative/ext-api-management/registry-admin-routes.yaml.adoc @@ -1,16 +1,7 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Kong API gateway: route structure for external administrative endpoints +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] -NOTE: 🌐 This document is available in both English and Ukrainian. Use the language toggle in the top right corner to switch between versions. +include::platform:ROOT:partial$admonitions/language-en.adoc[] //Цей документ містить інформацію про загальні положення при формуванні зовнішніх точок доступу адміністративних ендпоінтів. This document contains information about the general provisions for the formation of external access points of administrative endpoints. diff --git a/docs/en/modules/arch/pages/architecture/registry/administrative/operational-maintenance/overview.adoc b/docs/en/modules/arch/pages/architecture/registry/administrative/operational-maintenance/overview.adoc index 3b9f41e090..2f7ccda684 100644 --- a/docs/en/modules/arch/pages/architecture/registry/administrative/operational-maintenance/overview.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/administrative/operational-maintenance/overview.adoc @@ -3,13 +3,11 @@ include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] -//== Загальний опис -== General overview +== Overview //Підсистема, яка реалізує інтерфейси користувача для адміністрування операційної діяльності сервісів реєстру, ідентифікації та вирішення проблем виконання бізнес-процесів, контролю за накопиченням повідомлень у чергах, управління схемою бази даних реєстру, тощо. This subsystem implements user interfaces for administering the operational activities of registry services, identification, and resolution of issues in executing business processes, monitoring message queue accumulation, and managing the registry database schema, among others. -//== Функції підсистеми == Subsystem functions //* Перегляд стану черг _Підсистеми асинхронного обміну повідомленнями_ diff --git a/docs/en/modules/arch/pages/architecture/registry/administrative/operational-maintenance/services/business-process-administration-portal/building-blocks.adoc b/docs/en/modules/arch/pages/architecture/registry/administrative/operational-maintenance/services/business-process-administration-portal/building-blocks.adoc index b014e3c7c2..2f47d2e375 100644 --- a/docs/en/modules/arch/pages/architecture/registry/administrative/operational-maintenance/services/business-process-administration-portal/building-blocks.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/administrative/operational-maintenance/services/business-process-administration-portal/building-blocks.adoc @@ -1,21 +1,16 @@ -//= Структура компонента = Component structure include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] -//== Взаємодія з сервісами платформи == Interaction with Platform services image::arch:architecture/registry/administrative/operational-maintenance/services/business-process-administration-portal/business-process-administration-portal.svg[] -//.Критичні залежності: -.Critical dependencies: -//* *База даних Postgres* - яка піднята у іншій поді (citus-master), впливає на весь функціонал веб-сервісу. -* *Postgres database* - running in a separate pod (citus-master), affecting the entire functionality of the web service. +[NOTE,caption="Critical dependencies"] +_Postgres database_ running on a separate pod (`citus-master`), affecting the entire functionality of the web service. -//== Модульна / структурна діаграма -== Modular / structural diagram +== Modular/structural diagram image::arch:architecture/registry/administrative/operational-maintenance/services/business-process-administration-portal/microservice-internals.svg[] @@ -42,4 +37,4 @@ image::arch:architecture/registry/administrative/operational-maintenance/service [NOTE] //Більш детальніше ознайомитися зі стеком технологій можна xref:arch:architecture/registry/administrative/operational-maintenance/services/business-process-administration-portal/technologies.adoc[тут] -For more detailed information about the technology stack, you can refer to xref:arch:architecture/registry/administrative/operational-maintenance/services/business-process-administration-portal/technologies.adoc[]. +For detailed information about the technology stack, see xref:arch:architecture/registry/administrative/operational-maintenance/services/business-process-administration-portal/technologies.adoc[Technology stack]. diff --git a/docs/en/modules/arch/pages/architecture/registry/administrative/operational-maintenance/services/business-process-administration-portal/deployment-diagram.adoc b/docs/en/modules/arch/pages/architecture/registry/administrative/operational-maintenance/services/business-process-administration-portal/deployment-diagram.adoc index 74dae88d94..f3b0059eb5 100644 --- a/docs/en/modules/arch/pages/architecture/registry/administrative/operational-maintenance/services/business-process-administration-portal/deployment-diagram.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/administrative/operational-maintenance/services/business-process-administration-portal/deployment-diagram.adoc @@ -1,4 +1,3 @@ -//= Діаграма розгортання = Deployment diagram include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] diff --git a/docs/en/modules/arch/pages/architecture/registry/administrative/operational-maintenance/services/business-process-administration-portal/development.adoc b/docs/en/modules/arch/pages/architecture/registry/administrative/operational-maintenance/services/business-process-administration-portal/development.adoc index 1185fc98c6..c6844af1d3 100644 --- a/docs/en/modules/arch/pages/architecture/registry/administrative/operational-maintenance/services/business-process-administration-portal/development.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/administrative/operational-maintenance/services/business-process-administration-portal/development.adoc @@ -1,29 +1,21 @@ -//= Функціональні можливості сервісу -= Functional capabilities of the service += Service functional capabilities include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] -//== Стартова сторінка сервісу адміністрування бізнес-процесів: -== Starting page of the business process administration service +== Start page of the business process administration service image::arch:architecture/registry/administrative/operational-maintenance/services/business-process-administration-portal/camunda-welcome.svg[] -//.Сервіс надає наступний функціонал: -.The service offers the following functionality: -//TODO: Please double-check the links: linked lowcode-dev-cicd2-env-cockpit, lowcode-dev-cicd2-env-admin, and lowcode-dev-cicd2-env-tasklist display "application not available" when you click them. -//- Camunda Cockpit https://business-proc-admin-lowcode-dev-dev.apps.cicd2.mdtu-ddm.projects.epam.com/camunda/app/cockpit/default/#/dashboard[lowcode-dev-cicd2-env-cockpit] - дозволяє відстежувати робочі процеси і рішення у виробництві, щоб виявляти, аналізувати і вирішувати технічні проблеми. Більш детальніше можна ознайомитися https://docs.camunda.org/manual/7.14/webapps/cockpit/[тут] -- Camunda Cockpit https://business-proc-admin-lowcode-dev-dev.apps.cicd2.mdtu-ddm.projects.epam.com/camunda/app/cockpit/default/#/dashboard[lowcode-dev-cicd2-env-cockpit]: allows tracking of operational processes and decisions to detect, analyze, and resolve technical issues. For more detailed information, you can refer to the https://docs.camunda.org/manual/7.14/webapps/cockpit/[link]. -//- Camunda Admin https://business-proc-admin-lowcode-dev-dev.apps.cicd2.mdtu-ddm.projects.epam.com/camunda/app/admin/default/#/[lowcode-dev-cicd2-env-admin] - надає можливість налаштовувати користувачів і групи. Більш детальніше можна ознайомитися https://docs.camunda.org/manual/7.14/webapps/admin/[тут] -- Camunda Admin https://business-proc-admin-lowcode-dev-dev.apps.cicd2.mdtu-ddm.projects.epam.com/camunda/app/admin/default/#/[lowcode-dev-cicd2-env-admin]: provides the capability to configure users and groups. For more detailed information, you can refer to the https://docs.camunda.org/manual/7.14/webapps/admin/[link]. -//- Camunda Tasklist https://business-proc-admin-lowcode-dev-dev.apps.cicd2.mdtu-ddm.projects.epam.com/camunda/app/tasklist/default/#/?searchQuery=%5B%5D[lowcode-dev-cicd2-env-tasklist] - дозволяє кінцевим користувачам працювати над призначеними на них задачами. Більш детальніше можна ознайомитися https://docs.camunda.org/manual/7.14/webapps/tasklist/[тут] -- Camunda Tasklist https://business-proc-admin-lowcode-dev-dev.apps.cicd2.mdtu-ddm.projects.epam.com/camunda/app/tasklist/default/#/?searchQuery=%5B%5D[lowcode-dev-cicd2-env-tasklist]: enables end-users to work on tasks assigned to them. For more detailed information, you can refer to https://docs.camunda.org/manual/7.14/webapps/tasklist/[link]. - -//== Основні сценарії +The service offers the following functionality: :: + +* *Camunda Cockpit*: allows tracking of operational processes and decisions to detect, analyze, and resolve technical issues. For detailed information, see https://docs.camunda.org/manual/7.14/webapps/cockpit/[official resource]. +* *Camunda Admin*: provides the capability to configure users and groups. For detailed information, see https://docs.camunda.org/manual/7.14/webapps/admin/[official resource]. +* *Camunda Tasklist*: enables end-users to work on tasks assigned to them. For detailed information, see https://docs.camunda.org/manual/7.14/webapps/tasklist/[Official resource]. + == Main scenarios -//=== Надання прав доступу користувачу у Camunda Admin -=== Granting user access rights in Camunda Admin: +=== Granting user access rights in Camunda Admin //- У головному вікні Camunda Admin потрібно перейти на вкладку `Authorizations` - In the main Camunda Admin window, navigate to the `Authorizations` tab. @@ -54,7 +46,6 @@ image::arch:architecture/registry/administrative/operational-maintenance/service //Більш детально про управління авторизацією можна ознайомитися https://docs.camunda.org/manual/7.14/webapps/admin/authorization-management/#application-access[тут] You can learn more about the authorization at the https://docs.camunda.org/manual/7.14/webapps/admin/authorization-management/#application-access[link]. -//=== Призначення задачі користувачу у Camunda Cockpit === Assigning a task to a user in Camunda Cockpit //- На головній сторінці Camunda Cockpit потрібно перейти на вкладку `Processes`. @@ -87,7 +78,6 @@ image::arch:architecture/registry/administrative/operational-maintenance/service image::arch:architecture/registry/administrative/operational-maintenance/services/business-process-administration-portal/cockpit-task-assign-result.svg[] -//=== Призупинення бізнес-процесу у Camunda Cockpit === Suspending a business process in Camunda Cockpit //- На головній сторінці Camunda Cockpit потрібно перейти на вкладку `Processes` diff --git a/docs/en/modules/arch/pages/architecture/registry/administrative/operational-maintenance/services/business-process-administration-portal/summary.adoc b/docs/en/modules/arch/pages/architecture/registry/administrative/operational-maintenance/services/business-process-administration-portal/summary.adoc index ef44cad841..085043c7c6 100644 --- a/docs/en/modules/arch/pages/architecture/registry/administrative/operational-maintenance/services/business-process-administration-portal/summary.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/administrative/operational-maintenance/services/business-process-administration-portal/summary.adoc @@ -4,23 +4,17 @@ include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] //== Загальний опис -== General overview +== Overview //Cервіс для адміністрування та технічного моніторингу виконання бізнес-процесів. -Service for administration and technical monitoring the execution of business processes. -//// -.Сервіс надає наступний функціонал: -- здійснювати моніторинг працюючих бізнес-процесів. -- надає можливість налаштовувати користувачів і групи. -- дозволяє призначати задачі кінцевим користувачам -//// -.Service provides the following functionality: +This service is intended for managing and technical monitoring of business process execution. + +The service provides the following functionality: :: - monitor running business processes - allows setting up users and groups - allows assigning tasks to end-users -//== Загальні принципи == General provisions //// - Авторизація прав доступу з урахуванням ролей користувача @@ -48,8 +42,9 @@ Service for administration and technical monitoring the execution of business pr * *Адміністратор платформи* //// -.User roles: -* *Regulations administrator* -* *Platform administrator* +== User roles + +* Regulations administrator +* Platform administrator diff --git a/docs/en/modules/arch/pages/architecture/registry/administrative/operational-maintenance/services/business-process-administration-portal/technologies.adoc b/docs/en/modules/arch/pages/architecture/registry/administrative/operational-maintenance/services/business-process-administration-portal/technologies.adoc index d17a55d4e7..f11bd9fd38 100644 --- a/docs/en/modules/arch/pages/architecture/registry/administrative/operational-maintenance/services/business-process-administration-portal/technologies.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/administrative/operational-maintenance/services/business-process-administration-portal/technologies.adoc @@ -1,4 +1,3 @@ -//= Технологічний стек = Technology stack include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] diff --git a/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/business-processes/bpmn-modeler.adoc b/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/business-processes/bpmn-modeler.adoc index 21023caf23..78b2e65436 100644 --- a/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/business-processes/bpmn-modeler.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/business-processes/bpmn-modeler.adoc @@ -6,15 +6,10 @@ include::platform:ROOT:partial$admonitions/language-en.adoc[] == Functional scenarios - Create new _BPMN_ models of business processes. -//- Створення нових _BPMN_-моделей бізнес-процесів - Make changes to existing _BPMN_ models of business processes. -//- Внесення змін до наявних _BPMN_ моделей бізнес-процесів - View _BPMN_ models of business processes. -//- Перегляд _BPMN_-моделей бізнес-процесів - View the _XML_ code for representation of the _BPMN_ models of business processes. -//- Перегляд _XML_-коду представлення _BPMN_-моделей бізнес-процесів - Using a catalog of typical extensions to simplify business process modeling. -//- Використання каталогу типових розширень для спрощення моделювання бізнес-процесів == Key requirements @@ -34,77 +29,67 @@ include::platform:ROOT:partial$admonitions/language-en.adoc[] |=== |Technology / Library|Version|License|Documentation|Description -//|Технологія / Бібліотека|Версія|Ліцензія|Документація|Опис |https://bpmn.io/toolkit/bpmn-js/[bpmn-js] |9.1.0 |https://bpmn.io/license/[bpmn.io license] |https://bpmn.io/toolkit/bpmn-js/walkthrough/ |The _bpmn-js_ library helps to interact with BPMN charts in a browser -//|Бібліотека _bpmn-js_ допомагає взаємодіяти з BPMN діаграмами у браузері -|https://...[bpmn-js-properties-panel] +|https://github.com/bpmn-io/bpmn-js-properties-panel[bpmn-js-properties-panel] |1.1.1 |MIT |https://github.com/bpmn-io/bpmn-js-properties-panel |The _bpmn-js-properties-panel_ library makes it possible to edit the BPMN technical properties -//|Бібліотека _bpmn-js-properties-panel_ дає можливість редагувати технічні властивості BPMN |https://github.com/bpmn-io/element-template-chooser[element-template-chooser] |0.0.5 |MIT |https://github.com/bpmn-io/element-template-chooser |The _element-template-chooser_ library makes it possible to work with typical extensions of the modeling catalog developed as Element Templates -//|Бібліотека _element-template-chooser_ дає можливість працювати з типовими розширення каталогу моделювання, розроблених у вигляді Element Templates |https://github.com/camunda/camunda-bpmn-moddle[camunda-bpmn-moddle] |6.1.2 |MIT |https://github.com/camunda/camunda-bpmn-moddle |The _camunda-bpmn-moddle_ library defines the Camunda namespace extensions for BPMN 2.0 XML -//|Бібліотека _camunda-bpmn-moddle_ визначає розширення простору імен Camunda для BPMN 2.0 XML |=== -== Support of the default _Element Templates_ extensions -//== Підтримка типових розширень _Element Templates_ +== Support for the default _Element Templates_ extensions The _bpmn-js_ library supports all existing typical extensions of the modeling catalog, developed as Element Templates, for this we use the _bpmn-js-properties-panel_, _element-template-chooser_ and _camunda-bpmn-moddle_ libraries. To use existing Element Templates, you must call the _setTemplates_ function and pass an array containing the Element Templates argument. -//Бібліотека _bpmn-js_ підтримує усі існуючи типові розширення каталогу моделювання, розроблені у вигляді Element Templates, для цього ми використовуємо бубліотеки _bpmn-js-properties-panel_, _element-template-chooser_ та _camunda-bpmn-moddle_. Щоб використати існуючі Element Templates, необхідно визвати функцію _setTemplates_ та аргуметом передати масив з Element Templates. + [source, javascript] ---- const viewer = new BpmnModeler({...}); viewer.get('elementTemplatesLoader').setTemplates([ELEMENT_TEMPLATES]); ---- -== Support of themes and styles -//== Підтримка темування та стилізації -The _bpmn-js_ library provides the ability to select styles and supports theme selection, based on examples given in the documentation + -//Бібліотека _bpmn-js_ надає можливість впливати на стилі та підтримує темування, на прикладах приведених в документації + -https://github.com/bpmn-io/bpmn-js-examples/tree/master/theming + -https://github.com/bpmn-io/bpmn-js-examples/tree/master/colors +== Support for themes and styles + +The _bpmn-js_ library provides the ability to select styles and supports theme selection, based on examples given in the documentation: + +* https://github.com/bpmn-io/bpmn-js-examples/tree/master/theming + +* https://github.com/bpmn-io/bpmn-js-examples/tree/master/colors == Localization support -//== Підтримка локалізації + The _bpmn-js_ library provides for the localization option, based on the example given in the documentation. + -//Бібліотека _bpmn-js_ надає можливість локалізації, на прикладі приведеного в документації. + + https://github.com/bpmn-io/bpmn-js-examples/tree/master/i18n So far, at this time it is not possible to localize the properties panel (right sidebar). -//Поки, на цей час немає можливості локалізувати панель властивостей(права бічна панель). == Simulation interface -//== Інтерфейс моделювання + === Editor main interface -//=== Основний інтерфейс редактора image::architecture/registry/administrative/regulation-management/admin-portal/business-processes/bpmn-constructor.png[] === Business process in XML -//=== Бізнес-процес у XML вигляді image::architecture/registry/administrative/regulation-management/admin-portal/business-processes/bpmn-xml.png[] === Selecting Element Template for a task -//=== Вибір Element Template для задачі image::architecture/registry/administrative/regulation-management/admin-portal/business-processes/bpmn-element-templates.png[] \ No newline at end of file diff --git a/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/data-model/admin-portal-data-model-json-schema-description.adoc b/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/data-model/admin-portal-data-model-json-schema-description.adoc index 0ddff0b3de..6411d93737 100644 --- a/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/data-model/admin-portal-data-model-json-schema-description.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/data-model/admin-portal-data-model-json-schema-description.adoc @@ -1,5 +1,7 @@ ==== DataModelSnapshot +include::ROOT:partial$admonitions/language-en.adoc[] + ===== Table JsonSchema [source,json] ---- diff --git a/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/data-model/admin-portal-data-model-management.adoc b/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/data-model/admin-portal-data-model-management.adoc index 2b6d52ebab..142b232d15 100644 --- a/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/data-model/admin-portal-data-model-management.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/data-model/admin-portal-data-model-management.adoc @@ -1,98 +1,68 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Managing registry data model table structures -//= Управління структурами таблиць моделі даних реєстру +include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] -include::ROOT:partial$admonitions/language-en.adoc[] +include::platform:ROOT:partial$admonitions/language-en.adoc[] include::admin-portal-data-model-problem-description.adoc[] include::admin-portal-data-model-scenarious.adoc[] == Out of scope + - Working with data types -//- Робота з типами даних - Working with analytical representations -//- Робота з аналітичними представленнями -- Resolving conflicts using the administrative portal of the registry regulations management -//- Вирішення конфліктів з використанням адмінпорталу менеджменту регламенту реєстру +- Resolving conflicts using the administrative portal's regulations management == Principles of working with changes in the database -//== Принципи роботи зі змінами в БД === Existing mechanism for working with changes in the database -//=== Існуючий механізм роботи зі змінами в БД The existing mechanism for working with changes in the database is based on two principles: -//Існуючий механізм роботи зі змінами в БД базуєтсья на двух принципах: -- Creation of liquibase changeset -//- Cтворення liquibase changeset -- Saving liquibase changeset in git -//- Збереження liquibase changeset в git +- Creating the Liquibase changeset +- Saving the Liquibase changeset in git image::architecture/registry/administrative/regulation-management/admin-portal/data-model/tables-management-luqibase-current-flow.svg[] === Advanced mechanism for working with changes in the database -//=== Розширений механізм роботи зі змінами в БД -It is suggested to extend the existing mechanism for working with database changes by adding a DataModelSnapshot document to the git repository, which will reflect the state of the data model. -//Пропонується розширити існуючий механізм роботи зі змінами БД шляхом додавання DataModelSnapshot документу в git репозиторій, котрий буде відображати стан моделі даних. + +It is suggested to extend the existing mechanism for working with database changes by adding a _DataModelSnapshot_ document to the git repository, which will reflect the data model's state. image::architecture/registry/administrative/regulation-management/admin-portal/data-model/tables-management-luqibase-extended-flow.svg[] === Basic concepts -//=== Основні концепції -- DataModelSnapshot model: JSON documents reflecting the state of the registry regulations data model. -//- DataModelSnapshot model - JSON документи, що відображають стан моделі даних регламенту реєстру + +- _DataModelSnapshot_ model: JSON documents reflecting the state of the registry regulations data model. - Diff Document: The document showing the difference between the two states of the registry regulations data model. -//- Diff Document - документ, що відображає різницю між двома станами моделі даних регламенту реєстру -- History Document: The document reflecting the history of changes made to the master version or the candidate version of the registry regulations. -//- History Document - документ, що відображає історію змін мастер версії або версії- кандидату регламенту реєстру +- History Document: The document reflects the history of changes made to the master or candidate versions of the registry regulations. === DataModelSnapshot structure description -//=== Описання структури DataModelSnapshot + [NOTE] -The above data model was obtained as the result of the analysis of the existing state of lqiuibase changelogs (including the functionality analysis of the custom liquibase tags). -//Вищенаведена модель даних була отримана в результаті аналізу існуючого стану lqiuibase changelogs (включно з аналізом функціональності custom liquibase тегів) +The above data model was obtained from analyzing the existing state of liquibase changelogs, including the functionality analysis of the custom liquibase tags. [plantuml, db-tables-management-er, svg] ---- include::partial$architecture/registry/administrative/regulation-management/admin-portal/db-tables-management-er.puml[] ---- - === Description of the file structure in the file system -//=== Опис структури файлів на файловій системі -The DataModelSnapshot model has the following file structure in the file system: -//DataModelSnapshot model має наступну структуру файлів на файловій системі +The _DataModelSnapshot_ model has the following file structure in the file system: image::architecture/registry/administrative/regulation-management/admin-portal/data-model/tables-management-datamodel-filestructure.svg[] - The list of tables is determined by the list of files in the file system. -//- Перелік таблиць визначається переліком файлів на файловій системі - The name of the table file matches the name of the table and is `.json`. -//- Ім'я файлу таблиць відповідає назві таблиці та має наступний вигляд: `.json` - The name of the role permission file corresponds to the name id role permission and is the following: `.json`. -//- Ім'я файлу role permission відповідає назві id role permission та має наступний вигляд: `.json` ==== Temporary file structure in the file system (first iteration) -//==== Тимчасова структура файлів на файловій системі (first iteration) image::architecture/registry/administrative/regulation-management/admin-portal/data-model/tables-management-datamodel-filestructure-simple.svg[] === Description of the DataModelSnapshot data format -//=== Опис DataModelSnapshot формату даних -The Json format is used as a technical tool for describing the data structure of DataModelSnapshot. As a description of the contract document, https://json-schema.org/ [JsonSchema] is used. -//В якості технічного інструменту опису структури даних DataModelSnapshot використовується Json формат. В якості опису контракту документу використовується https://json-schema.org/[JsonSchema] + +We use the JSON format as a technical tool for describing the data structure of _DataModelSnapshot_. As a description of the contract document, https://json-schema.org/ [JsonSchema] is used. xref:arch:architecture/registry/administrative/regulation-management/admin-portal/data-model/admin-portal-data-model-json-schema-description.adoc[DataModelSnapshotSchema] @@ -101,26 +71,27 @@ include::domain-attributes-description.adoc[] include::admin-portal-data-model-principles.adoc[] -== Description of the technical solution -//== Опис технічного рішення +== Technical solution description === Container + image::architecture/registry/administrative/regulation-management/admin-portal/data-model/tables-management-c4-container.svg[] === Admin portal API container + image::architecture/registry/administrative/regulation-management/admin-portal/data-model/tables-management-c4-apiContainer.svg[] === CICD container + image::architecture/registry/administrative/regulation-management/admin-portal/data-model/tables-management-c4-cicd-container.svg[] == System component interaction scenario when editing the structure of the registry tables -//== Сценарій взаємодії компонентів системи під час редагування структури таблиць регламенту реєстру + [plantuml, db-tables-management-sequence, svg] ---- include::partial$architecture/registry/administrative/regulation-management/admin-portal/db-tables-management-sequence.puml[] ---- -== General diagram of the system components interaction when editing the data model of the registry regulations -//== Загальна діаграма взаємодії компонентів системи під час редагування моделі даних регламенту реєстру +== General diagram of the system components' interaction when editing the data model of the registry regulations image::architecture/registry/administrative/regulation-management/admin-portal/data-model/tables-management-component-structure.svg[] diff --git a/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/data-model/admin-portal-data-model-xml-changelog-serialization.adoc b/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/data-model/admin-portal-data-model-xml-changelog-serialization.adoc index 1ed0ea9229..74e2885b9a 100644 --- a/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/data-model/admin-portal-data-model-xml-changelog-serialization.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/data-model/admin-portal-data-model-xml-changelog-serialization.adoc @@ -4,41 +4,30 @@ include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::ROOT:partial$admonitions/language-en.adoc[] == Functional scenarios -//== Функціональні сценарії -- Create _Diff Document_ based on _DataModelSnapshot_ database (current version and version changes) in _.json_ format according to the xref:architecture/registry/administrative/regulation-management/admin-portal/data-model/admin-portal-data-model-management.adoc#_допустимі_операції_з_обєктами_доменної_моделі_що_ввійшли_в_попередній_реліз[requirements]. -//- Створення _Diff Document_ на основі _DataModelSnapshot_ бази даних (поточна версія та версія змін) в форматі _.json_ відповідно до xref:architecture/registry/administrative/regulation-management/admin-portal/data-model/admin-portal-data-model-management.adoc#_допустимі_операції_з_обєктами_доменної_моделі_що_ввійшли_в_попередній_реліз[вимог]. +- Create _Diff Document_ based on _DataModelSnapshot_ database (current version and version changes) in _.json_ format according to the xref:architecture/registry/administrative/regulation-management/admin-portal/data-model/admin-portal-data-model-management.adoc#valid-operations-domain-model-objects-prev-release[requirements]. - Create _Xml liquibase Changesets_ based on the generated _Diff Document_. -//- Створення _Xml liquibase Changesets_ на основі згенерованого _Diff Document_. == Out of scope - Delete operation for _AccessRule_ -//- Операція видалення для _AccessRule_ == Technology stack -//== Технологічний стек |=== |Technology / Library|Version|License|Documentation|Description -//|Технологія / Бібліотека|Версія|Ліцензія|Документація|Опис |Guava|31.1-jre|Apache License 2.0|https://github.com/google/guava/wiki[Documentation]|Guava — Google library for working with collections in Java. -//|Guava|31.1-jre|Apache License 2.0|https://github.com/google/guava/wiki[Документація]|Guava — Google бібліотека для роботи з колекціями в Java. |=== == _Diff calculator_ -//== Компонент _Diff calculator_ + The _Diff calculator_ component based on the DataModelSnapshot creates _Diff Document_. Since the DataModelSnapshot has a structure based on _Map_, the _Guava_ library is used to calculate the difference. -//Компонент _Diff calculator_ на основі DataModelSnapshot створює _Diff Document_. Так як DataModelSnapshot має структуру на основі _Map_, то для підрахунку різниці використовується бібліотека _Guava_. TIP: The calculation of difference between two states of database structure on the xref:architecture/registry/administrative/regulation-management/admin-portal/data-model/domain-snapshot-example.adoc[test data] takes 30 msec. -//TIP: Підрахунок різниці між двома станами структури БД -//на xref:architecture/registry/administrative/regulation-management/admin-portal/data-model/domain-snapshot-example.adoc[тестових даних] займає 30 мс. - === Example of generated _Diff Document_ -//=== Приклад згенерованого _Diff Document_ + [source, json] ---- { @@ -199,30 +188,16 @@ TIP: The calculation of difference between two states of database structure on t } ---- -[NOTE] --- -TODO: A _Json_ scheme of the _Diff Document_ description must be implemented. -//TODO: необхідно реалізувати _Json_ схему опису _Diff Document_. --- - - == _LiquibaseDataModelSerializer_ -//== Компонент _LiquibaseDataModelSerializer_ + The _LiquibaseDataModelSerializer_ component based on _Diff Document_ generates _Liquibase XML-Changelog_ using the following algorithm: -//Компонент _LiquibaseDataModelSerializer_ на основі _Diff Document_ генерує _Liquibase XML-Changelog_ за наступним алгоритмом: - Get _Liquibase ChangeLog_. -//- Отримуємо _Liquibase ChangeLog_ - Form _Liquibase Changes_ based on _Diff Document_. -//- На основі _Diff Document_ формуємо _Liquibase Changes_ - Add _Liquibase Changes_ to the corresponding _Liquibase ChangeSet_ or create a new one. -//- Додаємо _Liquibase Changes_ до потрібного _Liquibase ChangeSet_ або створюємо новий - _Liquibase_ based on updated _Liquibase ChangeLog_ generates _Liquibase XML-Changelog_. -//- _Liquibase_ на основі оновленого _Liquibase ChangeLog_ генерує _Liquibase XML-Changelog_ - === Example of generated Liquibase XML-Changelog -//=== Приклад згенерованого Liquibase XML-Changelog [source, xml] ---- diff --git a/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/data-model/data-model-version-candidate/data-model-version-candidate.adoc b/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/data-model/data-model-version-candidate/data-model-version-candidate.adoc index 67c99c154e..262e3be725 100644 --- a/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/data-model/data-model-version-candidate/data-model-version-candidate.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/data-model/data-model-version-candidate/data-model-version-candidate.adoc @@ -1,4 +1,4 @@ -= View the list of registry data model tables in the read mode for candidate versions += Viewing the list of registry data model tables in the read mode for candidate versions include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] diff --git a/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/data-model/data-model-version-candidate/edit-data-model-tables.adoc b/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/data-model/data-model-version-candidate/edit-data-model-tables.adoc index 14bb573cda..99a41cc717 100644 --- a/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/data-model/data-model-version-candidate/edit-data-model-tables.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/data-model/data-model-version-candidate/edit-data-model-tables.adoc @@ -3,110 +3,77 @@ include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] -== Abstract -//== Загальний опис +== General description + Development of the registry regulations includes the development of a registry data model. The administrative portal provides functionality for viewing the registry data model. It is necessary to provide the ability to edit the data model of the registry regulations. -//Розробка регламенту реєстру включає в себе розробку моделі даних реєстру. Адміністративний портал надає функціонал по перегляду моделі даних реєстру. Необхідно забезпечити можливість редагування моделі даних регламенту реєстру. == Problem description -//== Опис проблеми The admin portal can view the status of the registry regulations data model. The existing approach involves committing changes to Gerrit to the corresponding MR candidate version while developing the registry regulations data model. == Actors -//== Актори -- Registry regulations developer -//- Розробник регламенту реєстру + +* Registry regulations developer == Glossary -//== Глосарій -- LS: language server + +* LS: language server == Functional scenarios -//== Функціональні сценарії + - Changing the data structure in the registry regulations data model. -//- Зміна структури даних в моделі даних регламенту реєстру - Saving the changes made to the candidate version of the registry regulations. -//- Збереження внесених змін в версію-кандидат регламенту реєстру - Viewing error notifications in the edit window of the registry regulations data model table structure. -//- Перегляд сповіщень про помилки у вікні редагування структури таблиць моделі даних регламенту реєстру - Auto-prompts and auto-updates when editing liquibase changelog xml. -//- Автопідказки та автодоповнення при редагуванні liquibase changelog xml - Checking liquibase configuration according to liquibase and DDM xsd. -//- Перевірка liquibase конфігурації згідно з liquibase та DDM xsd -== Design of the existing solution -//== Дизайн існуючого рішення +== Existing solution design === Reviewing and editing the data model -//=== Перегляд та редагування моделі даних + image::architecture/registry/administrative/regulation-management/admin-portal/data-model/edit-data-model-version-candidate/data-model-edit-current-design.svg[] === Interacting with Language Server -//=== Взаємодія з Language Server -image::architecture/registry/administrative/regulation-management/admin-portal/data-model/edit-data-model-version-candidate/ls-current-design.svg[] +image::architecture/registry/administrative/regulation-management/admin-portal/data-model/edit-data-model-version-candidate/ls-current-design.svg[] === General principles -//=== Загальні принципи + - Changes to the data model of the registry regulations are made by making changes directly to Gerrit. -//- Внесення змін в модель даних регламенту реєстру відбувається шляхом внесення змін безпосередньо в Gerrit - The source file for data model deployment is `data-model/main-liquibase.xml`. -//- Початковий файл для розгортання моделі даних є `data-model/main-liquibase.xml` - The structure of files on the file system is not clearly regulated. `Liquibase changeset's` with instructions for creating data model tables can technically be found in any file in the file system. -//- Структура файлів на файловій системі чітко не регламентована. `Liquibase changeset's` з інструкціями для створення таблиць моделі даних технічно може знаходитись в будь-якому файлі на файловій системі - ddm-language-server only supports the Groovy language. -//- ddm-language-server підтримує лише Groovy мову -== Solution technical design -//== Технічний дизайн рішення +== Technical solution design image::architecture/registry/administrative/regulation-management/admin-portal/data-model/edit-data-model-version-candidate/edit-data-model-target-design.svg[] === General principles -//=== Загальні принципи - The data structure of the data model is only edited in the createTables.xml file. -//- Редагування структури даних дата моделі відбувається тільки в createTables.xml файлі. - registry-regulation-management receives and modifies createTables.xml using corresponding RestAPI methods. -//- registry-regulation-management отримує та змінює createTables.xml через RestAPI відповідні методи. - Language Server supports Groovy and XML. -//- Language Server підтримує Groovy та XML. - In the list of statuses of the candidate version components, the change in the database structure is displayed as a single item without a list of detailed changes for each data model table. -//- В переліку стану складових версії-кандидату зміна структури БД відображається єдиним пунктом без переліку детальних змін по кожній із таблиць моделі даних. === Changing the registry regulations data model description contract -//=== Зміна контракту опису дата моделі регламентур реєстру To ensure that the structure of the data model tables of the registry regulations is edited, it is necessary to change the approach to organizing the structure of liquibase configuration files as follows: -//Для забезпечення редагування структури таблиць моделі даних регламенту реєстру необхідно змінити підхід по організації структури liquibase файлів конфігурації наступним чином: - All operations on creation or changing the structure of database tables must be stored in the `data-model/createTables.xml` file. -//- Всі операції по створенню або зміні структури таблиць БД необхідно тримати в файлі `data-model/createTables.xml` - `data-model/createTables.xml` must be explicitly included in the list of files for deployment in the `data-model/main-liquibase.xml` configuration. -//- `data-model/createTables.xml` повинен бути явно включений до переліку файлів для розгортання в `data-model/main-liquibase.xml` конфігурацію -==== Migration of existing registries -//==== Міграція існуючих реєстрів +==== Migrating existing registries To ensure the compatibility of the registry regulations file structure, it is necessary to verify the above rules, and change the file structure (*without changing the liquibase changeset content*), if necessary. -//Для забезпечення сумісності структури фалів регламенту реєстру необхідно переконатися в вищенаведених правилах та провести зміну структури файлів (*без зміни liquibase changeset контенту*) в разі необхідності. [CAUTION] -If createTables.xml is not available, the admin portal does not provide the ability to edit the liquibase configuration using the Web-UI. The performance of the existing configuration of the registry regulations does not change in any way. -//При відсутності createTables.xml адмін-портал не надасть можливість редагування liquibase конфігурації використовуючи Web-ui. Працездатність існуючої конфігурації регламенту реєстру при цьому не ніяк зміниться. +If createTables.xml is not available, the admin portal does not provide the ability to edit the liquibase configuration using the Web UI. The performance of the existing configuration of the registry regulations does not change. + +=== Distributing perspectives for editing and viewing the data model -=== Distribution of perspectives for editing and viewing the data model -//=== Розподіл перспектив редагування і перегляду моделі даних To edit the registry regulations data model, you have to create a new editing perspective. -//Для редагування моделі даних регламенту реєстру необхідно створити нову перспективу редагування. All operations associated with viewing the state of the data model (present and future) are allocated in the view perspective. -//Всі операції, пов'язані з переглядом стану моделі даних (наявні та майбутні) виокремлюються в перспективу перегляду - -[NOTE] -TODO: add screenshots when will be ready === Sequence diagram -//=== Діаграма послідовності [plantuml, edit-data-model edit-data-model-tables-sequence, svg] ---- @@ -114,56 +81,40 @@ include::partial$architecture/registry/administrative/regulation-management/admi ---- === Deployment of XML LS -//=== Розгортання XML LS - To deploy XML Language Server, use the https://github.com/eclipse/lemminx[lemminx language server]. -//- Для розгортання XML Language Server необхідно використати https://github.com/eclipse/lemminx[lemminx language server]. ++ This LS is published in the `https://mvnrepository.com/artifact/org.eclipse.lemminx/org.eclipse.lemminx/0.23.2[maven central repository]` (there is no need to place the code of this component in your gerrit). -//Даний LS публікується в `https://mvnrepository.com/artifact/org.eclipse.lemminx/org.eclipse.lemminx/0.23.2[maven central repository]` (немає необхідності розміщовати код даного компоненту у себе в gerrit). - It is necessary to connect the above artifact and use the `org.eclipse.lemminx.XMLLanguageServer` LS implementation in the ddm-language-server module. -//- Необхідно підключити наведений артефакт та використати `org.eclipse.lemminx.XMLLanguageServer` імплементацію LS в ddm-language-server модулі. - In accordance with the https://microsoft.github.io/language-server-protocol/specifications/lsp/3.17/specification/#textDocumentItem[LS specification], the URL for creating websocket must be `/xml`. -//- Згідно зі https://microsoft.github.io/language-server-protocol/specifications/lsp/3.17/specification/#textDocumentItem[специфікацією LS] URL для створення websocket повинен бути `/xml`. === Working with DDM XSD -//=== Робота з DDM XSD To provide hints in full scope when editing XML documents (displaying field descriptions from xsd schemas as hoover messages, auto-completion, etc.), it is necessary to provide access to the `ddm-language-server` to load the corresponding xsd schemas using the specified URL in the XSD document. -//Для забезпечення підказок під час редагування XML документів в повному об'ємі (показ опису полів з xsd схем у вигляді hoover повідомлень, автодоповнення та інше) необхідно забезпечити доступ `ddm-language-server` до завантаження відповідних xsd схем за вказаним URL в XSD документі. All required XSD for editing XML Liquibase documents must be placed in platform nexus. -//Всі необхідні XSD для редагування XML Liquibase документів повинні бути розміщені в platform nexus XSD required to edit liquibase scripts: -//XSD, необхідні для редагування liquibase скриптів: - liquibase xsd: http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-4.5.xsd - ddm liquibase extension: https://nexus-public-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/repository/extensions/com/epam/digital/data/platform/liquibase-ext-schema/latest/liquibase-ext-schema-latest.xsd [CAUTION] To ensure compatibility of the liquibase configurations with `ddm-language-server`, it is necessary to migrate the URI for the `http://www.liquibase.org/xml/ns/dbchangelog` namespace. The URI must point to the corresponding xsd published in platform nexus. -//Для забезпечення сумісності liquibase конфігурацій з `ddm-language-server` необхідно провести міграцію URI для `http://www.liquibase.org/xml/ns/dbchangelog` namespace. URI повинен вказувати на відповідну xsd, опубліковану в platform nexus === RestAPI for liquibase configurations -//=== RestAPI по роботі з liquibase конфігураціями It is necessary to extend the existing registry-regulation-management RestAPI by adding the methods for: -//Необхідно розширити registry-regulation-management існуючий RestAPI шляхом додавання методів для: - Getting the liquibase configuration of the data model table structure for the candidate version. -//- Отримання liquibase конфігурації структури таблиць моделі даних для версії-кандидату - Getting the liquibase configuration of the data model table structure for master versions. -//- Отримання liquibase конфігурації структури таблиць моделі даних для мастер версії - Changing the liquibase configuration of the data model table structure for the candidate version. -//- Зміна liquibase конфігурації структури таблиць моделі даних для версії-кандидату ==== Getting the liquibase configuration of the data model tables -//==== Отримання liquibase конфігурації таблиць дата моделі Request: -//Запит: [source,http,options="nowrap"] ---- @@ -172,7 +123,6 @@ GET /versions/master/data-model/tables ---- Response structure: -//Структура відповіді: [CAUTION] Content-type=text/xml @@ -193,10 +143,8 @@ Content-type=text/xml ---- ==== Changing the liquibase configuration of the data model tables -//==== Зміна liquibase конфігурації таблиць дата моделі Request: -//Запит: [source,http,options="nowrap"] ---- @@ -221,22 +169,18 @@ Body: ---- - === Receiving and displaying changes in the status view of the registry regulations components -//=== Отримання та відображення змін в перегляді стану складових регламенту реєстру The work with the registry database structure is performed by editing only one resource in terms of RestAPI `/versions/candidates/{versionCandidateId}/data-model/tables`. -//Робота зі структурою БД реєстру ведеться в цілому редагуванням лише одного ресурсу в термінах RestAPI '/versions/candidates/{versionCandidateId}/data-model/tables'. + Therefore, it is necessary to operate with one single item called "Database table structure" in the list of the registry regulations component states. -//Тому в переліку стану складових регламенту реєстру необхідно оперувати одним єдиним пунктом під назвою `Структура таблиць БД`. This item can have the only `Modified` state if any changes were made to the `data-model/createTables.xml` file through the admin portal or directly by adding of a patchset in Gerrit to the corresponding MR to the candidate version. -//Даний пункт може мати єдиний стан `Змінено` в тому разі, якщо будь-які зміни були внесені в файл `data-model/createTables.xml` через адмін-портал або напряму через додавання патчсету в Gerrit у відповідний MR до версії-кандидату. -== High level development plan -//== Високорівневий план розробки +== High-level development plan + === Required expertise -//=== Необхідні експертизи + - DevOps - BE - FE @@ -244,29 +188,21 @@ This item can have the only `Modified` state if any changes were made to the `da - One TeamLead or One QALead === DevOps + - Configure Kong for working with XML LS. -//- Налаштувати kong для роботи з XML LS. === Backend + - Extend RestAPI for getting and saving liquibase configurations (for the candidate versions and master versions). Add RestAPI Optimistic locking headers to the `/versions/candidates/{versionCandidateId}/data-model/tables` endpoints. -//- Розширити RestAPI для отримання та збереження liquibase конфігурацій (для версій-кандидатів та мастер версії). Додати RestAPI Optimistic locking headers до ендпоінтів `/versions/candidates/{versionCandidateId}/data-model/tables`. - Connect XML lemminx LS. Extend ddm-language-server to work with the /xml websocket endpoint. -//- Підключити XML lemminx LS. Розширити ddm-language-server для роботи з /xml websocket endpoint. - Add the information about changes in the database structure of the data model to the `/versions/candidates/{versionCandidateId}/changes` RestAPI endpoint. -//- Додати інформацію про зміни структури БД моделі даних в `/versions/candidates/{versionCandidateId}/changes` RestAPI ендпоінт. - Publish http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-4.5.xsd[dbchangelog-4.5.xsd] on platform nexus. -//- Опублікувати http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-4.5.xsd[dbchangelog-4.5.xsd] в платформенний nexus. === Frontend - Create a perspective view of the data model state and a perspective view for editing data model tables. -//- Створити перспективу перегляду стану моделі даних та перспективу редагування таблиць моделі даних. - Integrate monaco editor into the perspective for editing data model tables. Configure interaction with XML LS. -//- Інтегрувати monaco editor в перспективу редагування таблиць моделі даних. Налаштувати взаємодію з XML LS. - Provide for displaying and storage of liquibase configuration of data model tables (integration with the `/versions/candidates/{versionCandidateId}/data-model/tables` endpoints). Provide for working with the RestAPI Optimistic Locking mechanism. -//- Забезпечити відображення та збереження liquibase конфігурації структури таблиць моделі даних (інтеграція з `/versions/candidates/{versionCandidateId}/data-model/tables` ендпоінтами). Забезпечити роботи з RestAPI Optimistic Locking механізмом. - Add the display of information about changes in the data model table structure to the candidate version overview. -//- Додати відображення інформації про зміни с структурі таблиць моделі даних в огляд версії-кандидату. === One TeamLead or One QALead -- Develop migration instructions for existing registries. Publish instructions, organize knowledge transfer with the DevOps command. -//- Створити інструкцію міграції існуючих реєстрів. Опублікувати інструкцію, провести KT з DevOps командою. \ No newline at end of file +- Develop migration instructions for existing registries. Publish instructions, organize knowledge transfer with the DevOps command. \ No newline at end of file diff --git a/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/data-model/domain-model-description.adoc b/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/data-model/domain-model-description.adoc index 7f1b45c763..14fcb14507 100644 --- a/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/data-model/domain-model-description.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/data-model/domain-model-description.adoc @@ -1,3 +1,4 @@ +[#permissible-operations-with-objects] == Permissible operations with the objects of a domain model //== Допустимі операції з об'єктами доменної моделі @@ -18,12 +19,11 @@ IMPORTANT: The data model objects that have not been integrated into the master Data model objects included in the master version of snapshot data model have limited editing capabilities. Tables created in CandidateSnapshot have no restrictions on editing capabilities. //Об'єкти моделі даних, що ввійшли до master версії snapshot data model мають обмежені можливості для редагування. Таблиці, що були створені в CandidateSnapshot не мають ніяких обмежень відносно можливостей редагування. +[#valid-operations-domain-model-objects-prev-release] === Valid operations with domain model objects included in the previous release -//=== Допустимі операції з об'єктами доменної моделі, що ввійшли в попередній реліз |=== |Entity|Create| Update| Delete -//|Назва entity|Create| Update| Delete |Table|Y|Y|N |Column|Y|Y|N diff --git a/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/forms/form-modeler.adoc b/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/forms/form-modeler.adoc index 6c08fb7661..7ed567a3f7 100644 --- a/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/forms/form-modeler.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/forms/form-modeler.adoc @@ -115,8 +115,7 @@ image:architecture/registry/administrative/regulation-management/admin-portal/fo image:architecture/registry/administrative/regulation-management/admin-portal/forms/form-modeler-edit-comp.png[] -=== Viewinf the _JSON_ code for representing UI form schemes -//=== Перегляд _JSON_-коду представлення схем UI-форм +=== Viewing the _JSON_ code for representing UI form schemes + +This is considered in a separate task. For details of implementation, see xref:registry-develop:registry-admin/admin-portal/registry-modeling/ui-forms/json-code-view-edit.adoc[Viewing and editing a UI-form JSON representation]. -This is consideren in the separate task -- xref:architecture-workspace/research/admin-portal/json-editor-tech-evaluation.adoc[Analysis of JSON editors for compliance]. -//Розглядається в окремій задачі xref:architecture-workspace/research/admin-portal/json-editor-tech-evaluation.adoc[Аналіз JSON-редакторів на відповідність] \ No newline at end of file diff --git a/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/regulation-repository/gitflow/gitflow-description.adoc b/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/regulation-repository/gitflow/gitflow-description.adoc index 412913ffc0..78889cac65 100644 --- a/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/regulation-repository/gitflow/gitflow-description.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/regulation-repository/gitflow/gitflow-description.adoc @@ -1,15 +1,7 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: -= Organization of work with git repositories when working with several versions of registry regulations -//= Організація роботи з git репозиторіями під час роботи з декількома версіями регламенту реєстру -NOTE: 🌐 This document is available in both English and Ukrainian. Use the language toggle in the top right corner to switch between versions. += Managing git repositories for multiple versions of registry regulations +include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] + +include::platform:ROOT:partial$admonitions/language-en.adoc[] == Basic principles //== Базові принципи @@ -98,8 +90,8 @@ When several users are simultaneously working (executing _git_ commands) on the //Під час одночасної роботи (виконання _git_ команд) декількох користувачів над однією версією, _Git_ блокує частину репозиторію шляхом створення _lock_ файлів. В такому випадку, задача, яка виконується після створення _lock_ файлу, буде чекати розблокування репозиторію або проінформує користувача про необхідність проведення операції пізніше (використовується _retry_ механізм для очікування завершення одночасних дій з репозиторієм на рівні _jGit_ java сервісу). [WARNING] -This mechanism of using _git lock_ files works only with the git client and does not guarantee permanent data consistency in the file system during git operations. xref:architecture-workspace/research/admin-portal/gitflow/git-repositories-management.adoc[See the document.] -//Даний механізм використання _git lock_ файлів працює тільки з git клієнтом і не гарантує постійну консистентність даних на файловій системі під час виконання git операцій. xref:architecture-workspace/research/admin-portal/gitflow/git-repositories-management.adoc[Дивись документ.] +This mechanism of using _git lock_ files works only with the git client and does not guarantee permanent data consistency in the file system during git operations. +//xref:architecture-workspace/research/admin-portal/gitflow/git-repositories-management.adoc[See the document]. diff --git a/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/bp-groups.adoc b/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/bp-groups.adoc index 3b1e8eac39..9121dad3d1 100644 --- a/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/bp-groups.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/bp-groups.adoc @@ -1,6 +1,3 @@ -//:imagesdir: ..\..\..\images\ -//:includedir: ..\..\..\partials\ - = Categorizing available services in the user portal include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] diff --git a/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/bp-script-groovy-editor.adoc b/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/bp-script-groovy-editor.adoc index cc7f820987..3c3ce1765d 100644 --- a/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/bp-script-groovy-editor.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/bp-script-groovy-editor.adoc @@ -10,14 +10,8 @@ The development of the registry regulations business processes includes the deve Developing Groovy scripts in specialized development tools, such as IDE (Desktop or Web versions), is much more efficient. Extending the admin portal with the rich web editors for editing groovy scripts will improve the user experience to the level of using Desktop IDE tools, as well as reduce the time for continuous transfer of scripts to Desktop IDE for editing and back to BPMN.IO visual business process designer. -//Розширення адмін-порталу використанням rich веб редакторів редагування Groovy скриптів покращить user experience до рівня використання Desktop IDE інструментів, а також зменшить час на постійне переміщення скриптів в Desktop IDE для редагування та назад в BPMN.IO візуальний конструктор бізнес-процесів - -[NOTE] -xref:architecture-workspace/research/admin-portal/code-editor-language-server-protocol.adoc[The POC results] to learn about the LSP protocol and the MonacoEditor web code editor. -//xref:architecture-workspace/research/admin-portal/code-editor-language-server-protocol.adoc[Результати POC] для ознайомлення з LSP протоколом та веб-редактором коду MonacoEditor == Glossary -//== Глосарій - LSP - Language Server Protocol - LS - Language Server @@ -25,27 +19,20 @@ xref:architecture-workspace/research/admin-portal/code-editor-language-server-pr - WSS - WebSocket Secure == Actors -//== Актори + - Registry regulations developer -//- Розробник регламенту реєстру == Editor functionality -//== Функціональні можливості редактору [NOTE] The following functionality is equally used for two functional scenarios: creating a new workflow step and editing or viewing an existing one. -//Наступні функціональні можливості в рівній мірі використовуються для двох функціональних сценаріїв: створення нового кроку бізнес-процесу та редагування або перегляд існуючого. - Auto-completion as a drop-down list of the call variants. -//- Автодоповнення у вигляді випадаючого списку варіантів виклику - Display the results of code analysis for errors using the language server. -//- Відображення результату аналізу коду на наявність помилок за допомогою language server - Display Hoover tooltip with javadoc information. -//- Показ Hoover тултипу з javadoc інформацією - Use different colors when viewing code. -//- Використання різних кольорів при перегляді коду - Auto-completion for DDM JUEL functions: -//- Автодоповнення для DDM JUEL функцій: + ** initiator ** completer ** system_user @@ -58,76 +45,50 @@ The following functionality is equally used for two functional scenarios: creati ** message_payload == Basic principles -//== Основні принципи - Monaco editor as a Web tool for the development of groovy scripts. -//- Monaco editor в якості Web інструменту розробки groovy скриптів - Using third-party Language Servers (LS) to get hints, the list for auto-completion and results of errors of semantic analysis of Groovy scripts. -//- Використання сторонніх Language Server's (LS's) для отримання підказок, переліку для автодоповнення та результату помилок семантичного аналізу Groovy скриптів - Using Language Server Protocol for communication between Language Server and Monaco editor. -//- Використання Language Server Protocol для комунікації між Language Server та Monaco editor - Using lsp4j for LS management (orchestration). -//- Використання lsp4j для менеджменту (orchestration) LS's - Transport communication protocol between Monaco editor and LS - WebSocket over HTTP (HTTPS). -//- Транспортний протокол комунікації між Monaco editor та LS - WebSocket over HTTP (HTTPS) - Logical communication protocol (payload structure in the transport protocol messages) between Monaco editor and LS. -//- Логічний протокол комунікації (структура payload в повідомленнях транспортного протоколу) між Monaco editor та LS - Json-RPC -== High level design -//== Високорівневий дизайн +== High-level design image::architecture/registry/administrative/regulation-management/bpmnio-groovy-editor/bp-groovy-script-editor.svg[] === Description and purpose of components -//=== Опис та призначення компонентів |=== |Name|Programming language|Description -//|Назва|Мова програмування|Опис |https://microsoft.github.io/monaco-editor/[Monaco editor] | JavaScript | Visual browser-based code editor -//|https://microsoft.github.io/monaco-editor/[Monaco editor] | JavaScript | Візуальний веб-редактор коду |Remote LS's | Java, LSP4J | Instances of LS services that use the LSP protocol and perform the client code check returning the test results in Json-RPC (LSP) format. -//|Remote LS's | Java, LSP4J | Екземпляри LS сервісів, що реалізує LSP протокол та виконують перевірку клієнтського коду з поверненням результатів перевірки в форматі Json-RPC(LSP). |LS Manager, Websocket Manager|Java, Spring|Spring boot web controller. Creates the required LS instances. Creates a WebSocket and uses the appropriate LS instance to analyze and validate code from the visual editor to the client. -//|LS Manager, Websocket Manager|Java, Spring|Spring boot web controller. Створює необхідні екземпляри LS. Створює WebSocket та використовує відповідний LS екземпляр для аналізу та перевірки коду з візуального редактору клієнту. - |=== === LSP communication -//=== LSP комунікація - WSS protocol is used as transport protocol. -//- В якості транспортного протоколу використовується WSS протокол - The https://microsoft.github.io/language-server-protocol/specifications/lsp/3.17/specification/[LSP] protocol, version 3.17 is used as RPC interaction. -//- В якості RPC взаємодії використовується https://microsoft.github.io/language-server-protocol/specifications/lsp/3.17/specification/[LSP] протокол версії 3.17 - ==== WebSocket communication -//==== WebSocket комунікація image::architecture/registry/administrative/regulation-management/bpmnio-groovy-editor/web-sockets-diagram.svg[] -- WSS is used as transport protocol. -//- В якості транспортного протоколу використовується WSS +- WSS is used as a transport protocol. - To configure Web-socket communication from the UI layer side, the https://www.npmjs.com/package/monaco-languageclient[monaco-languageclient] is used. -//- Для налаштування Web-socket зв'язку зі сторони UI layer використовується https://www.npmjs.com/package/monaco-languageclient[monaco-languageclient]. - spring-websocket is used to organize the websocket backend part. -//- Для організації websocket backend частини використовується spring-websocket. ==== Number of LS instances -//==== Кількість екземплярів LS image::architecture/registry/administrative/regulation-management/bpmnio-groovy-editor/web-sockets-concurrency-diagram.svg[] - Each window with monaco editor uses its own individual web-socket instance to connect to LS. -//- Кожне вікно з monaco editor використовує свій окремий web-socket instance для з'єднання з LS - Each web-socket uses an individual LS instance. -//- Кожний web-socket використовує окремий екземпляр LS. - All LS instances are in the same JVM instance. Technically, each LS instance is a new instance with the `org.eclipse.lsp4j.services.LanguageServer` interface. -//- Всі LS екземпляри знаходяться в одному JVM екземплярі. Технічно кожний екземпляр LS це новий екземпляр з інтерфейсом `org.eclipse.lsp4j.services.LanguageServer`. [plantuml,bp-script-editing ls-communication-sequence,svg] ---- @@ -135,103 +96,74 @@ include::partial$architecture/registry/administrative/regulation-management/bpmn ---- == Component deployment -//== Розгортання компоненту image::architecture/registry/administrative/regulation-management/bpmnio-groovy-editor/ls-deployment.svg[] == Scaling -//== Масштабування In the current version of the service deployment, it is suggested to use only vertical scaling (RAM, CPU). -//В поточній версії розгортання сервісу пропонується використовувати лише вертикальне масштабування (RAM, CPU). Since the approach of placing all LSs within a single JVM is used, therefore, a significant increase in the use of computing resources is not expected during an increase in the number of the LS clients working at the same time. -//Оскільки використовується підхід розміщення всіх LS в рамках однієї JVM, тому не очікується значного збільшення використання обчислювальних ресурсів під час збільшення кількості одночасно працюючих кліентів LS. [TIP] Horizontal scaling is possible by adding Load Balancer for the LSP (WebSocket JSON-RPC) traffic. -//Горизонтальне маштабування можливе шляхом додавання Load Balancer для LSP (WebSocket JSON-RPC) трафіку. Out of scope. == Threat modeling -//== Моделювання загроз |=== |Area|Name|Description|Limit Value -//|Area|Назва|Опис|Значення ліміту .5+|Kong|WSS traffic through Kong|Settings of the traffic through admin kong by using Upgrade headers. https://docs.konghq.com/enterprise/2.4.x/proxy/#proxy-websocket-traffic[WebSocket kong manual] | -//.5+|Kong|WSS трафік через Kong|Налаштування пропускання трафіку через admin kong шляхом використання Upgrade headers. https://docs.konghq.com/enterprise/2.4.x/proxy/#proxy-websocket-traffic[WebSocket kong manual] | | Authorization during the handshake process| Current authorization in admin kong. `GET /groovy` shall be accessible only for authorized users through admin realm | -//| Авторизація під час handshake процесу| Поточна авторизація на admin kong. `GET /groovy` повинен бути доступним тільки авторизованим користувачам через admin realm | | Maximum request size| Limit for payload in LSP (JSON-RPC). Use https://docs.konghq.com/hub/kong-inc/request-size-limiting/[Request Size Limiting] | 65kb (30kb after SC) -//| Максимальний розмір запиту| Ліміт для payload всередині LSP (JSON-RPC). Використати https://docs.konghq.com/hub/kong-inc/request-size-limiting/[Request Size Limiting] | 65kb (30kb after SC) | Socket timeout| Idle time for the socket through which it automatically closes. Required configuration on both BE and FE side. Kong config property `proxy_read_timeout`| 60s (should be by default) -//| Socket timeout| Idle time для сокету, через який він автоматично закривається. Необхідна конфігурація як на BE так і на FE side. Kong config property `proxy_read_timeout`| 60s (should be by default) | Socket open Rate limit | Limit on the number of requests to create web-socket `/groovy`. Use existing plugin in Kong https://docs.konghq.com/hub/kong-inc/rate-limiting/[Rate limit plugin] | 10 per minute per user -//| Socket open Rate limit | Ліміт на кількість запитів на створення web-socket `/groovy`. Використати існуючий плагін в Kong https://docs.konghq.com/hub/kong-inc/rate-limiting/[Rate limit plugin] | 10 per minute per user |Java application | CORS configuration | Configure CORS for the `/groovy` method for web-socket opening | -//|Java application | Конфігурація CORS | Налаштувати CORS для `/groovy` методу відкриття web-socket | |Chart configuration| RAM limit |Set the RAM limit by configuring resources.requests.memory in the Chart deployment| 1GB -//|Chart configuration| RAM limit |Встановити RAM ліміт шляхом налаштування resources.requests.memory в Chart deployment| 1GB - |=== -== Tech stack -//== Технологічний стек +== Technology stack [cols="2,1,1,2"] |=== |Name|Version|License|Description -//|Назва|Версія|Ліцензія|Опис |https://microsoft.github.io/monaco-editor/[Monaco editor] |0.34.1|https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt[MIT] | Visual browser-based code editor -//|https://microsoft.github.io/monaco-editor/[Monaco editor] |0.34.1|https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt[MIT] | Візуальний веб-редактор коду |https://www.npmjs.com/package/monaco-languageclient[monaco-languageclient]|4.0.3|https://github.com/TypeFox/monaco-languageclient/blob/master/License.txt[MIT]|The language server client connected to the Monaco editor and used to connect to remote language servers using LSP protocol) -//|https://www.npmjs.com/package/monaco-languageclient[monaco-languageclient]|4.0.3|https://github.com/TypeFox/monaco-languageclient/blob/master/License.txt[MIT]|Language server клієнт, що підключається до Monaco editor та використовується для з'єднання з віддаленими language серверами використовуючи LSP протокол) |https://www.npmjs.com/package/vscode-languageclient[vscode-languageclient]|8.0.2|https://github.com/Microsoft/vscode-languageserver-node/blob/main/License.txt[MIT]|Transitive dependency with monaco-languageclient -//|https://www.npmjs.com/package/vscode-languageclient[vscode-languageclient]|8.0.2|https://github.com/Microsoft/vscode-languageserver-node/blob/main/License.txt[MIT]|Транзитивна залежність з monaco-languageclient |https://github.com/eclipse/lsp4j/tree/main/documentation[LSP4J]|0.19| https://github.com/eclipse/lsp4j/blob/main/LICENSE[Eclipse Public License - v 2.0]| Library for managing LS instances. Used to run LS code. -//|https://github.com/eclipse/lsp4j/tree/main/documentation[LSP4J]|0.19| https://github.com/eclipse/lsp4j/blob/main/LICENSE[Eclipse Public License - v 2.0]| Бібліотека для менеджменту екземплярів LS. Використовується для запуску LS коду. |https://github.com/GroovyLanguageServer/groovy-language-server[Groovy language server] |-| https://github.com/GroovyLanguageServer/groovy-language-server/blob/master/LICENSE[APACHE LICENSE, v2.0]| Implements LSP protocol and performs Groovy code check returning test results in the Json-RPC format -//|https://github.com/GroovyLanguageServer/groovy-language-server[Groovy language server] |-| https://github.com/GroovyLanguageServer/groovy-language-server/blob/master/LICENSE[APACHE LICENSE, v2.0]| Реалізує LSP протокол та виконую перевірку Groovy коду з поверненням результатів перевірки в форматі Json-RPC |https://github.com/spring-projects/spring-boot[Spring Boot]|2.6.1|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Spring Framework extension to simplify the construction of applications based on Spring due to the automatic configuration and spring boot starters -//|https://github.com/spring-projects/spring-boot[Spring Boot]|2.6.1|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Розширення до Spring Framework для спрощення побудови аплікацій на базі Spring завдяки автоматичній конфігурації та наявності spring boot стартерів |https://spring.io/guides/gs/messaging-stomp-websocket/[spring-boot-starter-websocket]|2.6.1|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Spring extension for Web Socket management in the server applications (uses https://mvnrepository.com/artifact/org.springframework/spring-websocket/5.3.13[spring-websocket:5.3.13]) -//|https://spring.io/guides/gs/messaging-stomp-websocket/[spring-boot-starter-websocket]|2.6.1|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Розширення для Spring для менеджменту веб-сокетів в серверних додатках (використовує https://mvnrepository.com/artifact/org.springframework/spring-websocket/5.3.13[spring-websocket:5.3.13]) - |=== == Control interface -//== Інтерфейс управління BPMN.io will be extended with an additional button to call the modal window editing groovy scripts. -//BPMN.io буде розширено додатковою кнопкою визову модального вікна редагування groovy скриптів. .Business process script editor call window -//.Вікно визову редактору скриптів бізнес-процесів + image::architecture/registry/administrative/regulation-management/bpmnio-groovy-editor/bp-groovy-script-open-window.svg[] .Script edit window in Monaco Editor -//.Вікно редагування скрипта в Monaco Editor + image::architecture/registry/administrative/regulation-management/bpmnio-groovy-editor/bp-groovy-script-edit-window.png[] -== High level development plan -//== Високорівневий план розробки +== High-level development plan === Required expertise -//=== Необхідні експертизи - Java - Javascript @@ -240,190 +172,117 @@ image::architecture/registry/administrative/regulation-management/bpmnio-groovy- ==== Backend Java activities -- Create Spring Boot based backend service ddm-language-server. -//- Створити Spring Boot based backend service ddm-language-server +- Create Spring Boot-based backend service ddm-language-server. - Develop WebSocket proxy component. -//- Розробити WebSocket proxy component - Upgrade the LSP4J version to 0.19 for GroovyLanguageServer. -//- Підвищити версію LSP4J до 0.19 для GroovyLanguageServer ==== Javascript activities - Integration of Monaco Editor into the BPMN.IO business process editor. -//- Інтеграція Monaco editor в BPMN.IO редактор бізнес-процесів - Monaco Editor integration with ddm-language-server using monaco-languageclient. -//- Інтеграція Monaco-editor з ddm-language-server використовуючи monaco-languageclient ==== DevOps activities - Onboard https://github.com/GroovyLanguageServer/groovy-language-server: add codebase into gerrit and create pipeline around - Create deploy-templates and Dockerfile for service ddm-language-server (openjdk based image). -//- Створити deploy-templates та Dockerfile для service ddm-language-server (openjdk based image) - AdminKong configuration for ddm-language-server traffic. Add websocket proxy headers to the Kong configuration. -//- Конфігурація AdminKong для пропускання трафіку в ddm-language-server. Додати websocket proxy headers в конфігурацію Kong - Configuring Kong plugins to check the security limits. -//- Конфігурація плагінів Kong для перевірки security лімітів - Add the `languageServerUrl` variable to `environment-js` with the relative ddm-laguage-server address. -//- Додати в `environment-js` змінну `languageServerUrl` з відносною адресою ddm-laguage-server == Security -//== Безпека === Business data -//=== Бізнес Дані + |=== |Data Category|Description|Privacy|Integrity|Accessibility -//|Категорія Даних|Опис|Конфіденційність|Цілісність|Доступність |Interim business process data containing open information|Business form and process data that does not contain restricted information|Low|High|Average -//|Проміжні дані бізнес-процесів, що містять відкриту інформацію|Дані бізнес форм та процесів що не містять інформацію з обмеженим доступом|Низька|Висока|Середня |Operational logs|Lists of recorded/logged calls to the service and its operation logs|Average|High|High -//|Операційні журнали|Списки зафіксованих/залогованих звернень до сервісу та журнали його роботи|Середня|Висока|Висока |=== + === Simplified threat model -//=== Спрощена модель загроз image::architecture/registry/administrative/regulation-management/bpmnio-groovy-editor/groovy_TM.svg[] === Countermeasures against safety risks and compliance with safety requirements -//=== Механізми протидії ризикам безпеки та відповідність вимогам безпеки |=== | Risk | Security controls | Implementation | Priority -//| Ризик | Засоби контролю безпеки | Реалізація | Пріорітет | Breach of data integrity and confidentiality during transmission | Use of HTTPS and WSS | Taken into account in the original design | High -//| Порушення цілісності та конфіденційності даних при передачі | Використання HTTPS та WSS | Враховано в початковому дизайні | Високий | Unsafe session termination on the server side | During the user initiated exit from the system or in case of the automatic session timeout, any communication with the web socket must be terminated | Not taken into account in the initial design | High -//| Небезпечне завершення сеансу на стороні сервера | Під час виходу з системи ініційованого користувачем або при автоматичному закінченні терміну дії сесії будь-яка комунікація з веб сокетом повинна бути зупинена | Не враховано в початковому дизайні | Високий | Denial of service due to depletion of computing resources (DoS) caused by the lack of restrictions for web sockets -//| Відмова в обслуговуванні через вичерпання обчислювальних ресурсів (DOS) спричинине відсутністю обмежень для веб сокетів a| - Implement the maximum request size limit of 30 kb -//- Впровадження ліміту на максимальний розмір запиту на рівні 30 kb - Socket timeout: 60s -//- Час очікування сокету: 60s - Limit the number of open sockets to 10 sockets per user per minute -//- Обмеження кількості відкритих сокетів на рівні 10 сокетів для одного користувача протягом хвилини |Taken into account in the initial design | High -//|Враховано в початковому дизайні | Високий | Denial of service due to depletion of computing resources (DoS) caused by the lack of restrictions for the service at the openshift level -//| Відмова в обслуговуванні через вичерпання обчислювальних ресурсів (DOS) спричинине відсутністю обмежень для сервісу на рівні опеншифту a| - Limit RAM usage. The limit itself must be calculated after testing. -//- Обмеження споживання оперативної памяті. Сам ліміт повинен бути прорахований після проведення тестування. - Limit CPU time consumption. The limit itself must be calculated after testing. -//- Обмеження споживання часу процесора. Сам ліміт повинен бути прорахований після проведення тестування. - Configure the mechanism for restarting the service in case of excessive use of resources. -//- Налаштувати механізм перезапуска сервісу в разі надмірного використання ресурсів. | Taken into account in the initial design | High -//| Враховано в початковому дизайні | Високий | Denial of service due to depletion of computing resources (DoS) caused by the lack of restrictions for HTTP requests at the level of the Kong ingress controller -//| Відмова в обслуговуванні через вичерпання обчислювальних ресурсів (DOS) спричинине відсутністю обмежень для HTTP запитів на рівні інгрес контролеру Kong a| - The socket limit and the number of requests must be configured separately in the /groovy endpoint. That is, the rate limit plugin for Kong must be set in /groovy -//- Обмеження сокету та кількості запитів має бути налаштований окремо на /groovy ендпоінт. Тобто плагін рейт лімітів для Kong має бути налаштований на /groovy | Not taken into account in the initial design | High -//| Не враховано в початковому дизайні | Високий | Risk of backdoor in the language-server component -//| Ризик бекдору у компоненті language-server a| - Embed all the necessary resources and language dictionaries to parse AST in the ddm-language-server image to prevent any calls of this service to external sources -//- Вбудувати усі необхідні ресурси та мовні словники для розбору AST в імедж ddm-language-server для запобігання будь-яких звернень цього сервісу до зовнішніх джерел - Prohibit any communications of the ddm-language-server service with external resources at the level of openshift network policies and allow communications with the logging service and services involved according to the business logics. -//- Заборонити на рівні мережевих політик openshift будь яке спілкування сервісу ddm-language-server з зовнішніми ресурсами і дозволити комунікацію з сервісом логування та сервісами задіяними згідно бізнес логіки. | Partially taken into account in the initial design. It is required to completely isolate the ddm-language-server service from the external network | High -//| Частково враховано в початковому дизайні. Неодхідно повністю ізолювати сервіс ddm-language-server від зовнішньої мережі | Високий | Risk of executing vulnerability of interactive information systems (XSS) -//| Ризик виконання вразливості інтерактивних інформаційних систем (XSS) a| - CORS settings -//- Налатування CORS | Taken into account in the initial design | High -//| Враховано в початковому дизайні | Високий | Risk of disclosing technical information about the system -//| Ризик розкриття технічної інформації про систему a| - The service must return a general error in case of problems. -//- Сервіс має віддавати загальну помилку при появі проблем. - The service must have the "last resort" mechanism that handles any errors that have not been processed before. -//- Сервіс повинен мати механізм "last resort" який опрацює будь-які помилки які не були опрацьовані до цього. - Make sure the DEBUG mode is off at all levels in the pre-production and production environments. -//- Переконатись що режим DEBUG вимкнений на усіх рівнях у пре-продакшн та продакшн середовищах. - language-server does not return its version and any technical and/or system information in the HTTP response. -//- language-server не віддає свою версію та будь-яку технічну та/або системну інформацію у HTTP відповіді. | Not taken into account in the initial design | Medium -//| Не враховано в початковому дизайні | Середній | Deserialization of unreliable data -//| Десеріалізація ненадійних даних a| - Make sure that there is avoidance of or protection against deserialization of unreliable data both in the developed code and in third-party libraries. -//- Переконатись, що десеріалізація ненадійних даних уникається або захищена як у розробленому коді, так і в бібліотеках сторонніх розробників. - Make sure that there is a check of the JSON scheme, and it is checked before accepting the entered data. -//- Переконатись, що присутня перевірка схеми JSON та вона перевірена, перш ніж приймати введені дані. | Not taken into account in the initial design | Medium -//| Не враховано в початковому дизайні | Середній | Risk of a group of web vulnerabilities and compliance with security requirements -//| Ризик появи групи веб вразливостей та відповідність вимогам безпеки a| - Make sure that requests containing unexpected or missing Content Types are rejected by the corresponding headers (status of the HTTP response: 406 Unacceptable, or 415 Unsupported media type). -//- Переконатись, що запити, які містять неочікувані або відсутні Content Types, відхиляються відповідними заголовками (статус відповіді HTTP 406 Неприйнятний або 415 Непідтримуваний тип медіа). - The web server accepts only approved HTTP methods. -//- Веб сервер приймає тільки затверджені HTTP методи. - Make sure that the HTTP response has the Content-Type header as well as a safe character set (for example, UTF-8, ISO-8859-1). -//- Переконатись що HTTP відповідь має заголовок Content-Type а також безпечний набір символів (наприклад, UTF-8, ISO-8859-1). - The web page with Monaco Editor must contain the customized Content Security Policy (CSP) headers. -//- Веб сторінка з Монако редактором має містити налаштовані заголовки Content Security Policy (CSP). - Monaco Editor web page must contain the X-Content-Type-Options title: nosniff -//- Веб сторінка з Монако редактором має містити заголовок X-Content-Type-Options: nosniff | Not taken into account in the initial design | Medium -//| Не враховано в початковому дизайні | Середній | The risk of fixing in the system when exploiting a vulnerability to the system level and subsequent lateral movement. Compliance with the requirements. -//| Ризик закріплення в системі при експлуатації вразливості до системного рівня та подальший бічний рух. Відповідність вимогам. a| - The system service must not receive the account service key from openshift (unless it is a requirement), and must be run from a non-privileged system user. -//- Системний сервіс не повинен отримувати ключ сервіс аккаунту від openshift (якщо це не являється вимогою) та повинен бути запущенний від не привілейованого системного користувача. | Not taken into account in the initial design | Medium -//| Не враховано в початковому дизайні | Середній | Insufficient logging and safety compliance -//| Недостатнє журналювання та відповідність вимогам безпеки a| - The target service must log all requests and send them to a centralized logging and monitoring system. -//- Цільовий сервіс має логувати усі запити та надсилати їх до централізованої системи логування та моніторингу. - Make sure that all unsuccessful requests and errors arising during operations are logged. -//- Переконатись що усі неуспішні запити та помилки при виконанні операцій будуть залоговані. - The logging system must use the unified time and time zone. -//- Система логування має використовувати уніфікований час та часову зону. -- Logs must have the unified format and contain all the necessary information for investigation of security incidents. -//- Логи мають бути у уніфікованому форматі та містити усю необхідну інформацію для розслідування інцидентів безпеки. +- Logs must have a unified format and contain all the necessary information for investigation of security incidents. - Logs must not contain sensitive information, or it must be obfuscated accordingly -//- Логи не мають містити чутливої інформації або вона повинна бути заплутана (obfuscated) відповідним чином | Not taken into account in the initial design | Low -//| Не враховано в початковому дизайні | Низький | Misconfiguration of the service and/or framework -//| Місконфігурація сервісу та/або фреймфорку a| - Make sure that the server configuration is protected in accordance with the recommendations of the application server and the frameworks used.(web server/app server/framework hardening) -//- Переконатись, що конфігурація сервера захищена відповідно до рекомендацій сервера додатків і фреймворків, які використовуються.(web server/app server/framework hardening) | Not taken into account in the initial design | Low -//| Не враховано в початковому дизайні | Низький |=== === Comprehensive protection measures testing system -//=== Система тестування комплексу засобів захисту (КCЗ) . The repository with the source code must be onboarded to the vulnerability management system and undergo regular testing. -//. Репозиторій з вихідним кодом повинен бути заонборджений до системи керування вразливостями та проходити регулярне тестування . The basic image of the service must be scanned and not contain unresolved critical vulnerabilities. -//. Базовий імедж сервісу повинен бути просканований та не містити не вирішенних критичних вразливостей . The basic image must be placed in a trusted repository controlled by the organization. -//. Базовий імедж повинен бути розміщений в довіреному сховищі підконтрольному організації . The language-server technology should be added to the list of the used 3rd party products (inventory). -//. Технологія language-server повинна бути додана до переліку 3rd party продуктів які використовуються (inventory) - diff --git a/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/ceph-storage.adoc b/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/ceph-storage.adoc index 52a13e2b48..73142a2729 100644 --- a/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/ceph-storage.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/ceph-storage.adoc @@ -1,16 +1,7 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Object data storage +include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] -NOTE: 🌐 This document is available in both English and Ukrainian. Use the language toggle in the top right corner to switch between versions. +include::platform:ROOT:partial$admonitions/language-en.adoc[] == General description @@ -27,7 +18,7 @@ The bucket for storing CSV files with a list of officers for importing to the re [NOTE] -- -Read this xref:registry-develop:registry-admin/import-users-officer-description-file-csv.adoc[article] to learn about the CSV file structure. +Read this xref:registry-develop:registry-admin/create-users/import-users-officer.adoc[article] to learn about the CSV file structure. //Зі структурою CSV-файлу можна ознайомитись в xref:registry-develop:registry-admin/import-users-officer-description-file-csv.adoc[статті] -- diff --git a/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/overview.adoc b/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/overview.adoc index 5593392ff7..04352d6e50 100644 --- a/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/overview.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/overview.adoc @@ -6,59 +6,47 @@ include::platform:ROOT:partial$admonitions/language-en.adoc[] == General description The subsystem that provides capability of the registry development functionality based on the _Lowcode_ principles in the form of xref:architecture/registry/administrative/regulation-management/registry-regulation/registry-regulation.adoc[_digital registry regulations_] and provides capabilities for managing the officer accounts. -//Підсистема, яка реалізує можливості розробки функціональності реєстру за принципами _Lowcode_ у вигляді xref:architecture/registry/administrative/regulation-management/registry-regulation/registry-regulation.adoc[_цифрового регламенту реєстру_] та надає можливості по управлінню обліковими записами посадових осіб. == Subsystem functions -//== Функції підсистеми * Modeling of the xref:architecture/registry/administrative/regulation-management/registry-regulation/registry-regulation.adoc[registry regulations components] based on the _Lowcode_ principles: -//* Моделювання -//xref:architecture/registry/administrative/regulation-management/registry-regulation/registry-regulation.adoc[складових регламенту реєстру] -//за принципами _Lowcode_ + * Batch download of users. -//* Пакетне завантаження користувачів + * Amendments to the declarative description of the registry regulations. -//* Внесення змін у декларативний опис регламенту реєстру + * Versioning of the registry regulations with a history of changes. -//* Версіонування регламенту реєстру з історією внесення змін + * Monitoring of changes before entering them into the registry regulations. -//* Проведення інспекції змін перед внесенням їх до регламенту реєстру + * Viewing the results of monitoring of changes to the registry regulations by the xref:architecture/registry/administrative/regulation-publication/overview.adoc[Registry regulations deployment subsystem]. -//* Перегляд результатів перевірки змін в регламент реєстру -//xref:architecture/registry/administrative/regulation-publication/overview.adoc[Підсистемою розгортання регламенту реєстру] == Subsystem technical design -//== Технічний дизайн підсистеми .Component diagram of regulations modeling subsystem. General -//.Компонентна діаграма підсистеми моделювання регламенту. Загальна -image::architecture/registry/administrative/regulation-management/regulation-management-design.svg[] +image::architecture/registry/administrative/regulation-management/regulation-management-design-1.svg[] -* _(1)_ - The report archive is a zip archive that contains a list of requests and report settings in a declarative format. -//* _(1)_ - Архів звіту - це zip архів який в собі містить перелік запитів та налаштування звітів в декларативному форматі. -* _(2)_ - Scenarios that are relevant for modeling -//* _(2)_ - Сценарії які релевантні для моделювання -* _(3)_ - The internal structure of the Redash components is described in the xref:arch:architecture/registry/operational/reporting/overview.adoc[Registry analytical reporting subsystem] -//* _(3)_ - Внутрішня структура компонентів Redash описана у xref:arch:architecture/registry/operational/reporting/overview.adoc[Підсистемі аналітичної звітності реєстру] +* _(1)_ -- The report archive is a zip archive that contains a list of requests and report settings in a declarative format. + +* _(2)_ -- Scenarios that are relevant for modeling + +* _(3)_ -- The internal structure of the Redash components is described in the xref:arch:architecture/registry/operational/reporting/overview.adoc[Registry analytical reporting subsystem] [#subsystem-components] == Subsystem components -//== Складові підсистеми |=== |Component name|Representation in register|Origin|Repository|Purpose -//|Назва компоненти|Представлення в реєстрі|Походження|Репозиторій|Призначення |_Regulation modeling web interface_ -//|_Веб-інтерфейс моделювання регламенту_ + |`admin-portal` |origin -|https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/low-code-platform/platform/frontend/applications/common-web-app[github:/mdtu-ddm/low-code-platform/platform/frontend/applications/common-web-app] +|https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/low-code-platform/platform/frontend/applications/common-web-app[gerrit:/mdtu-ddm/low-code-platform/platform/frontend/applications/common-web-app] |Client web application for modeling registry regulations based on _Lowcode_ principles -//|Клієнтський вебдодаток для моделювання регламенту реєстру за принципами _Lowcode_ |_Report modeling web interface_ -//|_Веб-інтерфейс моделювання звітів_ + a| * `redash-admin` * `redash-admin-adhocworker` @@ -67,87 +55,76 @@ a| * `redash-admin-redis-master` |fork a| -* https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/data-architecture/devops-application/redash-chart[gerrit:/mdtu-ddm/data-architecture/devops-application/redash-chart] -* https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/data-architecture/application/redash[gerrit:/mdtu-ddm/data-architecture/application/redash] +* https://github.com/epam/edp-ddm-redash-chart[github:/epam/edp-ddm-redash-chart] +* https://github.com/epam/edp-ddm-redash[github:/epam/edp-ddm-redash] * https://github.com/getredash/redash[github:/getredash/redash] |Client web application for creating and configuring analytical reports and dashboards -//|Клієнтський вебдодаток для створення та налаштування аналітичних звітів та дашбордів |_Service for monitoring and storage of changes to regulations_ -//|_Сервіс інспекції та зберігання змін регламенту_ + a| * `gerrit` * `gerrit-operator` |3rd-party a| -* https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/devops/operators/gerrit-operator[gerrit:/mdtu-ddm/devops/operators/gerrit-operator] +* https://github.com/epam/edp-ddm-gerrit-operator[github:/epam/edp-ddm-gerrit-operator] * https://gerrit.googlesource.com/gerrit/[gerrit:/googlesource/gerrit] |Software tool allowing storage and management of registry regulations versions. -//|Програмний інструмент, що дозволяє зберігати та керувати версіями регламентів реєстрів. |_Regulations management service_ -//|_Сервіс управління регламентом_ + |`registry-regulation-management` |origin |https://github.com/epam/edp-ddm-registry-regulation-management[github:/epam/edp-ddm-registry-regulation-management] |The service that provides a REST API for working with versions of the registry regulations and their components -//|Сервіс який надає REST API для роботи з версіями регламенту реєстру та його складовими |_Language server_ -//|_Language сервер_ + |`ddm-language-server` |origin -|https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/low-code-platform/platform/backend/applications/ddm-language-server[gerrit:/mdtu-ddm/low-code-platform/platform/backend/applications/ddm-language-server] +|https://github.com/epam/edp-ddm-language-server[github:/epam/edp-ddm-language-server] |The service that provides the functionality of hints, autocompletion of functions and checks when editing code in the _Regulation modeling web interface_ -//|Сервіс який надає функціональність підказок, автодоповнення функцій та перевірки при редагуванні коду у _Веб-інтерфейсі моделювання регламенту_ |_Reports exporting service_ -//|_Сервіс вивантаження звітів_ + |`report-exporter` |origin |https://github.com/epam/edp-ddm-report-exporter[github:/epam/edp-ddm-report-exporter] |The service that provides REST API access to export reports from the _Report modeling web interface_ -//|Сервіс який надає REST API доступ для експорту звітів з _Веб-інтерфейсу моделювання звітів_ |Utility for downloading officers -//|_Утіліта завантаження надавачів послуг_ + |`publish-users-job` |origin |https://github.com/epam/edp-ddm-user-publisher[github:/epam/edp-ddm-user-publisher] |The service that provides REST API access to export reports from the _Report modeling web interface_ -//|Сервіс який надає REST API доступ для експорту звітів з _Веб-інтерфейсу моделювання звітів_ |xref:architecture/registry/administrative/regulation-management/ceph-storage.adoc#_user_import[Operational storage of file with users] -//|xref:architecture/registry/administrative/regulation-management/ceph-storage.adoc#_user_import[Операційне сховище файлів з користувачами] + |`ceph:user-import` |origin |https://github.com/epam/edp-ddm-registry-configuration/blob/main/deploy-templates/templates/CephObjectBucketClaim.yaml[github:/epam/edp-ddm-registry-configuration/blob/main/deploy-templates/templates/CephObjectBucketClaim.yaml] |Storing a file with users for import -//|Зберігання файлу з користувачами для імпорту |xref:architecture/registry/administrative/regulation-management/ceph-storage.adoc#_user_import_archive[Archive storage of files with users] -//|xref:architecture/registry/administrative/regulation-management/ceph-storage.adoc#_user_import_archive[Архівне сховище файлів з користувачами] + |`ceph:user-import-archive` |origin |https://github.com/epam/edp-ddm-registry-configuration/blob/main/deploy-templates/templates/CephObjectBucketClaim.yaml[github:/epam/edp-ddm-registry-configuration/blob/main/deploy-templates/templates/CephObjectBucketClaim.yaml] |Archive of files with users for import -//|Архів файлів з користувачами для імпорту |xref:architecture/registry/administrative/regulation-management/registry-regulation/registry-regulation.adoc[Git repository of the Digital registry regulations] -//|xref:architecture/registry/administrative/regulation-management/registry-regulation/registry-regulation.adoc[Git репозиторій Цифрового регламенту реєстру] + |`gerrit:registry-regulations` |origin |https://github.com/epam/edp-ddm-empty-template-registry-regulation[github:/epam/edp-ddm-empty-template-registry-regulation] |Git repository of the Digital registry regulations in the service for monitoring and storage of changes to the regulations -//|Git репозиторій Цифрового регламенту реєстру у сервісі інспекцій та зберігання змін регламенту |=== == Technology stack -//== Технологічний стек The following technologies were used when designing and developing the subsystem: -//При проєктуванні та розробці підсистеми, були використані наступні технології: * xref:arch:architecture/platform-technologies.adoc#java[Java] * xref:arch:architecture/platform-technologies.adoc#spring[Spring] @@ -171,14 +148,11 @@ The following technologies were used when designing and developing the subsystem === Security Only authorized users can access to the subsystem web interfaces. The standard system mechanisms, such as https://openid.net/developers/how-connect-works/[OpenID Connect] and https://saml.xml.org/saml-specifications[SAML] integration with the xref:architecture/platform/operational/user-management/overview.adoc[Users and roles management subsystem], are used for authorization. -//Доступ до веб-інтерфейсів підсистеми можливий тільки для авторизованих користувачів. Для авторизації використовується стандартні механізми системи такі як https://openid.net/developers/how-connect-works/[OpenID Connect] та https://saml.xml.org/saml-specifications[SAML] інтеграція з xref:architecture/platform/operational/user-management/overview.adoc[Підсистемою управління користувачами та ролями]. === Usability -Modeling of the regulations in the subsystem web interfaces is performed according to the principles of _Lowcode_ with auto-prompts for users, auto-completion and validation of the entered information. This allows to reduce the time for development of the regulations and enhance training of users. -//Моделювання регламенту у веб-інтерфейсах підсистеми здійснюється за принципами _Lowcode_ з впровадженням автопідказок для користувача, автодоповнення та валідації введеної інформації що дозволяє зменшити час на розробку регламенту та збільшити навченість користувачів. +Modeling of the regulations in the subsystem web interfaces is performed according to the principles of _Low-code_ with auto-prompts for users, auto-completion and validation of the entered information. This allows reducing the time for development of the regulations and enhancing training of users. === Modifiability -The structure of the subsystem's xref:architecture/registry/administrative/regulation-management/registry-regulation/registry-regulation.adoc[_digital registry regulations_] is divided onto individual elements that are loosely coupled to each other (the principle of Low coupling) and use the principles of _Lowcode_ for development, which simplifies implementation of new changes to the regulations, accelerates the speed of development and reduces the required expertise of a modeler. -//Структура xref:architecture/registry/administrative/regulation-management/registry-regulation/registry-regulation.adoc[_цифрового регламенту реєстру_] підсистеми розділена на окремі елементи, які слабо пов'язані один з одним (принцип Low coupling) та використовують принципи _Lowcode_ для розробки, що спрощує внесення нових змін до регламенту, прискорює швидкість розробки та зменшує необхідну експертизу моделювальника. \ No newline at end of file +The structure of the subsystem's xref:architecture/registry/administrative/regulation-management/registry-regulation/registry-regulation.adoc[_digital registry regulations_] is divided onto individual elements that are loosely coupled to each other (the principle of Low coupling) and use the principles of _Low-code_ for development, which simplifies implementation of new changes to the regulations, accelerates the speed of development and reduces the required expertise of a modeler. diff --git a/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/platform-evolution/form-scripts/form-scripts.adoc b/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/platform-evolution/form-scripts/form-scripts.adoc index 18f5b751f8..995f03e74a 100644 --- a/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/platform-evolution/form-scripts/form-scripts.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/platform-evolution/form-scripts/form-scripts.adoc @@ -1,51 +1,34 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: += Externalizing UI form scripts +include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] -= Externalization of UI form scripts - -NOTE: 🌐 This document is available in both English and Ukrainian. Use the language toggle in the top right corner to switch between versions. +include::platform:ROOT:partial$admonitions/language-en.adoc[] == General description -When modeling forms for tasks, it is often necessary to use the same Javascript functions that have to be duplicated. This relates both to functions that are relevant for any registry, and to those that make sense to reuse within specific regulations or even a business process. -//При моделюванні форм для задач часто виникає необхідність використовувати одні й ті самі Javascript функції які доводиться дублювати. Це стосується як функцій актуальних для будь-якого реєстру, так і тих які мають сенс перевикористовувати саме у рамках конкретного регламенту або навіть бізнес процесу. +When modeling forms for tasks, it is often necessary to use the same Javascript functions that have to be duplicated. This approach relates to relevant functions for any registry and those that make sense to reuse within specific regulations or even a business process. -To process all these scenarios, it is suggested to save individual javascript files *at the regulations level*. These files are available through API in form-schema-provider and are used when performing tasks. -//Для обробки всіх цих сценаріїв пропонується використовувати збереження окремих javascript файлів *на рівні регламенту*. Ці файли доступні через API у form-schema-provider та використовуються при виконанні задач. +We suggest saving individual javascript files *at the registry regulations level* to process all these scenarios. These files are available through API in form-schema-provider and are used when performing tasks. [user-roles] === User roles -//=== Ролі користувачів * Registry regulations developer == Functional scenarios -//== Функціональні сценарії -* Reusing Javascript repeated functions within Javascript inserts when modeling forms. The following form parameters are supported: -//* Перевикористання Javascript функцій, що повторюються у рамках Javascript вставок при моделюванні форм. Підтримуються такі параметри форм: -** Custom Default Value -** Calculated Value -** Custom Validation -** Advanced Conditions -** others, including specific to some components (for example, Filter Query and Custom Filter on the Select component) -//** інші, включаючи специфічні для деяких компонентів (наприклад, Filter Query та Custom Filter на компоненті Select) +* Reusing Javascript repeated functions within Javascript insertions when modeling forms. The following form parameters are supported: + +** *Custom Default Value* +** *Calculated Value* +** *Custom Validation* +** *Advanced Conditions* +** others, including specific to some components, for example, *Filter Query* and *Custom Filter* on the *Select* component. == Target design -//== Цільовий дизайн === Example of a file containing an externalized script -//=== Приклад файла який містить екстерналізований скрипт After adding such a file, users are able to use the `myUtil` function and the `myConst` variable in their Javascript inserts: -//Після додавання такого файлу користувачі зможуть використовувати функцію `myUtil` та змінну `myConst` у своїх Javascript вставках: [source,javascript] ---- @@ -56,74 +39,52 @@ function myUtil() { var myConst = 'veryCustom'; ---- -=== System components and their purpose in the solution design -//=== Компоненти системи та їх призначення в рамках дизайну рішення +=== System components and their purpose in the scope of the solution design -This section provides a list of system components that are involved or need to be changed/created as part of the implementation of functional requirements according to the technical design of the solution. -//У даному розділі наведено перелік компонент системи, які задіяні або потребують змін/створення в рамках реалізації функціональних вимог згідно технічного дизайну рішення. +This section provides a list of system components that are involved or need to be changed/created as part of implementing functional requirements according to the technical design of the solution. |=== -|Component|Official name|Purpose / Essence of changes -//|Компонент|Службова назва|Призначення / Суть змін +|Component|Service name|Purpose / Essence of changes -|_Register regulations_ -//|_Регламент реєстру_ +|_Registry regulations_ |*registry-regulations-publications* -|Add the form-scripts folder for storing externalized scripts. -//|Додати папку form-scripts для зберігання екстерналізованих скриптів. +|Add the _form-scripts_ folder for storing externalized scripts. -|_Regulations publication pipeline_ -//|_Пайплайн публікації регламенту_ +|_Registry regulations publication pipeline_ |*registry-regulations-publication-pipeline* -|Add processing of externalized scripts -- their storage and updating in the *form-schema-provider* service (similar to forms). -//|Додати обробку екстерналізованих скриптів - їх зберігання та оновлення у сервісі *form-schema-provider* (аналогічно до форм). +|Add processing of externalized scripts -- their storage and updating in the *`form-schema-provider`* service (similar to forms). |_Form providing service_ -//|_Сервіс постачання форм_ |*form-schema-provider* |Forms will now require externalized scripts. In the form-schema-provider service, it is necessary to add the ability to store and update scripts separately from forms. You also need to add a separate GET formScriptList endpoint so that it returns all scripts together in the String format. -//|Для роботи форм тепер будуть потрібні екстерналізовані скрипти. На сервісі form-schema-provider треба додати можливість зберігати та оновлювати скрипти окремо від форм. Також треба додати окремий ендпоінт GET formScriptList для того, щоб він віддавав усі скрепти разом у форматі String. |_Regulations management service_ -//|_Сервіс управління регламентом_ |*registry-regulation-management* -|For correct work with form preview on *admin-portal*, externalized scripts must be connected to the form. Therefore, in addition to *form-schema-provider*, changes are also required in the regulation management service. As part of these changes, one more endpoint should be added for the candidate and master versions that will read script files and return them in String format. -//|Для правильної роботи з попереднім переглядом форми на *admin-portal* екстерналізовані скрипти повинні буди підключені до форми. Тому окрім *form-schema-provider* зміни необхідні також і у сервісі управління регламентом. У рамках цих змін треба додати ще один ендпоінт для кандидат та майстер версій який буде зчитувати файли скриптів та віддавати їх у форматі String. +|Externalized scripts must be connected to the form for correct work with form preview on *`admin-portal`*. Therefore, in addition to *`form-schema-provider`*, changes are also required in the regulation management service. As part of these changes, one more endpoint should be added for the candidate and master versions that will read script files and return them in `String` format. |_UI form data validation service_ -//|_Сервіс валідації даних UI-форм_ |*form-submission-validation* -|For the correct validation of entered data, it is necessary to make the same computations as in the portals. Therefore, the validation service must also take into account externalized scripts. -//|Для правильної валідації введених даних необхідно зробити ті самі обчислення, що і на кабінетах. Тому сервіс валідації повинен теж враховувати екстерналізовані скрипти. +|For the correct validation of entered data, it is necessary to make the exact computations as in the portals. Therefore, the validation service must also take into account externalized scripts. -|_Register administrator portal_ -//|_Кабінет адміністратора реєстру_ +|_Administrative portal_ |*admin-portal* -|Change the form component so that it accepts arbitrary scripts as text and performs all Javascript computations based on these scripts. -//|Змінити компонент форми так щоб він приймав довільні скрипти у вигляді текста та виконував усі Javascript обчислення з урахуванням цих скриптів. +|Change the form component to accept arbitrary scripts as text and perform all Javascript computations based on these scripts. -|_Officer portalи_ -//|_Кабінет посадової особи_ +|_Officer portal_ |*officer-portal* |Add script data processing and transfer it to the form component as text -//|Додати обробку даних скриптів та передати їх у компонент форми у вигляді тексту) |_Citizen portal_ -//|_Кабінет громадянина_ |*citizen-portal* |Add script data processing and transfer it to the form component as text -//|Додати обробку даних скриптів та передати їх у компонент форми у вигляді тексту) |=== === Registry regulations -//=== Регламент реєстру -Add the *form-scripts* folder to regulations' Gerrit for storing scripts: -//Додати папку *form-scripts* у герріт регламента для зберігання скриптів: +Add the *_form-scripts_* folder to regulations' Gerrit for storing scripts: -.Structure of the registry regulations -//.Структура регламенту реєстру +.Registry regulations structure [plantuml, registry-config-regulation-structure, svg] ---- include::partial$architecture/registry/administrative/regulation-management/platform-evolution/form-scripts/form-scripts-structure.puml[] @@ -131,35 +92,27 @@ include::partial$architecture/registry/administrative/regulation-management/plat === Registry regulations publications pipeline -The `UploadFormScripts.groovy` file in `/platform/pipelines/stages/impl/lowcode` must be added to *registry-regulations-publications*. The implementation of this script is similar to the `UploadFormChanges.groovy` script for saving forms. -//Необхідно додати у *registry-regulations-publications* файл `UploadFormScripts.groovy` у `/platform/pipelines/stages/impl/lowcode`. Реалізація цього скрипта буде подібна до `UploadFormChanges.groovy` - скрипта по зберіганню форм. +The *_UploadFormScripts.groovy_* file must be added to the *_/platform/pipelines/stages/impl/lowcode_* in the *_registry-regulations-publications_*. The implementation of this script is similar to the _UploadFormChanges.groovy_ script for saving forms. === Portals and validation service -//=== Портали та сервіс валідації -One way or another, portals will receive externalized scripts in the `String` format and pass them to the form component. The form component will add the script text to any Javascript attribute of the form components. This way, all functions and constants will be available when computing Javascript attributes. This applies to officer-portal, citizen-portal, admin-portal and form-submission-validation. -//Портали будуть так чи інакше отримувати екстерналізовані скрити у форматі `String` та передавати у компонент форми. Компонент форми до будь-якого Javascript атрибута компонентів форм буде додавати текст скриптів. Таким чином усі функції та константи будуть доступні при обчисленні Javascript атрибутів. Це стосується officer-portal, citizen-portal, admin-portal та form-submission-validation. +One way or another, portals will receive externalized scripts in the `String` format and pass them to the form component. The form component will add the script text to any Javascript attribute of the form components. This way, all functions and constants will be available when computing Javascript attributes. This approach applies to `officer-portal`, `citizen-portal`, `admin-portal`, and `form-submission-validation` services. -.Execution order of the Javascript attribute -//.Порядок виконання Javascript атрибута +.Javascript attribute execution order [plantuml, registry-config-regulation-attribute, svg] ---- include::partial$architecture/registry/administrative/regulation-management/platform-evolution/form-scripts/form-scripts-attribute.puml[] ---- === Form providing service -//=== Сервіс постачання форм ==== Changes in Redis -//==== Зміни у Redis -- Create the new namespace (keyspace): `bpm-form-scripts` -//- Створити новий простір імен (keyspace): `bpm-form-scripts` +* Create the new namespace (keyspace): `bpm-form-scripts` ==== Endpoints -.form-schema-provider new API -//.form-schema-provider нові API +._form-schema-provider new API_ [%collapsible] ==== swagger::{attachmentsdir}/architecture/registry/administrative/regulation-management/platform-evolution/form-scripts/form-provider-swagger.yml[] @@ -169,40 +122,25 @@ swagger::{attachmentsdir}/architecture/registry/administrative/regulation-manage ==== Endpoints -.registry-regulation new API -//.registry-regulation нові API +._registry-regulation new API_ [%collapsible] ==== swagger::{attachmentsdir}/architecture/registry/administrative/regulation-management/platform-evolution/form-scripts/registry-regulation-swagger.yml[] ==== == Development plan -//== План розробки === Technical assessments -//=== Технічні експертизи - FE (changes in portals) -//- FE (зміни у порталах) - BE (changes in services) -//- BE (зміни в сервісах) - DevOps (changes in the publication pipeline) -//- DevOps (зміни у пайплайні публікації) === Plan -//=== План - Add an endpoint to the *registry-regulation-management* service for getting scripts -//- Додати ендпоінт до сервіса *registry-regulation-management* для отримання скриптів -- Add endpoints to the *form-schema-provider* service for saving, changing and getting scripts -//- Додати ендпоінти до сервіса *form-schema-provider* для збереження, зміни та отримання скриптів +- Add endpoints to the *form-schema-provider* service for saving, changing, and getting scripts - Update the form component -//- Оновити компонент форми -- Request externalized scripts on the admin-portal and transfer them to the form component -//- Запросити екстреналізовані скрипти на admin-portal та передати у компонент форми +- Request externalized scripts on the `admin-portal` and transfer them to the form component - Process the parameter of the externalized scripts on the citizen and officer portal and pass it to the form component -//- Обробити параметр екстреналізованих скриптів на citizen та officer portal та передати у компонент форми -- Add request for *form-schema-provider* in *form-submission-validation* and process scripts -//- Додати запит на *form-schema-provider* у *form-submission-validation* та обробити скрипти +- Add a request for *form-schema-provider* in *form-submission-validation* and process scripts - Add changes to the publication pipeline -//- Додати зміни у пайплайн публікації -- Add a reference business process to consent -//- Додати референтний бізнес процес у consent +- Add a reference business process to consent \ No newline at end of file diff --git a/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/platform-evolution/master-development/master-development.adoc b/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/platform-evolution/master-development/master-development.adoc index 3045aeba20..197f0a5316 100644 --- a/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/platform-evolution/master-development/master-development.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/platform-evolution/master-development/master-development.adoc @@ -1,16 +1,7 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Regulations development in a master version for forms and processes: simplified modeling and overwrite protection +include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] -NOTE: 🌐 This document is available in both English and Ukrainian. Use the language toggle in the top right corner to switch between versions. +include::platform:ROOT:partial$admonitions/language-en.adoc[] == General description @@ -71,7 +62,9 @@ All the functional scenarios refer to the _Regulations modeling web interface_. //* При редагуванні та видаленні сутності повинна виконуватися перевірка на те що зміни застосовуються відносно останньої версії сутності (незалежно у версії-кандидаті чи мастер-версії) * When checking for availability of changes, it has to be taken into account that changes can be made both in the Admin portal and directly in Gerrit. //* При перевірці на зміни повинно враховуватися що зміни можуть бути внесені як через Адмін портал, так і напряму у Gerrit -* When editing and deleting an entity (http method PUT, DELETE), the general xref:arch:architecture/registry/administrative/regulation-management/services/registry-regulation-management/rest-api/rest-api-partials/optimistic-locking.adoc[] approach has to be used that is used in the system. +* When editing and deleting an entity (http method PUT, DELETE), the general _RestAPI Optimistic locking_ +//xref:arch:architecture/registry/administrative/regulation-management/services/registry-regulation-management/rest-api/rest-api-partials/optimistic-locking.adoc[] +approach has to be used that is used in the system. //* При редагуванні та видаленні сутності (http method PUT, DELETE) використовується загальний xref:arch:architecture/registry/administrative/regulation-management/services/registry-regulation-management/rest-api/rest-api-partials/optimistic-locking.adoc[] підхід який використовується в системі * If conflicting changes are available, the system must remain in a consistent state after processing such a request. //* При наявності змін, що конфліктують система після обробки такого запиту повинна залишатися в консистентному стані diff --git a/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/platform-evolution/sc-where-logic-operators.adoc b/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/platform-evolution/sc-where-logic-operators.adoc index aed168d8c5..605ba93b9d 100644 --- a/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/platform-evolution/sc-where-logic-operators.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/platform-evolution/sc-where-logic-operators.adoc @@ -1,16 +1,7 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Managing logical operators in search conditions +include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] -NOTE: 🌐 This document is available in both English and Ukrainian. Use the language toggle in the top right corner to switch between versions. +include::platform:ROOT:partial$admonitions/language-en.adoc[] == General description diff --git a/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/platform-evolution/sign-validation/sign-validation.adoc b/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/platform-evolution/sign-validation/sign-validation.adoc index 638b50e28a..f02ebcbf35 100644 --- a/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/platform-evolution/sign-validation/sign-validation.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/platform-evolution/sign-validation/sign-validation.adoc @@ -1,16 +1,7 @@ -:toc-title: On this page: -:toc: preamble -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Verifying QES signature and signer in API-received business process content +include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] -NOTE: 🌐 This document is available in both English and Ukrainian. Use the language toggle in the top right corner to switch between versions. +include::platform:ROOT:partial$admonitions/language-en.adoc[] == General description @@ -396,10 +387,9 @@ IntStream.rangeClosed(0, endUser.ASiCGetSignsCount(data)) For CAdES data, `EndUser::VerifyInternal(base64Data)` is used, and the details from the 'EndUserSignInfo' object are returned as a single element in the array. //Для даних в форматі CAdES використовується `EndUser::VerifyInternal(base64Data)` та повертається деталі з об'єкту `EndUserSignInfo` як єдиний елемент в масиві. -== signature_content((, ) +== signature_content(, ) === JUEL function -//=== JUEL функція |=== |Parameter |Description |Type |Data type diff --git a/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/platform-evolution/template-validation/template-validation.adoc b/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/platform-evolution/template-validation/template-validation.adoc index a28dbc34a5..7830d2a99a 100644 --- a/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/platform-evolution/template-validation/template-validation.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/platform-evolution/template-validation/template-validation.adoc @@ -1,6 +1,5 @@ -include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] - = Validating empty business process mandatory fields on the template level +include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] diff --git a/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/registry-regulation/registry-regulation.adoc b/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/registry-regulation/registry-regulation.adoc index 91531c968e..28b70b0b7f 100644 --- a/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/registry-regulation/registry-regulation.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/registry-regulation/registry-regulation.adoc @@ -1,16 +1,7 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Digital registry regulations +include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] -NOTE: 🌐 This document is available in both English and Ukrainian. Use the language toggle in the top right corner to switch between versions. +include::platform:ROOT:partial$admonitions/language-en.adoc[] == General description diff --git a/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/user-import.adoc b/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/user-import.adoc index 8cd434b736..fa8b32a298 100644 --- a/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/user-import.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-management/user-import.adoc @@ -1,6 +1,5 @@ -include::ROOT:partial$templates/document-attributes/arch-set-en.adoc[] - = Importing users into Keycloak +include::ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::ROOT:partial$admonitions/language-en.adoc[] @@ -8,7 +7,6 @@ The Platform offers a valuable feature to efficiently add numerous officer users image:architecture/registry/administrative/regulation-management/ImportUsersFlow.drawio.png[User importing process] -//image:architecture/registry/administrative/regulation-management/ImportUsersFlow.drawio.png[Процес імпорту користувачів] . The Access administrator, using the web interface of the administrator portal, downloads a CSV file containing a list of users to import into the registry. //. Адміністратор Доступу з допомогою веб-інтерфейсу порталу адміністратора завантажує CSV файл що містить перелік користувачів для імпорту в реєстр. diff --git a/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-publication/cd-process.adoc b/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-publication/cd-process.adoc index 4796077b69..344fe64e72 100644 --- a/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-publication/cd-process.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-publication/cd-process.adoc @@ -1,8 +1,7 @@ - - = CD processes +include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] -include::ROOT:partial$admonitions/language-en.adoc[] +include::platform:ROOT:partial$admonitions/language-en.adoc[] == EDP flow diff --git a/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-publication/data-api-versioning-decommission.adoc b/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-publication/data-api-versioning-decommission.adoc index b7996459d9..31c420933e 100644 --- a/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-publication/data-api-versioning-decommission.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-publication/data-api-versioning-decommission.adoc @@ -1,9 +1,8 @@ - - //= Відмова від збереження попередніх версій сервісів API фабрики даних = Decommissioning of saving previous versions of data factory API services +include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] -include::ROOT:partial$admonitions/language-en.adoc[] +include::platform:ROOT:partial$admonitions/language-en.adoc[] == Overview diff --git a/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-publication/overview.adoc b/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-publication/overview.adoc index e54e1eb0ac..d165c5689a 100644 --- a/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-publication/overview.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/administrative/regulation-publication/overview.adoc @@ -5,171 +5,139 @@ include::platform:ROOT:partial$admonitions/language-en.adoc[] == Overview -//Підсистема, що забезпечує функції перевірки цілісності внесених змін до xref:architecture/registry/administrative/regulation-management/registry-regulation/registry-regulation.adoc[_цифрового регламенту реєстру_] та їх автоматичне застосування до підсистем xref:architecture/registry/operational/overview.adoc[_операційної зони реєстру_]. The registry regulations deployment subsystem verifies the integrity of the changes made to the xref:architecture/registry/administrative/regulation-management/registry-regulation/registry-regulation.adoc[registry regulations] and automatically applies them to the subsystems of the xref:architecture/registry/operational/overview.adoc[registry operational zone]. == Subsystem functions -//* Відстеження змін до регламенту реєстру * Tracking changes to the registry regulations -//* Валідація цілісності регламенту реєстру + * Validating the integrity of the registry regulations -//* Розгортання тимчасових баз даних для версій кандидатів + * Deploying temporary databases for version candidates -//* Застосування змін до схеми бази даних реєстру + * Applying changes to the registry database schema -//* Генерація коду сервісів доступу до даних реєстру + * Generating code for registry data access services -//* Розгортання сервісів доступу до даних реєстру + * Deploying registry data access services -//* Розгортання змін до бізнес-процесів та UI-форм + * Deploying changes to business processes and UI forms -//* Створення ролей користувачів реєстру + * Creating user roles for the registry -//* Налаштування прав доступу до бізнес-процесів + * Configuring access rights to business processes -//* Застосування змін до налаштувань зовнішніх інтеграцій та між-реєстрової взаємодії + * Applying changes to external integration and cross-registry interaction settings -//* Розгортання змін до шаблонів витягів та звітів + * Deploying changes to report and excerpt templates -//* Розгортання змін до шаблонів повідомлень користувачів + * Deploying changes to user notification templates -//* Застосування змін до налаштувань та кастомізацій реєстру + * Applying changes to registry settings and customization -//* Зберігання артефактів сервісів доступу до даних реєстру + * Storing artifacts of registry data access services -//* Приведення підсистем операційної зони реєстру до стану за замовчуванням (очищення регламенту) + * Resetting operational zone subsystems to the default state (regulations cleanup) -//* Налаштування правил симуляції зовнішніх інтеграцій + * Configuring simulation rules for external integrations -//* Налаштування підсистеми управління геоданими + * Configuring geodata management subsystem -//== Технічний дизайн підсистеми == Technical design -//.Компонентна діаграма підсистеми публікації регламенту -.A component diagram of the regulations deployment subsystem +.A component diagram of the Registry regulations deployment subsystem image::architecture/registry/administrative/regulation-publication/registry-publication-design.drawio.svg[] -//* _(1)_ - Відбувається тільки при першому розгортанні регламенту реєстру включно з відновленням після очищення * _(1)_ - Occurs only on the first deployment of the registry regulations, including post-cleanup recovery. -//== Складові підсистеми [#subsystem-components] == Subsystem components -//TODO: Do we need the Repository column for en version? |=== -//|Назва компоненти|Представлення в реєстрі|Походження|Репозиторій|Призначення + |Component name |Registry representation |Source |Repository |Function -//|_Сервіс розгортання регламенту_ |_Regulations deployment service_ a| * `jenkins` * `jenkins-operator` |3rd-party a| -* https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/devops/operators/jenkins-operator[gerrit:/mdtu-ddm/.../jenkins-operator] +* https://github.com/epam/edp-ddm-jenkins-operator[github:/epam/edp-ddm-jenkins-operator] * https://github.com/jenkinsci/jenkins[github:/jenkinsci/jenkins] -//|Програмний комплекс, що забезпечує автоматизацію в життєвому циклі розгортання регламенту Реєстру + |A software suite that provides automation throughout the registry regulations deployment lifecycle. -//|_Пайплайни розгортання реглменту_ |_Regulations deployment pipeline_ a| * `registry-regulations-publications-pipelines` * `registry-regulations-publication-stages` (DEPRECATED) |origin a| -* https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/devops/registry-regulations-publications/registry-regulations-publication-pipelines[gerrit:/mdtu-ddm/.../registry-regulations-publication-pipelines] -* https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/devops/registry-regulations-publications/registry-regulations-publication-stages[gerrit:/mdtu-ddm/.../registry-regulations-publication-stages] -//| Groovy пайплайни для виконання різноманітних кроків підсистеми розгортання регламенту. Побудовано на базі -//https://epam.github.io/edp-install/user-guide/pipeline-framework/[EDP Pipeline Framework] +* https://github.com/epam/edp-ddm-registry-regulations-publication-pipeline[github:/epam/edp-ddm-registry-regulations-publication-pipeline] +* https://github.com/epam/edp-ddm-registry-regulations-publication-stages[github:/epam/edp-ddm-registry-regulations-publication-stages] |Groovy pipelines to execute the various steps of the regulations deployment subsystem. Built on the https://epam.github.io/edp-install/user-guide/pipeline-framework/[EDP Pipeline Framework]. -//|_Агент розгортання регламенту_ |_Regulations deployment agent_ |`dataplatform-jenkins-agent` |origin -|https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/data-architecture/devops-application/dataplatform-jenkins-agent[gerrit:/mdtu-ddm/.../dataplatform-jenkins-agent] -//|Jenkins агент, який використовується для запуску пайплайнів підсистеми розгортання регламенту і містить всі необхідні залежності для цього. Детальніше з концепцією Jenkins агентів можна ознайомитись https://www.jenkins.io/doc/book/using/using-agents[в офіційній документації] +|https://github.com/epam/edp-ddm-dataplatform-jenkins-agent[github:/epam/edp-ddm-dataplatform-jenkins-agent] |A Jenkins agent that runs the pipelines of the regulations deployment subsystem and has all the necessary dependencies. To learn more about Jenkins agents, refer to Jenkins documentation: https://www.jenkins.io/doc/book/using/using-agents[Using Jenkins agents]. -//|_Сховище артефактів реєстру_ |_Registry artifacts storage_ |`nexus` |3rd-party a| -* https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/data-architecture/devops-application/nexus[gerrit:/mdtu-ddm/data-architecture/devops-application/nexus] +* https://github.com/epam/edp-ddm-nexus[github:/epam/edp-ddm-nexus] * https://github.com/sonatype/nexus-public[github:/sonatype/nexus-public] -//|Збереження згенерованих в підсистемі артефактів |Storing the artifacts generated in the subsystem. -//|_Утиліта валідації регламенту_ |_Regulations validation utility_ |`registry-regulations-validator-cli` |origin -|https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/low-code-platform/platform/backend/utilities/registry-regulations-validator-cli[gerrit:/mdtu-ddm/.../registry-regulations-validator-cli] -//|_Command line interface (CLI)_ для валідації складників регламенту на етапі перевірки потенційних змін -|A _command line interface (CLI)_ for validating the regulations components at the stage of checking potential changes. +|https://github.com/epam/edp-ddm-registry-regulations-validator-cli[github:/epam/edp-ddm-registry-regulations-validator-cli] +|A _command line interface (CLI)_ for validating the registry regulations' components at the stage of checking potential changes. -//|_Утиліта генерації сервісів доступу до даних реєстру_ |_Registry data access services generation utility_ |`service-generation-utility` |origin -|https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/data-architecture/libraries/service-generation-utility[gerrit:/mdtu-ddm/.../service-generation-utility] -//|_CLI_ для генерації коду сервісів доступу до даних реєстру на основі опису _Liqubase_ скриптів -//TODO: "Liqubase" typo in ua version +|https://github.com/epam/edp-ddm-service-generation-utility[github:/epam/edp-ddm-service-generation-utility] |A _CLI_ for generating registry data access services code based on the _Liquibase_ script descriptions. -//|_Утиліта публікації аналітичних звітів та витягів_ |_Reports and excerpts publishing utility_ |`report-publisher` |origin -|https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/data-architecture/libraries/report-publisher[gerrit:/mdtu-ddm/.../report-publisher] -//|_CLI_ для публікації аналітичних звітів та витягів у відповідні підсистеми +|https://github.com/epam/edp-ddm-report-publisher[github:/epam/edp-ddm-report-publisher] |A _CLI_ for publishing reports and excerpts to the corresponding subsystems. -//|_Утиліта управління доступом до БП_ |_BP access management utility_ |`camunda-auth-cli` |origin -|https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/low-code-platform/platform/backend/utilities/camunda-auth-cli[gerrit:/mdtu-ddm/.../camunda-auth-cli] -//|_CLI_ для налаштування прав доступу до БП для відповідних ролей користувачів +|https://github.com/epam/edp-ddm-camunda-auth-cli[github:/epam/edp-ddm-camunda-auth-cli] |A _CLI_ for managing access rights to BP for the corresponding user roles. -//|_Утиліта публікації шаблонів нотифікацій_ |_Notification templates publishing utility_ |`notification-template-publisher` |origin -|https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/data-architecture/libraries/notification-template-publisher[gerrit:/mdtu-ddm/.../notification-template-publisher] -//|_CLI_ для публікації шаблонів нотифікацій у відповідну підсистему +|https://github.com/epam/edp-ddm-notification-template-publisher[github:/epam/edp-ddm-notification-template-publisher] |A _CLI_ for publishing notification templates to the corresponding subsystems. -//|_Утиліта завантаження геошарів_ |_Geolayers loading utility_ |`geoserver-publisher` |origin -|https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/data-architecture/libraries/geoserver-publisher[gerrit:/mdtu-ddm/.../geoserver-publisher] -//|_CLI_ для налаштування підсистеми управління геоданими +|https://github.com/epam/edp-ddm-geoserver-publisher[github:/epam/edp-ddm-geoserver-publisher] |A _CLI_ for configuring the geodata management subsystem. -//|_Тимчасові бази даних реєстру_ |_Temporary registry databases_ |`operational:registry-dev-*` |origin -|https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/gitweb?p=mdtu-ddm/devops/registry-regulations-publications/registry-regulations-publication-pipeline.git;a=blob;f=src/com/epam/digital/data/platform/pipelines/stages/impl/dataplatform/CreateSchemaVersionCandidate.groovy;h=38bb68710a40a192bc52a9620aa249cd6d3010bd;hb=refs/heads/master[gerrit:/mdtu-ddm/.../dataplatform/CreateSchemaVersionCandidate.groovy] -//|Тимчасові бази даних реєстру для версій-кандидатів, які використовуються при моделюванні регламенту для перевірки потенційних змін у _Liquibase_ скриптах +|https://github.com/epam/edp-ddm-registry-regulations-publication-pipeline[github:/epam/edp-ddm-registry-regulations-publication-pipeline/.../dataplatform/CreateSchemaVersionCandidate.groovy] |Temporary registry databases for version candidates are used when modeling the regulations to test potential changes in _Liquibase_ scripts. |=== -//== Технологічний стек == Technological stack -//При проєктуванні та розробці підсистеми, були використані наступні технології: The following technologies were used when designing and developing the subsystem: * xref:arch:architecture/platform-technologies.adoc#java[Java] @@ -190,17 +158,16 @@ The following technologies were used when designing and developing the subsystem * xref:arch:architecture/platform-technologies.adoc#camunda[Camunda] * xref:arch:architecture/platform-technologies.adoc#geoserver[GeoServer] -//== Атрибути якості підсистеми == Subsystem quality attributes === _Deployability_ -//Основна задача підсистеми - це швидке розгортання внесених до регламенту змін у відповідні підсистеми операційної зони реєстру відразу після їх створення. Для реалізації розгортання використовуються загально поширені технології скриптування та автоматизації розгортання, такі як _Groovy_, _Jenkins_, _Helm_. + The main task of the subsystem is to deploy the regulations changes to the corresponding subsystems of the registry operational zone as soon as they are made. The deployment is implemented using common scripting and deployment automation technologies such as _Groovy_, _Jenkins_, and _Helm_. === _Integrability_ -//Перед підсистемою стоїть задача інтеграції з іншими підсистемами операційної зони реєстру. Для цього використовуються _Groovy_ скрипти або CLI адаптери, які містять складну логіку інтеграції та розроблені за допомогою мови програмування _Java_ та поширених фреймворків _Spring_ та _Spring Boot_. + The subsystem must be integrated with other subsystems of the registry operational zone. For this, the system uses _Groovy_ scripts and CLI adapters that contain complex integration logic and are developed using the _Java_ programming language and common frameworks such as _Spring_ and _Spring Boot_. === _Modifiability_ -//Пайплайн публікації регламенту реєстру розділений на окремі кроки, які слабо пов'язані один з одним. Це дозволяє більш безпечно вносити зміни в існуючу реалізацію та розробляти нові функції по застосуванню змін до нових підсистем при розширенні xref:architecture/registry/operational/overview.adoc[операційної зони реєстру]. + The registry regulations deployment pipeline is divided into separate, loosely connected steps. This enables you to safely modify the existing implementation and develop features to update new subsystems when expanding the xref:architecture/registry/operational/overview.adoc[registry operational zone]. \ No newline at end of file diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/audit/audit-db.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/audit/audit-db.adoc index 37b8b340e3..7b6836704d 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/audit/audit-db.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/audit/audit-db.adoc @@ -1,5 +1,4 @@ = Audit events operational database - include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/audit/overview.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/audit/overview.adoc index aaf8124a3b..680a076299 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/audit/overview.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/audit/overview.adoc @@ -1,118 +1,89 @@ = Registry audit events logging subsystem - include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] == Overview -//Підсистема, призначенням якої є отримання та обробка повідомлень про виникнення значущих подій в системі з їх послідуючою гарантованою фіксацією в журналі аудиту для довготривалого зберігання та аналізу. -The _Registry audit events logging subsystem_ receives and processes messages about significant system events and ensures they are recorded in the audit log for long-term storage and analysis. +The *_Registry audit events logging subsystem_* receives and processes messages about significant system events and ensures they are recorded in the audit log for long-term storage and analysis. -//== Функції підсистеми == Subsystem functions -//* Фіксація подій операцій над даними реєстру, ініційованих користувачем в рамках виконання бізнес-процесу -//* Фіксація подій, важливих для забезпечення захисту системи -//* Фіксація загальних подій рівня системи The subsystem logs the following events: * Operations on registry data initiated by the users while executing business processes. * Events critical for ensuring system security. * General system-level events. -//== Технічний дизайн підсистеми == Technical design -//На даній діаграмі зображено компоненти, які входять в _Підсистему журналювання подій аудиту_ та їх взаємодію з іншими підсистемами в рамках реалізації функціональних сценаріїв. -The following diagram presents the _Registry audit events logging subsystem's_ components and their interactions with other subsystems in the scope of the implementation of functional scenarios. +The following diagram presents the _Registry audit events logging subsystem's_ components and their interactions with other subsystems in implementing functional scenarios. image::architecture/registry/operational/audit/audit-overview.svg[float="center",align="center",width=600] -//_Підсистема журналювання подій аудиту_ надає асинхронний _API_ у вигляді _Kafka_-топіка `audit-events` для публікації повідомлень про події аудиту цільовими підсистемами згідно визначеної схеми та використовує для зберігання даних в _Операційну БД подій аудиту_ механізм, який базується на https://kafka.apache.org/documentation.html#connect[Kafka Connect API] для забезпечення `exactly once` семантики обробки повідомлень. The _Registry audit events logging subsystem_ provides an asynchronous _API_ in the form of the _Kafka_ `audit-events` topic for publishing audit event messages by the target subsystems according to a predefined scheme. The subsystem saves data to the _Audit events operational database_ using https://kafka.apache.org/documentation.html#connect[Kafka Connect API] to support _exactly-once_ semantics for message processing. -//Функції перегляду журналу аудиту доступні адміністраторам через веб-інтерфейс _Підсистеми аналітичної звітності_ у вигляді набору службових дашбордів, які створюються під час розгортання реєстру xref:arch:architecture/platform/administrative/overview.adoc[Підсистемою розгортання та налаштування Платформи та реєстрів]. Administrators can view audit logs through the _Registry analytical reporting subsystem's_ web interface as a set of service dashboards created during registry deployment by the xref:arch:architecture/platform/administrative/overview.adoc [_Platform and registries deployment and configuration subsystem_]. [TIP] -- -//Детальніше з дизайном _Підсистеми аналітичної звітності_ можна ознайомитись у відповідному xref:arch:architecture/registry/operational/reporting/overview.adoc[розділі]. For details on the _Registry analytical reporting subsystem's_ design, see xref:arch:architecture/registry/operational/reporting/overview.adoc[]. -- -//== Складові підсистеми [#subsystem-components] == Subsystem components -//TODO: Do we need the Repository column for en version? |=== -//|Назва компоненти|Представлення в реєстрі|Походження|Репозиторій|Призначення |Component name |Registry representation |Source |Repository |Function -//|_Сервіс збереження схем повідомлень подій аудиту_ |_Audit event message schema storage service_ |`kafka-schema-registry` |3rd-party -|https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/data-architecture/devops-application/kafka-schema-registry[gerrit:/mdtu-ddm/data-architecture/devops-application/kafka-schema-registry] -//|Перевірка відповідності структури повідомлення поточній схемі +|https://github.com/epam/edp-ddm-kafka-schema-registry[github:/epam/edp-ddm-kafka-schema-registry] |Validation of message structure against the current schema. -//|_Сервіс збереження подій аудиту_ |_Audit event storage service_ |`kafka-connect-cluster-connect` |3rd-party -|https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/data-architecture/devops-application/strimzi-kafka-operator[gerrit:/mdtu-ddm/data-architecture/devops-application/strimzi-kafka-operator] -//|Збереження повідомлень в базу даних +|https://github.com/epam/edp-ddm-strimzi-kafka-operator[github:/epam/edp-ddm-strimzi-kafka-operator] |Saving messages to the database. |_xref:arch:architecture/registry/operational/audit/audit-db.adoc[Audit events operational database]_ |`operational:audit` |origin |https://github.com/epam/edp-ddm-registry-postgres/tree/main/platform-db/changesets/audit[github:/epam/edp-ddm-registry-postgres/tree/main/platform-db/changesets/audit] -//|Відокремлена БД для збереження аудиту подій |A separate database for audit events. |=== -//== Перелік сервісів, які підлягають аудиту == List of services subject to audit -//TODO: Усі посилання на підсистеми в цій таблиці ведуть на якір #_аудит_та_журналювання_подій, який здебільшого under development. Тому я залишаю посилання без якоря - коли ці секції будуть додані, лінки можна буде проапдейтити. |=== -//|Підсистема власник|Назва компоненти|Представлення в реєстрі |Owner subsystem |Component name |Registry representation .2+.^|xref:arch:architecture/registry/operational/registry-management/overview.adoc[Registry data management subsystem] -//|_Сервіс синхронного управління даними реєстру_ |_Synchronous registry data management service_ |*registry-rest-api* -//|_Сервіс асинхронного управління даними реєстру_ |_Asynchronous registry data management service_ |*registry-kafka-api* .2+.^|xref:arch:architecture/registry/operational/bpms/overview.adoc[Business process management subsystem] -//|_Сервіс доступу до історичних даних БП_ |_Business process history access service_ |*process-history-service-api* -//|_Сервіс фіксації історичних подій БП_ |_Business process history logging service_ |*process-history-service-persistence* |xref:arch:architecture/registry/operational/user-settings/overview.adoc[User settings management subsystem] -//|_Сервіс управління налаштуваннями користувачів_ |_User settings management service_ |*user-settings* |xref:arch:architecture/registry/operational/notifications/overview.adoc[User notification subsystem] -//|_Сервіс нотифікацій користувачів_ |_User notification service_ |*ddm-notification-service* .4+|xref:arch:architecture/registry/operational/excerpts/overview.adoc[Registry excerpt generation subsystem] -//|_Сервіс управління витягами_ |_Excerpt management service_ |*excerpt-service-api* .3+|_Excerpt generation services_ @@ -122,35 +93,22 @@ For details on the _Registry analytical reporting subsystem's_ design, see xref: |=== -//== Технологічний стек -== Technological stack +== Technology stack -//При проектуванні та розробці підсистеми, були використані наступні технології: The following technologies were used when designing and developing the subsystem: * xref:arch:architecture/platform-technologies.adoc#kafka[Kafka] * xref:arch:architecture/platform-technologies.adoc#kafka-schema-registry[Kafka Schema Registry] * xref:arch:architecture/platform-technologies.adoc#strimzi-operator[Strimzi] -//== Атрибути якості підсистеми == Subsystem quality attributes -//TODO: Not sure we need this note. -[NOTE] --- -//Секція потребує допрацювання... -This section is under development. --- - === _Security_ -//Використання автентифікації за допомогою TLS для підключення до брокера повідомлень з боку додатка, унеможливлює здійснення атак типу `людина посередині` (`Man in the middle`). -//Всі дані в русі також шифруються за допомогою TLS. Using TLS authentication to connect the application to the message broker prevents man-in-the-middle attacks. All transit data is also encrypted using TLS. === _Reliability_ -//Загальна надійність системи забезпечується переліком механізмів реалізованих в компонентах які використовуються підсистемою. The overall system reliability is ensured by a number of mechanisms implemented in the subsystem's components. * Kafka (`Replication`, `Fault Tolerance`, `Message Persistence`, `Message immutability`, `Acknowledgment Mechanism`). @@ -158,20 +116,16 @@ The overall system reliability is ensured by a number of mechanisms implemented === _Scalability_ -//Можливість паралельної обробки повідомлень та відсутність зберігання стану в додатку забезпечує горизонтальне масштабування. Parallel processing of messages and the absence of state storage in the application ensures horizontal scaling. === _Performance_ -//Події сервісу створюються як асинхронні події (`Applicaton Events`) і таким чином не вносять значний вплив на швидкодію сценаріїв в середині сервісів. Service events are created as asynchronous events (`Application Events`) and do not significantly affect the performance of service scenarios. -=== _Data Integrity_ +=== _Data integrity_ -//Цілісність та незмінність даних гарантована незмінністю повідомлень Kafka та обмеженням доступу на операції запису до БД. The integrity and immutability of data is guaranteed by the immutability of Kafka messages and access restrictions to database write operations. -=== _Data Retention and Archiving_ +=== _Data retention and archiving_ -//Політики збереження та архівування реалізовано за рахунок налаштувань вбудованих механізмів збереження даних повідомлень Kafka та бекапування БД. The retention and archiving policies are implemented by configuring the settings of the built-in Kafka message data retention and database backup tools. \ No newline at end of file diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/bpms/bpm-history.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/bpms/bpm-history.adoc index 0b3919ab5c..05686c9ecc 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/bpms/bpm-history.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/bpms/bpm-history.adoc @@ -1,5 +1,4 @@ = Business processes execution history - include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/bpms/bpm-interim-data-storage.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/bpms/bpm-interim-data-storage.adoc index 47a8222c3d..aadda37989 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/bpms/bpm-interim-data-storage.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/bpms/bpm-interim-data-storage.adoc @@ -1,4 +1,4 @@ -= Intermediate data of business processes += Interim data of business processes include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/bpms/bpm-save-ext-documents.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/bpms/bpm-save-ext-documents.adoc index 03b3d5aec1..2ec71fdbd6 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/bpms/bpm-save-ext-documents.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/bpms/bpm-save-ext-documents.adoc @@ -1,12 +1,9 @@ -//= Скриптування вивантаження файлів за віддаленою адресою з послідуючим збереженням до реєстру у бізнес-процесі = Downloading digital documents from external sources: scripting capabilities - include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] -//== Загальний опис -== General overview +== Overview //Для повноцінної обробки даних, отриманих у результаті взаємодії з зовнішніми системами з бізнес-процесів, існує необхідність вивантажувати файли за їх віддаленими адресами та зберігати у сховище реєстру. To correctly process the data obtained as a result of interaction with external systems within business processes, there is a need to download digital documents from external sources and store them into the registry repository. @@ -14,20 +11,16 @@ To correctly process the data obtained as a result of interaction with external //У якості рішення розглянуто реалізацію службової _JUEL_-функції, яка надає можливість зі скриптових задач БП ініціювати вивантаження за віддаленою адресою та збереження отриманого файлу до _Об'єктного сховища проміжних даних БП_ для подальшого використання при формуванні запиту у _Фабрику Даних_ реєстру. As a solution, the implementation of a _JUEL_ function has been considered, which enables the initiation of remote address file retrieval from the business process script tasks, and saving of the received file to the _interim business process object storage_ for further use in generating a request to the registry _data factory_. -//== Актори та ролі користувачів == Actors and user roles -//* Розробник регламенту -* Regulations developer +* Registry regulations developer -//== Функціональні сценарії == Functional scenarios //* Вивантаження файлу за віддаленою адресою та завантаження до _Об'єктного сховища проміжних даних БП_ у скриптових задачах бізнес-процесів * File retrieval from a remote address and loading it into the _interim business process object storage_ in the business process script tasks. -//== Загальні принципи та положення -== General principles and provisions +== General provisions //* Ініціювання вивантаження та збереження файлу з БП через _JUEL_-функцію виконується під системним користувачем * Initiating file retrieval and storage from the business process through the JUEL function is performed by a system user diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/bpms/bpm-save-interim-form-submission.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/bpms/bpm-save-interim-form-submission.adoc index 4ad585228d..f22069d720 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/bpms/bpm-save-interim-form-submission.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/bpms/bpm-save-interim-form-submission.adoc @@ -1,8 +1,4 @@ -//= Проміжне збереження даних, внесених через UI-форми задач бізнес-процесів -= Interim data saving for the data entered through the UI task forms - -//TODO: Is the "interim" translation of the word "проміжний" correct in this context? It seems more relevant than "intermediate". - += Interim storage of data entered through business process UI forms include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/bpms/camunda-db.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/bpms/camunda-db.adoc index 36291d1e89..f17bbbfa66 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/bpms/camunda-db.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/bpms/camunda-db.adoc @@ -1,5 +1,4 @@ = Business processes operational database - include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/bpms/ceph-storage.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/bpms/ceph-storage.adoc index e505ff00e5..741f2bc592 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/bpms/ceph-storage.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/bpms/ceph-storage.adoc @@ -1,5 +1,4 @@ = Object data storage - include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/bpms/digital-documents.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/bpms/digital-documents.adoc index a44ad74810..93c40cec5b 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/bpms/digital-documents.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/bpms/digital-documents.adoc @@ -1,6 +1,4 @@ -//= Робота з цифровими документами у кабінеті користувача = Working with digital documents in the user portal - include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::ROOT:partial$admonitions/language-en.adoc[] @@ -8,11 +6,10 @@ include::ROOT:partial$admonitions/language-en.adoc[] //Поточний технічний дизайн сфокусований на загальних аспектах реалізації вимог щодо роботи із файлами через Кабінети користувача та на особливостях взаємодії між підсистемами "_Lowcode_" та "_Дата Фабрика_" в цьому контексті. The current technical design focuses on implementing the requirements for working with files through the user portals and the interaction features between the _Low-code_ and _Data Factory_ subsystems. +//// [NOTE] -//Детальніше з дизайном компоненти "_Сервіс цифрових документів_" підсистеми "_Lowcode_" можна ознайомитися -//xref:digital-document-service:digital-document-service.adoc[за посиланням] -//TODO: Smth weird with UA link here... For details on the _Digital documents service_ of the _Low-code_ subsystem, see xref:architecture/registry/operational/bpms/services/digital-document-service/digital-document-service.adoc[]. +//// //== Функціональні можливості == Functional capabilities diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/bpms/process_history-db.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/bpms/process_history-db.adoc index 4d2a7d3fff..f2eaaa566b 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/bpms/process_history-db.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/bpms/process_history-db.adoc @@ -1,6 +1,4 @@ -//= Операційна БД історичних даних бізнес-процесів = Business processes historical data operational database - include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/bpms/redis-storage.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/bpms/redis-storage.adoc index d20a1cf242..b31b388a9f 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/bpms/redis-storage.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/bpms/redis-storage.adoc @@ -1,5 +1,4 @@ = Non-relational data storage - include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/digital-signatures/services/dso/eseal.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/digital-signatures/services/dso/eseal.adoc index 69cea9bbb3..4fe45698c8 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/digital-signatures/services/dso/eseal.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/digital-signatures/services/dso/eseal.adoc @@ -1,4 +1,4 @@ -= Working with electronic seals += Working with electronic seal include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/excerpts/ceph-storage.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/excerpts/ceph-storage.adoc index 835cd41fc1..595da04d0c 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/excerpts/ceph-storage.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/excerpts/ceph-storage.adoc @@ -3,13 +3,11 @@ include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] -//== Загальний опис -== General overview +== Overview //_xref:arch:architecture/registry/operational/excerpts/overview.adoc[Підсистема формування витягів реєстру]_ використовує об'єктне сховище xref:arch:architecture/platform-technologies.adoc#ceph[Ceph] з xref:arch:architecture/platform/operational/distributed-data-storage/overview.adoc[_Підсистеми розподіленого зберігання даних_] для зберігання шаблонів для генерації витягів та файлів зі згенерованими / підписаними витягами з реєстру. _xref:arch:architecture/registry/operational/excerpts/overview.adoc[Registry excerpts generation subsystem]_ utilizes the xref:arch:architecture/platform-technologies.adoc#ceph[Ceph] object storage from the xref:arch:architecture/platform/operational/distributed-data-storage/overview.adoc[_Distributed data storage subsystem_] to store templates for excerpt generation and files containing generated/signed registry excerpts. -//== Структури даних == Data structures === file-excerpt-bucket diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/excerpts/excerpt-generation.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/excerpts/excerpt-generation.adoc index c9c511c54b..895b846693 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/excerpts/excerpt-generation.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/excerpts/excerpt-generation.adoc @@ -1,6 +1,4 @@ -//== Генерація витягів з кабінету користувача -== Generation of excerpts from User portals - += Generating excerpts in user portals include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] @@ -20,7 +18,6 @@ Current technical design focuses on the requirements for supporting information //Детальніше з дизайном підсистеми звітності можна ознайомитися xref:architecture/registry/operational/excerpts/excerpt.adoc[за посиланням]. For more details about the Reporting subsystem design, please refer to the following xref:architecture/registry/operational/excerpts/excerpt.adoc[link]. -//== Базові принципи == Basic principles //- Витяги можуть бути згенеровані тільки в рамках надання інформаційних послуг через бізнес-процеси diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/excerpts/history-excerpt.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/excerpts/history-excerpt.adoc index 92d52b80eb..1c25892844 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/excerpts/history-excerpt.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/excerpts/history-excerpt.adoc @@ -1,4 +1,4 @@ -= Viewing data history += Data history excerpt include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/ext-api-management/api-gateway/kong-oidc.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/ext-api-management/api-gateway/kong-oidc.adoc index e62da8191b..f6c288dfe8 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/ext-api-management/api-gateway/kong-oidc.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/ext-api-management/api-gateway/kong-oidc.adoc @@ -1,7 +1,5 @@ -include::ROOT:partial$templates/document-attributes/arch-set-en.adoc[] - -//= *OIDC* розширення для Kong API Gateway = The OIDC extension for the Kong API Gateway +include::ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::ROOT:partial$admonitions/language-en.adoc[] diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/ext-api-management/overview.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/ext-api-management/overview.adoc index 0c84947298..6067a9eb14 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/ext-api-management/overview.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/ext-api-management/overview.adoc @@ -1,72 +1,51 @@ -//= Підсистема управління зовнішнім трафіком операційної зони реєстру -= External traffic management subsystem of the registry operational zone += External traffic management subsystem: Registry operational zone include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] -//== Загальний опис -== General overview +== Overview -//Підсистема, призначенням якої є управління зовнішнім трафіком та контроль доступу до API-сервісів операційної зони Реєстру. The subsystem is designed to manage external traffic and control access to API services of the registry operational zone. -//== Функції підсистеми == Subsystem functions -//* Аутентифікація та авторизація запитів -// зони реєстру -//* Налаштування та контроль рейт-лімітів -//* Трансформація запитів та відповідей -//* Логування вхідних запитів * Authentication and authorization of requests * Traffic routing to API services of the registry operational zone subsystems * Configuration and control of rate limits * Transformation of requests and responses * Logging of incoming requests -//== Технічний дизайн підсистеми -== Technical design of the subsystem +== Subsystem technical design image::architecture/registry/operational/ext-api-management/registry-ext-traffic-subsystem.drawio.svg[width=600,float="center",align="center"] -//== Складові підсистеми [#subsystem-components] == Subsystem components |=== -//|Назва компоненти|Представлення в реєстрі|Походження|Репозиторій|Призначення |Component name|Presentation in the registry|Origin|Repository|Purpose -//|_Зовнішній API-шлюз операційної зони_ |_Registry operational zone external API gateway_ |`kong-kong` |3rd-party |https://github.com/epam/edp-ddm-kong[github:/epam/edp-ddm-kong] -//|Забезпечує керування трафіком, авторизацію, контроль доступу до API, балансування навантаження, перетворення запитів/відповідей та аналітику/моніторинг. |Provides traffic management, authorization, API access control, load balancing, request/response transformation, and analytics/monitoring. -//|_ServiceMesh шлюз_ |_ServiceMesh gateway_ |`istio-ingressgateway` |3rd-party |https://github.com/istio/proxy[github:/istio/proxy] -//|Мережевий шлюз що працює на межі istio service-mesh та отримує вхідні з'єднання HTTP/TCP. -|Network gateway operating on the edge of the Istio service --mesh, receiving incoming HTTP/TCP connections. +|Network gateway operating on the edge of the Istio service-mesh, receiving incoming HTTP/TCP connections. -//|xref:arch:architecture/registry/operational/ext-api-management/redis-storage.adoc#_sessions[__Операційне сховище сесій користувача__] |xref:arch:architecture/registry/operational/ext-api-management/redis-storage.adoc#_sessions[__Operational user sessions storage__] |`redis:sessions` |3rd-party |- -//|Зберігання користувацьких JWT-токенів |Storage of user JWT tokens |=== -//== Технологічний стек -== Technological stack +== Technology stack -//При проектуванні та розробці підсистеми, були використані наступні технології: The following technologies were used in the design and development of the subsystem: * xref:arch:architecture/platform-technologies.adoc#kong[Kong] @@ -74,26 +53,22 @@ The following technologies were used in the design and development of the subsys * xref:arch:architecture/platform-technologies.adoc#redis[Redis] * xref:arch:architecture/platform-technologies.adoc#istio[Istio ServiceMesh] -//== Атрибути якості підсистеми == Subsystem quality attributes === _Scalability_ -//Підсистема управління зовнішнім трафіком операційної зони реєстру підтримує як горизонтальне, так і вертикальне масштабування. The external traffic management subsystem of the registry operational zone supports both horizontal and vertical scalability. [TIP] -- -//Детальніше з масштабуванням підсистем можна ознайомитись у розділі For more details on subsystem scalability, please refer to xref:architecture/container-platform/container-platform.adoc[] -- === _Observability_ -//Підсистема управління зовнішнім трафіком операційної зони реєстру підтримує журналювання вхідних запитів та збір метрик продуктивності для подальшого аналізу через веб-інтерфейси відповідних підсистем Платформи. + The external traffic management subsystem of the registry operational zone supports logging of incoming requests and collects performance metrics for further analysis through web interfaces of the corresponding Platform subsystems. [TIP] -- -//Детальніше з дизайном підсистем можна ознайомитись у відповідних розділах: For more details on subsystem design, please refer to the relevant sections: * xref:arch:architecture/platform/operational/logging/overview.adoc[] @@ -101,12 +76,11 @@ For more details on subsystem design, please refer to the relevant sections: -- === _Portability_ -//Підсистема управління зовнішнім трафіком операційної зони реєстру може бути перенесена, розгорнута та керована однаково та надійно на різних платформах оркестрації контейнерів що розгорнуті в різних хмарних середовищах або власній інфраструктурі в дата-центрі. + The external traffic management subsystem of the registry operational zone can be easily transported, deployed, and reliably managed across different container orchestration platforms in various cloud environments or in proprietary infrastructure within data centers. [TIP] -- -//Детальніше можна ознайомитись у розділі xref:arch:architecture/container-platform/container-platform.adoc[Платформа оркестрації контейнерів] -For more details, please refer to -xref:arch:architecture/container-platform/container-platform.adoc[Container orchestration platform] --- +For more details, please refer to the +xref:arch:architecture/container-platform/container-platform.adoc[Container orchestration platform]. +-- \ No newline at end of file diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/ext-api-management/redis-storage.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/ext-api-management/redis-storage.adoc index 613c9af753..2a77aedce7 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/ext-api-management/redis-storage.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/ext-api-management/redis-storage.adoc @@ -1,4 +1,3 @@ -//= Нереляційне сховище даних = Non-relational data storage include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/ext-api-management/routes.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/ext-api-management/routes.adoc index 0ae518f3d7..5217c4b253 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/ext-api-management/routes.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/ext-api-management/routes.adoc @@ -1,5 +1,4 @@ -//== Структура маршрутів зовнішнього Kong API Gateway -== External Kong API Gateway route structure += External Kong API Gateway routes structure include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] @@ -7,8 +6,7 @@ include::platform:ROOT:partial$admonitions/language-en.adoc[] //Клієнтські додатки, які використовуються в системі, взаємодіють з сервісами, що надають доступ до функционалу платформи за допомогою REST API. Даний документ містить інформацію про загальні положення при формуванні зовнішніх точок доступ та перелік доступних для використання методів. The client applications used in the system interact with the services that provide access to the platform's functionality through REST API. This document contains information about the general principles of forming external access points and a list of available methods for use. -//=== Загальні положення -=== General provisions +== General provisions //* Усі зовнішні ендпоінти викликаються через Kong API Gateway * All external endpoints are accessed through the Kong API Gateway @@ -31,8 +29,7 @@ The client applications used in the system interact with the services that provi //*/api/tasks/{id}/complete* * Each individual route by default provides access to all resources of the target service that satisfy the specified pattern. For example, the endpoint */api/tasks* provides access, including to the method POST */api/tasks/{id}/complete*. -//=== Перелік ендпоінтів в системі (to be) -=== List of endpoints in the system (to be) +== List of endpoints in the system (to be) |=== |Route name |Route host |Route path |Service name |Service Path diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/ext-systems-simulation/custom-mocking-wiremock.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/ext-systems-simulation/custom-mocking-wiremock.adoc index 3ca8e20373..b1f1647457 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/ext-systems-simulation/custom-mocking-wiremock.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/ext-systems-simulation/custom-mocking-wiremock.adoc @@ -3,7 +3,6 @@ include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] -//== Загальний опис == General overview //Існує проблема, що поточне рішення для мокування виконується за допомогою SoapUI та сервіси моку інтеграційних точок поставляється разом з платформою. Це призводить до того що не можливо швидко додати новий мок інтеграційної точки або змінити вже існуючий без надання апдейту платформи. @@ -14,16 +13,11 @@ There is a problem that the current mocking solution is done with SoapUI and the To solve this problem, it is necessary to replace the current approach for creating mocks with the implementation of a new unified strategy that makes it possible to configure custom mocks for integration points in real time without delivering a new version of the platform. -//== Актори та ролі користувачів == Actors and user roles -//// -* Розробник реєстрів -* Розробник платформи -//// + * Registry developer * Platform developer -//== Глосарій == Glossary - WM - WireMock @@ -31,8 +25,7 @@ To solve this problem, it is necessary to replace the current approach for creat - Mocks - integration point stubs - Control Plane Console - platform admin console -//== Поточна робота мокування інтеграційних точок -== Current work of mocking integration points +== Current operation of mocking integration points image::arch:architecture/registry/operational/ext-systems-simulation/mocking/current-mocking-solution.svg[] diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/ext-systems-simulation/overview.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/ext-systems-simulation/overview.adoc index e2ca1bf5a1..8080ef5820 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/ext-systems-simulation/overview.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/ext-systems-simulation/overview.adoc @@ -5,66 +5,54 @@ include::platform:ROOT:partial$admonitions/language-en.adoc[] == Overview -//_Підсистема симуляції API зовнішніх систем_ забезпечує можливості по розробці та тестуванню реєстру в ізоляції від зовнішніх систем. The _External API simulation subsystem_ provides a way of developing and testing your registry in isolation from external systems. -//Налаштування правил симуляції згідно вимог реєстру доступне через службовий веб-інтерфейс xref:arch:architecture/registry/administrative/regulation-management/overview.adoc[Підсистеми моделювання регламенту реєстру]. Управління використанням симуляції зовнішніх інтеграцій та використанням реальних систем доступне через веб-інтерфейс налаштування _операційної конфігурації реєстру_ xref:arch:architecture/platform/administrative/control-plane/overview.adoc[Підсистеми управління Платформою та Реєстрами]. * The xref:arch:architecture/registry/administrative/regulation-management/overview.adoc[_Registry regulations modeling subsystem_] provides a dedicated web interface for configuring simulation rules according to registry requirements. * The xref:arch:architecture/platform/administrative/control-plane/overview.adoc[_Platform and registries management subsystem_] provides a web interface for managing the _registry operational configuration_, where you can manage the external integration simulation and real systems' usage. -//== Функції підсистеми == Subsystem functions -//* Симуляція API зовнішніх систем в рамках виконання бізнес-процесів -//* Симуляція віджету підпису даних в функціональних сценаріях накладання підпису та автентифікації користувачів кабінетів * Simulating external system's API during business process execution. * Simulating the data signature widget in the functional scenarios of applying a signature and authenticating portal users. -//== Технічний дизайн підсистеми == Technical design -//На даній діаграмі зображено компоненти, які входять в _Підсистема симуляції API зовнішніх систем_ та їх взаємодію з іншими підсистемами в рамках реалізації функціональних сценаріїв. -The following diagram presents the _External API simulation subsystem's_ components and their interactions with other subsystems in the scope of the implementation of functional scenarios. +The following diagram presents the _External API simulation subsystem's_ components and their interactions with other subsystems in the scope of implementing functional scenarios. image::arch:architecture/registry/operational/ext-systems-simulation/ext-systems-simulation-design.svg[float="center",align="center"] -//_Підсистема симуляції API зовнішніх систем_ представленя двома компонентами, які відповідають за мокування основних інтеграційних сценаріїв реєстру з зовнішніми системами: The _External API simulation subsystem_ contains two components that are responsible for mocking the main registry integration scenarios with external systems: -//* _Віджет симуляції підпису даних_ - статична копія віджету підпису, яка обслуговується веб-сервером _Nginx_. * _Data signature simulation widget_: A static copy of the signature widget served by the _Nginx_ web server. -//* _Сервер симуляції API зовнішніх систем_ - сервер симуляції _API_ на базі https://wiremock.org/[Wiremock], який підтримує _REST_ та _SOAP_ протоколи інтеграції. + * _External API simulation server_: An _API_ simulation server based on https://wiremock.org/[Wiremock] that supports _REST_ and _SOAP_ integration protocols. -//== Складові підсистеми -//TODO: Do we need the Repository column for en version? + [#subsystem-components] == Subsystem components |=== -//|Назва компоненти|Представлення в реєстрі|Походження|Репозиторій|Призначення + |Component name |Registry representation |Source |Repository |Function -//|_Віджет симуляції підпису даних_ |_Data signature simulation widget_ |`sign-widget-mock` |origin -|https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/low-code-platform/mock/sign-widget-mock[gerrit:/mdtu-ddm/low-code-platform/mock/sign-widget-mock] -//|Статична копія віджету підпису +|https://github.com/epam/edp-ddm-sign-widget-mock[github:/epam/edp-ddm-sign-widget-mock] + |A static copy of the signature widget. -//|_Сервер симуляції API зовнішніх систем_ |_External API simulation server_ |`wiremock` |3rd-party -|https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/general/wiremock[gerrit:/mdtu-ddm/general/wiremock] -//|Сервер мокування API зовнішніх систем з підтримкою декларативного підходу до опису контрактів +|https://github.com/epam/edp-ddm-wiremock[github:/epam/edp-ddm-wiremock] + |External systems API mocking server with support for a declarative approach to contract description. |=== //// -//TODO: Hiding the ua-specific services +UA SPECIFIC |_Мок-сервіс інтеграції з ЄДР_ |`trembita-edr-registry-mock` |origin [_deprecated_] @@ -84,20 +72,16 @@ The _External API simulation subsystem_ contains two components that are respons |Сервіс мокування SOAP API ЄІБДВПО //// -//== Технологічний стек -== Technological stack +== Technology stack -//При проектуванні та розробці підсистеми, були використані наступні технології: The following technologies were used when designing and developing the subsystem: * xref:arch:architecture/platform-technologies.adoc#javascript[JavaScript] * xref:arch:architecture/platform-technologies.adoc#java[Java] * xref:arch:architecture/platform-technologies.adoc#wiremock[Wiremock] -//== Атрибути якості підсистеми == Subsystem quality attributes === _Testability_ -//_Підсистема симуляції API зовнішніх систем_ забезпечує можливості тестування реєстру з симуляцією різних сценаріїв поведінки зовнішніх систем та проводити перевірку коректності опрацювання результатів, помилок, тимчасової недоступності зовнішніх систем, сповільнення їх швидкодії, тощо. The _External API simulation subsystem_ provides a way of testing your registry by simulating various scenarios of external systems' behavior and checking the correctness of processing results, errors, temporary unavailability of external systems, slowing down of their performance, and so on. \ No newline at end of file diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/geo/geoserver-rls.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/geo/geoserver-rls.adoc index 149985a15b..7bb07c7e25 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/geo/geoserver-rls.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/geo/geoserver-rls.adoc @@ -1,5 +1,7 @@ -//= Застосування правил RLS до модуля ГІС = Applying RLS rules to GIS module +include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] + +include::platform:ROOT:partial$admonitions/language-en.adoc[] //== Загальний опис == Overview diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/geo/gis.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/geo/gis.adoc index e5b6d2cc87..f4beaa2adb 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/geo/gis.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/geo/gis.adoc @@ -1,7 +1,8 @@ -//= Модуль ГІС = GIS module +include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] + +include::platform:ROOT:partial$admonitions/language-en.adoc[] -//== Загальні вимоги == General requirements //* Відображення мап, супутникових знімків які підтримуються сторонніми системами в порталі посадових осіб або громадян, з можливістю їх перемикання між собою та зміни масштабу. diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/geo/overview.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/geo/overview.adoc index dc678e0340..0de292e9f9 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/geo/overview.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/geo/overview.adoc @@ -7,7 +7,6 @@ include::platform:ROOT:partial$admonitions/language-en.adoc[] The _Geodata management subsystem_ searches and presents geographically bound registry objects in standardized formats. -//== Функції підсистеми == Subsystem functions //// diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/messaging/overview.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/messaging/overview.adoc index 1432288c95..02f1f0ed7f 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/messaging/overview.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/messaging/overview.adoc @@ -27,7 +27,6 @@ The _Asynchronous messaging subsystem_ is built on https://kafka.apache.org/[Apa //Для керування та розгортання кластерів Apache Kafka на платформі використовується https://strimzi.io/[Strimzi Cluster Operator]. Він забезпечує автоматизований спосіб налаштування, масштабування та керування Kafka-кластерами в середовищі OpenShift. Apache Kafka clusters are managed and deployed on the Platform using https://strimzi.io/[Strimzi Cluster Operator]. This tool provides an automated way to configure, scale, and manage Kafka clusters in an OpenShift environment. -//== Складові підсистеми [#subsystem-components] == Subsystem components diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/nonrelational-data-storage/overview.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/nonrelational-data-storage/overview.adoc index 9e1e1e092a..79547ed3f5 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/nonrelational-data-storage/overview.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/nonrelational-data-storage/overview.adoc @@ -1,19 +1,14 @@ = Non-relational database management subsystem - include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] == Overview -//Підсистема, призначенням якої є зберігання складових регламенту реєстру та проміжних даних, які продукуються системою у процесі взаємодії користувача з системою. The _Non-relational database management subsystem_ stores the registry regulations components and intermediate data produced by the system in the process of user interactions. == Subsystem functions -//* Довготривале зберігання схем UI-форм бізнес-процесів -//* Короткострокове зберігання проміжних даних бізнес-процесів -//* Короткострокове зберігання JWT-токенів аутентифікованих користувачів * Long-term storage of business process UI form schemas. * Short-term storage of business process intermediate data. * Short-term storage of JWT tokens of authenticated users. @@ -22,76 +17,66 @@ The _Non-relational database management subsystem_ stores the registry regulatio image::architecture/registry/operational/nonrelational-data-storage/redis.svg[float="center",align="center"] -//_Підсистема управління нереляційними базами даних_ використовує _Redis_ в якості key-value сховища, а відмовостійкість забезпечується за допомогою механізму _Redis Sentinel_. The _Non-relational database management subsystem_ uses _Redis_ as a key-value store, while the _Redis Sentinel_ mechanism ensures fault tolerance. -//Для автоматизації розгортання та управління кластером _Redis_ з _Redis Sentinel_ використовується _Kubernetes_-оператор https://github.com/spotahome/redis-operator[Redis Operator by Spotahome]. The _Kubernetes_ operator https://github.com/spotahome/redis-operator[Redis Operator by Spotahome] is used to automate the deployment and management of the _Redis_ cluster with _Redis Sentinel_. -//_Redis Sentinel_ є розподіленою системою, яка складається з декількох екземплярів _Sentinel_ процесів, які взаємодіють один з одним. _Redis Sentinel_ is a distributed system consisting of multiple instances of _Sentinel_ processes that interact with each other. -//_Redis Sentinel_ має наступні особливості: _Redis Sentinel_ has the following features: -//- факт відмови мастер вузла підтверджується декількома екземплярами _Sentinel_, які формують кворум, що зменшує кількість хибних спрацювань -//- _Sentinel_ сам по собі є відмовостійкою системою, яка може виконувати свої функції навіть у разі, якщо частина _Sentinel_ екземплярів не працюють. * Master node failure is confirmed by several _Sentinel_ instances forming a quorum, reducing the chances of false triggers. * _Sentinel_ is a fault-tolerant system that can perform its functions even when some _Sentinel_ instances are not operational. -//_Redis Sentinel_ надає наступні можливості: _Redis Sentinel_ provides the following capabilities: -//- _Моніторинг_ - _Sentinel_ слідкує за тим, щоб екземпляри _Redis-мастера_ та _реплік_ працювали коректно * *Monitoring*: _Sentinel_ ensures that _Redis master_ and _replica_ instances are working correctly. -//- _Алертинг_ - _Sentinel_ надає можливості відправки повідомлень адміністратору у разі ідентифікації збоїв екземплярів _Redis_ + * *Alerting*: _Sentinel_ can notify administrators when a _Redis_ instance failure is identified. -//- _Автоматичне відновлення_ - У разі, якщо екземпляр _Redis-мастер_ починає працювати некоректно, _Sentinel_ ініціює процес визначення нового _Redis-мастер_ екземпляру та реконфігурації інших _Redis-реплік_ на взаємодію з новим _мастером_. -* *Automatic recovery* - If a _Redis master_ instance stops working, _Sentinel_ initiates the process of determining a new _Redis master_ instance and reconfiguring other _Redis replicas_ to interact with the new _master_. + +* *Automatic recovery* -- If a _Redis master_ instance stops working, _Sentinel_ initiates the process of determining a new _Redis master_ instance and reconfiguring other _Redis replicas_ to interact with the new _master_. [TIP] -- -//Детальну інформацію можно знайти в офіційній технічній документації https://redis.io/docs/manual/sentinel/[Redis Sentinel]. + For details, refer to https://redis.io/docs/manual/sentinel/[Redis Sentinel documentation]. -- -//== Складові підсистеми [#subsystem-components] == Subsystem components -//TODO: Do we need the Repository column for en version? + [options="header",cols="a,a,a,a,a"] |=== -//|Назва компоненти|Представлення в реєстрі|Походження|Репозиторій|Призначення + |Component name |Registry representation |Source |Repository |Function |_Sentinel service_ |`rfs-redis-sentinel` |3rd-party -|https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/infrastructure/redis-sentinel[gerrit:/mdtu-ddm/infrastructure/redis-sentinel] -//|Керування високою доступністю та автоматичним переключенням між серверами Redis +|https://github.com/epam/edp-ddm-redis-sentinel[github:/epam/edp-ddm-redis-sentinel] + |Managing high availability and automatic failover between Redis servers. |_Redis key-value store_ |`rfr-redis-sentinel` |3rd-party |https://github.com/redis/redis[github:/redis/redis] -//|Збереження даних у пам'яті у форматі ключ-значення + |Storing data in memory in key-value format. |_Kubernetes operator for Redis_ |`redis-operator` |3rd-party |https://github.com/epam/edp-ddm-redis-operator[github:/epam/edp-ddm-redis-operator] -//|Розгортання та конфігурація ресурсів Redis Sentinel + |Deploying and configuring Redis Sentinel resources. |=== -//== Класифікація даних, що зберігаються у _Redis_ == Classification of data stored in Redis |=== -//|Простір імен|Підсистема власник|Опис + |Namespace |Owner subsystem |Description |xref:arch:architecture/registry/operational/ext-api-management/redis-storage.adoc#_sessions[sessions] @@ -119,49 +104,39 @@ For details, refer to https://redis.io/docs/manual/sentinel/[Redis Sentinel docu == Technological stack -//При проектуванні та розробці підсистеми, були використані наступні технології: The following technologies were used when designing and developing the subsystem: * xref:arch:architecture/platform-technologies.adoc#redis[Redis] * xref:arch:architecture/platform-technologies.adoc#redis-sentinel[Redis Sentinel] * xref:arch:architecture/platform-technologies.adoc#redis-operator[Redis Operator] -//== Атрибути якості підсистеми == Subsystem quality attributes === _Scalability_ -//_Підсистема управління нереляційними базами даних_ підтримує вертикальне масштабування у разі збільшення навантаження шляхом виділення додаткових ресурсів для подів підсистеми. The _Non-relational database management subsystem_ supports vertical scaling in case of increased load by allocating additional resources for subsystem pods. -//Також підсистема підтримує горизонтальне масштабування шляхом додавання реплік та можливість балансування читання між ними. The subsystem also supports horizontal scaling by adding replicas and balancing reads between them. === _Security_ -//_Підсистема управління нереляційними базами даних_ забезпечує захист каналу інформаційної взаємодії між сервісами підсистеми за допомогою _SSL/TLS_ шифрування трафіку. The _Non-relational database management subsystem_ protects the cross-service communication channel using _SSL/TLS_ traffic encryption. -//Взаємодія з сервісами підсистеми потребує аутентифікації клієнтів. Interaction with subsystem services requires client authentication. -//Дані зберігаються у _Підсистемі розподіленого зберігання файлів_ та використовують її можливості забезпечення безпеки. -//TODO: Підсистема розподіленого зберігання ДАНИХ, а не файлів, чи це дві окремі підсистеми? + Data is stored in the _Distributed data storage subsystem_ using its security capabilities. === _Availability_ -//_Підсистема управління нереляційними базами даних_ сконфігурована для роботи у режимі високої доступності за допомогою _Redis Sentinel_ The _Non-relational database management subsystem_ is configured for high availability with _Redis Sentinel_. === _Observability_ -//_Підсистема управління нереляційними базами даних_ підтримує журналювання вхідних запитів та збір метрик продуктивності для подальшого аналізу через веб-інтерфейси відповідних підсистем Платформи. -The _Non-relational database management subsystem_ logs incoming requests and collects performance metrics for analysis through the web interfaces of respective Platform subsystems. +The _Non-relational database management subsystem_ logs incoming requests and collects performance metrics for analysis through the web interfaces of the respective Platform subsystems. [TIP] -- -//Детальніше з дизайном підсистем можна ознайомитись у відповідних розділах: For details on the subsystem design, see: * xref:arch:architecture/platform/operational/logging/overview.adoc[] @@ -169,5 +144,5 @@ For details on the subsystem design, see: -- === _Reliability_ -//Надійність _Підсистеми управління нереляційними базами даних_ забезпечується xref:architecture/platform/operational/backup-recovery/overview.adoc[підсистемою резервного копіювання та відновлення] яка включає у себе резервне копіювання файлових систем сховища Redis. + Reliability of the _Non-relational database management subsystem_ is ensured by the xref:architecture/platform/operational/backup-recovery/overview.adoc[_Backup and restore subsystem_], which includes backing up Redis storage file systems. \ No newline at end of file diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/notifications/notification-service-design.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/notifications/notification-service-design.adoc index 0d47d19a4b..3abd3b858d 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/notifications/notification-service-design.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/notifications/notification-service-design.adoc @@ -5,103 +5,21 @@ include::platform:ROOT:partial$admonitions/language-en.adoc[] == General overview -//За реалізацію вимог по формуванню та відправленню повідомлень користувачам відповідає "_Сервіс повідомлень користувачів_". -"_User notification service_" is responsible for the implementation of the requirements for creating and sending notifications to the users. +*_User notification service_* is responsible for the implementation of the requirements for creating and sending notifications to the users. -//Інтерфейсом для зовнішньої взаємодії з сервісом виступає окремий _Kafka_-топік "_user-notifications_", а основою рішення є реагування та обробка подій-запитів на генерацію повідомлень з використанням _FreeMarker_-шаблонів, попередньо завантажених у сховище та їх послідуюча відправка згідно налаштувань користувача у _Kafka_-топіки, які відповідають за окремі канали зв'язку. - -The interface for external interaction with the service is a separate _Kafka_-topic "_user-notifications_", and the basis of the solution is the response and processing of events-requests for the generation of notifications using _FreeMarker_-templates pre-loaded in the storage and their subsequent sending according to the user's settings in _Kafka_- topics that are responsible for separate communication channels. +The interface for external interaction with the service is a separate _Kafka_-topic "_user-notifications_", and the basis of the solution is the response and processing of events-requests for the generation of notifications using _FreeMarker_-templates preloaded in the storage and their subsequent sending according to the user's settings in _Kafka_-topics that are responsible for separate communication channels. [NOTE] -//У разі, якщо подію-запит на відправку повідомлення через "_user-notifications_" топік не вдалося обробити, система проводить N спроб згідно поточної конфігурації і за відсутності результату перенаправляє повідомлення в окремий службовий топік "_user-notifications.DLT_". If the event-request to send a notification through the "_user-notifications_" topic could not be processed, the system makes N attempts according to the current configuration and, in the absence of a result, redirects the message to a separate service topic "_user-notifications.DLT_". -//== Компонентна діаграма == Component diagram -//На даній компонентній діаграмі зображено важливі аспекти функціонування сервісу, компоненти та їх призначення, зовнішні інтеграції та інтеграції з іншими сервісами _Платформами_. This component diagram shows important aspects of service functioning, components and their purpose, external integrations and integrations with other services of the _Platforms_. image::architecture/registry/operational/notifications/notifications-service.svg[] -//== Компоненти та їх призначення == Components and their purpose -//// -|=== -|Компонент|Бібліотека|Призначення - -|*Notification Event Subscriber* -|- -|Обробка системних запитів на відправлення повідомлень користувачам - -Логування деталей у разі невдалої спроби опрацювання запиту. - -Публікація запитів, які не вдалося опрацювати у окрему чергу повідомлень для аналізу. - -|*Notification Service* -|- -|Оркестрація процесу обробки запиту на відправлення повідомлень. - -Завантаження налаштувань користувачів та їх даних, необхідних для відправлення. - -Формування переліку каналів для яких необхідно відправити повідомлення. - -|*Notification Template Service* -|- -|Збереження змін до шаблонів повідомлень. - -Отримання шаблону повідомлення для каналу зв'язку. - -|*Channel Notification Validators* -|- -|Валідація запиту на відправку повідомлення згідно особливостей каналу зв'язку - -|*Channel Notification Producers* -|- -|Формування запиту на відправлення повідомлення для окремого каналу зв'язку на базі шаблону - -|*Channel Notification Publishers* -|- -|Публікація запитів на відправлення повідомлень для окремого каналу зв'язку - -|*Channel Notification Subscribers* -|- -|Обробка запитів на відправлення повідомлень для окремого каналу зв'язку. - -Публікація запитів, які не вдалося опрацювати у окрему чергу канала для подальшої обробки - -|*Inbox Notification Service* -|- -|Збереження in-app повідомлень для користувача. - -Отримання переліку in-app повідомлень користувача. - -Підтвердження перегляду in-app повідомлення користувачем - -|*User Settings Feign Client* -|ddm-user-settings-client -|Отримання налаштувань каналів зв'язку для користувача - -|*Diia Notification Service* -|ddm-diia-client -|Відправлення push-повідомлення користувачу - -|*Diia Notification Template Service* -|ddm-diia-client -|Реєстрація шаблону повідомлення для послідуючого використання при відправленні push-повідомлення - -|*Audit Service* -|ddm-audit-starter -|Фіксація події аудиту в журнал - -|*Idm Service* -|ddm-idm-client -|Отримання атрибутів користувача за ідентифікатором - -|=== -//// - |=== |Component|Library|Purpose @@ -175,25 +93,19 @@ Confirmation of viewing of the in-app notification by the user |=== -//== Взаємодія компонентів в рамках реалізації сценаріїв -== Interaction of components within the framework of the implementation of scenarios +== Component interaction for scenario implementation -//=== Отримання _in-app_ повідомлень та підтвердження перегляду користувачем -=== Receiving _in-app_ notifications and confirming the user's view +=== Receiving _in-app_ notifications and confirming user view [plantuml, inbox-notification-read-flow, svg] ---- include::partial$architecture/registry/operational/notifications/inbox/inbox-notification-read-flow.puml[] ---- -//=== Відправлення повідомлень === Sending notifications -//==== Загальний сценарій обробки повідомлень ==== General notification processing scenario - -//.Загальний сценарій обробки повідомлень kafka-топіком user-notifications .General scenario for notification processing by the user-notifications kafka topic [plantuml, notification-to-channels-flow.puml, svg] @@ -201,10 +113,8 @@ include::partial$architecture/registry/operational/notifications/inbox/inbox-not include::partial$architecture/registry/operational/notifications/general/notification-to-channels-flow.puml[] ---- -//==== Обробка запиту на відправлення поштового повідомлення -==== Processing of a request to send a email notification +==== Processing a request to send an email notification -//.Обробка запитів на відправку поштових повідомлень користувачам .Processing requests for sending email notifications to the users [plantuml, email-notification-flow, svg] @@ -212,45 +122,15 @@ include::partial$architecture/registry/operational/notifications/general/notific include::partial$architecture/registry/operational/notifications/email/email-notification-flow.puml[] ---- - - - - - -//// -//==== Обробка запиту на відправлення push-нотифікації в Дію -==== Processing a request to send a push notification to Diia - - -include::ROOT:partial$admonitions/ua-specific.adoc[] - -//TIP: З детальною інформацією щодо взаємодії з сервісом нотифікація Дії можна ознайомитись у розділі xref:architecture/registry/operational/notifications/diia-notifications-api.adoc[API відправки push-нотифікацій у мобільний додаток "Дія"]. - -TIP: Detailed information on interaction with the Action notification service can be found in the section xref:architecture/registry/operational/notifications/diia-notifications-api.adoc[API for sending push notifications to the "Diia" mobile application]. - -.Обробка запитів на відправку push-нотифікацій користувачам у мобільний додаток Дія -[plantuml, diia-notification-flow, svg] ----- -include::partial$architecture/registry/operational/notifications/diia/diia-notification-flow.puml[] ----- -//// - - - - -//==== Обробка запиту на відправлення in-app повідомлень у inbox користувача Кабінету Громадянина - -==== Processing a request to send in-app notifications to the inbox of a Citizen's portal +==== Processing a request to send in-app notifications to the inbox of a Citizen portal [plantuml, inbox-notification-save-flow, svg] ---- include::partial$architecture/registry/operational/notifications/inbox/inbox-notification-save-flow.puml[] ---- -//== Загальні налаштування сервісу == General service settings -//.Приклад налаштувань сервісу для публікації подій через Kafka-топік (на прикладі використання *ddm-starter-kafka* бібліотеки) .An example of service settings for publishing events via a Kafka topic (using the *ddm-starter-kafka* library as an example) [source, yaml] ---- @@ -277,7 +157,6 @@ data-platform: "": "" ---- -//.Приклад налаштувань сервісу для отримання повідомлень через Kafka-топік (на прикладі використання *ddm-starter-kafka* бібліотеки) .An example of service settings for receiving notifications via a Kafka topic (on the example of using the *ddm-starter-kafka* library) [source, yaml] ---- @@ -298,11 +177,8 @@ data-platform: multiplier: 2 ---- -//TIP: Існує необхідність реалізації автоматичного створення Kafka-топіків "_.DLT_" в рамках *ddm-starter-kafka* бібліотеки (_StartupKafkaTopicsCreator_) для коректного відпрацювання _DeadLetterPublishingRecoverer_ стратегії при неможливості обробки повідомлення. - TIP: There is a need to implement the automatic creation of Kafka topics "_.DLT_" within the framework of the *ddm-starter-kafka* library (_StartupKafkaTopicsCreator_) for the correct implementation of the _DeadLetterPublishingRecoverer_ strategy in case of notification processing failure. -//.Канонічний приклад налаштувань каналів зв'язку з секретами для тестування .Canonical example of communication channel settings with secrets for testing [source, yaml] ---- diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/notifications/notifications-api.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/notifications/notifications-api.adoc index f08366e51b..e335eddd99 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/notifications/notifications-api.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/notifications/notifications-api.adoc @@ -1,6 +1,5 @@ -include::ROOT:partial$templates/document-attributes/default-set-en.adoc[] - = API notification management +include::ROOT:partial$templates/document-attributes/default-set-en.adoc[] include::ROOT:partial$admonitions/language-en.adoc[] diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/notifications/notifications-database-schema.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/notifications/notifications-database-schema.adoc index 2336ce3d02..afb8a9c827 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/notifications/notifications-database-schema.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/notifications/notifications-database-schema.adoc @@ -1,7 +1,6 @@ += Physical model for data storage include::ROOT:partial$templates/document-attributes/default-set-en.adoc[] -= Physical model of data storage - include::ROOT:partial$admonitions/language-en.adoc[] //В рамках реалізації функціональних вимог, необхідно створити окрему схему _NOTIFICATIONS_ та розширити фізичну модель додатковими таблицями: diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/notifications/notifications-db.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/notifications/notifications-db.adoc index 421cbea2cf..2235b0ffa7 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/notifications/notifications-db.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/notifications/notifications-db.adoc @@ -1,4 +1,3 @@ -//= Операційна БД нотифікацій = Notifications operational database include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/notifications/notifications-integration.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/notifications/notifications-integration.adoc index 98d9271fa3..b344586bd5 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/notifications/notifications-integration.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/notifications/notifications-integration.adoc @@ -1,11 +1,8 @@ += Integrating with notification service include::ROOT:partial$templates/document-attributes/default-set-en.adoc[] -= Integration with notification service - include::ROOT:partial$admonitions/language-en.adoc[] -//== Загальний опис підходу до інтеграції - == General provisions //Задля запобігання блокування основного потоку виконання використовується принцип розділення публікації події про необхідність виконання операції від фактичного її виконання з використанням _publish-subscribe_ підходу, реалізованому за допомогою _Kafka_. З повним переліком, налаштуваннями та структурами об'єктів подій можна ознайомитись xref:architecture/registry/operational/notifications/notifications-design.adoc#_kafka_топіки_запитів_на_відправку_повідомлень_користувачам[за посиланням]. @@ -50,7 +47,7 @@ data-platform: //=== Інтеграція механізмів відправлення повідомлень у _Сервіс виконання бізнес-процесів_ -=== === Integration of mechanisms for sending messages to the _Business Process Management System_ +=== Integration of mechanisms for sending messages to the _Business Process Management System_ image::architecture/registry/operational/notifications/notifications-starter.svg[] diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/notifications/notifications-migration.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/notifications/notifications-migration.adoc index 61353a44ac..85b3559df7 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/notifications/notifications-migration.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/notifications/notifications-migration.adoc @@ -1,4 +1,3 @@ -//= Оновлення реєстрів = Registries update include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/notifications/notifications-modelling.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/notifications/notifications-modelling.adoc index e38bcded90..ee00a36428 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/notifications/notifications-modelling.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/notifications/notifications-modelling.adoc @@ -1,5 +1,4 @@ -//= Моделювання регламенту -= Regulations modeling += Registry regulations modeling include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/notifications/notifications-overview.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/notifications/notifications-overview.adoc index 394a4d4644..536a91a67e 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/notifications/notifications-overview.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/notifications/notifications-overview.adoc @@ -1,5 +1,4 @@ = Sending messages to users - include::ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::ROOT:partial$admonitions/language-en.adoc[] diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/notifications/overview.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/notifications/overview.adoc index 63e4b7bb05..b729a69a3b 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/notifications/overview.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/notifications/overview.adoc @@ -22,8 +22,6 @@ For example, in Ukrainian case this referes to Diia mobile application * Forming based on a customized template and creating _in-app_-notifications in the _Inbox_ of the user's cabinet * Viewing the list and confirming the viewing of in-app messages by the user - -//== Технічний дизайн підсистеми == Subsystem technical design //На даній діаграмі зображено компоненти, які входять в _Підсистема нотифікацій користувачів_ та їх взаємодію з іншими підсистемами в рамках реалізації функціональних сценаріїв. @@ -32,7 +30,6 @@ This diagram shows the components included in the _Subsystem of user notificatio image::arch:architecture/registry/operational/notifications/notifications-subsystem-design.svg[float="center",align="center"] -//=== Аудит та журналювання подій === Audit and event logging [NOTE] diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/portals/overview.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/portals/overview.adoc index 771034db51..b675fe37e7 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/portals/overview.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/portals/overview.adoc @@ -1,4 +1,3 @@ -//= Підсистема кабінетів користувачів = User portals subsystem include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/registry-management/ceph-storage.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/registry-management/ceph-storage.adoc index 3449ae5cb7..c4d7fd0a20 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/registry-management/ceph-storage.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/registry-management/ceph-storage.adoc @@ -1,25 +1,13 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - - = Object data storage +include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] -NOTE: 🌐 This document is available in both English and Ukrainian. Use the language toggle in the top right corner to switch between versions. +include::platform:ROOT:partial$admonitions/language-en.adoc[] == General description //_xref:arch:architecture/registry/operational/registry-management/overview.adoc[Підсистема управління даними реєстру]_ використовує об'єктне сховище xref:arch:architecture/platform-technologies.adoc#ceph[Ceph] з xref:arch:architecture/platform/operational/distributed-data-storage/overview.adoc[_Підсистеми розподіленого зберігання даних_] для зберігання даних та їх цифрових підписів при внесенні в реєстр, файлів цифрових документів та даних для передачі при міжсервісній взаємодії. -_xref:arch:architecture/registry/operational/registry-management/overview.adoc[Registry data management subsystem]_ uses object storage xref:arch:architecture/platform-technologies.adoc#ceph[Ceph] with xref:arch:architecture/platform/operational/distributed-data-storage/overview.adoc[_Subsystems of distributed data storage_] for storing data and their digital signatures when entering the register, files of digital documents and data for transmission during inter-service interaction. - +_xref:arch:architecture/registry/operational/registry-management/overview.adoc[Registry data management subsystem]_ uses the xref:arch:architecture/platform-technologies.adoc#ceph[Ceph] object storage of the xref:arch:architecture/platform/operational/distributed-data-storage/overview.adoc[_Subsystem for distributed data storage_] for storing data and their digital signatures when entering the register, files of digital documents and data for transmission during inter-service interaction. -//== Структури даних == Data structures === datafactory-ceph-bucket diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/registry-management/file-upload.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/registry-management/file-upload.adoc index 7471a41372..bdf1357564 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/registry-management/file-upload.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/registry-management/file-upload.adoc @@ -1,16 +1,7 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Uploading files +include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] -NOTE: 🌐 This document is available in both English and Ukrainian. Use the language toggle in the top right corner to switch between versions. +include::platform:ROOT:partial$admonitions/language-en.adoc[] == General context diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/registry-management/modify-bulk-load.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/registry-management/modify-bulk-load.adoc index 3715567708..90b5a9d70a 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/registry-management/modify-bulk-load.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/registry-management/modify-bulk-load.adoc @@ -1,16 +1,13 @@ -//= Зміна налаштувань поведінки API які вказуються на рівні структури створення таблиці -= Changing API behavior settings specified at the table creation structure level += Modifying API behavior settings at the table creation level include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] -//== Загальний опис -== General overview +== Overview //У моделювальника регламенти при створенні нових таблиць є можливість зазначити атрибут "bulkLoad" для можливості завантаження даних до таблиці з файлів або масивом. На данний момент відсутня можливість змінити це після створення таблиці. Оскільки цей атрибут не міняє структури даних, а лише впливає на генерацію коду - необхідно додати можливість зміни значення атрибуту і після створення таблиць. When creating new tables, regulations modeler has an ability to specify the "bulkLoad" attribute to enable data loading from files or an array to the table. Currently, there is no option to change this after table creation. Since this attribute does not alter the data structure but only affects code generation, it is necessary to add the ability to change the attribute value after table creation. -//== Функціональні сценарії == Functional scenarios //* Як моделювальник регламенту я хочу мати змогу змінювати налаштування які впливають на поведінку згенерованого коду API, але вказуються на рівні створення таблиць. @@ -20,25 +17,21 @@ When creating new tables, regulations modeler has an ability to specify the "bul ** Enabling/disabling the ability to save an array of data from _CSV_ or via REST API. ** Changing the data read mode from synchronous/asynchronous. -//== Ролі користувачів == User roles //* Розробник/моделювальник регламенту * Regulations developer/modeler -//== Загальні принципи та положення -== General principles and provisions +== General provisions //* Вже створені структури даних можуть лише розширюватись. //* Теги в регламенті які вже було опрацьовано не можуть бути змінені. * Already created data structures can only be extended. * Tags in the regulation that have already been processed cannot be changed. -//== Моделювання регламенту реєстру == Registry regulations modeling -//=== Розширення для моделювання -=== Extension for modeling +=== Extensions for data modeling [source,xml] ---- diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/registry-management/overview.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/registry-management/overview.adoc index 78c5fe3424..a86f4beb3c 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/registry-management/overview.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/registry-management/overview.adoc @@ -8,17 +8,8 @@ include::platform:ROOT:partial$admonitions/language-en.adoc[] //Підсистема, призначення якої є надання доступу до даних реєстру через REST API та _Підсистему асинхронного обміну повідомленнями_, з можливістю запису, читання, зміни та видалення даних. Також підсистема відповідальна за управління збереженими файлами, перевіркою цілісності даних та виявленням несанкціонованих змін. A subsystem whose purpose is to provide access to registry data via the REST API and the _Asynchronous Messaging Subsystem_, with the ability to write, read, modify, and delete data. The subsystem is also responsible for managing saved files, checking data integrity, and detecting unauthorized changes. -//== Функції підсистеми == Subsystem functions -//// -* Створення, читання, зміна та видалення записів реєстру. -* Пошук даних за параметрами. -* Реалізація рольового доступу до даних (`RBAC`). -* Ведення історичності змін. -* Збереження інформації про походження даних. -* Збереження пов'язаних файлів реєстру. -* Збереження підписаних запитів в якості підстав для зміни даних реєстру. -//// + * Create, read, modify and delete registry entries. * Search data by parameters. * Implementation of role-based access to data (`RBAC`). diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/registry-management/platform-evolution/async-load/async-load.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/registry-management/platform-evolution/async-load/async-load.adoc index 450e66bfdd..c2ad687e05 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/registry-management/platform-evolution/async-load/async-load.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/registry-management/platform-evolution/async-load/async-load.adoc @@ -1,16 +1,7 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Asynchronous data loading +include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] -NOTE: 🌐 This document is available in both English and Ukrainian. Use the language toggle in the top right corner to switch between versions. +include::platform:ROOT:partial$admonitions/language-en.adoc[] == General description diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/registry-management/platform-evolution/public-api/public-api.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/registry-management/platform-evolution/public-api/public-api.adoc index 41d05eff75..03827dd7a6 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/registry-management/platform-evolution/public-api/public-api.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/registry-management/platform-evolution/public-api/public-api.adoc @@ -1,16 +1,7 @@ -:toc-title: On this page: -:toc: preamble -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Public API and rate limits for reading registry data +include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] -NOTE: 🌐 This document is available in both English and Ukrainian. Use the language toggle in the top right corner to switch between versions. +include::platform:ROOT:partial$admonitions/language-en.adoc[] == General description diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/registry-management/platform-evolution/sc-post-migration/sc-post-migration.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/registry-management/platform-evolution/sc-post-migration/sc-post-migration.adoc index 2a74e7cb66..b6d95cbcb9 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/registry-management/platform-evolution/sc-post-migration/sc-post-migration.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/registry-management/platform-evolution/sc-post-migration/sc-post-migration.adoc @@ -1,77 +1,51 @@ -//= Додавання генерації POST-методів для пошуку даних -= Adding POST methods generation for retrieving the data += Adding POST methods generation for data retrieval include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] -//== Загальний опис == General overview -//При поточній реалізації з виконанням GET-запитів для пошуку даних, виникли проблеми з пошуком по типу _IN_/_NOT_IN_. In the current implementation, issues have arisen with searching data using GET requests, specifically related to the _IN/NOT_IN_ type of search. -//Вони пов'язані з неможливістю коректно обробити випадок, коли приходить запит типу _GET /search?inParam=value1,value2_ , де параметр inParam є єдиним значенням _value1,value2_, а не масивом значень _["value1", "value2"]_. Подібні структури в запиті Spring Web фреймворк парсить саме як масив _[value1, value2]_. These problems are associated with the inability to correctly handle cases where a request of the form _GET /search?inParam=value1,value2_ is received, where the parameter `inParam` is a single value _value1,value2_, rather than an array of values _["value1", "value2"]_. Spring Web framework parses such structures in the request as an array _[value1, value2]_. -//В якості воркераунду можливим виявилось формувати запит у форматі _GET /search?inParam=value1,value2&inParam=_. В такому випадку Spring формує параметри у масив _["value1,value2", ""]_, що є коректним для пошуку за типом IN/NOT_IN. As a workaround, it became possible to format the request as _GET /search?inParam=value1,value2&inParam=_. In this case, Spring constructs the parameters as an array _["value1,value2", ""]_, which is valid for searching with the IN/NOT_IN type. -//Проте використання подібного воркераунду є можливим тільки для випадків, де клієнт може явно сконфігурувати запит HTTP-запит з необхідними пошуковими параметрами у правильному форматі. However, the use of such a workaround is only feasible for cases where the client can explicitly configure the HTTP request with the necessary search parameters in the correct format. -//Такими сценаріями є: These scenarios include: -//* Інтеграція через UI-форми -//* xref:arch:architecture/registry/operational/registry-management/platform-evolution/public-api/public-api.adoc[Публічний API] -//* xref:arch:architecture/registry/operational/external-integrations/cross-registry.adoc#_інтеграція_з_сторонніми_системами[Інтеграція з зовнішніми системами] * Integration through UI forms * xref:arch:architecture/registry/operational/registry-management/platform-evolution/public-api/public-api.adoc[Public API] * xref:arch:architecture/registry/operational/external-integrations/cross-registry.adoc#_інтеграція_з_сторонніми_системами[Integration with external systems] -//Проте для сценаріїв, де запити пошуку даних формуються програмно всередині мікросервісів системи, таких як: However, for scenarios where data search requests are generated programmatically within microservices of the system, such as: include::ROOT:partial$admonitions/ua-specific.adoc[] -//* виставлення ендпоінтів пошуку даних через Трембіту (через _soap-api_) * Setting up data search endpoints through Trembita (UA-specific) secure exchange gateway (via _soap-api_) -//* використання ендпоінтів пошуку даних через делегати у бізнес-процесах (через _bpms_) * Using data search endpoints through delegates in business processes (via _bpms_) -//наявний воркераунд використати неможливо або це створить суттєві проблеми для розробки та підтримки такого рішення, що в майбутньому може призвести до блокуючих проблем у команд розробки. The existing workaround cannot be applied, or it will create significant issues for the development and maintenance of such a solution, potentially leading to blocking problems within development teams. -//Як вирішення таких проблем було вирішено додатково до генерації GET-інтерфейсу для пошуку даних також генерувати і POST-інтерфейс, при використанні якого необхідні пошукові параметри будуть формуватись у тілі запиту формату _JSON_, який дозволяє коректно відрізняти окремі одиночні значення від масивів. To address such issues, it was decided that in addition to generating a GET interface for data search, a POST interface should also be generated. When using the POST interface, the required search parameters will be formatted in the request body in _JSON_ format, which allows for a proper differentiation between individual values and arrays. -//== Загальні принципи та положення == General principles and provisions -//* GET і POST ендпоінти мають генеруватись разом * GET and POST endpoints should be generated together -//* Для внутрішніх інтеграцій всередині системи перейти на використання POST * For internal integrations within the system, transition to using POST is recommended -//* Використання GET методів залишається для зворотньої сумісності при використанні клієнтами сценаріїв _Пошук з UI-форм_, _Публічний API_ та _Інтеграція з зовнішніми системами_ * The use of GET methods remains for backward compatibility when used by clients in scenarios such as _Search with UI forms_, _Public API_, and _Integration with external systems_. -//* Використання POST-методів для сценаріїв _Публічний API_ та _Інтеграція з зовнішніми системами_ стане можливим * The use of POST methods for scenarios involving _Public API_ and __Integration with external system__s will become possible. -//* Використання POST-запитів для пошуку даних не впливає на сценарії модифікації даних, де також використовується метод POST (залишаються актуальними усі Network Policy, а також перевірка HTTP-заголовків при збереженні даних) * The use of POST requests for retrieving the data does not affect scenarios involving data modification, where the POST method is also used (all Network Policies remain valid, and HTTP header checks during data saving remain applicable). -//* Перехід UI-форм на використання POST методу наразі не потребується та є поза скоупом * Transitioning UI forms to use the POST method is currently not required and is beyond the scope -//== Високорівневий план розробки == High-level development plan -//=== Приклад === Example -//Для критерію пошуку -For the search criterion: - +.Search condition [source, xml] - +---- @@ -81,51 +55,35 @@ For the search criterion: +---- ---- - -//разом з існуючим GET-ендпоінтом повинен згенеруватись POST Together with the existing GET endpoint, a POST should be generated: -//.Новий API .New API [%collapsible] ==== swagger::{attachmentsdir}/architecture/registry/operational/registry-management/sc-post-migration/swagger.yml[] ==== -//=== Технічні експертизи === Technical expertise * BE -//=== План розробки === Development plan [cols="3,5,5"] |=== -//| Компонент | Необхідне розширення | Мета | Component | Required extension | Goal -//| service-generation-utility | додати генерацію POST ендпоінтів пошуку даних | виклик нових ендпоінтів з _soap-api_ та _bpms_ | service-generation-utility | Add generation of POST endpoints for data search | Invoke new endpoints with _soap-api_ and _bpms_ -//| service-generation-utility | змінити генерацію коду soap-api на відправку запитів до rest-api, перейти на POST | уникнути проблем з виставленням SC з пошуком через IN/NOT_IN через Трембіту | service-generation-utility | Change generation of soap-api code to send requests to rest-api, transition to POST | Avoid issues with setting up SC for IN/NOT_IN search through Trembita -//| service-generation-utility | змінити AuthPolicy для зовнішніх інтеграцій з rest-api-ext, дозволити обробку POST для ендпоінтів пошуку даних (не має впливати на ендпоінти модифікації даних) | можливість викликати POST ендпоінт для сценарію _Пошук даних без Трембіта_ | service-generation-utility | Modify AuthPolicy for external integrations with rest-api-ext, allow handling of POST for data search endpoints (should not affect data modification endpoints) | Enable calling POST endpoint for _Data search without Trembita_ scenario. -//| rest-api-core-base-image | для пошукових POST запитів прибрати валідацію специфічних заголовків (_X-Digital-Signature_, _X-Source-Business-Process_ etc.) | у поточній реалізації валідація заголовків налаштована за HTTP-методом, а не за викликаним ендпоінтом, внаслідок чого всі POST-запити валідуються. З новим підходом цю логіку необхідно змінити | rest-api-core-base-image | Remove validation of specific headers (_X-Digital-Signature_, _X-Source-Business-Process_ etc.) | In the current implementation, header validation is set based on the HTTP method, not the invoked endpoint. With the new approach, this logic needs to be changed -//| bpms | змінити делегати пошуку (_DataFactoryConnectorSearchDelegate_, _RegistryDataFactoryConnectorSearchDelegate_), додавши можливість приймати як параметр пошуку _Map_ (зараз - _Map_) | для коректного пошуку за типом IN у POST запиті необхідно буде передати список допустимих значень, вони відправляться з bpms як string ключ - list значення. Не має виникнути проблем зі зворотньою сумісністю, оскільки Map є ширшим, ніж поточне Map | bpms | Modify search delegates (_DataFactoryConnectorSearchDelegate_, _RegistryDataFactoryConnectorSearchDelegate_), adding possibility to accept _Map_ as a search parameter (now - _Map_) | For proper _IN type_ search in POST request, a list of valid values will need to be passed. These will be sent from bpms as a string key - list value. There should be no compatibility issues, as Map is broader than the current Map. -//| ddm-data-factory-client | оновити Feign-клієнти, які використовуються делегатами, на POST метод | використання в bpms клієнту | ddm-data-factory-client | Update Feign clients used by delegates to use POST method | Use in bpms client -//| platform-gateway | додати обробку POST-запитів пошуку замість GET | оскільки сценарій пошуку без Трембіти перемикається на POST метод, у проксі-сервісі platform-gateway теж необхідно перемкнутись на обробку запитів саме цього методу | platform-gateway | Add handling of POST search requests instead of GET | As the Trembita-less search scenario switches to POST, the proxy service platform-gateway also needs to switch to handling requests of this method |=== -//Також важливим є документування функціональності: It is also important to document the functionality: -//* Задокументувати особливості використання GET-методів при пошуку з IN/NOT_IN * Document the specifics of using GET methods for IN/NOT_IN search -//* Задокументувати рекомендації щодо формування тіла POST запиту (особливо при пошуку IN/NOT_IN) * Document recommendations for forming the body of a POST request (especially for IN/NOT_IN search) \ No newline at end of file diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/registry-management/registry-db.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/registry-management/registry-db.adoc index 6c3da53a89..cc08d0818c 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/registry-management/registry-db.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/registry-management/registry-db.adoc @@ -1,18 +1,8 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Registry operational database +include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] -NOTE: 🌐 This document is available in both English and Ukrainian. Use the language toggle in the top right corner to switch between versions. +include::platform:ROOT:partial$admonitions/language-en.adoc[] -//== Загальний опис == General description //// База даних `registry` містить як службові таблиці сервісів так і всі таблиці реєстру змодельовані адміністратором регламенту. @@ -28,7 +18,6 @@ Service tables are created in the public schema when the registry is created. Re This document deals with service tables. -//== Схема бази даних == Database schema [plantuml, registry-public-schema, svg] diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/registry-management/sc-pagination-count.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/registry-management/sc-pagination-count.adoc index 64f944152d..72c6ac46c8 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/registry-management/sc-pagination-count.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/registry-management/sc-pagination-count.adoc @@ -1,11 +1,9 @@ -//= Повернення інформації про загальну кількість записів при пагінації критеріїв пошуку -= Returning information about the total number of records in pagination of search conditions += Returning total record count with paginating search criteria include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] -//== Загальний опис -== General overview +== Overview //Наявна функціональність пагінації не надає можливості через API отримати загальну кількість елементів по критерію пошуку, по якому був виконаний запит. Зовнішнім системам доводиться перебирати всі сторінки ресурсу до пустої відповіді. Це незручно в розробці, та ускладнює можливість надати зручний інтерфейс кінцевому користувачу. The current pagination functionality does not provide an API-based way to retrieve the total number of items based on the search conditions used in the query. External systems are required to iterate through all resource pages until an empty response is encountered. This is inconvenient in development and complicates the ability to offer a user-friendly interface to end-users. @@ -13,22 +11,19 @@ The current pagination functionality does not provide an API-based way to retrie //Для поліпшення досвіду користувача пропонується реалізувати можливість створення критеріїв пошуку з новим типом пагінації, які будуть додатково повертати інформацію про поточну сторінку, кількість елементів на сторінці, загальну кількість елементів та загальну кількість сторінок. To enhance the user experience, it is proposed to implement the capability to create search conditions with a new pagination type that additionally returns information about the current page, the number of items per page, the total number of items, and the total number of pages. -//== Актори та ролі користувачів == Actors and user roles //* Розробник регламенту //* Зовнішні системи * Regulations developer * External systems -//== Загальні принципи та положення -== General principles and provisions +== General provisions //* Поведінка і контракт існуючих критеріїв пошуку не змінюється. //* Зберігається зворотня сумісність конфігурації критеріїв пошуку. * The behavior and contract of existing search conditions remain unchanged. * Backward compatibility of search conditions configuration is maintained. -//== Функціональні сценарії == Functional scenarios //* Налаштування критеріїв пошуку diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/relational-data-storage/databases.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/relational-data-storage/databases.adoc index 5be27f9ab2..6297ffd5fc 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/relational-data-storage/databases.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/relational-data-storage/databases.adoc @@ -1,5 +1,4 @@ = Databases - include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/relational-data-storage/db-roles.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/relational-data-storage/db-roles.adoc index 71287327d3..b82477e37c 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/relational-data-storage/db-roles.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/relational-data-storage/db-roles.adoc @@ -1,5 +1,4 @@ = Registry database users and privileges - include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/relational-data-storage/rdbms-analytical-workload.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/relational-data-storage/rdbms-analytical-workload.adoc index e11de74198..7cd4fd5807 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/relational-data-storage/rdbms-analytical-workload.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/relational-data-storage/rdbms-analytical-workload.adoc @@ -1,5 +1,4 @@ = Processing analytical requests - include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/relational-data-storage/rdbms-backup-recovery.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/relational-data-storage/rdbms-backup-recovery.adoc index 0cf5d22cb8..651bccdea1 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/relational-data-storage/rdbms-backup-recovery.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/relational-data-storage/rdbms-backup-recovery.adoc @@ -1,5 +1,4 @@ = Backup and recovery - include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/relational-data-storage/rdbms-gis.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/relational-data-storage/rdbms-gis.adoc index d1b55abc5f..fb683b7da1 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/relational-data-storage/rdbms-gis.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/relational-data-storage/rdbms-gis.adoc @@ -1,5 +1,4 @@ = Geographic objects and geolocation queries - include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/relational-data-storage/rdbms-horizontal-scaling.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/relational-data-storage/rdbms-horizontal-scaling.adoc index eaf44cf596..32a65bcb1b 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/relational-data-storage/rdbms-horizontal-scaling.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/relational-data-storage/rdbms-horizontal-scaling.adoc @@ -1,5 +1,4 @@ = Horizontal scaling - include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/relational-data-storage/rdbms-user-schema-management.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/relational-data-storage/rdbms-user-schema-management.adoc index 72a0a3f241..0dde8dfa5a 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/relational-data-storage/rdbms-user-schema-management.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/relational-data-storage/rdbms-user-schema-management.adoc @@ -1,5 +1,4 @@ = Managing database users and schemas - include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/reporting/kong-redash.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/reporting/kong-redash.adoc index 549c2dff99..bf2841dd88 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/reporting/kong-redash.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/reporting/kong-redash.adoc @@ -9,7 +9,7 @@ In the current version of the Platform, Redash is publicly accessed through Open * Potential vulnerability of the Redash publishing service when it is located outside the dedicated API gateway for external traffic. -* When configuring your xref:admin:registry-management/control-plane-custom-dns.adoc[DNS name for the portals], there is a need to configure a separate name for the Redash analytical report publishing service. +* When configuring your xref:admin:registry-management/custom-dns/cp-custom-dns-portals.adoc[DNS name for user portals], there is a need to configure a separate name for the Redash analytical report publishing service. Placing the Redash downstream of Kong can resolve those issues. diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/reporting/overview.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/reporting/overview.adoc index 772269180a..48313ec47e 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/reporting/overview.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/reporting/overview.adoc @@ -5,132 +5,112 @@ include::platform:ROOT:partial$admonitions/language-en.adoc[] == Overview -//Підсистема, призначенням якої є візуалізація даних реєстру у вигляді інформаційних панелей (_дашбордів_) змодельованих за допомогою _Підсистеми моделювання регламенту реєстру_. -The _Registry analytical reporting subsystem_ visualizes registry data through the dashboards modeled using the _Registry regulations modeling subsystem_. +The *_Registry analytical reporting subsystem_* visualizes registry data through the dashboards modeled using the _Registry regulations modeling subsystem_. -//Інформаційні панелі можуть складатися з табличних форм представлення даних, діаграм та графіків, елементів фільтрації та іншими елементами управління відображенням даними. Dashboards can contain tables and charts with filters and other data control elements. [TIP] -- -//Детальніше з підходом до обробки аналітичних запитів до даних реєстру можна ознайомитись у розділі xref:arch:architecture/registry/operational/relational-data-storage/rdbms-analytical-workload.adoc[] + To learn more about the processing of analytical requests to registry data, see xref:arch:architecture/registry/operational/relational-data-storage/rdbms-analytical-workload.adoc[]. -- -//== Функції підсистеми == Subsystem functions -//* Перегляд та маніпуляція відображенням даних реєстру на інформаційних панелях -//* Перегляд та аналіз даних журналу подій аудиту реєстру на інформаційних панелях * Viewing and configuring dashboards with registry data. * Viewing and analyzing dashboards with registry audit events log data. -//== Технічний дизайн підсистеми == Technical design image::architecture/registry/operational/reporting/reporting.drawio.svg[float="center",align="center"] -//Підсистема побудована на основі https://redash.io/help/[Redash], відкритого програмного забезпечення для візуалізації та дослідження даних, яке дозволяє користувачам підключатися до різних джерел даних, запитувати та візуалізувати дані, а також створювати інтерактивні інформаційні панелі та звіти. Воно використовує архітектуру мікросервісів і складається з таких компонентів: -The subsystem is built on https://redash.io/help/[Redash], an open-source data visualization and exploration tool that enables users to connect to various data sources, query and visualize data, and create interactive dashboards and reports. Redash uses microservices architecture and consists of the following components: +The subsystem is built on https://redash.io/help/[Redash], an open-source data visualization and exploration tool that enables users to connect to various data sources, query and visualize data, and create interactive dashboards and reports. Redash uses microservice architecture and consists of the following components: -//* _Redash Server_: Сервер Redash відповідає за обробку запитів користувачів, управління аутентифікацією та авторизацією користувачів, а також надання веб-інтерфейсу Redash та адміністративного API. Користувачі взаємодіють з Redash через веб-інтерфейс, а підсистеми розгортання регламенту та розгортання реєстру, через API. _Redash Server_ асинхронно взаємодіє з іншими сервісами за допомогою черги завдань https://python-rq.org/[RQ (Redis Queue)], для виконання запитів та отримання даних. * _Redash server_: The Redash server processes user requests, manages user authentication and authorization, and provides the Redash web interface and administrative API. Users interact with Redash through the web interface, while the regulations and registry deployment subsystems use the API. The Redash server interacts with other services asynchronously using https://python-rq.org/[RQ (Redis Queue)] to handle requests and receive data. -//* _Обробники черги завдань_: Redash використовує робочі процеси для виконання завдань з черги асинхронно. Обробники черги виконують завдання, такі як виконання запитів до джерел даних, генерація результатів запитів та надсилання оновлень виконання запиту до інтерфейсу користувача. + * _Queue processors_: Redash uses worker processes to handle tasks from the queue asynchronously. Queue processors perform tasks such as querying the data sources, generating query results, and sending query execution updates to the user interface. -//** _Redash Worker_: Обробник що відповідає за виконання завдань, які надійшли в чергу з сервера Redash в результаті взаємодії з користувачем. Наприклад завдання запиту на отримання даних з джерела даних, коли користувач відкриває інформаційну панель. -** _Redash worker_: This queue processor handles tasks lined up from the Redash server as a result of user interactions -- for example, querying a data source when a user opens a dashboard. -//** _Redash Scheduler_: Цей обробники черги відповідає за виконання запитів з певною періодичністю за заданим графіком. Наприклад виконання завдань оновлення даних для збережених запитів для яких налаштовано розклад. -** _Redash scheduler_: This queue processor handles requests according to a schedule -- for example, performing data update tasks for saved requests with a defined schedule. -//* _Redash DB_: Redash використовує реляційну базу даних PostgreSQL, як основне сховище метаданих. База даних зберігає різні метадані, пов'язані з користувачами, запитами, інформаційними панелями та візуалізаціями. Вона також зберігає результати запитів та кешовані дані. Сервіси Redash взаємодіють з базою даних для отримання та збереження необхідної інформації. + +** _Redash worker_: This queue processor handles tasks lined up from the Redash server as a result of user interactions—for example, querying a data source when a user opens a dashboard. + +** _Redash scheduler_: This queue processor handles requests according to a schedule—for example, performing data update tasks for saved requests with a defined schedule. + * _Redash DB_: Redash uses a PostgreSQL relational database as its primary metadata store. The database stores metadata related to users, requests, dashboards, and visualizations. It also stores request results and cached data. Redash services interact with the database to obtain and store the necessary information. -//* _Redis Queue_: База даних черги завдань в Redis - це сховище даних у пам'яті, яке Redash використовує для керування загальними блокуваннями виконання запитів та розподілу завдань між робочими процесами. + * _Redis queue_: The Redis queue database is an in-memory data store that Redash uses to manage shared query execution locks and distribute tasks between worker processes. -//Взаємодія між цими компонентами підсистеми може бути узагальнена наступним чином: The interaction between these components of the subsystem can be summarized as follows: -//* Коли користувач взаємодіє з веб-інтерфейсом Redash, їх запити обробляються сервером Redash. Сервер аутентифікує користувача, за допомогою _підсистеми управління користувачами та ролями_, перевіряє запит і взаємодіє з відповідними сервісами на основі дій користувача. * When users interact with the Redash web interface, their requests are processed by the Redash server. The server authenticates the user via the _Users and roles management subsystem_, verifies the request, and interacts with the appropriate services based on the user's actions. -//* Коли користувач виконує запит, сервер отримує запит та відправляє його до робочого процесу через систему черги завдань (Redis Queue). Робочий процес Redash Worker бере завдання і виконує запит асинхронно, періодично оновлюючи стан запиту та надсилаючи оновлення до інтерфейсу користувача. + * When a user executes a request, the server receives the request and sends it to the workflow through the Redis queue. A Redash worker accepts the task and executes the request asynchronously while periodically updating the state of the request and sending updates to the UI. -//* Після завершення виконання запиту робочий процес зберігає кінцевий результат, і сервер отримує його для відображення користувачу. + * Once the request is processed, the workflow saves the final result, and the server receives it to display to the user. -//== Складові підсистеми -//TODO: Do we need the Repository column for en version? [#subsystem-components] == Subsystem components [options="header",cols="a,a,a,a,a"] |=== -//|Назва компоненти|Представлення в реєстрі|Походження|Репозиторій|Призначення + |Component name |Registry representation |Source |Repository |Function |_Redash server_ |`redash-viewer` |3rd-party -.7+a|https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/data-architecture/application/redash[gerrit:/mdtu-ddm/data-architecture/application/redash] +.7+a|* https://github.com/epam/edp-ddm-redash-chart[github:/epam/edp-ddm-redash-chart] +* https://github.com/epam/edp-ddm-redash[github:/epam/edp-ddm-redash] -https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/data-architecture/devops-application/redash-chart[gerrit:/mdtu-ddm/data-architecture/devops-application/redash-chart] -//| Надання користувацького Web UI та адміністративного API |Providing the Redash web interface and administrative API. |_Redash worker_ |`redash-viewer-adhocworker` |3rd-party -//| Обробка завдань із черги + |Processing queued tasks. |_Redash scheduler_ |`redash-viewer-scheduler` |3rd-party -//| Обробка завдань за розкладом + |Processing scheduled tasks. |_Prometheus exporter_ |`redash-exporter` |3rd-party -//| Збір метрик для моніторингу і їх публікація у форматі Prometheus + |Collecting metrics for monitoring and publishing them in the Prometheus format. -//|_Сховище черги завдань_ |_Task queue storage_ |`redash-viewer-redis-master` |3rd-party -//| Зберігання черги завдань + |Storing the task queue. -//| _Сховище метаданих_ |_Metadata storage_ |`redash-viewer-postgresql` |3rd-party -//| Зберігання бази метаданих Redash (запитів, інформаційних панелей, налаштувань тощо) + |Redash metadata storage (requests, dashboards, settings, and so on). |=== -//== Джерела даних == Data sources |=== -//|Назва компоненти|Представлення в реєстрі + |Component name |Registry representation -//|_Аналітична БД реєстру_ |_Registry analytical database_ a| * `analytical:registry` -//|_Операційна БД подій аудиту_ |_Audit events operational database_ a| * `operational:audit` |=== -//== Технологічний стек == Technological stack -//При проектуванні та розробці підсистеми, були використані наступні технології: The following technologies were used when designing and developing the subsystem: * xref:arch:architecture/platform-technologies.adoc#redash[Redash] @@ -139,17 +119,15 @@ The following technologies were used when designing and developing the subsystem * xref:arch:architecture/platform-technologies.adoc#redis[Redis] * xref:arch:architecture/platform-technologies.adoc#helm[Helm] -//== Атрибути якості підсистеми == Subsystem quality attributes === _Observability_ -//_Підсистема аналітичної звітності реєстру_ підтримує журналювання та збір метрик продуктивності для подальшого аналізу через веб-інтерфейси відповідних підсистем Платформи. The _Registry analytical reporting subsystem_ supports logging and collecting performance metrics for analysis through the web interfaces of respective Platform subsystems. [TIP] -- -//Детальніше з дизайном підсистем можна ознайомитись у відповідних розділах: + For details on the subsystem design, see: * xref:arch:architecture/platform/operational/logging/overview.adoc[] @@ -158,14 +136,10 @@ For details on the subsystem design, see: === _Security_ -//_Підсистема аналітичної звітності реєстру_ розмежована на користувацький інтерфейс та адміністративний з додатковим мережевим захистом що сприяє безпеці керування підсистемою та зменшує поверхню атаки. The _Registry analytical reporting subsystem_ is divided into a user interface and an administrative interface with additional network protection, promoting secure management of the subsystem and reducing the attack surface. -//Автентифікація та розмежування прав виконуєтсья централізовано xref:architecture/platform/operational/user-management/overview.adoc[підсистемою управління користувачами та ролями]. Authentication and authorization are centrally managed by the xref:architecture/platform/operational/user-management/overview.adoc[_Users and roles management subsystem_]. -//За замовчуванням користувачу надаються мінімальні права необхідні для виконання поставлених завдань. Також підсистема обмежує доступ до інформаційних панелей та до джерел даних на основі рольової моделі. Таким чином користувач може бачити тільки ті інформаційні панелі та дані тільки з тих джерел які дозволені для його ролі. By default, users are granted the minimal privileges necessary to perform the assigned tasks. The subsystem also restricts access to dashboards and data sources based on the role model. This way, the user can see only those dashboards and data from only those sources that their role allows. -//Використовується багаторівнева система мережевого захисту між компонентами підсистеми а самі компоненти постійно скануються на відомі вразливості. A multi-level network protection system is used between subsystem components, and the components themselves are constantly scanned for known vulnerabilities. \ No newline at end of file diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/secret-management/overview.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/secret-management/overview.adoc index e9f9be675e..a291d3e754 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/secret-management/overview.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/secret-management/overview.adoc @@ -5,83 +5,64 @@ include::platform:ROOT:partial$admonitions/language-en.adoc[] == Overview -//Підсистема що обслуговує процеси шифрування чутливих даних Реєстру та синхронізацію секретів по запиту від цільових сервісів Реєстрів шляхом створення та спостереження за ресурсом `ExternalSecret`. The _Secrets and encryption management subsystem_ handles the encryption of sensitive registry data and synchronizes secrets upon request from the target registry services by creating and monitoring the `ExternalSecret` resource. == Subsystem functions -//* Зберігання ключів шифрування / дешифрування даних * Storing the encryption/decryption keys. -//* Синхронізація та оновлення секретів між надійним xref:arch:architecture/platform-technologies.adoc#vault[HashiCorp Vault] сховищем та Платформою оркестрації контейнерів * Synchronizing and updating secrets between xref:arch:architecture/platform-technologies.adoc#vault[HashiCorp Vault] storage and the container orchestration platform. == Technical design image::architecture/registry/operational/secret-management/secret-and-cipher-management.drawio.svg[width=600,float="center",align="center"] -//== Складові підсистеми [#subsystem-components] == Subsystem components -//TODO: Do we need the Repository column for en version? |=== -//|Назва компоненти|Представлення в реєстрі|Походження|Репозиторій|Призначення |Component name |Registry representation |Source |Repository |Function -//|_Сервіс управління секретами та шифруванням_ |_Secrets and encryption management service_ |`hashicorp-vault` |3rd-party -|https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/devops/hashicorp-vault[gerrit:/mdtu-ddm/devops/hashicorp-vault] -//|Безпечне зберігання ключів шифрування для використання іншими підсистемами для підтримки процесів шифрування та дешифрування даних +|https://github.com/epam/edp-ddm-hashicorp-vault[github:/epam/edp-ddm-hashicorp-vault] |Secure storage of encryption keys for other subsystems to support data encryption and decryption. -//|_Сервіс синхронізації секретів із платформної підсистеми управління секретами в OpenShift_ |_Platform secrets management subsystem and OpenShift secrets synchronization service_ |`external-secrets-operator` |3rd-party |https://github.com/external-secrets/external-secrets[github:/external-secrets/external-secrets] -//|Автоматизує процес безпечного отримання та синхронізації конфіденційних даних з HashiCorp Vault, в OKD Secrets. |Automating the process of securely retrieving and synchronizing sensitive data between HashiCorp Vault and OKD Secrets. -//|_Сервіс оновлення секретів в цільових сервісах реєстру_ |_Secrets update service for target registry services_ |`reloader` |3rd-party |https://github.com/stakater/Reloader[github:/stakater/Reloader] -//|Cпостереження за змінами в конфігурації та секретах компонентів реєстрів та їх вчасне оновлення подах шляхом `Rolling Update` |Monitoring the changes in the configuration and secrets of registry components and updating the pods via `Rolling Update`. |=== -== Technological stack +== Technology stack -//При проектуванні та розробці підсистеми, були використані наступні технології: The following technologies were used when designing and developing the subsystem: * xref:arch:architecture/platform-technologies.adoc#vault[HashiCorp Vault] * xref:arch:architecture/platform-technologies.adoc#reloader[Reloader] * xref:arch:architecture/platform-technologies.adoc#ext-secrets-operator[External Secrets Operator] -//== Атрибути якості підсистеми == Subsystem quality attributes === _Security_ -//Підсистема використовує стійкі алгоритми шифрування для зберігання чутливих даних та реалізує надійний контроль доступу для них. The subsystem uses strong encryption algorithms to store sensitive data and implements reliable access control. === _Observability_ -//Підсистема записує детальну інформацію про спроби аутентифікації, отримання секретів та інші операції, що дозволяє дотримуватися вимог відповідності. The subsystem records detailed information about authentication attempts, secrets retrieval, and other operations, enabling you to meet compliance requirements. -//Також, підсистема управління користувачами та ролями підтримує журналювання вхідних запитів та збір метрик продуктивності для подальшого аналізу через веб-інтерфейси відповідних підсистем Платформи. -//TODO: Тут точно йдеться про Підсистема управління користувачами та ролями? -Also, the _Users and roles management subsystem_ supports incoming requests logging and collecting performance metrics for analysis through the web interfaces of respective Platform subsystems. +Also, the subsystem supports incoming requests logging and collecting performance metrics for analysis through the web interfaces of respective Platform subsystems. [TIP] -- -//Детальніше з дизайном підсистем можна ознайомитись у відповідних розділах: For details on the subsystem design, see: * xref:arch:architecture/platform/operational/logging/overview.adoc[] diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/user-settings/overview.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/user-settings/overview.adoc index c81c86676e..f35f24a54f 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/user-settings/overview.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/user-settings/overview.adoc @@ -1,13 +1,13 @@ -//= via Підсистема управління налаштуваннями користувачів = User settings management subsystem +include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] + +include::platform:ROOT:partial$admonitions/language-en.adoc[] -//== Загальний опис == Overview //Підсистема, яка забезпечує можливості управління персональними налаштуваннями через кабінет користувача. -The subsystem that provides user settings management capabilities via user portal. +The subsystem provides user settings management capabilities via user portal. -//== Функції підсистеми == Subsystem functions //- Отримання налаштувань користувача @@ -21,7 +21,6 @@ The subsystem that provides user settings management capabilities via user porta //- Валідація введених налаштувань користувача (за патерном email, відсутністю в blacklist тощо) - Validation of the entered user settings (by email pattern, non-presence in blacklists, etc.) -//== Технічний дизайн підсистеми == Subsystem technical design image::arch:architecture/registry/operational/user-settings/user-settings-overview.drawio.svg[float="center",align="center"] diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/user-settings/redis-storage.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/user-settings/redis-storage.adoc index c0f36a9982..c807c6a22e 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/user-settings/redis-storage.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/user-settings/redis-storage.adoc @@ -1,9 +1,9 @@ -//= Нереляційне сховище даних = Non-relational data storage +include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] -//== Загальний опис -== Overview +include::platform:ROOT:partial$admonitions/language-en.adoc[] +== Overview //// _xref:arch:architecture/registry/operational/user-settings/overview.adoc[Підсистема управління налаштуваннями користувачів]_ використовує розподілену _in-memory_ базу даних xref:arch:architecture/platform-technologies.adoc#redis[Redis] з xref:arch:architecture/registry/operational/nonrelational-data-storage/overview.adoc[_Підсистеми управління нереляційними базами даних_] для зберігання автоматично згенерованих _OTP_-кодів (_One-Time Password_) зі встановленим _Time-To-Live_ для записів згідно налаштувань реєстру. diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/user-settings/settings-db.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/user-settings/settings-db.adoc index d4ad7122e7..8e64e22726 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/user-settings/settings-db.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/user-settings/settings-db.adoc @@ -1,13 +1,13 @@ -//= Операційна БД налаштувань користувачів -= User settings operational DB += User settings operational database +include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] + +include::platform:ROOT:partial$admonitions/language-en.adoc[] -//== Загальний опис == Overview //Призначенням бази даних `settings` є зберігання персональних налаштувань користувачів. The `settings` database function main function is to store user settings. -//== Схема бази даних == Database scheme [plantuml, settings-schema, svg] diff --git a/docs/en/modules/arch/pages/architecture/registry/operational/user-settings/user-settings.adoc b/docs/en/modules/arch/pages/architecture/registry/operational/user-settings/user-settings.adoc index df326f5035..516e88e28e 100644 --- a/docs/en/modules/arch/pages/architecture/registry/operational/user-settings/user-settings.adoc +++ b/docs/en/modules/arch/pages/architecture/registry/operational/user-settings/user-settings.adoc @@ -1,33 +1,20 @@ -//= Управління налаштуваннями користувача -== User settings management - -//Налаштування користувача зберігаються у фабриці даних та можуть бути змінені користувачем в процесі роботи одним з наведених засобів: -User settings are stored in Data Factory, and can be changed by the user via one of the following ways: += User settings management +include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] +include::platform:ROOT:partial$admonitions/language-en.adoc[] +User settings are stored in Data Factory, and can be changed by the user via one of the following ways: -//// -* xref:architecture/platform/operational/user-management/citizen-onboarding.adoc[Процес онбордингу] -* Кабінет людини/громадянина -* Бізнес-процеси регламенту -//// -* xref:architecture/platform/operational/user-management/citizen-onboarding.adoc[Onboarding process] +//* xref:architecture/platform/operational/user-management/citizen-onboarding.adoc[Onboarding process] +* Onboarding process * User portal * Regulations business processes - - //// -[NOTE] - Детальніше про структуру налаштувань можна дізнатися за xref:architecture/registry/operational/user-settings/user-channel-settings.adoc[Управління каналами зв'язку користувача]. -//// - - [NOTE] Find more details on the settings structure in xref:architecture/registry/operational/user-settings/user-channel-settings.adoc[Managing user communication channels]. +//// - -//== Робота з налаштуваннями через бізнес-процеси == Managing user settings via business processes //=== Конектори @@ -48,8 +35,8 @@ To manage settings via business processes, the corresponding connector-extension ** X-Access-Token - user token for the update request //** Result variable - змінна бізнес-процесу, в яку буде записано відповідь від сервісу налаштувань ** Result variable - business process variable, where the settings service response will be written -//** Payload - налаштування які потрібно зберегти згідно з xref:architecture/registry/operational/user-settings/user-channel-settings.adoc[контрактом]. -** Payload - settings that need to be saved according to the xref:architecture/registry/operational/user-settings/user-channel-settings.adoc[contract]. +** Payload - settings that need to be saved according to the contract. +//xref:architecture/registry/operational/user-settings/user-channel-settings.adoc[contract]. //Адреса *settings-api* задається в конфігурації сервісу виконання бізнес-процесів. *settings-api* address is set in business process execution service configuration. @@ -393,15 +380,11 @@ User settings viewing and changing are a function of citizen/officer portals, an //* PUT /settings - для оновлення налаштувань користувача * PUT /settings - for settings update - -//// -[NOTE] -Детальніше про контракт взаємодії можна дізнатися за xref:architecture/registry/operational/user-settings/user-channel-settings.adoc[посиланням]. //// [NOTE] You can find more info on the contract xref:architecture/registry/operational/user-settings/user-channel-settings.adoc[here]. +//// -//Методи роботи з налаштуваннями доступні через Kong API Gateway та вимагають автентифікації користувача. The methods are available via Kong API Gateway and require user authentication. //Робота з налаштуваннями виконується лише для поточного користувача, який виконав вхід у систему. Зміна налаштувань іншого користувача неможлива за дизайном diff --git a/docs/en/modules/arch/pages/architecture/security/standards-and-compliance.adoc b/docs/en/modules/arch/pages/architecture/security/standards-and-compliance.adoc index 32b21b4a63..6fe140739d 100644 --- a/docs/en/modules/arch/pages/architecture/security/standards-and-compliance.adoc +++ b/docs/en/modules/arch/pages/architecture/security/standards-and-compliance.adoc @@ -1,14 +1,5 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Standards and compliance +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] == Overview @@ -196,4 +187,37 @@ The security testing process is comprehensively described on xref:testing:securi == Training and awareness -Effective training and awareness programs play a crucial role in ensuring the responsible and secure use of the platform and the protection of personal data. It is important to emphasize that while the platform facilitates data processing and security measures, training is the responsibility of the organization (platform owner) and is not inherently built into the platform itself. \ No newline at end of file +Effective training and awareness programs play a crucial role in ensuring the responsible and secure use of the platform and the protection of personal data. It is important to emphasize that while the platform facilitates data processing and security measures, training is the responsibility of the organization (platform owner) and is not inherently built into the platform itself. + +== GDPR compliance at the registry level + +=== Overview + +The General Data Protection Regulation (GDPR) is a crucial legal framework dictating the principles and obligations for processing personal data in the European Union. Compliance with GDPR is imperative for any organization handling personal data, especially at the registry level. As a systematic data collection, a registry often contains sensitive personal information, necessitating strict adherence to GDPR guidelines. + +=== Registry owner responsibilities + +NOTE: The primary responsibility for GDPR compliance at the registry level lies with the owner. This encompasses a range of duties outlined below. + +. *Data protection by design and default*: The registry must be engineered with solid data protection mechanisms, including creating data structures that comply with GDPR norms. This involves implementing technical safeguards and privacy-friendly default settings to ensure data security and confidentiality. + +. *Lawful processing and consent management*: The registry owner must ensure data is lawfully processed. This often involves obtaining explicit consent from individuals whose data is collected and processed, with clear information on the purpose and use of their data. Additionally, developing business processes that facilitate correct data management is crucial. + +. *Upholding data subject rights*: It is critical to establish procedures to address the rights of individuals, such as the right to access their data, request corrections, or demand erasure of their data. + +. *Breach notification protocols*: In the event of a data breach, the registry owner must have protocols in place for timely notification to the relevant supervisory authorities and, where applicable, to the individuals affected. + +. *Record-keeping and compliance documentation*: Detailed records of data processing activities are essential. The registry owner must be able to demonstrate compliance with GDPR through these records. + +=== Implementation guidelines + +To align with GDPR, the registry owner should: + +* Conduct regular data protection impact assessments. +* Ensure continuous training and awareness for staff handling personal data. +* Establish clear policies and procedures for data processing and breach response. +* Collaborate with data protection officers or external consultants for compliance verification. + +=== Conclusion + +Complying with GDPR at the registry level is a legal and ethical obligation for registry owners. It involves adhering to the regulation's requirements and proactively developing data structures and business processes that ensure proper data management and privacy protection. \ No newline at end of file diff --git a/docs/en/modules/arch/partials/architecture/libraries/nav.adoc b/docs/en/modules/arch/partials/architecture/libraries/nav.adoc index c2dad73ade..ec34a5795e 100644 --- a/docs/en/modules/arch/partials/architecture/libraries/nav.adoc +++ b/docs/en/modules/arch/partials/architecture/libraries/nav.adoc @@ -1,2 +1,2 @@ -*** xref:arch:architecture/platform-libraries.adoc[Бібліотеки Платформи] +*** xref:arch:architecture/platform-libraries.adoc[Platform libraries] include::arch:partial$architecture/libraries/liquibase-ddm-ext/nav.adoc[] \ No newline at end of file diff --git a/docs/en/modules/arch/partials/architecture/nav.adoc b/docs/en/modules/arch/partials/architecture/nav.adoc index d74e782183..fa43b3b4d1 100644 --- a/docs/en/modules/arch/partials/architecture/nav.adoc +++ b/docs/en/modules/arch/partials/architecture/nav.adoc @@ -16,22 +16,23 @@ include::arch:partial$architecture/container-platform/nav.adoc[] include::arch:partial$architecture/platform/administrative/nav.adoc[] // Операційна зона include::arch:partial$architecture/platform/operational/nav.adoc[] -//*** Підсистеми Реєстру -// Адміністративна зона -//include::arch:partial$architecture/registry/administrative/nav.adoc[] -// Операційна зона -//include::arch:partial$architecture/registry/operational/nav.adoc[] +*** Registry subsystems +// REGISTRY ADMINISTRATIVE ZONE +include::arch:partial$architecture/registry/administrative/nav.adoc[] +// REGISTRY OPERATIONAL ZONE +//TODO: HERE +include::arch:partial$architecture/registry/operational/nav.adoc[] // Компонент керування станом ресурсів Платформи -//include::arch:partial$architecture/platform-installer/nav.adoc[] +include::arch:partial$architecture/platform-installer/nav.adoc[] // Сховище резервних копій Платформи -//include::arch:partial$architecture/platform-backup-storage/nav.adoc[] +include::arch:partial$architecture/platform-backup-storage/nav.adoc[] // Центральний сервіс управління секретами Платформи -//include::arch:partial$architecture/platform-secret-management/nav.adoc[] +include::arch:partial$architecture/platform-secret-management/nav.adoc[] // Інформаційний обмін Платформи //include::arch:partial$architecture/data-exchange/nav.adoc[] // Програмно-апаратний криптомодуль "Гряда" //include::arch:partial$architecture/network-crypto-module/nav.adoc[] // Бібліотеки Платформи -//include::arch:partial$architecture/libraries/nav.adoc[] +include::arch:partial$architecture/libraries/nav.adoc[] // API документація Платформи -//include::arch:partial$architecture/platform-api/nav.adoc[] \ No newline at end of file +include::arch:partial$architecture/platform-api/nav.adoc[] \ No newline at end of file diff --git a/docs/en/modules/arch/partials/architecture/platform-api/nav.adoc b/docs/en/modules/arch/partials/architecture/platform-api/nav.adoc index dfacce3cfe..57b0c2b35f 100644 --- a/docs/en/modules/arch/partials/architecture/platform-api/nav.adoc +++ b/docs/en/modules/arch/partials/architecture/platform-api/nav.adoc @@ -1 +1,16 @@ -*** xref:arch:architecture/platform-api/overview.adoc[API документація Платформи] \ No newline at end of file +*** xref:arch:architecture/platform-api/overview.adoc[Platform API documentation] +**** xref:arch:architecture/platform-api/services/keycloak-rest-api-ext.adoc[Keycloak extensions for additional REST API] +**** xref:arch:architecture/platform-api/services/bpms.adoc[Business processes management service] +**** xref:arch:architecture/platform-api/services/platform-gateway.adoc[Cross-registry interaction API gateway] +**** xref:arch:architecture/platform-api/services/digital-signature-ops.adoc[Digital signatures service] +**** xref:arch:architecture/platform-api/services/bp-webservice-gateway.adoc[Business process invocation service for external systems] +**** xref:arch:architecture/platform-api/services/user-task-management.adoc[User task management service] +**** xref:arch:architecture/platform-api/services/user-process-management.adoc[User process management service] +**** xref:arch:architecture/platform-api/services/user-settings-service-api.adoc[User settings management service] +**** xref:arch:architecture/platform-api/services/form-schema-provider.adoc[UI form schemes providing service] +**** xref:arch:architecture/platform-api/services/form-submission-validation.adoc[UI form data validation service] +**** xref:arch:architecture/platform-api/services/digital-document-service.adoc[Digital documents service] +**** xref:arch:architecture/platform-api/services/process-history-service-api.adoc[Business processes history service] +**** xref:arch:architecture/platform-api/services/ddm-notification-service.adoc[User notifications service] +**** xref:arch:architecture/platform-api/services/excerpt-service-api.adoc[Excerpts management service] +**** xref:arch:architecture/platform-api/services/registry-regulation-management.adoc[Registry regulations management service] \ No newline at end of file diff --git a/docs/en/modules/arch/partials/architecture/platform-backup-storage/nav.adoc b/docs/en/modules/arch/partials/architecture/platform-backup-storage/nav.adoc index e9e96e0a49..1e33b76a59 100644 --- a/docs/en/modules/arch/partials/architecture/platform-backup-storage/nav.adoc +++ b/docs/en/modules/arch/partials/architecture/platform-backup-storage/nav.adoc @@ -1 +1 @@ -*** xref:arch:architecture/platform-backup-storage/overview.adoc[Сховище резервних копій Платформи] \ No newline at end of file +*** xref:arch:architecture/platform-backup-storage/overview.adoc[Platform backup storage] \ No newline at end of file diff --git a/docs/en/modules/arch/partials/architecture/platform-installer/nav.adoc b/docs/en/modules/arch/partials/architecture/platform-installer/nav.adoc index 339f450d2b..afb2097321 100644 --- a/docs/en/modules/arch/partials/architecture/platform-installer/nav.adoc +++ b/docs/en/modules/arch/partials/architecture/platform-installer/nav.adoc @@ -1,4 +1,4 @@ -*** xref:arch:architecture/platform-installer/overview.adoc[Компонент керування станом ресурсів Платформи] -**** Ключові аспекти компоненту -***** xref:arch:architecture/platform-installer/installer-structure.adoc[Опис та структура інсталятора] -***** xref:arch:architecture/platform-installer/installation-process.adoc[Процес інсталяції та оновлення Платформи Реєстрів] \ No newline at end of file +*** xref:arch:architecture/platform-installer/overview.adoc[Component for managing the state of Platform resources] +**** Key component aspects +***** xref:arch:architecture/platform-installer/installer-structure.adoc[Installer component structure] +//***** xref:arch:architecture/platform-installer/installation-process.adoc[Процес інсталяції та оновлення Платформи Реєстрів] \ No newline at end of file diff --git a/docs/en/modules/arch/partials/architecture/platform-quality-attributes/nav.adoc b/docs/en/modules/arch/partials/architecture/platform-quality-attributes/nav.adoc new file mode 100644 index 0000000000..8d511d9b71 --- /dev/null +++ b/docs/en/modules/arch/partials/architecture/platform-quality-attributes/nav.adoc @@ -0,0 +1,12 @@ +*** xref:arch:architecture/platform-quality-attributes/overview.adoc[Platform quality attributes] +**** xref:arch:architecture/platform-quality-attributes/platform-portability.adoc[] +**** xref:arch:architecture/platform-quality-attributes/platform-scalability.adoc[] +**** xref:arch:architecture/platform-quality-attributes/platform-availability.adoc[] +**** xref:arch:architecture/platform-quality-attributes/platform-performance.adoc[] +**** xref:arch:architecture/platform-quality-attributes/platform-security.adoc[] +**** xref:arch:architecture/platform-quality-attributes/platform-observability.adoc[] +**** xref:arch:architecture/platform-quality-attributes/platform-auditability.adoc[] +**** xref:arch:architecture/platform-quality-attributes/platform-interoperability.adoc[] +**** xref:arch:architecture/platform-quality-attributes/platform-operability.adoc[] +**** xref:arch:architecture/platform-quality-attributes/platform-modifiability.adoc[] +**** xref:arch:architecture/platform-quality-attributes/platform-verifiability.adoc[] \ No newline at end of file diff --git a/docs/en/modules/arch/partials/architecture/platform-secret-management/nav.adoc b/docs/en/modules/arch/partials/architecture/platform-secret-management/nav.adoc index 946072a59e..88770878a4 100644 --- a/docs/en/modules/arch/partials/architecture/platform-secret-management/nav.adoc +++ b/docs/en/modules/arch/partials/architecture/platform-secret-management/nav.adoc @@ -1 +1 @@ -*** xref:arch:architecture/platform-secret-management/overview.adoc[Центральний сервіс управління секретами Платформи] \ No newline at end of file +*** xref:arch:architecture/platform-secret-management/overview.adoc[Central service for managing Platform secrets] \ No newline at end of file diff --git a/docs/en/modules/arch/partials/architecture/platform-system-requirements/nav.adoc b/docs/en/modules/arch/partials/architecture/platform-system-requirements/nav.adoc index 906c6a6299..7306995219 100644 --- a/docs/en/modules/arch/partials/architecture/platform-system-requirements/nav.adoc +++ b/docs/en/modules/arch/partials/architecture/platform-system-requirements/nav.adoc @@ -1,2 +1,3 @@ -*** xref:arch:architecture/platform-system-requirements/overview.adoc[Platform system requirements] -**** xref:arch:architecture/platform-system-requirements/registry-cost.adoc[Calculating registry cost] \ No newline at end of file +*** xref:arch:architecture/platform-system-requirements/overview.adoc[System requirements] +**** xref:arch:architecture/platform-system-requirements/platform-requirements.adoc[System requirements for the Platform instance] +**** xref:arch:architecture/platform-system-requirements/registry-requirements.adoc[System requirements for the Registry instance] \ No newline at end of file diff --git a/docs/en/modules/arch/partials/architecture/registry/administrative/ext-api-management/nav.adoc b/docs/en/modules/arch/partials/architecture/registry/administrative/ext-api-management/nav.adoc index fb1d349206..2c2dfec7b7 100644 --- a/docs/en/modules/arch/partials/architecture/registry/administrative/ext-api-management/nav.adoc +++ b/docs/en/modules/arch/partials/architecture/registry/administrative/ext-api-management/nav.adoc @@ -1,4 +1,4 @@ -***** xref:arch:architecture/registry/administrative/ext-api-management/overview.adoc[Підсистема управління зовнішнім трафіком] -****** xref:arch:architecture/registry/administrative/ext-api-management/redis-storage.adoc[Нереляційне сховище даних] -****** Еволюція підсистеми -******* xref:arch:architecture/registry/administrative/ext-api-management/registry-admin-routes.yaml.adoc[Структура маршрутів зовнішнього Kong API Gateway для адміністративних ендпоінтів] \ No newline at end of file +***** xref:arch:architecture/registry/administrative/ext-api-management/overview.adoc[External traffic management subsystem] +****** xref:arch:architecture/registry/administrative/ext-api-management/redis-storage.adoc[Non-relational data storage] +****** Subsystem evolution +******* xref:arch:architecture/registry/administrative/ext-api-management/registry-admin-routes.yaml.adoc[Kong API gateway: route structure for external administrative endpoints] \ No newline at end of file diff --git a/docs/en/modules/arch/partials/architecture/registry/administrative/nav.adoc b/docs/en/modules/arch/partials/architecture/registry/administrative/nav.adoc index 11b6c9ba42..178e788884 100644 --- a/docs/en/modules/arch/partials/architecture/registry/administrative/nav.adoc +++ b/docs/en/modules/arch/partials/architecture/registry/administrative/nav.adoc @@ -1,4 +1,4 @@ -**** xref:arch:architecture/registry/administrative/overview.adoc[Адміністративна зона] +**** xref:arch:architecture/registry/administrative/overview.adoc[Administrative zone] // Підсистема управління зовнішнім трафіком include::arch:partial$architecture/registry/administrative/ext-api-management/nav.adoc[] // Підсистема моделювання регламенту реєстру diff --git a/docs/en/modules/arch/partials/architecture/registry/administrative/operational-maintenance/nav.adoc b/docs/en/modules/arch/partials/architecture/registry/administrative/operational-maintenance/nav.adoc index f9153dea12..4b5aeb1f3e 100644 --- a/docs/en/modules/arch/partials/architecture/registry/administrative/operational-maintenance/nav.adoc +++ b/docs/en/modules/arch/partials/architecture/registry/administrative/operational-maintenance/nav.adoc @@ -1,3 +1,3 @@ -***** xref:arch:architecture/registry/administrative/operational-maintenance/overview.adoc[Підсистема обслуговування операційної зони реєстру] -****** Сервіси підсистеми +***** xref:arch:architecture/registry/administrative/operational-maintenance/overview.adoc[Registry's operational zone service subsystem] +****** Subsystem services include::arch:partial$architecture/registry/administrative/operational-maintenance/services/business-process-administration-portal/nav.adoc[] \ No newline at end of file diff --git a/docs/en/modules/arch/partials/architecture/registry/administrative/operational-maintenance/services/business-process-administration-portal/nav.adoc b/docs/en/modules/arch/partials/architecture/registry/administrative/operational-maintenance/services/business-process-administration-portal/nav.adoc new file mode 100644 index 0000000000..6c5c5baf51 --- /dev/null +++ b/docs/en/modules/arch/partials/architecture/registry/administrative/operational-maintenance/services/business-process-administration-portal/nav.adoc @@ -0,0 +1,5 @@ +******* xref:arch:architecture/registry/administrative/operational-maintenance/services/business-process-administration-portal/summary.adoc[Business process administration service] +******** xref:arch:architecture/registry/administrative/operational-maintenance/services/business-process-administration-portal/building-blocks.adoc[Component structure] +******** xref:arch:architecture/registry/administrative/operational-maintenance/services/business-process-administration-portal/development.adoc[Service functional capabilities] +******** xref:arch:architecture/registry/administrative/operational-maintenance/services/business-process-administration-portal/deployment-diagram.adoc[Deployment diagram] +******** xref:arch:architecture/registry/administrative/operational-maintenance/services/business-process-administration-portal/technologies.adoc[Technology stack] diff --git a/docs/en/modules/arch/partials/architecture/registry/administrative/regulation-management/admin-portal/db-tables-management-er.puml b/docs/en/modules/arch/partials/architecture/registry/administrative/regulation-management/admin-portal/db-tables-management-er.puml new file mode 100644 index 0000000000..df3a784d8f --- /dev/null +++ b/docs/en/modules/arch/partials/architecture/registry/administrative/regulation-management/admin-portal/db-tables-management-er.puml @@ -0,0 +1,74 @@ +@startuml +' hide the spot +hide circle + +' avoid problems with angled crows feet +skinparam linetype ortho + +entity "Table" as table { + *id : UUID + -- + name: string + historicalFlag: boolean + objectReference: + description: String +} + +entity "Index" as index { + *id : UUID + -- + name: string + columns: array[Index.Column] +} + +entity "Index.Column" as index_column { + name: string + sorting: enum[ASC, DESC, NONE] +} + +entity "UniqueConstraint" as unique_constraint extends index + +entity "PrimaryKeyConstraint" as primary_key_constraint extends unique_constraint + +entity "Column" as column { + *id : UUID + -- + name: string + description: string + type: enum[clarify types] + defaultValue: object + notNull: boolean +} + +entity "ForeignKey" as foreign_key { + *id : UUID + -- + name: string + targetTable: string + columnPairs: array[ForeignKey.ColumnPair] +} + +entity "ForeignKey.ColumnPair" as foreign_key_column_pair { + sourceColumnName: string + targetColumnName: string +} + +entity "DdmRolePermission" as ddm_role_permission { + *permissionId : UUID + -- + roleName : string + objectName : string // it's table name + columnName : string + operation: enum[INSERT, SELECT, UPDATE, DELETE] +} + + +table ||..o{ index +table ||..o{ column +table ||..o{ foreign_key +table ||..o{ unique_constraint +table ||..o{ primary_key_constraint + +foreign_key +-- foreign_key_column_pair +index +-- index_column +@enduml \ No newline at end of file diff --git a/docs/en/modules/arch/partials/architecture/registry/administrative/regulation-management/admin-portal/db-tables-management-sequence.puml b/docs/en/modules/arch/partials/architecture/registry/administrative/regulation-management/admin-portal/db-tables-management-sequence.puml new file mode 100644 index 0000000000..b2cbe0bf1b --- /dev/null +++ b/docs/en/modules/arch/partials/architecture/registry/administrative/regulation-management/admin-portal/db-tables-management-sequence.puml @@ -0,0 +1,85 @@ +@startuml + +autonumber +skinparam responseMessageBelowArrow true + +actor "Regulations\n administrator" as User +actor "Regulations\n inspector" as Reviewer + +participant "Administrative portal" as FrontEnd +participant "Registry regulations\n management service" as BackendService +participant "Change inspection service" as Gerrit +participant "Registry regulations\n publishing service" as Jenkins + +activate User +User -> FrontEnd: Create candidate version of the regulations +FrontEnd -> BackendService: Create candidate version of the regulations +activate BackendService +BackendService -> Gerrit: Create a separate branch +activate Gerrit +BackendService -> Gerrit: Get updated version of DataModelSnapshot +BackendService <-- Gerrit: DataModelSnapshot + +BackendService -> Gerrit: Get change history of DataModelSnapshot +FrontEnd <-- BackendService: DataModelSnapshot + +BackendService -> BackendService: Processing change history +FrontEnd <-- BackendService: History +User <-- FrontEnd: Regulations candidate version + +User -> FrontEnd: Request to save changes of\n regulations candidate version +FrontEnd -> BackendService: New version of DataModelSnapshot + +User -> FrontEnd: Request for change inspection of\n regulations candidate version +FrontEnd -> BackendService: Send the candidate version for review + +deactivate User + +BackendService -> Gerrit: Get DataModelSnapshot of the document\n that is up-to-date when creating the change branch +BackendService <-- Gerrit: DataModelSnapshot + +BackendService -> Gerrit: Get changed DataModelSnapshot +BackendService <-- Gerrit: DataModelSnapshot +BackendService -> BackendService: build Diff document +BackendService -> BackendService: conversion of Diif document\n in liquibase changeset + +BackendService -> BackendService: Add information to liquibase сhangelog\n from liquibase changeset +BackendService -> Gerrit: Save liquibase changeset +deactivate BackendService + +activate Reviewer +Reviewer -> FrontEnd: Request for version inspection +FrontEnd -> BackendService: Request for version inspection + +activate BackendService +BackendService -> Gerrit: Get candidate version status +BackendService <-- Gerrit: Condition status (conflicts and tests) +BackendService -> Gerrit: Get DataModelSnapshot\n from the candidate version change branch + +'Add diff here + +BackendService -> Gerrit: Get document with change history +BackendService <-- Gerrit: History +FrontEnd <-- BackendService: Candidate version +Reviewer <-- FrontEnd: Candidate version + +Reviewer -> FrontEnd: Request to apply changes +deactivate Reviewer + +FrontEnd -> BackendService: Request to apply changes + +BackendService -> Gerrit: Merge PR +deactivate BackendService + +Gerrit --> Jenkins: Send event to start RegistryRegulationJob + +activate Jenkins +Jenkins -> Jenkins: Create DB structure\n and informing metadata table\n using liquibase changelog +Jenkins -> Jenkins: Create DataModelSnapshot\n using DB + +Jenkins -> Gerrit: Save updated DataModelSnapshot +deactivate Jenkins +Gerrit -> Gerrit: merge changes to master +deactivate Gerrit + +@enduml \ No newline at end of file diff --git a/docs/en/modules/arch/partials/architecture/registry/administrative/regulation-management/nav.adoc b/docs/en/modules/arch/partials/architecture/registry/administrative/regulation-management/nav.adoc index 0c55873026..867a1cd23b 100644 --- a/docs/en/modules/arch/partials/architecture/registry/administrative/regulation-management/nav.adoc +++ b/docs/en/modules/arch/partials/architecture/registry/administrative/regulation-management/nav.adoc @@ -1,30 +1,30 @@ -***** xref:arch:architecture/registry/administrative/regulation-management/overview.adoc[Підсистема моделювання регламенту реєстру] -****** xref:arch:architecture/registry/administrative/regulation-management/registry-regulation/registry-regulation.adoc[Цифровий регламент реєстру] -****** xref:arch:architecture/registry/administrative/regulation-management/ceph-storage.adoc[Об'єктне сховище даних] -****** Еволюція підсистеми -******* xref:arch:architecture/registry/administrative/regulation-management/platform-evolution/form-scripts/form-scripts.adoc[Екстерналізація скриптів UI-форм] -******* xref:arch:architecture/registry/administrative/regulation-management/platform-evolution/master-development/master-development.adoc[Спрощений процес розробки регламенту через мастер-версію для форм і бізнес-процесів та захист від перезапису змін] -******* xref:arch:architecture/registry/administrative/regulation-management/platform-evolution/template-validation/template-validation.adoc[Валідація на перевірку пустих обов'язкових полів на рівні темплейту БП] -******* xref:arch:architecture/registry/administrative/regulation-management/platform-evolution/sc-where-logic-operators.adoc[Управління типом логічного оператора в критеріях пошуку] -******* xref:arch:architecture/registry/administrative/regulation-management/platform-evolution/sign-validation/sign-validation.adoc[Можливість перевіряти валідність підпису КЕП і ким підписано контент, що прийшов в бізнес процес по API] -****** Архітектура підсистеми -******* Управління версіями регламенту реєстру -******** xref:arch:architecture/registry/administrative/regulation-management/admin-portal/regulation-repository/gitflow/gitflow-description.adoc[Організація роботи з git репозиторіями під час роботи з декількома версіями регламенту реєстру] -******* Управління посадовими особами реєстру -******** xref:arch:architecture/registry/administrative/regulation-management/user-import.adoc[Механізм імпорту користувачів в KeyCloak] -******* Управління моделлю даних реєстру -******** xref:arch:architecture/registry/administrative/regulation-management/admin-portal/data-model/admin-portal-data-model-management.adoc[Управління структурами таблиць моделі даних реєстру] -******** xref:arch:architecture/registry/administrative/regulation-management/admin-portal/data-model/data-model-version-candidate/data-model-version-candidate.adoc[Перегляд переліку таблиць моделі даних реєстру у режимі читання для версії-кандидату] -******** xref:arch:architecture/registry/administrative/regulation-management/admin-portal/data-model/data-model-version-candidate/edit-data-model-tables.adoc[Внесення змін до файлу описів структур таблиць моделі даних реєстру через веб-редактор коду] -******** xref:arch:architecture/registry/administrative/regulation-management/admin-portal/data-model/admin-portal-data-model-xml-changelog-serialization.adoc[Механізм перетворення моделі структури БД у вигляді Liquibase ChangeSet] -******** xref:arch:architecture/registry/administrative/regulation-management/admin-portal/data-model/admin-portal-data-model-json-schema-description.adoc[Опис структури Json представлення моделі даних] -******* Управління бізнес-процесами реєстру -******** xref:arch:architecture/registry/administrative/regulation-management/admin-portal/business-processes/bpmn-modeler.adoc[Моделювання бізнес-процесів за допомогою веб-редактора] -******** xref:arch:architecture/registry/administrative/regulation-management/bp-groups.adoc[Категоризація доступних послуг в кабінеті користувача] -******** xref:arch:architecture/registry/administrative/regulation-management/bp-script-groovy-editor.adoc[Редагування Groovy скриптів бізнес-процесів в адмін-порталі] -******* Управління схемами UI-форм реєстру -******** xref:arch:architecture/registry/administrative/regulation-management/admin-portal/forms/form-modeler.adoc[Моделювання UI-форм за допомогою веб-редактора] -****** Сервіси підсистеми -include::arch:partial$architecture/registry/administrative/regulation-management/services/admin-portal/nav.adoc[] -include::arch:partial$architecture/registry/administrative/regulation-management/services/registry-regulation-management/nav.adoc[] -include::arch:partial$architecture/registry/administrative/regulation-management/services/business-process-modeler-extensions/nav.adoc[] \ No newline at end of file +***** xref:arch:architecture/registry/administrative/regulation-management/overview.adoc[Registry regulations modeling subsystem] +****** xref:arch:architecture/registry/administrative/regulation-management/registry-regulation/registry-regulation.adoc[Digital registry regulations] +****** xref:arch:architecture/registry/administrative/regulation-management/ceph-storage.adoc[Object data storage] +****** Subsystem evolution +******* xref:arch:architecture/registry/administrative/regulation-management/platform-evolution/form-scripts/form-scripts.adoc[Externalizing UI form scripts] +******* xref:arch:architecture/registry/administrative/regulation-management/platform-evolution/master-development/master-development.adoc[Regulations development in a master version for forms and processes: simplified modeling and overwrite protection] +******* xref:arch:architecture/registry/administrative/regulation-management/platform-evolution/template-validation/template-validation.adoc[Validating empty business process mandatory fields on the template level] +******* xref:arch:architecture/registry/administrative/regulation-management/platform-evolution/sc-where-logic-operators.adoc[Managing logical operators in search conditions] +******* xref:arch:architecture/registry/administrative/regulation-management/platform-evolution/sign-validation/sign-validation.adoc[Verifying QES signature and signer in API-received business process content] +****** Subsystem architecture +******* Managing versions of registry regulations +******** xref:arch:architecture/registry/administrative/regulation-management/admin-portal/regulation-repository/gitflow/gitflow-description.adoc[Managing git repositories for multiple versions of registry regulations] +******* Managing registry officers +******** xref:arch:architecture/registry/administrative/regulation-management/user-import.adoc[Importing users into Keycloak] +******* Managing registry data model +******** xref:arch:architecture/registry/administrative/regulation-management/admin-portal/data-model/admin-portal-data-model-management.adoc[Managing registry data model table structures] +******** xref:arch:architecture/registry/administrative/regulation-management/admin-portal/data-model/data-model-version-candidate/data-model-version-candidate.adoc[Viewing the list of registry data model tables in the read mode for candidate versions] +******** xref:arch:architecture/registry/administrative/regulation-management/admin-portal/data-model/data-model-version-candidate/edit-data-model-tables.adoc[Editing registry data model table structure in the web code editor] +******** xref:arch:architecture/registry/administrative/regulation-management/admin-portal/data-model/admin-portal-data-model-xml-changelog-serialization.adoc[Converting database structure models to Liquibase ChangeSets] +******** xref:arch:architecture/registry/administrative/regulation-management/admin-portal/data-model/admin-portal-data-model-json-schema-description.adoc[Data model JSON snapshot] +******* Managing registry business processes +******** xref:arch:architecture/registry/administrative/regulation-management/admin-portal/business-processes/bpmn-modeler.adoc[Modeling business processes using the web editor] +******** xref:arch:architecture/registry/administrative/regulation-management/bp-groups.adoc[Categorizing available services in the user portal] +******** xref:arch:architecture/registry/administrative/regulation-management/bp-script-groovy-editor.adoc[Editing business process groovy scripts in admin-portal] +******* Managing registry UI form schemes +******** xref:arch:architecture/registry/administrative/regulation-management/admin-portal/forms/form-modeler.adoc[Modeling UI forms using the web editor] +//****** Сервіси підсистеми +//include::arch:partial$architecture/registry/administrative/regulation-management/services/admin-portal/nav.adoc[] +//include::arch:partial$architecture/registry/administrative/regulation-management/services/registry-regulation-management/nav.adoc[] +//include::arch:partial$architecture/registry/administrative/regulation-management/services/business-process-modeler-extensions/nav.adoc[] \ No newline at end of file diff --git a/docs/en/modules/arch/partials/architecture/registry/administrative/regulation-management/platform-evolution/form-scripts/form-scripts-attribute.puml b/docs/en/modules/arch/partials/architecture/registry/administrative/regulation-management/platform-evolution/form-scripts/form-scripts-attribute.puml new file mode 100644 index 0000000000..45ae28de8d --- /dev/null +++ b/docs/en/modules/arch/partials/architecture/registry/administrative/regulation-management/platform-evolution/form-scripts/form-scripts-attribute.puml @@ -0,0 +1,4 @@ +@startuml +(*) --> "myUtil.js as text" +"myUtil.js as text" --> "Component Javascript attribute" +@enduml diff --git a/docs/en/modules/arch/partials/architecture/registry/administrative/regulation-management/platform-evolution/form-scripts/form-scripts-structure.puml b/docs/en/modules/arch/partials/architecture/registry/administrative/regulation-management/platform-evolution/form-scripts/form-scripts-structure.puml new file mode 100644 index 0000000000..a83780da79 --- /dev/null +++ b/docs/en/modules/arch/partials/architecture/registry/administrative/regulation-management/platform-evolution/form-scripts/form-scripts-structure.puml @@ -0,0 +1,12 @@ +@startsalt +{ +{T ++ <&folder> registry-regulation +++ <&folder> bpmn +++ ... +++ <&folder> forms +++ <&folder> form-scripts +++ ... +} +} +@endsalt diff --git a/docs/en/modules/arch/partials/architecture/registry/administrative/regulation-publication/nav.adoc b/docs/en/modules/arch/partials/architecture/registry/administrative/regulation-publication/nav.adoc index 6abb6ea6a5..075214e262 100644 --- a/docs/en/modules/arch/partials/architecture/registry/administrative/regulation-publication/nav.adoc +++ b/docs/en/modules/arch/partials/architecture/registry/administrative/regulation-publication/nav.adoc @@ -1,7 +1,7 @@ -***** xref:arch:architecture/registry/administrative/regulation-publication/overview.adoc[Підсистема розгортання регламенту реєстру] -****** Еволюція підсистеми -******* xref:arch:architecture/registry/administrative/regulation-publication/data-api-versioning-decommission.adoc[Відмова від збереження попередніх версій сервісів API фабрики даних] -******* xref:arch:architecture/registry/administrative/regulation-publication/cd-process.adoc[Процеси CD] -****** Сервіси підсистеми -include::arch:partial$architecture/registry/administrative/regulation-publication/services/camunda-auth-cli/nav.adoc[] -include::arch:partial$architecture/registry/administrative/regulation-publication/services/generator/nav.adoc[] \ No newline at end of file +***** xref:arch:architecture/registry/administrative/regulation-publication/overview.adoc[Registry regulations deployment subsystem] +****** Subsystem evolution +******* xref:arch:architecture/registry/administrative/regulation-publication/data-api-versioning-decommission.adoc[Decommissioning of saving previous versions of data factory API services] +******* xref:arch:architecture/registry/administrative/regulation-publication/cd-process.adoc[CD processes] +//****** Сервіси підсистеми +//include::arch:partial$architecture/registry/administrative/regulation-publication/services/camunda-auth-cli/nav.adoc[] +//include::arch:partial$architecture/registry/administrative/regulation-publication/services/generator/nav.adoc[] \ No newline at end of file diff --git a/docs/en/modules/arch/partials/architecture/registry/operational/audit/nav.adoc b/docs/en/modules/arch/partials/architecture/registry/operational/audit/nav.adoc index 4e33e1bd65..672df21767 100644 --- a/docs/en/modules/arch/partials/architecture/registry/operational/audit/nav.adoc +++ b/docs/en/modules/arch/partials/architecture/registry/operational/audit/nav.adoc @@ -1,4 +1,4 @@ -***** xref:arch:architecture/registry/operational/audit/overview.adoc[Підсистема журналювання подій аудиту] -****** xref:arch:architecture/registry/operational/audit/audit-db.adoc[] -****** Еволюція підсистеми -******* xref:arch:architecture/registry/operational/audit/audit.adoc[Аудит подій] \ No newline at end of file +***** xref:arch:architecture/registry/operational/audit/overview.adoc[Registry audit events logging subsystem] +****** xref:arch:architecture/registry/operational/audit/audit-db.adoc[Audit events operational database] +//****** Subsystem evolution +//******* xref:arch:architecture/registry/operational/audit/audit.adoc[Аудит подій] \ No newline at end of file diff --git a/docs/en/modules/arch/partials/architecture/registry/operational/bpms/nav.adoc b/docs/en/modules/arch/partials/architecture/registry/operational/bpms/nav.adoc index 1002323852..4a01121146 100644 --- a/docs/en/modules/arch/partials/architecture/registry/operational/bpms/nav.adoc +++ b/docs/en/modules/arch/partials/architecture/registry/operational/bpms/nav.adoc @@ -1,25 +1,26 @@ -***** xref:arch:architecture/registry/operational/bpms/overview.adoc[Підсистема виконання бізнес-процесів] -****** xref:arch:architecture/registry/operational/bpms/ceph-storage.adoc[Об'єктне сховище даних] -****** xref:arch:architecture/registry/operational/bpms/redis-storage.adoc[Нереляційне сховище даних] -****** xref:arch:architecture/registry/operational/bpms/camunda-db.adoc[] -****** xref:arch:architecture/registry/operational/bpms/process_history-db.adoc[] -****** Еволюція підсистеми -******* xref:arch:architecture/registry/operational/bpms/digital-documents.adoc[Робота з цифровими документами у кабінеті користувача] -******* xref:arch:architecture/registry/operational/bpms/bpm-history.adoc[Історичність виконання бізнес-процесів] -******* xref:arch:architecture/registry/operational/bpms/bpm-form-schema.adoc[Зберігання схем UI-форм та валідація даних користувачів] -******* xref:arch:architecture/registry/operational/bpms/bpm-interim-data-storage.adoc[Проміжні дані бізнес-процесів] -******* xref:arch:architecture/registry/operational/bpms/bpm-save-interim-form-submission.adoc[Проміжне збереження даних, внесених через UI-форми задач бізнес-процесів] -******* xref:arch:architecture/registry/operational/bpms/bpm-save-ext-documents.adoc[Скриптування вивантаження файлів за віддаленою адресою з послідуючим збереженням до реєстру у бізнес-процесі] -******* xref:arch:architecture/registry/operational/bpms/soap-connector.adoc[Універсальний SOAP-конектор для взаємодії з учасниками інформаційного обміну через ШБО "Трембіта"] -******* xref:arch:architecture/registry/operational/bpms/trembita-rest-connector.adoc[Універсальний конектор для виклику Trembita Rest API] -****** Сервіси підсистеми +***** xref:arch:architecture/registry/operational/bpms/overview.adoc[Business processes management subsystem] +****** xref:arch:architecture/registry/operational/bpms/ceph-storage.adoc[Object data storage] +****** xref:arch:architecture/registry/operational/bpms/redis-storage.adoc[Non-relational data storage] +****** xref:arch:architecture/registry/operational/bpms/camunda-db.adoc[Business processes operational database] +****** xref:arch:architecture/registry/operational/bpms/process_history-db.adoc[Business processes historical data operational database] +****** Subsystem evolution +//TODO: HERE +******* xref:arch:architecture/registry/operational/bpms/digital-documents.adoc[Working with digital documents in the user portal] +******* xref:arch:architecture/registry/operational/bpms/bpm-history.adoc[Business processes execution history] +******* xref:arch:architecture/registry/operational/bpms/bpm-form-schema.adoc[Saving UI form schemes and validating user data] +******* xref:arch:architecture/registry/operational/bpms/bpm-interim-data-storage.adoc[Interim data of business processes] +******* xref:arch:architecture/registry/operational/bpms/bpm-save-interim-form-submission.adoc[Interim storage of data entered through business process UI forms] +******* xref:arch:architecture/registry/operational/bpms/bpm-save-ext-documents.adoc[Downloading digital documents from external sources: scripting capabilities] +//******* xref:arch:architecture/registry/operational/bpms/soap-connector.adoc[Універсальний SOAP-конектор для взаємодії з учасниками інформаційного обміну через ШБО "Трембіта"] +//******* xref:arch:architecture/registry/operational/bpms/trembita-rest-connector.adoc[Універсальний конектор для виклику Trembita Rest API] +//****** Subsystem services // Сервіс виконання бізнес-процесів -include::arch:partial$architecture/registry/operational/bpms/services/bpms/nav.adoc[] +//include::arch:partial$architecture/registry/operational/bpms/services/bpms/nav.adoc[] // Сервіс управління задачами користувача -include::arch:partial$architecture/registry/operational/bpms/services/user-task-management/nav.adoc[] +//include::arch:partial$architecture/registry/operational/bpms/services/user-task-management/nav.adoc[] // Сервіс управління бізнес-процесами користувача -include::arch:partial$architecture/registry/operational/bpms/services/user-process-management/nav.adoc[] +//include::arch:partial$architecture/registry/operational/bpms/services/user-process-management/nav.adoc[] //Сервіс цифрових документів -include::arch:partial$architecture/registry/operational/bpms/services/digital-document-service/nav.adoc[] +//include::arch:partial$architecture/registry/operational/bpms/services/digital-document-service/nav.adoc[] //Сервіс валідації даних форми -include::arch:partial$architecture/registry/operational/bpms/services/form-submission-validation/nav.adoc[] \ No newline at end of file +//include::arch:partial$architecture/registry/operational/bpms/services/form-submission-validation/nav.adoc[] \ No newline at end of file diff --git a/docs/en/modules/arch/partials/architecture/registry/operational/digital-signatures/nav.adoc b/docs/en/modules/arch/partials/architecture/registry/operational/digital-signatures/nav.adoc index 0d3b908ed7..e354aaa7c7 100644 --- a/docs/en/modules/arch/partials/architecture/registry/operational/digital-signatures/nav.adoc +++ b/docs/en/modules/arch/partials/architecture/registry/operational/digital-signatures/nav.adoc @@ -1,3 +1,3 @@ -***** xref:arch:architecture/registry/operational/digital-signatures/overview.adoc[Підсистема цифрових підписів] -****** Сервіси підсистеми +***** xref:arch:architecture/registry/operational/digital-signatures/overview.adoc[Digital signatures subsystem] +****** Subsystem services include::arch:partial$architecture/registry/operational/digital-signatures/services/nav.adoc[] \ No newline at end of file diff --git a/docs/en/modules/arch/partials/architecture/registry/operational/digital-signatures/services/nav.adoc b/docs/en/modules/arch/partials/architecture/registry/operational/digital-signatures/services/nav.adoc new file mode 100644 index 0000000000..bfe94ec53f --- /dev/null +++ b/docs/en/modules/arch/partials/architecture/registry/operational/digital-signatures/services/nav.adoc @@ -0,0 +1,4 @@ +//******* xref:arch:architecture/registry/operational/digital-signatures/services/dso/index.adoc[Сервіс КЕП-операцій] +******* QES operations service +******** xref:arch:architecture/registry/operational/digital-signatures/services/dso/esignature.adoc[Working with digital signatures] +******** xref:arch:architecture/registry/operational/digital-signatures/services/dso/eseal.adoc[Working with electronic seal] diff --git a/docs/en/modules/arch/partials/architecture/registry/operational/excerpts/nav.adoc b/docs/en/modules/arch/partials/architecture/registry/operational/excerpts/nav.adoc index d987413cd0..c45534b08e 100644 --- a/docs/en/modules/arch/partials/architecture/registry/operational/excerpts/nav.adoc +++ b/docs/en/modules/arch/partials/architecture/registry/operational/excerpts/nav.adoc @@ -1,7 +1,7 @@ -***** xref:arch:architecture/registry/operational/excerpts/overview.adoc[Підсистема формування витягів реєстру] -****** xref:arch:architecture/registry/operational/excerpts/ceph-storage.adoc[Об'єктне сховище даних] -****** xref:arch:architecture/registry/operational/excerpts/excerpt-db.adoc[] -****** Еволюція підсистеми -******* xref:arch:architecture/registry/operational/excerpts/excerpt-generation.adoc[Генерація витягів з кабінету користувача] -******* xref:arch:architecture/registry/operational/excerpts/excerpt.adoc[Генерування витягів] -******* xref:arch:architecture/registry/operational/excerpts/history-excerpt.adoc[Витяг історичності даних] \ No newline at end of file +***** xref:arch:architecture/registry/operational/excerpts/overview.adoc[Registry excerpt generation subsystem] +****** xref:arch:architecture/registry/operational/excerpts/ceph-storage.adoc[Object data storage] +****** xref:arch:architecture/registry/operational/excerpts/excerpt-db.adoc[Excerpts operational database] +****** Subsystem evolution +******* xref:arch:architecture/registry/operational/excerpts/excerpt-generation.adoc[Generating excerpts in user portals] +******* xref:arch:architecture/registry/operational/excerpts/excerpt.adoc[Generating excerpts] +******* xref:arch:architecture/registry/operational/excerpts/history-excerpt.adoc[Data history excerpt] \ No newline at end of file diff --git a/docs/en/modules/arch/partials/architecture/registry/operational/ext-api-management/nav.adoc b/docs/en/modules/arch/partials/architecture/registry/operational/ext-api-management/nav.adoc index 39882be20c..b73eb4b38a 100644 --- a/docs/en/modules/arch/partials/architecture/registry/operational/ext-api-management/nav.adoc +++ b/docs/en/modules/arch/partials/architecture/registry/operational/ext-api-management/nav.adoc @@ -1,6 +1,7 @@ -***** xref:arch:architecture/registry/operational/ext-api-management/overview.adoc[Підсистема управління зовнішнім трафіком] -****** xref:arch:architecture/registry/operational/ext-api-management/redis-storage.adoc[Нереляційне сховище даних] -****** Еволюція підсистеми -******* xref:arch:architecture/registry/operational/ext-api-management/routes.adoc[Структура маршрутів зовнішнього Kong API Gateway] -******* xref:arch:architecture/registry/operational/ext-api-management/api-gateway/overview.adoc[Зовнішній операційний API-шлюз] -******** xref:arch:architecture/registry/operational/ext-api-management/api-gateway/kong-oidc.adoc[OIDC розширення для Kong API Gateway] \ No newline at end of file +***** xref:arch:architecture/registry/operational/ext-api-management/overview.adoc[External traffic management subsystem: Registry operational zone] +****** xref:arch:architecture/registry/operational/ext-api-management/redis-storage.adoc[Non-relational data storage] +****** Subsystem evolution +******* xref:arch:architecture/registry/operational/ext-api-management/routes.adoc[External Kong API Gateway routes structure] +******* External operational API gateway +//******* xref:arch:architecture/registry/operational/ext-api-management/api-gateway/overview.adoc[Зовнішній операційний API-шлюз] +******** xref:arch:architecture/registry/operational/ext-api-management/api-gateway/kong-oidc.adoc[The OIDC extension for the Kong API Gateway] \ No newline at end of file diff --git a/docs/en/modules/arch/partials/architecture/registry/operational/ext-systems-simulation/nav.adoc b/docs/en/modules/arch/partials/architecture/registry/operational/ext-systems-simulation/nav.adoc index dd3b21cf57..30a7c9af4f 100644 --- a/docs/en/modules/arch/partials/architecture/registry/operational/ext-systems-simulation/nav.adoc +++ b/docs/en/modules/arch/partials/architecture/registry/operational/ext-systems-simulation/nav.adoc @@ -1,3 +1,3 @@ -***** xref:arch:architecture/registry/operational/ext-systems-simulation/overview.adoc[Підсистема симуляції API зовнішніх систем] -****** Еволюція підсистеми -******* xref:arch:architecture/registry/operational/ext-systems-simulation/custom-mocking-wiremock.adoc[Декларативний підхід до налаштування емуляторів зовнішніх систем для спрощення тестування зовнішніх інтеграцій реєстру] \ No newline at end of file +***** xref:arch:architecture/registry/operational/ext-systems-simulation/overview.adoc[External API simulation subsystem] +****** Subsystem evolution +******* xref:arch:architecture/registry/operational/ext-systems-simulation/custom-mocking-wiremock.adoc[Declarative configuration of system emulators: simplified testing of external registry integrations] \ No newline at end of file diff --git a/docs/en/modules/arch/partials/architecture/registry/operational/external-integrations/nav.adoc b/docs/en/modules/arch/partials/architecture/registry/operational/external-integrations/nav.adoc index 80f01b8339..00e8df58d6 100644 --- a/docs/en/modules/arch/partials/architecture/registry/operational/external-integrations/nav.adoc +++ b/docs/en/modules/arch/partials/architecture/registry/operational/external-integrations/nav.adoc @@ -1,11 +1,11 @@ -***** xref:arch:architecture/registry/operational/external-integrations/overview.adoc[Підсистема зовнішніх інтеграцій] -****** Еволюція підсистеми -******* xref:arch:architecture/registry/operational/external-integrations/diia-integration.adoc[Інтеграція Платформи Реєстрів та Дії] -******* xref:arch:architecture/registry/operational/external-integrations/api-access-from-trembita.adoc[Обмеження доступа до SOAP інтерфейсів з ШБО Трембіта] -******* xref:arch:architecture/registry/operational/external-integrations/cross-registry.adoc[Міжреєстрова взаємодія без Трембіта] -******* Інтеграція з зовнішніми системами через ШБО Трембіта -******** xref:arch:architecture/registry/operational/external-integrations/trembita/camunda-connectors.adoc[Дизайн моделювання зовнішніх інтеграційних розширень на інші реєстри] -******** xref:arch:architecture/registry/operational/external-integrations/trembita/external-invocation.adoc[Дизайн обробки запитів на ініціювання бізнес-процесів зовнішніми системами через Трембіту] -******** xref:arch:architecture/registry/operational/external-integrations/trembita/service-registration.adoc[Реєстрація SOAP-сервісу в системі Трембіта] -******** xref:arch:architecture/registry/operational/external-integrations/trembita/consumers.adoc[Керування зовнішніми клієнтами в системі] -******** xref:arch:architecture/registry/operational/external-integrations/trembita/authz.adoc[Розмежування прав доступу до бізнес-процесів для зовнішніх клієнтів] \ No newline at end of file +***** xref:arch:architecture/registry/operational/external-integrations/overview.adoc[External integrations subsystem] +//****** Subsystem evolution +//******* xref:arch:architecture/registry/operational/external-integrations/diia-integration.adoc[Інтеграція Платформи Реєстрів та Дії] +//******* xref:arch:architecture/registry/operational/external-integrations/api-access-from-trembita.adoc[Обмеження доступа до SOAP інтерфейсів з ШБО Трембіта] +//******* xref:arch:architecture/registry/operational/external-integrations/cross-registry.adoc[Міжреєстрова взаємодія без Трембіта] +//******* Інтеграція з зовнішніми системами через ШБО Трембіта +//******** xref:arch:architecture/registry/operational/external-integrations/trembita/camunda-connectors.adoc[Дизайн моделювання зовнішніх інтеграційних розширень на інші реєстри] +//******** xref:arch:architecture/registry/operational/external-integrations/trembita/external-invocation.adoc[Дизайн обробки запитів на ініціювання бізнес-процесів зовнішніми системами через Трембіту] +//******** xref:arch:architecture/registry/operational/external-integrations/trembita/service-registration.adoc[Реєстрація SOAP-сервісу в системі Трембіта] +//******** xref:arch:architecture/registry/operational/external-integrations/trembita/consumers.adoc[Керування зовнішніми клієнтами в системі] +//******** xref:arch:architecture/registry/operational/external-integrations/trembita/authz.adoc[Розмежування прав доступу до бізнес-процесів для зовнішніх клієнтів] \ No newline at end of file diff --git a/docs/en/modules/arch/partials/architecture/registry/operational/geo/nav.adoc b/docs/en/modules/arch/partials/architecture/registry/operational/geo/nav.adoc index 528f1b7778..1e452c61c9 100644 --- a/docs/en/modules/arch/partials/architecture/registry/operational/geo/nav.adoc +++ b/docs/en/modules/arch/partials/architecture/registry/operational/geo/nav.adoc @@ -1,4 +1,4 @@ -***** xref:arch:architecture/registry/operational/geo/overview.adoc[Підсистема управління гео-даними] -****** Еволюція підсистеми -******* xref:arch:architecture/registry/operational/geo/gis.adoc[Модуль ГІС] -******* xref:arch:architecture/registry/operational/geo/geoserver-rls.adoc[] \ No newline at end of file +***** xref:arch:architecture/registry/operational/geo/overview.adoc[Geodata management subsystem] +****** Subsystem evolution +******* xref:arch:architecture/registry/operational/geo/gis.adoc[GIS module] +******* xref:arch:architecture/registry/operational/geo/geoserver-rls.adoc[Applying RLS rules to GIS module] \ No newline at end of file diff --git a/docs/en/modules/arch/partials/architecture/registry/operational/nav.adoc b/docs/en/modules/arch/partials/architecture/registry/operational/nav.adoc index 4e9b5128a8..f776116b4b 100644 --- a/docs/en/modules/arch/partials/architecture/registry/operational/nav.adoc +++ b/docs/en/modules/arch/partials/architecture/registry/operational/nav.adoc @@ -1,4 +1,4 @@ -**** xref:arch:architecture/registry/operational/overview.adoc[Операційна зона] +**** xref:arch:architecture/registry/operational/overview.adoc[Operational zone] // Підсистема кабінетів користувачів include::arch:partial$architecture/registry/operational/portals/nav.adoc[] // Підсистема управління зовнішнім трафіком @@ -17,16 +17,17 @@ include::arch:partial$architecture/registry/operational/ext-systems-simulation/n include::arch:partial$architecture/registry/operational/excerpts/nav.adoc[] // Підсистема нотифікацій користувачів include::arch:partial$architecture/registry/operational/notifications/nav.adoc[] -// Підсистема управління гео-даними +// Підсистема управління геоданими include::arch:partial$architecture/registry/operational/geo/nav.adoc[] // Підсистема журналювання подій аудиту include::arch:partial$architecture/registry/operational/audit/nav.adoc[] +//TODO: HERE // Підсистема управління налаштуваннями користувачів include::arch:partial$architecture/registry/operational/user-settings/nav.adoc[] // Підсистема цифрових підписів include::arch:partial$architecture/registry/operational/digital-signatures/nav.adoc[] -***** xref:arch:architecture/registry/operational/secret-management/overview.adoc[Підсистема управління секретами та шифруванням] -***** xref:arch:architecture/registry/operational/messaging/overview.adoc[Підсистема асинхронного обміну повідомленнями] +***** xref:arch:architecture/registry/operational/secret-management/overview.adoc[Secrets and encryption management subsystem] +***** xref:arch:architecture/registry/operational/messaging/overview.adoc[Asynchronous messaging subsystem] // Підсистема зберігання даних include::arch:partial$architecture/registry/operational/relational-data-storage/nav.adoc[] -***** xref:arch:architecture/registry/operational/nonrelational-data-storage/overview.adoc[Підсистема управління нереляційними базами даних] \ No newline at end of file +***** xref:arch:architecture/registry/operational/nonrelational-data-storage/overview.adoc[Non-relational database management subsystem] \ No newline at end of file diff --git a/docs/en/modules/arch/partials/architecture/registry/operational/notifications/email/email-channel-configuration-flow.puml b/docs/en/modules/arch/partials/architecture/registry/operational/notifications/email/email-channel-configuration-flow.puml new file mode 100644 index 0000000000..c61ebdcfa0 --- /dev/null +++ b/docs/en/modules/arch/partials/architecture/registry/operational/notifications/email/email-channel-configuration-flow.puml @@ -0,0 +1,162 @@ +@startuml +skinparam shadowing false +skinparam DatabaseBackgroundColor white +skinparam DatabaseBorderColor #2688d4 +skinparam QueueBackgroundColor white +skinparam QueueBorderColor #2688d4 +skinparam NoteBackgroundColor white +skinparam NoteBorderColor #2688d4 +skinparam EntityBackgroundColor white +skinparam EntityBorderColor #2688d4 +skinparam ControlBackgroundColor white +skinparam ControlBorderColor #2688d4 +skinparam ActorBackgroundColor white + +skinparam sequence { + ArrowColor #2688d4 + ActorBorderColor #2688d4 + LifeLineBorderColor #2688d4 + ParticipantBorderColor #2688d4 + ParticipantBackgroundColor white + BoxBorderColor #2688d4 + BoxBackgroundColor white +} + +actor "Адміністратор \nплатформи" as platform_admin +participant "Control Plane \nConsole \n**(control-plane)**" as control_plane + +participant "Зовнішній \nПоштовий Сервер \n**(external-mail-server)**" as external_mail_server + +entity "OpenShift \n'control-plane' \nnamespace" as openshift_control_plane_namespace + +box Platform Jenkins + control "Пайплайн створення реєстру" as registry_creation_pipeline +end box + +participant "Платформенний \nПоштовий Сервер \n**(platform-mail-server)**" as platform_mail_server + +entity "OpenShift \n'' \nnamespace" as openshift_registry_namespace +participant "Сервіс нотифікацій \nкористувачів \n**(notification-service)**" as notification_service + +platform_admin -> control_plane: Створення / Редагування конфігурації реєстру +activate control_plane +control_plane -> control_plane: Внесення назви реєстру (****) +control_plane -> control_plane: Вибір опції використання платформенного \nабо зовнішнього поштового сервера + +alt Обрано опцію використання зовнішнього поштового серверу + control_plane -> control_plane: Внесення даних налаштувань SMTP поштового сервера + note left + "smtp.host": '' + "smtp.port": '' + "username": '' + "password": '' + end note + + control_plane -> external_mail_server: Тестування підключення + external_mail_server -> control_plane: Результат підключення + + alt Підключення до зовнішнього поштового серверу виконано успішно + control_plane -> control_plane: Формування даних для створення ConfigMap\n**-notification-service-email-channel-configuration** + control_plane -> openshift_control_plane_namespace: Створення ConfigMap\n**-notification-service-email-channel-configuration** + note left + "notifications.email.host": '' + "notifications.email.port": '' + "notifications.email.properties.mail.smtp.auth": true + "notifications.email.properties.mail.smtp.starttls": true + "notifications.email.properties.mail.transport.protocol": 'smtp' + end note + + control_plane -> control_plane: Формування даних для створення Secret\n**-notification-service-email-channel-configuration** + control_plane -> openshift_control_plane_namespace: Створення Secret\n**-notification-service-email-channel-configuration** + note left + "notifications.email.username": '' + "notifications.email.password": '' + end note + end +else Обрано опцію використання платформенного поштового серверу + control_plane -> control_plane: Формування адреси поштової скриньки реєстру \n(**@**) + control_plane -> control_plane: Генерація пароля для доступу до поштової скриньки реєстру \n(**@**) + + control_plane -> control_plane: Автоматичне формування налаштувань SMTP \nплатформенного поштового сервера + note left + "smtp.host": '' + "smtp.port": '' + "username": '**@**' + "notifications.email.password": '****' + end note + + control_plane -> control_plane: Формування даних для створення ConfigMap\n**-notification-service-email-channel-configuration** + control_plane -> openshift_control_plane_namespace: Створення ConfigMap\n**-notification-service-email-channel-configuration** + note left + "notifications.email.host": '' + "notifications.email.port": '' + "notifications.email.properties.mail.smtp.auth": true + "notifications.email.properties.mail.smtp.starttls": true + "notifications.email.properties.mail.transport.protocol": 'smtp' + end note + + control_plane -> control_plane: Формування даних для створення Secret\n**-notification-service-email-channel-configuration** + control_plane -> openshift_control_plane_namespace: Створення Secret\n**-notification-service-email-channel-configuration** + note left + "notifications.email.username": '**@**' + "notifications.email.password": '****' + end note +end + +control_plane -> registry_creation_pipeline: Запуск пайплайну створення реєстру +deactivate control_plane + +activate registry_creation_pipeline +alt Обрано опцію використання платформенного поштового серверу + registry_creation_pipeline -> platform_mail_server: Створення поштової скриньки \n(**@**) + note left + "username": '**@**' + "password": '' + end note + platform_mail_server --> registry_creation_pipeline +end + +== Підготовка налаштувань підключення до SMTP сервера (ConfigMap) для реєстру == +registry_creation_pipeline -> openshift_control_plane_namespace: Експорт ConfigMap\n**-notification-service-email-channel-configuration** +registry_creation_pipeline -> registry_creation_pipeline: Формування даних для створення ConfigMap\n**notification-service-email-channel-configuration** +registry_creation_pipeline -> openshift_registry_namespace: Створення ConfigMap\n**notification-service-email-channel-configuration** +registry_creation_pipeline -> openshift_control_plane_namespace: Видалення ConfigMap\n**-notification-service-email-channel-configuration** + +== Підготовка налаштувань підключення до SMTP сервера (Secret) для реєстру == +registry_creation_pipeline -> openshift_control_plane_namespace: Експорт Secret\n**-notification-service-email-channel-configuration** +registry_creation_pipeline -> registry_creation_pipeline: Формування даних для створення Secret\n**notification-service-email-channel-configuration** +registry_creation_pipeline -> openshift_registry_namespace: Створення Secret\n**notification-service-email-channel-configuration** +registry_creation_pipeline -> openshift_control_plane_namespace: Видалення Secret\n**-notification-service-email-channel-configuration** + +== Налаштування доступу до SMTP сервера для сервісів реєстру == + +alt Обрано опцію використання зовнішнього поштового серверу + registry_creation_pipeline -> openshift_registry_namespace: Створення Istio ServiceEntry для зовнішнього поштового сервера + note left + apiVersion: networking.istio.io/v1alpha3 + kind: ServiceEntry + metadata: + name: external-mail-server + spec: + hosts: + - + location: MESH_EXTERNAL + ports: + - number: + name: tcp-smtp + protocol: TCP + resolution: DNS + end note + registry_creation_pipeline -> openshift_registry_namespace: Обмеження доступу до ServiceEntry \nзовнішнього поштового сервера тільки для **notification-service** +else Обрано опцію використання платформенного поштового серверу + registry_creation_pipeline -> openshift_registry_namespace: Створення NetworkPolicy для доступу **notification-service** до платформенного поштового сервера +end + +== Застосування налаштувань до сервісів реєстру == +registry_creation_pipeline -> notification_service: Рестарт сервісу **notification-service** +notification_service -> openshift_registry_namespace: Читання ConfigMap та Secret\n**notification-service-email-channel-configuration** +registry_creation_pipeline --> platform_admin + +deactivate registry_creation_pipeline + +@enduml diff --git a/docs/en/modules/arch/partials/architecture/registry/operational/notifications/email/email-notification-flow.puml b/docs/en/modules/arch/partials/architecture/registry/operational/notifications/email/email-notification-flow.puml new file mode 100644 index 0000000000..2fa2347854 --- /dev/null +++ b/docs/en/modules/arch/partials/architecture/registry/operational/notifications/email/email-notification-flow.puml @@ -0,0 +1,94 @@ +@startuml +skinparam shadowing false +skinparam DatabaseBackgroundColor white +skinparam DatabaseBorderColor #2688d4 +skinparam QueueBackgroundColor white +skinparam QueueBorderColor #2688d4 +skinparam NoteBackgroundColor white +skinparam NoteBorderColor #2688d4 +skinparam sequence { + ArrowColor #2688d4 + ActorBorderColor #2688d4 + LifeLineBorderColor #2688d4 + ParticipantBorderColor #2688d4 + ParticipantBackgroundColor white + BoxBorderColor #2688d4 + BoxBackgroundColor white +} + +queue "'email-channel-notifications'\n Kafka Topic" as email_notifications_kafka_topic +box "Сервіс нотифікацій користувачів" + participant "Email Channel \nNotification Subscriber" as email_channel_notification_subscriber + participant "Audit Service" as audit_service +end box +participant "Поштовий Сервер" as mail_server +queue "'audit-events'\n Kafka Topic" as audit_events_kafka_topic +queue "'email-channel-notifications.DLT'\n Kafka Topic" as email_notifications_dlt_kafka_topic + +alt Відправка повідомлення + loop Виконання N спроб на відправку згідно налаштувань у разі помилки обробки повідомлення + email_channel_notification_subscriber -> email_notifications_kafka_topic: Зчитування запиту \nна відправку повідомлення + note left + { + "context": { + "system": "Low-code Platform", + "application": "", + "businessProcess": "", + "businessProcessDefinitionId": "", + "businessProcessInstanceId": "", + "businessActivity": "", + "businessActivityInstanceId": "" + }, + "notification": { + "subject": "", + "message": "" + }, + "recipient": { + "email": "" + } + } + end note + + activate email_channel_notification_subscriber + email_channel_notification_subscriber -> email_channel_notification_subscriber: Побудова об'єкту повідомлення \nз даних запиту на відправку + email_channel_notification_subscriber -> mail_server: Відправка поштового повідомлення + note left + { + "to": {email}, + "subject": {subject}, + "text:": {message} + } + end note + mail_server --> email_channel_notification_subscriber: Повідомлення відправлено + email_channel_notification_subscriber -> email_channel_notification_subscriber: Обробка результату відправки повідомлення + alt У разі помилки відправки + email_channel_notification_subscriber --> email_notifications_kafka_topic + end + + email_channel_notification_subscriber -> email_channel_notification_subscriber: Формування події аудиту + email_channel_notification_subscriber -> audit_service: Фіксація події аудиту **SEND_USER_NOTIFICATION** (success) + note left + { + "notification": { + "channel:": "email", + "subject": "<Заголовок повідомлення>", + "message": "<Повідомлення>", + "recipient": { + "id": "<Ідентифікатор користувача - optional>", + "email": "<Поштова адреса користувача>" + } + } + } + end note + audit_service -> audit_events_kafka_topic: Публікація події аудиту + audit_events_kafka_topic --> audit_service + audit_service --> email_channel_notification_subscriber: OK + email_channel_notification_subscriber --> email_notifications_kafka_topic: Подію опрацьовано: ACK + end +else Повідомлення не відправлено + email_channel_notification_subscriber -> email_notifications_dlt_kafka_topic: Публікації події в Dead Letter Topic + email_notifications_dlt_kafka_topic --> email_channel_notification_subscriber + email_channel_notification_subscriber --> email_notifications_kafka_topic: Подію опрацьовано: ACK +end +deactivate email_channel_notification_subscriber +@enduml \ No newline at end of file diff --git a/docs/en/modules/arch/partials/architecture/registry/operational/notifications/general/notification-to-channels-flow.puml b/docs/en/modules/arch/partials/architecture/registry/operational/notifications/general/notification-to-channels-flow.puml new file mode 100644 index 0000000000..c7a3287905 --- /dev/null +++ b/docs/en/modules/arch/partials/architecture/registry/operational/notifications/general/notification-to-channels-flow.puml @@ -0,0 +1,164 @@ +@startuml +skinparam shadowing false +skinparam DatabaseBackgroundColor white +skinparam DatabaseBorderColor #2688d4 +skinparam QueueBackgroundColor white +skinparam QueueBorderColor #2688d4 +skinparam NoteBackgroundColor white +skinparam NoteBorderColor #2688d4 +skinparam sequence { + ArrowColor #2688d4 + ActorBorderColor #2688d4 + LifeLineBorderColor #2688d4 + ParticipantBorderColor #2688d4 + ParticipantBackgroundColor white + BoxBorderColor #2688d4 + BoxBackgroundColor white +} + +queue "'user-notifications'\n Kafka Topic" as user_notifications_kafka_topic + +box "Сервіс відправки повідомлень" + participant "Notification \nEvent Subscriber" as notification_kafka_subscriber + participant "Notification \nService" as notification_service + participant "Channel Notification \nValidators" as notification_channel_validators + participant "Channel Notification \nProducers" as notification_channel_producers + participant "Notification \nTemplate Service" as notification_template_service + participant "Channel Notification \nPublishers" as channel_notification_publishers +end box + +participant "Сервіс \nналаштувань користувачів" as user_settings_service +participant "Сервіс управління \nкористувачами та доступом" as keycloak +participant "Сервіс логування" as logging_service +database "Сховище \nшаблонів" as template_db + +queue "'user-notifications.DLT'\n Kafka Topic" as user_notifications_dlt_kafka_topic +queue "'*-channel-notification'\n Kafka Topic" as channel_notification_topics + +== Відправка повідомлень за преференціями користувача == +alt Відправка повідомлення +notification_kafka_subscriber -> user_notifications_kafka_topic: Зчитування події + note left + { + "context": { + "system": "Low-code Platform", + "application": "", + "businessProcess": "", + "businessProcessDefinitionId": "", + "businessProcessInstanceId": "", + "businessActivity": "", + "businessActivityInstanceId": "" + }, + "notification": { + "templateName": "" + }, + "recipients": [ + { + "id": "<Ідентифікатор користувача>", + "parameters": [ + { + "key": "", + "value": "" + } + ] + } + ] + } + end note +activate notification_kafka_subscriber +notification_kafka_subscriber -> notification_service: Відправка повідомлення \nкористувачу +activate notification_service + notification_service -> user_settings_service: Читання налаштувань користувача \n(**username = **) + user_settings_service --> notification_service: Обрані канали зв'язку з їх налаштуваннями + notification_service -> keycloak: Читання атрибутів користувача + keycloak --> notification_service: Атрибути користувача: РНОКПП, тощо. + notification_service -> notification_service: Визначення каналів зв'язку (**channel**) + loop Обробка повідомлення для кожного каналу зв'язку + notification_service -> notification_channel_validators: Валідація повідомлення + alt Помилка валідації + notification_channel_validators -> logging_service: Логування помилки + end + notification_channel_validators --> notification_service + notification_service -> notification_template_service: Запит на отримання шаблону для каналу зв'язку \n(у випадку з diia - створення шаблону) + notification_template_service -> template_db: Отримання шаблону + template_db --> notification_template_service + notification_template_service --> notification_service + notification_service -> notification_channel_producers: Створення повідомлення для каналу зв'язку + notification_channel_producers --> notification_service: Повідомлення для каналів зв'язку + alt Помилка створення повідомлення з шаблону і моделі + notification_service -> logging_service: Логування помилки + end + end + notification_service -> channel_notification_publishers: Запит на відправку повідомлень до каналів зв'язку + channel_notification_publishers -> channel_notification_topics: Публікація в топік каналу зв'язку + notification_kafka_subscriber --> user_notifications_kafka_topic: Подію опрацьовано +else Повідомлення не оброблене + notification_service -> logging_service: Логування помилки + notification_service -> user_notifications_dlt_kafka_topic: Збереження повідомлення до Dead-Letter Topic + user_notifications_dlt_kafka_topic --> notification_service + notification_kafka_subscriber --> user_notifications_kafka_topic: Подію опрацьовано +end +deactivate notification_service +deactivate notification_kafka_subscriber + +== Відправка повідомлень за визначеним каналом == + +alt Відправка повідомлення +notification_kafka_subscriber -> user_notifications_kafka_topic: Зчитування події + note left + { + "context": { + "system": "Low-code Platform", + "application": "", + }, + "notification": { + "templateName": "{notificationTemplate}" + }, + "recipients": [ + { + "id": "", + "channels": [ + { + "channel": "email", + "email": "" + } + ], + "parameters": [ + { + "key": "", + "value": "" + } + ] + } + ] + } + end note +activate notification_kafka_subscriber +notification_kafka_subscriber -> notification_service: Відправка повідомлення користувачу \nза інформацією з **channel** +activate notification_service + notification_service -> notification_channel_validators: Валідація повідомлення + notification_channel_validators --> notification_service + alt У разі помилки валідації по каналу + notification_channel_validators --> logging_service + end + notification_service -> notification_template_service: Отримання шаблону для каналу зв'язку \n(у випадку з diia - створення шаблону) + notification_template_service -> template_db: Отримання шаблону (для diia -\nзбереження + отримання) + template_db --> notification_template_service + notification_template_service --> notification_service + notification_service -> notification_channel_producers: Створення повідомлення для каналу зв'язку + notification_channel_producers --> notification_service: Повідомлення для каналу зв'язку + alt У разі помилки при створенні повідомлення з шаблону + notification_service --> logging_service + end + notification_service -> channel_notification_publishers: Запит на відправку повідомлення до каналу зв'язку + channel_notification_publishers -> channel_notification_topics: Публікація в топік каналу зв'язку + notification_kafka_subscriber --> user_notifications_kafka_topic: Подію опрацьовано +else Повідомлення не оброблене + notification_service -> logging_service: Логування помилки + notification_service -> user_notifications_dlt_kafka_topic: Збереження повідомлення до Dead-Letter Topic + user_notifications_dlt_kafka_topic --> notification_service + notification_kafka_subscriber --> user_notifications_kafka_topic: Подію опрацьовано +end +deactivate notification_service +deactivate notification_kafka_subscriber +@enduml diff --git a/docs/en/modules/arch/partials/architecture/registry/operational/notifications/inbox/inbox-notification-read-flow.puml b/docs/en/modules/arch/partials/architecture/registry/operational/notifications/inbox/inbox-notification-read-flow.puml new file mode 100644 index 0000000000..41c24d3ec9 --- /dev/null +++ b/docs/en/modules/arch/partials/architecture/registry/operational/notifications/inbox/inbox-notification-read-flow.puml @@ -0,0 +1,65 @@ +@startuml +skinparam shadowing false +skinparam DatabaseBackgroundColor white +skinparam DatabaseBorderColor #2688d4 +skinparam QueueBackgroundColor white +skinparam QueueBorderColor #2688d4 +skinparam NoteBackgroundColor white +skinparam NoteBorderColor #2688d4 +skinparam sequence { + ArrowColor #2688d4 + ActorBorderColor #2688d4 + LifeLineBorderColor #2688d4 + ParticipantBorderColor #2688d4 + ParticipantBackgroundColor white + BoxBorderColor #2688d4 + BoxBackgroundColor white +} + +actor "Користувач" as user +participant "Клієнтський додаток\n кабінету користувача" as cabinet +participant "Kong \nAPI Management" as kong +participant "Сервіс для роботи \nз inbox повідомленнями" as inbox_message_service + +database "Сховище inbox повідомлень" as inbox_db + +title Сценарії користувача з inbox повідомленнями + +== Отримання користувачем повідомлень == + +user -> cabinet: Перехід на вкладку \n'Повідомлення' +activate cabinet + cabinet -> kong: Запит даних \nПараметри: \nІдентифікатор сесії Kong + activate kong + kong -> kong: Перевірка сесії + kong -> inbox_message_service: Запит даних \n**GET /api/notifications/inbox \nПараметри: X-Access-Token + activate inbox_message_service + inbox_message_service -> inbox_db: Запит до БД на отримання \nповідомлень за + inbox_db --> inbox_message_service: Результат запиту + deactivate inbox_message_service + inbox_message_service --> kong + deactivate kong + kong --> cabinet +deactivate cabinet +cabinet --> user: Відображення скорочених \nповідомлень на сторінці + +== Читання користувачем повідомлення == + +user -> cabinet: Натискає "Показати повне повідомлення" +activate cabinet + cabinet --> user: Відображення повного повідомлення + cabinet -> kong: Запит даних \nПараметри: \nІдентифікатор сесії Kong + activate kong + kong -> kong: Перевірка сесії + kong -> inbox_message_service: Запит на маркування повідомлення як прочитаного \n**POST /api/notifications/inbox/{id}/ack \nПараметри: X-Access-Token + activate inbox_message_service + inbox_message_service -> inbox_db: Запит до БД на \nоновлення повідомлення + inbox_db --> inbox_message_service: Результат запиту + deactivate inbox_message_service + inbox_message_service --> kong + deactivate kong + kong --> cabinet +deactivate cabinet +cabinet --> user: Повідомлення перестає \nвідображатись як 'Нове' + +@enduml \ No newline at end of file diff --git a/docs/en/modules/arch/partials/architecture/registry/operational/notifications/inbox/inbox-notification-save-flow.puml b/docs/en/modules/arch/partials/architecture/registry/operational/notifications/inbox/inbox-notification-save-flow.puml new file mode 100644 index 0000000000..a275774700 --- /dev/null +++ b/docs/en/modules/arch/partials/architecture/registry/operational/notifications/inbox/inbox-notification-save-flow.puml @@ -0,0 +1,91 @@ +@startuml +skinparam shadowing false +skinparam DatabaseBackgroundColor white +skinparam DatabaseBorderColor #2688d4 +skinparam QueueBackgroundColor white +skinparam QueueBorderColor #2688d4 +skinparam NoteBackgroundColor white +skinparam NoteBorderColor #2688d4 +skinparam sequence { + ArrowColor #2688d4 + ActorBorderColor #2688d4 + LifeLineBorderColor #2688d4 + ParticipantBorderColor #2688d4 + ParticipantBackgroundColor white + BoxBorderColor #2688d4 + BoxBackgroundColor white +} + +queue "'inbox-notifications-channel'\n Kafka Topic" as inbox_notifications_channel_kafka_topic + +box "Сервіс відправки повідомлень" + participant "Inbox Event \nSubscriber" as notification_kafka_subscriber + participant "Inbox Notification \nService" as inbox_notification_service + participant "Audit Service" as audit_service +end box + +queue "'audit-events'\n Kafka Topic" as audit_events_kafka_topic + +queue "'inbox-notifications-channel.DLT'\n Kafka Topic" as inbox_notifications_channel_dlt_kafka_topic + +database "Сховище inbox повідомлень" as inbox_db + +alt Відправка повідомлення (вдалий кейс) +loop Виконання N спроб на відправку згідно налаштувань у разі помилки обробки повідомлення +notification_kafka_subscriber -> inbox_notifications_channel_kafka_topic: Зчитування події +note left + { + "context": { + "system": "Low-code Platform", + "application": "", + "businessProcess": "", + "businessProcessDefinitionId": "", + "businessProcessInstanceId": "", + "businessActivity": "", + "businessActivityInstanceId": "" + }, + "notification": { + "subject": "", + "message": "" + }, + "recipient": { + "id": "Ідентифікатор користувача в системі" + } + } + end note +activate notification_kafka_subscriber +notification_kafka_subscriber -> notification_kafka_subscriber: Підготовка повідомлення \nдо збереження в БД +notification_kafka_subscriber -> inbox_notification_service: Збереження in-app повідомлення +inbox_notification_service -> inbox_db: Збереження повідомлення до БД +inbox_db --> inbox_notification_service: Результат збереження +inbox_notification_service --> notification_kafka_subscriber + alt Помилка при збереженні + notification_kafka_subscriber --> inbox_notifications_channel_kafka_topic + end +end + notification_kafka_subscriber -> notification_kafka_subscriber: Формування події аудиту + notification_kafka_subscriber -> audit_service: Фіксація події аудиту **SEND_USER_NOTIFICATION** (success) + note left + { + "notification": { + "channel:": "inbox", + "subject": "<Заголовок повідомлення>", + "message": "<Повідомлення>", + "recipient": { + "id": "<Ідентифікатор користувача>" + } + } + } + end note + audit_service -> audit_events_kafka_topic: Публікація події аудиту + audit_events_kafka_topic --> audit_service + audit_service --> notification_kafka_subscriber + notification_kafka_subscriber --> inbox_notifications_channel_kafka_topic: Подію опрацьовано + +else Повідомлення не відправлено + notification_kafka_subscriber -> inbox_notifications_channel_dlt_kafka_topic: Публікації події в Dead Letter Topic + inbox_notifications_channel_dlt_kafka_topic --> notification_kafka_subscriber + notification_kafka_subscriber --> inbox_notifications_channel_kafka_topic: Подію опрацьовано +end +deactivate notification_kafka_subscriber +@enduml \ No newline at end of file diff --git a/docs/en/modules/arch/partials/architecture/registry/operational/notifications/nav.adoc b/docs/en/modules/arch/partials/architecture/registry/operational/notifications/nav.adoc index 654c1ad593..889fb321f3 100644 --- a/docs/en/modules/arch/partials/architecture/registry/operational/notifications/nav.adoc +++ b/docs/en/modules/arch/partials/architecture/registry/operational/notifications/nav.adoc @@ -1,14 +1,14 @@ -***** xref:arch:architecture/registry/operational/notifications/overview.adoc[Підсистема нотифікацій користувачів] -****** xref:arch:architecture/registry/operational/notifications/notifications-db.adoc[] -****** Еволюція підсистеми -******* xref:arch:architecture/registry/operational/notifications/notifications-overview.adoc[Відправлення повідомлень користувачам] -******** xref:arch:architecture/registry/operational/notifications/notifications-design.adoc[Технічний дизайн рішення] -********* xref:arch:architecture/registry/operational/notifications/notification-service-design.adoc[Низькорівневий дизайн сервісу повідомлень] -********* xref:arch:architecture/registry/operational/notifications/notifications-integration.adoc[Інтеграція механізмів відправлення повідомлень] -********* xref:arch:architecture/registry/operational/notifications/notifications-api.adoc[API управління повідомленнями] -********* xref:arch:architecture/registry/operational/notifications/notifications-database-schema.adoc[Фізична модель зберігання даних] -********* xref:arch:architecture/registry/operational/notifications/notifications-audit.adoc[Аудит та журналювання подій] -******** xref:arch:architecture/registry/operational/notifications/notifications-channels-configuration.adoc[Налаштування каналів зв'язку реєстру] -******** xref:arch:architecture/registry/operational/notifications/notifications-modelling.adoc[Моделювання регламенту реєстру] -******** xref:arch:architecture/registry/operational/notifications/notifications-migration.adoc[Міграція даних при оновленні реєстру] -******** xref:arch:architecture/registry/operational/notifications/diia-notifications-api.adoc[API відправки push-нотифікацій у мобільний додаток "Дія"] \ No newline at end of file +***** xref:arch:architecture/registry/operational/notifications/overview.adoc[User notification subsystem] +****** xref:arch:architecture/registry/operational/notifications/notifications-db.adoc[Notifications operational database] +****** Subsystem evolution +******* xref:arch:architecture/registry/operational/notifications/notifications-overview.adoc[Sending messages to users] +******** xref:arch:architecture/registry/operational/notifications/notifications-design.adoc[Technical solution design] +********* xref:arch:architecture/registry/operational/notifications/notification-service-design.adoc[User notification service] +********* xref:arch:architecture/registry/operational/notifications/notifications-integration.adoc[Integrating with notification service] +********* xref:arch:architecture/registry/operational/notifications/notifications-api.adoc[API notification management] +********* xref:arch:architecture/registry/operational/notifications/notifications-database-schema.adoc[Physical model for data storage] +********* xref:arch:architecture/registry/operational/notifications/notifications-audit.adoc[Auditing and event logging] +//******** xref:arch:architecture/registry/operational/notifications/notifications-channels-configuration.adoc[Налаштування каналів зв'язку реєстру] +******** xref:arch:architecture/registry/operational/notifications/notifications-modelling.adoc[Registry regulations modeling] +******** xref:arch:architecture/registry/operational/notifications/notifications-migration.adoc[Migrating data during the registry update] +//******** xref:arch:architecture/registry/operational/notifications/diia-notifications-api.adoc[API відправки push-нотифікацій у мобільний додаток "Дія"] \ No newline at end of file diff --git a/docs/en/modules/arch/partials/architecture/registry/operational/portals/nav.adoc b/docs/en/modules/arch/partials/architecture/registry/operational/portals/nav.adoc index b67bc6c6a2..9f0dba898b 100644 --- a/docs/en/modules/arch/partials/architecture/registry/operational/portals/nav.adoc +++ b/docs/en/modules/arch/partials/architecture/registry/operational/portals/nav.adoc @@ -1,4 +1,4 @@ -***** xref:arch:architecture/registry/operational/portals/overview.adoc[Підсистема кабінетів користувачів] -****** Клієнтські додатки підсистеми -include::arch:partial$architecture/registry/operational/portals/services/officer-portal/nav.adoc[] -include::arch:partial$architecture/registry/operational/portals/services/citizen-portal/nav.adoc[] \ No newline at end of file +***** xref:arch:architecture/registry/operational/portals/overview.adoc[User portals subsystem] +//****** Клієнтські додатки підсистеми +//include::arch:partial$architecture/registry/operational/portals/services/officer-portal/nav.adoc[] +//include::arch:partial$architecture/registry/operational/portals/services/citizen-portal/nav.adoc[] \ No newline at end of file diff --git a/docs/en/modules/arch/partials/architecture/registry/operational/registry-management/nav.adoc b/docs/en/modules/arch/partials/architecture/registry/operational/registry-management/nav.adoc index b4a43e223a..17a0040e0e 100644 --- a/docs/en/modules/arch/partials/architecture/registry/operational/registry-management/nav.adoc +++ b/docs/en/modules/arch/partials/architecture/registry/operational/registry-management/nav.adoc @@ -1,17 +1,17 @@ -***** xref:arch:architecture/registry/operational/registry-management/overview.adoc[Підсистема управління даними реєстру] -****** xref:arch:architecture/registry/operational/registry-management/ceph-storage.adoc[Об'єктне сховище даних] -****** xref:arch:architecture/registry/operational/registry-management/registry-db.adoc[] -****** Еволюція підсистеми -******* xref:arch:architecture/registry/operational/registry-management/file-upload.adoc[Збереження файлів] -******* xref:arch:architecture/registry/operational/registry-management/personal-data.adoc[Робота з персональними даними] -******* xref:arch:architecture/registry/operational/registry-management/rbac.adoc[Розмежування прав доступу до даних] -******* xref:arch:architecture/registry/operational/registry-management/versioning.adoc[Версіонування сервісів] -******* xref:arch:architecture/registry/operational/registry-management/sc-pagination-count.adoc[Повернення інформації про загальну кількість записів при пагінації критеріїв пошуку] -******* xref:arch:architecture/registry/operational/registry-management/modify-bulk-load.adoc[Зміна налаштувань поведінки API які вказуються на рівні структури створення таблиці] -******* xref:arch:architecture/registry/operational/registry-management/platform-evolution/public-api/public-api.adoc[Публічний API та рейт-ліміти на читання даних реєстру] -******* xref:arch:architecture/registry/operational/registry-management/platform-evolution/async-load/async-load.adoc[Асинхронне завантаження даних] -******* xref:arch:architecture/registry/operational/registry-management/platform-evolution/sc-post-migration/sc-post-migration.adoc[Додавання генерації POST-методів для пошуку даних] -****** Сервіси підсистеми -include::arch:partial$architecture/registry/operational/registry-management/services/rest-api/nav.adoc[] -include::arch:partial$architecture/registry/operational/registry-management/services/kafka-api/nav.adoc[] -include::arch:partial$architecture/registry/operational/registry-management/services/data-model/nav.adoc[] \ No newline at end of file +***** xref:arch:architecture/registry/operational/registry-management/overview.adoc[Registry data management subsystem] +****** xref:arch:architecture/registry/operational/registry-management/ceph-storage.adoc[Object data storage] +****** xref:arch:architecture/registry/operational/registry-management/registry-db.adoc[Registry operational database] +****** Subsystem evolution +******* xref:arch:architecture/registry/operational/registry-management/file-upload.adoc[Uploading files] +//******* xref:arch:architecture/registry/operational/registry-management/personal-data.adoc[Робота з персональними даними] +//******* xref:arch:architecture/registry/operational/registry-management/rbac.adoc[Розмежування прав доступу до даних] +//******* xref:arch:architecture/registry/operational/registry-management/versioning.adoc[Версіонування сервісів] +******* xref:arch:architecture/registry/operational/registry-management/sc-pagination-count.adoc[Returning total record count with paginating search criteria] +******* xref:arch:architecture/registry/operational/registry-management/modify-bulk-load.adoc[Modifying API behavior settings at the table creation level] +******* xref:arch:architecture/registry/operational/registry-management/platform-evolution/public-api/public-api.adoc[Public API and rate limits for reading registry data] +******* xref:arch:architecture/registry/operational/registry-management/platform-evolution/async-load/async-load.adoc[Asynchronous data loading] +******* xref:arch:architecture/registry/operational/registry-management/platform-evolution/sc-post-migration/sc-post-migration.adoc[Adding POST methods generation for data retrieval] +//****** Subsystem services +//include::arch:partial$architecture/registry/operational/registry-management/services/rest-api/nav.adoc[] +//include::arch:partial$architecture/registry/operational/registry-management/services/kafka-api/nav.adoc[] +//include::arch:partial$architecture/registry/operational/registry-management/services/data-model/nav.adoc[] \ No newline at end of file diff --git a/docs/en/modules/arch/partials/architecture/registry/operational/relational-data-storage/nav.adoc b/docs/en/modules/arch/partials/architecture/registry/operational/relational-data-storage/nav.adoc index 6669260063..e6f48fb1be 100644 --- a/docs/en/modules/arch/partials/architecture/registry/operational/relational-data-storage/nav.adoc +++ b/docs/en/modules/arch/partials/architecture/registry/operational/relational-data-storage/nav.adoc @@ -1,10 +1,10 @@ -***** xref:arch:architecture/registry/operational/relational-data-storage/overview.adoc[Підсистема управління реляційними базами даних] -****** xref:arch:architecture/registry/operational/relational-data-storage/rdbms-analytical-workload.adoc[Обробка аналітичних запитів] -****** xref:arch:architecture/registry/operational/relational-data-storage/rdbms-gis.adoc[Географічні об'єкти та геолокаційні запити] -****** xref:arch:architecture/registry/operational/relational-data-storage/rdbms-user-schema-management.adoc[Керування користувачами та схемами БД] -******* xref:arch:architecture/registry/operational/relational-data-storage/db-roles.adoc[Користувачі баз даних та їх привілеї] -******* xref:arch:architecture/registry/operational/relational-data-storage/databases.adoc[Бази даних] -****** xref:arch:architecture/registry/operational/relational-data-storage/rdbms-horizontal-scaling.adoc[Горизонтальне масштабування] -****** xref:arch:architecture/registry/operational/relational-data-storage/rdbms-backup-recovery.adoc[Резервне копіювання та відновлення] +***** xref:arch:architecture/registry/operational/relational-data-storage/overview.adoc[Relational database management subsystem] +****** xref:arch:architecture/registry/operational/relational-data-storage/rdbms-analytical-workload.adoc[Processing analytical requests] +****** xref:arch:architecture/registry/operational/relational-data-storage/rdbms-gis.adoc[Geographic objects and geolocation queries] +****** xref:arch:architecture/registry/operational/relational-data-storage/rdbms-user-schema-management.adoc[Managing database users and schemas] +******* xref:arch:architecture/registry/operational/relational-data-storage/db-roles.adoc[Registry database users and privileges] +******* xref:arch:architecture/registry/operational/relational-data-storage/databases.adoc[Databases] +****** xref:arch:architecture/registry/operational/relational-data-storage/rdbms-horizontal-scaling.adoc[Horizontal scaling] +****** xref:arch:architecture/registry/operational/relational-data-storage/rdbms-backup-recovery.adoc[Backup and recovery] //****** Журналювання //****** Конфігурація diff --git a/docs/en/modules/arch/partials/architecture/registry/operational/reporting/nav.adoc b/docs/en/modules/arch/partials/architecture/registry/operational/reporting/nav.adoc index 5723152228..b7f2b7f4a7 100644 --- a/docs/en/modules/arch/partials/architecture/registry/operational/reporting/nav.adoc +++ b/docs/en/modules/arch/partials/architecture/registry/operational/reporting/nav.adoc @@ -1,3 +1,3 @@ -***** xref:arch:architecture/registry/operational/reporting/overview.adoc[Підсистема аналітичної звітності реєстру] -****** Еволюція підсистеми -******* xref:arch:architecture/registry/operational/reporting/kong-redash.adoc[Розміщення сервіса публікування аналітичної звітності Redash за Kong] \ No newline at end of file +***** xref:arch:architecture/registry/operational/reporting/overview.adoc[Registry analytical reporting subsystem] +****** Subsystem evolution +******* xref:arch:architecture/registry/operational/reporting/kong-redash.adoc[Placing the Redash analytical reporting service downstream of Kong] \ No newline at end of file diff --git a/docs/en/modules/arch/partials/architecture/registry/operational/user-settings/nav.adoc b/docs/en/modules/arch/partials/architecture/registry/operational/user-settings/nav.adoc index d4d588cb11..342e5eaeaa 100644 --- a/docs/en/modules/arch/partials/architecture/registry/operational/user-settings/nav.adoc +++ b/docs/en/modules/arch/partials/architecture/registry/operational/user-settings/nav.adoc @@ -1,7 +1,7 @@ -***** xref:arch:architecture/registry/operational/user-settings/overview.adoc[Підсистема управління налаштуваннями користувачів] -****** xref:arch:architecture/registry/operational/user-settings/redis-storage.adoc[Нереляційне сховище даних] -****** xref:arch:architecture/registry/operational/user-settings/settings-db.adoc[] -****** Еволюція підсистеми -******* xref:arch:architecture/registry/operational/user-settings/user-settings.adoc[Управління налаштуваннями користувача] -******* xref:arch:architecture/registry/operational/user-settings/user-channel-settings.adoc[Управління каналами зв'язку користувача] -******* xref:arch:architecture/registry/operational/user-settings/user-contact-confirmation.adoc[Підтвердження каналу зв`язку з користувачем] \ No newline at end of file +***** xref:arch:architecture/registry/operational/user-settings/overview.adoc[User settings management subsystem] +****** xref:arch:architecture/registry/operational/user-settings/redis-storage.adoc[Non-relational data storage] +****** xref:arch:architecture/registry/operational/user-settings/settings-db.adoc[User settings operational database] +****** Subsystem evolution +******* xref:arch:architecture/registry/operational/user-settings/user-settings.adoc[User settings management] +//******* xref:arch:architecture/registry/operational/user-settings/user-channel-settings.adoc[Управління каналами зв'язку користувача] +//******* xref:arch:architecture/registry/operational/user-settings/user-contact-confirmation.adoc[Підтвердження каналу зв`язку з користувачем] \ No newline at end of file diff --git a/docs/en/modules/platform-develop/images/platform-prod-deployment/platform-prod-deploy-resources-1.png b/docs/en/modules/platform-develop/images/platform-prod-deployment/platform-prod-deploy-resources-1.png new file mode 100644 index 0000000000..9a249945ff Binary files /dev/null and b/docs/en/modules/platform-develop/images/platform-prod-deployment/platform-prod-deploy-resources-1.png differ diff --git a/docs/en/modules/platform-develop/images/platform-prod-deployment/platform-prod-deploy-resources.png b/docs/en/modules/platform-develop/images/platform-prod-deployment/platform-prod-deploy-resources.png new file mode 100644 index 0000000000..79578a251c Binary files /dev/null and b/docs/en/modules/platform-develop/images/platform-prod-deployment/platform-prod-deploy-resources.png differ diff --git a/docs/en/modules/registry-develop/attachments/data-model/sc/pagination/swagger-offset.yml b/docs/en/modules/registry-develop/attachments/data-model/sc/pagination/swagger-offset.yml new file mode 100644 index 0000000000..65d10fee92 --- /dev/null +++ b/docs/en/modules/registry-develop/attachments/data-model/sc/pagination/swagger-offset.yml @@ -0,0 +1,109 @@ +openapi: 3.0.1 +info: + title: OpenAPI definition + version: v0 +servers: + - url: https://registry-rest-api.projects.epam.com + description: Generated server url +paths: + "/get-requests-by-search-param-offset": + get: + tags: + - get-requests-by-search-param-search-controller + summary: отримати список ресурсів + description: Використовується для отримання об'єктів. Не змінює стан ресурсу + operationId: search_29 + parameters: + - name: searchConditions + in: query + required: true + schema: + "$ref": "#/components/schemas/GetRequestsBySearchParamOffsetSearchConditions" + - name: X-Access-Token + in: header + required: false + schema: + type: string + - name: X-Digital-Signature + in: header + required: false + schema: + type: string + - name: X-Digital-Signature-Derived + in: header + required: false + schema: + type: string + - name: X-Source-System + in: header + required: false + schema: + type: string + - name: X-Source-Application + in: header + required: false + schema: + type: string + - name: X-Source-Business-Process + in: header + required: false + schema: + type: string + - name: X-Source-Business-Process-Definition-Id + in: header + required: false + schema: + type: string + - name: X-Source-Business-Process-Instance-Id + in: header + required: false + schema: + type: string + - name: X-Source-Business-Activity + in: header + required: false + schema: + type: string + - name: X-Source-Business-Activity-Instance-Id + in: header + required: false + schema: + type: string + responses: + '200': + description: OK з результатом + content: + "*/*": + schema: + type: array + items: + "$ref": "#/components/schemas/GetRequestsBySearchParamOffsetSearchConditionResponse" + '400': + description: Некоректні вхідні дані (наприклад, неправильний тип поля) + '401': + description: Помилка аутентифікації (відсутній токен або цифровий підпис) + '500': + description: Внутрішня помилка сервера + '501': + description: Не імплементовано (використовується для заглушок) +components: + schemas: + GetRequestsBySearchParamOffsetSearchConditions: + type: object + properties: + offset: + type: integer + format: int32 + limit: + type: integer + format: int32 + GetRequestsBySearchParamOffsetSearchConditionResponse: + type: object + properties: + searchParam: + type: string + requestBySearchParamId: + type: string + format: uuid + name: + type: string \ No newline at end of file diff --git a/docs/en/modules/registry-develop/attachments/data-model/sc/pagination/swagger-page.yml b/docs/en/modules/registry-develop/attachments/data-model/sc/pagination/swagger-page.yml new file mode 100644 index 0000000000..4fbd2dee49 --- /dev/null +++ b/docs/en/modules/registry-develop/attachments/data-model/sc/pagination/swagger-page.yml @@ -0,0 +1,126 @@ +openapi: 3.0.1 +info: + title: OpenAPI definition + version: v0 +servers: + - url: https://registry-rest-api.projects.epam.com + description: Generated server url +paths: + /get-requests-by-search-param-page: + get: + tags: + - get-requests-by-search-param-search-controller + summary: отримати список ресурсів + description: Використовується для отримання об’єктів. Не змінює стан ресурсу + operationId: search + parameters: + - name: searchConditions + in: query + required: true + schema: + $ref: '#/components/schemas/GetRequestsBySearchParamPageSearchConditions' + - name: X-Access-Token + in: header + required: false + schema: + type: string + - name: X-Digital-Signature + in: header + required: false + schema: + type: string + - name: X-Digital-Signature-Derived + in: header + required: false + schema: + type: string + - name: X-Source-System + in: header + required: false + schema: + type: string + - name: X-Source-Application + in: header + required: false + schema: + type: string + - name: X-Source-Business-Process + in: header + required: false + schema: + type: string + - name: X-Source-Business-Process-Definition-Id + in: header + required: false + schema: + type: string + - name: X-Source-Business-Process-Instance-Id + in: header + required: false + schema: + type: string + - name: X-Source-Business-Activity + in: header + required: false + schema: + type: string + - name: X-Source-Business-Activity-Instance-Id + in: header + required: false + schema: + type: string + responses: + '200': + description: OK з результатом + content: + application/json: + schema: + $ref: '#/components/schemas/GetRequestsBySearchParamPageSearchConditionResponse' + '400': + description: Некоректні вхідні дані (наприклад, неправильний тип поля) + '401': + description: Помилка аутентифікації (відсутній токен або цифровий підпис) + '500': + description: Внутрішня помилка сервера + '501': + description: Не імплементовано (використовується для заглушок) +components: + schemas: + GetRequestsBySearchParamPageSearchConditions: + type: object + properties: + pageSize: + type: integer + format: int32 + pageNo: + type: integer + format: int32 + GetRequestsBySearchParamPageSearchConditionResponse: + type: object + properties: + content: + type: array + items: + $ref: '#/components/schemas/ExampleDataResponse' + totalElements: + type: integer + format: int32 + totalPages: + type: integer + format: int32 + pageNo: + type: integer + format: int32 + pageSize: + type: integer + format: int32 + ExampleDataResponse: + type: object + properties: + searchParam: + type: string + requestBySearchParamId: + type: string + format: uuid + name: + type: string \ No newline at end of file diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/alternative-branches/alternative-branches-1.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/alternative-branches/alternative-branches-1.png index 80a56a2a9b..10240a4407 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/alternative-branches/alternative-branches-1.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/alternative-branches/alternative-branches-1.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/alternative-branches/alternative-branches-2.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/alternative-branches/alternative-branches-2.png index 4d9280aa4a..ef6581547b 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/alternative-branches/alternative-branches-2.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/alternative-branches/alternative-branches-2.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/alternative-branches/alternative-branches-3.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/alternative-branches/alternative-branches-3.png index 11ff8a5307..e5dd775ca9 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/alternative-branches/alternative-branches-3.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/alternative-branches/alternative-branches-3.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/alternative-branches/alternative-branches-4.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/alternative-branches/alternative-branches-4.png index 93e4147a42..352f9d80a9 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/alternative-branches/alternative-branches-4.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/alternative-branches/alternative-branches-4.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/alternative-branches/alternative-branches-5.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/alternative-branches/alternative-branches-5.png index 6d88827e7c..86f6c91a2a 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/alternative-branches/alternative-branches-5.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/alternative-branches/alternative-branches-5.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/element-temp/bp-element-temp-01.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/element-temp/bp-element-temp-01.png new file mode 100644 index 0000000000..d8bd3f54cd Binary files /dev/null and b/docs/en/modules/registry-develop/images/bp-modeling/bp/element-temp/bp-element-temp-01.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/element-temp/bp-element-temp-05.jpg b/docs/en/modules/registry-develop/images/bp-modeling/bp/element-temp/bp-element-temp-05.jpg new file mode 100644 index 0000000000..1292f98a8a Binary files /dev/null and b/docs/en/modules/registry-develop/images/bp-modeling/bp/element-temp/bp-element-temp-05.jpg differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/element-temp/element-temp-install-bpmnlint.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/element-temp/element-temp-install-bpmnlint.png new file mode 100644 index 0000000000..3e5ebae084 Binary files /dev/null and b/docs/en/modules/registry-develop/images/bp-modeling/bp/element-temp/element-temp-install-bpmnlint.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/element-temp/element-temp-turn-on-bpmnlint.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/element-temp/element-temp-turn-on-bpmnlint.png new file mode 100644 index 0000000000..8ff2fda9fd Binary files /dev/null and b/docs/en/modules/registry-develop/images/bp-modeling/bp/element-temp/element-temp-turn-on-bpmnlint.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_1.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_1.png index 3c2d6e9fea..8ac7f4e10a 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_1.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_1.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_10.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_10.png index 636dc6d79d..aa1f4ef486 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_10.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_10.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_11.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_11.png index 830184c7f5..765326dafe 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_11.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_11.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_12.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_12.png index 710de3dcd3..396329d039 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_12.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_12.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_13.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_13.png index 9fc05dc2df..00c3b18556 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_13.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_13.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_14.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_14.png index 4b00bdca0a..68281e376f 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_14.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_14.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_15.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_15.png index ee512c6d0e..5d23144cdd 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_15.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_15.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_16.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_16.png index d53d7fb595..fdf94278fd 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_16.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_16.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_17.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_17.png index a2fee61f66..d8818bce92 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_17.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_17.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_18.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_18.png index 6b2f08acd7..e842ba0604 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_18.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_18.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_19.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_19.png index ef45a89d26..abfae6c372 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_19.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_19.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_2.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_2.png index b4436efdd0..e93a016ccc 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_2.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_2.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_20.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_20.png index feae0e644e..4b6156a733 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_20.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_20.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_3.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_3.png index 3f5219441f..f3c3b1a12c 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_3.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_3.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_4.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_4.png index 2e4fe86ece..20dad75afb 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_4.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_4.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_5.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_5.png index c388730450..f327cadb19 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_5.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_5.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_6.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_6.png index a849fd5cb6..2981c84f7f 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_6.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_6.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_7.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_7.png index 82e5ba50a7..6d32789fdc 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_7.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_7.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_8.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_8.png index 766895a37d..6ae00f8d9c 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_8.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_8.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_9.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_9.png index 0903d880b2..f5f8cb2031 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_9.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/mess1_9.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/message-event-01.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/message-event-01.png index 1102e001d7..11c237366b 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/message-event-01.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/events/message-event/message-event-01.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/events/timer-event/timer-event-01.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/events/timer-event/timer-event-01.png index 190db70344..aea7a9064f 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/events/timer-event/timer-event-01.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/events/timer-event/timer-event-01.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/events/timer-event/timer-event-02.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/events/timer-event/timer-event-02.png index 3abb88f664..27e2e5e639 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/events/timer-event/timer-event-02.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/events/timer-event/timer-event-02.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/events/timer-event/timer-event-03.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/events/timer-event/timer-event-03.png index 2af2704f24..7df7a96819 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/events/timer-event/timer-event-03.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/events/timer-event/timer-event-03.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-01.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-01.png index 54345b4f89..298e7aeb19 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-01.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-01.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-02.1.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-02.1.png index 6cae37a400..0a3e01267c 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-02.1.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-02.1.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-02.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-02.png index 0c712154c4..90cb6f03ef 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-02.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-02.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-03.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-03.png index ac5f861706..8d2f64cfe4 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-03.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-03.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-04.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-04.png index 74fd1a6325..1f125af9f3 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-04.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-04.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-05.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-05.png index a4511f8fdc..027e0b0cc7 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-05.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-05.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-06.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-06.png index 23147c52a3..d582500369 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-06.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-06.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-07.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-07.png index 26945a2f2d..1baa95c58c 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-07.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-07.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-08.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-08.png deleted file mode 100644 index 089a0d33ef..0000000000 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-08.png and /dev/null differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-09.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-09.png index ab3730aa8e..2c346e27f4 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-09.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-09.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-11.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-11.png index 40f323b6b0..f9447f10b8 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-11.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-11.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-12.1.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-12.1.png index 573fdebfaf..ae89641b8d 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-12.1.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-12.1.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-12.2.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-12.2.png index 142293d7e7..c0aad02875 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-12.2.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-12.2.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-13.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-13.png index 1fa3a2f607..125d52a4dd 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-13.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-13.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-14.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-14.png index de773c56b0..5069ab71eb 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-14.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-14.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-15.1.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-15.1.png index d302d9427d..7fc815ea1b 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-15.1.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-15.1.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-15.2.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-15.2.png index c20024b9e8..ac101de88d 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-15.2.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-15.2.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-16.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-16.png index 0ff7361a20..d870cd41cf 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-16.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-16.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-17.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-17.png index 160666d267..c29e30e928 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-17.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-17.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-18.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-18.png index 0b907fb50b..2d5278c808 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-18.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-18.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-19.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-19.png index 777d5235d6..cfc56cd333 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-19.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-19.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-20.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-20.png deleted file mode 100644 index 0e9efafdb8..0000000000 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-20.png and /dev/null differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-21.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-21.png index 5628d577b8..4e28c952d7 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-21.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-21.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-1-1.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-1-1.png index ea91accbd3..953c8ea0d6 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-1-1.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-1-1.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-1.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-1.png index 5f67cf9bc8..6eee3ce7e2 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-1.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-1.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-10.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-10.png index 63522763dd..ecd7efe0ea 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-10.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-10.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-11.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-11.png index cdd80aa773..85a79ff164 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-11.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-11.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-2.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-2.png index 67265b5e7f..adf222eaf8 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-2.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-2.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-3.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-3.png index c2ea13c66a..e4c1b96956 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-3.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-3.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-4.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-4.png index 434d5df51f..0189141f3e 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-4.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-4.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-5.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-5.png index 0f96006856..92cf1e6b35 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-5.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-5.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-6.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-6.png index e3890748fb..51cebad842 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-6.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-6.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-7-1.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-7-1.png index 37bf9c8f9a..87e7c3aaad 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-7-1.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-7-1.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-7-2.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-7-2.png index b6317becd7..e81fe027c7 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-7-2.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-7-2.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-7.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-7.png index 2466db3771..d58d84565c 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-7.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-7.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-8.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-8.png index c580922090..965b9bf2fc 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-8.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-8.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-9.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-9.png index 85ddbc1cf6..e5fc06b3d3 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-9.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-9.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/call-activities/bp-call-activity-01.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/call-activities/bp-call-activity-01.png index a3d77bcaf2..b728662575 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/call-activities/bp-call-activity-01.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/call-activities/bp-call-activity-01.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/call-activities/bp-call-activity-1.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/call-activities/bp-call-activity-1.png index 1f25113d1a..12c43546ba 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/call-activities/bp-call-activity-1.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/call-activities/bp-call-activity-1.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/call-activities/bp-call-activity-10.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/call-activities/bp-call-activity-10.png index ef4de31264..5cf3aa17b9 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/call-activities/bp-call-activity-10.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/call-activities/bp-call-activity-10.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/call-activities/bp-call-activity-11.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/call-activities/bp-call-activity-11.png index 93680221ae..45d4fed437 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/call-activities/bp-call-activity-11.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/call-activities/bp-call-activity-11.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/call-activities/bp-call-activity-12.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/call-activities/bp-call-activity-12.png index ea2bca7dd2..dfd5fec289 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/call-activities/bp-call-activity-12.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/call-activities/bp-call-activity-12.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/call-activities/bp-call-activity-2.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/call-activities/bp-call-activity-2.png index be37b47f84..5c721f222c 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/call-activities/bp-call-activity-2.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/call-activities/bp-call-activity-2.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/call-activities/bp-call-activity-3.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/call-activities/bp-call-activity-3.png index 0880565386..aec9691927 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/call-activities/bp-call-activity-3.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/call-activities/bp-call-activity-3.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/call-activities/bp-call-activity-4.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/call-activities/bp-call-activity-4.png index a23601103d..0ee441931e 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/call-activities/bp-call-activity-4.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/call-activities/bp-call-activity-4.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/call-activities/bp-call-activity-5.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/call-activities/bp-call-activity-5.png index 1bf677df65..1265344833 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/call-activities/bp-call-activity-5.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/call-activities/bp-call-activity-5.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/call-activities/bp-call-activity-6.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/call-activities/bp-call-activity-6.png index d6020230a1..8e02d51510 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/call-activities/bp-call-activity-6.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/call-activities/bp-call-activity-6.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/call-activities/bp-call-activity-7.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/call-activities/bp-call-activity-7.png index 81b8785c00..49ecb20811 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/call-activities/bp-call-activity-7.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/call-activities/bp-call-activity-7.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/call-activities/bp-call-activity-8.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/call-activities/bp-call-activity-8.png index c5e4eedaf7..4b80d4f9bc 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/call-activities/bp-call-activity-8.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/call-activities/bp-call-activity-8.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/call-activities/bp-call-activity-9.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/call-activities/bp-call-activity-9.png index a3c0ac61c7..46afd7ffdb 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/call-activities/bp-call-activity-9.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/call-activities/bp-call-activity-9.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/call-activities/call-activity-same-bpmn.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/call-activities/call-activity-same-bpmn.png index 9bfd21f662..2c35f8e181 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/call-activities/call-activity-same-bpmn.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/call-activities/call-activity-same-bpmn.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/embedded-subprocess/embedded-subprocess-1.png b/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/embedded-subprocess/embedded-subprocess-1.png index 2f1689f340..e9fc9a4c27 100644 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/embedded-subprocess/embedded-subprocess-1.png and b/docs/en/modules/registry-develop/images/bp-modeling/bp/subprocesses/embedded-subprocess/embedded-subprocess-1.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/forms/components/edit-grid/submit-data-as-array/edit-grid-submit-data-as-array-4-en.png b/docs/en/modules/registry-develop/images/bp-modeling/forms/components/edit-grid/submit-data-as-array/edit-grid-submit-data-as-array-4-en.png new file mode 100644 index 0000000000..03f8610bb5 Binary files /dev/null and b/docs/en/modules/registry-develop/images/bp-modeling/forms/components/edit-grid/submit-data-as-array/edit-grid-submit-data-as-array-4-en.png differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/forms/components/edit-grid/submit-data-as-array/edit-grid-submit-data-as-array-4.png b/docs/en/modules/registry-develop/images/bp-modeling/forms/components/edit-grid/submit-data-as-array/edit-grid-submit-data-as-array-4.png deleted file mode 100644 index b79b066795..0000000000 Binary files a/docs/en/modules/registry-develop/images/bp-modeling/forms/components/edit-grid/submit-data-as-array/edit-grid-submit-data-as-array-4.png and /dev/null differ diff --git a/docs/en/modules/registry-develop/images/bp-modeling/forms/components/edit-grid/submit-data-as-array/edit-grid-submit-data-as-array-5-en.png b/docs/en/modules/registry-develop/images/bp-modeling/forms/components/edit-grid/submit-data-as-array/edit-grid-submit-data-as-array-5-en.png new file mode 100644 index 0000000000..017be24357 Binary files /dev/null and b/docs/en/modules/registry-develop/images/bp-modeling/forms/components/edit-grid/submit-data-as-array/edit-grid-submit-data-as-array-5-en.png differ diff --git a/docs/en/modules/registry-develop/images/registry-admin/admin-portal/report-templates/report-templates-download.png b/docs/en/modules/registry-develop/images/registry-admin/admin-portal/report-templates/report-templates-download.png new file mode 100644 index 0000000000..f287cf0ef3 Binary files /dev/null and b/docs/en/modules/registry-develop/images/registry-admin/admin-portal/report-templates/report-templates-download.png differ diff --git a/docs/en/modules/registry-develop/images/registry-admin/admin-portal/report-templates/report-templates-pagination.png b/docs/en/modules/registry-develop/images/registry-admin/admin-portal/report-templates/report-templates-pagination.png new file mode 100644 index 0000000000..3b26c4d061 Binary files /dev/null and b/docs/en/modules/registry-develop/images/registry-admin/admin-portal/report-templates/report-templates-pagination.png differ diff --git a/docs/en/modules/registry-develop/images/registry-admin/admin-portal/report-templates/report-templates-search.png b/docs/en/modules/registry-develop/images/registry-admin/admin-portal/report-templates/report-templates-search.png new file mode 100644 index 0000000000..02a47e7cdc Binary files /dev/null and b/docs/en/modules/registry-develop/images/registry-admin/admin-portal/report-templates/report-templates-search.png differ diff --git a/docs/en/modules/registry-develop/images/registry-admin/admin-portal/report-templates/report-templates-section.png b/docs/en/modules/registry-develop/images/registry-admin/admin-portal/report-templates/report-templates-section.png new file mode 100644 index 0000000000..3586d34957 Binary files /dev/null and b/docs/en/modules/registry-develop/images/registry-admin/admin-portal/report-templates/report-templates-section.png differ diff --git a/docs/en/modules/registry-develop/images/registry-admin/admin-portal/report-templates/report-templates-sort.png b/docs/en/modules/registry-develop/images/registry-admin/admin-portal/report-templates/report-templates-sort.png new file mode 100644 index 0000000000..0fc149dd4b Binary files /dev/null and b/docs/en/modules/registry-develop/images/registry-admin/admin-portal/report-templates/report-templates-sort.png differ diff --git a/docs/en/modules/registry-develop/images/registry-admin/admin-portal/ui-forms/code.png b/docs/en/modules/registry-develop/images/registry-admin/admin-portal/ui-forms/code.png new file mode 100644 index 0000000000..5d137450b1 Binary files /dev/null and b/docs/en/modules/registry-develop/images/registry-admin/admin-portal/ui-forms/code.png differ diff --git a/docs/en/modules/registry-develop/images/registry-admin/admin-portal/ui-forms/constructor.png b/docs/en/modules/registry-develop/images/registry-admin/admin-portal/ui-forms/constructor.png new file mode 100644 index 0000000000..14415cfcc8 Binary files /dev/null and b/docs/en/modules/registry-develop/images/registry-admin/admin-portal/ui-forms/constructor.png differ diff --git a/docs/en/modules/registry-develop/images/registry-admin/admin-portal/ui-forms/main.png b/docs/en/modules/registry-develop/images/registry-admin/admin-portal/ui-forms/main.png new file mode 100644 index 0000000000..2cd9148433 Binary files /dev/null and b/docs/en/modules/registry-develop/images/registry-admin/admin-portal/ui-forms/main.png differ diff --git a/docs/en/modules/registry-develop/images/registry-admin/admin-portal/ui-forms/menu.png b/docs/en/modules/registry-develop/images/registry-admin/admin-portal/ui-forms/menu.png new file mode 100644 index 0000000000..9f19f3356a Binary files /dev/null and b/docs/en/modules/registry-develop/images/registry-admin/admin-portal/ui-forms/menu.png differ diff --git a/docs/en/modules/registry-develop/images/registry-admin/admin-portal/ui-forms/request.png b/docs/en/modules/registry-develop/images/registry-admin/admin-portal/ui-forms/request.png new file mode 100644 index 0000000000..23f0cef033 Binary files /dev/null and b/docs/en/modules/registry-develop/images/registry-admin/admin-portal/ui-forms/request.png differ diff --git a/docs/en/modules/registry-develop/images/registry-admin/admin-portal/ui-forms/uI-forms-2.png b/docs/en/modules/registry-develop/images/registry-admin/admin-portal/ui-forms/ui-forms-2.png similarity index 100% rename from docs/en/modules/registry-develop/images/registry-admin/admin-portal/ui-forms/uI-forms-2.png rename to docs/en/modules/registry-develop/images/registry-admin/admin-portal/ui-forms/ui-forms-2.png diff --git a/docs/en/modules/registry-develop/images/registry-admin/admin-portal/ui-forms/view.png b/docs/en/modules/registry-develop/images/registry-admin/admin-portal/ui-forms/view.png new file mode 100644 index 0000000000..da161f99a4 Binary files /dev/null and b/docs/en/modules/registry-develop/images/registry-admin/admin-portal/ui-forms/view.png differ diff --git a/docs/en/modules/registry-develop/images/registry-admin/api-rate-limits/Kong-Rate-Limits.drawio.png b/docs/en/modules/registry-develop/images/registry-admin/api-rate-limits/Kong-Rate-Limits.drawio.png index 4ed52f6342..56a5e8ff5b 100644 Binary files a/docs/en/modules/registry-develop/images/registry-admin/api-rate-limits/Kong-Rate-Limits.drawio.png and b/docs/en/modules/registry-develop/images/registry-admin/api-rate-limits/Kong-Rate-Limits.drawio.png differ diff --git a/docs/en/modules/registry-develop/images/registry-admin/api-rate-limits/Rate-limit-configuration.drawio.png b/docs/en/modules/registry-develop/images/registry-admin/api-rate-limits/Rate-limit-configuration.drawio.png index f43b0c611e..0376533fd4 100644 Binary files a/docs/en/modules/registry-develop/images/registry-admin/api-rate-limits/Rate-limit-configuration.drawio.png and b/docs/en/modules/registry-develop/images/registry-admin/api-rate-limits/Rate-limit-configuration.drawio.png differ diff --git a/docs/en/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-1.png b/docs/en/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-1.png new file mode 100644 index 0000000000..d27d026891 Binary files /dev/null and b/docs/en/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-1.png differ diff --git a/docs/en/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-10.png b/docs/en/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-10.png new file mode 100644 index 0000000000..6f856b421c Binary files /dev/null and b/docs/en/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-10.png differ diff --git a/docs/en/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-11-1.png b/docs/en/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-11-1.png new file mode 100644 index 0000000000..6202df1ed9 Binary files /dev/null and b/docs/en/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-11-1.png differ diff --git a/docs/en/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-11-2.png b/docs/en/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-11-2.png new file mode 100644 index 0000000000..cbbcebab13 Binary files /dev/null and b/docs/en/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-11-2.png differ diff --git a/docs/en/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-11.png b/docs/en/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-11.png new file mode 100644 index 0000000000..c5998ec3aa Binary files /dev/null and b/docs/en/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-11.png differ diff --git a/docs/en/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-2.png b/docs/en/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-2.png new file mode 100644 index 0000000000..acb630343f Binary files /dev/null and b/docs/en/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-2.png differ diff --git a/docs/en/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-3.png b/docs/en/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-3.png new file mode 100644 index 0000000000..8288c3817f Binary files /dev/null and b/docs/en/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-3.png differ diff --git a/docs/en/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-4.png b/docs/en/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-4.png new file mode 100644 index 0000000000..17beb947d9 Binary files /dev/null and b/docs/en/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-4.png differ diff --git a/docs/en/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-5.png b/docs/en/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-5.png new file mode 100644 index 0000000000..2b6c612fff Binary files /dev/null and b/docs/en/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-5.png differ diff --git a/docs/en/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-6-1.png b/docs/en/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-6-1.png new file mode 100644 index 0000000000..13aafa0fe9 Binary files /dev/null and b/docs/en/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-6-1.png differ diff --git a/docs/en/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-6.png b/docs/en/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-6.png new file mode 100644 index 0000000000..1129a2eeed Binary files /dev/null and b/docs/en/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-6.png differ diff --git a/docs/en/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-7-1.png b/docs/en/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-7-1.png new file mode 100644 index 0000000000..73183786c2 Binary files /dev/null and b/docs/en/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-7-1.png differ diff --git a/docs/en/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-7-2.png b/docs/en/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-7-2.png new file mode 100644 index 0000000000..f9e19611b3 Binary files /dev/null and b/docs/en/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-7-2.png differ diff --git a/docs/en/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-7.png b/docs/en/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-7.png new file mode 100644 index 0000000000..cda969b13d Binary files /dev/null and b/docs/en/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-7.png differ diff --git a/docs/en/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-8.png b/docs/en/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-8.png new file mode 100644 index 0000000000..a885fcd65d Binary files /dev/null and b/docs/en/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-8.png differ diff --git a/docs/en/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-9.png b/docs/en/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-9.png new file mode 100644 index 0000000000..3a4e902790 Binary files /dev/null and b/docs/en/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-9.png differ diff --git a/docs/en/modules/registry-develop/images/registry-admin/external-integration/rest-api-no-trembita/int-reg-ext-system.png b/docs/en/modules/registry-develop/images/registry-admin/external-integration/rest-api-no-trembita/int-reg-ext-system.png index 8574ffdee8..3a6912f30c 100644 Binary files a/docs/en/modules/registry-develop/images/registry-admin/external-integration/rest-api-no-trembita/int-reg-ext-system.png and b/docs/en/modules/registry-develop/images/registry-admin/external-integration/rest-api-no-trembita/int-reg-ext-system.png differ diff --git a/docs/en/modules/registry-develop/images/registry-admin/external-integration/rest-api-no-trembita/internal-registries-platform.png b/docs/en/modules/registry-develop/images/registry-admin/external-integration/rest-api-no-trembita/internal-registries-platform.png index 54d4b034fc..58541336b1 100644 Binary files a/docs/en/modules/registry-develop/images/registry-admin/external-integration/rest-api-no-trembita/internal-registries-platform.png and b/docs/en/modules/registry-develop/images/registry-admin/external-integration/rest-api-no-trembita/internal-registries-platform.png differ diff --git a/docs/en/modules/registry-develop/images/registry-admin/import-users(officer)/import-users(officer).jpg b/docs/en/modules/registry-develop/images/registry-admin/import-users(officer)/import-users(officer).jpg deleted file mode 100644 index 8c68bd0f19..0000000000 Binary files a/docs/en/modules/registry-develop/images/registry-admin/import-users(officer)/import-users(officer).jpg and /dev/null differ diff --git a/docs/en/modules/registry-develop/images/registry-admin/import-users(officer)/import-users-officer.svg b/docs/en/modules/registry-develop/images/registry-admin/import-users(officer)/import-users-officer.svg new file mode 100644 index 0000000000..c76b80b7dd --- /dev/null +++ b/docs/en/modules/registry-develop/images/registry-admin/import-users(officer)/import-users-officer.svg @@ -0,0 +1,4 @@ + + + +
Import users from the file
Import users from the file
The registry regulations administrator performs the business process of importing users via the Administrative Portal
The registry regulations administrator performs the b...
Administrator adds the file with the users
Administrator adds the file with the users
Validating the file
Validating the file
No
No
Yes
Yes
Does format file is *.csv?
Does format file is *.csv?
Error: Invalid file format
Error: Invalid file format
Yes
Yes
No
No
Does the file size NOT exceed 30 MB?
Does the file size NOT exceed 30 MB?
No
No
Yes
Yes
Is the file encoding UTF-8?
Is the file encoding UTF-8?
Error: The file is too large
Error: The file is too large
Error: Invalid encoding file
Error: Invalid encoding file
Validating the file data
Validating the file data
Yes
Yes
No
No
Is there at least one empty 
from the required fields or
the field consists of spaces only or
field has multiple values separated by a comma
instead of one?
Is there at least one empty...
Error about the absence of a mandatory attribute
Error about the absence of a mandatory attr...
Yes
Yes
No
No
Does the field edrpou contain invalid
symbols (not numbers)?
Does the field edrpou contain invalid...
Error about the presence of invalid characters
Error about the presence of invalid charact...
No
No
Yes
Yes


Are the indicated roles in the list of

the available roles in Keycloak?
Are the indicated roles in the list ofthe available r...
Error about the absence of the specified role
Error about the absence of the specified ro...
No
No
Yes
Yes
Is the structure of the file as specified?
Is the structure of the file as specified?
Error about mismatching the
file to the given structure
Error about mismatching the...
No
No
Yes
Yes
Is the User with this 
username and attributes
(drfo, edrpou, fullName)
already exist in Keycloak?
Is the User with this...
No
No
Yes
Yes
Is the User with the following  
username but with other attributes
already exist in Keycloak?
Is the User with the following  username but with oth...
No
No
Yes
Yes
Is the User with the following  
attributes but with different username username
already exist in Keycloak?
Is the User with the following  attributes but with d...
No
No
Yes
Yes
Is a User with the following attributes 
already met before in a CSV file?
Is a User with the following attributes already met b...
Importing users process
Importing users process
The user is skipped, an entry with the corresponding reason is recorded in the Kibana logs (Skipped)
The user is skipped, an entry with the corr...
No
No
Yes
Yes
Is the error occur during the
import process in Keycloak?
Is the error occur during the...
A record of the successful processing of the total number of users is recorded in the Kibana logs (Successfully imported)
A record of the successful processing of the total nu...
User records that have been successfully processed are added to the Keycloak system
User records that have been successfully processed ar...
User import process completed successfully
User import process completed successfully
The user is skipped, an entry with the corresponding reason is recorded in the Kibana logs (Failed to import)
The user is skipped, an entry with the corr...
The records of users with the following errors Failed to import and Skipped are not added to the Keycloak`s database
The records of users with the following err...
Importing users process is not completed
Importing users process is not completed Text is not SVG - cannot display \ No newline at end of file diff --git a/docs/en/modules/registry-develop/images/registry-admin/regulations-deploy/registry-deploy-regulation-05-en.png b/docs/en/modules/registry-develop/images/registry-admin/regulations-deploy/registry-deploy-regulation-05-en.png new file mode 100644 index 0000000000..02936796f3 Binary files /dev/null and b/docs/en/modules/registry-develop/images/registry-admin/regulations-deploy/registry-deploy-regulation-05-en.png differ diff --git a/docs/en/modules/registry-develop/images/registry-admin/regulations-deploy/registry-deploy-regulation-05.png b/docs/en/modules/registry-develop/images/registry-admin/regulations-deploy/registry-deploy-regulation-05.png deleted file mode 100644 index 8b684b8208..0000000000 Binary files a/docs/en/modules/registry-develop/images/registry-admin/regulations-deploy/registry-deploy-regulation-05.png and /dev/null differ diff --git a/docs/en/modules/registry-develop/pages/best-practices/bp-officer-self-register-manual.adoc b/docs/en/modules/registry-develop/pages/best-practices/bp-officer-self-register-manual.adoc index 76fd12cfb4..26c78a39fd 100644 --- a/docs/en/modules/registry-develop/pages/best-practices/bp-officer-self-register-manual.adoc +++ b/docs/en/modules/registry-develop/pages/best-practices/bp-officer-self-register-manual.adoc @@ -3,66 +3,46 @@ include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc include::platform:ROOT:partial$admonitions/language-en.adoc[] -//== Загальний опис == General overview -//Розглянемо опис бізнес-процесу автоматичної реєстрації посадових осіб (надавачів послуг) із ручним підтвердженням даних модератором. -Let us take a look at the business process of automatic registration of Officers (service providers) with manual data verification by a moderator. +Let us take a look at the business process of automatic registration of *Officers* (service providers) with manual data verification by a moderator. -//Бізнес-процес складається з двох пулів, що представляють двох учасників: посадову особу-заявника, яка самореєструється, та модератора, який перевіряє дані. Обмін інформацією між учасниками здійснюється через події повідомлень (*Message events*). The business process consists of two pools representing two participants: the Officer applicant who self-registers and the moderator who verifies the data. Information exchange between participants is carried out through *message events*. -//Заявник вводить особисті дані на формі, які надсилаються модератору для перевірки. Модератор має певний час (_тут -- 2 хвилини_) на прийняття рішення, контрольоване таймером (*Timer boundary event*). Якщо рішення не прийнято вчасно, процес іде за альтернативним потоком та завершується, а користувач не реєструється. -The applicant enters personal data on a form, which is sent to the moderator for verification. The moderator has a specific time frame (_here - 2 minutes_) to make a decision, controlled by a *timer boundary event*. If a decision is not made in time, the process follows an alternative path and terminates, and the user is not registered. +The applicant enters personal data on a form, which is sent to the moderator for verification. The moderator has a specific time frame (_here -- 2 minutes_) to make a decision, controlled by a *timer boundary event*. If a decision is not made in time, the process follows an alternative path and terminates, and the user is not registered. -//У разі позитивного рішення, дані підписуються КЕП і системним ключем, після чого зберігаються до системної таблиці (_тут_ -- `officer`) бази даних реєстру, відповідно до створеної попередньо моделі даних. Інформація про рішення надсилається заявнику через подію повідомлення. Якщо рішення негативне, процес іде за альтернативним потоком, і користувача не реєструють. In case of a positive decision, the data is signed with a qualified electronic signature (QES) and a system key, then stored in the system's database table (_here_ - `officer`) according to the previously created data model. Information about the decision is sent to the applicant through a notification event. If the decision is negative, the process follows an alternative path, and the user is not registered. -//При позитивному рішенні, інформація передається на сервісну задачу із делегатом *Save user roles*, який змінює роль користувача з *`unregistered-officer`* на *`officer`*. Таким чином, користувач реєструється в системі. Upon a positive decision, the information is passed to a service task with the delegate *Save user roles*, which changes the user's role from *`unregistered-officer`* to *`officer`*. Thus, the user is registered in the system. -//Заявник переходить на форму із повідомленням про успішну самореєстрацію та статусом "`Самореєстрацію пройдено`". Після цього заявник перенаправляється на форму для повторного входу в систему. The applicant is redirected to a page confirming successful self-registration with the status `Registration complete`. Afterward, the applicant is redirected to a login page. -//Після повторної автентифікації з роллю *`officer`*, посадова особа отримує доступ до усіх послуг, доступних йому у реєстрі. Зареєстрований користувач з роллю `officer` зможе ініціювати, переглядати, редагувати та надавати послуги відповідно до своїх повноважень та обов'язків у системі. -After re-authentication with the role *`officer`*, the Officer gains access to all services available in the registry. A registered user with the role `officer` can initiate, view, edit, and provide services according to their permissions and duties in the system. +After re-authentication with the role *`officer`*, the Officer gains access to all services available in the registry. A registered user with the role `officer` can initiate, view, edit, and provide services, according to their permissions and duties in the system. -//Таким чином, бізнес-процес автоматичної реєстрації посадових осіб (надавачів послуг) із ручним підтвердженням даних модератором спрощує процес реєстрації, забезпечуючи ефективний контроль з боку модератора та зменшуючи час, потрібний для реєстрації користувачів. In this way, the business process of automatic registration of Officers (service providers) with manual data verification by a moderator streamlines the registration process, ensuring effective control by the moderator and reducing the time required for user registration. -//== Передумови == Prerequisites -//Для того, щоб бізнес-процес самореєстрації запрацював, необхідно виконати передумови, описані нижче. To enable the self-registration business process, the following prerequisites must be met: -//=== Увімкнення опції самореєстрації посадових осіб === Enabling the Officer self-registration option -//Активуйте опцію самореєстрації надавачів послуг в адміністративній панелі Control Plane. Enable the option for Officer self-registration in the Control Plane administrative panel. -//TIP: Детальніше про це -- див. на сторінці TIP: For more details, see xref:registry-admin/cp-auth-setup/cp-officer-self-registration.adoc[]. -//=== Моделювання структур даних === Data structure modeling -//Створіть модель даних реєстру за прикладом нижче. Create a data model for the registry following the example below. [TIP] ==== -//Приклад _.xml_-схеми ви можете знайти у регламенті демо-реєстру *_consent-data_* за посиланням: -//https://admin-tools-consent-data.apps.envone.dev.registry.eua.gov.ua/gerrit. You can find an example .xml schema in the demo registry regulations. -//хема буде доступна за назвою *_tablesOfficers.xml_*. The schema will be available under the name *_tablesOfficers.xml_*. ==== -//._Референтний приклад моделі даних. Таблиці для збереження самореєстрованих користувачів_ ._Reference data model example. Tables for storing self-registered users_ [%collapsible] ==== @@ -96,211 +76,149 @@ The schema will be available under the name *_tablesOfficers.xml_*. ---- ==== -//Ця модель даних створює таблицю *`officers`* у базі даних, яка зберігає інформацію про зареєстрованих користувачів (посадових осіб), які самореєструвалися в системі. This data model creates a table named *`officers`* in the database, which stores information about registered users (Officers) who have self-registered in the system. -//._Опис стовпців таблиці_ ._Description of the table columns_ [%collapsible] ==== -//* *`officers_id`* -- це первинний ключ таблиці з унікальним ідентифікатором кожного посадовця, типом UUID, який автоматично генерується за допомогою функції `uuid_generate_v4()`. + * *`officers_id`*: This is the primary key of the table with a unique identifier for each Officer, using the UUID data type, which is automatically generated using the `uuid_generate_v4()` function. -//* *`user_name`* -- імена користувача з системи Keycloak (система управління ідентифікацією та доступом користувачі). * *`user_name`*: Usernames from the Keycloak system (an identity and user access management system). -//* *`full_name`* -- ПІБ користувача. * *full_name*: Full name of the user. -//* *`drfo`* : РНОКПП користувача (Реєстраційний номер облікової картки платника податків). * *drfo*: Registration number of the taxpayer's account card of the user. * *`edrpou`* : User's number at the Unified state register of enterprises and organizations of Ukraine. [NOTE,caption=UA-specific] The *drfo* and *edrpou* are attributes specific to the Ukrainian implementation and may not apply or function as described in other contexts or regions. Please consult the local guidelines or documentation if you are implementing this outside of Ukraine. -//* *`realm_roles`* -- перелік регламентних ролей користувача. * *realm_roles*: List of user roles in the regulations. -//* *`work_start_date`* -- дата прийняття користувача на роботу. * *work_start_date*: Date of employment. -//* *`unit_name`* -- назва підрозділу відповідно до ієрархії організації. * *`unit_name`*: Name of the unit according to the organization's hierarchy. -//* *`hierarchy_code`* -- сурогатний ключ, складений на основі `structure_code`. * *hierarchy_code*: Surrogate key generated based on the `structure_code`. -//* *`structure_code`* -- унікальний код ієрархії для відповідного підрозділу. * *`structure_code`*: Unique hierarchy code for the corresponding unit. -//* *`selfregistration_decision`* -- булеве значення, що відображає рішення модератора щодо самореєстрації користувача. * *`selfregistration_decision`*: Boolean value reflecting the moderator's decision regarding user self-registration. ==== -//== Референтний приклад процесу == Reference process example [TIP] ==== -//Приклад _.bpmn_-моделі процесу, а також користувацькі _.json_-форми до нього ви можете знайти у регламенті демо-реєстру *_consent-data_* за посиланням: -//https://admin-tools-consent-data.apps.envone.dev.registry.eua.gov.ua/gerrit. You can find an example BPMN model of the process as well as custom JSON forms for it in the demo registry regulations. -//Процес буде доступний за назвою *_officer-selfregistration-handmoderation.bpmn_*. Назви форм ви можете знайти всередині відповідних користувацьких задач бізнес-процесу у полі *`Form key`*. The process will be available under the name *_officer-selfregistration-handmoderation.bpmn_*. You can find the form names within the respective business process tasks in the *`Form key`* field. ==== -//=== Створення пулів для учасників процесу === Creating pools for process participants -//Створіть два пули (Participant) для учасників процесу -- посадової особи-заявника, яка самореєструється, та модератора, який перевіряє дані. Create two pools (Participants) for process participants -- the Officer-applicant who self-registers and the moderator who verifies the data. -//.Пул процесу для посадової особи-заявника, який самореєструється .Pool for the Officer-applicant who self-registers: image::best-practices/officer-auto-register/manual-moderation/officer-self-register-manual-mod-1.png[] -//.Пул процесу для посадової особи-модератора, який перевіряє дані .Pool for the moderator who verifies the data: image::best-practices/officer-auto-register/manual-moderation/officer-self-register-manual-mod-2.png[] -//Вкажіть для кожного наступне: Specify the following for each of the pools: -//* *`Participant Name`* -- назва пулу для процесу. -//* *`Process ID`* -- ідентифікатор процесу в регламенті реєстру. -//* *`Process name`* -- бізнес-назва процесу. -//* Активуйте чекбокс `*Executable*`. * *`Participant Name`*: process pool name * *`Process ID`*: Process identifier in the registry regulations. * *`Process name`*: Business name of the process. * Activate the *`Executable`* checkbox. -//=== Початок процесу === Starting the process -//Змоделюйте стартову подію. Ця подія ініціює автоматичний старт процесу після автентифікації з роллю *`unregistered-officer`*. Model the starting event. This event initiates the automatic start of the process after authentication with the *`unregistered-officer`* role. -//* Вкажіть назву задачі. -//* Вкажіть ініціатора процесу як *`initiator`*. * Specify the task name. * Set the process initiator as *`initiator`*. + [TIP] ==== [%collapsible] -//.Що таке ініціатор? + .What is initiator? ===== -//*`"Start initiator = initiator"`* вказує на те, що значення ініціатора (тобто особи чи системи, яка розпочала процес) буде встановлено як *`initiator`*. + * "*`Start initiator = initiator`*" indicates that the initiator's value (i.e., the person or system that initiated the process) will be set as the *`initiator`*. -//У контексті бізнес-процесів, ініціатор -- це той, хто починає процес або відповідає за його запуск. Зазвичай, ініціатор -- це користувач, який викликає дію, або система, яка автоматично розпочинає процес. In the context of business processes, the initiator is the one who initiates the process or is responsible for its start. Typically, the initiator is a user who triggers an action, or it can be a system that automatically initiates the process. -//У цьому випадку, `initiator` може бути використаний для ідентифікації особи чи системи, що стартували процес, у подальших етапах бізнес-процесу або для контролю доступу до ресурсів. In this case, the `initiator` can be used to identify the person or system that started the process for further stages of the business process or for access control to resources. ===== ==== image:best-practices/officer-auto-register/manual-moderation/officer-self-register-manual-mod-3.png[] -//=== Надсилання даних з токена для підтвердження реєстрації === Sending token data for registration confirmation -//Змоделюйте проміжну подію відправлення повідомлення -- *Message Intermediate Throw Event*. Model an intermediate message throwing event -- *Message Intermediate Throw Event*. -//TIP: Детальніше про *Message Intermediate Throw Event* ви можете переглянути на сторінці xref:bp-modeling/bp/bpmn/events/message-event.adoc#message-intermediate-throw-event[Моделювання та налаштування проміжної події відправки повідомлення]. TIP: For more details about the *Message Intermediate Throw Event*, you can refer to the page on xref:bp-modeling/bp/bpmn/events/message-event.adoc#message-intermediate-throw-event[Modeling and configuring this type of event in the documentation]. -//Ця подія повідомлення являє собою елемент у бізнес-процесі, який відправляє повідомлення з даними (`ПІБ`, `РНОКПП` та `ЄДРПОУ` з токена) про користувача до іншого учасника процесу або іншого процесу. У цьому випадку, вона описує відправлення даних заявника-ініціатора (особи, яка намагається зареєструватися) до модератора для ручного підтвердження даних. This message event is an element in the business process that sends data (`full name`, `drfo`, and `EDRPOU` from the token) about the user to another process participant or process. In this case, it describes the sending of data from the initiator-applicant (the person trying to register) to the moderator for manual data confirmation. -//Виконайте налаштування події наступним чином: :: Configure the event as follows: :: -//. У розділі *Implementation* вкажіть: . In the *Implementation* section: -+ -//* Тип -- *`Delegate expression`*. + * Type: *`Delegate expression`*. -//* Вираз -- *`${startProcessByMessageDelegate}`*. Змінна є імплементацією делегата. + * Expression: ${startProcessByMessageDelegate}. The variable is an implementation of the delegate. -+ -//. У розділі *Global message reference*: + . In the *Global message reference* section: -+ -//* Оберіть *`startModerationBpMessage`* зі списку доступних. -//* У полі `Name` продублюйте значення *`startModerationBpMessage`* для зручності. + * Choose *`startModerationBpMessage`* from the available list. * Duplicate the value *`startModerationBpMessage`* in the *Name* field for convenience. -+ -//. У розділі *Inputs* вкажіть вхідні дані для передачі до іншого процесу: + . In the *Inputs* section, specify the input data to pass to another process: -+ -//* Створіть локальну змінну *`messagePayload`*. -//* Визначте для неї тип *`Map`*, тобто ключі-значення. -//* Передайте набір ключів-значень як *`Map entries`* у полях `Key` та *Value*. Зробити це можна наступним чином за допомогою функції `initiator()`: + * Create a local variable *`messagePayload`*. * Define its type as *`Map`* (key-value pairs). * Pass a set of key-value pairs as *`Map entries`* in the *Key* and *Value* fields using the `initiator()` function: -+ -//** ДРФО/РНОКПП + ** drfo/Registration number of the taxpayer's account card (UA-specific) *** *`Key: drfo`* *** *`Value: ${initiator().drfo}`* -//** ДРФО/РНОКПП ** drfo/Registration number of the taxpayer's account card (UA-specific) *** *`Key: edrpou`* *** *`Value: ${initiator().edrpou}`* -//** ПІБ ** User's full name *** *`Key: fullName`* *** *`Value: ${initiator().fullName}`* -//** Ім'я користувача в системі ** User's username in the system *** *`Key: userName`* *** *`Value: ${initiator().userName}`* - image:best-practices/officer-auto-register/manual-moderation/officer-self-register-manual-mod-4.png[] -//=== Отримання даних з токена модератором для підтвердження реєстрації === Moderator receiving token data for registration confirmation -//Змоделюйте стартову подію повідомлення -- *Message Start Event*. -Model a message start event -- *Message Start Event*. +Model a message start event—*Message Start Event*. -//TIP: Детальніше про *Message Start Event* ви можете переглянути на сторінці xref:bp-modeling/bp/bpmn/events/message-event.adoc#message-start-event[Моделювання та налаштування стартової події повідомлення]. TIP: For more detailed information about the *Message Start Event*, you can refer to the page on xref:bp-modeling/bp/bpmn/events/message-event.adoc#message-start-event[Modeling and configuring message start event]. -//Ця подія повідомлення являє собою елемент у бізнес-процесі, який отримує повідомлення з даними (`ПІБ`, `РНОКПП` та `ЄДРПОУ` з токена) про користувача до іншого учасника процесу або іншого процесу. У цьому випадку, вона описує отримання даних від заявника-ініціатора (особи, яка намагається зареєструватися) модератором для ручного підтвердження даних. This event is an element in the business process that receives data (`full name`, `drfo`, and `EDRPOU` from the token) about the user from another process participant or process. In this case, it describes the receipt of data from the initiator-applicant (the person trying to register) by the moderator for manual data confirmation. -//Виконайте налаштування події наступним чином: :: Configure the event as follows: -//. Визначте ідентифікатор події як `start_message_event`. Він буде використаний у наступній скрипт-задачі. . Define the event identifier as `start_message_event`. It will be used in the subsequent script task. -//. У розділі *Global message reference*: . In the *Global message reference* section: -+ -//* Оберіть *`startModerationBpMessage`* зі списку доступних. -//* У полі `Name` продублюйте значення *`startModerationBpMessage`* для зручності. + * Choose *`startModerationBpMessage`* from the available list. * Duplicate the value *`startModerationBpMessage`* in the *Name* field for convenience. image:best-practices/officer-auto-register/manual-moderation/officer-self-register-manual-mod-5.png[] -//=== Скрипт для підготовки даних до відображення на UI-формі === Script for data preparation for display on the UI form -//Створіть скрипт-задачу (Script Task) та додайте Groovy-скрипт, який підготує дані для відображення на UI-формі процесу. Create a Script Task and add a Groovy script that prepares data for displaying on the UI form of the process. image:best-practices/officer-auto-register/manual-moderation/officer-self-register-manual-mod-6.png[] -//Відкрийте редактор скриптів та додайте наступний скрипт: Open the script editor and add the following script: -//._Скрипт для підготовки даних до відображення на UI-формі_ ._Script for data preparation for display on UI form_ [%collapsible] ==== @@ -309,40 +227,32 @@ Open the script editor and add the following script: set_transient_variable('payload', S(message_payload('start_message_event').data, 'application/json')) ---- -//Цей скрипт виконує наступні дії: This script performs the following actions: -//. Витягує дані з повідомлення *`start_message_event`* та конвертує їх у формат JSON. Для цього використовується функція *`message_payload('start_message_event').data`*. Функція S забезпечує обробку JSON-формату. . Extracts data from the *`start_message_event`* message and converts it into JSON format. This is done using the function *`message_payload('start_message_event').data`*. Function S handles the JSON processing. -+ -//. Після того, як дані перетворено на JSON, скрипт створює тимчасову змінну *`payload`* та присвоює їй значення цих даних. Функція *`set_transient_variable()`* використовується для створення тимчасової змінної процесу, яка зберігатиме змінну *`payload`*. + . After the data is transformed into JSON, the script creates a temporary variable named *`payload`* and assigns it the value of this data. The function *`set_transient_variable()`* is used to create a process temporary variable that will store the *`payload`* variable. ==== -//=== Визначення бізнес-ключа процесу === Determining the business key of the process -//Ця задача -- сервісна задача (Service Task), яка використовує делегат *Define process business key*, що виконує певний код або логіку під час виконання цієї задачі. This task is a service task that utilizes the *Define process business key* delegate, which executes specific code or logic during the execution of this task. [TIP] ==== [%collapsible] -//.Що таке бізнес-ключ? + .What is a business key? ===== -//_Бізнес-ключ_ або _Ключ бізнес-процесу_ (*Business Key*) -- це специфічний для домену ідентифікатор екземпляра бізнес-процесу у https://camunda.com/bpmn/reference[Camunda BPM]. Він є додатковим атрибутом, що застосовується при моделюванні бізнес-процесів для їх однозначної ідентифікації, а також ідентифікації користувацьких задач процесу. + The _Business key_, or _Process business key_ (*Business Key*), is a domain-specific identifier for an instance of a business process in https://camunda.com/bpmn/reference[Camunda BPM]. It is an additional attribute used during the modeling of business processes to ensure their unique identification, as well as the identification of user tasks within the process. ===== ==== -//За допомогою розширення БП задається вхідний параметр `*businessKey*`. Цей параметр отримує значення з тимчасової змінної *`payload`*, яка була створена раніше, та зокрема з атрибута *`fullName`*. The input parameter *`businessKey`* is set in the BP extension. This parameter receives values from a temporary variable called *`payload`*, which was created earlier, specifically from the attribute *`fullName`*. -//Після виконання цієї задачі, бізнес-ключ процесу буде встановлено як значення *`fullName`* із тимчасової змінної *`payload`*. After completing this task, the business key of the process will be set as the value of *`fullName`* from the temporary variable *`payload`*. -//У цьому контексті, сервісна задача отримує повне ім'я особи-заявника із JSON-даних, що були передані у повідомленні, та встановлює його як бізнес-ключ для поточного екземпляра процесу: In this context, the service task receives the full name of the applicant from JSON data transmitted in the message and sets it as the business key for the current process instance: ---- @@ -353,35 +263,22 @@ image:best-practices/officer-auto-register/manual-moderation/officer-self-regist [TIP] ==== -//Детальніше про бізнес-ключі ви можете дізнатися на сторінці For more details about business keys, please see xref:bp-modeling/bp/modeling-facilitation/bp-business-keys.adoc[]. ==== -//=== Перегляд даних для реєстрації модератором на UI-формі === Reviewing data for moderator registration on the UI form -//Ця задача -- користувацька задача (User Task) з ідентифікатором *`makeDecisionActivity`*, яка призначена для виконання посадовою особою-модератором (*`candidateGroups="officer-moderator"`*). This task is a user task with the identifier *`makeDecisionActivity`*, intended for execution by an officer-moderator (*`candidateGroups="officer-moderator"`*). -//В задачі використовується параметр *`formKey`* зі значенням *`selfregistration-decision`*, який вказує на UI-форму, що має бути показана модератору для перегляду даних посадової особи-заявника та прийняття рішення про самореєстрацію. The task uses the *`formKey`* parameter with the value *`selfregistration-decision`*, indicating the UI form to be shown to the moderator for reviewing the data of the officer-applicant and making a decision on self-registration. -//За допомогою розширення-делегата User Form задається вхідний параметр *`Form data pre-population`*, який отримує значення з тимчасової змінної "payload", визначеної у скрипті раніше. Цей параметр передає дані заявника до форми, який відображається модератору. Using the User Form delegate, the *`Form data pre-population`* input parameter is defined, which receives data from the temporary variable "payload" specified in the earlier script. This parameter passes applicant data to the form displayed to the moderator. -//Після того, як модератор перегляне дані та прийме рішення, процес продовжується далі відповідно до вибору модератора (підтвердження або відхилення самореєстрації). After the moderator reviews the data and makes a decision, the process continues according to the moderator's choice (confirmation or rejection of self-registration). -//Виконайте налаштування наступним чином: :: Configure it as follows: :: -//. У полі *`Name`* введіть назву користувацької задачі. -//. Застосуйте шаблон делегата -- *`User Form`*. -//. У полі *`ID`* введіть ідентифікатор задачі -- *`makeDecisionActivity`*. -//. У полі *`Form key`* визначте ключ для поєднання із відповідною змодельованою формою бізнес-процесу -- *`selfregistration-decision`*. -//. У полі `Candidate roles` введіть роль посадової особи-модератора процесу, визначену у регламенті, -- *`officer-moderator`*. -//. У полі *`Form data pre-population`* передайте дані на UI-форму як змінну ${payload}. . In the *`Name`* field, enter the name of the user task. . Apply the delegate *`User Form`* template. . In the *`ID`* field, specify the task identifier as *`makeDecisionActivity`*. @@ -391,23 +288,17 @@ Configure it as follows: :: image:best-practices/officer-auto-register/manual-moderation/officer-self-register-manual-mod-8.png[] -//=== Таймер для прийняття рішення модератором щодо реєстрації === Timer for the moderator's decision regarding registration -//Це гранична подія (*Timer Boundary Event*), яка прикріплена до користувацької задачі *`makeDecisionActivity`*. Ця подія містить визначення події таймера (`timerEventDefinition`), яке встановлює таймер із тривалістю 2 хвилини (*`PT2M`*). This is a *Timer Boundary Event* attached to the User Task *`makeDecisionActivity`*. This event contains a timer event definition that sets a timer with a duration of 2 minutes (*`PT2M`*). -//Коли користувацька задача `makeDecisionActivity` активується, таймер починає відлік 2 хвилин. Якщо модератор не приймає рішення протягом цього часу, таймер спрацьовує, і процес переходить до наступного кроку відповідно до альтернативного потоку (це означає, що користувач не буде зареєстрований). When the User Task `makeDecisionActivity` is activated, the timer starts counting down from 2 minutes. If the moderator does not make a decision within this time, the timer triggers, and the process proceeds to the next step according to the alternative flow (meaning the user will not be registered). -//Виконайте налаштування наступним чином: :: Configure it as follows: -//. У полі Name вкажіть назву для події. -//. У розділі Timer: . In the *Name* field, specify a name for the event. . In the *Timer* section: -//* У полі *`Type`* (`Timer Definition Type`) вкажіть тип таймера -- *`Duration`* (тривалість). + * In the *`Type`* (`Timer Definition Type`) field, specify the timer type as *`Duration`*. + [TIP] @@ -417,55 +308,38 @@ Configure it as follows: * xref:bp-modeling/bp/bpmn/events/timer-event.adoc[]. * xref:best-practices/bp-timer-launch.adoc[] ==== -+ -//* У полі *`Value`* вкажіть значення для таймера у певному форматі. Наприклад, *`PT2M`*, тобто 2 хвилини. + * In the *`Value`* field, specify the timer value in a specific format, e.g., *`PT2M`* for 2 minutes. -+ -//TIP: Ви можете налаштувати таймер, використовуючи стандартний формат *`ISO 8601`* або `*cron*`-вираз. + TIP: You can configure the timer using the standard *`ISO 8601`* format or a *`cron`* expression. image:best-practices/officer-auto-register/manual-moderation/officer-self-register-manual-mod-9.png[] -//=== Надсилання повідомлення про те, що рішення про автореєстрацію не прийнято (альтернативний потік) === Sending a message that the self-registration decision was not accepted (alternative flow) -//Це кінцева подія (*Message End Event*), яка має визначення події повідомлення (`messageEventDefinition`) і використовує делегат *`${sendMessageDelegate}`*, що відповідає за надсилання повідомлення. -This is an *Message End Event* that has a message event definition and uses the `${sendMessageDelegate}` delegate responsible for sending messages. +This is a *Message End Event* that has a message event definition and uses the `${sendMessageDelegate}` delegate responsible for sending messages. -//TIP: Детальніше про *Message End Event* ви можете переглянути на сторінці xref:bp-modeling/bp/bpmn/events/message-event.adoc#message-end-event[Моделювання та налаштування кінцевої події повідомлення]. TIP: For more details about the *Message End Event*, you can refer to the xref:bp-modeling/bp/bpmn/events/message-event.adoc#message-end-event[Modeling and configuration of Message End Event page]. -//Якщо процес доходить до цієї події, отже рішення про автореєстрацію не було прийнято (наприклад, через те, що спрацював таймер). У цьому випадку, подія надсилає повідомлення з інформацією про те, що рішення не було прийнято, до іншого процесу або учасника, використовуючи делегат *`sendMessageDelegate`*. Інформація про ідентифікатор процесу, з якого було викликано цей процес (*`correlationProcessInstanceId`*), передається як вхідний параметр. If the process reaches this event, it means that the self-registration decision was not accepted (for example, due to a timer triggering). In this case, the event sends a message with information that the decision was not accepted to another process or participant using the *`sendMessageDelegate`* delegate. Information about the identifier of the process that called this process (*`correlationProcessInstanceId`*) is passed as an input parameter. -//Функція *`process_caller()`* використовується для отримання інформації про той процес, який викликав поточний процес. The *`process_caller()`* function is used to obtain information about the process that triggered the current process. -//У нашому випадку функція отримує ідентифікатор (*`id`*) процесу, який викликав поточний процес. Цей ідентифікатор передається як вхідний параметр `correlationProcessInstanceId` для делегата `sendMessageDelegate`, який надсилає повідомлення. In our case, the function retrieves the identifier (*`id`*) of the process that triggered the current process. This identifier is passed as an input parameter (`correlationProcessInstanceId`) to the `sendMessageDelegate` delegate, which sends the message. -//Виконайте налаштування наступним чином: :: Configuration steps: :: -//. У розділі *Implementation* вкажіть: . In the *Implementation* section, specify: -//* Тип -- *`Delegate expression`*. -//* Вираз -- *`${sendMessageDelegate}`*. Змінна є імплементацією делегата. + * Type as *`Delegate expression`*. * Expression as *`${sendMessageDelegate}`*. The variable is an implementation of the delegate. -+ -//. У розділі *Global message reference*: -//* Оберіть *`decisionOverdueMessage`* зі списку доступних. -//* У полі `Name` продублюйте значення *`decisionOverdueMessage`* для зручності. + . In the *Global message reference* section: * Choose *`decisionOverdueMessage`* from the available options. * Duplicate the *`decisionOverdueMessage`* value in the *Name* field for convenience. -+ -//. У розділі *Inputs* вкажіть вхідні дані для передачі до іншого процесу: + . In the *Inputs* section, specify the input data to be passed to another process: -//* Створіть локальну змінну *`correlationProcessInstanceId`*. -//* Визначте для неї тип *`String or Expression`*, тобто рядок або вираз. -//* У полі *`Value`* передайте ідентифікатор процесу, який викликав поточний процес. Зробити це можна наступним чином за допомогою функції *`process_caller()`*: + * Create a local variable called *`correlationProcessInstanceId`*. * Define its type as *`String or Expression`*. * In the *Value* field, pass the identifier of the process that triggered the current process using the *`process_caller()`* function: @@ -478,44 +352,29 @@ ${process_caller().id} image:best-practices/officer-auto-register/manual-moderation/officer-self-register-manual-mod-10.png[] -//=== Отримання повідомлення про те, що рішення про автореєстрацію не прийнято (альтернативний потік) === Receiving a message that the self-registration decision was not accepted (alternative flow) -//Ця подія є проміжною подією отримання повідомлення (*Intermediate Message Catch Event*) у процесі BPMN. Вона служить для очікування та перехоплення вхідного повідомлення, яке відправлено іншим процесом або учасником. Зазвичай такі події використовуються для синхронізації або координації між різними процесами чи учасниками у бізнес-процесі. This event is an *Intermediate Message Catch Event* in the BPMN process. It is used to wait for and catch an incoming message sent by another process or participant. Such events are typically used for synchronization or coordination between different processes or participants in a business process. -//TIP: Детальніше про *Intermediate Message Catch Event* ви можете переглянути на сторінці xref:bp-modeling/bp/bpmn/events/message-event.adoc#message-intermediate-catch-event[Моделювання та налаштування проміжної події отримання повідомлення]. TIP: For more details about the *Intermediate Message Catch Event*, you can refer to the xref:bp-modeling/bp/bpmn/events/message-event.adoc#message-intermediate-catch-event[Modeling and configuration of intermediate message catch event] page. -//Виконайте налаштування події наступним чином: :: Configuration steps for the event: :: -//У розділі *Global message reference*: In the *Global message reference* section: -//. Оберіть *`decisionOverdueMessage`* зі списку доступних. -//. У полі `Name` продублюйте значення *`decisionOverdueMessage`* для зручності. . Choose *`decisionOverdueMessage`* from the available options. . Duplicate the *`decisionOverdueMessage`* value in the *Name* field for convenience. image:best-practices/officer-auto-register/manual-moderation/officer-self-register-manual-mod-11.png[] -//=== Виведення інформації про завершення процесу на форму (альтернативний потік) === Displaying information about process completion on a form (alternative flow) -//Ця задача є користувацькою задачею (*User Task*) і призначена для надання інформації користувачеві про те, що процес реєстрації завершився через вичерпання часу, відведеного на прийняття рішення. This task is a user task intended to provide information to the user that the registration process has ended due to a timeout for decision-making. -//Ця задача призначена для ініціатора процесу (*`camunda:assignee="${initiator}"`*), який є заявником. Форма, пов'язана з цією задачею, має ключ *`selfregistration-decision-overdue`* (`camunda:formKey="selfregistration-decision-overdue"`), який відображає форму з інформацією про завершення процесу по вичерпанню часу. This task is assigned to the process initiator (*`camunda:assignee="${initiator}"`*), who is the applicant. The form associated with this task has the key *`selfregistration-decision-overdue`* (`camunda:formKey="selfregistration-decision-overdue"`), which displays information about the process completion due to a timeout. -//Виконайте налаштування наступним чином: :: Configuration steps: :: -//. У полі `Name` введіть назву користувацької задачі. -//. Застосуйте шаблон делегата для цієї задачі -- *User Form*. -//. Поєднайте користувацьку задачу із UI-формою за допомогою параметра *`Form key`*. Введіть значення *`selfregistration-decision-overdue`*. -//. У полі *`Assignee`* вкажіть змінну для особи, якій призначається поточна задача, -- *`${initiator}`*. . In the *Name* field, enter the name of the user task. . Apply the delegate template for this task -- *User Form*. . Link the User Task to a UI form using the *`Form key`* parameter. Enter the value. @@ -523,33 +382,23 @@ Configuration steps: :: image:best-practices/officer-auto-register/manual-moderation/officer-self-register-manual-mod-11-1.png[] -//Далі відбувається завершення процесу відповідно до кінцевої події в альтернативному потоці. The process then concludes based on the end event in the alternative flow. -//=== Підписання даних КЕП === Signing data with a Qualified Electronic Signature (QES) -//Ця задача є користувацькою задачею (User Task) у бізнес-процесі BPMN і призначена для підпису рішення заявника за допомогою кваліфікованого електронного підпису (КЕП). This task is a user task within the BPMN business process and is designed for signing the applicant's decision using a Qualified Electronic Signature (QES). -//Ця задача призначається для користувача, який виконав задачу `makeDecisionActivity`. Форма, пов'язана із цією задачею, має ключ *`selfregistration-sign-decision`*, який відображає форму для підпису рішення КЕП. Вхідні дані для форми передаються із результатів форми задачі *`makeDecisionActivity`*. This task is assigned to the user who performed the `makeDecisionActivity` task. The form associated with this task has the key *`selfregistration-sign-decision`*, which displays the QES decision signing form. The input data for the form is passed from the results of the *`makeDecisionActivity`* task. -//Після того, як користувач підпише рішення, процес продовжиться за основним потоком. After the user signs the decision, the process will continue along the main flow. -//Виконайте налаштування наступним чином: :: Configuration steps: :: -//. У полі *`Name`* введіть назву користувацької задачі. -//. Застосуйте шаблон делегата -- *`Officer Sign Task`*. -//. У полі *`ID`* введіть ідентифікатор задачі -- *`signDecisionActivity`*. -//. У полі *`Form key`* визначте ключ для поєднання із відповідною змодельованою формою бізнес-процесу -- *`selfregistration-sign-decision`*. . In the *`Name`* field, enter the name of the user task. . Apply the delegate template for this task -- *`Officer Sign Task`*. . In the *`ID`* field, enter the task identifier as *`signDecisionActivity`*. . In the *`Form key`* field, specify the key to link to the corresponding modeled business process form - *`selfregistration-sign-decision`*. -//. У полі `Assignee` вкажіть, кому призначається задача для виконання. Використайте для цього функцію *`completer()`*: + . In the *Assignee* field, specify who the task is assigned to for execution. Use the *`completer()`* function to assign it to the user who completed the makeDecisionActivity task: ${completer('makeDecisionActivity').userName} + @@ -557,7 +406,7 @@ ${completer('makeDecisionActivity').userName} ---- ${completer('makeDecisionActivity').userName} ---- -//. У полі *`Form data pre-population`* передайте дані на UI-форму через функцію `submission()`: + . In the *`Form data pre-population`* field, pass the data to the UI form using the `submission()` function: + [source,juel] @@ -567,27 +416,18 @@ ${submission('makeDecisionActivity').formData}. image:best-practices/officer-auto-register/manual-moderation/officer-self-register-manual-mod-12.png[] -//=== Підписання даних системним ключем === Signing data with a system key -//Ця задача є сервісною задачею (*Service Task*) у бізнес-процесі BPMN і призначена для підпису даних системним ключем, тобто автоматичним підписом з боку системи. This task is a Service Task within the BPMN business process and is designed for signing data with a system key, i.e., an automatic signature by the system. -//Ця задача використовує делегат *`digitalSystemSignatureDelegate`*, який відповідає за логіку підпису системним ключем. This task uses the *`digitalSystemSignatureDelegate`* delegate, which is responsible for the logic of signing with the system key. -//Вхідні параметри для цього завдання включають *`x_access_token`* та *`payload`*. `x_access_token` отримується від користувача, який завершив задачу *`signDecisionActivity`*, а `payload` містить дані форми з результатів цього завдання. Input parameters for this task include *`x_access_token`* and *`payload`*. `x_access_token` is obtained from the user who completed the *`signDecisionActivity`* task, and `payload` contains the form data from the results of that task. -//Задача генерує вихідний параметр *`subject_system_signature_ceph_key`*, який містить згенерований ключ зберігання системного підпису. The task generates an output parameter *`subject_system_signature_ceph_key`*, which contains the generated system signature storage key. -//Виконайте налаштування наступним чином: :: Configuration steps: :: -//. Змоделюйте сервісну задачу (Service Task) для підпису даних системним ключем. -//. Використовуйте делегат *System signature by DSO service* із каталогу шаблонів для накладання системного підпису. -//. Вхідні дані передайте функцію submission у відповідному полі: . Model a service task for signing data with a system key. . Use the *System signature by DSO service* delegate from the template catalog for applying the system signature. . Pass input data to the submission function in the appropriate field: @@ -596,41 +436,27 @@ ${submission('signDecisionActivity').formData} ---- ${submission('signDecisionActivity').formData} ---- -//. Передайте токен виконавця останньої користувацької задачі у бізнес-процесі: *`${completer('signDecisionActivity').accessToken}`*. + . Pass the token of the last user task executor in the business process using: *`${completer('signDecisionActivity').accessToken}`*. -+ -//. Відповідь запишіть у змінну `*subject_system_signature_ceph_key*`. + . Store the response in the *`subject_system_signature_ceph_key`* variable. image:best-practices/officer-auto-register/manual-moderation/officer-self-register-manual-mod-13.png[] -//=== Створення запису у базі даних реєстру === Creating a record in the registry database -//Ця задача створює користувача в системній таблиці бази даних реєстру. Вона використовує шаблон делегата `dataFactoryConnectorCreateDelegate` для виконання дій. Задача отримує вхідні параметри з попередніх задач, такі як ключі та дані форми, та передає їх для створення користувача. This task creates a user record in the system's database table. It uses the `dataFactoryConnectorCreateDelegate` delegate to perform the actions. The task receives input parameters from previous tasks, such as keys and form data, and passes them to create the user. -//Вхідні параметри включають: :: Input parameters include: :: -//* *`x_digital_signature_derived_ceph_key`* -- ключ, що походить від підписаного документа. -//* *`resource`* -- ресурс, що буде створений (у цьому випадку, `officers`). -//* *`x_access_token`* -- токен доступу виконавця задачі `signDecisionActivity`. -//* *`x_digital_signature_ceph_key`* -- системний ключ документа із підписом від задачі `signDecisionActivity`. -//* *`payload`* -- дані форми з завдання `signDecisionActivity`. * *`x_digital_signature_derived_ceph_key`*: The key derived from the signed document. * *`resource`*: The resource to be created (in this case, `officers`). * *`x_access_token`*: The access token of the `signDecisionActivity` task executor. * *`x_digital_signature_ceph_key`*: The system key of the document signed in the `signDecisionActivity` task. * *`payload`*: The form data from the `signDecisionActivity` task. -//Виконайте налаштування наступним чином: :: Configuration steps: :: -//. Створіть сервісну задачу (*Service Task*). -//. Використовуйте делегат *Create entity in data factory*, щоб створити сутність у базі даних. -//. Вкажіть ресурс/API-ендпоінт *`officers`*, що відповідає назві таблиці із даними, яку ви визначили при створенні моделі даних реєстру -- *`officers`*. -//. Вхідні дані передайте через функцію *`submission()`* у відповідному полі: . Create a service task. . Use the *Create entity in data factory* delegate to create an entity in the database. . Specify the resource/API endpoint as *`officers`*, which corresponds to the name of the data model table you defined when creating the registry data model - *`officers`*. @@ -640,11 +466,7 @@ Configuration steps: :: ---- ${submission('signDecisionActivity').formData} ---- -//. Передайте токен виконавця останньої користувацької задачі у бізнес-процесі: *`${completer('signDecisionActivity').accessToken}`*. -//. Вкажіть джерело системного підпису. Для цього використовуйте функцію `sign_submission()`: + -//*`${sign_submission('signDecisionActivity').signatureDocumentId}`*. -//. Вкажіть як змінну *`${subject_system_signature_ceph_key}`* ключ Ceph-документа, який містить інформацію про підписані дані. -//. Запишіть відповідь до результівної змінної, наприклад, `response`. + . Pass the token of the last user task executor in the business process using: *`${completer('signDecisionActivity').accessToken}`*. . Specify the source of the system signature using the `sign_submission()` function: *`${sign_submission('signDecisionActivity').signatureDocumentId}`*. @@ -653,64 +475,43 @@ ${submission('signDecisionActivity').formData} image:best-practices/officer-auto-register/manual-moderation/officer-self-register-manual-mod-14.png[] -//=== Визначення статусу виконання процесу === Determining the execution status of the process -//Ця задача встановлює результат виконання процесу "Самореєстрацію пройдено" за допомогою шаблону делегата *`defineBusinessProcessStatusDelegate`*. Задача приймає вхідні дані з попередньої задачі та передає результат до наступного етапу процесу. This task sets the result of the "Self-registration completed" process execution using the *`defineBusinessProcessStatusDelegate`* delegate template. The task accepts input data from the previous task and passes the result to the next stage of the process. -//Встановіть результат виконання: :: Set the execution result as follows: :: -//. Оберіть шаблон делегата *Define business process status* у списку доступних. -//. У полі Status введіть статус -- `Самореєстрацію пройдено`. . Select the delegate template *Define business process status* from the available list. . In the *Status* field, enter the status as `Self-registration completed`. image:best-practices/officer-auto-register/manual-moderation/officer-self-register-manual-mod-15.png[] -//=== Відправлення рішення назад до процесу заявника реєстрації === Sending the decision back to the applicant registration process -//Ця задача є завершальною подією (*Message End Event*) у процесі підтвердження самореєстрації модератором. Вона виконує наступні функції: This task serves as the concluding event (*Message End Event*) in the moderator's self-registration confirmation process. It performs the following functions: -//. Встановлює зв'язок з процесом реєстранта через параметр *`correlationProcessInstanceId`*, що отримує значення з ID процесу-викликача (*`${process_caller().id}`*). . Establishes a connection with the registrant process using the *`correlationProcessInstanceId`* parameter, which obtains its value from the ID of the calling process (*`${process_caller().id}`*). -+ -//. Передає дані про рішення відносно самореєстрації через параметр *`messageData`*. Цей параметр містить відомості про позитивне чи негативне рішення (*`${submission('signDecisionActivity').formData.prop('selfregistrationDecision').value()}`*). + . Transfers decision-related data regarding self-registration through the *`messageData`* parameter. This parameter contains information about a positive or negative decision (*`${submission('signDecisionActivity').formData.prop('selfregistrationDecision').value()}`*). -+ -//. Використовує делегат *`${sendMessageDelegate}`* для відправки повідомлення з вищезазначеними даними. + . Utilizes the delegate *`${sendMessageDelegate}`* to send a message with the aforementioned data. -//TIP: Детальніше про *Message End Event* ви можете переглянути на сторінці xref:bp-modeling/bp/bpmn/events/message-event.adoc#message-end-event[Моделювання та налаштування кінцевої події повідомлення]. TIP: For more details on the *Message End Event*, please refer to the xref:bp-modeling/bp/bpmn/events/message-event.adoc#message-end-event[Modeling and configuring the message end event] page. -//Виконайте наступні налаштування: :: Configure the following settings: :: -//. У розділі *Implementation* вкажіть: . In the *Implementation* section, specify: -//* Тип -- *`Delegate expression`*. -//* Вираз -- *`${sendMessageDelegate}`*. Змінна є імплементацією делегата. + * Type: *`Delegate expression`*. * Expression: *`${sendMessageDelegate}`*. This variable represents the delegate implementation. -+ -//. У розділі *Global message reference*: -//* Оберіть *`decisionMessage`* зі списку доступних. -//* У полі `Name` продублюйте значення *`decisionMessage`* для зручності. + . In the *Global message reference* section: * Choose *`decisionMessage`* from the available list. * Duplicate the value *`decisionMessage`* in the *Name* field for convenience. -+ -//. У розділі *Inputs* вкажіть вхідні дані для передачі до іншого процесу: -//* Створіть локальну змінну *`correlationProcessInstanceId`*. + . In the *Inputs* section, specify the input data to be sent to another process: * Create a local variable *`correlationProcessInstanceId`*. -+ -//** Визначте для неї тип *`String or Expression`*, тобто рядок або вираз. -//** У полі *`Value`* передайте ідентифікатор процесу, який викликав поточний процес. Зробити це можна наступним чином за допомогою функції *`process_caller()`*: + ** Define its type as *`String or Expression`*, i.e., a string or expression. ** In the *`Value`* field, pass the identifier of the process that invoked the current process. You can do this using the *`process_caller()`* function: + @@ -718,16 +519,11 @@ Configure the following settings: :: ---- ${process_caller().id} ---- -+ -//* Створіть локальну змінну *`messageData`*. -//** Визначте для неї тип *`Map`*, тобто ключі-значення. -//** Передайте набір ключів-значень як *`Map entries`* у полях `Key` та *Value*. Зробити це можна наступним чином за допомогою функції `submission()`: + * Create a local variable *`messageData`*. ** Define its type as *`Map`*, i.e., key-value pairs. ** Pass a set of key-value pairs as *`Map entries`* in the `Key` and *Value* fields. You can do this using the `submission()` function: -+ -//*** *`Key: isDecisionPositive`* (вказує на ключ до позитивного результату, який підтверджує реєстрацію посадової особи) -//*** *`Value: ${submission('signDecisionActivity').formData.prop('selfregistrationDecision').value()}`* + *** *`Key: isDecisionPositive`* (indicates the key for a positive result confirming the Officer's registration) *** *`Value: ${submission('signDecisionActivity').formData.prop('selfregistrationDecision').value()}`* @@ -735,61 +531,42 @@ image:best-practices/officer-auto-register/manual-moderation/officer-self-regist image:best-practices/officer-auto-register/manual-moderation/officer-self-register-manual-mod-16-1.png[] -//=== Отримання повідомлення про те, що рішення про автореєстрацію прийнято та записано до Фабрики даних === Receiving a message confirming self-registration decision and recording it in the Data Factory -//Ця подія є проміжною подією отримання повідомлення (*Intermediate Message Catch Event*) у процесі BPMN. Вона служить для очікування та перехоплення вхідного повідомлення, яке відправлено іншим процесом або учасником. Зазвичай такі події використовуються для синхронізації або координації між різними процесами чи учасниками у бізнес-процесі. This event serves as an *Intermediate Message Catch Event* in the BPMN process. It is used to wait for and intercept an incoming message sent by another process or participant. Typically, such events are used for synchronization or coordination between different processes or participants in a business process. -//TIP: Детальніше про *Intermediate Message Catch Event* ви можете переглянути на сторінці xref:bp-modeling/bp/bpmn/events/message-event.adoc#message-intermediate-catch-event[Моделювання та налаштування проміжної події отримання повідомлення]. TIP: For more details on the *Intermediate Message Catch Event*, you can refer to the xref:bp-modeling/bp/bpmn/events/message-event.adoc#message-intermediate-catch-event[Modeling and configuring the intermediate message catch event] page. -//Виконайте налаштування події наступним чином: :: Configuration steps: :: -//У розділі *Global message reference*: -//. Оберіть *`decisionMessage`* зі списку доступних. -//. У полі `Name` продублюйте значення *`decisionMessage`* для зручності. In the *Global message reference* section: . Select *`decisionMessage`* from the available list. . Duplicate the value *`decisionMessage`* in the `Name` field for convenience. image:best-practices/officer-auto-register/manual-moderation/officer-self-register-manual-mod-17.png[] -//=== Моделювання XOR-шлюзу та додавання логіки через вирази умови === Modeling a XOR gateway and adding logic through condition expressions -//Змоделюйте XOR-шлюз, який на основі певної умови визначатиме, за яким потоком далі піде бізнес-процес. Model an XOR gateway that, based on a certain condition, will determine the next flow of the business process. image:best-practices/officer-auto-register/manual-moderation/officer-self-register-manual-mod-18.png[] -//Якщо рішення про реєстрацію негативне і передається повідомленням від процесу модератора як ключ *`${!isDecisionPositive}`*, тоді процес піде за альтернативним потоком, а користувач не пройде реєстрацію. Роль такого користувача не зміниться й залишиться *`unregistered-officer`*. If the decision regarding registration is negative and is conveyed by a message from the moderator's process as the key *`${!isDecisionPositive}`*, then the process will follow an alternative flow, and the user will not complete the registration. The role of such a user will remain *`unregistered-officer`*. image:best-practices/officer-auto-register/manual-moderation/officer-self-register-manual-mod-18-1.png[] -//Якщо рішення про реєстрацію позитивне і передається повідомленням від процесу модератора як ключ *`${isDecisionPositive}`*, тоді процес піде за основним потоком, а користувач пройде реєстрацію. Роль такого користувача зміниться у наступній сервісній задачі з *`unregistered-officer`* на *`officer`*. If the decision regarding registration is positive and is conveyed by a message from the moderator's process as the key *`${isDecisionPositive}`*, then the process will follow the main flow, and the user will complete the registration. The role of such a user will change in the subsequent service task from *`unregistered-officer`* to *`officer`*. image:best-practices/officer-auto-register/manual-moderation/officer-self-register-manual-mod-18-2.png[] -//=== Виведення інформації на форму про відсутність дозволу на реєстрацію (альтернативний потік) == Displaying information on the lack of registration permission (alternative flow) -//Ця задача є користувацькою задачею (*User Task*) і призначена для надання інформації користувачеві про відсутність дозволу на реєстрацію. This task is a user task and is intended to provide information to the user about the lack of registration permission. -//Ця задача призначена для ініціатора процесу (*`camunda:assignee="${initiator}"`*), який є заявником. Форма, пов'язана з цією задачею, має ключ *`selfregistration-denied-handmoderation`* (`camunda:formKey="selfregistration-denied-handmoderation"`), який відображає форму з інформацією про відсутність дозволу на реєстрацію. This task is assigned to the process initiator (*`camunda:assignee="${initiator}"`*), who is the applicant. The form associated with this task has the key *`selfregistration-denied-handmoderation`* `(`camunda:formKey="selfregistration-denied-handmoderation`"`), which displays information about the lack of registration permission. -//Виконайте налаштування наступним чином: :: Configuration steps: :: -//. У полі `Name` введіть назву користувацької задачі. -//. Застосуйте шаблон делегата для цієї задачі -- *User Form*. -//. Поєднайте користувацьку задачу із UI-формою за допомогою параметра *`Form key`*. Введіть значення *`selfregistration-denied-handmoderation`*. -//. У полі *`Assignee`* вкажіть змінну для особи, якій призначається поточна задача, -- *`${initiator}`*. . In the `Name` field, enter the name of the user task. . Apply the delegate template for this task -- *User Form*. . Associate the user task with the UI form using the *`Form key`* parameter. Enter the value *`selfregistration-denied-handmoderation`*. @@ -797,30 +574,19 @@ Configuration steps: :: image:best-practices/officer-auto-register/manual-moderation/officer-self-register-manual-mod-19.png[] -//Далі встановлюється результат виконання, що реєстрацію не пройдено й відбувається завершення процесу відповідно до кінцевої події в альтернативному потоці. -Next, set the outcome that the registration was not completed, and the process concludes according to the end event in the alternative flow. +Next, set the outcome that the registration was not completed, and the process concludes, according to the end event in the alternative flow. -//=== Видалення ролі unregistered-officer та призначення ролі officer посадовій особі === Removing the unregistered-officer role and assigning the Officer role to the Officer -//Після підтвердження реєстрації, дані передаються до сервісної задачі, яка використовує делегат *`Save user roles`* для перепризначення ролей користувачам та збереження їх до БД Keycloak. After confirming the registration, data is passed to a service task that uses the *`Save user roles`* delegate to reassign roles to users and save them to the Keycloak database. -//Ця задача виконує наступні дії: This task performs the following actions: -//. Видаляє роль *`unregistered-officer`* у користувача, який проходить самореєстрацію. -//. Додає роль officer до користувача після успішної самореєстрації. . Removes the *`unregistered-officer`* role from the user who completes self-registration. . Adds the officer role to the user after successful self-registration. -//Задача використовує делегат *`${keycloakSaveUserRoleConnectorDelegate}`*, який взаємодіє з Keycloak для зміни ролей користувача. Інформація про ролі та інші параметри передаються через input-параметри: The task uses the *`${keycloakSaveUserRoleConnectorDelegate}`* delegate, which interacts with Keycloak to change the user's roles. Role information and other parameters are passed through input parameters: -//* *`realm`* встановлюється як *`OFFICER`*. -//* *`roles`* містить список ролей, які будуть додані користувачу (у цьому випадку -- *`officer`*). -//* *`username`* отримує значення імені користувача, який проходить самореєстрацію (*`${initiator().userName}`*). -//* *`roleType`* встановлюється на *`ALL ROLES`*, що вказує на те, що зміни будуть застосовані до всіх ролей користувача. * *realm* is set to *`OFFICER`*. * *roles* contains a list of roles to be added to the user (in this case, *`officer`*). * *`username`* receives the value of the username of the user completing self-registration (*`${initiator().userName}`*). @@ -828,22 +594,14 @@ The task uses the *`${keycloakSaveUserRoleConnectorDelegate}`* delegate, which i image:bp-modeling/bp/element-temp/service-task/save-user-roles/delegate-save-user-roles-1.png[] -//TIP: Детальніше про делегат ви можете переглянути на сторінці xref:bp-modeling/bp/element-templates/bp-element-templates-installation-configuration.adoc#save-user-roles[Збереження ролей користувачів до Keycloak (Save user roles)]. -TIP: For more details about the delegate, you can refer to the xref:bp-modeling/bp/element-templates/bp-element-templates-installation-configuration.adoc#save-user-roles[Save user roles to Keycloak] page. +TIP: For more details about the delegate, you can refer to the xref:bp-modeling/bp/element-templates/service-task-templates/save-user-roles.adoc[] page. -//=== Виведення на форму інформації по успішне завершення процесу реєстрації === Displaying information on successful registration process completion -//Ця задача (*User Task*) відображає інформаційне повідомлення для користувача після успішної самореєстрації. Користувач повинен переглянути інформацію та підтвердити її перегляд. Задача використовує шаблон форми *`User form`* та ключ форми *`selfregistration-success`* для відображення відповідного інтерфейсу користувача. Задача призначена для виконання ініціатором процесу самореєстрації (*`${initiator}`*). This user task displays an informational message to the user after a successful self-registration. The user should review the information and confirm its viewing. The task uses the *`User Form`* template and the form key *`selfregistration-success`* to display the corresponding user interface. The task is assigned to the initiator of the self-registration process (*`${initiator}`*). -//Виконайте наступні налаштування: :: Configuration steps: :: -//. У полі `Name` введіть назву користувацької задачі. -//. Застосуйте шаблон делегата для цієї задачі -- *User Form*. -//. Поєднайте користувацьку задачу із UI-формою за допомогою параметра *`Form key`*. Введіть значення *`selfregistration-success`*. -//. У полі *`Assignee`* вкажіть змінну для особи, якій призначається поточна задача, -- *`${initiator}`*. . In the *Name* field, enter the name of the user task. . Apply the delegate template for this task -- *User Form*. . Associate the user task with the UI form using the *`Form key`* parameter. Enter the value *`selfregistration-success`*. @@ -851,8 +609,6 @@ Configuration steps: :: image:best-practices/officer-auto-register/manual-moderation/officer-self-register-manual-mod-20.png[] -//=== Встановлення результату виконання та завершення процесу === Setting the execution result and completing the process -//У наступних задачах встановіть результат виконання процесу, використавши для цього сервісну задачу та делегат *Define business process status*, та закінчіть процес подією завершення (*End event*). In the following tasks, set the execution result of the process using a service task and the *Define business process status* delegate, and conclude the process with an End event. diff --git a/docs/en/modules/registry-develop/pages/best-practices/bp-timer-launch.adoc b/docs/en/modules/registry-develop/pages/best-practices/bp-timer-launch.adoc index 21c901c2b1..ca1c760bff 100644 --- a/docs/en/modules/registry-develop/pages/best-practices/bp-timer-launch.adoc +++ b/docs/en/modules/registry-develop/pages/best-practices/bp-timer-launch.adoc @@ -1,117 +1,85 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - -//= Запуск бізнес-процесу за таймером = Launching a business process by schedule -//TODO: I prefer the "by schedule" option of translation than "Lauching a business process by timer. Please advise which one you find more accurate. +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] + +include::platform:ROOT:partial$admonitions/language-en.adoc[] -//== Загальний опис == General overview -//Ця сторінка демонструє приклад реалізації та запуску бізнес-процесу, який автоматично активується відповідно до графіка, використовуючи Camunda BPM. Процес самостійно ініціюється у визначений час та виконує задачі відповідно до встановленої послідовності. -This page demonstrates an example of implementing and launching a business process that is automatically activated according to a schedule using Camunda BPM. The process initiates itself at a specified time and performs tasks according to a defined sequence. +This page demonstrates an example of implementing and launching a business process that is automatically activated according to a schedule using the *Timer* BPMN element. The process initiates itself at a specified time and performs tasks according to a defined sequence. -//Було створено референтний бізнес-процес, який має на меті допомогти розробникам та моделювальникам регламентів краще розуміти та ефективно використовувати таймери в Camunda BPM. -A reference business process has been created to help regulations developers and modelers to better understand and effectively use schedulers in Camunda BPM. -//TODO: I used the word "scheduler" instead of "timer" above to keep consistency with the title. +A reference business process has been created to help registry developers and modelers to better understand and effectively use timers. -//== Референтний приклад == Reference example -//TIP: Приклад _.bpmn_-моделі процесу ви можете знайти за назвою _automatic-external-system-data-saving.bpmn_ у регламенті демо-реєстру *_consent-data_* за посиланням: -TIP: You can find an example _.bpmn_ process model under the name _automatic-external-system-data-saving.bpmn_ in the demo registry *_consent-data_* by following this link: -https://admin-tools-consent-data.apps.envone.dev.registry.eua.gov.ua/gerrit. +[TIP] +==== +[%collapsible] +.Where can I find an example of a reference business process? +===== +include::partial$snippets/demo-reg-reference-examples-en.adoc[] + +An example of a BPMN process diagram will be available in the demo-registry's regulations by searching for the keywords -- *_automatic-external-system-data-saving_*. The names of the forms can be found inside the corresponding User Tasks of the business process in the *`Form key`* field. +===== +==== -//=== Короткий огляд компонентів процесу та їх призначення === Brief overview of process components and their purpose -//. Стартова подія з таймером (Start event) -- запускає бізнес-процес у встановлений час, щоденно з понеділка по п'ятницю о 8:00. -. Start Event with the timer -- initiates the business process at a set time, daily from Monday to Friday at 8:00. -//. Скрипт -- отримує дані зі зовнішньої системи та формує об'єкт для подальшого збереження. -. Script -- retrieves data from an external system and creates an object for further storage. -//. Підписання даних системним ключем -- гарантує, що дані, отримані від зовнішньої системи є автентичними та цілісними. -. Data signing with system key -- ensures that the data received from the external system is authentic and intact. -//. Створення сутності у БД -- зберігає отримані дані в базі даних. -. Entity creation in the database -- stores the received data in the database. -//. Встановлення статусу бізнес-процесу -- відображає успішне завершення бізнес-процесу. -. Setting the status of the business process -- indicates the successful completion of the business process. -//. Кінцева подія (End event) -- позначає завершення бізнес-процесу. -. End Event -- marks the end of the business process. - -//=== Моделювання +. *Start Event with the timer* -- initiates the business process at a set time, daily from Monday to Friday at 8:00. + +. *Script*—retrieves data from an external system and creates an object for further storage. + +. *Data signing with a system key* -- ensures that the data received from the external system is authentic and intact. + +. *Entity creation in the database* -- stores the received data in the database. + +. *Setting the business process status* -- indicates the successful completion of the business process. + +. *End Event* -- marks the end of the business process. + === Modeling -//. Увійдіть до [.underline]#Кабінету адміністратора регламентів#. -. Log in to the [.underline]#Regulations administrator portal#. -+ -//. Відкрийте розділ [.underline]#Моделі процесів#. -. Open the [.underline]#Process models# section. +. Log in to the *Administrative portal*. +. Open the *Process models* section. -. Створіть новий процес, вкажіть бізнес- та службову назву та перейдіть до вкладки [.underline]#Конструктор#. -//. Create a new process, specify the business and system names, and go to the [.underline]#Constructor# tab. +. Create a new business process. Enter business and service name for this process. Go to the *Builder* tab. + image:best-practices/bp-timer-launch/bp-timer-launch-1.png[] -+ -//. Змоделюйте пул для бізнес-процесу. + . Model a pool for the business process. + image:best-practices/bp-timer-launch/bp-timer-launch-2.png[] -+ -//. Створіть стартову подію (*Start event*) та виконайте наступні налаштування: + . Create a *Start event* starting event and perform the following settings: -. -+ -//* Введіть назву задачі. Наприклад, `Старт`. -* Enter the task name, for example, `Start`. -//* У розділі *Timer* встановіть розклад, за яким буде запускатися та виконуватися бізнес-процес. -* In the *Timer* section, set the schedule for starting and executing the business process. -+ -//** У полі *`Type`* (`Timer Definition Type`) вкажіть тип таймера -- *`Cycle`*. -** In the *`Type`* field (`Timer Definition Type`), specify the timer type - *`Cycle`*. + +.. Enter the task name, for example, `Start`. + +.. In the *Timer* section, set the schedule for starting and executing the business process. + +.. In the *Type* field (`Timer Definition Type`), specify the timer type - *Cycle*. + [TIP] ==== -//Опція *`Cycle`* дозволяє налаштувати повторювані процеси або події на основі певного інтервалу часу. Циклічний таймер може бути встановлений на рівні стартової, проміжної події або граничної події, що пов'язані з виконавцем завдань. -The *`Cycle`* option allows you to configure recurring processes or events based on a specific time interval. A cyclic timer can be set at the level of a start event, intermediate event, or boundary event associated with a task performer. +The *Cycle* option allows you to configure recurring processes or events based on a specific time interval. A cyclic timer can be set at the level of a start event, intermediate event, or boundary event associated with a task performer. -//Детальніше про типи таймерів -- див. на сторінці For more details on timer types, refer to xref:bp-modeling/bp/bpmn/events/timer-event.adoc[]. ==== -+ -//** У полі *`Value`* вкажіть розклад у певному форматі для запуску процесу. Наприклад, *`0 8 * * MON-FRI`*. -** In the *`Value`* field, specify the schedule in a specific format for process execution. For example, *`0 8 * * MON-FRI`*. + +.. In the *Value* field, specify the schedule in a specific format for process execution. For example, *`0 8 * * MON-FRI`*. + [TIP] ==== -//Ви можете налаштувати циклічний таймер, використовуючи стандартний формат *`ISO 8601`* для інтервалів повторень або `*cron*`-вираз. You can configure a cyclic timer using the standard *`ISO 8601`* format for repeat intervals or a `*cron*` expression. -//Приклади значень для формату ISO 8601: :: Examples of values for the ISO 8601 format: :: -+ -//* `R5/PT10S` -- кожні 10 секунд, до 5 разів. + * `R5/PT10S` -- every 10 seconds, up to 5 times. -//* `R/P1D` -- щодня, нескінченно. * `R/P1D` -- daily, indefinitely. -//Приклади значень для формату cron: :: Examples of values for the cron format: :: -+ + * `0 8 * * MON-FRI`: + -//0: хвилини (точно в 0 хвилин) -//8: години (ранку, 8:00) -//*: день місяця (будь-який день місяця) -//*: місяць (будь-який місяць) -//MON-FRI: день тижня (понеділок - п'ятниця) ---- 0: minutes (exactly at 0 minutes) 8: hours (8:00 in the morning) @@ -120,20 +88,14 @@ Examples of values for the cron format: :: MON-FRI: day of the week (Monday - Friday) ---- -//Таким чином, цей `cron`-вираз означає, що процес буде запускатися щодня з понеділка по п'ятницю о 8:00 ранку. Thus, the above `cron` expression means that the process will be triggered every day from Monday to Friday at 8:00 in the morning. * `0 0 9-17 * * MON-FRI`: -//Цей `cron`-вираз означає, що процес буде запускатися кожну годину з 9 до 17 години за UTC з понеділка по п'ятницю. This `cron` expression means that the process will be triggered every hour from 9 to 17 UTC time from Monday to Friday. - ==== -+ -//* Вкажіть ініціатора процесу як *`initiator`*. -* Specify the process initiator as *`initiator`*. - +.. Specify the process initiator as *`initiator`*. + [TIP] ==== @@ -141,31 +103,24 @@ This `cron` expression means that the process will be triggered every hour from .Що таке ініціатор? .What is an initiator? ===== -//*`"Start initiator = initiator"`* вказує на те, що значення ініціатора (тобто особи чи системи, яка розпочала процес) буде встановлено як *`initiator`*. + The phrase "*`Start initiator = initiator`*" indicates that the value of the initiator (i.e., the person or system that initiated the process) will be set as the initiator. -//У контексті бізнес-процесів, ініціатор -- це той, хто починає процес або відповідає за його запуск. Зазвичай, ініціатор -- це користувач, який викликає дію, або система, яка автоматично розпочинає процес. In the context of business processes, the initiator is the person who starts the process or is responsible for its initiation. Typically, the initiator is a user who triggers an action or a system that automatically initiates the process. -У цьому випадку, `initiator` може бути використаний для ідентифікації особи чи системи, що стартували процес, у подальших етапах бізнес-процесу або для контролю доступу до ресурсів. In this case, the term `initiator` can be used to identify the person or system that initiated the process in subsequent stages of the business process or for access control to resources. ===== ==== - + image:best-practices/bp-timer-launch/bp-timer-launch-3.png[] -+ -//. Створіть скрипт-задачу та використайте скрипт для отримання та обробки даних. Для цього відкрийте візуальний редактор коду (_детальніше про редактор коду -- на сторінці . Create a script task and use the script to retrieve and process data. To do this, open the visual code editor (_for more information about the code editor, refer to xref:registry-admin/admin-portal/registry-modeling/process-models/components/edit-groovy-scripts.adoc[]_). + -//У нашому прикладі дані отримуємо з іншої системи. ++ In our example, we retrieve data from another system. + image:best-practices/bp-timer-launch/bp-timer-launch-4.png[] - + -._Скрипт для отримання та обробки даних_ ._Script for data retrieval and processing_ [%collapsible] ==== @@ -191,10 +146,8 @@ payload.image = listFileObj set_variable('payload', S(payload, 'application/json')) ---- -//Скрипт отримує дані із зовнішньої системи, створює об'єкт *`payload`* з отриманими даними та зберігає його як змінну процесу для подальшого використання у наступних етапах бізнес-процесу, а саме: The script retrieves data from an external system, creates a *`payload`* object with the obtained data, and stores it as a process variable for further use in subsequent stages of the business process, namely: -//. Імпортує класи `java.text.SimpleDateFormat` та `java.util.Date` для роботи з датами: . Imports the `java.text.SimpleDateFormat` and `java.util.Date` classes for working with dates: + [source,groovy] @@ -202,16 +155,14 @@ The script retrieves data from an external system, creates a *`payload`* object import java.text.SimpleDateFormat; import java.util.Date; ---- -+ -//. Створює новий об'єкт SimpleDateFormat з форматом "dd_MM_yyyy" для форматування дати: + . Creates a new `SimpleDateFormat` object with the format "`dd_MM_yyyy`" for date formatting: + [source,groovy] ---- SimpleDateFormat date = new SimpleDateFormat("dd_MM_yyyy"); ---- -+ -//. Визначає URL-адресу зображення для завантаження: + . Defines the image URL for downloading: + @@ -219,163 +170,143 @@ SimpleDateFormat date = new SimpleDateFormat("dd_MM_yyyy"); ---- String url = 'https://wallpapercave.com/wp/wp2601438.jpg'; ---- -+ -//. Генерує ім'я файлу на основі поточної дати, додаючи префікс `'file_'` та розширення `'.jpeg'`: -. Generates a file name based on the current date, adding the prefix '`file_`' and the extension _.jpeg_: +. Generates a file name based on the current date, adding the prefix '`file_`' and the extension _.jpeg_: + [source,groovy] ---- String fileName = 'file_'.concat(date.format(new Date())).concat('.jpeg'); ---- -+ -//. Викликає функцію *`save_digital_document_from_url(url, fileName)`* для збереження цифрового документа (зображення) із заданою URL-адресою та іменем файлу: -. Calls the function *`save_digital_document_from_url(url, fileName)`* to save the digital document (image) with the specified URL and file name: +. Calls the function *`save_digital_document_from_url(url, fileName)`* to save the digital document (image) with the specified URL and file name: + [source,groovy] ---- def documentMetadata = save_digital_document_from_url(url, fileName); ---- -+ -//. Створює порожній словник payload та список `listFileObj` для побудови JSON-структури даних: -. Creates an empty payload dictionary and a list `listFileObj` for constructing the JSON data structure: +. Creates an empty payload dictionary and a list `listFileObj` for constructing the JSON data structure: + [source,groovy] ---- def payload = [:]; def listFileObj = []; ---- -+ -//. Присвоює згенероване ім'я файлу полю name словника *`payload`*: -. Assigns the generated file name to the name field of the *`payload`* dictionary: +. Assigns the generated file name to the name field of the *`payload`* dictionary: + [source,groovy] ---- payload.name = fileName; ---- -+ -//. Створює новий порожній словник `fileObj`: -. Creates a new empty dictionary `fileObj`: +. Creates a new empty dictionary `fileObj`: + [source,groovy] ---- def fileObj = [:]; ---- -+ -//. Присвоює *`id`* та *`checksum`* з метаданих документа відповідним полям словника `fileObj`: -. Assigns the *`id`* and *`checksum`* from the document metadata to the respective fields of the fileObj dictionary: +. Assigns the *`id`* and *`checksum`* from the document metadata to the respective fields of the fileObj dictionary: + [source,groovy] ---- fileObj.id = documentMetadata.id; fileObj.checksum = documentMetadata.checksum; ---- -+ -//. Додає `fileObj` до списку `listFileObj`: -. Adds `fileObj` to the list `listFileObj`: +. Adds `fileObj` to the list `listFileObj`: + [source,groovy] ---- listFileObj << fileObj; ---- -+ -//. Присвоює список `listFileObj` полю `image` словника `payload`: -. Assigns the list `listFileObj` to the image field of the `payload` dictionary: +. Assigns the list `listFileObj` to the image field of the `payload` dictionary: + [source,groovy] ---- payload.image = listFileObj; ---- -+ -//. Встановлює змінну '`payload`' зі значенням словника `payload`, перетвореного на JSON-рядок, для використання у подальших кроках бізнес-процесу: -. Sets the variable '`payload`' with the value of the payload dictionary converted to a JSON string for use in subsequent steps of the business process. +. Sets the variable '`payload`' with the value of the payload dictionary converted to a JSON string for use in subsequent steps of the business process. + [source,groovy] ---- set_variable('payload', S(payload, 'application/json')); ---- ==== -+ -//. Змоделюйте сервісну задачу (Service Task) для підпису даних системним ключем. + . Model a Service Task for data signing with a system key. + +.. Use the delegate *System signature by DSO service* from the template catalog for applying the system signature. + +.. Pass the input data as the variable `${payload}` in the corresponding field. + +.. Pass the user token. You can do this using the JUEL function *`system_user()`* and the *`accessToken`* method. For example, `${system_user().accessToken`}. It can be further used in integration connectors for integration on behalf of the user. + -//Налаштування: :: -Settings: :: - -//* Використовуйте делегат *System signature by DSO service* із каталогу шаблонів для накладання системного підпису. -* Use the delegate *System signature by DSO service* from the template catalog for applying the system signature. -//* Вхідні дані передайте як змінну *`${payload}`* у відповідному полі. -* Pass the input data as the variable `${payload}` in the corresponding field. -//* Передайте токен користувача. Ви можете це зробити через JUEL-функцію *`system_user()`* та метод *`accessToken`*. Наприклад, `${system_user().accessToken`. Його надалі можна використовувати в інтеграційних конекторах для інтеграції від імені користувача. -* Pass the user token. You can do this using the JUEL function *`system_user()`* and the *`accessToken`* method. For example, `${system_user().accessToken`}. It can be further used in integration connectors for integration on behalf of the user. -+ -//Ви можете також використати токен ініціатора процесу. Наприклад, `${initiator().accessToken`. You can also use the process initiator's token. For example, `${initiator().accessToken}`. + -//TIP: Детальніше див. на сторінці TIP: For more details, refer to xref:bp-modeling/bp/modeling-facilitation/modelling-with-juel-functions.adoc[]. -//* Відповідь запишіть у змінну. Наприклад, `*system_signature_key*`. -* Save the response in a variable. For example, *`system_signature_key`*. +. Save the response in a variable. For example, *`system_signature_key`*. + image:best-practices/bp-timer-launch/bp-timer-launch-5.png[] -+ -//. Збережіть дані до БД. Створіть новий запис у базі даних, зберігши значення об'єкта *`entityLocation`* до відповідної колонки. . Save data to the database. Create a new record in the database, storing the value of the *`entityLocation`* object in the respective column. -+ -//* Використовуйте делегат *Create entity in data factory*, щоб створити сутність у базі даних. -* Use the *Create entity in data factory* delegate to create an entity in the database. + +.. Use the *Create entity in data factory* delegate to create an entity in the database. + [TIP] ==== -//Альтернативно ви можете використовувати загальний інтеграційний конектор *Connect to data factory*. Детальніше про інтеграційні розширення до бізнес-процесів див. на сторінці Alternatively, you can use the general integration connector *Connect to data factory*. For more information about integration extensions for business processes, refer to -xref:bp-modeling/bp/element-templates/bp-element-templates-installation-configuration.adoc[]. +xref:bp-modeling/bp/element-templates/service-task-templates/connect-to-data-factory.adoc[]. ==== -+ -//* Вкажіть ресурс/API-ендпоінт. Наприклад, *`test-entity`*, що відповідає назві таблиці, яку ви визначили при створенні моделі даних реєстру -- *`test_entity`*. -* Specify the resource/API endpoint. For example, *`test-entity`*, which corresponds to the table name you defined when creating the data model registry -- *`test_entity`*. -+ -//* Вхідні дані передайте як змінну *`${payload}`* у відповідному полі. -* Pass the input data as the *`${payload}`* variable in the corresponding field. -//* Передайте токен користувача. Ви можете це зробити через JUEL-функцію *`system_user()`* та метод *`accessToken`*. Наприклад, `${system_user().accessToken`. -* Pass the user token. You can do this using the JUEL function *`system_user()`* and the *`accessToken`* method. For example, *`${system_user().accessToken}`*. -//* Вкажіть *`X-Digital-Signature source`* -- джерело системного підпису. Наприклад, *`${system_signature_key}`*. -* Specify the *`X-Digital-Signature source`* -- the source of the system signature. For example, *`${system_signature_key}`*. -//* Вкажіть *`X-Digital-Signature-Derived source`* -- ключ Ceph-документа, який містить інформацію про підписані дані. Наприклад, *`${system_signature_key}`*. -* Specify the *`X-Digital-Signature-Derived source`* -- the Ceph document key that contains information about the signed data. For example, *`${system_signature_key}`*. -//* Запишіть відповідь до змінної результату, наприклад, `response`. -* Save the response to a result variable, for example, `response`. + +.. Specify the resource/API endpoint. For example, *`test-entity`*, which corresponds to the table name you defined when creating the data model registry -- *`test_entity`*. + +.. Pass the input data as the *`${payload}`* variable in the corresponding field. + +.. Pass the user token. You can do this using the JUEL function *`system_user()`* and the *`accessToken`* method. For example, *`${system_user().accessToken}`*. + +.. Specify the *`X-Digital-Signature source`* -- the source of the system signature. For example, *`${system_signature_key}`*. + +.. Specify the *`X-Digital-Signature-Derived source`* -- the Ceph document key that contains information about the signed data. For example, *`${system_signature_key}`*. + +.. Save the response to a result variable, for example, `response`. + image:best-practices/bp-timer-launch/bp-timer-launch-6.png[] -+ -//. Встановіть статус бізнес-процесу, що відображатиме успішне завершення бізнес-процесу. Для цього створіть сервісну задачу (*Service Task*) і застосуйте делегат *Define business process status*. . Set the status of the business process to reflect a successful completion of the business process. To do this, create a Service Task and apply the *Define business process status* delegate. -+ -//. Завершіть процес за допомогою *End Event*. + . Finish the process using the *End Event*. -+ -//. Застосуйте внесені зміни до майстер-гілки, щоб опублікувати процес у регламенті. + . Apply the made changes to the master branch to publish the process in the schedule. + -//TIP: Див. детальніше -- на сторінці TIP: For more details, see xref:registry-admin/admin-portal/version-control/overview-new-change-request.adoc[]. -//== Використання у Кабінеті користувача -== Use within the User portal +== Use within the user portal + +The business process modeled and published by the schedule becomes accessible in the *Officer Portal*. + +This process can be found in the *Available services* > *Reference business processes* section. It will be launched and executed according to the established schedule in a *Timer* event. + +[TIP] +==== +The Officer portal is available via the pattern link: + +---- +https://officer-portal--main. +---- + +where `` is the name for your registry and `` designates the domain and subdomain names for the cluster instance. + +For example, for the `demo-registry`, deployed on the `example.com` Platform instance, the route to the *Officer Portal* service is: + +https://officer-portal-demo-registry-main.example.com -//Бізнес-процес, який було змодельовано та опубліковано в регламенті, стає доступним у Кабінеті посадової особи за посиланням `https://officer-portal-<назва-реєстру>.apps.<назва-кластера>.dev.registry.eua.gov.ua`. Цей процес можна знайти у розділі [.underline]#Доступні послуги > Референтні бізнес-процеси#. Він буде запускатися та виконуватися відповідно до встановленого графіку. -The business process that has been modeled and published in the schedule becomes accessible in the Officer Portal via the link _https://officer-portal-.apps..dev.registry.eua.gov.ua_. This process can be found in the [.underline]#Available Services > Reference business processes# section. It will be launched and executed according to the established schedule. \ No newline at end of file +//https://officer-portal-{{{registry-name}}}-main.{{{dns-wildcard}}} +==== \ No newline at end of file diff --git a/docs/en/modules/registry-develop/pages/best-practices/bp-upload-edit-file.adoc b/docs/en/modules/registry-develop/pages/best-practices/bp-upload-edit-file.adoc index fc6a524ae9..941e6d82c6 100644 --- a/docs/en/modules/registry-develop/pages/best-practices/bp-upload-edit-file.adoc +++ b/docs/en/modules/registry-develop/pages/best-practices/bp-upload-edit-file.adoc @@ -87,7 +87,7 @@ The initial table filling with data uses the PL/pgSQL database procedure. //* Детальний опис процедури для первинного завантаження даних читайте на сторінці xref:data-modeling/initial-load/data-initial-data-load-pl-pgsql.adoc[]. * Also see xref:study-project/study-tasks/task-1-registry-db-modeling.adoc[] for practical application of the initial loading when modeling the regulations. -//* Також перегляньте xref:study-project/study-tasks/task-1-registry-db-modeling.adoc[] для ознайомлення із практичним застосуванням первинного завантаження при моделюванні регламенту. +//* Також перегляньте xref:study-project/study-tasks/task-registry-update-registry-db-modeling.adoc[] для ознайомлення із практичним застосуванням первинного завантаження при моделюванні регламенту. ==== . Model your own business process using the following example. diff --git a/docs/en/modules/registry-develop/pages/best-practices/edit-grid-rows-action.adoc b/docs/en/modules/registry-develop/pages/best-practices/edit-grid-rows-action.adoc index b70c2c1e7b..0f4f1d1eca 100644 --- a/docs/en/modules/registry-develop/pages/best-practices/edit-grid-rows-action.adoc +++ b/docs/en/modules/registry-develop/pages/best-practices/edit-grid-rows-action.adoc @@ -1,41 +1,32 @@ -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Selecting and acting on one or multiple rows in a table +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] + +include::platform:ROOT:partial$admonitions/language-en.adoc[] == Data structure modeling -//Створіть модель даних реєстру за прикладом нижче. Create a data model for the registry based on the example below. [TIP] ==== -//Приклад _.xml_-схем та пов'язаних CSV-файлів для створення моделі даних ви можете знайти у регламенті демо-реєстру *_consent-data_* за посиланням: -Example .xml schemas and associated CSV files for creating a data model can be found in the demo registry *_consent-data_* regulations at the following link: -https://admin-tools-consent-data.apps.envone.dev.registry.eua.gov.ua/gerrit. +[%collapsible] +.Where can I find reference data modeling examples? +===== +include::partial$snippets/demo-reg-reference-examples-en.adoc[] + +Examples of _.xml_ schemas and associated CSV files for creating a data model can be found in the demo registry's regulations by searching with keywords. -//Схема для створення таблиць та критеріїв пошуку буде доступна за назвою *_licenseTable.xml_*. -The schema for creating tables and search conditions will be available under the name *_licenseTable.xml_*. +The schema for creating tables and search criteria will be available under the name *_licenseTable.xml_*. -//Файл-довідник CSV із даними для імпорту в БД буде доступний за назвою *_licences.csv_*. -The CSV reference file with data for importing into the database will be available under the name *_licenses.csv_*. +The reference CSV file with data for importing into the database will be available under the name *_licences.csv_*. -//Файл для заповнення таблиці licences даними буде доступний за назвою *_populateLicenses.xml_*. -The file for populating the licenses table with data will be available under the name *_populateLicenses.xml_*. +The file to populate the `licences` table with data will be available under the name *_populateLicenses.xml_*. +===== ==== -//. Створіть новий тип даних, таблицю та критерій пошуку. . Create a new data type, table, and search conditions. + -//Ця модель даних створює новий користувацький тип даних та таблицю, а також визначає критерій пошуку. This data model creates a new user-defined data type and table, as well as it defines the search condition. - + ._Базова модель даних для нашого прикладу_ ._Basic data model for our example_ @@ -93,19 +84,10 @@ This data model creates a new user-defined data type and table, as well as it de ---- ==== + -//Створюється користувацький тип даних *`license_status`* з двома можливими значеннями: "діюча" (`active`) та "анульована" (`canceled`). A custom data type called *`license_status`* is being created with two possible values: "`active`" and "`canceled`". + -//Створюється нова таблиця *`licenses`* з наступними стовпцями: A new table called *`licenses`* is being created with the following columns: -//* *`license_id`*: унікальний ідентифікатор ліцензії (`UUID`). -//* *`number`*: номер ліцензії (текстовий формат). -//* *`date_received`*: дата отримання ліцензії (формат дати). -//* *`date_terminated`*: дата припинення ліцензії (формат дати). -//* *`full_name`*: повне ім'я власника ліцензії (текстовий формат). -//* *`licensing_status`*: статус ліцензії (тип даних `license_status`). - * *`license_id`*: unique identifier for the license (`UUID`). * *`number`*: license number (text format). * *`date_received`*: date when the license was received (date format). @@ -113,31 +95,21 @@ A new table called *`licenses`* is being created with the following columns: * *`full_name`*: full name of the license owner (text format). * *`licensing_status`*: license status (of type `license_status`). + -//Створюється критерій пошуку (Search condition) із назвою *`search_licenses_by_status`*, який дозволяє здійснювати пошук ліцензій у таблиці *`licenses`* за їх статусом. У цій умові пошуку передбачено, що значення стовпця *`licensing_status`* повинно бути рівним значенню, заданому при пошуку (*`searchType="equal"`*). A search condition named *`search_licenses_by_status`* is being created, which allows searching for licenses in the *`licenses`* table based on their status. This search condition assumes that the value of the *`licensing_status`* column should be equal to the specified search value (*`searchType="equal"`*). [start=2] -//. Підготуйте файл-довідник CSV із даними для імпорту в БД. . Prepare a CSV reference file with data for importing into the database. + -//Цей файл-довідник CSV містить дані про ліцензії, які можуть бути завантажені до бази даних (таблиці "licenses"). У файлі представлені наступні стовпці: This CSV reference file contains data about licenses that can be loaded into the database (table "licenses"). The file contains the following columns: -+ -//* *`number`*: номер ліцензії. -//* *`licensing_status`*: статус ліцензії (діюча або анульована). -//* *`date_received`*: дата отримання ліцензії. -//* *`date_terminated`*: дата припинення дії ліцензії. -//* *`full_name`*: повне ім'я власника ліцензії (організація або фізична особа). + * *`number`*: license number. * *`licensing_status`*: license status (active or canceled). * *`date_received`*: date when the license was received. * *`date_terminated`*: date when the license was terminated. * *`full_name`*: full name of the license owner (organization or individual). + -//Ці дані можуть бути імпортовані в таблицю *`licenses`* бази даних. These data can be imported into the *`licenses`* table of the database. -+ -//. Імпортуйте дані з файлу-довідника CSV за допомогою виклику функції завантаження даних до БД -- *`CALL p_load_table_from_csv()`*. Для цього створіть окремий файл *_populateLicences.xml_*, в якому вкажіть наступну структуру: + . Import the data from the CSV reference file using the data loading function call to the database: *`CALL p_load_table_from_csv()`*. To do this, create a separate file named *_populateLicences.xml_* with the following structure: + [source,xml] @@ -151,62 +123,41 @@ These data can be imported into the *`licenses`* table of the database. ---- + -//Ця функція використовує вбудований механізм Liquibase для імпорту даних з CSV-файлу в таблицю бази даних. Використовуються наступні компоненти: This function uses the built-in Liquibase mechanism to import data from a CSV file into a database table. The following components are used: -//* *``*: встановлює значення змінної dataLoadPath, яка вказує шлях до каталогу з файлами CSV для завантаження даних. * *``*: sets the value of the `dataLoadPath` variable, which specifies the path to the directory containing CSV files for data loading. -//* *``*: описує зміни, які слід застосувати до бази даних. В цьому випадку -- виклик функції *`p_load_table_from_csv()`* для імпорту даних з CSV-файлу в таблицю *`licenses`*. * *``*: describes the changes to apply to the database. In this case, it's a call to the *`p_load_table_from_csv()`* function to import data from the CSV file into the *`licenses`* table. -//* *``*: описує SQL-запит, який викликає функцію `p_load_table_from_csv`. Запит включає ім'я таблиці `licenses`, шлях до CSV-файлу (використовуючи змінну `${dataLoadPath}`), та масив зі стовпцями, які слід імпортувати з файлу. * *``*: describes the SQL query that invokes the `p_load_table_from_csv` function. The query includes the name of the `licenses` table, the path to the CSV file (using the `${dataLoadPath}` variable), and an array of columns to import from the file. -//TIP: Детальніше про створення моделі та завантаження даних до реєстру ви можете переглянути у розділах xref:data-modeling/data/physical-model/overview.adoc[] та xref:data-modeling/initial-load/data-initial-data-load-pl-pgsql.adoc[]. TIP: For more information on creating a data model and loading data into the registry, please refer to xref:data-modeling/data/physical-model/overview.adoc[] and xref:data-modeling/initial-load/data-initial-data-load-pl-pgsql.adoc[]. -//== Референтний бізнес-процес == Reference business process -//=== Створення пулів для процесів === Creating pools for processes -//Це комплексний бізнес-процес, який складається з основного процесу та підпроцесів, які він викликає. This is a complex business process consisting of a main process and subprocesses that it invokes. -//BPMN-діаграма містить основний процес та два підпроцеси, які ініціюються основним через *Call Activity*. Ці підпроцеси є подібними та відрізняються лише назвами задач та порядком їх виконання. The BPMN diagram includes the main process and two subprocesses initiated by the main process through a *Call Activity*. These subprocesses are similar and differ only in the names of tasks and their execution order. -//У нашому прикладі розглянемо основний процес, а також коротко один із підпроцесів -- анулювання ліцензії. In our example, we will examine the main process and briefly discuss one of the subprocesses -- license cancellation. [TIP] ==== -//Приклад _.bpmn_-моделі процесу із виконанням дії над багатьма рядками таблиці, а також користувацькі _.json_-форми до нього ви можете знайти у регламенті демо-реєстру *_consent-data_* за посиланням: -You can find an example _.bpmn_ model of the process with multiple row table action and its corresponding custom _.json_ forms in the demo registry regulation at the following link: -https://admin-tools-consent-data.apps.envone.dev.registry.eua.gov.ua/gerrit. - -//Процес буде доступний за назвою *_edit-grid-rows-action.bpmn_*. Назви форм ви можете знайти всередині відповідних користувацьких задач бізнес-процесу у полі *`Form key`*. -The process will be available under the name *_edit-grid-rows-action.bpmn_*. The form names can be found inside the respective user tasks of the business process in the *`Form key`* field. +[%collapsible] +.Where can I find an example of a reference business process? +===== +include::partial$snippets/demo-reg-reference-examples-en.adoc[] -//Споріднена модель процесу із виконанням дії над одним рядком таблиці буде доступний за назвою *_bp-action-one-row-grid.bpmn_*. -The related model of the process with single row table action will be available under the name *_bp-action-one-row-grid.bpmn_*. +An example of a BPMN process diagram will be available in the demo-registry's regulations by searching for the keywords -- *_edit-grid-rows-action_*. The names of the forms can be found inside the corresponding User Tasks of the business process in the *`Form key`* field. +===== ==== -//=== Вибір усіх органів ліцензування з БД через критерій пошуку === Selecting all licensing authorities from the database using search condition -//Змоделюйте сервісну задача (Service Task) та використайте делегат *Search entities in data factory*. Model a Service Task and utilize the delegate *Search entities in data factory*. -//На основі створеної моделі даних, ця задача відповідає за пошук та вибірку ліцензій з таблиці *`licenses`*. Таблиця *`licenses`* містить наступні стовпці: Based on the created data model, this task is responsible for searching and selecting licenses from the *`licenses`* table. The *`licenses`* table contains the following columns: -//* `license_id` -- унікальний ідентифікатор ліцензії (`UUID`). -//* `number` -- номер ліцензії (`TEXT`). -//* `date_received` -- дата отримання ліцензії (`DATE`). -//* `date_terminated` -- дата припинення ліцензії (`DATE`). -//* `full_name` -- повне ім'я органу ліцензування (`TEXT`). -//* `licensing_status` -- статус ліцензії (тип даних `license_status`). * `license_id`: unique identifier of the license (`UUID`). * `number`: license number (`TEXT`). * `date_received`: date of license issuance (`DATE`). @@ -214,54 +165,40 @@ Based on the created data model, this task is responsible for searching and sele * `full_name`: full name of the licensing authority (`TEXT`). * `licensing_status`: license status (data type: `license_status`). -//Тип даних *`license_status`* є переліком з двома можливими значеннями: The *`license_status`* data type is an enumeration with two possible values: -//* *`active`* (чинна) -- ліцензія є дійсною. -//* *`canceled`* (анульована) -- ліцензія скасована. * *`active`*: the license is valid. * *`canceled`*: the license is canceled. -//Поточна задача використовує умову пошуку (Search condition) *`search_licenses_by_status`*, яка дозволяє фільтрувати ліцензії в таблиці *`licenses`* за статусом ліцензування. У цьому випадку, задача шукає ліцензії зі статусом *`active`* (чинні). The current task uses the search condition *`search_licenses_by_status`* to filter licenses in the *`licenses`* table based on their licensing status. In this case, the task searches for licenses with the status *`active`*. -//Таким чином, сервісне завдання виконує пошук активних ліцензій у таблиці *`licenses`* на основі визначених умов пошуку, передаючи системний токен доступу для авторизації запиту до бази даних. Thus, the service task performs a search for active licenses in the *`licenses`* table based on the defined search conditions, passing the system access token for query authorization to the database. -//Параметри які використовуються для налаштування та отримання результатів пошуку: :: The parameters used for configuration and obtaining search results are as follows: :: -//. У секції *Inputs* встановіть вхідний параметр *`resource`* як *`search-licenses-by-status`* для визначення ресурсу/API-ендпоінту, який слід використати для пошуку. . In the *Inputs* section, set the input parameter *`resource`* as *`search-licenses-by-status`* to determine the resource/API endpoint to be used for the search. + -//TIP: Тут ендпоінт `search-licenses-by-status` генерується на базі критерію пошуку `search_licenses_by_status`, визначеного у моделі даних. TIP: Here, the endpoint `search-licenses-by-status` is generated based on the search criterion `search_licenses_by_status` defined in the data model. + -//. У секції *Inputs > Search variables* передайте параметри пошуку, які необхідно застосувати, як ключі-значення (*`Map`*): . In the *Inputs > Search variables* section, provide the search parameters to be applied as key-value pairs (*`Map`*): * `Key: *licensingStatus*` * `Value: *active*` + -//У цьому випадку, ми шукаємо ліцензії зі статусом *`active`*. In this case, we are searching for licenses with the status *`active`*. + -//. У секції *Inputs > X-Access-Token* передайте системний токен доступу для авторизації запита до бази даних: . In the *Inputs > X-Access-Token* section, pass the system access token for query authorization to the database: + ---- ${system_user().accessToken} ---- + -//. У секції *Outputs > Result variable* встановіть вихідний параметр як змінну *`licensesResponse`*, до якої зберігатиметься відповідь від бази даних для подальшого використання. . In the *Outputs > Result variable* section, set the output parameter as the variable *`licensesResponse`*, which will store the response from the database for further use. image:best-practices/edit-grid-rows-action/edit-grid-rows-action-1.png[] -//=== Скрипт підготовки даних для відображення на формі у табличному вигляді === Data preparation script for displaying in tabular form -//Змоделюйте сервісну задачу та використайте наступний groovy-скрипт. Model the service task and use the following Groovy script. image:best-practices/edit-grid-rows-action/edit-grid-rows-action-2.png[] @@ -279,73 +216,50 @@ def licenses = licensesResponse.responseBody.elements() ---- ==== -//Цей скрипт виконує наступні дії: This script performs the following actions: -//. Витягує список ліцензій з відповіді *`licensesResponse.responseBody.elements()`*. Змінна *`licenses`* містить список активних ліцензій, отриманих від попереднього сервісного завдання. . Extracts the list of licenses from the response *`licensesResponse.responseBody.elements()`*. The variable *`licenses`* contains the list of active licenses obtained from the previous service task. -+ -//. Створює новий об'єкт JSON *`payload`* з порожнім словником. + . Creates a new JSON object *`payload`* with an empty dictionary. -+ -//. Додає до об'єкта JSON *`payload`* список ліцензій, отриманий на першому кроці, під ключем *`licenses`*. + . Adds the list of licenses obtained in the first step to the JSON object *`payload`*, under the key *`licenses`*. -+ -//. Зберігає JSON об'єкт *`payload`* у транзієнтну змінну (тимчасову змінну, яка існує лише під час виконання процесу) з назвою *`payload`*. + . Stores the JSON object *`payload`* in a transient variable (a temporary variable that exists only during the process execution) named *`payload`*. -//=== Обрання дії над даними в одному рядку таблиці === Performing an action on data in a single row of a table -//Змоделюйте користувацьку задачу (User Task) та поєднайте її з відповідною UI-формою за ключем *`Form key`*. Model a User Task and associate it with the corresponding UI form using the *`Form key`* key. -//Основна мета цієї форми -- дозволити користувачу обрати дію, яку він хоче виконати над даними у певному рядку таблиці за допомогою компонента *Edit Grid* (змінити дату або анулювати ліцензію). The main goal of this form is to allow the user to select an action to perform on the data in a specific row of a table using the *Edit Grid* component (such as changing the date or canceling a license). -//Виконайте наступні налаштування: :: Perform the following configurations: :: -//. У полі *`Name`* введіть назву користувацької задачі. . In the *Name* field, enter the name of the User Task. -//. Застосуйте шаблон делегата -- *`User Form`*. . Apply the delegate template -- *`User Form`*. -//. У полі *`ID`* введіть ідентифікатор задачі -- *`defineActionActivity`*. . In the *`ID`* field, enter the task identifier -- *`defineActionActivity`*. -//. У полі *`Form key`* визначте ключ для поєднання із відповідною змодельованою формою бізнес-процесу -- *`feature-edit-grid-rows-action-define`*. . In the *`Form key`* field, define the key to connect with the corresponding modeled form of the business process -- *`feature-edit-grid-rows-action-define`*. -//. У полі `Assignee` вкажіть змінну для особи, якій призначається поточна задача, -- *`${initiator}`*. . In the *Assignee* field, specify the variable for the person assigned to the current task -- *`${initiator}`*. -//. У полі *`Form data pre-population`* передайте дані на UI-форму як змінну ${payload}. . In the *`Form data pre-population`* field, pass the data to the UI form as the variable *`${payload}`*. - image:best-practices/edit-grid-rows-action/edit-grid-rows-action-3.png[] -//=== Моделювання XOR-шлюзу та додавання логіки через вирази умови === Modeling an XOR gateway and adding logic through condition expressions -//Змоделюйте XOR-шлюз, який визначає, який з підпроцесів слід викликати на основі *`action codes`*, обраних на попередній формі. Model an XOR Gateway that determines which subprocess to call based on the *`action codes`* selected on the previous form. -//TIP: Action codes -- кнопки у контекстному меню "Три крапки", змодельовані на UI-формі за допомогою елемента *`Edit Grid`*. TIP: Action codes are buttons in the context menu (three dots), modeled on the UI form using the *`Edit Grid`* element. image:best-practices/edit-grid-rows-action/edit-grid-rows-action-4.png[] [NOTE] ==== -//Якщо на формі *`defineActionActivity`* обрано чекбокс з декількома рядками (записами) таблиці, то для кожного з цих рядків запуститься підпроцес відповідно до обраної кнопки на UI-формі (у цьому контексті це мають бути _окремі кнопки_, змодельовані через компонент *Button*). Запуск підпроцесу для кожного з обраних рядків можливий завдяки функції мультиекземпляра *`Multi-instance`* (_див.xref:#call-activity-cancel[]_). If the multiple rows (records) checkbox is selected on the *`defineActionActivity`* form, a subprocess will be triggered for each of these rows according to the selected button on the UI form (in this context, these should be _separate buttons_ modeled using the *Button* component). Launching a subprocess for each selected row is made possible by the *`Multi-instance`* feature (see _xref:#call-activity-cancel[]_ ). -//Якщо ви обрали контекстне меню "Три крапки" навпроти певного рядка, то відповідний підпроцес запуститься лише для даних цього рядка. Який саме підпроцес запуститься -- регулюється логікою кодів дії (action codes), змодельованих на формі у компоненті *Edit Grid*. Тобто контекстне меню "Три крапки" дозволяє обрати логіку виконання дії над одним рядком таблиці. If you select the context menu (three dots) next to a specific row, the corresponding subprocess will only be triggered for the data in that row. The specific subprocess to be launched is controlled by the action code logic, modeled on the *Edit Grid* component. In other words, the context menu (three dots) allows you to choose the execution logic for an individual row of the table. ==== -//Залежно від дії, визначеної в action codes (у нашому прикладі ми оновлюємо дані лише по одному рядку на формі, тому використовуємо лише action codes через контекстне меню), основний процес ініціює один з наступних підпроцесів через *Call Activity*: Depending on the action defined in the action codes (in our example, we only update data for one row on the form, so we only use action codes through the context menu), the main process initiates one of the following subprocesses through the *Call Activity*: -//. Процес "Зміна дати терміну дії ліцензії", якщо введений action code відповідає наступній умові: . The `Change license expiry date process` if the entered action code satisfies the following condition: + [source,juel] @@ -354,8 +268,7 @@ ${submission('defineActionActivity').formData.hasProp('_action_code') && submiss ---- + image:best-practices/edit-grid-rows-action/edit-grid-rows-action-4-1.png[] -+ -//. Процес "Скасування ліцензії", якщо введений action code відповідає наступній умові: + . `License Cancellation` process if the entered action code satisfies the following condition: + [source,juel] @@ -365,98 +278,78 @@ ${submission('defineActionActivity').formData.hasProp('_action_code') && submiss + image:best-practices/edit-grid-rows-action/edit-grid-rows-action-4-2.png[] -//Після виклику відповідного підпроцесу за допомогою Call Activity, основний процес продовжується до кінцевої події. Далі розглянемо потік із викликом підпроцесу для скасування ліцензії. After calling the corresponding subprocess using the Call Activity, the main process continues to the final event. Next, we will discuss the flow with the cancellation subprocess call. [#call-activity-cancel] -//=== Call Activity для виклику підпроцесу скасування ліцензії === Call Activity for the license cancellation subprocess -//Цей Call Activity виконує процес з іменем *`license-cancellation`* для кожного елемента в колекції даних, яка вказана в `multiInstanceLoopCharacteristics`. Тобто якщо на формі з Edit Grid ви обрали чекбокс на одному і більше записів, то при використанні функції Multi-instance, підпроцес запуститься для кожного з таких записів. This Call Activity executes a process named *`license-cancellation`* for each item in the data collection specified in `multiInstanceLoopCharacteristics`. This means that if you select the checkbox on one or more records in the Edit Grid form, using the Multi-instance feature, the subprocess will be triggered for each of those records. [NOTE] ==== -//Зверніть увагу, що коли обрано чекбокс дії над одним і більше рядком таблиці, дані з форми мають надсилатися до процесу за action-кодами, які змодельовані на UI-формі через компонент *Button*. Note that when the checkbox for multiple rows in the table is selected, the data from the form should be sent to the process based on the action codes modeled on the UI form using the *Button* component. -//Детальніше про це див. у розділі For more details, see xref:#modeling-forms[]. ==== [TIP] ==== -//Детальніше про Call Activity та особливості їх застосування ви можете переглянути на сторінках: For more details on Call Activity and its application features, you can review the following pages: -* xref:bp-modeling/bp/element-templates/bp-element-templates-installation-configuration.adoc[] -* xref:bp-modeling/bp/bpmn/subprocesses/overview.adoc[] +* xref:bp-modeling/bp/element-templates/call-activities/call-activities-overview.adoc[] +* xref:bp-modeling/bp/bpmn/subprocesses/subprocess-overview.adoc[] ==== -//Виконайте наступні налаштування: :: Perform the following configurations: :: + -//. У секції *Multi-instance* > *`Collection`* введіть значення: . In the *Multi-instance* > *`Collection`* section, enter the value: + ---- ${submission('defineActionActivity').formData.prop('licenses').elements()} ---- + -//. Для *Multi-instance* > *`Element variable`* вкажіть змінну *`license`*. . For *Multi-instance* > *`Element variable`*, specify the variable *`license`*. + [NOTE] ==== -//Це означає, що Call Activity буде виконана для кожного елемента в колекції даних, який повертається функцією *`${submission('defineActionActivity').formData.prop('licenses').elements()}`*. Кожен елемент цієї колекції буде збережений до визначеної змінної *`license`*. This means that the Call Activity will be performed for each element in the data collection returned by the function ${submission('defineActionActivity').formData.prop('licenses').elements()}. Each element of this collection will be stored in the defined variable license. -//Використання функції *`Multi-instance`* також показано на прикладі The use of the Multi-instance feature is also demonstrated in the example xref:registry-admin/user-notifications/email/e-mail-notification.adoc[]. ==== -+ -//. У полі *`Called element`* вкажіть ідентифікатор (Process ID) підпроцесу, який необхідно викликати та запустити. У нашому випадку -- це *`license-cancellation`*. + . In the *`Called element`* field, specify the identifier (Process ID) of the subprocess to be called and executed. In our case, it is *`license-cancellation`*. -+ -//. Для поля *`Asynchronous continuation`* вкажіть значення *`Before`*. Це означає, що ця активність буде виконана асинхронно. Асинхронне виконання починається перед виконанням самого Call Activity, тобто "асинхронно перед". + . For the *`Asynchronous continuation`* field, specify the value *`Before`*. This means that this activity will be performed asynchronously. Asynchronous continuation starts before the execution of the Call Activity itself, meaning "asynchronously before." + [TIP] ==== -.Що таке Asynchronous continuation? .What is Asynchronous continuation? [%collapsible] ===== -//*Asynchronous continuation* у Call Activity в Camunda BPM -- це механізм, що дозволяє виконати активність асинхронно відносно основного потоку процесу. Це означає, що активність (у цьому випадку Call Activity) може бути виконана пізніше, не затримуючи виконання наступних елементів в основному потоці. *Asynchronous continuation* in Call Activity in Camunda BPM is a mechanism that allows executing an activity asynchronously in relation to the main process flow. This means that the activity (in this case, Call Activity) can be executed later without delaying the execution of subsequent elements in the main flow. -//Asynchronous continuation часто використовується, коли потрібно запустити довготривалу або ресурсомістку операцію без блокування подальшого виконання процесу. Це може бути корисним, наприклад, коли Call Activity викликає зовнішній процес, який може тривати певний час. Asynchronous continuation is often used when it is necessary to initiate a long-running or resource-intensive operation without blocking the further execution of the process. This can be useful, for example, when the Call Activity invokes an external process that may take some time. -//Після завершення асинхронної операції, робота процесу продовжується з наступної точки, після Call Activity. Asynchronous continuation також дозволяє системі керування процесами (наприклад, Camunda BPM) більш ефективно управляти ресурсами, розподіляючи навантаження між різними екземплярами процесу. After the completion of the asynchronous operation, the process workflow continues from the next point after the Call Activity. Asynchronous continuation also enables process management systems (such as Camunda BPM) to more efficiently manage resources by distributing the load among different process instances. -//*`Asynchronous continuation: before`* в контексті Camunda BPM означає, що асинхронний виклик відбувається перед запуском Call Activity, а не після його завершення. In the context of Camunda BPM, *`asynchronous continuation: before`* means that the asynchronous invocation takes place before the start of the Call Activity, rather than after its completion. -//Такий варіант використання асинхронного продовження може бути корисним, коли вам потрібно запустити довготривалу або ресурсомістку активність (як-от Call Activity), але ви не хочете блокувати виконання основного потоку процесу, поки ця активність не буде виконана. This use of asynchronous continuation can be useful when you need to initiate a long-running or resource-intensive activity (such as a Call Activity), but you don't want to block the execution of the main process flow until this activity is completed. ===== ==== + image:best-practices/edit-grid-rows-action/edit-grid-rows-action-5.png[] -+ -//. У полі In mappings вкажіть: + . In the *In mappings* field, specify: * `Source: *Type*` * `source: *license*` * `target: *license*` + + -//Це означає, що дані зі змінної license в основному процесі будуть передані до підпроцесу `license-cancellation` і збережені до змінної під таким же іменем. This means that the data from the variable license in the main process will be passed to the license-cancellation subprocess and stored in a variable with the same name. + @@ -464,21 +357,15 @@ image:best-practices/edit-grid-rows-action/edit-grid-rows-action-5-1.png[] [CAUTION] ==== -//Якщо на формі бізнес-процесу ви обираєте дію над одним рядком таблиці, використовуючи при цьому контекстне меню "Три крапки" *`⋮`* (_див. детальніше про моделювання форм у розділі xref:#modeling-forms[]_), то змоделювати бізнес-процес в такому разі можна двома способами: If you choose an action on a single row of the table using the context menu (three dots) *`⋮`* (see more about form modeling in xref:#modeling-forms[]), you can model the business process in two ways: -//* з використанням Multi-instance у Call Activity (як показано вище у розділі); -//* з використанням базових налаштувань Call Activity. * Using Multi-instance in the Call Activity (as shown above in the section). * Using basic configurations of the Call Activity. -//Базові налаштування Call Activity в такому випадку виглядатимуть майже ідентично до опції з Multi-instance: The basic configurations of the Call Activity in this case will look almost identical to the Multi-instance option: -//* Вкажіть тип вхідних параметрів -- *`Source expression`*. * Specify the input parameter type as *`Source expression`*. -//* Вкажіть вираз для отримання даних з форми за допомогою функції `submission()`. * Specify an expression to retrieve data from the form using the `submission()` function. + [source,juel] @@ -486,43 +373,32 @@ The basic configurations of the Call Activity in this case will look almost iden ${submission('defineActionActivity').formData.prop('licenses').elements()[0]} ---- + -// Вкажіть *`Target`* -- *`license`*. * Specify the *`Target`* as *`license`*. + -//Це означає, що дані зі змінної license в основному процесі будуть передані до підпроцесу `license-cancellation` і збережені до змінної під таким же іменем. This means that the data from the variable license in the main process will be passed to the `license-cancellation` subprocess and stored in a variable with the same name. image:best-practices/edit-grid-rows-action/edit-grid-rows-action-10.png[] ==== -//=== Користувацька задача для ануляції ліцензії === User task for license cancellation -//Змоделюйте користувацьку задачу (*User Task*), яка надасть можливість для користувача анулювати ліцензію. Model a User Task that allows the user to cancel a license. -//. Використовуйте шаблон делегата *`User Form`* для створення форми користувача. . Use the *`User Form`* delegate template to create the user form. -+ -//. Вкажіть ідентифікатор форми, яка повинна бути показана користувачу, у цьому випадку -- *`edit-grid-rows-action-cancel-license`*. + . Specify the form ID to be shown to the user, in this case - *`edit-grid-rows-action-cancel-license`*. -+ -//. Задача може бути призначена користувачеві (`Assignee`), але в цьому випадку поле можна залишити порожнім, що означає, що будь-який користувач може взяти її до виконання. + . The task can be assigned to a user (`Assignee`), but in this case, the field can be left empty, which means any user can claim and execute it. -+ -//. У полі Candidate roles вкажіть роль. Поле вказує на те, що цю задачу зможуть бачити та виконувати користувачі з певною роллю/ролями, у нашому випадку -- *`op-regression`*. + . In the *Candidate roles* field, specify the role. This field indicates that users with a specific role/roles, in our case -- *`op-regression`*, can view and execute this task. -+ -//. У полі Form data pre-population передайте дані про ліцензію як змінну *`${license}`*, що будуть виведені на форму для попереднього заповнення даних. + . In the Form data pre-population field, pass the license data as the variable *`${license}`*, which will be displayed on the form for pre-filling the data. image:best-practices/edit-grid-rows-action/edit-grid-rows-action-6.png[] -//=== Підготовка даних для запису (transient var) === Data preparation for recording (transient var) -//Змоделюйте скрипт-задачу (Script Task) та застосуйте скрипт, який зможе отримати дані із попередньої задачі (форми) та підготує їх для запису до БД (у нашому випадку -- до оновлення сутності). Model a Script Task and apply a script that can retrieve data from the previous task (form) and prepare it for recording in the database (in our case, updating an entity). image:best-practices/edit-grid-rows-action/edit-grid-rows-action-7.png[] @@ -538,26 +414,22 @@ def canceledLicense = submission('cancelLicenseActivity').formData set_transient_variable('canceledLicense', canceledLicense) ---- -//Цей скрипт виконує наступні дії: This script performs the following actions: -//. Отримує дані форми, що були відправлені користувачем у задачі *`cancelLicenseActivity`*. Результат цього виразу зберігається у змінній *`canceledLicense`*. . Retrieves the form data that was submitted by the user in the *`cancelLicenseActivity`* task. The result of this expression is stored in the variable *`canceledLicense`*. + [source,groovy] ---- submission('cancelLicenseActivity').formData ---- -+ -//. Встановлює властивість *`licensingStatus`* об'єкта *`canceledLicense`* у значення *`canceled`*. Це означає, що ліцензію відмічено як "_скасовану_". + . Sets the *`licensingStatus`* property of the *`canceledLicense`* object to the value *`canceled`*. This means that the license is marked as "canceled". + [source,groovy] ---- canceledLicense.prop('licensingStatus', 'canceled') ---- -+ -//. Створює тимчасову (transient) змінну з іменем *`'canceledLicense'`*, значення якої встановлюється в об'єкт *`canceledLicense`*. Тимчасова змінна зберігається лише протягом поточного виконання процесу і не зберігається до бази даних. + . Creates a transient variable named '*`canceledLicense`*' with the value set to the *`canceledLicense`* object. Transient variables are only stored during the current execution of the process and are not persisted to the database. + [source,groovy] @@ -566,179 +438,155 @@ set_transient_variable('canceledLicense', canceledLicense) ---- ==== -//=== Підписання даних КЕП та накладання системного підпису === Data signing with the qualified digital signature and system signature -//Далі змоделюйте відповідні задачі для підписання даних КЕП та системним ключем. Використовуйте для цього делегати *Officer sign task* та *System signature by DSO service відповідно*. Next, model the corresponding tasks for data signing with a digital signature and system key. Use the *Officer sign task* and *System signature by DSO service* delegates, respectively. -//TIP: Приклади моделювання таких задач ви можете переглянути на сторінці TIP: You can refer to the Modeling Examples for such tasks at xref:best-practices/bp-officer-self-register-manual.adoc[]. - -//=== Зберегти оновлені дані обраного рядка у таблиці на формі до БД === Saving the updated data of the selected row in the table on the form to the database. -//Змоделюйте сервісну задачу, яка виконає операцію оновлення даних за обраним записом у БД. Model a service task that will perform the operation of updating data for the selected record in the database. -//. Використовуйте делегат *Update entity in data factory*, що є класом Java, який містить логіку для виконання цієї задачі. . Use the *Update entity in data factory* delegate, which is a Java class that contains the logic to perform this task. + -//Альтернативно, ви можете застосувати загальний конектор до Фабрики даних *Connect to data factory*, використавши метод *`PUT`*. Alternatively, you can apply the general *Connect to data factory* connector, using the *`PUT`* method. + [TIP] ==== -//Детальніше про це див. на сторінці For more information, refer to -xref:bp-modeling/bp/element-templates/bp-element-templates-installation-configuration.adoc[]. +xref:bp-modeling/bp/element-templates/service-task-templates/connect-to-data-factory.adoc[]. ==== -+ -//. Вкажіть *`resource`*, що вказує на ресурс, тобто таблицю яку потрібно оновити, у цьому випадку -- *`licenses`*. + . Specify the *`resource`* that indicates the resource, i.e., the table that needs to be updated, in this case - *`licenses`*. -+ -//. Вкажіть `Resource id`, що визначає ідентифікатор ліцензії, яку потрібно оновити. Наприклад: + . Specify the `Resource id` that defines the identifier of the license that needs to be updated. For example: + ---- ${license.prop('licenseId').value()} ---- -+ -//. У полі *`Payload`* передайте дані, що потрібно оновити для вказаної ліцензії. Ці дані беруться з тимчасової змінної `canceledLicense`, що була встановлена у попередніх кроках процесу. Це можна зробити за допомогою функції `submission()`. Наприклад: + . In the *`Payload`* field, pass the data that needs to be updated for the specified license. This data is taken from the temporary variable `canceledLicense`, which was set in the previous steps of the process. This can be done using the `submission()` function. For example: + ---- ${submission('signCanceledLicenseActivity').formData} ---- -+ -//. Передайте токен доступу до ресурсу -- *`X-Access-Token`*, отриманий із задачі `signCanceledLicenseActivity`. Це можна зробити за допомогою функції completer(). Наприклад: + . Pass the access token to the resource -- *`X-Access-Token`*, obtained from the `signCanceledLicenseActivity` task. This can be done using the `completer()` function. For example: + ---- ${completer('signCanceledLicenseActivity').accessToken} ---- -+ -//. Передайте містять ключі для цифрового підпису даних КЕП та системним ключем у полях `X-Digital-Signature source` і `X_Digital-Signature-Derived source` відповідно. Наприклад: + . Pass the keys for the digital signature of the CEP data and the system key in the `X-Digital-Signature source` and `X_Digital-Signature-Derived source` fields, respectively. For example: + -.КЕП .Qualified digital signature ---- ${sign_submission('signCanceledLicenseActivity').signatureDocumentId} ---- + -.Системний підпис .System signature ---- ${system_signature_ceph_key} ---- -+ -//. Результат запита збережіть у вихідний параметр *`response`*. + . Save the result of the request in the output parameter *`response`*. image:best-practices/edit-grid-rows-action/edit-grid-rows-action-8.png[] -//=== Завершення процесу та повернення користувача на початкову форму === Completing the process and returning the user to the initial form. -//Після оновлення сутності у Фабриці даних, підпроцес, що викликали, завершується, результат повертається назад до Call Activity, і користувач повертається на початок основного процесу. Переадресація користувача можлива завдяки змодельованим подіям "З'єднання" (*Link event*). After updating the entity in the Data Factory, the sub-process that invoked it is completed, and the result is returned back to the Call Activity, and the user is returned to the beginning of the main process. User redirection is possible thanks to the modeled *Link events*. image:best-practices/edit-grid-rows-action/edit-grid-rows-action-9.png[] -//TIP: Детальніше про подію "З'єднання" ви можете дізнатися на сторінці TIP: For more information about the "Link" event, you can refer to xref:bp-modeling/bp/bpmn/events/bp-link-events.adoc[]. [#modeling-forms] -//== Моделювання UI-форм до бізнес-процесу == Modeling UI Forms for business processes -//Розглянемо приклад моделювання користувацької форми для перегляду та виконання дій над певними рядками таблиці за допомогою компонента Edit Grid. Let's consider an example of modeling a user form for viewing and performing actions on specific rows of a table using the Edit Grid component. -//Також змоделюємо дві кнопки через компонент Button для виконання додаткової логіки. We will also model two buttons using the Button component to perform additional logic. [NOTE] ==== -//Якщо на формі *`defineActionActivity`* обрано чекбокс з декількома рядками (записами) таблиці, то для кожного з цих рядків запуститься підпроцес відповідно до обраної кнопки на UI-формі (у цьому контексті це мають бути _окремі кнопки_, змодельовані через компонент *Button*). Запуск підпроцесу для кожного з обраних рядків можливий завдяки функції мультиекземпляра *`Multi-instance`* (_див.xref:#call-activity-cancel[]_). If the multi-row checkbox is selected on the *`defineActionActivity`* form, a subprocess will be launched for each of these rows based on the selected button on the UI form (in this context, these should be _separate buttons_ modeled using the *Button* component). Launching a subprocess for each selected row is possible using the Multi-instance function (see _xref:#call-activity-cancel[]_). -//Якщо ви обрали контекстне меню "Три крапки" навпроти певного рядка, то відповідний підпроцес запуститься лише для даних цього рядка. Який саме підпроцес запуститься -- регулюється логікою кодів дії (action codes), змодельованих на формі у компоненті *Edit Grid*. Тобто контекстне меню "Три крапки" дозволяє обрати логіку виконання дії над одним рядком таблиці. If you select the context menu "Three dots" next to a specific row, the corresponding subprocess will only be launched for the data of that row. The specific subprocess to be launched is determined by the action codes logic modeled on the *Edit Grid* component on the form. Therefore, the context menu "Three dots" allows selecting the logic for performing an action on a single table row. ==== -//. Перейдіть до конструктора форм у Кабінеті адміністратора регламентів, створіть нову форму та змоделюйте компонент *Edit Grid*, який складається з 5-ти текстових полів (*Text Field*) для таблиці. . Go to the form builder in the Administrator of Regulations Portal, create a new form, and model the *Edit Grid* component, which consists of 5 text fields (*Text Field*) for the table. -+ -//. Перейдіть до налаштувань компонента *Edit Grid*. + . Go to the settings of the *Edit Grid* component. + image:best-practices/edit-grid-rows-action/forms/edit-grid-rows-action-form-1.png[] -+ -//. Введіть назву (*`Label`*) для цього компонента, що відображатиметься на формі, та активуйте опції `Multiple-record selection` та `Read Only`. + . Enter a name (*`Label`*) for this component, which will be displayed on the form, and activate the options `Multiple-record selection` and `Read Only`. -+ -//* `Multiple-record selection` дозволяє користувачам вибирати кілька записів в таблиці одночасно. + * `Multiple-record selection` allows users to select multiple records in the table simultaneously. -//* `Read Only` показує дані через окремий елемент управління в контекстному меню (три вертикальних крапки), який дозволяє переглядати дані без можливості редагування. * `Read Only` displays data through a separate control element in the context menu (three vertical dots), which allows viewing data without the ability to edit. + image:best-practices/edit-grid-rows-action/forms/edit-grid-rows-action-form-2.png[] -+ -//. Перейдіть на вкладку *API* та введіть службову назву компонента для використання в API-запитах. У нашому випадку -- це `licences`, що відповідає назві таблиці в БД. . Switch to the *API* tab and enter a service name for the component to be used in API requests. In our case, it is `licenses`, which corresponds to the table name in the database. + image:best-practices/edit-grid-rows-action/forms/edit-grid-rows-action-form-3.png[] -//. Перейдіть на вкладку *Logic* та додайте коди дій (action codes) для опцій контекстного меню "Три крапки", які будуть доступні для виконання дії над певним рядком на формі під час виконання бізнес-процесу. + . Switch to the *Logic* tab and add action codes for the options in the context menu "Three dots" that will be available for performing an action on a specific row on the form during the execution of the business process. + [NOTE] ==== -//Розробник регламенту повинен уникати моделювання дій за допомогою `action_code` у контекстному меню "три крапки" рядка таблиці, коли EditGrid налаштовано в режимі редагування. Якщо цього не зробити, відредаговані дані можуть залишитися незбереженими, а користувач автоматично перейде за `action_code` до наступного БП. + The regulation developer should avoid modeling actions using the `action_code` in the context menu "Three dots" of a table row when EditGrid is in edit mode. Failure to do so may result in unsaved edited data, and the user will automatically move to the next business process based on the action_code. -//Замість цього, користувача слід направити на форму підпису після редагування даних, щоб забезпечити збереження всіх внесених змін. Instead, the user should be directed to a signing form after editing the data to ensure that all changes are saved. ==== + image:best-practices/edit-grid-rows-action/forms/edit-grid-rows-action-form-4.png[] -+ -//. Змоделюйте компонент *Button* для додаткової двох додаткових кнопок, щоб мати можливість виконувати дії над декількома рядками таблиці одночасно, коли активована опція `Multiple-record selection` в Edit Grid. . Model the *Button* component for two additional buttons to be able to perform actions on multiple rows of the table simultaneously when the Multiple-record selection option is activated in Edit Grid. -+ -//* Додайте кнопку оновлення терміну дії ліцензії (для одного і більше записів у таблиці, за умови використання чекбоксу `Multiple-record selection` в Edit Grid). + * Add a button to update the license action period (for one or more records in the table, provided the `Multiple-record selection` checkbox is used in Edit Grid). + image:best-practices/edit-grid-rows-action/forms/edit-grid-rows-action-form-5.png[] + image:best-practices/edit-grid-rows-action/forms/edit-grid-rows-action-form-6.png[] -+ -//* Додайте кнопку скасування ліцензії (для одного і більше записів у таблиці, за умови використання чекбоксу `Multiple-record selection` в Edit Grid). + * Add a button to cancel the license (for one or more records in the table, provided the `Multiple-record selection` checkbox is used in Edit Grid). + image:best-practices/edit-grid-rows-action/forms/edit-grid-rows-action-form-7.png[] + image:best-practices/edit-grid-rows-action/forms/edit-grid-rows-action-form-8.png[] -+ -//. Збережіть зміни та застосуйте конфігурацію до майстер-гілки. + . Save the changes and apply the configuration to the master branch. -//TIP: Читайте про можливості Edit Grid у розділі документації TIP: Read about the capabilities of the Edit Grid component at xref:bp-modeling/forms/components/edit-grid/edit-grid.adoc[]. -//== Використання у Кабінетах користувачів == Usage in user portals -//Змодельований бізнес-процес можна буде знайти у списку доступних послуг Кабінету посадової особи у демо-реєстрі _consent-data_. -The modeled business process can be found in the list of available services in the User Portal of the authorized person in the _consent-data_ demo registry. +The modeled business process can be found in the list of available services in the *Officer Portal* under the authorized person in the demo registry. + +[TIP] +==== +The Officer portal is available via the pattern link: + +---- +https://officer-portal--main. +---- + +where `` is the name for your registry and `` designates the domain and subdomain names for the cluster instance. + +For example, for the `demo-registry`, deployed on the `example.com` Platform instance, the route to the *Officer Portal* service is: + +https://officer-portal-demo-registry-main.example.com + +//https://officer-portal-{{{registry-name}}}-main.{{{dns-wildcard}}} +==== .Бізнес-процес у Кабінеті .Business process in the user portal @@ -750,9 +598,4 @@ image::release-notes:wn-1-9-4/whats-new-1-9-4-5.png[] .Виконання дії над декількома рядками у таблиці .Performing an action on multiple rows in the table -image::release-notes:wn-1-9-4/whats-new-1-9-4-9.png[] - - - - - +image::release-notes:wn-1-9-4/whats-new-1-9-4-9.png[] \ No newline at end of file diff --git a/docs/en/modules/registry-develop/pages/bp-modeling/bp/access/bp-limiting-access-keycloak-attributes.adoc b/docs/en/modules/registry-develop/pages/bp-modeling/bp/access/bp-limiting-access-keycloak-attributes.adoc index 6963982410..ee4cb86999 100644 --- a/docs/en/modules/registry-develop/pages/bp-modeling/bp/access/bp-limiting-access-keycloak-attributes.adoc +++ b/docs/en/modules/registry-develop/pages/bp-modeling/bp/access/bp-limiting-access-keycloak-attributes.adoc @@ -1,406 +1,297 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: = Granting organization access to business process tasks at the level of user attributes -//= Розмежування доступу організацій до задач бізнес-процесу на рівні атрибутів користувачів - -//:toc: -//:toc-title: ЗМІСТ -//:toclevels: 5 -//:sectnums: -//:sectnumlevels: 5 -//:sectanchors: +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] + +include::platform:ROOT:partial$admonitions/language-en.adoc[] + == Abstract -//== Загальний опис In order to support the functionality of organization access granting to business processes at the level of user attributes, a standard extension to business processes has been developed -- the `${getUsersByAttributesFromKeycloak}` delegate. For that, the *Get users by attributes from keycloak* template with the same name is implemented as a JSON file _getUsersByAttributesFromKeycloak.json_. -//З метою підтримки функціональності розмежування доступу організацій до бізнес-процесів на рівні атрибутів користувачів, розроблено типове розширення до бізнес-процесів -- делегат `${getUsersByAttributesFromKeycloak}`, для якого імплементовано однойменний шаблон *Get users by attributes from keycloak*, представлений у вигляді JSON-файлу _getUsersByAttributesFromKeycloak.json_. The delegate is required in order to receive a list of users (officers) by certain attributes from the Keycloak identity and access management service when performing a business process. -//Делегат потрібний для того, щоб при виконанні бізнес-процесу отримувати список користувачів (посадових осіб) за певними атрибутами із сервісу керування ідентифікацією та доступом Keycloak. -you can search in Keycloak using the following attributes: :: -//Виконати пошук у Keycloak можливо за такими атрибутами: :: +You can search in Keycloak using the following attributes: :: * `edrpou`: The identification number of an entity in the Unified state register of enterprises and organizations of Ukraine (EDRPOU). -//* `edrpou`, тобто ідентифікаційним номером суб'єкта Єдиного державного реєстру підприємств і організацій (ЄДРПОУ); + * `drfo`: The identification number of a natural person in the State Register of Individuals – Taxpayers (DRFO). -//* `drfo`, тобто ідентифікаційним номером фізичної особи у Державному реєстрі фізичних осіб -- платників податків (ДРФО). Each officer of a certain organization has such attributes in the Keycloak service. As a result of the query, a list of usernames is returned to the business process. -//Кожна посадова особа певної організації має такі атрибути у сервісі Keycloak. У результаті виконання запита, до бізнес-процесу повертається список імен користувачів. CAUTION: This is NOT the full name of a user, but a `username`. For example, `username1, username2` etc. -//CAUTION: Мається на увазі НЕ повне ім'я користувача, а його `username`. Наприклад, `username1, username2` тощо. This list of names can be used later on in the *Candidate users* field when performing a user task in a business process. -//Цей список імен можна надалі застосовувати при виконанні користувацької задачі бізнес-процесу у полі *Candidate users*. *Candidate users* are the users authorized to perform the task. This parameter is required to control user access to specific tasks of a business process. -//*Candidate users* -- користувачі, уповноважені до виконання задачі. Тобто це параметр, який потрібен для того, щоб розмежувати доступ до конкретних задач бізнес-процесу між користувачами. The list of Keycloak users is saved to the result variable in a service task of a business process. This variable is further processed by the groovy script when executing the scripting task. As a result, the list becomes a string that can be used in Candidate users. -//Список користувачів із Keycloak зберігається до результівної змінної (Result variable) у сервісній задачі бізнес-процесу. Ця змінна надалі обробляється groovy-скриптом при виконанні задачі скриптування, в результаті чого список перетворюється на рядок, який можна використовувати у Candidate users. TIP: So, we get the _list_ object from the Keycloak service using the `edrpou` and `drfo` attributes and use the script to convert it into a _string_, which values are comma separated and used in the `Candidate users` parameter for granting access to a specific task of a business process. -//TIP: Отже, ми із сервісу Keycloak за атрибутами `edrpou` та `drfo` отримуємо об'єкт _список_ та за допомогою скрипту конвертуємо його в _рядок_, значення якого розділені комами й використовуються для надання доступу до конкретної задачі бізнес-процесу у параметрі `Candidate users`. == Business process modeling and configuration -//== Моделювання та налаштування бізнес-процесу Let's consider setting up a delegate to search for user attributes in the Keycloak service as part of the process when transferring a student from one school to another. -//Розглянемо налаштування делегата для пошуку атрибутів користувачів у сервісі Keycloak в рамках процесу переведення учня з однієї школи до іншої. image:bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-1.png[] We have a complex business process of transferring a student from one school to another. The student must first be excluded from the first school, and then enrolled at the second. -//Маємо комплексний бізнес-процес переведення учня з однієї школи до іншої. Учня необхідно спочатку виключити із першої школи, а потім зарахувати до другої. From the point of the security architecture, each organization (herein _educational institution_) in the Keycloak service has its own EDRPOU code. Therefore, two business processes in our example are different organizations, each one having its own employees and corresponding level of access within the organization. -//З погляду архітектури безпеки, у сервісі Keycloak кожна організація (тут -- _заклад освіти_) має свій код ЄДРПОУ. Тому два бізнес-процеси у нашому прикладі є різними організаціями, кожна зі своїми працівниками й відповідним рівнем доступу в межах організації. -We have to launch automatically the business process of the second school after the first process finishes. The end of the business process in the first school (_School 1_) lanches the second process (_School 2_) xref:bp-modeling/bp/bpmn/events/message-event.adoc#message-end-event[by the "Notification" event]. -//Ми маємо автоматично запустити бізнес-процес другої школи після закінчення першого процесу. Кінець бізнес-процесу у першій школі (_Школа 1_) запускає другий процес (_Школа 2_) xref:bp-modeling/bp/bpmn/events/message-event.adoc#message-end-event[подією "Повідомлення"]. + +We have to automatically launch the business process of the second school after the first process finishes. The end of the business process in the first school (_School 1_) launches the second process (_School 2_) xref:bp-modeling/bp/bpmn/events/message-event.adoc#message-end-event[by the _Message_ event]. In the business process of the second school, the officer must perform the task (User Task) of transferring the student, that is, it is necessary to appoint a performer of the task in the new organization (school). To do this, you need first to get a list of potential users in the relevant organization (performers) from the Keycloak service, and then use this list to grant task access to users in the second business process. -//У бізнес-процесі другої школи посадова особа має виконати задачу (User Task) із переведення учня, тобто необхідно призначити виконавця задачі у новій організації (школі). Для цього потрібно спочатку отримати список потенційних користувачів відповідної організації (виконавців) із сервісу Keycloak, а потім використати цей список, щоб надати доступ до виконання задачі користувачам у другому бізнес-процесі. That means that each officer in the relevant organization can see the task in the citizen portal and appoint himself/herself as the performer. -//Тобто кожна посадова особа відповідної організації зможе бачити задачу у Кабінеті отримувача послуг і призначити себе виконавцем. [#create-pool-bp-1] === Creating a pool for the first school business process -//=== Створення пулу для бізнес-процесу першої школи First of all, _model the pool for the business process of the first school_. To do this, follow the steps below: -//Найперше, _змоделюйте пул для бізнес-процесу першої школи_. Для цього виконайте кроки, подані нижче: NOTE: Modeling of the business process diagram has to be made within the *Create Pool/Participant* element. -//NOTE: Моделювання діаграми бізнес-процесу має відбуватися в рамках елемента *Create Pool/Participant*. . Open the *Camunda Modeler* application and create a new BPMN diagram. To do this, click *File* -> *New File* -> *BPMN Diagram* in the upper left-hand side corner. -//. Відкрийте додаток *Camunda Modeler* та створіть нову діаграму BPMN. Для цього у лівому верхньому куті натисніть меню *File* -> *New File* -> *BPMN Diagram*. + + image:registry-develop:bp-modeling/bp/modeling-instruction/bp-1.png[] . In the toolbar on the left-hand side, find the *Create pool/Participant* item and drag it to the modeling panel. -//. На панелі інструментів зліва знайдіть елемент *Create pool/Participant* та перетягніть його до панелі моделювання. + image:registry-develop:bp-modeling/bp/modeling-instruction/bp-2.png[] . Enter the corresponding values into the following fields: -//. Заповніть наступні поля відповідними значеннями: + * In the `Participant Name` field, enter the name of the pool to be displayed in the modeler -- `School 1`. -//* У полі `Participant Name` введіть назву пулу, що відображатиметься у моделері -- `Школа 1`. + * In the `Process id` field, enter the business process ID -- `firstversa`. -//* У полі `Process id` введіть ідентифікатор бізнес-процесу -- `firstversa`. + * In the `Process Name` field, enter the process business name, optional. -//* У полі `Process Name` вкажіть бізнес-назву процесу за необхідності. + image:bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-1-1.png[] [#bp-1-start-event] -==== Modelling of the start event -//==== Моделювання початкової події +==== Modeling of the start event _Create a start event_. To do this, follow the following steps: -//_Створіть початкову подію_. Для цього виконайте наступні кроки: . On the toolbar on the left-hand side, find the *CreateStartEvent* element (circle) and drag it to the modeling panel. -//. На панелі інструментів, зліва, знайдіть елемент (коло) *CreateStartEvent* та перетягніть його до панелі моделювання. + . In the settings panel on the right-hand side, enter the corresponding values for the following parameters: -//. На панелі налаштувань справа заповніть наступні параметри відповідними значеннями: + * In the `Name` field, enter the name of the start event -- `Start`; -//* У полі `Name` введіть назву початкової події -- `Початок`; + * In the `Initiator` field, enter `initiator`. -//* У полі `Initiator` введіть `initiator`. + TIP: `initiator` is a special variable set for the user who initiated the process. -//TIP: `initiator` -- спеціальна змінна, що встановлюється для користувача, який розпочав процес. + image:bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-2.png[] ==== Modeling of the user task for data entering -//==== Моделювання користувацької задачі внесення даних Next, _create a user task for entering data by a user_. To do this, follow these steps: -//Далі _створіть користувацьку задачу, призначену для введення даних користувачем_. Для цього виконайте наступні кроки: . Create a new task, enter its type by clicking the wrench icon and selecting *User Task* from the menu. -//. Створіть нову задачу, вкажіть її тип, натиснувши іконку ключа та обравши з меню пункт *User Task* (Користувацька задача). . In the settings panel on the right-hand side, click `Open Catalog`, select the *User Form* template and click `Apply` to confirm. -//. На панелі налаштувань справа натисніть `Open Catalog`, оберіть шаблон *User Form* (Користувацька форма) та натисніть `Apply` для підтвердження. . In the settings panel, configure the following parameters: -//. На панелі налаштувань сконфігуруйте наступні параметри: * In the `Id` field, enter the task identifier -- `Zayava`. -//* У полі `Id` вкажіть ідентифікатор задачі -- `Zayava`. + + TIP: Task ID is assigned automatically by default. Enter the value manually, if necessary. -//TIP: ID задачі призначається автоматично, за замовчуванням. Введіть значення вручну, якщо це необхідно. * In the `Name` field, enter the name of the task -- `Enter application data`. -//* У полі `Name` вкажіть назву задачі -- `Внести дані про заяву`. * In the `Form key` field, enter the form key that corresponds to the service name of the data entry form -- `add-keyapp`. -//* У полі `Form key` введіть ключ форми, що відповідатиме службовій назві форми для внесення даних -- `add-keyapp`. * In the `Assignee` field, enter the variable used to store the user who launched the process instance -- `${initiator}`. -//* У полі `Assignee` вкажіть змінну, що використовується для зберігання користувача, який запустив екземпляр процесу, -- `${initiator}`. + TIP: On the UI, after launching the business process, the officer can see a form for entering application data. The data are passed to the business process via the `Form key` parameter and will be used in the next task of the process. -//TIP: З погляду UI, після запуску бізнес-процесу, перед посадовою особою з'явиться форма для внесення даних про заяву. Дані будуть передані бізнес-процесу за параметром `Form key` і використані у наступній задачі процесу. + image:bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-3.png[] ==== Modeling of the user task to sign the data using QES -//==== Моделювання користувацької задачі підпису даних КЕП Model a _user task (*User form*) for signing the application data using QES_ and link it to the business process form using the `Form key` parameter. -//Змоделюйте _користувацьку задачу (*User form*) для підпису даних про заяву за допомогою КЕП_ та пов'яжіть її з формою бізнес-процесу параметром `Form key`. . In the `Id` field, enter the task identifier -- `Sign`. It is a task definition key. -//. У полі `Id` вкажіть ідентифікатор задачі -- `Sign`. Він є ключем визначення задачі (task definition key). + . In the `Name` field, enter the task name. For example, `Sign the application data`. -//. У полі `Name` введіть назву задачі. Наприклад, `Підписати дані про заяву`. + . In the `Form key` field, enter the business process form key -- `add-zayavasign`. -//. У полі `Form key` введіть ключ форми бізнес-процесу -- `add-zayavasign`. + . In the `Assignee` field, enter the variable used to store the user who launched the process instance -- `${initiator}`. -//. У полі `Assignee` вкажіть змінну, що використовується для зберігання користувача, який запустив екземпляр процесу, -- `${initiator}`. + -TIP: On the UI, after data entering by the user, a new form appears for data signing using QES. The data are passed to the business process via the `Form key` parameter and will be used in the next task of the process. -//TIP: З погляду UI, після внесення даних користувачем, з'явиться нова форма для підпису даних за допомогою КЕП. Дані будуть передані бізнес-процесу за параметром `Form key` і використані у наступній задачі процесу. +TIP: On the UI, after data entered by the user, a new form appears for data signing using QES. The data are passed to the business process via the `Form key` parameter and will be used in the next task of the process. + image:bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-4.png[] ==== Modeling of a user task for searching an officer -//==== Моделювання користувацької задачі для пошуку посадової особи Model a _user task (*User form*) to search for officers or for a specific officer by attributes_ and associate it with the business process form using the `Form key` parameter. -//Змоделюйте _користувацьку задачу (*User form*) для пошуку посадових осіб або конкретної посадової особи за атрибутами_ та пов'яжіть її з формою бізнес-процесу параметром `Form key`. . In the `Id` field, enter the task identifier -- `Search`. It is a task definition key. -//. У полі `Id` вкажіть ідентифікатор задачі -- `Search`. Він є ключем визначення задачі (task definition key). . In the `Name` field, enter the name of the task. For example, `Search for an officer`. -//. У полі `Name` введіть назву задачі. Наприклад, `Виконати пошук посадової особи`. . In the `Form key` field, enter the business process form key -- `add-zayavasearch`. -//. У полі `Form key` введіть ключ форми бізнес-процесу -- `add-zayavasearch`. . In the `Assignee` field, enter the variable used to store the user who launched the process instance -- `${initiator}`. -//. У полі `Assignee` вкажіть змінну, що використовується для зберігання користувача, який запустив екземпляр процесу, -- `${initiator}`. + TIP: On the UI, after the user signs the data, a new form appears for searching officers / an officer by attributes. That means, the user must enter the values of the `edrpou` and `drfo` attributes into the corresponding fields of the form. The data are passed to the business process via the `Form key' parameter and will be used in the next task of the process. -//TIP: З погляду UI, після підпису даних користувачем, з'явиться нова форма для пошуку посадових осіб/посадової особи за атрибутами. Тобто користувач має ввести значення атрибутів `edrpou` та `drfo` у відповідних полях форми. Дані будуть передані бізнес-процесу за параметром `Form key` і використані у наступній задачі процесу. + image:bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-5.png[] ==== Modeling a service task for getting a list of users by their attributes -//==== Моделювання сервісної задачі для отримання списку користувачів за їх атрибутами Later on, the data is used in the service task "Get a list of users by attributes". -//Надалі дані використовуються у сервісній задачі "Отримати список користувачів за атрибутами". In the task, you need to use a delegate to get a list of users by their attributes (*Get users by attributes from keycloak*). -//У задачі необхідно застосувати делегат для отримання списку користувачів за їх атрибутами (*Get users by attributes from keycloak*). As a result, you get a list of users by their attributes. -//В результаті отримуємо список користувачів за їх атрибутами. . Model a new task. -//. Змоделюйте нову задачу. . Define its type by clicking the wrench icon and selecting *Service Task* from the menu. -//. Визначте її тип, натиснувши іконку ключа та обравши з меню пункт *Service Task* (сервісна задача). . Go to the settings panel on the right-hand side and apply the *Get users by attributes from keycloak* delegate. To do this, select the corresponding template from the catalog (`Open Catalog'). -//. Перейдіть до панелі налаштувань справа та застосуйте делегат *Get users by attributes from keycloak*. Для цього оберіть відповідний шаблон із каталогу (`Open Catalog`). . Make further settings: -//. Виконайте подальші налаштування: * Enter the task name in the `Name` field. For example, `Get a list of users by attributes`. -//* У полі `Name` вкажіть назву задачі. Наприклад, `Отримати список користувачів за атрибутами`. * In the `Edrpou attribute value` field, enter the value of the `edrpou` attribute -- `${submission('Search').formData.prop('edrpou').value()}`. -//* У полі `Edrpou attribute value` вкажіть значення атрибута `edrpou` -- `${submission('Search').formData.prop('edrpou').value()}`. + [NOTE] ==== The value of the `edrpou` attribute is required. It can be submitted both directly (by entering the EDRPOU code, for example, `11111111`), and using the `submission()` function, specifying the ID of the last user task (herein `Search`). -//Значення атрибута `edrpou` є обов'язковим для заповнення. Його можна передати як напряму (тобто ввести код ЄДРПОУ, наприклад, `11111111`), так і через функцію `submission()`, вказавши ID останньої користувацької задачі (тут -- `'Search'`). ==== * In the `Drfo attribute value` field, enter the value of the `drfo` attribute -- `${submission('Search').formData.prop('drfo').value()}`. -//* У полі `Drfo attribute value` вкажіть значення атрибута `drfo` -- `${submission('Search').formData.prop('drfo').value()}`. + + [NOTE] ==== The value of the `drfo` attribute is optional. You can pass it both directly (by entering the DRFO code, for example, `2222222222`), and using the `submission()` function, by entering the ID of the last user task (herein `Search`). -//Значення атрибута `drfo` є опціональним. Його можна передати як напряму (тобто ввести код ДРФО, наприклад, `2222222222`), так і через функцію `submission()`, вказавши ID останньої користувацької задачі (тут -- `'Search'`). + ==== * In the `Result variable` field, enter the name of the variable where you want to save the response -- `usersByAttributes`. -//* У полі `Result variable` вкажіть назву змінної, до якої необхідно зберегти відповідь -- `usersByAttributes`. + + [CAUTION] ==== As a result of the inquiry, you receive a list of users from Keycloak by their attributes. This list is stored in the `usersByAttributes` variable. -//В результаті запита отримуємо список користувачів із Keycloak за їх атрибутами, який зберігатиметься у змінній `usersByAttributes`. + * If the user passes only the value of the `edrpou` parameter, the service returns a list of _all officers_ in the corresponding organization. -//* Якщо користувач передає лише значення параметра `edrpou`, то сервіс повертає список _усіх посадових осіб_ відповідної організації. + * If the user passes the values of the `edrpou` and `drfo` parameters, the service returns a list with a name of a _particular officier_ in the corresponding organization. -//* Якщо користувач передає значення параметрів `edrpou` та `drfo`, то сервіс повертає список з іменем _конкретної посадової особи_ відповідної організації. ==== + + image:bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-6.png[] ==== Modeling the "Message" end event -//==== Моделювання кінцевої події "Повідомлення" At this stage, it is necessary to pass the received list of users to another business process. For this, the "Message" end event is used. That means that the termination of one process initiates another process by passing certain data in a message. -//На цьому етапі необхідно передати отриманий список користувачів до іншого бізнес-процесу. Для цього використовується кінцева подія "Повідомлення". Тобто завершення одного процесу запускає інший процес через повідомлення, передаючи певні дані. We need to create a local variable, and pass the list of users and QES to another process in it. -//Нам необхідно створити локальну змінну і передати в ній список користувачів, а також КЕП до іншого процесу. . Model the end message event. -//. Змоделюйте кінцеву подію повідомлення. + TIP: To find out more about the "Message" event, read xref:bp-modeling/bp/bpmn/events/message-event.adoc[this information]. -//TIP: Детальніше про події "Повідомлення" -- за xref:bp-modeling/bp/bpmn/events/message-event.adoc[посиланням]. + . Go to the settings panel on the right-hand side and configure the options: -//. Перейдіть до панелі налаштувань справа та сконфігуруйте параметри: * In the `General` tab, configure the following settings: -//* На вкладці `General` налаштуйте наступне: ** In the `Implementation` field, select the `Delegate Expression` type. -//** У полі `Implementation` оберіть тип `Delegate Expression`. ** In the `Delegate Expression` field, enter the delegate to pass the message -- `${startProcessByMessageDelegate}`. -//** У полі `Delegate Expression` введіть делегат для передачі повідомлення -- `${startProcessByMessageDelegate}`. ** In the `Global Message Name` field, enter the global name for establishing communication between message events -- `Startprocessmessage`. -//** У полі `Global Message Name` введіть глобальне ім'я для встановлення зв'язку між подіями повідомлення -- `Startprocessmessage`. ** In the `Global Message referenced` field, select `Startprocessmessage`. The value is filled in automatically, according to the `Global Message Name` parameter. -//** У полі `Global Message referenced` оберіть `Startprocessmessage`. Значення заповнюється автоматично, відповідно до параметра `Global Message Name`. + + -NOTE: The values of the `Global Message Name` and `Global Message referenced` parameters must match the corresponding values of the message receiving event. -//NOTE: Значення параметрів `Global Message Name` та `Global Message referenced` мають збігатися з відповідними значеннями події, що приймає повідомлення. +NOTE: The values of the `Global Message Name` and `Global Message referenced` parameters must match the corresponding values of the message-receiving event. + + image:bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-7.png[] * In the `Input/Output` tab, configure a local variable as an input parameter: -//* На вкладці `Input/Output` налаштуйте локальну змінну як вхідний параметр: ** In the `Local Variable Name` field, enter the name of the local variable -- `messagePayload`. -//** У полі `Local Variable Name` введіть назву локальної змінної -- `messagePayload`. ** In the `Variable Assignment Type' field, enter the type of parameter passing using a variable -- `Map' (key-value). -//** У полі `Variable Assignment Type` вкажіть тип передачі параметрів через змінну -- `Map` (ключ-значення). ** Add entries for two parameters by clicking the plus sign (`+`): -//** Додайте записи для двох параметрів, натиснувши позначку плюса. + *** For the first entry, enter the `users` parameter and its value `${usersByAttributes}` in the `Key` field. -//*** Для першого запису, у полі `Key` вкажіть параметр `users` та його значення `${usersByAttributes}`. + TIP: The user must pass a name of the variable where the array of users, obtained in the previous service task, is stored. -//TIP: Користувач має передати назву змінної, до якої збережено масив користувачів, отриманий в рамках попередньої сервісної задачі. + *** For the second entry, enter the `task` parameter and its `${submission('Sign').formData}` value in the `Key` field. -//*** Для другого запису, у полі `Key` введіть параметр `task` та його значення `${submission('Sign').formData}`. + TIP: The user must pass QES used in the last user task for data signing (herein, `Sign`) using the `submission()` function. -//TIP: Користувач має передати через функцію `submission()` КЕП, застосований в останній користувацькій задачі для підпису даних (тут -- `'Sign'`). + image:bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-7-1.png[] [#create-pool-bp-2] === Creating a pool for the second school business process -//=== Створення пулу для бізнес-процесу другої школи Model the pool for the business process of the second school_. To do this, follow the steps below: -//_Змоделюйте пул для бізнес-процесу другої школи_. Для цього виконайте кроки, подані нижче: NOTE: Modeling of the business process diagram has to be made within the *Create Pool/Participant* element. -//NOTE: Моделювання діаграми бізнес-процесу має відбуватися в рамках елемента *Create Pool/Participant*. -. Open the *Camunda Modeler* application and create a new BPMN diagram. To do this, click *File* -> *New File* -> *BPMN Diagram* in the upper left-hand side corner. -//. Відкрийте додаток *Camunda Modeler* та створіть нову діаграму BPMN. Для цього у лівому верхньому куті натисніть меню *File* -> *New File* -> *BPMN Diagram*. +. Open the *Camunda Modeler* application and create a new BPMN diagram. To do this, click *File* > *New File* > *BPMN Diagram* in the upper left-hand side corner. + image:registry-develop:bp-modeling/bp/modeling-instruction/bp-1.png[] . In the toolbar on the left-hand side, find the *Create pool/Participant* item and drag it to the modeling panel. -//. На панелі інструментів зліва знайдіть елемент *Create pool/Participant* та перетягніть його до панелі моделювання. + image:registry-develop:bp-modeling/bp/modeling-instruction/bp-2.png[] . Enter the corresponding values into the following fields: -//. Заповніть наступні поля відповідними значеннями: * In the `Participant Name` field, enter the name of the pool to be displayed in the modeler -- `School 2`. -//* У полі `Participant Name` введіть назву пулу, що відображатиметься у моделері -- `Школа 2`. * In the `Process id` field, enter the business process ID -- `secondversa`. -//* У полі `Process id` введіть ідентифікатор бізнес-процесу -- `secondversa`. * In the `Process Name` field, enter the process business name, optional. -//* У полі `Process Name` вкажіть бізнес-назву процесу за необхідності. image:bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-7-2.png[] -==== Modelling of the message start event -//==== Моделювання стартової події повідомлення +==== Modeling of the message start event At this stage, it is necessary to get a list of users from the business process of the first school. This is done using the initial "Message" event. -//На цьому етапі необхідно отримати список користувачів від бізнес-процесу першої школи. Для цього використовується початкова подія "Повідомлення". . Model the start message event. -//. Змоделюйте початкову подію повідомлення. + TIP: To find out more about the "Message" event, read xref:bp-modeling/bp/bpmn/events/message-event.adoc[this information]. -//TIP: Детальніше про події "Повідомлення" -- за xref:bp-modeling/bp/bpmn/events/message-event.adoc[посиланням]. + . Go to the settings panel on the right-hand side and configure the parameters: -//. Перейдіть до панелі налаштувань справа та сконфігуруйте параметри: * In the `Id` field, enter the event identifier -- `Two`. -//* У полі `Id` введіть ідентифікатор події -- `Two`. * In the `Global Message Name` field, enter the global name for establishing communication between message events -- `Startprocessmessage`. -//* У полі `Global Message Name` введіть глобальне ім'я для встановлення зв'язку між подіями повідомлення -- `Startprocessmessage`. * In the `Global Message referenced` field, select `Startprocessmessage`. The value is filled in automatically, according to the `Global Message Name` parameter. -//* У полі `Global Message referenced` оберіть `Startprocessmessage`. Значення заповнюється автоматично, відповідно до параметра `Global Message Name`. + + NOTE: The values of the `Global Message Name` and `Global Message referenced` parameters must match the corresponding values of the message sending event. -//NOTE: Значення параметрів `Global Message Name` та `Global Message referenced` мають збігатися з відповідними значеннями події, що надсилає повідомлення. + image:bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-8.png[] ==== Modeling the scripting task for downloading a list of officers -//==== Моделювання задачі скриптування для завантаження списку посадових осіб At this stage, it is necessary to create a script based on the data from the business process of the first school. This script converts the list of users received from the Keycloak service into a string of comma-separated values. These values can be used later on for granting access to the student transfer task in the business process of the second school. -//На цьому етапі необхідно на основі даних від бізнес-процесу першої школи створити скрипт, який конвертує список користувачів, отриманих із сервісу Keycloak, у рядок значень, розділених комою. Ці значення надалі можна буде використати для надання доступу до задачі із переведення учня у бізнес-процесі другої школи. . Create a new task, define its type by clicking the wrench icon and selecting *Script Task* from the menu. -//. Створіть нову задачу, визначте її тип, натиснувши іконку ключа та обравши з меню пункт *Script Task* (Задача скриптування). . In the settings panel on the right-hand side, fill in the following fields: -//. На панелі налаштувань справа заповніть наступні поля: * In the `Name` field, enter the task name -- `Download the list of officers`. -//* У полі `Name` вкажіть назву задачі -- `Завантажити список посадових осіб`. * In the `Script Format` field, specify the script format -- `groovy`. -//* У полі `Script Format` вкажіть формат скрипту -- `groovy`. * In the `Script Type` field, enter the script type -- `Inline Script`. -//* У полі `Script Type` вкажіть тип скрипту -- `Inline Script`. * Enter the groovy script directly into the `Script` field: -//* У полі `Script` введіть безпосередньо groovy-скрипт: + + .Приклад. Groovy-скрипт, що конвертує об'єкт зі списком користувачів у рядок значень, розділених комами .Example. The groovy script to convert an object containing a list of users into a comma-separated string of values @@ -418,130 +309,99 @@ set_variable('users',users) ==== . The result of script execution is written to the `users` variable. -//. Результат виконання скрипту записується до змінної `'users'`. + image:bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-9.png[] ==== Modeling a user task to view application data -//==== Моделювання користувацької задачі для перегляду даних про заяву Model a _user task (*User form*) for viewing application data_ and connect it to the business process form using the `Form key` parameter. -//Змоделюйте _користувацьку задачу (*User form*) для перегляду даних про заяву_ та пов'яжіть її з формою бізнес-процесу параметром `Form key`. . In the `Name` field, enter the name of the task. For example, `View application data`. -//. У полі `Name` введіть назву задачі. Наприклад, `Переглянути дані про заяву`. + . In the `Form key` field, enter the business process form key -- `add-zayavaview`. -//. У полі `Form key` введіть ключ форми бізнес-процесу -- `add-zayavaview`. + . In the `Candidate users` field, use the variable that stores the received list of users from Keycloak as a comma-separated string of values -- `${users}`. -//. У полі `Candidate users` використайте змінну, яка зберігає отриманий список користувачів із Keycloak у вигляді рядка значень, розділених комами -- `${users}`. + [NOTE] ==== The list of usernames can be passed both directly (for example, `username1, username2, username3, ...`) and using a variable (herein, `${users}`) where this list is stored. -//Список імен користувачів можна передати як напряму (наприклад, `username1, username2, username3, ...`), так і через змінну (тут -- `${users}`), в якій цей список зберігається. ==== + image:bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-10.png[] In this case, each officer in the corresponding organization (_School 2_) has access to review this task in the personal portal, and will also be able to appoint himself/herself as a performer. -//Таким чином кожна посадова особа відповідної організації (_Школа 2_) матиме доступ до перегляду цієї задачі в особистому Кабінеті, а також зможе призначити себе виконавцем. IMPORTANT: An officer may NOT have access to a business process, but only to a specific task. That means that such a user is not able to start a business process, but is able to perform a certain task within such a process. -//IMPORTANT: Посадова особа може НЕ мати доступу до бізнес-процесу, лише до конкретної задачі. Тобто такий користувач не зможе розпочати бізнес-процес, проте зможе виконати певну задачу в рамках такого процесу. ==== Simulation of the process end event -//==== Моделювання події завершення процесу Model the process end event: -//Змоделюйте подію завершення процесу: -* In the `Name` field, enter the name of the event -- `End`. -//* У полі `Name` введіть назву події -- `Завершення`. -+ +In the `Name` field, enter the name of the event -- `End`. + image:bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-11.png[] == Access settings in Keycloak -//== Налаштування доступу в Keycloak -Let's see how users and their attributes look like from the perspective of the Keycloak service. -//Розглянемо, як саме виглядають користувачі та їх атрибути з погляду сервісу Keycloak. +Let's see what users and their attributes look like from the perspective of the Keycloak service. All users of the Platform and registry, as well as their attributes, are stored in specific Keycloak realmsfootnote:[*Realm* is a concept in https://www.keycloak.org/[Keycloak] that refers to an entity that manages a set of users and their credentials, roles, and groups.], according to their roles. -//Всі користувачі Платформи та реєстру, а також їх атрибути зберігаються у певних реалмахfootnote:[*Realm* - це концепція в https://www.keycloak.org/[Keycloak], яка відноситься до об’єкта, що керує набором користувачів, а також їхніми обліковими даними, ролями та групами.] Keycloak, відповідно до їхньої ролі. -There are 4 main realms: -//Виділяють 4 основні реалми: +There are four main realms: * `-admin` * `-officer-portal` * `-citizen-portal` * `-external-system`. -TIP: To find out more about creatnig users and granting them access rights, see xref:admin:user-management-auth/keycloak-create-users.adoc[this link]. -//TIP: Детальніше про створення користувачів та надання їм прав доступу -- за xref:admin:user-management-auth/keycloak-create-users.adoc[посиланням]. +TIP: To find out more about creating users and granting them access rights, see xref:registry-admin/create-users/overview.adoc[this link]. CAUTION: You have to get the list of users by their attributes from the `-officer-portal` realm, because access to a task is granted to users having the "Officer" role. -//CAUTION: Список користувачів за атрибутами необхідно отримати із реалму `-officer-portal`, адже доступ до задачі надається користувачам із роллю "Посадова особа". . Enter the `-officer-portal` realm. -//. Увійдіть до реалму `-officer-portal`. + image:bp-modeling/bp/keycloak-attributes-access/keycloak-attributes-access-1.png[] . In the sidebar on the left-hand side, go to the *Users* section. Click `View all users` to display the list of all users in this realm. -//. На боковій панелі зліва, перейдіть до розділу *Users*. Натисніть `View all users` для відображення списку усіх користувачів в рамках цього реалму. + image:bp-modeling/bp/keycloak-attributes-access/keycloak-attributes-access-2.png[] . Go to the settings of a particular user. To do this, click the user ID. -//. Перейдіть до налаштувань певного користувача. Для цього натисніть його ID. + image:bp-modeling/bp/keycloak-attributes-access/keycloak-attributes-access-3.png[] . In the *Details* tab, find the username returned in a list to the business process. It corresponds to the `Username` parameter. -//. На вкладці *Details* зверніть увагу на ім'я користувача, що повертається у списку до бізнес-процесу. Воно відповідає параметру `Username`. ++ image:bp-modeling/bp/keycloak-attributes-access/keycloak-attributes-access-4.png[] . Open the *Attributes* tab. -//. Відкрийте вкладку *Attributes*. + User attributes are defined as pairs of keys and their values in the `Key` and `Value` fields. -//Атрибути користувачів визначаються як пари ключів та їх значень у полях `Key` та `Value`. + image:bp-modeling/bp/keycloak-attributes-access/keycloak-attributes-access-5.png[] So we can see that the user with the `auto-user-data` name has the `edrpou` and `drfo` attributes configured. The parameters have the values of the EDRPOU and DRFO codes -- `11111111` and `2222222222`, respectively. The `edrpou` attribute defines that this user belongs to the organization with the `11111111` code. The `drfo` attribute defines the identification number of this user. -//Таким чином, ми бачимо, що користувач з іменем `auto-user-data` має налаштовані атрибути `edrpou` та `drfo`. Параметри мають значення кодів ЄДРПОУ та ДРФО -- `11111111` та `2222222222` відповідно. Атрибут `edrpou` визначає приналежність цього користувача до організації із кодом `11111111`. Атрибут `drfo` визначає ідентифікаційний номер цього користувача. NOTE: Keycloak does not have a clear distribution into organizations. Such distribution is set by the `edrpou` attribute. That means, if a certain organization has the EDRPOU code `11111111`, then every user with the attribute `"edrpou":"11111111"` belongs to that organization. -//NOTE: У Keycloak немає чіткого розподілу на організації. Такий розподіл встановлюється атрибутом `edrpou`. Тобто якщо певна організація має код ЄДРПОУ `11111111`, то кожна особа з атрибутом `"edrpou":"11111111"` належатиме до такої організації. == Implementation at API level -//== Імплементація на рівні API For the functioning of the `${getUsersByAttributesFromKeycloak}` delegate, an additional endpoint has been developed at the Java API level to receive a list of users from the Keycloak service by `edrpou` and `drfo` attributes. -//Для функціонування делегата `${getUsersByAttributesFromKeycloak}`, на рівні Java API розроблено додатковий ендпоінт для отримання списку користувачів із сервісу Keycloak за атрибутами `edrpou` та `drfo`. .A request to the Keycloak API resource -//.Запит до ресурсу в Keycloak API ==== - Resource: :: -//Ресурс: :: + ---- POST /realms/{realm}/users/search ---- * `POST`: HTTP method. -//* `POST` -- HTTP-метод. * `{realm}`: The realm in Keycloak. For example, `-officer-portal`. -//* `{realm}` -- реалм у Keycloak. Наприклад, `-officer-portal`. * `/users/search`: The resource/endpoint. -//* `/users/search` -- ресурс/ендпоінт. Request body: :: -//Тіло запита: :: + + [source,json] ---- @@ -555,10 +415,8 @@ Request body: :: ==== The API returns an object with a list of users based on the specified attributes. -//API повертає об'єкт зі списком користувачів за вказаними атрибутами. .Example. Response from Keycloak API -//.Приклад. Відповідь від Keycloak API ==== [source,json] ---- @@ -570,6 +428,4 @@ The API returns an object with a list of users based on the specified attributes ... } ---- -==== - - +==== \ No newline at end of file diff --git a/docs/en/modules/registry-develop/pages/bp-modeling/bp/bp-alternative-branches.adoc b/docs/en/modules/registry-develop/pages/bp-modeling/bp/bp-alternative-branches.adoc index c82b53a779..34dd528c42 100644 --- a/docs/en/modules/registry-develop/pages/bp-modeling/bp/bp-alternative-branches.adoc +++ b/docs/en/modules/registry-develop/pages/bp-modeling/bp/bp-alternative-branches.adoc @@ -93,7 +93,7 @@ image:bp-modeling/forms/admin-portal-form-modeling-step-1.png[] . Go to the UI form modelling service for business processes. //. Перейдіть до сервісу моделювання UI-форм для бізнес-процесів. + -image:bp-modeling/forms/admin-portal-form-modeling-step-2.png[] +image:registry-admin/admin-portal/ui-forms/ui-forms-1.png[] . Create a new form for data signature using QES, or open one of the previously modelled forms. //. Створіть нову форму для підпису даних КЕП, або відкрийте одну зі змодельованих попередньо. diff --git a/docs/en/modules/registry-develop/pages/bp-modeling/bp/bpmn/events/message-event.adoc b/docs/en/modules/registry-develop/pages/bp-modeling/bp/bpmn/events/message-event.adoc index 694ab28517..91b136a9f2 100644 --- a/docs/en/modules/registry-develop/pages/bp-modeling/bp/bpmn/events/message-event.adoc +++ b/docs/en/modules/registry-develop/pages/bp-modeling/bp/bpmn/events/message-event.adoc @@ -1,139 +1,106 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - -//= Подія «Повідомлення» = Message event +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] + +include::platform:ROOT:partial$admonitions/language-en.adoc[] -//== Загальний опис == Overview -//Подія «Повідомлення» (*Message Event*) -- це подія у бізнес-процесі, яка використовується для передачі інформації від одного бізнес-процесу до іншого бізнес-процесу або підпроцесу. Згенероване вихідне повідомлення (подія-відправник) активує елемент, що приймає повідомлення (подія-одержувач), який з ним пов'язаний. -*Message event* -- is a business process event used to transfer information from one business process to another one, or a subprocess. The generated outgoing message (sender-event) activates the element that receives the corresponding message (receiver-event). +*_Message event_* is a business process event used to transfer information from one business process to another one, or a subprocess. The generated outgoing message (sender-event) activates the element that receives the corresponding message (receiver-event). image:bp-modeling/bp/events/message-event/message-event-01.png[] -//Елементи події, що надсилають та приймають повідомлення, _повинні бути взаємопов'язаними_ та мати відповідні налаштування обміну інформацією. The event elements that send and receive messages _must be interconnected_ and have the corresponding information exchange configuration. -//При моделюванні застосовуються такі типи подій повідомлення: :: -The following types of message events are used in modelling: :: +The following types of message events are used in modeling: :: + +. xref:#message-end-event[*Message End Event*] -- an event that is modeled at the end of a business process or subprocess. It is configured to send a data array, certain attributes, or a text message. + +. xref:#message-start-event[*Message Start Event*] -- an event that is modeled at the initiation of a business process or subprocess start. It is configured to receive a data array, certain attributes, or a text message from End Message Event or Message Intermediate Throw Event element. -//. xref:#message-end-event[Кінцева подія повідомлення (*Message End Event*)] -- подія, що моделюється при завершенні бізнес-процесу чи підпроцесу, і яка налаштовується для відправки масиву даних, певних атрибутів або тестового повідомлення. -. xref:#message-end-event[*Message End Event*] -- an event that is modelled at the end of a business process or subprocess. It is configured to send a data array, certain attributes, or a text message. -//. xref:#message-start-event[Стартова подія повідомлення (*Message Start Event*)] -- подія, що моделюється при ініціюванні старту нового бізнес- процесу чи підпроцесу, і яка налаштовується для отримання масиву даних, певних атрибутів або тестового повідомлення від елемента End Message Event або Message Intermediate Throw Event. -. xref:#message-start-event[*Message Start Event*] -- an event that is modelled at the initiation of a business process or subprocess start. It is configured to receive a data array, certain attributes, or a text message from End Message Event or Message Intermediate Throw Event element. -//. xref:#message-intermediate-throw-event[Проміжна подія відправки повідомлення (*Message Intermediate Throw Event*)] -- подія, що моделюється при проходженні бізнес-процесу чи підпроцесу, і яка налаштовується для відправки масиву даних, певних атрибутів або тестового повідомлення. -. xref:#message-intermediate-throw-event[*Message Intermediate Throw Event*] -- an event that is modelled during business process or subprocess running. It is configured to send a data array, certain attributes, or a text message. -//. xref:#message-intermediate-catch-event[Проміжна подія отримання повідомлення (*Message Intermediate Catch Event*)] -- подія, що моделюється при проходженні бізнес-процесу чи підпроцесу, і яка налаштовується для отримання масиву даних, певних атрибутів або тестового повідомлення від елемента End Message Event або Message Intermediate Throw Event. -. xref:#message-intermediate-catch-event[*Message Intermediate Catch Event*] -- an event that is modelled during business process or subprocess running. It is configured to receive a data array, certain attributes, or a text message from End Message Event or Message Intermediate Throw Event element. +. xref:#message-intermediate-throw-event[*Message Intermediate Throw Event*] -- an event that is modeled during business process or subprocess running. It is configured to send a data array, certain attributes, or a text message. + +. xref:#message-intermediate-catch-event[*Message Intermediate Catch Event*] -- an event that is modeled during business process or subprocess running. It is configured to receive a data array, certain attributes, or a text message from End Message Event or Message Intermediate Throw Event element. [#message-end-event] -//== Моделювання та налаштування кінцевої події повідомлення -== Message End Event modelling and configuring -//Для моделювання та налаштування кінцевої події повідомлення, необхідно виконати наступні налаштування: +== Message End Event modeling and configuring + To model and configure Message End Event, make the following configurations: [IMPORTANT] ==== -//Передумови :: + Prerequisites :: -//Підготуйте 2 змодельовані бізнес-процеси в рамках 2-х пулів, що мають взаємодіяти між собою за допомогою повідомлень (_тут -- процеси *Send Message* та *Receive Message_*). -Prepare 2 modelled business process within 2 pools that will interact with each other via messages (_here we will use *Send Message* and *Receive Message_* processes). +Prepare 2 modeled business process within 2 pools that will interact with each other via messages (_here we will use *Send Message* and *Receive Message_* processes). ==== -//. В рамках бізнес-процесу, що надсилатиме інформацію (*Send Message*), додайте подію завершення процесу. . Add a process end event in the *Send Message* business process. + image:bp-modeling/bp/events/message-event/mess1_1.png[] -//. Виділіть подію завершення процесу та визначте її тип. Для цього натисніть _іконку ключа_ та оберіть в налаштуваннях значення *Message End Event*. . Select the process end event and define its type by clicking the _key icon_ and selecting *Message End Event* in configuration. + image:bp-modeling/bp/events/message-event/mess1_2.png[] -//. На вкладці *General* налаштуйте делегат для надсилання даних повідомлення: . On the *General* tab configure a delegate for message data sending: -//* У полі `Id` вкажіть робочий ідентифікатор елемента, або залиште значення за замовчуванням. -//* У полі `Name` вкажіть робочу назву елемента. -//* У полі `Implementation` оберіть зі списку значення `Delegate Expression`. -//* У полі `Delegate Expression` вкажіть значення делегата -- `${startProcessByMessageDelegate}`. * In the `Id` field, enter element identificator, or use the default value. * In the `Name` field, enter element name. * In the `Implementation` field, select `Delegate Expression` from the list. * In the `Delegate Expression` field, enter delegate value -- `${startProcessByMessageDelegate}`. + -//NOTE: На відміну від інших типових розширень-делегатів для моделювання бізнес-процесів, що мають xref:bp-modeling/bp/element-templates/bp-element-templates-installation-configuration.adoc[розроблені шаблони], делегат `startProcessByMessageDelegate`, який використовується при моделюванні подій «Повідомлення», налаштовується в ручному режимі. -NOTE: As opposed to other delegate expressions for business process modelling that have xref:bp-modeling/bp/element-templates/bp-element-templates-installation-configuration.adoc[developed templates], the `startProcessByMessageDelegate` delegate used in Message events is configured manually. +NOTE: As opposed to other delegate expressions for business process modeling that have xref:bp-modeling/bp/element-templates/element-templates-overview.adoc[developed templates], the `startProcessByMessageDelegate` delegate used in Message events is configured manually. -//* Розгорніть блок *Details*, натиснувши клавішу `+` (позначка плюса). -//* У полі `Global Message Name` вкажіть назву елемента, що прийматиме повідомлення (наприклад, `startProcessReceiveMessageAfterSystemTask`). * Expand the *Details* block by clicking the `+` button. * In the `Global Message Name` field, enter a name for the message receiving element (for example `startProcessReceiveMessageAfterSystemTask`). + [CAUTION] ==== -//Вказана назва має бути ідентичною для 2-х взаємопов'язаних елементів -- елемента, що надсилає дані повідомлення, та елемента, що ці дані приймає. + The name must be identical for two interconnected elements - the data sending element, and the data receiving element. -//Один елемент, що надсилає повідомлення, може бути взаємопов'язаний тільки з одним елементом, що приймає повідомленням. One message sending element can be interconnected with only one message receiving element. ==== -//* У полі `Global Message referenced` оберіть зі списку значення посилання до елемента, що приймає дані, вказаного у полі `Global Message Name`. * In the `Global Message referenced` field, select data receiving element link value from the list (referenced in `Global Message Name` field). + [CAUTION] ==== -//Якщо при моделюванні бізнес-процесів в рамках одного _.bpmn_-файлу використовуються декілька взаємопов'язаних елементів подій повідомлення, то у полі `Global Message referenced`, у випадному списку відображатимуться всі раніше встановлені значення елементів, що отримують повідомлення. Будьте уважними при налаштуванні цього параметра та обирайте саме той елемент кореляції, який потрібен. -If several interconnected elements of message events are used in the business process modelling within one _.bpmn_-file, then the dropdown list will show all the previously set values of message receiving elements. Be attentive when configuring this parameter and select the corresponding element. -//При зміні значення у полі `Global Message referenced`, автоматично заповнюється ідентичне значення для поля `Global Message Name`. +If several interconnected elements of message events are used in the business process modeling within one _.bpmn_-file, then the dropdown list will show all the previously set values of message receiving elements. Be attentive when configuring this parameter and select the corresponding element. + When changing values in the `Global Message referenced` field, an identical value automatically fills in the `Global Message Name` field. ==== + image:bp-modeling/bp/events/message-event/mess1_3.png[] -//. Перейдіть на вкладку *Input\Output* та налаштуйте масив даних, атрибути або текстове повідомлення, що передаватимуться до бізнес-процесу (підпроцесу), що прийматиме дані: . Navigate to the *Input\Output* tab and configure data array, attributes or text message that will be transferred to the receiving business process or subprocess: -//* Навпроти секції *Input Parameters* натисніть клавішу `+` (позначка плюса), після чого буде автоматично додано вхідний параметр, який необхідно налаштувати відповідно до даних, що передаватимуться до іншого бізнес-процесу (підпроцесу). * Click the `+` button in front of the *Input Parameters* section. This will automatically enter the incoming parameter, which you need to configure according to the data that is to be transferred to the other business process or subprocess. + image:bp-modeling/bp/events/message-event/mess1_4.png[] -//* У полі `Local Variable Name` вкажіть назву локальної змінної або залиште значення за замовчуванням. * In the `Local Variable Name` field, enter the name for the local variable, or use default name. + image:bp-modeling/bp/events/message-event/mess1_5.png[] -//* У полі `Variable Assignment Type` оберіть тип змінної та налаштуйте її наступним чином: * In the `Variable Assignment Type` field, select variable type and configure it in the following way: + [TIP] ==== -//Існує 4 доступних способи призначення змінної: + There are for ways to assign the variable: -//* рядок або вираз (`String or Expression`); -//* скрипт (`Script`); -//* масив або список (`List`); -//* набір пар ключ-значення (`Map`). + + + * `String or Expression`; * `Script`; * `List`; @@ -141,83 +108,75 @@ There are for ways to assign the variable: ==== - -//* При виборі типу `String or Expression`, вкажіть у полі `Variable Assignment Value` вираз змінної, що передаватиметься за допомогою JUEL-функції. * When selecting `String or Expression` type, set the transferred variable expression in the `Variable Assignment Value` field via JUEL-function. + [TIP] ==== -//За детальною інформацією щодо підтримуваних Платформою JUEL-функцій, зверніться до сторінки xref:bp-modeling/bp/modeling-facilitation/modelling-with-juel-functions.adoc[]. + You can find more details on the JUEL-functions supported by the Platform on the following page: xref:bp-modeling/bp/modeling-facilitation/modelling-with-juel-functions.adoc[]. ==== + image:bp-modeling/bp/events/message-event/mess1_6.png[] -//* При виборі типу `Script`, вкажіть дані скрипту у полях `Script Format`, `Script Type` та `Script`. * When selecting `Script` type, enter script data in the `Script Format`, `Script Type` and `Script` fields. + image:bp-modeling/bp/events/message-event/mess1_7.png[] -//* При виборі типу `List`, натисніть `+` (`Add Value`) та у полі `Value` вкажіть значення змінної (текст або за допомогою JUEL-функції). * When selecting `List` type, click `+` (`Add Value`), and set variable value (text or JUEL-function) in the `Value` field. + image:bp-modeling/bp/events/message-event/mess1_8.png[] -//* При виборі типу `Map`, натисніть кнопку `+` (`Add Entry`) , у полі `Key` вкажіть назву змінної, а в полі `Value` вкажіть значення змінної (текст або за допомогою JUEL-функцій). * When selecting `Map` type, click `+` (`Add Entry`), set variable name in the `Key` field, and set variable value (text or JUEL-function) in the `Value` field. + image:bp-modeling/bp/events/message-event/mess1_9.png[] -//* За необхідності, навпроти секції *Input Parameters* натисніть кнопку `+` та сконфігуруйте значення наступної змінної. * If needed, click `+` in front of the *Input Parameters* section, and configure the next variable value. -//.Приклади конфігурації змінних для кінцевої події повідомлення .Examples of variable configuration for the message end event ==== image:bp-modeling/bp/events/message-event/mess1_10.png[] image:bp-modeling/bp/events/message-event/mess1_11.png[] +==== + +[TIP] +==== +[%collapsible] +.Where can I find an example of a reference business process? +===== +include::partial$snippets/demo-reg-reference-examples-en.adoc[] -//TIP: Скористайтеся референтним прикладом бізнес-процесу для отримання деталей: link:{attachmentsdir}/bp-modeling/bp/message-event/Process_checkIntermediateThrowEvent.bpmn[_Process_checkIntermediateThrowEvent.bpmn_]. -TIP: Use business process reference example for details: link:{attachmentsdir}/bp-modeling/bp/message-event/Process_checkIntermediateThrowEvent.bpmn[_Process_checkIntermediateThrowEvent.bpmn_]. +An example of a BPMN process diagram will be available in the demo-registry's regulations by searching for the keywords -- *_checkIntermediateThrowEvent_*. The names of the forms can be found inside the corresponding User Tasks of the business process in the *`Form key`* field. +===== ==== [#message-start-event] -//== Моделювання та налаштування стартової події повідомлення -== Message Start Event modelling and configuring +== Message Start Event modeling and configuring -//Для моделювання та налаштування стартової події повідомлення, необхідно виконати наступні налаштування: To model and configure Message Start Event, make the following configurations: [IMPORTANT] ==== -//Передумови :: + Prerequisites :: -// Підготуйте 2 змодельовані бізнес-процеси в рамках 2-х пулів, що мають взаємодіяти між собою за допомогою повідомлень (_тут -- процеси *Send Message* та *Receive Message_*). -Prepare 2 modelled business process within 2 pools that will interact with each other via messages (_here we will use *Send Message* and *Receive Message_* processes). +Prepare two modeled business processes within 2 pools that will interact with each other via messages (_here we will use *Send Message* and *Receive Message_* processes). ==== -// . В рамках бізнес-процесу, що прийматиме інформацію (*Receive Message*), додайте стартову подію. . Add a process start event in the *Receive Message* business process. + image:bp-modeling/bp/events/message-event/mess1_12.png[] -//. Виділіть початкову подію та визначте її тип. Для цього натисніть _іконку ключа_ та оберіть в налаштуваннях значення *Message Start Event*. + . Select the process start event and define its type by clicking the _key icon_ and selecting *Message Start Event* in configuration. + image:bp-modeling/bp/events/message-event/mess1_13.png[] -//. На вкладці *General* налаштуйте елемент для отримання даних повідомлення: + . In the *General* tab, configure the message receiving element: -//* У полі `Id` вкажіть робочий ідентифікатор елемента або залиште значення за замовчуванням. -//* У полі `Name` вкажіть робочу назву елемента. -//* Навпроти секції *Details* натисніть клавішу `+` (позначка плюса). -//* У полі `Global Message Name` вкажіть назву елемента, що прийматиме дані, і значення якого було вказано для події повідомлення, що надсилатиме дані (End Message Event або Message Intermediate Throw Event). -//Наприклад, `startProcessReceiveMessageAfterSystemTask`. * In the `Id` field, enter element identificator, or use the default value. * In the `Name` field, enter element name. * Click `+` in front of the *Details* section. @@ -227,23 +186,19 @@ For example, `startProcessReceiveMessageAfterSystemTask`. + [CAUTION] ==== -//Вказана назва має бути ідентичною для 2-х взаємопов'язаних елементів -- елемента, що надсилає дані повідомлення, та елемента, що ці дані приймає. + The name must be identical for two interconnected elements - the data sending element, and the data receiving element. -//Один елемент, що надсилає повідомлення, може бути взаємопов'язаний тільки з одним елементом, що приймає повідомленням. One message sending element can be interconnected with only one message receiving element. ==== -//* У полі `Global Message referenced` оберіть зі списку значення посилання елемента, що приймає дані, вказаного у полі `Global Message Name`. * In the `Global Message referenced` field, select data receiving element link value from the list (referenced in `Global Message Name` field). + [CAUTION] ==== -//Якщо при моделюванні бізнес-процесів в рамках одного _.bpmn_-файлу використовуються декілька взаємопов'язаних елементів подій повідомлення, то у полі `Global Message referenced`, у випадному списку відображатимуться всі раніше встановлені значення елементів, що отримують повідомлення. Будьте уважними при налаштуванні цього параметра та обирайте саме той елемент кореляції, який потрібен. -If several interconnected elements of message events are used in the business process modelling within one _.bpmn_-file, then the dropdown list will show all the previously set values of message receiving elements. Be attentive when configuring this parameter and select the corresponding element. +If several interconnected elements of message events are used in the business process modeling within one _.bpmn_-file, then the dropdown list will show all the previously set values of message receiving elements. Be attentive when configuring this parameter and select the corresponding element. -//При зміні значення у полі `Global Message referenced`, автоматично заповнюється ідентичне значення для поля `Global Message Name`. When changing values in the `Global Message referenced` field, an identical value automatically fills in the `Global Message Name` field. ==== @@ -251,160 +206,131 @@ When changing values in the `Global Message referenced` field, an identical valu image:bp-modeling/bp/events/message-event/mess1_14.png[] [#message-intermediate-throw-event] -//== Моделювання та налаштування проміжної події відправки повідомлення -== Intermediate Throw Event modelling and configuring +== Intermediate Throw Event modeling and configuring -//Для моделювання та налаштування проміжної події відправки повідомлення, необхідно виконати наступні налаштування: To model and configure Intermediate Throw Event, make the following configurations: - [IMPORTANT] ==== -//Передумови :: Prerequisites :: -//Підготуйте 2 змодельовані бізнес-процеси в рамках 2-х пулів, що мають взаємодіяти між собою за допомогою повідомлень (_тут -- процеси *Send Message* та *Receive Message_*). -Prepare 2 modelled business process within 2 pools that will interact with each other via messages (_here we will use *Send Message* and *Receive Message_* processes). +Prepare two modeled business processes within 2 pools that will interact with each other via messages (_here we will use *Send Message* and *Receive Message_* processes). ==== -//. В рамках бізнес-процесу, що надсилатиме інформацію (*Send Message*), додайте проміжну подію (Intermediate/Boundary Event). -. Add an Intermediate/Boundary Event event in the *Receive Message* business process. +. Add an *Intermediate/Boundary Event* in the *Receive Message* business process. + image:bp-modeling/bp/events/message-event/mess1_15.png[] -//. Змоделюйте взаємодію між двома процесами. + . Model the interaction between the two processes. + image:bp-modeling/bp/events/message-event/mess1_16.png[] -//. Виділіть проміжну подію та визначте її тип. Для цього натисніть _іконку ключа_ та оберіть в налаштуваннях значення *Message Intermediate Throw Event*. + . Select the intermediate event and define its type by clicking the _key icon_ and selecting *Message Intermediate Throw Event* in configuration. + image:bp-modeling/bp/events/message-event/mess1_17.png[] -//. На вкладці *General* налаштуйте делегат для надсилання даних повідомлення: -. On the *General* tab configure a delegate for message data sending: +. On the *General* tab, configure a delegate for message data sending: -//* У полі `Id` вкажіть робочий ідентифікатор елемента, або залиште значення за замовчуванням. -//* У полі `Name` вкажіть робочу назву елемента. -//* У полі `Implementation` оберіть зі списку значення `Delegate Expression`. -//* У полі `Delegate Expression` вкажіть значення делегата -- `${startProcessByMessageDelegate}`. * In the `Id` field, enter element identificator, or use the default value. * In the `Name` field, enter element name. * In the `Implementation` field, select `Delegate Expression` from the list. * In the `Delegate Expression` field, enter delegate value -- `${startProcessByMessageDelegate}`. + -//NOTE: На відміну від інших типових розширень-делегатів для моделювання бізнес-процесів, що мають xref:bp-modeling/bp/element-templates/bp-element-templates-installation-configuration.adoc[розроблені шаблони], делегат `startProcessByMessageDelegate`, який використовується при моделюванні подій «Повідомлення», налаштовується в ручному режимі. -NOTE: As opposed to other delegate expressions for business process modelling that have xref:bp-modeling/bp/element-templates/bp-element-templates-installation-configuration.adoc[developed templates], the `startProcessByMessageDelegate` delegate used in Message events is configured manually. +NOTE: As opposed to other delegate expressions for business process modeling that have xref:bp-modeling/bp/element-templates/element-templates-overview.adoc[developed templates], the `startProcessByMessageDelegate` delegate used in Message events is configured manually. -//* Розгорніть блок *Details*, натиснувши клавішу `+` (позначка плюса). * Expand the *Details* block by clicking `+`. -//* У полі `Global Message Name` вкажіть назву елемента, що прийматиме повідомлення (наприклад, `startProcessReceiveMessageExec`). + * * In the `Global Message Name` field, enter a name for the message receiving element (for example `startProcessReceiveMessageExec`). + [CAUTION] ==== -//Вказана назва має бути ідентичною для 2-х взаємопов'язаних елементів -- елемента, що надсилає дані повідомлення, та елемента, що ці дані приймає. The name must be identical for two interconnected elements - the data sending element, and the data receiving element. -//Один елемент, що надсилає повідомлення, може бути взаємопов'язаний тільки з одним елементом, що приймає повідомленням. One message sending element can be interconnected with only one message receiving element. ==== -//* У полі `Global Message referenced` оберіть зі списку значення посилання до елемента, що приймає дані, вказаного у полі `Global Message Name`. * In the `Global Message referenced` field, select data receiving element link value from the list (referenced in `Global Message Name` field). + [CAUTION] ==== -//Якщо при моделюванні бізнес-процесів в рамках одного _.bpmn_-файлу використовуються декілька взаємопов'язаних елементів подій повідомлення, то у полі `Global Message referenced`, у випадному списку відображатимуться всі раніше встановлені значення елементів, що отримують повідомлення. Будьте уважними при налаштуванні цього параметра та обирайте саме той елемент кореляції, який потрібен. -If several interconnected elements of message events are used in the business process modelling within one _.bpmn_-file, then the dropdown list will show all the previously set values of message receiving elements. Be attentive when configuring this parameter and select the corresponding element. -// При зміні значення у полі `Global Message referenced`, автоматично заповнюється ідентичне значення для поля `Global Message Name`. +If several interconnected elements of message events are used in the business process modeling within one _.bpmn_-file, then the dropdown list will show all the previously set values of message receiving elements. Be attentive when configuring this parameter and select the corresponding element. + When changing values in the `Global Message referenced` field, an identical value automatically fills in the `Global Message Name` field. ==== + image:bp-modeling/bp/events/message-event/mess1_18.png[] -//. Перейдіть на вкладку *Input\Output* та налаштуйте масив даних, атрибути або текстове повідомлення, що передаються іншому бізнес-процесу (підпроцесу). . Navigate to the *Input\Output* tab and configure data array, attributes or text message that will be transferred to the receiving business process or subprocess: -//TIP: Налаштування input/output-параметрів делегата детально описані у розділі xref:#message-end-event[]. TIP: Input/output parameters of the delegate are descriped in the xref:#message-end-event[] section. - -//.Приклади конфігурації змінних для проміжної події відправки повідомлення .Configuration examples for the Message Intermediate Throw event ==== image:bp-modeling/bp/events/message-event/mess1_19.png[] image:bp-modeling/bp/events/message-event/mess1_20.png[] +==== -//TIP: Скористайтеся референтним прикладом бізнес-процесу для отримання деталей: link:{attachmentsdir}/bp-modeling/bp/message-event/Process_checkIntermediateThrowEvent.bpmn[_Process_checkIntermediateThrowEvent.bpmn_]. -TIP: Use business process reference example for details: link:{attachmentsdir}/bp-modeling/bp/message-event/Process_checkIntermediateThrowEvent.bpmn[_Process_checkIntermediateThrowEvent.bpmn_]. +[TIP] +==== +[%collapsible] +.Where can I find an example of a reference business process? +===== +include::partial$snippets/demo-reg-reference-examples-en.adoc[] + +An example of a BPMN process diagram will be available in the demo-registry's regulations by searching for the keywords -- *_checkIntermediateThrowEvent_*. The names of the forms can be found inside the corresponding User Tasks of the business process in the *`Form key`* field. +===== ==== [#message-intermediate-catch-event] -//== Моделювання та налаштування проміжної події отримання повідомлення -== Message Intermediate Catch Event modelling and configuring +== Message Intermediate Catch Event modeling and configuring To model and configure Message Intermediate Catch Event, make the following configurations: -[IMPORTANT] +[NOTE,caption="prerequisites"] ==== -//Передумови :: -Prerequisites :: - -//Підготуйте 2 змодельовані бізнес-процеси в рамках 2-х пулів, що мають взаємодіяти між собою за допомогою повідомлень (_тут -- процеси *Send Message* та *Receive Message_*). -Prepare 2 modelled business process within 2 pools that will interact with each other via messages (_here we will use *Send Message* and *Receive Message_* processes). +Prepare two modeled business processes within two pools that will interact with each other via messages (_here we will use *Send Message* and *Receive Message_* processes). ==== -. В рамках бізнес-процесу, що прийматиме інформацію (_тут -- *Receive Message_*), додайте проміжну подію. . Add an intermediate event in the *Receive Message* business process. - + image:bp-modeling/bp/events/message-event/mess1_21.png[] -//. Виділіть проміжну подію та визначте її тип. Для цього натисніть _іконку ключа_ та оберіть в налаштуваннях значення *Message Intermediate Catch Event*. + . Select the intermediate event and define its type by clicking the _key icon_ and selecting *Message Intermediate Catch Event* in configuration. + image:bp-modeling/bp/events/message-event/mess1_22.png[] -//. На вкладці *General* налаштуйте елемент для отримання даних повідомлення: + . On the *General* tab, configure the message data receiving element: -//* У полі `Id` вкажіть робочий ідентифікатор елемента або залиште значення за замовчуванням. -//* У полі `Name` вкажіть робочу назву елемента. -//* Навпроти секції *Details* натисніть клавішу `+` (позначка плюса). -//* У полі `Global Message Name` вкажіть назву елемента, що прийматиме дані, і значення якого було вказано для події повідомлення, що надсилатиме дані (End Message Event або Message Intermediate Throw Event). -//Наприклад, `sendIntermediateMessage`. * In the `Id` field, enter element identificator, or use the default value. * In the `Name` field, enter element name. * Click `+` in front of the *Details* section. * In the `Global Message Name` field, enter the name of the data receiving element with the same value that was set for message event sender (End Message Event or Message Intermediate Throw Event). For example, `sendIntermediateMessage`. - + [CAUTION] ==== -//Вказана назва має бути ідентичною для 2-х взаємопов'язаних елементів -- елемента, що надсилає дані повідомлення, та елемента, що ці дані приймає. + The name must be identical for two interconnected elements - the data sending element, and the data receiving element. -//Один елемент, що надсилає повідомлення, може бути взаємопов'язаний тільки з одним елементом, що приймає повідомленням. One message sending element can be interconnected with only one message receiving element. ==== -//* У полі `Global Message referenced` оберіть зі списку значення посилання елемента, що приймає дані, вказаного у полі `Global Message Name`. * In the `Global Message referenced` field, select data receiving element link value from the list (referenced in `Global Message Name` field). + [CAUTION] ==== -//Якщо при моделюванні бізнес-процесів в рамках одного _.bpmn_-файлу використовуються декілька взаємопов'язаних елементів подій повідомлення, то у полі `Global Message referenced`, у випадному списку відображатимуться всі раніше встановлені значення елементів, що отримують повідомлення. Будьте уважними при налаштуванні цього параметра та обирайте саме той елемент кореляції, який потрібен. -If several interconnected elements of message events are used in the business process modelling within one _.bpmn_-file, then the dropdown list will show all the previously set values of message receiving elements. Be attentive when configuring this parameter and select the corresponding element. -// При зміні значення у полі `Global Message referenced`, автоматично заповнюється ідентичне значення для поля `Global Message Name`. +If several interconnected elements of message events are used in the business process modeling within one _.bpmn_-file, then the dropdown list will show all the previously set values of message receiving elements. Be attentive when configuring this parameter and select the corresponding element. + When changing values in the `Global Message referenced` field, an identical value automatically fills in the `Global Message Name` field. ==== diff --git a/docs/en/modules/registry-develop/pages/bp-modeling/bp/bpmn/events/timer-event.adoc b/docs/en/modules/registry-develop/pages/bp-modeling/bp/bpmn/events/timer-event.adoc index cae8a41386..c5275cba17 100644 --- a/docs/en/modules/registry-develop/pages/bp-modeling/bp/bpmn/events/timer-event.adoc +++ b/docs/en/modules/registry-develop/pages/bp-modeling/bp/bpmn/events/timer-event.adoc @@ -1,203 +1,140 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - -//= Подія «Таймер» = Timer Event +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] + +include::platform:ROOT:partial$admonitions/language-en.adoc[] -//== Загальний опис == Overview -//Подія «Таймер» (*Timer Event*) -- це подія, що означає час, і яка активується визначеним таймером. Це може бути конкретно встановлений час або дата, а може -- певний інтервал (кожний понеділок тощо). Кожен таймер має свій час очікування та відповідні налаштування. -A *Timer Event* is an event that is activated by a defined timer. It can be a defined time and date, or a time interval (for example, "every Monday"). Each timer has its own waiting time and corresponding configuration. +A *_Timer Event_* is an event that is activated by a defined timer. It can be a defined time and date, or a time interval, for example, "every Monday". Each timer has its own waiting time and corresponding configuration. image:bp-modeling/bp/events/timer-event/timer-event-01.png[] -//IMPORTANT: Таймер не може бути подією завершення. Це суперечить суті процесного підходу. IMPORTANT: Timer can't be an end event, due to process approach. -//Виділяють 2 типи подій «Таймер», які наразі підтримує Платформа: :: We differentiate 2 types of Timer Events currently supported by the Platform: :: -//* xref:#time-interm-boundary-interrupt-event[Проміжна гранична переривальна подія часу (*Time Intermediate Boundary Interrupting Event*)] -- подія, яка діє як секундомір і виконує обробку подій, активуючи таймер. Коли таймер спрацьовує (наприклад, через певний інтервал), виконується потік послідовності, що виходить із проміжної події таймера. На час очікування поточний потік виконання бізнес-процесу не переривається. * xref:#time-interm-boundary-interrupt-event[*Time Intermediate Boundary Interrupting Event*] -- an event that works like a stopwatch and processes events by activating a timer. When the timer triggers (for example, after a certain interval), a sequence flow that comes from the intermediate timer event is executed. The current flow of business process execution is not paused during the event waiting period. + -//TIP: Іншими словами, коли настає виконання елемента, до якого приєднано граничну подію, потік продовжується. Коли таймер спрацьовує (наприклад, через певний проміжок часу), активність анулюється, і виконується альтернативний потік послідовності, що виходить із події таймера. -TIP: Basically, when an event execution is triggered, provided the event has an interconnected boundary event, the flow is continued. When a timer is triggered (for example, after a certain interval), the activity is nullified, and an alternative sequence flow that comes from the timer event is executed. +TIP: Basically, when an event execution is triggered, provided the event has an interconnected boundary event, the flow is continued. When a timer is triggered, for example, after a certain interval, the activity is nullified, and an alternative sequence flow that comes from the timer event is executed. + image:bp-modeling/bp/events/timer-event/timer-event-02.png[] -//* xref:#time-interm-catch-event[Проміжна оброблювальна подія часу (*Time Intermediate Catch Event*)] -- подія, яка виконує роль секундоміра або будильника і перериває виконання бізнес-процесу у певній точці, очікуючи перехід до виконання наступного елемента бізнес-процесу (тобто продовжує виконання потоку послідовності). На час очікування поточний потік виконання бізнес-процесу призупиняється. * xref:#time-interm-catch-event[*Time Intermediate Catch Event*] -- an event that acts like a stopwatch or an alarm clock, and cuts business process execution at a certain point, waiting for the execution of the next element of the business process (continuing the sequence flow execution). The current flow of business process execution is paused during the event waiting period. + image:bp-modeling/bp/events/timer-event/timer-event-03.png[] -//== Типи таймерів та їх налаштування == Timer types and their configuration -//Таймери, що використовуються при моделюванні подій «Таймер», можуть бути визначені за: -The timers used in Timer Events modelling can be defined by: +The timers used in Timer Events modeling can be defined by: -//Датою (Date) :: Date :: -//_Таймер дати_ встановлює конкретний момент часу, визначений як комбіноване представлення дати та часу за стандартом ISO 8601. Він повинен містити інформацію про часовий пояс або зміщення зони від серверного часу. За бажанням, він може містити ідентифікатор зони. Наприклад, `2019-10-02T08:09:40+02:00[Europe/Kyiv]` (_детальніше -- за https://docs.camunda.io/docs/components/modeler/bpmn/timer-events/#time-date[посиланням]_). _Date timer_ sets a moment in time, defined as a combined representation of date and time according to ISO 8601 standard. Optionally, it can contain time zone identificator. For example, `2019-10-02T08:09:40+02:00[Europe/Kyiv]` (_follow the https://docs.camunda.io/docs/components/modeler/bpmn/timer-events/#time-date[link] more info_). -//Тривалістю (Duration) :: Duration :: -//_Таймер тривалості_ встановлюється відповідно до формату тривалості ISO 8601, який визначає кількість часу у певному часовому проміжку. Наприклад, `P14DT1H30M` -- 14 днів, 1 година і 30 хвилин (_детальніше -- за https://docs.camunda.io/docs/components/modeler/bpmn/timer-events/#time-duration[посиланням]_). _Duration timer_ is set according to the ISO 8601 duration format, which defines the amount of time in a certain time period. For example, `P14DT1H30M` -- 14 days, 1 hour and 30 minutes (_follow the https://docs.camunda.io/docs/components/modeler/bpmn/timer-events/#time-duration[link] more info_). + -//CAUTION: Якщо тривалість дорівнює нулю або від’ємна, таймер спрацьовує негайно. CAUTION: If the duration is set to zero or a negative value, the timer will trigger immediately. -//Циклом (Cycle) :: Cycle :: -//_Таймер циклу_ визначається як формат повторюваних інтервалів ISO 8601; він містить тривалість і кількість повторів. Наприклад, R5/PT10S -- повторювати кожні 10 секунд, 5 разів (_детальніше -- за https://docs.camunda.io/docs/components/modeler/bpmn/timer-events/#time-cycle[посиланням]_) -_Cycle timer_ is defined as ISO 8601 repeated interval format; it includes duration and the number of cycles. For example, R5/PT10S -- repeat every 10 second, 5 times (_follow the https://docs.camunda.io/docs/components/modeler/bpmn/timer-events/#time-cycle[link] more info_). +_Cycle timer_ is defined as ISO 8601 repeated interval format; it includes duration and the number of cycles. For example, R5/PT10S -- repeat every 10 seconds, 5 times (_follow the https://docs.camunda.io/docs/components/modeler/bpmn/timer-events/#time-cycle[link] more info_). + -//CAUTION: Якщо повтори не визначені, таймер повторюється нескінченно, доки його не скасують. -CAUTION: If the number of cycles is not set, the timer will trigger infinitely, until cancelled. +CAUTION: If the number of cycles is not set, the timer will trigger infinitely, until canceled. [#time-interm-boundary-interrupt-event] -//== Моделювання граничної переривальної події часу -== Time Intermediate Boundary Interrupting Event modelling +== Time Intermediate Boundary Interrupting Event modeling -//Для моделювання проміжної граничної переривальної події «Таймер» (*Time Intermediate Boundary Interrupting Event*) необхідно виконати наступні кроки: To model Time Intermediate Boundary Interrupting Event, take the following steps: -//. Відкрийте додаток **Camunda Modeler** та створіть нову **діаграму BPMN**, натиснувши кнопку `BPMN diagram`. -//В результаті з`явиться вікно нової діаграми. . Open **Camunda Modeler** application and create a new **BPMN diagram** by clicking `BPMN diagram`. This will open the new diagram window. + image:registry-develop:bp-modeling/bp/modeling-instruction/bp-1.png[] [start=2] -//. Додайте елемент Intermediate Boundary Interrupting Event: . Add the Intermediate Boundary Interrupting Event element -//* З панелі інструментів, що знаходиться зліва, оберіть елемент *Create Intermediate/Boundary Event* та перетягніть його безпосередньо на змодельовану задачу (тут -- _користувацька задача_). * Select *Create Intermediate/Boundary Event* on the panel on the left and drag it onto the modelled task (in this case -- _user task_). + -//TIP: Для приєднання таймера можна використовувати задачу будь-якого типу: _користувацька, сервісна або задача скриптування_ тощо. -TIP: To add a timer you can use any type of task: _user, service, script_, etc. +TIP: To add a timer, you can use any type of task: _user, service, script_, etc. + image:bp-modeling/bp/events/timer-event/timer-event-1.png[] image:bp-modeling/bp/events/timer-event/timer-event-2.png[] -//* Виділіть подію, визначте її тип, натиснувши іконку ключа (*Change type*) та обравши з меню пункт *Timer Boundary Event*. * Select an event, define its type by clicking the key icon (*Change type*) and selecting *Timer Boundary Event* from the menu. + image:bp-modeling/bp/events/timer-event/timer-event-3.png[] -//. Натисніть елемент *Timer Boundary Event*, перейдіть до панелі налаштувань та сконфігуруйте подію: . Click the *Timer Boundary Event* element, navigate to the configuration panel and configure the event: -//* У полі `Name` введіть ім’я елемента (опціонально). Це може бути призначення таймера або бізнес-назва. -* In the `Name` field, enter element name (optional). It can be timer purpose, or business-related name. -//* У полі `Timer Definition Type` вкажіть тип таймера. З випадного списку оберіть одне зі значень. Наприклад, `Duration`, тобто тривалість (_детальніше про типи таймерів -- за https://docs.camunda.io/docs/components/modeler/bpmn/timer-events/#timers[посиланням]_). +* In the `Name` field, enter element name (optional). It can be a timer purpose, or business-related name. * In the `Timer Definition Type` field, set timer type by selecting one from the dropdown. For example, `Duration` (_follow the https://docs.camunda.io/docs/components/modeler/bpmn/timer-events/#timers[link] more info_) + image:bp-modeling/bp/events/timer-event/timer-event-4.png[] -//* У полі `Timer Definition` визначте тривалість таймера. Наприклад, `PT3S`, що відповідає 3 секундам. * In the `Timer Definition` field, define timer duration. For example, `PT3S` for 3 seconds. + -//TIP: У Сamunda дата і час для таймерів встановлюється у спеціальному форматі, відповідно до стандарту ISO 8601. Детальніше -- за https://docs.camunda.io/docs/components/modeler/bpmn/timer-events/#time-duration[посиланням]. TIP: In Camunda, date and time for timers are set in a special format, according to ISO 8601 standard (_follow the https://docs.camunda.io/docs/components/modeler/bpmn/timer-events/#time-duration[link] more info_). + image:bp-modeling/bp/events/timer-event/timer-event-5.png[] -//В результаті гранична переривальна подія часу змодельована та налаштована. -As a result, your Time Intermediate Boundary Interrupting Event is modelled and configured. +As a result, your Time Intermediate Boundary Interrupting Event is modeled and configured. [#time-interm-catch-event] -// == Моделювання проміжної оброблювальної події часу -== Time Intermediate Catch Event modelling +== Time Intermediate Catch Event modeling -//Для моделювання проміжної оброблювальної події часу (*Time Intermediate Catch Event*) необхідно виконати наступні кроки: To model Time Intermediate Catch Event, make the following steps: -//. Відкрийте додаток **Camunda Modeler** та створіть нову **діаграму BPMN**, натиснувши кнопку `BPMN diagram`. -//В результаті з`явиться вікно нової діаграми. . Open **Camunda Modeler** application and create a new **BPMN diagram** by clicking `BPMN diagram`. This will open the new diagram window. + image:registry-develop:bp-modeling/bp/modeling-instruction/bp-1.png[] -//. Попередньо змоделюйте стартову подію та користувацьку задачу. . First, model a start event and a user task. -//. Додайте елемент *Time Intermediate Catch Event*: . Add the *Time Intermediate Catch Event* element: -//* З панелі інструментів, що знаходиться зліва, оберіть елемент *Create Intermediate/Boundary Event* та перетягніть його до області моделювання. -* On the left panel, select *Create Intermediate/Boundary Event* and drag it to the modelling canvas. +* On the left panel, select *Create Intermediate/Boundary Event* and drag it to the modeling canvas. + image:bp-modeling/bp/events/timer-event/timer-event-1.png[] + image:bp-modeling/bp/events/timer-event/timer-event-6.png[] -//* Виділіть подію, визначте її тип, натиснувши іконку ключа (*Change type*) та обравши з меню пункт *Timer Intermediate Catch Event*. * * Select an event, define its type by clicking the key icon (*Change type*) and selecting *Timer Intermediate Catch Event* from the menu. + image:bp-modeling/bp/events/timer-event/timer-event-7.png[] +. Click the *Timer Intermediate Catch Event* element, navigate to a configuration panel and set up the event: -//. Натисніть елемент *Timer Intermediate Catch Event*, перейдіть до панелі налаштувань та сконфігуруйте подію: -. Click the *Timer Intermediate Catch Event* element, navigate to configuration panel and configure the event: - -//* У полі `Name` введіть ім’я елемента. Це може бути призначення таймера або бізнес-назва. -* In the `Name` field, enter element name (optional). It can be timer purpose, or business-related name. -//* У полі `Timer Definition Type` вкажіть тип таймера. З випадного списку оберіть одне зі значень. Наприклад, `Duration`, тобто тривалість (_детальніше про типи таймерів -- за https://docs.camunda.io/docs/components/modeler/bpmn/timer-events/#timers[посиланням]_). +* In the `Name` field, enter element name (optional). It can be a timer purpose, or business-related name. * In the `Timer Definition Type` field, set timer type by selecting one from the dropdown. For example, `Duration` (_follow the https://docs.camunda.io/docs/components/modeler/bpmn/timer-events/#timers[link] more info_) -//* У полі `Timer Definition` визначте дату і час таймера. Наприклад, `2022-15-05T16:30:00+03:00[Europe/Kyiv]` -- це означає, що таймер спрацює 15 травня 2022 року, о 16:30 за київським часом (відповідно до зони UTC+3). * In the `Timer Definition` field, set time and date for the timer. For example, `2022-15-05T16:30:00+03:00[Europe/Kyiv]` -- timer will trigger on May 15th, 2022 at 16:30 Kyiv time (UTC+3). + -//TIP: У Camunda дата і час для таймерів встановлюється у спеціальному форматі, відповідно до стандарту ISO 8601. Детальніше -- за https://docs.camunda.io/docs/components/modeler/bpmn/timer-events/#time-duration[посиланням]. TIP: In Camunda, date and time for timers are set in a special format, according to ISO 8601 standard (_follow the https://docs.camunda.io/docs/components/modeler/bpmn/timer-events/#time-duration[link] more info_). + image:bp-modeling/bp/events/timer-event/timer-event-8.png[] -//В результаті проміжна оброблювальна подія часу змодельована та налаштована. -As a result, your Time Intermediate Catch Event is modelled and configured. - +As a result, your Time Intermediate Catch Event is modeled and configured. -//== Приклад використання подій «Таймер» у бізнес-процесі == Example of using Timer Events in a business process -//Розглянемо логіку роботи 2-х типів подій «Таймер» на прикладі простого синтетичного бізнес-процесу нарахування коштів сервісом умовного банку. -In this example we will review the logic of 2 types of Timer Event, using a simple synthetic business process, which registers transactions as a bank service. +In this example, we will review the logic of two types of Timer Event, using a simple synthetic business process, which registers transactions as a bank service. image:bp-modeling/bp/events/timer-event/timer-event-9.png[] -//. Процес ініційовано стартовою подією. . Start event initiates the process. -//. Сервіс банку очікує зарахування коштів на рахунок або картку клієнта. _Проміжна гранична переривальна подія часу_, що змодельована безпосередньо на сервісній задачі, має встановлений таймер, який спрацює із настанням відповідної дати (15.05.2022). -. The bank service awaits money transfer to the client's account or card. A _Time Intermediate Boundary Interrupting Event_ modelled in the service task has a timer set on a certain date (15.05.2022). -//. Якщо кошти надійшли на картку до 15.05.2022, то виконується наступний елемент основного потоку послідовності. +. The bank service awaits money transfer to the client's account or card. A _Time Intermediate Boundary Interrupting Event_ modeled in the service task has a timer set on a certain date (15.05.2022). . If the transfer is made before 15.05.2022, the next element of the main sequence flow will initiate. -//. Якщо кошти не надійшли на картку до 15.05.2022, то активність основного потоку анулюється, і виконується альтернативний потік послідовності, що виходить із події таймера -- сервіс має сформувати звітний документ про баланс рахунку та завершити процес. В такому випадку ми бачимо, що подія анулювала основний потік і токен пішов за альтернативною гілкою. -. If the transfer wasn't made before 15.05.2022, main flow activity is nullified, and an alternative sequence flow that comes from the timer is executed -- the service must form a report on account balance and end the process. In this case we see that the event cancelled the main flow, and the token went along the alternative branch. -//. Отже, кошти надійшли, і сервіс має зачекати протягом 2 годин, адже так сконфігурована _проміжна оброблювальна подія часу_. В цьому випадку активність не переривається, а основний потік призупиняється на час очікування таймера. +. If the transfer wasn't made before 15.05.2022, main flow activity is nullified, and an alternative sequence flow that comes from the timer is executed -- the service must form a report on account balance and end the process. In this case, we see that the event canceled the main flow, and the token went along the alternative branch. . The money was transferred, and the service must wait 2 hours, as _Time Intermediate Catch Event_ is configured. In this case, activity is not interrupted, and the main flow is suspended for the timer period. -//. Після 2-х годин очікування, основний потік продовжується і сервіс має надіслати клієнту сповіщення про зарахування коштів та завершити процес. . After the 2 hours passed, the main flow continued, the service will send the client a notification about the money transfer, and end the process. diff --git a/docs/en/modules/registry-develop/pages/bp-modeling/bp/bpmn/subprocesses/call-activities.adoc b/docs/en/modules/registry-develop/pages/bp-modeling/bp/bpmn/subprocesses/call-activities.adoc index 5c5bb91946..2f02f3e014 100644 --- a/docs/en/modules/registry-develop/pages/bp-modeling/bp/bpmn/subprocesses/call-activities.adoc +++ b/docs/en/modules/registry-develop/pages/bp-modeling/bp/bpmn/subprocesses/call-activities.adoc @@ -1,88 +1,60 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - -//= Глобальний підпроцес (Call Activity) = Call Activity +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] + +include::platform:ROOT:partial$admonitions/language-en.adoc[] -//== Загальний опис == Overview -//*Call Activity* (або підпроцес, який можна використовувати повторно) -- це стандартний елемент BPMN-моделювання, що підтримує Camunda Engine, який дозволяє викликати інший процес як частину поточного процесу. Він подібний до xref:bp-modeling/bp/bpmn/subprocesses/embedded-subprocess.adoc[вбудованого підпроцесу], але є зовнішнім, тобто змодельованим в рамках окремого пулу бізнес-процесу, і може використовуватися неодноразово та декількома різними батьківськимиfootnote:[_Батьківський_ або _основний_ процес (*Parent process*) -- процес, що ініціює запуск підпроцесу. Відносно батьківського процесу підпроцес є *Child*-процесом (*Child process*).] бізнес-процесами. -*Call Activity* -- is a standard BPMN-modelling element supported by Camunda Engine. It allows you to call another process as part of the currently running process. *Call Activity* is similarl to xref:bp-modeling/bp/bpmn/subprocesses/embedded-subprocess.adoc[embedded subprocess], but is external, meaning it's modelled within a separate business process pool, and can be used multiple times by different Parentfootnote:[*Parent Process* is a process that initiates subprocess start. A subprocess is a *Child Process* to a *Parent Process*.] business processes. +*_Call Activity_* is a standard BPMN-modeling element supported by Camunda Engine. It allows you to call another process as part of the currently running process. *Call Activity* is similar to xref:bp-modeling/bp/bpmn/subprocesses/embedded-subprocess.adoc[embedded subprocess], but is external, meaning it's modeled within a separate business process pool, and can be used multiple times by different Parentfootnote:[*Parent Process* is a process that initiates subprocess start. A subprocess is a *Child Process* to a *Parent Process*.] business processes. image:bp-modeling/bp/subprocesses/call-activities/bp-call-activity-01.png[] [NOTE] ==== -//У Camunda BPMN виклики глобального, тобто зовнішнього підпроцесу, можуть виконуватися між процесами, що змодельовані в окремих файлах _.bpmn_, або ж в рамках одного файлу _.bpmn_. Таким чином один незалежний бізнес-процес може запускати інший і навпаки. -In Camunda BPMN the calling of global (external) subprocess can be executed between processes modelled in separate _.bpmn_ files, or within a single _.bpmn_ file. This way an independent business process can start another one, and vice versa, +In Camunda BPM the calling of global (external) subprocess can be executed between processes modeled in separate _.bpmn_ files, or within a single _.bpmn_ file. This way an independent business process can start another one, and vice versa. -//Платформа реєстрів наразі підтримує лише один тип -- виклик глобального підпроцесу з основного (батьківського) процесу. З глобального підпроцесу можна також виконати виклик Call Activity -- підпроцес 2-го рівня (_див. xref:#restrictions[]_). -The registry platform currently supports only one type -- calling a global subprocess from a Parent process. From a global subprocess you can execute the Call Activity -- a subprocess of the 2nd level (_see ref:#restrictions[]_). +The registry platform currently supports only one type -- calling a global subprocess from a Parent process. From a global subprocess you can execute the Call Activity -- a subprocess of the 2nd level (_see xref:#restrictions[]_). -//.Приклад. Виклик між процесами, змодельованими в окремих файлах BPMN -.Example. Calling between processes, modelled in separate BPMN files +.Example. Calling between processes, modeled in separate BPMN files image:bp-modeling/bp/subprocesses/call-activities/call-activity-separate-bpmn.png[] -//.Приклад. Виклик підпроцесу із основного процесу в рамках одного файлу BPMN -.Example. Calling between processes, modelled in one BPMN file. +.Example. Calling between processes, modeled in one BPMN file. image:bp-modeling/bp/subprocesses/call-activities/call-activity-same-bpmn.png[] ==== -//Коли елемент Call Activity вводиться в дію, створюється новий екземпляр процесу, на який він посилається. Новий екземпляр процесу активується під час події none startfootnote:[*None events* є невизначеними подіями, які також називаються «порожніми».]. Процес може мати стартові події інших типів, але вони ігноруються. -When Call Activity element is brought into action, a new instance is created for the process the element is linked to. The new instance is activated during none startfootnote:[*None events* are undefined events, also called "empty".] event. The process can have start events of other types, but they are ignored. +When a Call Activity element is brought into action, a new instance is created for the process the element is linked to. The new instance is activated during none-startfootnote:[*None events* are undefined events, also called "empty."] event. The process can have start events of other types, but they are ignored. [NOTE] ==== -//Коли створений екземпляр процесу завершується, дія виклику припиняється, і продовжується виконання вихідного потоку послідовності. When the created instance is ended, the call action is stopped, and the sequence flow continues. -//Іншими словами як тільки виконано виклик Call Activity, процес, що ініціював виклик (основний процес), чекає на завершення глобального підпроцесу, і тільки після цього продовжується. In other words, when Call Activity is executed, the process that initiated the call awaits the end of the global subprocess, and continues after that. ==== -//== Типи розширень шаблонів елементів Call Activity == Types of Call Activity element template extensions -//Для спрощення моделювання бізнес-процесів в рамках Платформи реєстрів, імплементовано декілька типів розширень (делегатів), що налаштовуються за допомогою розроблених шаблонів елементів для виклику зовнішніх процесів (Call Activity): -To simplify business process modelling within the registry Platform, a number of extension (delegate) types that are configured using the developed Call Activity element templates, were implemented: +To simplify business process modeling within the registry Platform, a number of extension (delegate) types that are configured using the developed Call Activity element templates, were implemented: -//. xref:bp-modeling/bp/element-templates/bp-element-templates-installation-configuration.adoc#bp-element-temp-call-activity-call-activity[*Call Activity*] -- загальний шаблон для виклику глобального (зовнішнього) підпроцесу. . xref:bp-modeling/bp/element-templates/call-activities/call-activity.adoc[*Call Activity*] -- general template for global subprocess call. -//. xref:bp-modeling/bp/element-templates/bp-element-templates-installation-configuration.adoc#element-temp-check-excerpt-status[*Check excerpt status*] -- специфікований шаблон для виклику підпроцесу перевірки статусу витягу. . xref:bp-modeling/bp/element-templates/call-activities/check-excerpt-status.adoc[*Check excerpt status*] -- specialized template for the calling of check excerpt status subprocess. - -//CAUTION: Варто розрізняти Call Activity як стандартний BPMN-елемент і Call Activity як розширення цього самого елемента, що налаштовується за допомогою розробленого шаблону _callActivity.json_, призначеного для виклику глобального (зовнішнього) підпроцесу. CAUTION: We differentiate Call Activity as a BPMN element and Call Activity as this element's extension that is configured using the _callActivity.json_ developed template, used to call the global subprocess. [#element-temp-call-activity] -//== Моделювання бізнес-процесів із застосуванням розширень Call Activity -== Modelling business processes using Call Activity extensions +== Modeling business processes using Call Activity extensions -//Розглянемо застосування BPMN-елемента Call Activity із використанням розробленого шаблону-розширення _callActivity.json_ для виклику глобальних підпроцесів на прикладі бізнес-процесів оформлення онлайн-замовлення (_далі -- основний або батьківський процес_) та підтвердження цього замовлення (_далі -- підпроцес_). Let's look at the application of Call Activity BPMN-element using _callActivity.json_ developed template-extension to call global subprocesses on the example of online order processing business processes (_further in the text -- main or parent process_) and confirmation of the order (_further in the text -- subprocess_). image:bp-modeling/bp/subprocesses/call-activities/bp-call-activity-1.png[] [TIP] ==== -//На етапі моделювання необхідно створити 2 пули бізнес-процесів та зберегти їх в рамках одного файлу _.bpmn_. -On the modelling stage it is required to create 2 business process pools and save them within one _.bpmn_ file. +On the modeling stage it is required to create 2 business process pools and save them within one _.bpmn_ file. ==== -//=== Етапи моделювання процесів -=== Process modelling stages +=== Process modeling stages -//Для того, щоб змоделювати 2 процеси (у нашому випадку -- це основний процес та глобальний підпроцес) із застосуванням Call Activity, необхідно пройти наступні етапи: To model 2 processes (the parent process and the global subprocess in our case) using Call Activity, we need to go through the following stages: . xref:#create-pool-bp-1[]. @@ -98,227 +70,174 @@ To model 2 processes (the parent process and the global subprocess in our case) . xref:#bp-end-event-caller-process[]. [#create-pool-bp-1] -//=== Створення пулу для основного бізнес-процесу === Creating parent process pool -//Найперше, _змоделюйте пул для основного бізнес-процесу_. Для цього виконайте кроки, подані нижче: _To model a pool for the parent process_, take the following steps: -//NOTE: Моделювання діаграми бізнес-процесу має відбуватися в рамках елемента *Create Pool/Participant*. -NOTE: Parent process pool modelling must be performed within the *Create Pool/Participant* element. +NOTE: Parent process pool modeling must be performed within the *Create Pool/Participant* element. -//. Відкрийте додаток *Camunda Modeler* та створіть нову діаграму BPMN. Для цього у лівому верхньому куті натисніть меню *File* -> *New File* -> *BPMN Diagram*. -. Open *Camunda Modeler* and create a new BPMN diagram by clicking *File* menu -> *New File* -> *BPMN Diagram*. +. Open *Camunda Modeler* and create a new BPMN diagram by clicking *File* menu > *New File* > *BPMN Diagram*. + image:registry-develop:bp-modeling/bp/modeling-instruction/bp-1.png[] -//. На панелі інструментів зліва знайдіть елемент *Create pool/Participant* та перетягніть його до панелі моделювання. -. On the left panel, find *Create pool/Participant* and drag it onto the modelling canvas. + +. On the left panel, find *Create pool/Participant* and drag it onto the modeling canvas. + image:registry-develop:bp-modeling/bp/modeling-instruction/bp-2.png[] -//. Заповніть наступні поля відповідними значеннями: + . Fill in the fields with the corresponding values: -//* У полі `Participant Name` введіть назву пулу, що відображатиметься у моделері -- `Оформлення замовлення на сайті`. * In the `Participant Name` field, enter the name for the pool -- `Creating an order on the website`. -//* У полі `Process id` введіть ідентифікатор бізнес-процесу -- `create-order`. * In the `Process id` enter business process ID -- `create-order`. -//* У полі `Process Name` вкажіть бізнес-назву процесу -- `Оформлення замовлення на сайті`. * In the `Process Name` field enter process name -- `Creating an order on the website`. + image:bp-modeling/bp/subprocesses/call-activities/bp-call-activity-2.png[] [#bp-start-event] -//=== Моделювання стартової події основного процесу -=== Modelling start event of the parent process +=== Modeling start event of the parent process -//_Створіть початкову подію_. Для цього виконайте наступні кроки: _To model a start event_, take the following steps: -//. На панелі інструментів, зліва, знайдіть елемент (коло) *CreateStartEvent* та перетягніть його до панелі моделювання. -. On the left panel, find the *CreateStartEvent* and drag it onto the modelling canvas. -//. На панелі налаштувань справа заповніть наступні параметри відповідними значеннями: +. On the left panel, find the *CreateStartEvent* and drag it onto the modeling canvas. . On the right panel, fill in the following parameters with the corresponding values: -//* У полі `Name` введіть назву початкової події -- `Кошик`; * In the `Name` field, enter the name for the start event -- `Cart`; -//* У полі `Initiator` введіть `initiator`. * In the `Initiator` field, enter `initiator`. + -//TIP: `initiator` -- спеціальна змінна, що встановлюється для користувача, який розпочав процес. TIP: `initiator` -- is a special variable set for the user who started the process. + image:bp-modeling/bp/subprocesses/call-activities/bp-call-activity-3.png[] [#bp-user-form-insert-data-online-order] -//=== Моделювання користувацької задачі внесення даних онлайн-замовлення -=== Modelling the user task for entering online order data +=== modeling the user task for entering online order data -//Далі _створіть користувацьку задачу, призначену для введення даних користувачем_. Для цього виконайте наступні кроки: _To create a user task for data entering, take the following steps:_ -//. Створіть нову задачу, вкажіть її тип, натиснувши іконку ключа та обравши з меню пункт *User Task* (Користувацька задача). . Create a new task, define its type by clicking the key icon and selecting *User Task* from the menu. -//. На панелі налаштувань справа натисніть `Open Catalog`, оберіть шаблон *User Form* (Користувацька форма) та натисніть `Apply` для підтвердження. . On the right panel, click `Open Catalog`, select *User Form* template, and click `Apply` to confirm. -//. На панелі налаштувань справа заповніть наступні поля: . On the right panel, fill in the following fields: -//* У полі `Id` вкажіть ідентифікатор задачі -- `user-form-1`. * In the `Id` field, set task ID -- `user-form-1`. + -//TIP: ID задачі призначається автоматично, за замовчуванням. Введіть значення вручну, якщо це необхідно. TIP: Task ID is automatically set by default. Enter it manually if required. -//* У полі `Name` вкажіть назву задачі -- `Форма введення даних онлайн-замовлення`. * In the `Name` field, enter task name -- `Order data form`. -//* У полі `Form key` введіть ключ форми, що відповідатиме службовій назві форми для внесення даних -- `add-order-bp-add-order-test`. * In the `Form key` field, enter form key that will correspond with the form service name -- `add-order-bp-add-order-test`. -//* У полі `Assignee` вкажіть змінну, що використовується для зберігання користувача, який запустив екземпляр процесу, -- `${initiator}`. * In the `Assignee` field, enter the variable of the user who initiated the process instance -- `${initiator}`. + image:bp-modeling/bp/subprocesses/call-activities/bp-call-activity-4.png[] [#bp-call-activity] -//=== Моделювання Call Activity для виклику зовнішнього підпроцесу -=== Modelling Call Activity to call external subprocess +=== modeling Call Activity to call external subprocess -//На цьому етапі необхідно _змоделювати *Call Activity* (виклик глобального підпроцесу із зовнішнього пулу)_. Для цього виконайте кроки, подані нижче: _To model Call Activity, take the following steps:_ -//TIP: Приклад налаштування делегата Call Activity наведено за xref:bp-modeling/bp/element-templates/bp-element-templates-installation-configuration.adoc#bp-element-temp-call-activity-call-activity[посиланням]. TIP: You can find an example of Call Activity delegate configuration xref:bp-modeling/bp/element-templates/call-activities/call-activities-overview.adoc[here]. -//. Створіть елемент *Call Activity*. -. Create *Call Activity* element. -//. Виконайте подальші налаштування: +. Create the *Call Activity* element. + . Perform the following configurations: -//* У полі `Name` вкажіть назву елемента -- `Рішення щодо підтвердження замовлення`. * In the `Name` field, enter element name -- `Decision on order confirmation`. -//* У полі `Called Element` вкажіть ідентифікатор глобального xref:#create-pool-bp-2[підпроцесу, що викликатиметься], -- `order-confirm`. + * In the `Called Element` field, set the ID of the global xref:#create-pool-bp-2[subprocess to be called] -- `order-confirm`. -//* У полі `Input data` вкажіть вхідні дані, які необхідно передати бізнес-процесу, що викликається. Параметри мають передаватися у вигляді пар _ключ-значення_ (тут -- `${submission('user-form-1').formData}`). + * In the `Input data` field, set the input data to be sent to the called business process. The parameters must be transferred in the form of _key-value_ pairs (here -- `${submission('user-form-1').formData}`). + -//TIP: За деталями щодо використання функції `submission()` у бізнес-процесах перейдіть на сторінку xref:registry-develop:bp-modeling/bp/modeling-facilitation/modelling-with-juel-functions.adoc[]. TIP: You can find more detauls on using the `submission()` function on the following page: xref:registry-develop:bp-modeling/bp/modeling-facilitation/modelling-with-juel-functions.adoc[]. -//* У полі `Output variable name` вкажіть назву змінної, до якої необхідно записати дані (payload), отримані в результаті виконання підпроцесу, що викликається (тут -- `callActivityOutput`). * In the `Output variable name` set the payload-carrying variable name (here -- `callActivityOutput`). + image:bp-modeling/bp/subprocesses/call-activities/bp-call-activity-5.png[] -//NOTE: Таким чином поточна конфігурація запускає xref:#create-pool-bp-2[глобальний підпроцес] із основного пулу. Основний процес не може завершитися, доки виконується глобальний підпроцес. NOTE: This way the current configuration starts xref:#create-pool-bp-2[a global subprocess] from the main pool. The main process can't end while the global subprocess is running. [#create-pool-bp-2] -//=== Створення пулу для глобального підпроцесу === Creating a pool for the global subprocess -//На прикладі xref:#create-pool-bp-1[], _змоделюйте пул для глобального підпроцесу_. _Model a pool for the global subprocess_ as shown in the example xref:#create-pool-bp-1[]. -//. На панелі інструментів зліва знайдіть елемент *Create pool/Participant* та перетягніть його до панелі моделювання. -. On the left panel, find the *Create pool/Participant* element and drag it to the modelling canvas. +. On the left panel, find the *Create pool/Participant* element and drag it to the modeling canvas. + image:registry-develop:bp-modeling/bp/modeling-instruction/bp-2.png[] -//. Заповніть наступні поля відповідними значеннями: . Fill in the following fields with the corresponding values: -//* У полі `Participant Name` введіть назву пулу, що відображатиметься у моделері -- `Рішення щодо підтвердження замовлення`. -* In the `Participant Name` field, enter the name of the pool displayed in the modeller -- `Decision on order confirmation`. -//* У полі `Process id` введіть ідентифікатор бізнес-процесу -- `order-confirm`. +* In the `Participant Name` field, enter the name of the pool displayed in the modeler -- `Decision on order confirmation`. + * In the `Process id` field, enter business process ID -- `order-confirm`. -//* У полі `Process Name` вкажіть бізнес-назву процесу -- `Рішення щодо підтвердження замовлення`. + * In the `Process Name` field, enter business process name -- `Decision on order confirmation`. + image:bp-modeling/bp/subprocesses/call-activities/bp-call-activity-6.png[] [#bp-start-event-called-process] -//=== Моделювання стартової події глобального підпроцесу -=== Modelling start event for the global subprocess +=== Modeling start event for the global subprocess -//На прикладі xref:#bp-start-event[], _створіть стартову подію підпроцесу_. _Model a start event for the global subprocess_ as shown in the example xref:#bp-start-event[]. -//Для цього виконайте наступні кроки: To do that, take the following steps: -//. На панелі інструментів, зліва, знайдіть елемент (коло) *CreateStartEvent* та перетягніть його до панелі моделювання. -. On the left panel, find the *CreateStartEvent* element and drag it to the modelling canvas. -//. На панелі налаштувань справа заповніть наступні параметри відповідними значеннями: +. On the left panel, find the *CreateStartEvent* element and drag it to the modeling canvas. + . On the right panel, fill in the following parameters with the corresponding values: -//* У полі `Name` введіть назву початкової події -- `Отримання даних замовлення`. + * In the `Name` field, enter the name of the start event -- `Receiving order data`. -//* У полі `Initiator` введіть `initiator`. + * In the `Initiator` field, enter `initiator`. + -//TIP: `initiator` -- спеціальна змінна, що встановлюється для користувача, який розпочав процес. TIP: `initiator` -- is a special variable set for the user who started the process. + image:bp-modeling/bp/subprocesses/call-activities/bp-call-activity-7.png[] [#bp-user-form-approval-decision] -//=== Моделювання користувацької задачі "Рішення про погодження онлайн-замовлення" -=== Modelling the "Decision for order confirmation" user task -//На прикладі xref:#bp-user-form-insert-data-online-order[], _створіть задачу "Рішення про погодження онлайн-замовлення"_. Для цього виконайте кроки, подані нижче: +=== Modeling the "Decision for order confirmation" user task + _Create the "Decision for order confirmation" user task_ based on the example xref:#bp-user-form-insert-data-online-order[], by taking the following steps: -//. Створіть нову задачу, вкажіть її тип, натиснувши іконку ключа та обравши з меню пункт *User Task* (Користувацька задача). . Create a new task, define its type by clicking the key icon and selecting *User Task* from the menu. -//. На панелі налаштувань справа натисніть `Open Catalog`, оберіть шаблон *User Form* (Користувацька форма) та натисніть `Apply` для підтвердження. + . On the right panel, click `Open Catalog`, select *User Form* template, and click `Apply` to confirm. -//. На панелі налаштувань справа заповніть наступні поля: + . On the right panel, fill in the following fields: -//* У полі `Id` вкажіть ідентифікатор задачі -- `user-form-2`. + * In the `Id` field, enter task ID -- `user-form-2`. + -//TIP: ID задачі призначається автоматично, за замовчуванням. Введіть значення вручну, якщо це необхідно. + TIP: Task ID is automatically set by default. Enter it manually if required. -//* У полі `Name` вкажіть назву задачі -- `Рішення про погодження онлайн-замовлення`. * In the `Name` field, enter task name -- `Decision for order confirmation`. -//* У полі `Form key` введіть ключ форми, що відповідатиме службовій назві форми для внесення даних -- `add-order-bp-order-confirm-test`. -* In the `Form key` field, enter form key that will correspond with the form service name -- `add-order-bp-order-confirm-test`. -//* У полі `Assignee` вкажіть змінну, що використовується для зберігання користувача, який запустив екземпляр процесу, -- `${initiator}`. + +* In the `Form key` field, enter a form key that will correspond with the form service name -- `add-order-bp-order-confirm-test`. + * In the `Assignee` field, enter the variable of the user who initiated the process instance -- `${initiator}`. + image:bp-modeling/bp/subprocesses/call-activities/bp-call-activity-8.png[] [#bp-script-task] -//=== Моделювання задачі скриптування для підготовки даних до виведення -=== Modelling the script task to prepare the data for output +=== Modeling the script task to prepare the data for output -//На цьому етапі необхідно _створити задачу скриптування для обробки даних та підготовки їх до виведення_. _Create a script task for data processing and preparation for output_. [TIP] ==== -//Задача має на меті за допомогою groovy-скрипту із виконанням функції `submission()` взяти дані, введені користувачем на формі, обробити їх, сформувати вивід у форматі JSON та записати його до змінної `callActivityOutput`, зазначеної у полі `Output variable name` при моделюванні xref:#bp-call-activity[Call Activity] основного процесу. -The task purpose is to take the data that the user filled in the form, using groovy-script with `submission()` function, form an output in JSON format, and write it into `callActivityOutput` variable, defined in `Output variable name` field when modelling xref:#bp-call-activity[Call Activity] of the main process. +The task purpose is to take the data that the user filled in the form, using groovy-script with `submission()` function, form an output in JSON format, and write it into `callActivityOutput` variable, defined in `Output variable name` field when modeling xref:#bp-call-activity[Call Activity] of the main process. ==== -//. Створіть нову задачу, вкажіть її тип, натиснувши іконку ключа та обравши з меню пункт *Script Task* (Задача скриптування). . Create a new task, define its type by clicking the key icon and selecting *Script Task* from the menu. -//. На панелі налаштувань справа заповніть наступні поля: + . On the right panel, fill in the following fields: -//* У полі `Name` вкажіть назву задачі -- `Підготовка даних до виведення`. * In the `Name` field, enter task name -- `Preparing data for output` -//* У полі `Script Format` вкажіть формат скрипту -- `groovy`. * In the `Script Format` field, enter script format -- `groovy`. -//* У полі `Script Type` вкажіть тип скрипту -- `Inline Script`. * In the `Script Type` field, enter script type -- `Inline Script`. -//* У полі `Script` введіть безпосередньо groovy-скрипт: * In the `Script` field, enter the groovy-script: + [source,groovy] @@ -332,80 +251,59 @@ set_transient_variable('outputPayload', S(data, 'application/json')) image:bp-modeling/bp/subprocesses/call-activities/bp-call-activity-9.png[] [#bp-end-event-called-process] -//=== Моделювання події завершення глобального підпроцесу -=== Modelling global subprocess end event - -//На цьому етапі необхідно _створити подію, яка завершуватиме глобальний підпроцес_. +=== modeling global subprocess end event -//. Створіть подію завершення бізнес-процесу. . Create a business process end event. -//. На панелі налаштувань справа для параметра `Name` вкажіть значення `Замовлення підтвержено`. -. On the right panel, set the `Name` parameter to `Order confirmed`. +. On the right panel, set the `Name` parameter to `Order confirmed`. + image:bp-modeling/bp/subprocesses/call-activities/bp-call-activity-10.png[] -//TIP: Дані, отримані в результаті виконання глобального підпроцесу "Рішення щодо підтвердження замовлення", записуються до змінної `callActivityOutput`, зазначеної у полі `Output variable name` при моделюванні xref:#bp-call-activity[Call Activity] основного процесу, і можуть бути використані на xref:#bp-user-form-order-payment[формі для оплати замовлення] у основному процесі. Після цього продовжується виконання основного процесу. -TIP: The data received as a result of the "Decision for order confirmation" global subprocess execution are written into the `callActivityOutput` variable, defined in the `Output variable name` field when modelling xref:#bp-call-activity[Call Activity] of the main process, and can be used on the xref:#bp-user-form-order-payment[order payment form] in the main process. After that, the main process execution continues. +TIP: The data received as a result of the "Decision for order confirmation" global subprocess execution are written into the `callActivityOutput` variable, defined in the `Output variable name` field when modeling xref:#bp-call-activity[Call Activity] of the main process, and can be used on the xref:#bp-user-form-order-payment[order payment form] in the main process. After that, the main process execution continues. [#bp-user-form-order-payment] -// === Моделювання користувацької задачі для оплати онлайн-замовлення -=== Modelling the user task for order payment +=== modeling the user task for order payment -// На прикладі xref:#bp-user-form-insert-data-online-order[] _створіть користувацьку задачу, призначену для оплати замовлення користувачем_. Для цього виконайте наступні кроки: _Create the user task for order payment_ based on the example xref:#bp-user-form-insert-data-online-order[], by taking the following steps: -//. Створіть нову задачу, вкажіть її тип, натиснувши іконку ключа та обравши з меню пункт *User Task* (Користувацька задача). . Create a new task, define its type by clicking the key icon and selecting *User Task* from the menu. -//. На панелі налаштувань справа натисніть `Open Catalog`, оберіть шаблон *User Form* (Користувацька форма) та натисніть `Apply` для підтвердження. + . On the right panel, click `Open Catalog`, select *User Form* template, and click `Apply` to confirm. -//. На панелі налаштувань справа заповніть наступні поля: + . On the right panel, fill in the following fields: -//* У полі `Name` вкажіть назву задачі -- `Оплата онлайн-замовлення`. * In the `Name` field, enter task name -- `Order payment`. -//* У полі `Form key` введіть ключ форми, що відповідатиме службовій назві форми для внесення даних -- `add-order-bp-view-order-test`. + * In the `Form key` field, enter form key that will correspond with the form service name -- `add-order-bp-view-order-test`. -//* У полі `Assignee` вкажіть змінну, що використовується для зберігання користувача, який запустив екземпляр процесу, -- `${initiator}`. + * In the `Assignee` field, enter the variable of the user who initiated the process instance -- `${initiator}`. + image:bp-modeling/bp/subprocesses/call-activities/bp-call-activity-11.png[] [#bp-end-event-caller-process] -//=== Моделювання події завершення основного процесу -=== Modelling main process end event +=== Modeling main process end event -//На цьому етапі необхідно _створити подію, яка завершуватиме основний процес_. - -//. Створіть подію завершення бізнес-процесу. . Create the business process end event. -//. На панелі налаштувань справа для параметра `Name` вкажіть значення `Замовлення сплачено`. . On the right panel, fill in `Name` parameter with `Order paid`. - + image:bp-modeling/bp/subprocesses/call-activities/bp-call-activity-12.png[] [#restrictions] -//== Обмеження рівнів вкладеності при викликах підпроцесів за допомогою Call Activity == Restricting nesting levels when calling subprocesses with Call Activity -//Існують певні обмеження на Платформі щодо кількості рівнів вкладеності бізнес-процесів при викликах глобальних підпроцесів за допомогою делегата Call Activity. The Platform has certain restrictions on how many nesting levels are allowed for business processes during the calling of global subprocesses with Call Activity. [CAUTION] ==== -//Для правильної роботи функціональності виклику глобальних процесів із застосуванням делегата Call Activity, використовуйте не більше 3-х рівнів вкладеності бізнес-процесів, тобто основний процес, глобальний підпроцес 1-го рівня та глобальний підпроцес 2-го рівня. -For proper calling of global subprocesses with Call Activity functionality operation, use no more than 3 nesting levels for bysiness processes. This means: main process, global subprocess of the 1st level, and global subprocess of the 2nd level. + +For proper calling of global subprocesses with Call Activity functionality operation, use no more than 3 nesting levels for bysiness processes. This means the _main process, global subprocess of the 1st level, and global subprocess of the 2nd level_. ==== -//== Відображення бізнес-процесів у Кабінетах користувачів == Displaying business processes in user Portals -//Користувачі Кабінетів посадової особи та отримувача послуг на сторінках [.underline]#Мої послуги# та [.underline]#Мої задачі#, під час виконання підпроцесів, як викликаних, так і вбудованих, бачитимуть лише назви батьківських бізнес-процесів найвищого рівня. Users of Officer and Citizen Portals will see only the names of parent business processes of the highest level on [.underline]#My services# and [.underline]#My tasks# pages during the execution of called or in-built subprocesses. -//Тобто, якщо бізнес-процес А викликав підпроцес Б, а підпроцес Б викликав підпроцес В, користувач бачитиме у Кабінеті _лише_ назву бізнес-процесу А під час виконання задач підпроцесів Б та В. If business process `A` called subprocess `B`, and subprocess `B` called subprocess `C`, the user will _only see business process A name_ in the Portal. diff --git a/docs/en/modules/registry-develop/pages/bp-modeling/bp/bpmn/subprocesses/embedded-subprocess.adoc b/docs/en/modules/registry-develop/pages/bp-modeling/bp/bpmn/subprocesses/embedded-subprocess.adoc index e356c73b78..3d2ca10286 100644 --- a/docs/en/modules/registry-develop/pages/bp-modeling/bp/bpmn/subprocesses/embedded-subprocess.adoc +++ b/docs/en/modules/registry-develop/pages/bp-modeling/bp/bpmn/subprocesses/embedded-subprocess.adoc @@ -1,59 +1,37 @@ -//= Вбудований підпроцес = Embedded subprocess -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - -//== Загальний опис +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] + +include::platform:ROOT:partial$admonitions/language-en.adoc[] + == Overview -//Вбудований підпроцес (*Embedded subprocess*) -- це підпроцес, що налаштовується та запускається всередині основного (батьківського) бізнес-процесу. -An *Embedded subprocess* is a subprocess that is configured and run inside the main (parent) business process. +An *_Embedded subprocess_* is a subprocess that is configured and run inside the main (parent) business process. [TIP] ==== -//Вбудований підпроцес дозволяє НЕ виконувати два бізнес-процеси окремо, щоразу виходячи до Кабінету користувача та запускаючи кожний послідовно. Натомість вбудований підпроцес покликаний забезпечити плавний перехід між бізнес-процесами, без розриву основного процесу та підпроцесу, і повернення назад до основного процесу. An embedded subprocess allows the user to avoid running two business processes separately, leaving the Portal every time to start each process. Embedding a subprocess provides a smooth transfer between business processes without separating the main process and the subprocess. -//Наприклад, основний процес має на меті внести дані про заяву, але він також вимагає попередньо погодити внесення змін уповноваженою особою. Погодження змін логічно і зручно винести в окремий вбудований процес, таким чином розділяючи два процеси між собою, і водночас не порушуючи єдиний потік послідовності. For example, the main process has a purpose of entering contract data, but it requires approval of the changes by an authorized officer. This approval process logically fits into an embedded subprocess, thus having a dedicated process for everything, and still fitting into one sequence flow. ==== image:bp-modeling/bp/subprocesses/embedded-subprocess/embedded-subprocess-1.png[] -//Вбудований підпроцес повинен мати тільки одну подію none startfootnote:[*None events* є невизначеними подіями, які також називаються «порожніми».]. -An embedded subprocess must only contain one none start eventfootnote:[*None events* are undefined events, also called "empty".]. +An embedded subprocess must only contain one none start eventfootnote:[*None events* are undefined events, also called "empty."]. -//При активації вбудованого підпроцесу, ініціюється старт цього підпроцесу подією *Start event*. Підпроцес залишається активним, допоки активним залишається хоча б один елемент у контейнері з підпроцесом. Коли останній елемент підпроцесу, тобто фінальна подія виконується, підпроцес завершується, і продовжується вихідний потік послідовності у батьківськомуfootnote:[_Батьківський_ або _основний_ процес (*Parent process*) -- процес, що ініціює запуск підпроцесу. Відносно батьківського процесу підпроцес є *Child*-процесом (*Child process*).] процесі. On embedded subprocess activation, a *Start event* initiates it. The subprocess remains active while at least one element in its container is active. At the end of the last element of the subprocess, meaning the final event, the subprocess ends, and the output sequence flow continues in the Parentfootnote:[*Parent Process* is a process that initiates subprocess start. A subprocess is a *Child Process* to a *Parent Process*.] process. -//// -TODO: Дати посилання на приклад із boundary event або interrupting boundary event, коли буде готова відповідна інструкція -Вбудовані підпроцеси часто використовуються разом із граничними подіями (Boundary events). До підпроцесу можна приєднати одну або кілька граничних подій. Наприклад, коли ініціюється переривальна гранична подія, весь підпроцес (включаючи всі активні елементи) припиняється. -//// -//== Використання вбудованого підпроцесу при моделюванні -== Using embedded subprocess in modelling +== Using embedded subprocess in modeling -//Розглянемо застосування BPMN-елемента Embedded subprocess на прикладі бізнес-процесу внесення даних (_далі -- основний або батьківський процес_) та вбудованого підпроцесу погодження змін (_далі -- підпроцес_). We'll show how to use the Embedded Subprocess BPMN-element with a data input business process (_further in this text -- main or parent process) and changes approval embedded subprocess (_further in this text -- subprocess) as an example. [TIP] ==== -//На етапі моделювання необхідно створити 1 пул із бізнес-процесом та зберегти його в рамках одного файлу _.bpmn_. -At the modelling stage, create 1 pool with a business process and save it in one _.bpmn_ file. +At the modeling stage, create 1 pool with a business process and save it in one _.bpmn_ file. ==== -//=== Етапи моделювання процесів === Process modelling stages -//Для того, щоб змоделювати 2 процеси (у нашому випадку -- це основний процес та підпроцес), використовуючи елемент Embedded subprocess, необхідно пройти наступні етапи: To model 2 processes (in our case -- the main process and the subprocess), using Embedded subprocess element, we'll go through the following stages: . xref:#create-pool-bp[]. @@ -66,172 +44,118 @@ To model 2 processes (in our case -- the main process and the subprocess), using . xref:#bp-end-event[]. [#create-pool-bp] -//=== Створення пулу для бізнес-процесу === Creating a pool for the business process -//Найперше, _змоделюйте пул для основного бізнес-процесу_. Для цього виконайте кроки, подані нижче: _Model a pool for the main process by taking the following steps_: -//NOTE: Моделювання діаграми бізнес-процесу має відбуватися в рамках елемента *Create Pool/Participant*. -NOTE: Modelling of business process diagram must be performed within the *Create Pool/Participant* element. +NOTE: Modeling of business process diagram must be performed within the *Create Pool/Participant* element. -//. Відкрийте додаток *Camunda Modeler* та створіть нову діаграму BPMN. Для цього у лівому верхньому куті натисніть меню *File* -> *New File* -> *BPMN Diagram*. . Open *Camunda Modeler* and create a new BPMN diagram by clicking *File* -> *New File* -> *BPMN Diagram* in the top left corner. + image:registry-develop:bp-modeling/bp/modeling-instruction/bp-1.png[] -//. На панелі інструментів зліва знайдіть елемент *Create pool/Participant* та перетягніть його до панелі моделювання. -. On the left panel, find the *Create pool/Participant* element and drag it to the modelling canvas. +. On the left panel, find the *Create pool/Participant* element and drag it to the modeling canvas. + image:registry-develop:bp-modeling/bp/modeling-instruction/bp-2.png[] -//. Заповніть наступні поля відповідними значеннями: + . Fill in the following fields with the corresponding values: -//* У полі `Participant Name` введіть назву пулу, що відображатиметься у моделері -- `Бізнес-процес внесення даних`. * In the `Participant Name` field, enter the name of the pool -- `Data input business process`. -//* У полі `Process id` введіть ідентифікатор бізнес-процесу (наприклад, `processId`). * In the `Process id` field, enter business process ID (for example, `processId`). -//* У полі `Process Name` вкажіть бізнес-назву процесу -- `Бізнес-процес внесення даних`. * In the `Process Name` field, enter business process name -- `Data input business process`. + image:bp-modeling/bp/subprocesses/embedded-subprocess/embedded-subprocess-2.png[] [#bp-start-event] -//=== Моделювання стартової події основного процесу -=== Modelling main process start event +=== Modeling main process start event -//_Створіть початкову подію_. Для цього виконайте наступні кроки: _Create a start event by taking the following steps_: -//. На панелі інструментів, зліва, знайдіть елемент (коло) *CreateStartEvent* та перетягніть його до панелі моделювання. -. On the left panel, find *CreateStartEvent* element and drag it to the modelling canvas. -//. На панелі налаштувань справа заповніть наступні параметри відповідними значеннями: +. On the left panel, find *CreateStartEvent* element and drag it to the modeling canvas. + . On the right panel, fill in the following parameters with the corresponding values: -//* У полі `Name` введіть назву початкової події -- `Старт процесу`. + * In the `Name` field, enter name for the start event -- `Process start`. -//* У полі `Initiator` введіть `initiator`. * In the `Initiator` field, enter `initiator`. + -//TIP: `initiator` -- спеціальна змінна, що встановлюється для користувача, який розпочав процес. TIP: `initiator` -- is a special variable set for the user who started the process. + image:bp-modeling/bp/subprocesses/embedded-subprocess/embedded-subprocess-3.png[] [#bp-user-form-insert-data] -//=== Моделювання користувацької задачі внесення даних - === Modelling the user task for entering online order data -//Далі _створіть користувацьку задачу, призначену для введення даних користувачем_. Для цього виконайте наступні кроки: _To create a user task for data entering, take the following steps:_ -//. Створіть нову задачу, вкажіть її тип, натиснувши іконку ключа та обравши з меню пункт *User Task* (Користувацька задача). . Create a new task, define its type by clicking the key icon and selecting *User Task* from the menu. -//. На панелі налаштувань справа натисніть `Open Catalog`, оберіть шаблон *User Form* (Користувацька форма) та натисніть `Apply` для підтвердження. . On the right panel, click `Open Catalog`, select *User Form* template, and click `Apply` to confirm. -//. На панелі налаштувань справа заповніть наступні поля: . On the right panel, fill in the following fields: -//* У полі `Id` вкажіть ідентифікатор задачі -- `user-form-1`. * In the `Id` field, set task ID -- `user-form-1`. -//* У полі `Name` вкажіть назву задачі -- `Форма введення даних онлайн-замовлення`. * In the `Name` field, enter task name -- `Order data form`. -//* У полі `Form key` введіть ключ форми, що відповідатиме службовій назві форми для внесення даних -- `add-order-bp-add-order-test`. * In the `Form key` field, enter form key that will correspond with the form service name -- `add-order-bp-add-order-test`. -//* У полі `Assignee` вкажіть змінну, що використовується для зберігання користувача, який запустив екземпляр процесу, -- `${initiator}`. * In the `Assignee` field, enter the variable of the user who initiated the process instance -- `${initiator}`. image:bp-modeling/bp/subprocesses/embedded-subprocess/embedded-subprocess-4.png[] [#create-expanded-subprocess] -//=== Моделювання вбудованого підпроцесу === Modelling embedded subprocess -//На цьому етапі необхідно _змоделювати вбудований підпроцес_. Він налаштовується всередині окремого контейнера в рамках цього ж пулу. Next, we need to _model the embedded subprocess_. It is configured inside a dedicated container within the same pool. -//. На панелі інструментів зліва знайдіть елемент *Create expanded SubProcess* та перетягніть його в середину пулу. . On the left panel, find the *Create expanded SubProcess* element, and drag it into the pool. + image:bp-modeling/bp/subprocesses/embedded-subprocess/embedded-subprocess-5.png[] -//. Далі змоделюйте 3 елементи в рамках підпроцесу: . Next, model the three elements within the subprocess: -//* стартову подію підпроцесу; * subprocess start event; -//* користувацьку задачу для погодження змін; * user task for changes approval; -//* подію завершення підпроцесу. * subprocess end event. [#bp-start-event-subprocess] -//==== Моделювання стартової події підпроцесу ==== Modelling subprocess start event -//_Налаштуйте стартову подію підпроцесу_. + _Configure subprocess start event_. [NOTE] -//На відміну від налаштувань основного процесу, подія старту підпроцесу додається автоматично, разом із контейнером *Create expanded SubProcess*. As opposed to configuring the main process, subprocess start event is added automatically, along with the *Create expanded SubProcess* container. -//На панелі налаштувань справа заповніть поле `Name` назвою початкової події -- `Старт підпроцесу`. On the right panel, fill in the `Name` field with the start event name -- `Subprocess start`. image:bp-modeling/bp/subprocesses/embedded-subprocess/embedded-subprocess-6.png[] [#bp-user-form-approval-decision] -//==== Створення користувацької задачі для погодження змін ==== Creating the changes approval user task -//_Створіть користувацьку задачу для погодження змін_. Для цього виконайте кроки, подані нижче: _Create the user task for changes approval by taking the following steps_: -//. Створіть нову задачу, вкажіть її тип, натиснувши іконку ключа та обравши з меню пункт *User Task* (Користувацька задача). . Create a new task, define its type by clicking the key icon, and selecting *User Task* from the menu. -//. На панелі налаштувань справа натисніть `Open Catalog`, оберіть шаблон *User Form* (Користувацька форма) та натисніть `Apply` для підтвердження. . On the right panel, click `Open Catalog`, select *User Form* template, and click `Apply` to confirm. -//. На панелі налаштувань справа заповніть наступні поля: . On the configuration panel, fill in the following fields: -//* У полі `Name` вкажіть назву задачі -- `Прийняття рішення про погодження заяви`. * In the `Name` field, enter task name -- `Making decision on contract approval`. -//* У полі `Form key` введіть ключ форми, що відповідатиме службовій назві форми для внесення даних -- `add-applicationsecond`. * In the `Form key` field, enter the form key that corresponds with the service name of the form -- `add-applicationsecond`. -//* У полі `Assignee` вкажіть змінну, що використовується для зберігання користувача, який запустив екземпляр процесу, -- `${initiator}`. * In the `Assignee` field, enter the variable used to store the user that initiated the instance -- `${initiator}`. + image:bp-modeling/bp/subprocesses/embedded-subprocess/embedded-subprocess-7.png[] [#bp-end-event-subprocess] -//==== Моделювання події завершення підпроцесу ==== Modelling subprocess end event -//На цьому етапі необхідно _створити подію, яка завершуватиме підпроцес_. - -//. Створіть подію завершення бізнес-процесу. . Create subprocess end event. -//. На панелі налаштувань справа для параметра `Name` вкажіть значення `Завершення підпроцесу`. . On the right panel, for the `Name` parameter, enter the value `Subprocess end`. - + image:bp-modeling/bp/subprocesses/embedded-subprocess/embedded-subprocess-8.png[] [#bp-end-event] -//=== Моделювання події завершення основного процесу -=== Modelling main process end event +=== Modeling main process end event -//На цьому етапі необхідно _створити подію, яка завершуватиме процес_. - -//. Створіть подію завершення бізнес-процесу. . Create main process end event. -//. На панелі налаштувань справа для параметра `Name` вкажіть значення `Завершення процесу`. . On the right panel, for the `Name` parameter, enter the value `Process end`. - + -image:bp-modeling/bp/subprocesses/embedded-subprocess/embedded-subprocess-9.png[] - +image:bp-modeling/bp/subprocesses/embedded-subprocess/embedded-subprocess-9.png[] \ No newline at end of file diff --git a/docs/en/modules/registry-develop/pages/bp-modeling/bp/element-templates/element-templates-install.adoc b/docs/en/modules/registry-develop/pages/bp-modeling/bp/element-templates/element-templates-install.adoc new file mode 100644 index 0000000000..23710d4fce --- /dev/null +++ b/docs/en/modules/registry-develop/pages/bp-modeling/bp/element-templates/element-templates-install.adoc @@ -0,0 +1,149 @@ += Installing extensions to business processes (_for local development_) +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] + +include::platform:ROOT:partial$admonitions/language-en.adoc[] + +Standard extension connectors -- **Element Templates** have been developed to simplify business process modeling. + +IMPORTANT: If you use the functionality of the xref:registry-admin/admin-portal/overview.adoc[Administrative portal] to develop the registry, you don't need to install business process extensions, additional external applications, or plugins. The portal has everything necessary built in out of the box. The instructions below in this document are intended _ONLY_ for local development. + +[#preconditions] +== Preconditions + +=== Installing Camunda Modeler + +. Download the archive with the **Camunda Modeler** application via this link:https://downloads.camunda.cloud/release/camunda-modeler/4.8.0/[link]. ++ +[NOTE] +==== +It is recommended to use version 4.8.0 for stable system operation. +==== +. Select the **Open Source Modeler** product and download the version compatible with your operating system, e.g., *Windows 64bit*. +. After downloading the application archive, unpack it on your local machine. ++ +[TIP] +==== +The folder with the application might, for example, be named: + +*`camunda-modeler-4.8.1-win-x64`* +==== + +=== Installing the BPMN Linter plugin + +Install the **BPMN Linter** plugin to extend Camunda functionality and validate your BPMN diagrams. + +. Go to the official repository at https://github.com/camunda/camunda-modeler-linter-plugin[link]. + +. Click the *`Code`* > *`Download ZIP`* button and download the archive. ++ +image:bp-modeling/bp/element-temp/element-temp-install-bpmnlint.png[] + +. After downloading, unpack the archive content to the _camunda-modeler-4.8.1-win-x64\resources\plugins_ application folder of Camunda. + +. Restart the Camunda Modeler application. +. Enable the plugin by pressing *Plugins* > *BPMN Linter* > *Toggle Linting*. ++ +Alternatively, use the kbd:[Ctrl+L] keyboard shortcut. ++ +image:bp-modeling/bp/element-temp/element-temp-turn-on-bpmnlint.png[] ++ +TIP: The plugin can be turned on and off using `Ctrl+L`. + +[#element-temp-install] +== Installing the catalog of business process extensions + +[#element-temp-install-windows] +=== Installing the catalog of extensions for Windows OS + +Follow the instructions below to install the Element Templates catalog. + +. Download the business process extensions catalog analogously to the point xref:#element-temp-install-windows[]. +. Open the terminal. +. Navigate to the local directory where Camunda Modeler resources are located using the command: ++ +[source, bash] +---- +cd ~/Library/Application\ Support/camunda-modeler/resources +---- + +. Create a new directory under the extensions category `element templates` if it doesn't exist using the command: ++ +[source, bash] +---- +mkdir element-templates +---- + +. Copy all JSON extension files from the `business-process-modeler-extensions` directory to the created directory using the command: ++ +[source,bash] +---- +cp business-process-modeler-extensions/*.json ~/Library/Application\ Support/camunda-modeler/resources/element-templates +---- + +. The final directory structure should look like this: ++ +---- +~/Library/Application\ Support/camunda-modeler/resources/element-templates/ +---- ++ +image:registry-develop:bp-modeling/bp/element-temp/bp-element-temp-05.jpg[] + +. Restart the Camunda Modeler application. +. Check the availability of extensions in the catalog while modeling a business process: + +.. Create a task—select *Create Task*. +.. Click on the key icon—choose *Change Type*. +.. Specify the task type: *Service Task*, *User Task* or *Call Activity*. +.. Press the *`Open Catalog`* button. + +As a result, the *Element Templates* extension catalog will open, which can be applied during modeling. + ++ +image:registry-develop:bp-modeling/bp/element-temp/bp-element-temp-01.png[] + +[#element-temp-install-macos] +=== Installing the catalog of extensions for macOS + +Follow the instructions below to install the Element Templates catalog. + +. Download the catalog of extensions to business processes analogously to point xref:#element-temp-install-windows[]. +. Open the terminal. +. Navigate to the local directory where the Camunda Modeler resources are stored using the command: ++ +[source, bash] +---- +cd ~/Library/Application\ Support/camunda-modeler/resources +---- + +. Create a new directory for the `element templates` extensions category if it doesn't exist already using the command: ++ +[source, bash] +---- +mkdir element-templates +---- + +. Copy all the JSON extension files from the `business-process-modeler-extensions` directory to the newly created directory using the command: ++ +[source,bash] +---- +cp business-process-modeler-extensions/*.json ~/Library/Application\ Support/camunda-modeler/resources/element-templates +---- + +. The end directory structure should look something like this: ++ +---- +~/Library/Application\ Support/camunda-modeler/resources/element-templates/ +---- ++ +image:registry-develop:bp-modeling/bp/element-temp/bp-element-temp-05.jpg[] + +. Restart the Camunda Modeler application. +. Check the availability of extensions in the catalog during business process modeling: + +.. Create a task—select *Create Task*. +.. Click on the key icon - choose *Change Type*. +.. Specify the type of the task: *Service Task*, *User Task* or *Call Activity*. +.. Click on the *`Open Catalog`* button. + +This action will open the *Element Templates* extension catalog, which can be applied during modeling. + ++ +image:registry-develop:bp-modeling/bp/element-temp/bp-element-temp-01.png[] \ No newline at end of file diff --git a/docs/en/modules/registry-develop/pages/bp-modeling/bp/element-templates/element-templates-overview.adoc b/docs/en/modules/registry-develop/pages/bp-modeling/bp/element-templates/element-templates-overview.adoc index 99726cf5b8..cb7520e8c1 100644 --- a/docs/en/modules/registry-develop/pages/bp-modeling/bp/element-templates/element-templates-overview.adoc +++ b/docs/en/modules/registry-develop/pages/bp-modeling/bp/element-templates/element-templates-overview.adoc @@ -1,26 +1,26 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: += Business process extensions (Element templates) :sectlinks: -:partnums: +:sectanchors: -= Business process extensions (Element templates) +include::platform:ROOT:partial$admonitions/language-en.adoc[] -//CAUTION: Розділ у процесі модернізації. -CAUTION: This section is being updated. +CAUTION: This section is being refactored. -//Для спрощення моделювання бізнес-процесів розроблені типові інтеграційні розширення-конектори -- **Element Templates**. Вони є ланкою взаємодії між рівнем виконання бізнес-процесів та API фабрики даних. Standard integration connectors/extensions, or *Element Templates*, are meant to simplify business process modeling. They serve as a link between the business processes execution layer and the data factory API. - -[overview] == Section overview +[%collapsible] +._Installing business process extensions_ +==== +* [*] xref:registry-develop:bp-modeling/bp/element-templates/element-templates-install.adoc[] +==== + +[%collapsible] +._Business process extensions catalog_ +==== * [*] xref:registry-develop:bp-modeling/bp/element-templates/user-task-templates/user-task-overview.adoc[User task templates] * [*] xref:bp-modeling/bp/element-templates/service-task-templates/service-task-overview.adoc[Service task templates] -* [*] xref:bp-modeling/bp/element-templates/call-activities/call-activities-overview.adoc[Call activity templates] -* [*] xref:bp-modeling/bp/element-templates/rest-integration-registries/rest-integration-registries-overview.adoc[Standard extensions for integrating with other registries on the Platform] \ No newline at end of file +* [*] xref:bp-modeling/bp/element-templates/call-activities/call-activities-overview.adoc[] +* [*] xref:bp-modeling/bp/element-templates/rest-integration-registries/rest-integration-registries-overview.adoc[] +==== \ No newline at end of file diff --git a/docs/en/modules/registry-develop/pages/bp-modeling/bp/element-templates/rest-integration-registries/rest-integration-registries-overview.adoc b/docs/en/modules/registry-develop/pages/bp-modeling/bp/element-templates/rest-integration-registries/rest-integration-registries-overview.adoc index 873cff3aaf..aa9b7501cc 100644 --- a/docs/en/modules/registry-develop/pages/bp-modeling/bp/element-templates/rest-integration-registries/rest-integration-registries-overview.adoc +++ b/docs/en/modules/registry-develop/pages/bp-modeling/bp/element-templates/rest-integration-registries/rest-integration-registries-overview.adoc @@ -1,36 +1,28 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 += Integrating extensions :sectanchors: :sectlinks: -:partnums: -= Integrating extensions +include::platform:ROOT:partial$admonitions/language-en.adoc[] -//В рамках REST-взаємодії з іншими реєстрами на Платформі та бізнес-процесами, що змодельовані всередині регламентів таких реєстрів, імплементовано додаткові розширення-конектори (делегати) для передачі або отримання даних до/з цих реєстрів. Additional extensions, or delegates, are implemented to transfer and receive data as part of the REST interaction between the different registries on the Platform and the business process modeled within their regulations. -//На сьогодні Платформа підтримує 2 таких делегати: :: The Platform supports the following delegates: :: -//* xref:registry-develop:bp-modeling/bp/element-templates/rest-integration-registries/start-bp-another-registry.adoc[Start business process in another registry] -- делегат для ініціювання бізнес-процесу, що змодельований в рамках регламенту іншого реєстру на Платформі. -* xref:registry-develop:bp-modeling/bp/element-templates/rest-integration-registries/start-bp-another-registry.adoc[Start business process in another registry]: A delegate for initiating a business process modeled in the regulations of another registry on the Platform. -//* xref:registry-develop:bp-modeling/bp/element-templates/rest-integration-registries/search-for-entities-another-registry.adoc[Search for entities in another registry data factory] -- делегат для отримання даних сутностей (таблиць) у базі даних іншого реєстру, що розгорнутий на Платформі. -* xref:registry-develop:bp-modeling/bp/element-templates/rest-integration-registries/search-for-entities-another-registry.adoc[Search for entities in another registry data factory]: A delegate for obtaining data from entities (tables) in the database of another registry deployed on the Platform. +* *Start business process in another registry*: A delegate for initiating a business process modeled in the regulations of another registry on the Platform. +* *Search for entities in another registry data factory*: A delegate for obtaining data from entities (tables) in the database of another registry deployed on the Platform. [CAUTION] ==== -//Для того, щоб взаємодіяти з цільовим реєстром на Платформі, а також бізнес-процесами, що у ньому розгорнуті, недостатньо просто використовувати інтеграційні конектори. Using integration connectors is not enough to interact with a target registry on the Platform, as well as its business processes. -//Необхідно попередньо: :: You also need to: :: -//* Відкрити доступ до такого реєстру в адмін-консолі для керування реєстрами Control Plane (_детальну інструкцію ви можете переглянути на сторінці xref:admin:registry-management/control-plane-registry-grant-access.adoc[]_). * Grant access to the target registry using the Control Plane admin console. For details, see xref:admin:registry-management/control-plane-registry-grant-access.adoc[]. -//* Надати доступ до відповідних представлень та REST API реєстру на рівні моделі даних (_детальну інструкцію ви можете переглянути на сторінці xref:data-modeling/data/physical-model/rest-api-view-access-to-registry.adoc[]_). * Grant access to the relevant views and registry's REST API at the data model level. For details, see xref:data-modeling/data/physical-model/rest-api-view-access-to-registry.adoc[]. -==== \ No newline at end of file +==== + +== Section overview + +* xref:registry-develop:bp-modeling/bp/element-templates/rest-integration-registries/start-bp-another-registry.adoc[Start business process in another registry] + +* xref:registry-develop:bp-modeling/bp/element-templates/rest-integration-registries/search-for-entities-another-registry.adoc[Search for entities in another registry data factory] \ No newline at end of file diff --git a/docs/en/modules/registry-develop/pages/bp-modeling/bp/element-templates/service-task-templates/digital-signature-by-dso-service.adoc b/docs/en/modules/registry-develop/pages/bp-modeling/bp/element-templates/service-task-templates/digital-signature-by-dso-service.adoc index 5abb766541..75a2bd2b5b 100644 --- a/docs/en/modules/registry-develop/pages/bp-modeling/bp/element-templates/service-task-templates/digital-signature-by-dso-service.adoc +++ b/docs/en/modules/registry-develop/pages/bp-modeling/bp/element-templates/service-task-templates/digital-signature-by-dso-service.adoc @@ -6,27 +6,19 @@ include::platform:ROOT:partial$admonitions/language-en.adoc[] .Delegate summary |=== |Name |Description - |Business name |*Digital signature by DSO service* - |Service name |*`${digitalSignatureConnectorDelegate}`* - |File name in the extensions library |*_digitalSignatureConnectorDelegate.json_* |=== -//NOTE: Перш за все, переконайтеся, що папка _/element-templates_ містить файл _digitalSignatureConnectorDelegate.json_. NOTE: First of all, make sure the _/element-templates_ folder contains the _digitalSignatureConnectorDelegate.json_ file. -//. Відкрийте *Service Task* > у вікні справа натисніть кнопку `*Open Catalog*` та оберіть відповідний шаблон (Template) зі списку. . Open the *Service Task*, click the `*Open Catalog*` button, and select the template from the list. -//. У полі *Payload* введіть дані для підпису. . In the *Payload* field, enter the data for signing. -//. У полі *X-Access-Token source* введіть токен доступу до системи користувача, під яким виконується операція. . In the *X-Access-Token source* field, enter the user access token to the system used for the current operation. -//. У полі *Result variable* вкажіть будь-яке ім'я для вихідного параметра (за замовчуванням -- `response`). . In the *Result variable* field, enter any name for the output parameter (the default name is `response`). image:registry-develop:bp-modeling/bp/element-temp/bp-element-temp-11.png[] \ No newline at end of file diff --git a/docs/en/modules/registry-develop/pages/bp-modeling/bp/element-templates/service-task-templates/service-task-overview.adoc b/docs/en/modules/registry-develop/pages/bp-modeling/bp/element-templates/service-task-templates/service-task-overview.adoc index 6ee83592c5..586eced182 100644 --- a/docs/en/modules/registry-develop/pages/bp-modeling/bp/element-templates/service-task-templates/service-task-overview.adoc +++ b/docs/en/modules/registry-develop/pages/bp-modeling/bp/element-templates/service-task-templates/service-task-overview.adoc @@ -1 +1,42 @@ -= Service task extensions \ No newline at end of file += Service task extensions +:sectanchors: +:sectlinks: + +include::platform:ROOT:partial$admonitions/language-en.adoc[] + +== Section overview + +****** Managing users and roles +******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/add-role-to-keycloak-user.adoc[] +******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/save-user-roles.adoc[] +******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/get-roles-from-keycloak.adoc[] +******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/keycloak-get-officer-users-by-attributes-equals-start-with.adoc[] +******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/remove-role-from-keycloak-user.adoc[] +****** Managing user settings +******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/read-user-settings.adoc[] +****** Creating entities +******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/create-entity.adoc[] +******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/create-nested-entities.adoc[] +******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/batch-creation-entities.adoc[] +******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/batch-creation-entities-v2.adoc[] +****** Reading and searching entities +******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/read-entity.adoc[] +******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/batch-read-entities-from-data-factory.adoc[] +******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/search-entities-in-data-factory.adoc[] +****** Updating entities +******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/update-entity-in-data-factory.adoc[] +******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/update-entity-in-data-factory-partially.adoc[] +****** Deleting entities +******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/delete-entity.adoc[] +****** Modeling digital signatures +******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/digital-signature-by-dso-service.adoc[] +****** Integrating with external systems +******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/connect-to-external-system-v2.adoc[] +****** Modeling business process errors +******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/throw-system-error.adoc[] +******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/throw-validation-error.adoc[] +****** Modeling statuses +******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/define-bp-status.adoc[] + + + diff --git a/docs/en/modules/registry-develop/pages/bp-modeling/bp/element-templates/user-task-templates/user-task-overview.adoc b/docs/en/modules/registry-develop/pages/bp-modeling/bp/element-templates/user-task-templates/user-task-overview.adoc index b6ac8fd88c..cc65e6290c 100644 --- a/docs/en/modules/registry-develop/pages/bp-modeling/bp/element-templates/user-task-templates/user-task-overview.adoc +++ b/docs/en/modules/registry-develop/pages/bp-modeling/bp/element-templates/user-task-templates/user-task-overview.adoc @@ -1,4 +1,7 @@ = User task extensions +:sectanchors: +:sectlinks: + include::platform:ROOT:partial$admonitions/language-en.adoc[] == Section overview @@ -7,29 +10,3 @@ include::platform:ROOT:partial$admonitions/language-en.adoc[] * xref:bp-modeling/bp/element-templates/user-task-templates/officer-sign-task.adoc[] * xref:bp-modeling/bp/element-templates/user-task-templates/user-form.adoc[] - - -//// -[#business-process-modeler-extensions-configuration] -== Налаштування типових розширень до бізнес-процесів - -Цей розділ описує налаштування типових розширень для бізнес-процесів -- **Element Templates**. - -Типи задач для застосування розширень :: - -Типові розширення **Element Templates** можуть бути застосовані до різних типів задач, наприклад: - -* xref:#element-temp-user-task[] -* xref:#element-temp-service-task[] -* xref:#element-temp-call-activity[] -* xref:#element-temp-send-task[] -* xref:#extensions-integrate-bp-another-registries[] - -[CAUTION] -==== -Налаштування типових розширень-конекторів відбувається у застосунку *Camunda Modeler*. - -Перед початком роботи переконайтеся, що виконано всі передумови, описані у розділі xref:business-process-modeler-extensions-installation[Встановлення каталогу типових розширень до бізнес-процесів]. -==== -//// - diff --git a/docs/en/modules/registry-develop/pages/bp-modeling/bp/excerpts/bp-modeling-excerpt-csv-docx.adoc b/docs/en/modules/registry-develop/pages/bp-modeling/bp/excerpts/bp-modeling-excerpt-csv-docx.adoc index 0b0f624e73..b9a3059f42 100644 --- a/docs/en/modules/registry-develop/pages/bp-modeling/bp/excerpts/bp-modeling-excerpt-csv-docx.adoc +++ b/docs/en/modules/registry-develop/pages/bp-modeling/bp/excerpts/bp-modeling-excerpt-csv-docx.adoc @@ -1,214 +1,161 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: = Modeling business processes for generating excerpts in csv and docx format -//= Моделювання бізнес-процесу з формування витягів у форматі csv та docx -//:toc: -//:toc-title: ЗМІСТ -//:experimental: -//:example-caption: Приклад -//:important-caption: ВАЖЛИВО -//:note-caption: ПРИМІТКА -//:tip-caption: ПІДКАЗКА -//:warning-caption: ПОПЕРЕДЖЕННЯ -//:caution-caption: УВАГА -//:figure-caption: Figure -//:table-caption: Table -//:appendix-caption: Appendix -//:toclevels: 5 -//:sectnums: -//:sectnumlevels: 5 -//:sectanchors: -//:sectlinks: -//:partnums: - -The description of the business process modeling mechanism is given in the example of Register of certified laboratories, namely in creation of the "Laboratory report in csv format" excerpt. Modeling a business process for generating excerpts in the docx format is similar, except for the step where the file format is selected. -//Опис механізму моделювання бізнес-процесу наведений на прикладі Реєстру атестованих лабораторій, а саме формування витягу "Звіт по лабораторіям у форматі csv". Моделювання бізнес-процесу з витягом у форматі docx є аналогічним, за винятком кроку, де зазначається формат файлу. +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] + +include::platform:ROOT:partial$admonitions/language-en.adoc[] + +The description of the business process modeling mechanism is given in the example of the _Registry of certified laboratories_, namely in creating the "Laboratory report in csv format" excerpt. Modeling a business process for generating excerpts in the docx format is similar, except for the step where the file format is selected. [TIP] Fulfil the required preconditions for creating a business process, follow the xref:bp-modeling/bp/bp-modeling-instruction.adoc#bp-modelling-preconditions[link] for instructions. -//Виконайте необхідні передумови для створення бізнес-процесу, інструкція за xref:bp-modeling/bp/bp-modeling-instruction.adoc#bp-modelling-preconditions[посиланням]. == Initial steps for creating a business process -//== Початкові кроки створення бізнес-процесу . Create a new BPMN diagram. -//. Створіть нову BPMN-діаграму. + image:registry-develop:bp-modeling/bp/modeling-instruction/bp-1.png[] -. Add the Create pool/Participant element. -//. Додайте елемент Create pool/Participant. + +. Add the *Create pool/Participant* element. + In the right-hand side window with parameters, you have to enter the appropriate values into the fields: -//У правому вікні з параметрами необхідно заповнити поля відповідними значеннями: - ++ +-- * In the `Participant Name` field, enter the pool name -- `Generate a report on laboratories in csv format`. -//* в полі `Participant Name` введіть назву пулу `Формування звіту по лабораторіям в форматі csv`; * In the `Process id` field, enter the ID of the business process -- `zvit-csv-bp`. -//* в полі `Process id` введіть ідентифікатор бізнес-процесу `zvit-csv-bp`; * In the `Process name` field, enter the business name of the process -- `Generate a report on laboratories in csv format`. -//* в полі `Process name` вкажіть бізнес-назву процесу `Формування звіту по лабораторіям в форматі csv`. - +-- + image:registry-develop:bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-01.png[] + [#create-start-event] +[start=3] . Create the start event for starting the business process by a user. -//. Створіть початкову подію для запуску бізнес-процесу користувачем. + In the settings panel on the right-hand side, enter the appropriate values into the following parameters: -//На панелі налаштувань справа заповніть наступні параметри відповідними значеннями: * In the `General` tab: -//* на вкладці `General`: ** In the `Id` field, enter the `StartEvent_lab1` value. -//** в полі `Id` введіть значення `StartEvent_lab1`; ** In the `Name` field, enter the name of the start event -- `Start Form`. -//** в полі `Name` введіть назву початкової події `Стартова форма`; ** in the `Initiator` field, enter the `initiator` value. -//** в полі `Initiator` введіть значення `initiator`. + + [TIP] ==== `initiator` is a special variable set for the user, which initiated the process. -//`initiator` — спеціальна змінна, що встановлюється для користувача, який розпочав процес. ==== + + image:registry-develop:bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-02.png[] -* In the ``Form'' tab: -//* на вкладці `Form`: +* In the *Form* tab: + ** in the `FormKey` field, enter the form ID -- `add-startform-zvit`. -//** в полі `FormKey` введіть ідентифікатор форми `add-startform-zvit`. + + [TIP] ==== In the `FormKey` field, enter the service name of the created UI form in the Regulations administrator portal. -//В полі `FormKey` зазначається службова назва створеної UI-форми в Кабінеті адміністратора регламентів. image:registry-develop:bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-02.1.png[] -The following steps describe xref:#create-ui-form-1[modelling of the start form]. -//На подальших кроках буде розглянуто xref:#create-ui-form-1[моделювання стартової форми]. + +The following steps describe xref:#create-ui-form-1[modeling of the start form]. ==== == Data preparation and signing -//== Підготування даних та їх підписання -. Create a service task "Read data by laboratoryId". -//. Створіть сервісну задачу "Читання даних по laboratoryId". +. Create a service task *Read data by laboratoryId*. + -Select the customized `Read entity from data factory` template. -//Оберіть налаштований шаблон (Template) `Read entity from data factory`. +Select the customized *Read entity from data factory* template. + [TIP] ==== -You can find more details about the `Read entity from data factory` delegate by following the xref:bp-modeling/bp/element-templates/bp-element-templates-installation-configuration.adoc#_читання_сутності_із_фабрики_даних_read_entity_from_data_factory[link]. -//Детальніше ознайомитися з описом делегата Читання сутності із фабрики даних (`Read entity from data factory`) ви можете за xref:bp-modeling/bp/element-templates/bp-element-templates-installation-configuration.adoc#_читання_сутності_із_фабрики_даних_read_entity_from_data_factory[посиланням]. +You can find more details about this delegate on the page xref:bp-modeling/bp/element-templates/service-task-templates/read-entity.adoc[]. ==== + In the settings panel, enter the following values: -//На панелі налаштувань вкажіть наступні значення: * In the `Name` field, enter the name of the task -- `Data reading by laboratoryId`. -//* в полі `Name` вкажіть назву задачі `Читання даних по laboratoryId`; * In the `Resource` field, enter the `laboratory` resource. -//* в полі `Resource` вкажіть ресурс `laboratory`; * in the `Resource id` field, enter the resource ID -- `${submission('StartEvent_lab1').formData.prop('laboratory').prop('laboratoryId').value()}`. -//* в полі `Resource id` введіть ідентифікатор ресурсу `${submission('StartEvent_lab1').formData.prop('laboratory').prop('laboratoryId').value()}`; + + [TIP] ==== In our case, we pass the `StartEvent_lab1` resource identifier from the start form of the business process using the `submission()` function. -//В нашому випадку ми передаємо ідентифікатор ресурсу `StartEvent_lab1` за допомогою функції `submission()` зі стартової форми бізнес-процесу. ==== * In the `X-Access-Token` field, specify the access token to the user's system that is used to perform the `${initiator().accessToken}` operation. -//* в полі `X-Access-Token` вкажіть токен доступу до системи користувача, під яким виконується операція `${initiator().accessToken}`; + * In the `Result Variable` field, enter the output parameter name -- `labResponse`. -//* в полі `Result Variable` вкажіть назву для вихідного параметра -- `labResponse`. + image:registry-develop:bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-03.png[] -. Create the "Search for employee data" service task. -//. Створіть сервісну задачу "Пошук даних про співробітників". +. Create the *Search for employees data* service task. + -Select the configured `Search for entities in data factory` template. -//Оберіть налаштований шаблон (Template) `Search for entities in data factory`. +Select the configured *Search for entities in data factory* template. + + [TIP] ==== -You can find more details about the `Search for entities in data factory` delegate by following the xref:bp-modeling/bp/element-templates/bp-element-templates-installation-configuration.adoc#_пошук_сутностей_у_фабриці_даних_search_for_entities_in_data_factory[link]. -//Детальніше ознайомитися з описом делегата Пошук сутностей у фабриці даних (`Search for entities in data factory`) ви можете за xref:bp-modeling/bp/element-templates/bp-element-templates-installation-configuration.adoc#_пошук_сутностей_у_фабриці_даних_search_for_entities_in_data_factory[посиланням]. +You can find more details about this delegate on the page xref:bp-modeling/bp/element-templates/service-task-templates/search-entities-in-data-factory.adoc[]. + ==== + In the settings panel, enter the following values: -//На панелі налаштувань вкажіть наступні значення: -* In the `Name` field, enter the name of the task -- `Search for employee data`. -//* У полі `Name` вкажіть назву задачі `Пошук даних про співробітників`; + +* In the `Name` field, enter the name of the task -- `Search for employees data`. + * In the `Input Parameters` section: -//* У розділі `Input Parameters`: + ** Expand the `Resource` block: -//** Розгорніть блок `Resource`: + *** `Local Variable Assignment` is set to `on`. This allows creation of a local variable for the request body. -//*** `Local Variable Assigment` має значення `on`, це дозволить створити локальну змінну для тіла запита; + *** `Variable Assignment Type`, select the `String of Expression` variable assignment type from the dropdown list. -//*** `Variable Assignment Type` оберіть з випадного списку тип призначення змінної `String of Expression`; + *** `Variable Assignment Value`, enter `staff-equal-laboratory-id`. -//*** `Variable Assignment Value` введіть `staff-equal-laboratory-id`. + + [TIP] ==== `staff-equal-laboratory-id` is the endpoint name for the search criteria, where a request is made to find entities. -//`staff-equal-laboratory-id` -- це назва ендпоінту для критерію пошуку куди здійснюється запит для пошуку сутностей. + ==== ** Expand the `Search variable` block: -//** Розгорніть блок `Search variable`: + *** `Local Variable Assignment` has the `on` value. -//*** `Local Variable Assigment` має значення `on`; + *** `Variable Assignment Type`, select `Map`. -//*** `Variable Assignment Type` виберіть `Map`; + *** `Add Entry`, enter `laboratoryId` in `Key`, and enter `${submission('StartEvent_lab1').formData.prop('laboratory').prop('laboratoryId').value()}` in `Value`. ** Expand the `X-Access-Token` block: -//** Розгорніть блок `X-Access-Token`: + *** `Local Variable Assignment` has the `on` value. -//*** `Local Variable Assigment` має значення `on`; + *** `Variable Assignment Type`, select `String of Expression`. -//*** `Variable Assignment Type` оберіть `String of Expression`; + *** `Variable Assignment Value`, enter `${initiator().accessToken}`. -//*** `Variable Assignment Value` введіть значення `${initiator().accessToken}`. + * In the `Output Parameters` section: -//* У розділі `Output Parameters`: + ** Expand the `Result variable` block: -//** Розгорніть блок `Result variable`: + *** `Local Variable Assignment` has the `on` value. -//*** `Local Variable Assigment` має значення `on`; + *** `Assign to Process Variable`, enter the value of the variable used for writing the request result -- `staffResponse`. -//*** `Assign to Process Variable` введіть значення змінної до якої буде записано результат запита -- `staffResponse`. + image:registry-develop:bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-04.png[] -. Create the "Prepare data for displaying" script task. -//. Створіть задачу скриптування "Підготовка даних для показу". +. Create the *Prepare data for displaying* script task. + In the settings panel, enter the following values: -//На панелі налаштувань вкажіть наступні значення: * In the `Name` field, enter the `Prepare data for displaying` name. -//* в полі `Name` вкажіть назву `Підготовка даних для показу`; * In the `Script Format` field, enter the script type (language) — `groovy`. -//* в полі `Script Format` вкажіть тип (мову) скриптування — `groovy`; * In the `Script Type` field, select the script type -- `Inline Script`. -//* в полі `Script Type` вкажіть тип скрипту `Inline Script`; * In the `Script` field, insert the following groovy script: -//* в полі `Script` вставте безпосередньо groovy-скрипт: + [source, groovy] ---- @@ -245,60 +192,47 @@ payload['personnelGrid'] = personnelGrid execution.removeVariable('payload') set_transient_variable('payload', S(payload, 'application/json')) ---- - + image:registry-develop:bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-05.png[] + [#create_user-task-1] -. Create the "Display personnel data" custom task. -//. Створіть користувацьку задачу "Відобразити дані про персонал". +[start=4] +. Create the *Display personnel data* custom task. + In the settings panel, set the following values: -//На панелі налаштувань вкажіть наступні значення: * In the `Id` field, enter the `personnelDataZvitForm` value. -//* в полі `Id` введіть значення `personnelDataZvitForm`; * In the `Name` field, enter the `Display personnel data` name. -//* в полі `Name` вкажіть назву `Відобразити дані про персонал`; * In the `Form key` field, enter the `read-personnel-data-zvit` value. -//* в полі `Form key` введіть значення `read-personnel-data-zvit`; + + [TIP] ==== In the `FormKey` field, you have to enter the service name of the created UI form in the Regulations administrator portal. -//В полі `FormKey` зазначається службова назва створеної UI-форми в Кабінеті адміністратора регламентів. -The following steps describe xref:#create-ui-form-2[modelling of the personnel data display form]. -//На подальших кроках буде розглянуто xref:#create-ui-form-2[моделювання форми відображення даних про персонал]. +The following steps describe xref:#create-ui-form-2[modeling of the personnel data display form]. ==== + * In the `Assignee` field, enter the `${initiator}` value. -//* в полі `Assignee` введіть значення `${initiator}`; + [TIP] ==== `${initiator}` indicates that the business process will be assigned to the user who initiated the business process. -//`${initiator}` вказує на те, що бізнес-процес буде призначено користувачеві, що ініціював бізнес-процес. ==== * In the `Form data pre-population` field, enter the `${payload}` value. -//* в полі `Form data pre-population` введіть значення `${payload}`. - + image:registry-develop:bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-06.png[] -. Create the "Prepare data for writing (transient var)" script task. -//. Створіть задачу скриптування "Підготовка даних для запису (transient var)". +. Create the *Prepare data for creating database record (transient var)* script task. + In the settings panel, set the following values: -//На панелі налаштувань вкажіть наступні значення: -* In the `Name` field, enter the `Prepare data for writing (transient var)` value. -//* в полі `Name` введіть значення `Підготовка даних для запису (transient var)`; +* In the `Name` field, enter the `Prepare data for creating database record (transient var)` value. * In the `Script Format` field, enter the script type (language) — `groovy`. -//* в полі `Script Format` вкажіть тип (мову) скриптування — `groovy`; * In the `Script Type` field, select the `Inline Script` script type. -//* в полі `Script Type` вкажіть тип скрипту `Inline Script`; * In the `Script` field, insert the following groovy script: -//* в полі `Script` вставте безпосередньо groovy-скрипт: + + [source, groovy] ---- @@ -344,71 +278,60 @@ set_transient_variable('excerpt', excerptInputData) + image:registry-develop:bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-07.png[] -. Add the task for calling an external business process (Call Activity) "Signing data using the system key". -//. Додайте задачу виклику зовнішнього бізнес-процесу (Call Activity) "Підпис даних системним ключем". +. Add a service task for data signing with the system key. + [TIP] ==== -You can find more details about the `System digital signature` delegate by following the xref:bp-modeling/bp/element-templates/bp-element-templates-installation-configuration.adoc#element-temp-system-digital-signature[link]. -//Детальніше ознайомитися з описом делегата виклику підпроцесу для підпису даних системним ключем (`System digital signature`) ви можете за xref:bp-modeling/bp/element-templates/bp-element-templates-installation-configuration.adoc#element-temp-system-digital-signature[посиланням]. +For a detailed overview of the delegate description for signing data with the system key, follow this xref:bp-modeling/bp/element-templates/service-task-templates/digital-signature-by-dso-service.adoc[link]. ==== + -Select the configured `System digital signature` template. -//Оберіть налаштований шаблон (Template) `System digital signature`. +Select the configured template *Digital signature by DSO service*. + -In the settings panel, enter the following values: -//На панелі налаштувань вкажіть наступні значення: - -* In the `Name` field, enter the name of the task -- `Signing data using the system key`. -//* в полі `Name` вкажіть назву задачі `Підпис даних системним ключем`; -* In the `Input Parameters` section enter the input data that must be signed and passed to a business process called by `${payload}`; -//* в полі `Input Data` вкажіть вхідні дані, які необхідно підписати та передати бізнес-процесу, що викликається `${payload}`; -* In the `Output variable name` field, enter the `system_signature_ceph_key` variable, where the system signature key, obtained as a result of execution of the called subprocess, has to be saved. -//* в полі `Output variable name` вкажіть назву змінної `system_signature_ceph_key`, до якої необхідно зберегти системний ключ для підпису, отриманий в результаті виконання підпроцесу, що викликається. +In the settings panel, specify the following values: -+ -image:registry-develop:bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-08.png[] +* In the *Name* field, indicate the task name `Sign data with the system key`. +* In the *Payload* field, enter the data to be signed -- `${payload}`. +* In the *X-Access-Token source* field, indicate the user access token under which the operation is performed -- `${initiator().accessToken}`. +* In the *Result variable* field, specify the variable name `system_signature_ceph_key`, to which the system signing key should be saved. == Generating a report -//== Формування звіту + [#create-service-task-1] -. Create a service task "Request for generating an excerpt report". -//. Створіть сервісну задачу "Запит на формування витягу-звіту". +. Create a service task *Request for generating an excerpt*. + + Select the `Generate Excerpt' configured template. -//Оберіть налаштований шаблон (Template) `Generate Excerpt`. -* In the `Name field`, enter the `Request for generating an excerpt report` name. -//* в полі `Name` введіть назву `Запит на формування витягу-звіту`; + +* In the `Name field`, enter the `Request for generating an excerpt` name. + * In the `Excerpt Type` field, enter the name of the file that defines the format -- `lab-staff-excerpt-csv`. -//* в полі `Excerpt Type` введіть назву файлу, яким визначено формат `lab-staff-excerpt-csv`; + * In the `Excerpt Input Data` field, enter the `${excerpt}` value. -//* в полі `Excerpt Input Data` введіть значення `${excerpt}`; + * In the `Requires System Signature` field, enter the `false` value. -//* в полі `Requires System Signature` введіть значення `false`; + + [IMPORTANT] ==== A possibility to sign excerpt data in .csv and .docx formats using a system key [.underline]#is not available#. Therefore, the `Requires System Signature` parameter should contain the `false` value by default. If `true` is set, the business process will not run. _Signing using the system key is only available for the .pdf format_. -//Можливість підписання даних витягів у форматі .csv і .docx системним ключем [.underline]#відсутня#, тому за замовчуванням параметр `Requires System Signature` має містити значення `false`. Якщо буде вказано значення `true`, бізнес-процес не буде працювати. _Підписання системним ключем доступно лише для формату .pdf_. + ==== * In the `X-Access-Token` field, enter the token to access the user system, which is used to perform the `${initiator().accessToken}` operation. -//* в полі `X-Access-Token` зазначте токен доступу до системи користувача, під яким виконується операція `${initiator().accessToken}`; + * In the `X-Digital-Signature source` field, enter the source of the digital signature -- `${sign_submission('StartEvent_lab1').signatureDocumentId}`. -//* в полі `X-Digital-Signature source` вкажіть джерело цифрового підпису `${sign_submission('StartEvent_lab1').signatureDocumentId}`; + * In the `X-Digital-Signature-Derived source` field, enter the source of the system digital signature -- `${system_signature_ceph_key}`. -//* в полі `X-Digital-Signature-Derived source` вкажіть джерело системного цифрового підпису `${system_signature_ceph_key}`; + * In the `Result variable` field, enter the `response` output parameter name. -//* в полі `Result variable` вкажіть назву для вихідного параметра `response`. + image:registry-develop:bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-09.png[] -+ [TIP] ==== The data transmitted to generate the `excerptInputData` excerpt must have the following format: -//Дані, що передаються для генерації витягу `excerptInputData` повинні мати відповідний формат: + [source, groovy] ---- { @@ -427,10 +350,8 @@ The data transmitted to generate the `excerptInputData` excerpt must have the fo ==== . Create a file in the root of the cluster, placing it in the corresponding project directory. -//. Створіть файл у корені кластера, розмістивши його у відповідному каталозі проєкту. + The file name has to be identical to the name entered in `Excerpt Type` (xref:#create-service-task-1[at the previous step]). In our example, that is `lab-staff-excerpt-csv.csv`. -//Файл повинен мати назву ідентичну зазначеній у полі `Excerpt Type` (xref:#create-service-task-1[на попередньому кроці]), у нашому прикладі -- `lab-staff-excerpt-csv.csv`. + [plantuml] ---- @@ -491,121 +412,107 @@ The file name has to be identical to the name entered in `Excerpt Type` (xref:#c [TIP] ==== At this stage, the .csv and .docx file format is determined. -//На цьому етапі визначається формат файлу .csv та .docx. + ==== -. Create a "Save extract report request ID" script task. -//. Створіть задачу скриптування "Зберегти Id запиту витягу-звіту". +. Create a "Save excerpt's request ID" script task. + + In the settings panel, set the following values: -//На панелі налаштувань вкажіть наступні значення: -* In the `Name` field, enter the name of the task -- "Save extract report request ID". -//* в полі `Name` введіть назву задачі `Зберегти Id запиту витягу-звіту`; + +* In the `Name` field, enter the name of the task -- *Save excerpt's request ID*. * In the `Script Format` field, enter the script type (language) — `groovy`. -//* в полі `Script Format` вкажіть тип (мову) скриптування — `groovy`; * In the `Script Type` field, select the `Inline Script` script type. -//* в полі `Script Type` вкажіть тип скрипту `Inline Script`; * In the `Script` field, insert the following groovy script: -//* в полі `Script` вставте безпосередньо groovy-скрипт: + + [source, groovy] ---- response.responseBody.prop('excerptIdentifier').value() ---- * In the `Result Variable` field, enter the name of the variable to which the extract identifier will be written, -- `excerptIdentifier`. -//* в полі `Result Variable` вкажіть назву змінної, до якої буде записано ідентифікатор витягу, -- `excerptIdentifier`. + image:registry-develop:bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-11.png[] == Setting the conditions of the output generation result checks -//== Налаштування умов перевірок результату генерації витягу . Add the task for calling an external business process (Call Activity) "Check excerpt generation status". -//. Додайте задачу виклику зовнішнього бізнес-процесу (Call Activity) "Перевірка статусу генерації витягу-звіту". + Select the configured `Check excerpt status` template. -//Оберіть налаштований шаблон (Template) `Check excerpt status`. + + [TIP] ==== -Follow the xref:bp-modeling/bp/element-templates/bp-element-templates-installation-configuration.adoc#element-temp-check-excerpt-status[link] to find more details about the `Check excerpt status` delegate. -//Детальніше ознайомитися з описом делегата `Check excerpt status` ви можете за xref:bp-modeling/bp/element-templates/bp-element-templates-installation-configuration.adoc#element-temp-check-excerpt-status[посиланням]. +Follow the xref:bp-modeling/bp/element-templates/call-activities/check-excerpt-status.adoc[link] to find more details about the `Check excerpt status` delegate. + ==== + In the settings panel, enter the following values: -//На панелі налаштувань вкажіть наступні значення: + * In the `Name` field, enter the name of the task -- `Check the status of excerpt generation`. -//* в полі `Name` вкажіть назву задачі `Перевірка статусу генерації витягу-звіту`; + * In the `Input excerpt identifier` field, enter the excerpt ID that has to be passed to the called business process -- `${excerptIdentifier}`. -//* в полі `Input excerpt identifier` вкажіть ID витягу, який необхідно передати бізнес-процесу, що викликається, -- `${excerptIdentifier}`; + * In the `Output variable name` field, enter the `excerptStatus` variable, where the excerpt status, recived as the result of a sub-process execution, has to be saved. -//* в полі `Output variable name` вкажіть назву змінної -- `excerptStatus`, до якої необхідно зберегти статус витягу, отриманий в результаті виконання підпроцесу, що викликається. + + image:registry-develop:bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-12.1.png[] + - - ."Check excerpt generation status" business process -//.Бізнес процес "Перевірка статусу генерації витягу" + ==== image:registry-develop:bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-13.png[] ==== -. Add the Create Intermediate/Boundary Event element, define its type by clicking the key icon (Change type) and selecting the Timer Boundary Event item from the menu. -//. Додайте елемент Create Intermediate/Boundary Event, визначте її тип, натиснувши іконку ключа (Change type) та обравши з меню пункт Timer Boundary Event. +. Add the Create *Intermediate/Boundary Event* element, define its type by clicking the key icon (Change type) and selecting the Timer Boundary Event item from the menu. + + [TIP] ==== -Follow the xref:registry-develop:bp-modeling/bp/bpmn/events/timer-event.adoc[link] to find more detailed description of the "Timer" event modeling element. -//Детальніше ознайомитися з описом елемента моделювання події "Timer" ви можете за xref:registry-develop:bp-modeling/bp/bpmn/events/timer-event.adoc[посиланням]. +Follow the xref:registry-develop:bp-modeling/bp/bpmn/events/timer-event.adoc[link] to find more detailed description of the *Timer* event modeling element. + ==== + Go to the settings panel and configure the event: -//Перейдіть до панелі налаштувань та сконфігуруйте подію: + * In the `Name` field, enter the `P2M waiting time expired`. -//* в полі `Name` введіть значення `Вичерпано час на очікування P2M`; * In the `Timer Definition Type` field, set the `Duration` timer type; -//* в полі `Timer Definition Type` вкажіть тип таймера `Duration` (тривалість); * In the `Timer Definition` field, set the `P2M` timer duration. -//* в полі `Timer Definition` зазначте тривалість таймера `P2M`. + image:registry-develop:bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-12.2.png[] . Add XOR gateways for the "Check excerpt generation status" Call Activity and for the "P2M Timed Out" Timer Boundary Event. -//. Додайте XOR-шлюзи для Call Activity "Перевірка статусу генерації витягу-звіту" і Timer Boundary Event "Вичерпано час на очікування P2M". + + image:registry-develop:bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-14.png[] -. Create the "Save the identifier of the generated excerpt to the system BP" service task. -//. Створіть сервісну задачу "Зберегти ідентифікатор згенерованого витягу-звіту у системну БП". +. Create the "Save the generated excerpt identifier to the system BP" service task. + In the settings panel, set the following values: -//На панелі налаштувань вкажіть наступні значення: * In the `General` tab: -//* на вкладці `General`: + ** In the `Name` field, enter the value `Save the identifier of the generated excerpt to the system BP`. -//** в полі `Name` введіть значення `Зберегти ідентифікатор згенерованого витягу-звіту у системну БП`; + ** in the `Implementation` field ,select the `Delegate Expression` value. -//** в полі `Implementation` виберіть значення `Delegate Expression`; + ** In the `Delegate Expression` field, enter `${defineProcessExcerptIdDelegate}`. -//** в полі `Delegate Expression` введіть значення `${defineProcessExcerptIdDelegate}`. + * In the `Input/Output` tab: -//* на вкладці `Intup/Output`: + ** In the `Local Variable Name` field, enter the `excerptId` value. -//** в полі `Local Variable Name` введіть значення `excerptId`; + ** In the `Variable Assignment Type` field, select `String or Expression`. -//** в полі `Variable Assignment Type` виберіть значення `String or Expression`; + ** In the `Variable Assignment Value` field, enter `${excerptIdentifier}`. -//** в полі `Variable Assignment Value` введіть значення `${excerptIdentifier}`. + image:registry-develop:bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-15.1.png[] @@ -617,153 +524,127 @@ image:registry-develop:bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-d [TIP] ==== The value specified in the `Id` field is used as the name of the file that a user downloads from the portal. -//Значення, що вказано в полі `Id` використовується як назва файлу, який користувач буде завантажувати з Кабінету. + ==== . Configure the flow process for the XOR gateway. -//. Налаштуйте процес потоку для XOR-шлюзу. + + Create Connect using sequence (branches): -//Створіть Connect using sequence (гілки): + + .. To the "Save the identifier of the generated excerpt to the system BP" service task: -//.. до сервісної задачі "Зберегти ідентифікатор згенерованого витягу-звіту у системну БП": + * Enter `yes` in the `Name` field. -//* у полі `Name` введіть значення `так`; + * In the `Condition Type` field, select `Expression`. -//* у полі `Condition Type` виберіть значення `Expression`; + * In the `Expression` field, enter the `${excerptStatus.equals('COMPLETED')}` value. -//* у полі `Expression` введіть значення `${excerptStatus.equals('COMPLETED')}`. + + image:registry-develop:bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-16.png[] .. To another XOR gateway: -//.. до іншого XOR-шлюзу: + * In the `Name` field, enter `no`. -//* у полі `Name` введіть значення `ні`; + * In the `Condition Type` field, select `Expression`. -//* у полі `Condition Type` виберіть значення `Expression`; + * In the `Expression` field, enter `${excerptStatus.equals('FAILED')}`. -//* у полі `Expression` введіть значення `${excerptStatus.equals('FAILED')}`. + + image:registry-develop:bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-17.png[] == Process execution result -//== Результат виконання процесу === Unsuccessful result of business process execution -//=== Неусіпішний результат виконання бізнес-процесу . Create the "Execution result "Excerpt not generated"" service task. -//. Створіть сервісну задачу "Результат виконання "Витяг-звіт не сформовано"". + Choose the `Define business process status` configured template. -//Оберіть налаштований шаблон (Template) `Define business process status`. ++ + In the settings panel, set the following values: -//На панелі налаштувань вкажіть наступні значення: * In the `Name` field, enter the `Execution result "Excerpt not generated"` value. -//* у полі `Name` введіть значення `Результат виконання "Витяг-звіт не сформовано"`; + * In the `Status` field, enter the `Excerpt not generated` value. This status is displayed after process completion. -//* у полі `Status` введіть значення `Витяг не сформовано` статус, що відображатиметься після завершення процесу. + image:registry-develop:bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-18.png[] . Configure the flow process from the XOR gateway to the service task "Execution result "Excerpt not generated"" by creating a Connect using sequence (branch). -//. Налаштуйте процес потоку від XOR-шлюзу до сервісної задачі "Результат виконання "Витяг-звіт не сформовано"", створивши Connect using sequence (гілку). + + And create the business process completion event. -//І створіть подію завершення бізнес-процесу. * In the `Name` field, enter the `Excerpt document not generated` value. -//* у полі `Name` введіть значення `Документ витяг-звіт не сформовано`. + image:registry-develop:bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-19.png[] === Successful result of business process execution -//=== Успішний результат виконання бізнес-процесу . Create the "Execution result "Excerpt generated"" service task. -//. Створіть сервісну задачу "Результат виконання "Витяг-звіт сформовано"". + Choose the `Define business process status` configured template. -//Оберіть налаштований шаблон (Template) `Define business process status`. + In the settings panel, set the following values: -//На панелі налаштувань вкажіть наступні значення: * In the `Name` field, enter the `Execution result "Excerpt generated"` value. -//* у полі `Name` введіть значення `Результат виконання "Витяг-звіт сформовано"`; -* In the `Status` field, enter the `Excerpt generated` value. This status is displayed after process completion. -//* у полі `Status` введіть значення `Витяг сформовано` статус, що відображатиметься після завершення процесу. -+ -image:registry-develop:bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-20.png[] +* In the `Status` field, enter the `Excerpt generated` value. This status is displayed after process completion. . Create the business process completion event. -//. Cтворіть подію завершення бізнес-процесу. * In the `Name` field, enter the `Excerpt document generated` value. -//* у полі `Name` введіть значення `Документ витяг-звіт сформовано`. + image:registry-develop:bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-21.png[] == Modeling forms -//== Моделювання форм Model the forms in accordance with the instructions at the xref:registry-develop:bp-modeling/forms/registry-admin-modelling-forms.adoc[link]. -//Змоделюйте форми згідно з інструкцією за xref:registry-develop:bp-modeling/forms/registry-admin-modelling-forms.adoc[посиланням]. [#create-ui-form-1] === Modeling the starting form -//=== Моделювання стартової форми Modeling the starting form involves creation of a form for searching a laboratory by its name. -//Моделювання стартової форми передбачає створення форми для пошуку лабораторії за назвою. * In the `Form business name` field, enter the `Start form lab report` value. -//* У полі `Бізнес-назва форми` введіть значення `Стартова форма лаб звіт`. + * In the `Form service name` field, enter the `add-startform-zvit` value (which is used at the xref:#create-start-event[previous step] as the value of the `Form Key` parameter). -//* У полі `Службова назва форми` введіть значення `add-startform-zvit` (що використовувалось на xref:#create-start-event[минулому кроці] як значення параметра `Form Key`). image:bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-22.png[] [TIP] ==== The configured form can be downloaded from the following link: -//Завантажити налаштовану форму можливо за посиланням: + _link:{attachmentsdir}/bp-modeling/add-startform-zvit.json[add-startform-zvit.json]_ ==== [#create-ui-form-2] === Modeling the personnel data display form -//=== Моделювання форми відображення даних про персонал Modeling the personnel data display form involves creation of a form for generating the data of the called laboratory. -//Моделювання форми відображення даних про персонал передбачає створення форми для формування даних запитуваної лабораторії. + * In the `Business name of the form` field, enter the `Display personnel data report` value. -//* У полі `Бізнес-назва форми` введіть значення `Відобразити дані про персонал звіт`. + * In the `Form service name` field, enter the `read-personnel-data-zvit` value (which is used at the xref:#create_user-task-1[previous step] as the value of the `Form Key` parameter). -//* У полі `Службова назва форми` введіть значення `read-personnel-data-zvit`,(що використовувалось на xref:#create_user-task-1[минулому кроці] як значення параметра `Form Key`). image:bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-23.png[] [TIP] ==== The configured form can be downloaded from the following link: -//Завантажити налаштовану форму можливо за посиланням: + _link:{attachmentsdir}/bp-modeling/read-personnel-data-zvit.json[read-personnel-data-zvit.json]_ ==== == An example of using the business process by a user -//== Приклад використання бізнес-процесу користувачем -You can learn more about the process of creating excerpts by users, based on the result of the modeled business process, at following the links: -//Детальніше ознайомитися з процесом формування витягів користувачем за результатом змодельованого бізнес-процесу ви можете за посиланнями: +You can learn more about the process of creating excerpts by users based on the result of the modeled business process by the following links: * xref:user:officer/reports/reports-csv.adoc[] * xref:user:officer/reports/reports-docx.adoc[] diff --git a/docs/en/modules/registry-develop/pages/bp-modeling/bp/index.adoc b/docs/en/modules/registry-develop/pages/bp-modeling/bp/index.adoc index 068faadec5..febaa617bf 100644 --- a/docs/en/modules/registry-develop/pages/bp-modeling/bp/index.adoc +++ b/docs/en/modules/registry-develop/pages/bp-modeling/bp/index.adoc @@ -1,9 +1,8 @@ -//= Моделювання бізнес-процесів і таблиць прийняття рішень -= Business process and decision tables modeling += Modeling business processes and decision tables +:sectanchors: +:sectlinks: -include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] - -include::platform:ROOT:partial$admonitions/language-en.adoc[] +*_Business Processes (BP)_* are the basis for all services provided by Registries on the Platform. They are based on BPMN -- as standardized notation for representing and modeling business processes that allow organizations to streamline operations, improve efficiency and communication between service providers and recipients. BP modelers use dedicated BPMN tools to create, edit, emulate, and execute Business Processes. BP modeling is an extensive section that includes many topics. You can learn more about them on dedicated pages. diff --git a/docs/en/modules/registry-develop/pages/bp-modeling/bp/rest-connector.adoc b/docs/en/modules/registry-develop/pages/bp-modeling/bp/rest-connector.adoc index 83563fdcba..f0e76a60a1 100644 --- a/docs/en/modules/registry-develop/pages/bp-modeling/bp/rest-connector.adoc +++ b/docs/en/modules/registry-develop/pages/bp-modeling/bp/rest-connector.adoc @@ -1,195 +1,105 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - -//= Інтеграція із зовнішніми сервісами за допомогою REST-конектора = Integration with external services using the REST connector +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] + +include::platform:ROOT:partial$admonitions/language-en.adoc[] -//`REST Connector` -- це конектор для підключення до зовнішніх захищених сервісів/систем поза кластером Платформи. You can use the `REST connector` to connect to secured services or systems outside the Platform cluster. -//Для налаштування конектора необхідно виконати наступні кроки. This guide describes the steps required to set up the connector. [#create-service-entry] -//== Створення ServiceEntry == Creating a Service Entry -//Для того, щоб запит на отримання зовнішніх ресурсів міг вийти за межі кластера Платформи, необхідно на рівні реєстру створити *`Service Entry`* -- точку виходу трафіку за межі системи. Before a request for an external resource can go beyond the Platform cluster, you need to create a *Service Entry* at the registry level to serve as an entry point for the outbound traffic. [NOTE] ==== -//Service Entry створюється автоматично, після того, як адміністратор реєстру налаштує інтеграцію в адміністративній панелі Control Plane. Після застосування змін до конфігурації реєстру та проходження Jenkins-пайплайну `*MASTER-Build-*`, підключення до зовнішньої системи буде налаштовано. + A Service Entry is created automatically after the registry administrator configures the integration in the Control Plane admin console. Once the changes are applied to the registry configuration and the *MASTER-Build-``* Jenkins pipeline runs, the connection to the external system is set up. -//За деталями налаштувань у консолі Control Plane зверніться до сторінки xref:registry-develop:registry-admin/external-integration/cp-integrate-ext-system.adoc[]. For details on Control Plane settings, see xref:registry-develop:registry-admin/external-integration/cp-integrate-ext-system.adoc[]. ==== [WARNING] ==== -//Для версій реєстру 1.9.2 та нижче Service Entry створюється автоматично, після запуску пайплайну публікацій та розгортання змін до регламенту реєстру. + For registry versions 1.9.2 or earlier, a Service Entry is created automatically after the publication pipeline is launched and changes to the registry regulations are deployed. ==== -//Перевірити, що Service Entry створено, можна у списку `*ServiceEntries*` в OpenShift-консолі. Для цього: You can check whether the Service Entry was created using the `*ServiceEntries*` list in the OpenShift console. -//. Увійдіть до OpenShift консолі. . Sign in to the OpenShift web console. -+ -//. Перейдіть до меню `Home` → `API Explorer`. У рядку пошуку `Filter by kind` введіть значення `ServiceEntry`, в результатах фільтрування виберіть відповідний сервіс. + . Go to *Home* > *API Explorer*. . In the *Filter by kind* search field, search for `ServiceEntry` and select the corresponding service. + image:registry-develop:bp-modeling/bp/rest-connector/rest-connector-1.png[] -+ -//. Виберіть реєстр з випадного списку `Project`, в якому буде використовуватись зовнішній сервіс. Перейдіть до меню `Instances` і знайдіть необхідну `ServiceEntry`. + . From the *Project* dropdown list, select the registry that will use the external service. . Open the *Instances* tab and find the required `ServiceEntry`. + image:registry-develop:bp-modeling/bp/rest-connector/rest-connector-2-1.png[] -// The following text was commented out in the original doc -//// - -Starting from 1.8.2 release, the ServiceEntry is created automatically - -How to create ServiceEntry manually? ONLY for versions up to 1.8.1 - -. Авторизуйтесь до OpenShift консолі. - -. Перейдіть до меню `Home` → `API Explorer`. У рядку пошуку `Filter by kind` введіть значення `ServiceEntry`, в результатах фільтрування виберіть відповідний сервіс. -+ -image:registry-develop:bp-modeling/bp/rest-connector/rest-connector-1.png[] - -. Виберіть проєкт з випадного списку `Project`, в якому буде використовуватись зовнішній сервіс. Перейдіть до меню `Instances` і натисніть `Create ServiceEntry`. -+ -image:registry-develop:bp-modeling/bp/rest-connector/rest-connector-2.png[] - -. Далі необхідно вказати налаштування для YAML файлу. -+ -image:registry-develop:bp-modeling/bp/rest-connector/rest-connector-3.png[] -+ -* для параметра `name` потрібно вказати назву сервісу, наприклад, `httpbin-org`; -* для параметра `spec` необхідно зазначити наступне: -+ -[source, yaml] ----- -spec: - exportTo: - - . - hosts: - - httpbin.org - location: MESH_EXTERNAL - ports: - - name: https - number: 443 - protocol: HTTPS - - name: http - number: 80 - protocol: HTTP - resolution: DNS ----- -+ -** у параметрі `hosts` зазначається адреса сервісу, що буде використовуватися; -** у параметрі `ports` вказуються налаштування виклику для `https` чи `http`, або для обох варіантів одночасно. - -. Після налаштування натисніть `Create`. -+ -image:registry-develop:bp-modeling/bp/rest-connector/rest-connector-4.png[] - -. У результаті успішного виконання налаштувань буде створено сервіс, через який буде дозволено пропускати трафік із кластера. -+ -image:registry-develop:bp-modeling/bp/rest-connector/rest-connector-5.png[] -//// - [#create-secret] -//== Створення секрету для авторизації сервісу == Creating a secret for service authorization [WARNING] ==== -//Для версій реєстру 1.9.3 і вище не потрібно створювати секрети вручну в Openshift. + For registry versions 1.9.3 or later, there is no need to create secrets manually in Openshift. -//Секрети (токен, пароль тощо) створюються автоматично після застосування налаштувань взаємодії з іншими системами, які необхідно виконати в адмін-панелі Control Plane. The secrets (such as a token or password) are created automatically after the external system interaction settings are applied via the Control Plane admin console. -//В результаті застосування змін до конфігурації реєстру та проходження Jenkins-пайплайну `*MASTER-Build-*`, разом із Service Entry створюється й секрет для авторизації у зовнішньому сервісі. Він додається до *user-management:hashicorp-vault* для тієї системи/сервісу, до якої необхідно виконувати запити. Once the changes are applied to the registry configuration and the *MASTER-Build-``* Jenkins pipeline runs, a secret for external service authorization is created along with the Service Entry. The secret is added to the *user-management:hashicorp-vault* for the system or service to which requests will be made. -//Зверніться до сторінки xref:registry-admin/external-integration/cp-integrate-ext-system.adoc[] для отримання детальної інформації щодо налаштування взаємодії з іншими системами. For details on configuring interactions with external systems, see xref:registry-admin/external-integration/cp-integrate-ext-system.adoc[]. ==== -//Щоб створити секрет вручну, необхідно виконати наступні кроки: To create the secret manually, perform these steps: -//. В OpenShift консолі перейдіть до меню `Workloads` → `Secrets` та оберіть відповідний проєкт з випадного списку `Project`. Натисніть `Create` → `Key/value secret`. . Sign in to the OpenShift web console. . Go to *Workloads* > *Secrets* and select your project from the *Project* dropdown list. . Select *`Create`* > *Key/value secret*. + image:registry-develop:bp-modeling/bp/rest-connector/rest-connector-6.png[] -+ -//. Вкажіть назву секрету у полі `Secret name`, наприклад, `httpbin-basic-authentication`. + . Enter the name of the secret into the *Secret name* field. For example: `httpbin-basic-authentication`. + -//NOTE: Назву секрету необхідно буде використати у параметрі `*secret-name*` при налаштуванні регламенту (_див. детальніше у розділі xref:#regulations-configuration[]_). NOTE: You will need the name of the secret for the `*secret-name*` parameter when configuring the regulations. For details, jump to xref:#regulations-configuration[]. + image:registry-develop:bp-modeling/bp/rest-connector/rest-connector-7.png[] -+ -//. Доступно два типи аутентифікації сервісу: + . Specify the type of service authentication to use: -//* Для типу аутентифікації `BASIC` необхідно додати два параметри `Key`: + * For `BASIC` authentication, add two *Key* parameters: ** `username` ** `password` + image:registry-develop:bp-modeling/bp/rest-connector/rest-connector-8.png[] -+ -//* Для типу аутентифікації `PARTNER_TOKEN` необхідно додати один параметр `Key`: + * For `PARTNER_TOKEN` authentication, add one *Key* parameter: ** `token` + image:registry-develop:bp-modeling/bp/rest-connector/rest-connector-9.png[] -+ -//. У результаті успішного виконання налаштувань буде створено секрет, за допомогою якого можливо авторизуватися в зовнішньому сервісі. + . Once the settings are applied successfully, the secret is created. You can use this secret for authorization in the external service. + image:registry-develop:bp-modeling/bp/rest-connector/rest-connector-10.png[] [#regulations-configuration] -//== Налаштування регламенту == Configuring the regulations [WARNING] ==== -//Для версій реєстру 1.9.3+ та вище основні інтеграційні налаштування виконуються на рівні екземпляра реєстру в адміністративній панелі Control Plane (_див. детальніше -- xref:registry-admin/external-integration/cp-integrate-ext-system.adoc[]_). For registry versions 1.9.3 or later, the main integration settings are performed at the registry instance level in the Control Plane admin console. For details, see xref:registry-admin/external-integration/cp-integrate-ext-system.adoc[]. -//На рівні налаштувань регламенту адміністратор конфігурує лише: :: -At the regulations level, the administrator configures only the following: :: +At the registry regulations level, the administrator configures only the following: :: -//* назву системи; * system name -//* дозволені операції: * allowed operations: -//** ендпоінт/шлях до ресурсу; ** endpoint and resource path -//** метод. ** method -//.Налаштування external-systems у файлі bp-trembita/configuration.yml для версій реєстру 1.9.3+ .external-systems config in the bp-trembita/configuration.yml file for registries version 1.9.3 or later ===== [source, yaml] @@ -213,13 +123,10 @@ external-systems: ===== ==== -//Для версії реєстру 1.9.2 та нижче виконайте попередні конфігурації на рівні регламенту реєстру. For registries version 1.9.2 or earlier, perform the configuration at the registry regulations level. -//Для цього потрібно налаштувати параметри блоку `*external-systems*` у конфігураційному файлі *_bp-trembita/configuration.yml_* відповідного реєстру. To do this, you need to configure the `*external-systems*` block in the *_bp-trembita/configuration.yml_* file of a corresponding registry. -//.Приклад для типу аутентифікації `BASIC` .An example of `BASIC` authentication [example] [source, yaml] @@ -238,14 +145,6 @@ external-systems: [NOTE] ==== -//* після заголовка `external-systems` зазначається назва сервісу, що буде використовуватись, наприклад, `httpbin`; -//* для параметра `url` вказується адреса сервісу, наприклад, `http://httpbin.org/`; -//* в заголовку `methods` вказується назва методу взаємодії з сервісом, наприклад, `get`: -//** `path` шлях до сервісу, наприклад, `/get`; -//** `method` HTTP-метод взаємодії з сервісом, наприклад, `GET`. -//* для заголовка `auth` зазначаються параметри секрету: -//** `type` створений типу аутентифікації `BASIC` або `PARTNER_TOKEN`; -//** `secret-name` назву секрету, наприклад, `httpbin-basic-authentication`. * The `external-systems` header must be followed by the name of the external service, for example, `httpbin`. * The `url` parameter must contain the service address, for example, `http://httpbin.org/` * The `methods` header must contain the name of the method used to interact with the service, for example, `get`. @@ -256,8 +155,6 @@ external-systems: ** The `secret-name` is the name of the secret, for example, `httpbin-basic-authentication`. ==== -//.Приклад для типу аутентифікації `PARTNER_TOKEN` -//TODO: Example contains ua-specific diia mention, but maybe as a url example that's fine? .An example of `PARTNER_TOKEN` authentication [example] [source, yaml] @@ -277,84 +174,67 @@ external-systems: ---- [#bp-modeling] -//== Моделювання бізнес-процесу з використанням делегата Connect to external system == Modeling business processes using the "Connect to external system" delegate -//Для налаштування шаблону делегата в Camunda Modeler, необхідно виконати наступні кроки: To configure the delegate template in Camunda Modeler, perform these steps: -//. Створіть *Service Task*. . Open the business process modeling interface. . Create a *Service Task*. -+ -//. На панелі налаштувань справа натисніть кнопку kbd:[*Open Catalog*], оберіть відповідний шаблон *`Connect to external system v2`* зі списку та натисніть kbd:[*Apply*] для підтвердження. . In the settings panel on the right, click the *`Open Catalog`* button and select the *Connect to external system v2* delegate template from the list. Click *`Apply`* to confirm your action. + image:registry-develop:bp-modeling/bp/rest-connector/rest-connector-11.png[] -+ -//. Сконфігуруйте обраний шаблон: + . Configure the following options: -//* У полі `Name` вкажіть назву задачі, наприклад, `Створити запит (GET)`. * *Name*: Specify the task name. For example, `Create a GET request`. * *Input Parameters*: -//** Розгорніть блок `External system name` та вкажіть назву сервісу, з яким буде відбуватися взаємодія: + ** Expand the *External system name* section and specify the name of the target external system: -//*** Активуйте позначку `Local Variable Assignment` → `ON`. Це дозволить створити локальну змінну для метода. + *** Set the *Local Variable Assignment* toggle to *On*. This will allow creating a local variable for the method. -//*** У полі `Variable Assignment Type` оберіть з випадного списку тип призначення змінної — `String or Expression`. + *** From the *Variable Assignment Type* dropdown list, select *String or Expression*. -//*** У полі `Variable Assignment Value` введіть назву сервісу — `httpbin`. + *** In the *Variable Assignment Value* field, enter the name of the external system. For example, `httpbin`. + image:registry-develop:bp-modeling/bp/rest-connector/rest-connector-12.png[] -+ -//** Розгорніть блок `External system method name` та вкажіть HTTP-метод для взаємодії з сервісом: + ** Expand the *External system method name* section and specify the HTTP method for interacting with the external system: -//*** Активуйте позначку `Local Variable Assignment` → `ON`. Це дозволить створити локальну змінну для метода. + *** Set the *Local Variable Assignment* toggle to *On*. This will allow creating a local variable for the method. -//*** У полі `Variable Assignment Type` оберіть з випадного списку тип призначення змінної — `String or Expression`. + *** From the *Variable Assignment Type* dropdown list, select *String or Expression*. -//*** У полі `Variable Assignment Value` введіть назву методу — `get`. + *** In the *Variable Assignment Value* field, enter the name of the method. For example, `get`. + image:registry-develop:bp-modeling/bp/rest-connector/rest-connector-13.png[] -+ -//TODO: parametErs in ua version -//** Розгорніть блок `Request parametrs` (використовується для методу GET) та вкажіть необхідні параметри запиту: + ** When using the GET method, expand the *Request parameters* section and specify the required request parameters: -//*** Активуйте позначку `Local Variable Assignment` → `ON`. Це дозволить створити локальну змінну для метода. + *** Set the *Local Variable Assignment* toggle to *On*. This will allow creating a local variable for the method. -//*** У полі `Variable Assignment Type` оберіть з випадного списку тип призначення змінної — `Map`. *** From the *Variable Assignment Type* dropdown list, select *Map*. -//**** `Key` вкажіть ключ параметра запита. + **** *Key*: Specify the request parameter key. -//**** `Value` вкажіть значення параметра запита. **** *Value*: Specify the request parameter value. + image:registry-develop:bp-modeling/bp/rest-connector/rest-connector-14.png[] -+ -//** Розгорніть блок `Additional request headers` та вкажіть додаткові заголовки запиту: + ** Expand the *Additional request headers* section and specify additional request headers: -//*** Активуйте позначку `Local Variable Assignment` → `ON`. Це дозволить створити локальну змінну для метода. + *** Set the *Local Variable Assignment* toggle to *On*. This will allow creating a local variable for the method. -//*** У полі `Variable Assignment Type` оберіть з випадного списку тип призначення змінної — `Map`. *** From the *Variable Assignment Type* dropdown list, select *Map*. -//**** `Key` вкажіть ключ заголовка запита. **** *Key*: Specify the request header key. -//**** `Value` вкажіть значення заголовка запита. **** *Value*: Specify the request header value. + image:registry-develop:bp-modeling/bp/rest-connector/rest-connector-15.png[] -+ -//** Блок `Request payload` використовується для POST і PUT методів запиту. + ** The *Request payload* section is used for the POST and PUT request methods. * *Output Parameters*: -//** Розгорніть блок `Result variable` та вкажіть назву змінної процесу, до якої необхідно записати результат (за замовчуванням — `response`): + ** Expand the *Result variable* section and specify the process variable to put response to. The default value is `response`. -//** Активуйте позначку `Process Variable Assignment` → `ON`. + ** Set the *Process Variable Assignment* toggle to *On*. -//** У полі `Assign to Process Variable` введіть назву результівної змінної (за замовчуванням — `response`). + ** In the *Assign to Process Variable* field, enter the name of the result variable or leave the default `response` value. + image:registry-develop:bp-modeling/bp/rest-connector/rest-connector-16.png[] \ No newline at end of file diff --git a/docs/en/modules/registry-develop/pages/bp-modeling/bp/what-is-bp.adoc b/docs/en/modules/registry-develop/pages/bp-modeling/bp/what-is-bp.adoc index 01dde77419..341c3fc405 100644 --- a/docs/en/modules/registry-develop/pages/bp-modeling/bp/what-is-bp.adoc +++ b/docs/en/modules/registry-develop/pages/bp-modeling/bp/what-is-bp.adoc @@ -1,5 +1,4 @@ -//= Що таке бізнес-процеси: аналіз, структура і типи операцій -= What are Business Processes: analysis, structure, operation types += What are business processes: analysis, structure and operation types include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] diff --git a/docs/en/modules/registry-develop/pages/bp-modeling/external-integration/api-call/connectors-external-registry.adoc b/docs/en/modules/registry-develop/pages/bp-modeling/external-integration/api-call/connectors-external-registry.adoc index f8aacb625c..b40f398bf3 100644 --- a/docs/en/modules/registry-develop/pages/bp-modeling/external-integration/api-call/connectors-external-registry.adoc +++ b/docs/en/modules/registry-develop/pages/bp-modeling/external-integration/api-call/connectors-external-registry.adoc @@ -1,523 +1,65 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - -//= Типові інтеграційні SOAP-конектори до інших реєстрів -= SOAP-based integration connectors with other registries -//TODO: This topic omits a lot of ua-specific content and reframes it as more general "SOAP integration" without mentioning Trembita or connectors other than SOAP HTTP. += SOAP integration connectors with other registries +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] + +include::platform:ROOT:partial$admonitions/language-en.adoc[] == Overview -//Взаємодія з реєстрами, що знаходяться поза межами Платформи, можлива завдяки шлюзу безпечного обміну даними (ШБО) "Трембіта". -//TODO: Using the indefinite article here to not imply any specific SEG implementation =) -Integration with registries outside the Platform is possible through a secure exchange gateway (SEG). +SOAP integration with external registries primarily occurs via the "Trembita" Secure Exchange Gateway (SEG) and corresponding SOAP connectors. -//ШБО "Трембіта" є захищеним інтерфейсом для електронної взаємодії між державними системами, який розгортається в межах Платформи реєстрів як сервіс і дозволяє використовувати власні ресурси для отримання інформації із зовнішніх систем. -The goal of using SEG is to provide a secure interface for electronic interactions between various state systems. Once SEG is deployed within the Platform as a service, it enables receiving information from external systems using its own resources. +SOAP connectors :: +These are specialized connectors employed within business processes. They're designed to retrieve data from registries outside the Platform using the SOAP protocol, which uses XML format for data representation. -//Для виклику зовнішніх сервісів через ШБО "Трембіта", на Платформі реєстрів розроблено типові інтеграційні розширення-конектори, що дозволяють комунікувати через інтерфейс ШБО із зовнішніми сервісами за протоколом SOAP. -To call external services, you can use the Platform's standard integration connector that enables communication with external services via the SOAP protocol over the SEG interface. +Purpose of the "Trembita" SEG :: +SEG's primary function is to offer a secure interface for electronic interactions across various state systems. When integrated within the Platform, SEG harnesses its inherent resources to access data from external systems. -//Кожний конектор використовується у бізнес-процесах для отримання даних із реєстрів поза межами Платформи. -The SOAP connector is used in business processes to receive data from registries outside the Platform. +Platform's standard integration :: +For interacting with external services, the Platform boasts standard integration connectors. These are tailored for communication with external entities using the SOAP protocol, all transpiring over the SEG interface. -//WARNING: Наразі функціонування розроблених конекторів можливе лише з використанням серверів-заглушок, що імітують живе з'єднання. -WARNING: The SOAP connector can only be used with mock servers that simulate a live connection. +Region-specific application :: +It's crucial to note that using the "Trembita" SEG is particularly tuned for the Ukrainian setting. Hence, it and _may not apply or function as described in other contexts or regions_. -//// -//TODO: Commenting this CAUTION out because it links to a topic out of translation scope -[CAUTION] -==== -Щоб мати змогу використовувати розроблені на Платформі SOAP-інтеграційні конектори до зовнішніх сервісів та отримувати інформацію від інших реєстрів через ШБО "Трембіта", необхідно попередньо виконати конфігурації на рівні реєстру в адміністративній панелі Control Plane. +Universal SOAP HTTP connector :: +We've implemented a universal SOAP HTTP connector to augment the Platform's SOAP interoperability and amplify its integration potential. -_Детальніше про налаштування інтеграцій через ШБО "Трембіта" ви можете переглянути у статті xref:registry-develop:registry-admin/external-integration/cp-integrate-trembita.adoc[]_. -==== -//// +WARNING: Always use SOAP connectors in conjunction with mock servers that replicate the behavior of live connections for development purposes. -//== Встановлення типових розширень-конекторів == Installing standard integration connectors -//Налаштування розширень-конекторів відбувається у застосунку **Camunda Modeler**. Перед початком роботи переконайтеся, що виконано всі передумови, описані у розділі xref:bp-modeling/bp/element-templates/bp-element-templates-installation-configuration.adoc#business-process-modeler-extensions-installation[Встановлення каталогу типових розширень до бізнес-процесів]. -Connectors are configured in the *Camunda Modeler* application. Before you start, ensure all prerequisites described in the xref:bp-modeling/bp/element-templates/bp-element-templates-installation-configuration.adoc#business-process-modeler-extensions-installation[Installing a catalog of standard extensions to business processes] section are fulfilled. - -//// -[#edr] -== Розширення-конектори для отримання даних з ЄДР - -Для спрощення моделювання бізнес-процесів розроблені типові інтеграційні конектори для отримання інформації з ЄДРfootnote:[**ЄДР** -- Єдиний державний реєстр юридичних осіб, фізичних осіб-підприємців та громадських формувань.], налаштування яких відбувається на схемах бізнес-процесів у додатку **Camunda Modeler**. - -Наразі імплементовано 2 типи конекторів для отримання даних із ЄДР: :: - -. Інтеграційний конектор `searchSubject` -- призначений для отримання інформації про суб'єкт за кодом ЄДРПОУ або РНОКПП (раніше -- ІПН). -. Інтеграційний конектор `subjectDetails` -- призначений для отримання деталізованої інформації про суб'єкт за ID. - -=== Отримання інформації за суб'єктом в ЄДР - -Розширення *Search Subjects Edr Registry* -- делегат для виклику зовнішнього SOAP-сервісу, призначений для отримання інформації про суб'єкт за кодом ЄДРПОУ або РНОКПП (раніше -- ІПН), який налаштовується за допомогою шаблону *Search Subjects Edr Registry* (_searchSubjectsEdrRegistryConnectorDelegate.json_). - -[WARNING] -==== -Передумови :: - -За умови налаштування шаблону у *Camunda Modeler* переконайтеся, що папка із застосунком *_resources/element-templates_* містить файл _searchSubjectsEdrRegistryConnectorDelegate.json_. -==== - -. Відкрийте **Service Task**. -. На панелі налаштувань справа натисніть `Open Catalog` та оберіть шаблон *Search Subjects Edr Registry* зі списку. -+ -image:registry-develop:bp-modeling/ext-integration/connectors/edr/element-template-settings-01.png[] -. Налаштуйте обраний шаблон: - -* У полі `Name` вкажіть назву задачі. Наприклад, `Пошук інформації за суб'єктом в ЄДР` -* У полі `Authorization token` зазначте токен для доступу до СЕВ ДЕІР "Трембіта". Наприклад, `{token}`. -+ -NOTE: `Authorization token` надається постачальником сервісу (в нашому випадку -- ЄДР), який є іншим учасником СЕВ ДЕІР "Трембіта". - -* У полі `Code` введіть код (ЄДРПОУ або РНОКПП) для пошуку в ЄДР. Наприклад, `88888888`. -* У полі `Result variable` зазначте назву вихідного параметру, до якого буде записано відповідь від сервісу. Наприклад, `response`. - -+ -image:registry-develop:bp-modeling/ext-integration/connectors/edr/element-template-settings-1.png[] - -=== Отримання деталізованої інформації за суб'єктом в ЄДР - -Розширення *Get Subject Detail Edr Registry* -- делегат для виклику зовнішнього SOAP-сервісу, призначений для отримання деталізованої інформації про суб'єкт за ID, який налаштовується за допомогою шаблону *Get Subject Detail Edr Registry* (_subjectDetailEdrRegistryConnectorDelegate.json_). - -[WARNING] -==== -Передумови :: -За умови налаштування шаблону у *Camunda Modeler* переконайтеся, що папка із застосунком *_resources/element-templates_* містить файл _subjectDetailEdrRegistryConnectorDelegate.json_. -==== - -. Відкрийте **Service Task**. -. На панелі налаштувань справа натисніть `Open Catalog` та оберіть шаблон *Get Subject Detail Edr Registry* зі списку. -+ -image:registry-develop:bp-modeling/ext-integration/connectors/edr/element-template-settings-02.png[] - -. Налаштуйте обраний шаблон: - -* У полі `Name` вкажіть назву задачі. Наприклад, `Пошук деталізованої інформації за суб'єктом в ЄДР`. -* У полі `Authorization token` зазначте токен для доступу до СЕВ ДЕІР "Трембіта". Наприклад, `{token}`. -+ -NOTE: `Authorization token` надається постачальником сервісу (в нашому випадку -- ЄДР), який є іншим учасником СЕВ ДЕІР "Трембіта". - -* У полі `Id` зазначте унікальний ідентифікатор суб'єкта для пошуку в ЄДР. Наприклад, `{subject_id}`. -* У полі `Result variable` зазначте назву вихідного параметру, до якого буде записано відповідь від сервісу. Наприклад, `response`. - -+ -image:registry-develop:bp-modeling/ext-integration/connectors/edr/element-template-settings-2.png[] - -=== Приклади використання у бізнес-процесі - -Розглянемо ситуацію, коли у бізнес-процесі необхідно перевірити статус суб'єкта в ЄДР. - -Для цього у процесі необхідно налаштувати інтеграційний конектор для пошуку суб'єкта з ЄДР (в нашому випадку відповідь буде записано до змінної `responseEDR`). - -image:registry-develop:bp-modeling/ext-integration/connectors/edr/element-template-settings-3.png[] - -.Приклад відповіді від сервісу -==== -[source,json] ----- - { - "name": "active user", - "code": "77777777", - "id": 213123, - "state": "ACTIVE" - } ----- - -Відповідь містить параметр `state`, що має значення `"ACTIVE"`. -Далі на шлюзі відбувається перевірка: - -NOTE: Якщо `state` має значення `SUSPENDED` або `CANCELLED`, то бізнес-процес видає валідаційну помилку. -==== - -.Приклад налаштування гілки -==== ----- -${responseEdr.value.responseBody.elements().get(0).prop('state').value().equals('SUSPENDED') || responseEdr.responseBody.elements().get(0).prop('state').value().equals('CANCELED')} ----- - -image:registry-develop:bp-modeling/ext-integration/connectors/edr/element-template-settings-4.png[] - -NOTE: Якщо `state` не дорівнює `SUSPENDED` або `CANCELLED`, то відбудеться подальше виконання процесу. -==== - -.Приклад налаштування гілки -==== ----- -${!responseEdr.value.responseBody.elements().get(0).prop('state').value().equals('SUSPENDED') && !responseEdr.value.responseBody.elements().get(0).prop('state').value().equals('CANCELED')} ----- - -image:registry-develop:bp-modeling/ext-integration/connectors/edr/element-template-settings-5.png[] -==== - -[#extension-conectory_for_retrieving_data_from_DRACS] -== Розширення-конектори для отримання даних із ДРАЦС - -Для спрощення моделювання бізнес-процесів розроблено типові інтеграційні конектори для отримання інформації із ДРАЦСfootnote:[*ДРАЦС* -- Державна реєстрація актів цивільного стану.], налаштування яких відбувається на схемах бізнес-процесів у додатку **Camunda Modeler**. - -Наразі імплементовано 2 типи конекторів для отримання даних із ДРАЦС: :: - -. Типове інтеграційне розширення-конектор до SOAP-сервісу ДРАЦС для отримання даних Свідоцтва про народження за вказаними серією і номером Свідоцтва, та датою народження -- `GetCertByNumRoleBirthDate`. - -. Типове інтеграційне розширення-конектор до SOAP-сервісу ДРАЦС для отримання даних Свідоцтва про народження за вказаними серією і номером Свідоцтва, та ПІБ -- `GetCertByNumRoleNames`. - -=== Отримання даних Свідоцтва про народження за вказаними серією і номером Свідоцтва, та датою народження - -Розширення *Get Certificate By Birthdate* -- делегат для виклику зовнішнього SOAP-сервісу для отримання даних Свідоцтва про народження за вказаними серією і номером Свідоцтва, та датою народження, який налаштовується за допомогою шаблону *Get Certificate By Birthdate* (_getCertificateByBirthdateDracsRegistryDelegate.json_). - -[WARNING] -==== -Передумови :: - -За умови налаштування шаблону у *Camunda Modeler* переконайтеся, що папка із застосунком *_resources/element-templates_* містить файл _getCertificateByBirthdateDracsRegistryDelegate.json_. -==== - -. Відкрийте **Service Task**. -. На панелі налаштувань справа натисніть `Open Catalog` та оберіть шаблон *Get Certificate By Birthdate* зі списку. -+ -image:bp-modeling/ext-integration/connectors/dracs/get-certificate-dracs-1.png[] -. Налаштуйте обраний шаблон: -* У полі `Name` вкажіть назву задачі. Це може бути призначення сервісної задачі. Наприклад, `Отримати дані зі Свідоцтва про народження`. -* У полі `Certificate Number` вкажіть номер сертифіката. Наприклад, `218727`. -* У полі `Certificate Serial` вкажіть серію сертифіката. Наприклад, `IV-AM`. -+ -TIP: Актуальний формат номера свідоцтва та серію можна перевірити за https://minjust.gov.ua/dep/ddr/svidotstva-pro-narodjennya[посиланням]. -* У полі `Role` вкажіть роль `CHILD`. -+ -NOTE: Наразі Платформа реєстрів підтримує отримання даних виключно для ролі `CHILD`. Тобто із сервісу ДРАЦС можна отримати виключно дані дитини із сертифіката Свідоцтва про народження. Всі інші передбачені ДРАЦС ролі не підтримуються. -* У полі `Birth Year` введіть рік народження дитини. Наприклад, `2021`. -* У полі `Birth Month` вкажіть місяць народження дитини. Наприклад, `10`. -* У полі `Birth Day` вкажіть день народження дитини. Наприклад, `21`. -* У полі `Result variable` вкажіть результівну змінну, до якої необхідно записати відповідь від сервісу -- `response`. -+ -TIP: Приклад відповіді можна подивитися у розділі xref:#dracs-api-implementation[] -+ - -image:bp-modeling/ext-integration/connectors/dracs/get-certificate-dracs-3.png[] - -=== Отримання даних Свідоцтва про народження за вказаними серією і номером Свідоцтва, та ПІБ - -Розширення *Get Certificate By Name* -- делегат для виклику зовнішнього SOAP-сервісу для отримання даних за вказаними серією і номером Свідоцтва, та ПІБ, який налаштовується за допомогою шаблону *Get Certificate By Name* (_getCertificateByNameDracsRegistryDelegate.json_). - -[WARNING] -==== -Передумови :: - -За умови налаштування шаблону у *Camunda Modeler* переконайтеся, що папка із застосунком *_resources/element-templates_* містить файл _getCertificateByNameDracsRegistryDelegate.json_. -==== - -. Відкрийте **Service Task**. -. На панелі налаштувань справа натисніть `Open Catalog` та оберіть шаблон *Get Certificate By Name* зі списку. -+ -image:bp-modeling/ext-integration/connectors/dracs/get-certificate-dracs-2.png[] -. Налаштуйте обраний шаблон: -* У полі `Name` вкажіть назву задачі. Це може бути призначення сервісної задачі. Наприклад, `Отримати дані зі Свідоцтва про народження`. -* У полі `Certificate Number` вкажіть номер сертифіката. Наприклад, `218727`. -* У полі `Certificate Serial` вкажіть серію сертифіката. Наприклад, `IV-AM`. -+ -TIP: Актуальний формат номера свідоцтва та серію можна перевірити за https://minjust.gov.ua/dep/ddr/svidotstva-pro-narodjennya[посиланням]. -* У полі `Role` вкажіть роль `CHILD`. -+ -NOTE: Наразі Платформа реєстрів підтримує отримання даних виключно для ролі `CHILD`. Тобто із сервісу ДРАЦС можна отримати виключно дані дитини із сертифіката Свідоцтва про народження. Всі інші передбачені ДРАЦС ролі не підтримуються. -* У полі `Name` введіть ім'я дитини. Наприклад, `Павло`. -* У полі `Surname` прізвище дитини. Наприклад, `Сидоренко`. -* У полі `Patronymic` по батькові дитини. Наприклад, `Іванович`. -* У полі `Result variable` вкажіть результівну змінну, до якої необхідно записати відповідь від сервісу -- `response`. -+ -TIP: Приклад відповіді можна подивитися у розділі xref:#dracs-api-implementation[] -+ -image:bp-modeling/ext-integration/connectors/dracs/get-certificate-dracs-4.png[] - -[#dracs-api-implementation] -=== Імплементація на рівні API - -При налаштуванні шаблонів делегата у бізнес-процесі, делегати формують запити у форматі XML і за протоколом SOAP надсилають їх відповідним сервісам ДРАЦС. - -.Приклад SOAP-запита до API-сервісу GetCertByNumRoleBirthDate згідно з контрактом -[%collapsible] -==== -[source,xml] ----- - - - ... - - - - 3 - 218727 - IV-AM - 2021-21-10T00:00:00 - - - 1 - - - - - ----- -==== - -.Приклад SOAP-запита до API-сервісу GetCertByNumRoleNames згідно з контрактом -[%collapsible] -==== -[source,xml] ----- - - - ... - - - - 4 - 218727 - IV-AM - - Павло - Іванович - 1 - Сидоренко - - - - ----- -==== - -.Приклад відповіді від API згідно з контрактом для обох сервісів ДРАЦС -[%collapsible] -==== -[source,json] ----- -{ - "certificate":[ - { - "certStatus":1, - "certRepeat":0, - "certSerial":"IV-AM", - "certNumber":"218727", - "certSerialNumber":null, - "certOrg":null, - "certDate":null, - "arOrg":null, - "arNumb":null, - "arComposeDate":null, - "childSurname":"Сидоренко", - "childName":"Павло", - "childPatronymic":"Іванович", - "childBirthdate":null, - "fatherSurname":null, - "fatherName":null, - "fatherPatronymic":null, - "fatherCitizenship":null, - "fatherCitizenshipAnother":null, - "motherSurname":null, - "motherName":null, - "motherPatronymic":null, - "motherCitizenship":null, - "motherCitizenshipAnother":null, - "oldSurname":null, - "oldName":null, - "oldPatronymic":null, - "newSurname":null, - "newName":null, - "newPatronymic":null, - "dateOfBirth":null, - "placeofBirth":null, - "husbandOldSurname":null, - "husbandSurname":null, - "husbandName":null, - "husbandPatronymic":null, - "husbandCitizenship":null, - "husbandBirthdate":null, - "husbandPlaceofBirth":null, - "wifeOldSurname":null, - "wifeSurname":null, - "wifeName":null, - "wifePatronymic":null, - "wifeCitizenship":null, - "wifeBirthdate":null, - "wifePlaceOfBirth":null - } - ] -} ----- -NOTE: Параметри зі значенням `null` не використовуються. -==== - -[#eibdvpo] -== Розширення-конектор для отримання даних з ЄІБДВПО - -Для спрощення моделювання бізнес-процесів розроблено типовий інтеграційний конектор для обміну інформацією з ЄІБДВПОfootnote:[**ЄІБДВПО** -- Єдина інформаційна база даних внутрішньо переміщених осіб.], налаштування якого відбувається на схемах бізнес-процесів у додатку *Camunda Modeler*. - -_Наразі імплементовано 1 тип конектора для обміну даними з ЄІБДВПО:_ - -* Типове інтеграційне розширення-конектор до SOAP-сервісу ЄІБДВПО для отримання інформації за довідкою внутрішньо переміщеної особи -- `idpExchangeServiceRegistryConnector`. - -=== Отримання інформації за довідкою внутрішньо переміщеної особи (ВПО) - -Розширення *Idp Exchange Service Registry Connector* -- інтеграційний конектор для виклику зовнішнього SOAP-сервісу для отримання даних за довідкою внутрішньо переміщеної особи (ВПО), який налаштовується за допомогою шаблону *Idp Exchange Service Registry Connector* (_idpExchangeServiceRegistryConnector.json_). - -[WARNING] -==== -Передумови :: - -За умови налаштування шаблону у *Camunda Modeler* переконайтеся, що папка із застосунком *_resources/element-templates_* містить файл _idpExchangeServiceRegistryConnector.json_. -==== - -. Відкрийте Service Task. - -. На панелі налаштувань справа натисніть Open Catalog та оберіть шаблон *Idp Exchange Service Registry Connector* зі списку. - -+ -image:registry-develop:bp-modeling/ext-integration/connectors/eibdvpo/get-vpo-eibdvpo-01.png[] - -. Налаштуйте обраний шаблон: - -* У полі `Name` вкажіть назву задачі. Це може бути призначення сервісної задачі. Наприклад, `Idp Exchange Service Registry`. -* У полі `Url` вкажіть шлях до сервісу. Наприклад, `/idp/getCertificateByGUID/${submission('FORM_IDP_INPUT').formData.prop('uid').value()}`. -* У полі `Metgod` вкажіть HTTP-спосіб взаємодії з сервісом `GET` або `POST`. -* У полі `Body`, у разі використання методу `POST`, вкажіть тіло запиту. Наприклад, `${submission('FORM_IDP_INPUT').formData}`. -* У полі `Result variable` вкажіть результівну змінну, до якої необхідно записати відповідь від сервісу -- `response`. - -+ -image:registry-develop:bp-modeling/ext-integration/connectors/eibdvpo/get-vpo-eibdvpo-02.png[] - -=== Імплементація на рівні API - -При налаштуванні шаблонів делегата у бізнес-процесі, делегати формують запити у форматі XML і за протоколом SOAP надсилають їх відповідним сервісам ЄІБДВПО. - -.Приклад SOAP-запита до API-сервісу IDPexchangeService згідно з контрактом: -[%collapsible] -==== -* запит за РНОКПП: -+ -[source, json] ----- -{ -"method": "GET", -"url": "/idp/getCertificateByRNOKPP/3333333333", -"body": null -} ----- -* запит за UID (унікальний ідентифікатор довідки в реєстрі ВПО): -+ -[source, json] ----- -{ -"method": "GET", -"url": "/idp/getCertificateByGUID/79cefcce20028d82fc1d6dda6a498da2", -"body": null -} ----- -==== +Connectors are configured in the *Camunda Modeler* application. Before you start, ensure all prerequisites described in the xref:bp-modeling/bp/element-templates/element-templates-install.adoc[] section are fulfilled. -.Приклад відповіді від API-сервісу IDPexchangeService згідно з контрактом: -[%collapsible] -==== -[source, json] ----- -{ - "person": { - "idpSurname": "ІВАНОВ", - "idpName": "ІВАН", - "idpPatronymic": "ІВАНОВИЧ", - "birthDate": "01.01.1979 00.00.00.000", - "birthPlace": "хутір Ізбушенка, Луганської області", - "RNOKPP": "3333333333", - "gender": "Жінка", - "documentType": "1", - "documentSerie": "ЕК", - "documentNumber": "633666", - "documentDate": "13.11.1997 00.00.00.000", - "documentIssuer": "Артемівським РВЛМУУМВС укр. в Луг. обл.", - "regAddress": "ЛУГАНСЬКА ОБЛАСТЬ/М.ЛУГАНСЬК ЛУГАНСЬК ВУЛ.ПОГРАНИЧНА буд.0", - "factAddress": "М.БАХМУТ ДОНЕЦЬКА ОБЛ. ВУЛ. МИРУ буд. 00 кв. 00", - "certificateNumber": "1419-69164", - "certificateDate": "02.09.2015 00.00.00.000", - "certificateIssuer": "М.БАХМУТ ДОНЕЦЬКА ОБЛ.", - "certificateState": "знята з обліку", - "UID": "f895ad5fbbe66605979afb7e18847c1b" - }, - "accompanied": [] -} ----- -==== - -[TIP] -==== -У разі необхідності використання окремого параметру(наприклад, `idpSurname`) при моделюванні бізнес-процесу, можливе використання наступного скрипту: - -[source, groovy] ----- -def serviceResponse = response.responseBody.elements().get(0) -serviceResponse.prop('person').prop('idpSurname') - - -accompanied.each{ - it ... -} ----- -==== -//// - -//== Загальний SOAP http-конектор == General integration SOAP HTTP connector -//CAUTION: Конектор можна використати для інтеграції з будь-яким SOAP-сервісом. - -//Розширення *SOAP http connector* -- інтеграційний конектор для виклику зовнішнього SOAP-сервісу, який налаштовується за допомогою шаблону *SOAP http connector* (_soapHttpConnector.json_). You can use the *SOAP http connector* extension to call any external SOAP service. This connector is configured using the *SOAP http connector* template (_soapHttpConnector.json_). [WARNING] ==== Prerequisites :: - -//За умови налаштування шаблону у *Camunda Modeler* переконайтеся, що папка із застосунком *_resources/element-templates_* містить файл _soapHttpConnector.json_. When configuring the template in Camunda Modeler, ensure the _resources/element-templates_ folder of the application contains the _soapHttpConnector.json_ file. ==== [#configure-soap-http-delegate] -//=== Налаштування конектора === Configuring the connector -//Конектор конфігурується за допомогою спеціального шаблону-розширення для сервісної (системної) задачі бізнес-процесу. The connector is configured via an extension template for the service task of the business process. -//. Створіть *Service Task* (Сервісну задачу). . Open the business process modeling interface. . Create a *Service Task*. -//. На панелі справа натисніть `*Select*`, оберіть та налаштуйте шаблон *SOAP http connector* зі списку: . In the panel on the right, click *`Select`*, then select the *SOAP http connector* from the list. Configure the template: -+ -//* У полі `*Name*` вкажіть назву задачі. `Наприклад, Пошук інформації за суб'єктом в ЄДР`. + * *Name*: Specify the task name -- for example, `Search by registry subject`. -+ -//* У полі `*Url*` вкажіть адресу ресурсу (повний шлях до ендпоінту). Наприклад, `https://trembita-edr-registry-mock.apps.envone.dev.registry.eua.gov.ua/mockEDRService`. + * *Url*: Specify the resource address -- for example, `https://trembita-edr-registry-mock.apps.envone.dev.registry.eua.gov.ua/mockEDRService`. -+ -//* У полі `*Headers*` вкажіть заголовки запита. Наприклад, *${requestHeaders}*. + * *Headers*: Specify the request headers -- for example, `${requestHeaders}`. -+ -//* У полі `*Payload*` вкажіть тіло запита. Наприклад, *`${requestPayload}`*. + + * `*Payload*: Provide the request body -- for example, `${requestPayload}`. + -//* У полі `*Result variable*` вкажіть змінну, до якої необхідно записати відповідь від сервісу. Наприклад, `*edrResponseBody*`. * *Result variable*: Specify the variable to store the service response -- for example, `edrResponseBody`. + image:registry-develop:bp-modeling/ext-integration/connectors/soap-http/soap-http-1.png[] -//.Відповідь від API згідно з контрактом для сервісу ЄДР .API response from EDR service ==== [source,xml] @@ -545,23 +87,20 @@ image:registry-develop:bp-modeling/ext-integration/connectors/soap-http/soap-htt ---- [NOTE] -//Сервіс повертає відповідь у вигляді рядка, тобто об'єкта типу `*String*` у форматі XML. The response from a service returns in the form of a string -- that is, a *String* type object in XML format. -//Надалі ви можете використати цю відповідь у xref:#soap-http-script-form-output[скрипті для виводу даних на UI-форму]. You can further use the response in the xref:#soap-http-script-form-output[script for outputting data to the UI form]. ==== -//=== Використання у бізнес-процесі на прикладі надсилання запита до сервісу ЄДР -=== An example of querying the EDR service as part of the business process +=== An example of querying the SOAP service as part of the business process + +[NOTE,caption=UA-specific] +This example presents the universal SOAP connector with the Ukrainian-specific system -- Unified State Register or EDR (as it sounds in Ukraine). -//Розглянемо приклад використання розробленого інтеграційного конектора у бізнес-процесі, який має взаємодію із SOAP-сервісом ЄДР (_тут -- виконує пошук інформації про посадову особу за кодом ЄДРПОУ (атрибутом `edrpou`)_). -//TODO: ua-specific example Let's consider an example of using the integration connector in a business process that interacts with the EDR SOAP service. In our case, it searches for information about officers by their EDRPOU code (the `edrpou` attribute). [TIP] ==== -//Скористайтеся референтними прикладами бізнес-процесу та UI-форм для кращого розуміння деталей моделювання: Download the following business process and UI form examples for reference: * [*] Business process: _link:{attachmentsdir}/bp-modeling/soap-connectors/soap-http-connector-edr.bpmn[soap-http-connector-edr.bpmn]_ @@ -569,75 +108,57 @@ Download the following business process and UI form examples for reference: * [*] Result view form: _link:{attachmentsdir}/bp-modeling/soap-connectors/soap-http-connector-edrpou-edr-result-view.json[soap-http-connector-edrpou-edr-result-view.json]_ ==== -//. Створіть бізнес-процес і додайте пул до панелі моделювання. . Create a business process and add a pool to the modeling canvas. + image:registry-develop:bp-modeling/ext-integration/connectors/soap-http/soap-http-2.png[] -+ -//. Створіть стартову задачу для ініціювання процесу. + . Create a start task to initiate the process. + [WARNING] ==== -//Для того, щоб використовувати змінну `*initiator*` у бізнес-процесі, необхідно визначити її на стартовій події як `*initiator*` у полі `*Start initiator*`. To use the `*initiator*` variable in the business process, you need to define it in the *Start initiator* field of the start event. image:registry-develop:bp-modeling/ext-integration/connectors/soap-http/soap-http-2-1.png[] ==== -//==== Користувацька задача введення даних для пошуку в іншому реєстрі ==== A user task for entering data to search another registry -//Далі змоделюйте користувацьку задачу (*User Task*), оберіть шаблон *User Form* (користувацька UI-форма) та виконайте налаштування. Next, model the *User Task*, select the *User Form* template, and configure it. -//. Введіть назву задачі. Наприклад, `Ввести ЄДРПОУ для пошуку`. . Specify the task name -- for example, `Enter EDRPOU to search by`. -//. У полі `*ID*` введіть ідентифікатор задачі (`activity_id`). Його ви можете використовувати надалі у бізнес-процесі відповідно до вашої логіки. Наприклад, `*searchEdrpouCodeOfficer*`. . In the *ID* field, enter the task ID (`activity_id`). You can use it in the business process according to your business logic -- for example, `*searchEdrpouCodeOfficer*`. -//. У полі `*Form key*` введіть службову назву UI-форми вводу даних. Наприклад, `*soap-http-connector-edrpou-search-in-edr*`. . In the *Form key* field, enter the service name of the data entry UI form -- for example, `*soap-http-connector-edrpou-search-in-edr*`. -//. У полі `Assignee` введіть токен ініціатора процесу -- `${initiator}`. . In the *Assignee* field, specify the process initiator token -- for example, `${initiator}`. image:registry-develop:bp-modeling/ext-integration/connectors/soap-http/soap-http-3.png[] -//Приклад UI-форми на інтерфейсі користувача може виглядати так: :: Here is an example of a UI form as it appears to the users: :: + image:registry-develop:bp-modeling/ext-integration/connectors/soap-http/soap-http-5.png[] [#request-soap-http-connector] -//==== Скрипт для виконання запита через SOAP-конектор ==== A script for making requests through the SOAP connector -//Далі сформуйте Groovy-скрипт, в якому необхідно визначити параметри, а саме _заголовки_ та _тіло_ запита, які будуть використані SOAP-конектором для отримання даних в іншому реєстрі. Next, create a Groovy script defining the parameters to be used by the SOAP connector to get data from another registry -- namely, the request _headers_ and _body_. -//. Створіть скрипт-задачу (*Script Task*). . Create a *Script Task*. -//. Введіть назву. Наприклад, `Підготувати дані для запита`. . Specify the task name -- for example, `Preparing request data`. -//. Відкрийте візуальний редактор скриптів та напишіть необхідний скрипт. . Open the script visual editor and create your script. + image:registry-develop:bp-modeling/ext-integration/connectors/soap-http/soap-http-4.png[] -//Загалом скрипт може виглядати так: :: Here is an example of a script: :: + image:registry-develop:bp-modeling/ext-integration/connectors/soap-http/soap-http-4-1.png[] -+ -//* 3.1. Отримуємо код ЄДРПОУ, який ввели на першій формі: -* 3.1. Get the EDRPOU code from the first form: + +.. Get the EDRPOU code from the first form: + [source,groovy] ---- def edrpou = submission('searchEdrpouCodeOfficer').formData.prop('edrpou').value() ---- -+ -//* 3.2. Готуємо заголовки запита: -* 3.2. Prepare the request headers: + +.. Prepare the request headers: + [source,groovy] ---- @@ -646,22 +167,18 @@ requestHeaders['SOAPAction'] = 'SearchSubjects' requestHeaders['Content-Type'] = 'text/xml;charset=UTF-8;' ---- + -//NOTE: Підставте відповідне значення для свого запита замість `'SearchSubjects'`. NOTE: Replace `'SearchSubjects'` with your own request. -+ -//* 3.3. Зберігаємо заголовки до транзитної змінної процесу `*requestHeaders*`. Значення цієї змінної ми використаємо як вхідний параметр запита у налаштуваннях SOAP-конектора. -* 3.3. Save headers to the `*requestHeaders*` transient variable. We will use the value of this variable as an input parameter of the request in the SOAP connector settings. + +.. Save headers to the `*requestHeaders*` transient variable. We will use the value of this variable as an input parameter of the request in the SOAP connector settings. + [source,groovy] ---- set_transient_variable('requestHeaders', requestHeaders) ---- + +.. Form the body of the SOAP request to the EDR API according to the API contract: + -//* 3.4. Формуємо тіло SOAP-запита до API-сервісу ЄДР згідно з контрактом: -//TODO: What is the contract in this context? -* 3.4. Form the body of the SOAP request to the EDR API according to the contract: -+ -.SOAP request body +._SOAP request body_ [%collapsible] ==== [source,groovy] @@ -715,7 +232,6 @@ def requestPayload = """ + [TIP] ==== -//Підставляємо змінну *`${edrpou}`* у тіло запита: Put the *`${edrpou}`* variable into the request body: [source,xml] @@ -729,40 +245,31 @@ Put the *`${edrpou}`* variable into the request body: ---- ==== -//* 3.5. Зберігаємо тіло запита до транзитної змінної процесу `*requestPayload*`. Значення цієї змінної ми використаємо як вхідний параметр запита у налаштуваннях SOAP-конектора. -* 3.5. Save the request body to the `*requestPayload*` transient variable. We will use the value of this variable as an input parameter of the request in the SOAP connector settings. + +.. Save the request body to the `*requestPayload*` transient variable. We will use the value of this variable as an input parameter of the request in the SOAP connector settings. + [source,groovy] ---- set_transient_variable('requestPayload', requestPayload as String) ---- + -//NOTE: `*requestPayload*` необхідно передати як рядок (*`as String`*). NOTE: The `*requestPayload*` variable must be passed as a string. -//Використовуйте параметри, збережені до змінних у скрипті, в рамках сервісної задачі та налаштуванні SOAP-конектора. Use the parameters from the script's variables for the service task and to configure the SOAP connector. -//==== Сервісна задача для відправлення пошукового запита до іншого реєстру ==== A service task for sending a search query to another registry -//Далі необхідно створити сервісну задачу, застосувати та налаштувати шаблон для *SOAP-http-конектора*. Next, you need to create a service task and apply and configure the *SOAP-http-connector* template. TIP: For details, jump to xref:#configure-soap-http-delegate[]. [#soap-http-script-form-output] -//==== Скрипт для виводу даних на UI-форму користувача ==== A script for outputting data to the user's UI form -//Далі необхідно передати дані на UI-форму, отримані в іншому реєстрі за допомогою SOAP-http-конектора. Для цього спочатку сформуйте відповідний скрипт, який зможе це зробити. Next, you need to pass the data obtained from another registry using the SOAP HTTP connector to the UI form. For this, you need to create a corresponding script. -//. Створіть скрипт-задачу (*Script Task*). . Create a *Script Task*. -//. Введіть назву. Наприклад, `Підготовка отриманих даних для виведення на форму`. -. Specify the task name -- for example, `Preparing the obtained data for the form`. -//. Відкрийте візуальний редактор скриптів та напишіть необхідний скрипт. +. Specify the task name—for example, `Preparing the obtained data for the form`. . Open the script visual editor and create your script. + image:registry-develop:bp-modeling/ext-integration/connectors/soap-http/soap-http-6.png[] @@ -770,13 +277,10 @@ image:registry-develop:bp-modeling/ext-integration/connectors/soap-http/soap-htt Here is an example of a script: :: + image:registry-develop:bp-modeling/ext-integration/connectors/soap-http/soap-http-6-1.png[] -+ -//* 3.1. Формуємо JSON-об'єкт з параметрами *`state`*, `*name*`, `*code*`, `*id*`, щоб передати їх на форму. -* 3.1. Form a JSON object with the *`state`*, `*name*`, `*code*`, and `*id*` parameters to pass to the form. -+ -//* 3.2. Зберігаємо об'єкт до змінної *`payload`*, яку ми й використаємо як вхідний параметр для передачі даних на форму. -* 3.2. Save the object to the *`payload`* variable, which we will use as an input parameter for passing data to the form. -//._Скрипт для виводу даних на UI-форму користувача_ + +.. Form a JSON object with the *`state`*, `*name*`, `*code*`, and `*id*` parameters to pass to the form. + +.. Save the object to the *`payload`* variable, which we will use as an input parameter for passing data to the form. + ._A script for outputting data to the user's UI form_ [%collapsible] @@ -801,386 +305,26 @@ def getValueByPropertyName(String propName) { ---- ==== + -//NOTE: Функція *`S(edrResponseBody, 'application/xml')`* повертає об'єкт відповідно до специфікації https://javadoc.io/static/org.camunda.spin/camunda-spin-core/1.6.3/org/camunda/spin/xml/SpinXmlElement.html[SpinXmlElement]. NOTE: The *`S(edrResponseBody, 'application/xml')`* function returns the object using the https://javadoc.io/static/org.camunda.spin/camunda-spin-core/1.6.3/org/camunda/spin/xml/SpinXmlElement.html[SpinXmlElement] specification. -//==== Користувацька задача передачі даних на UI-форму ==== A user task for passing data to the UI form -//Насамкінець необхідно вивести отримані в іншому реєстрі та опрацьовані скриптом дані на UI-форму користувача. Finally, you need to output the data obtained from another registry and processed by the script to the user's UI form. -//Змоделюйте користувацьку задачу (*User Task*), оберіть шаблон *User Form* (користувацька UI-форма) та виконайте налаштування. Model the *User Task*, select the *User Form* template, and configure it. -//. Введіть назву задачі. Наприклад, `Переглянути дані з ЄДР`. . Specify the task name -- for example, `View EDR data`. -//. У полі `*ID*` введіть ідентифікатор задачі (`activity_id`). Наприклад, `*writeResultForm*`. . In the *ID* field, enter the task ID (`activity_id`) -- for example, `*writeResultForm*`. -. У полі `*Form key*` введіть службову назву UI-форми вводу даних. Наприклад, `*soap-http-connector-edrpou-edr-result-view*`. -//TODO: Скоріш за все, тут має бути "UI-форми перегляду результату" . In the *Form key* field, enter the service name of the result view UI form -- for example, `*soap-http-connector-edrpou-edr-result-view*`. -//. У полі `Assignee` введіть токен ініціатора процесу -- `${initiator}`. . In the *Assignee* field, specify the process initiator token -- for example, `${initiator}`. -//. У полі `*Form data pre-population*` вкажіть як змінну об'єкт із параметрами, які необхідно передати на форму, -- `*${payload}*`. . In the *Form data pre-population* field, specify the variable for the object with parameters to pass to the form: `*${payload}*`. + -//TIP: Змінна формується у задачі xref:#soap-http-script-form-output[]. TIP: The variable is formed in the following task: xref:#soap-http-script-form-output[]. image:registry-develop:bp-modeling/ext-integration/connectors/soap-http/soap-http-7.png[] -//Приклад UI-форми на інтерфейсі користувача може виглядати так: :: Here is an example of a UI form as it appears to the users: :: + image:registry-develop:bp-modeling/ext-integration/connectors/soap-http/soap-http-8.png[] -//Змоделюйте задачу завершення процесу та збережіть зміни. -Model the process end task and save your changes. - -//// -[#trembita-connector] -== Загальний Trembita SOAP-конектор -[CAUTION] -==== -Конектор можна використати для інтеграції з будь-яким SOAP-сервісом, зареєстрованим у СЕВ ДЕІР "Трембіта". - -Детальніше про налаштування взаємодії з "Трембітою" див. на сторінці xref:registry-admin/external-integration/cp-integrate-trembita.adoc[]. -==== - -*Trembita SOAP connector* -- інтеграційне розширення-делегат *`${trembitaSoapConnectorDelegate}`*, призначене для виклику зовнішнього SOAP-сервісу через ШБО "Трембіта". Воно налаштовується у бізнес-процесі за допомогою шаблону *Trembita SOAP connector* (*_trembitaSoapConnectorDelegate.json_*). - -[WARNING] -==== -Передумови :: - -За умови налаштування делегата в Camunda Modeler переконайтеся, що папка застосунку *_resources/element-templates_* містить файл шаблону *_trembitaSoapConnectorDelegate.json_*. -==== - -[#configure-trembita-soap-delegate] -=== Налаштування делегата - -Делегат конфігурується за допомогою спеціального шаблону-розширення для сервісної (системної) задачі бізнес-процесу. - -. Створіть *Service Task* (Сервісну задачу). - -. На панелі справа натисніть `*Select*`, оберіть та налаштуйте шаблон *Trembita SOAP connector* зі списку: - -. У полі `*Name*` секції *General* вкажіть назву задачі. Наприклад, `Відправлення запита до ЄДР`. - -. Розділ *Custom properties*: - -* У полі `*Trembita system name*` вкажіть назву зовнішньої системи-учасника СЕВ ДЕІР "Трембіта", з якою встановлено підключення через адміністративну панель *Control Plane*. Наприклад, *`trembita-registry-test`*. - -* У полі `*Trembita service name*` вкажіть назву сервісу зовнішньої системи "Трембіта", куди необхідно виконати запит. Наприклад, *`testAction`*. -+ -NOTE: [.underline]#Назва сервісу = SOAP Action#. Вона визначає, який процес або програму необхідно викликати, коли запит надсилається клієнтом сервісу. - -* У полі `*Content type*` визначається формат представлення даних та кодування. За замовчуванням -- *`text/xml;charset=UTF-8;`*. - -* У полі *`Request payload`* вкажіть змінну, яка містить дані запита. Наприклад, *`${requestPayload}`*. -+ -NOTE: *`${requestPayload}`* формується попередньо у скрипті (_див. детальніше -- xref:#request-trembita-soap-connector[]_). -+ -Тіло запита може виглядати так: -+ -.Тіло запита згідно з контрактом для сервісу ЄДР -==== -[source,xml] ----- - - $edrpou - ----- -==== - -* У полі `*Result variable*` вкажіть змінну, до якої необхідно записати відповідь від сервісу. Наприклад, `*edrResponseBody*`. - -+ -image:registry-develop:bp-modeling/ext-integration/connectors/trembita-connector/trembita-connector-1.png[] - -+ -.Відповідь від API згідно з контрактом для сервісу ЄДР -==== -[source,xml] ----- - - - ... - - - - - - 1 - зареєстровано - Сидоренко Василь Леонідович - http://zqedr-api.nais.gov.ua/1.0/subjects/2222 - 2222 - 2222 - - - - - ----- - -[NOTE] -Делегат повертає відповідь у вигляді об'єкта типу https://javadoc.io/static/org.camunda.spin/camunda-spin-core/1.6.3/org/camunda/spin/xml/SpinXmlElement.html[SpinXmlElement]. -==== - -=== Використання у бізнес-процесі на прикладі надсилання запита до сервісу ЄДР - -Розглянемо приклад використання розробленого інтеграційного конектора у бізнес-процесі, який має взаємодію із SOAP-сервісом ЄДР (_тут -- виконує пошук інформації про посадову особу за кодом ЄДРПОУ (атрибутом `edrpou`)_). - -[TIP] -==== -Скористайтеся референтними прикладами бізнес-процесу та UI-форм для кращого розуміння деталей моделювання: - -* [*] Бізнес-процес: _link:{attachmentsdir}/bp-modeling/soap-connectors/trembita-connector.bpmn[trembita-connector.bpmn]_ -* [*] Форма введення даних: _link:{attachmentsdir}/bp-modeling/soap-connectors/soap-http-connector-edrpou-search-in-edr.json[soap-http-connector-edrpou-search-in-edr.json]_ -* [*] Форма перегляду результату: _link:{attachmentsdir}/bp-modeling/soap-connectors/soap-http-connector-edrpou-edr-result-view.json[soap-http-connector-edrpou-edr-result-view.json]_ -==== - -[NOTE] -==== -Конектор можна використати для інтеграції з будь-яким SOAP-сервісом, зареєстрованому у СЕВ ДЕІР "Трембіта". -==== - -. Створіть бізнес-процес і додайте пул до панелі моделювання. -+ -image:registry-develop:bp-modeling/ext-integration/connectors/trembita-connector/trembita-connector-2.png[] - -. Створіть стартову задачу для ініціювання процесу. -+ -[WARNING] -==== -Для того, щоб використовувати змінну `*initiator*` у бізнес-процесі, необхідно визначити її на стартовій події як `*initiator*` у полі `*Start initiator*`. - -image:registry-develop:bp-modeling/ext-integration/connectors/soap-http/soap-http-2-1.png[] - -==== - -==== Користувацька задача введення даних для пошуку в іншому реєстрі - -Далі змоделюйте користувацьку задачу (*User Task*), оберіть шаблон *User Form* (користувацька UI-форма) та виконайте налаштування. - -. Введіть назву задачі. Наприклад, `Ввести ЄДРПОУ для пошуку`. -. У полі `*ID*` введіть ідентифікатор задачі (`activity_id`). Його ви можете використовувати надалі у бізнес-процесі відповідно до вашої логіки. Наприклад, `*searchEdrpouCodeOfficer*`. -. У полі `*Form key*` введіть службову назву UI-форми вводу даних. Наприклад, `*soap-http-connector-edrpou-search-in-edr*`. -. У полі `Assignee` введіть токен ініціатора процесу -- `${initiator}`. - -image:registry-develop:bp-modeling/ext-integration/connectors/soap-http/soap-http-3.png[] - -Приклад UI-форми на інтерфейсі користувача може виглядати так: :: -+ -image:registry-develop:bp-modeling/ext-integration/connectors/soap-http/soap-http-5.png[] - -[#request-trembita-soap-connector] -==== Скрипт для виконання запита через Trembita SOAP-конектор - -Далі сформуйте Groovy-скрипт, в якому необхідно визначити параметри, а саме _тіло_ запита й опціонально -- _заголовки_, які будуть використані SOAP-конектором для отримання даних в іншому реєстрі. - -[WARNING] -==== -Делегат _автоматично додасть наступні системні заголовки_ при виконанні запита до SOAP-сервісу. - -.Перелік і структура заголовків -[%collapsible] -===== -[source,xml] ----- - - ? - ? - ? - ? - - - ? - ? - ? - ? - ? - ? - -? -? -? ----- -===== -==== - -. Створіть скрипт-задачу (*Script Task*). -. Введіть назву. Наприклад, `Підготувати дані для запита`. -. Відкрийте візуальний редактор скриптів та напишіть необхідний скрипт. -+ -image:registry-develop:bp-modeling/ext-integration/connectors/soap-http/soap-http-4.png[] - -Загалом скрипт може виглядати так: :: -+ -image:registry-develop:bp-modeling/ext-integration/connectors/trembita-connector/trembita-connector-3.png[] - -* 3.1. Отримуємо значення коду `*edrpou*`, який ввели на першій формі вводу даних (`*formData*`): -+ -[source,groovy] ----- -def edrpou = submission('searchEdrpouCodeOfficer').formData.prop('edrpou').value() ----- - -* 3.2. Отримуємо токен авторизації для доступу до сервісу за допомогою JUEL-функції *`get_trembita_auth_token()`*. -+ -[source,groovy] ----- -def registryAuthSecretValue = get_trembita_auth_token('trembita-registry-test') ----- -+ -[NOTE] -==== -Функція *`get_trembita_auth_token()`* дозволяє отримати токен авторизації для доступу до сервісів СЕВ ДЕІР "Трембіта", з якими попередньо налаштовано взаємодію у Control Plane (_див. детальніше -- xref:bp-modeling/bp/modeling-facilitation/modelling-with-juel-functions.adoc[]_). -==== - -* 3.3. Створюємо шаблон заголовка SOAP-запита із токеном авторизації. -+ -[source,groovy] ----- -def authHeaderTagTemplate = """ - - $registryAuthSecretValue - -""" ----- - -* 3.4. Заповнюємо шаблон заголовка із токеном авторизації. -+ -[source,groovy] ----- -def headerString = sprintf(authHeaderTagTemplate, registryAuthSecretValue) ----- - -* 3.5. Створюємо шаблон тіла SOAP-запита для пошуку суб'єкта за кодом ЄДРПОУ. -+ -[source,groovy] ----- -def bodyTemplate = """ - - $edrpou - -""" ----- - -* 3.6. Заповнюємо шаблон тіла SOAP-запита зі значенням `*edrpou*`. -+ -[source,groovy] ----- -def bodyString = sprintf(bodyTemplate, edrpou) ----- - -* 3.7. Створюємо шаблон SOAP-запита зі згенерованим заголовком та тілом. -+ -[source,groovy] ----- -String requestTemplate = """ - - - $headerString - - - $bodyString - - -""" ----- -+ -Змінні `*headerString*` та `*bodyString*` формуються з шаблонів `*authHeaderTagTemplate*` та `*bodyTemplate*` відповідно, де змінні `*$registryAuthSecretValue*` і `*$edrpou*` замінюються на значення змінних `*registryAuthSecretValue*` та *`edrpou`*, що були отримані на попередніх етапах у скрипті. - -* 3.8. Далі формуємо запит на отримання інформації про суб'єкт за його ЄДРПОУ. -+ -[source,groovy] ----- -def requestPayload = sprintf(requestTemplate, headerString, bodyString) ----- -+ -Запит формується за допомогою змінної *`requestTemplate`*, в якій змінні *$headerString* і *$bodyString* замінюються на їх відповідні значення. - -* 3.9. Кінцевий запит зберігаємо у змінній `*requestPayload*` і додаємо до тимчасових змінних за допомогою функції *`set_transient_variable()`*. Значення цієї змінної ми використаємо як вхідний параметр запита у налаштуваннях Trembita SOAP-конектора (_див. детальніше -- xref:#configure-trembita-soap-delegate[]_). -+ -[source,groovy] ----- -set_transient_variable('requestPayload', requestPayload) ----- -+ -TIP: Тимчасові змінні дозволяють зберігати дані на певний час, щоб вони були доступні наступним етапам скрипту (до наступної користувацької задачі), але не були збережені назавжди. - - -==== Сервісна задача для відправлення пошукового запита до іншого реєстру - -Далі необхідно створити сервісну задачу, застосувати та налаштувати делегат для *Trembita SOAP*-конектора. - -TIP: Див. детальніше у розділі xref:#configure-trembita-soap-delegate[]. - -[#trembita-soap-script-form-output] -==== Скрипт для виводу даних на UI-форму користувача - -Далі необхідно передати дані на UI-форму, отримані в іншому реєстрі за допомогою SOAP-http-конектора. Для цього спочатку сформуйте відповідний скрипт, який зможе це зробити. - -. Створіть скрипт-задачу (*Script Task*). -. Введіть назву. Наприклад, `Підготовка отриманих даних для виведення на форму`. -. Відкрийте візуальний редактор скриптів та напишіть необхідний скрипт. -+ -image:registry-develop:bp-modeling/ext-integration/connectors/soap-http/soap-http-6.png[] - -Загалом скрипт може виглядати так: :: -+ -image:registry-develop:bp-modeling/ext-integration/connectors/trembita-connector/trembita-connector-4.png[] - -* 3.1. Формуємо JSON-об'єкт із параметрами *`state`*, `*name*`, `*code*`, `*id*`, щоб передати їх на форму. - -* 3.2. Зберігаємо об'єкт до змінної *`payload`*, яку ми й використаємо як вхідний параметр для передачі даних на форму. -+ -._Скрипт для виводу даних на UI-форму користувача_ -[%collapsible] -==== -[source,groovy] ----- -def payload = [:] - - payload['state'] = getValueByPropertyName("state_text") - payload['name'] = getValueByPropertyName("name") - payload['code'] = getValueByPropertyName("code") - payload['id'] = getValueByPropertyName("id") - - set_transient_variable('payload', S(payload, 'application/json')) - - def getValueByPropertyName(String propName) { - return edrResponseBody.childElement("Body") - .childElement("http://nais.gov.ua/api/sevdeir/EDR", "SearchSubjectsResponse") - .childElement("SubjectList") - .childElement("SubjectInfo") - .childElement(propName) - .textContent() -} ----- -==== - -==== Користувацька задача передачі даних на UI-форму - -Насамкінець необхідно вивести отримані в іншому реєстрі та опрацьовані скриптом дані на UI-форму користувача. - -Змоделюйте користувацьку задачу (*User Task*), оберіть шаблон *User Form* (користувацька UI-форма) та виконайте налаштування. - -. Введіть назву задачі. Наприклад, `Переглянути дані з ЄДР`. -. У полі `*ID*` введіть ідентифікатор задачі (`activity_id`). Наприклад, `*writeResultForm*`. -. У полі `*Form key*` введіть службову назву UI-форми вводу даних. Наприклад, `*soap-http-connector-edrpou-edr-result-view*`. -. У полі `Assignee` введіть токен ініціатора процесу -- `${initiator}`. -. У полі `*Form data pre-population*` вкажіть як змінну об'єкт із параметрами, які необхідно передати на форму, -- `*${payload}*`. -+ -TIP: Змінна формується у задачі xref:#trembita-soap-script-form-output[]. - -image:registry-develop:bp-modeling/ext-integration/connectors/soap-http/soap-http-7.png[] - -Приклад UI-форми на інтерфейсі користувача може виглядати так: :: -+ -image:registry-develop:bp-modeling/ext-integration/connectors/soap-http/soap-http-8.png[] - -Змоделюйте задачу завершення процесу та збережіть зміни. \ No newline at end of file +Model the process end task and save your changes. \ No newline at end of file diff --git a/docs/en/modules/registry-develop/pages/bp-modeling/forms/bp-modeling-forms-general-description.adoc b/docs/en/modules/registry-develop/pages/bp-modeling/forms/bp-modeling-forms-general-description.adoc index ff47734c19..1f6ad0de20 100644 --- a/docs/en/modules/registry-develop/pages/bp-modeling/forms/bp-modeling-forms-general-description.adoc +++ b/docs/en/modules/registry-develop/pages/bp-modeling/forms/bp-modeling-forms-general-description.adoc @@ -1,19 +1,14 @@ //= Моделювання UI-форм бізнес-процесів = Modeling UI forms for business processes +:sectanchors: +:sectlinks: -include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] +UI forms in the *_Administrative portal_* facilitate data input, retrieval, and search within registries. They bridge user interfaces with API layers of business process execution and the Data factory. -include::platform:ROOT:partial$admonitions/language-en.adoc[] +[#section-overview] +== Section overview -//Моделювання форм до бізнес-процесів відбувається у **Кабінеті адміністратора регламентів**, що дозволяє забезпечити зв'язок між користувацькими формами, необхідними для внесення даних до БД, та API рівнів виконання бізнес-процесів і фабрики даних. -You can model the UI forms for business processes in the regulations administrator portal. It enables you to connect the UI forms for entering data into the database, and the APIs at the level of business processes and the data factory. - -[#useful-links] -== Useful links - -* [*] https://help.form.io/intro/welcome/[Official Form.io documentation]. -* [*] https://help.form.io/userguide/forms/[Form.io forms]. -* [*] https://help.form.io/userguide/form-components/[Form.io form components]. * [*] xref:bp-modeling/forms/registry-admin-modelling-forms.adoc[] * [*] xref:bp-modeling/forms/components/index.adoc[] -* [*] xref:bp-modeling/forms/transferring-forms-to-admin-portal.adoc[] \ No newline at end of file +* [*] xref:registry-admin/admin-portal/overview.adoc[] +* [*] https://help.form.io/intro/welcome/[Official Form.io documentation]. diff --git a/docs/en/modules/registry-develop/pages/bp-modeling/forms/components/edit-grid/edit-grid-save-data-list.adoc b/docs/en/modules/registry-develop/pages/bp-modeling/forms/components/edit-grid/edit-grid-save-data-list.adoc index 001e94613b..7f2938fd73 100644 --- a/docs/en/modules/registry-develop/pages/bp-modeling/forms/components/edit-grid/edit-grid-save-data-list.adoc +++ b/docs/en/modules/registry-develop/pages/bp-modeling/forms/components/edit-grid/edit-grid-save-data-list.adoc @@ -1,73 +1,62 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - -//= Збереження даних з форми масивом у БД = Saving form data to the database as an array +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] + +include::platform:ROOT:partial$admonitions/language-en.adoc[] -//Завантажити дані масивом до фабрики даних можливо, якщо при моделюванні форми використати компонент *Edit Grid*. To load an array of data to the data factory, use the *Edit Grid* component when modeling the UI form. -//Компонент *Edit Grid* дозволяє змоделювати записи з різних компонентів як єдиний масив і завантажити його до бази даних. Масив має відповідати структурі, визначеній моделлю даних. The *Edit Grid* component enables you to model records from different components as a single array and upload them to the database. The array must follow the structure defined by the data model. -//IMPORTANT: Якщо структура масиву даних на формі не відповідає визначеній моделі у БД, то значення з форми не завантажаться до бази даних, а система поверне помилку. IMPORTANT: If the structure of an array in a form does not follow the model defined in the database, the values from the form will not be loaded, and the system will return an error. -//TIP: Інструкція показує тестовий сценарій моделювання масиву даних для завантаження документів за допомогою компонента *Edit Grid*. TIP: This topic demonstrates a test scenario of modeling a data array for loading documents using the *Edit Grid* component. -//. Відкрийте розділ моделювання форм. -. Sign in to the regulations administrator portal. +. Sign in to the *Administrative portal*. . Open the *UI forms* section. + image::registry-admin/admin-portal/ui-forms/ui-forms-1.png[] -//. Створіть форму, або відкрийте будь-яку наявну зі списку. + . Create a form or select one from the list. -//. Перейдіть на вкладку [.underline]#Конструктор#. + . Open the *Builder* tab. -//. На панелі компонентів зліва оберіть [.underline]#Оновлені#. + . In the components panel on the left, select *Updated*. -//. Оберіть компонент *Edit Grid* та перетягніть до області моделювання. + . Find the *Edit Grid* component and drag it onto the modeling canvas. + image:bp-modeling/forms/components/edit-grid/sort-as-number/edit-grid-sort-as-number-1.png[] + -//. У новому вікні натисніть `Save`, щоб зберегти зміни. + . In the new window, click *`Save`*. + image:bp-modeling/forms/components/edit-grid/sort-as-number/edit-grid-sort-as-number-2.png[] + -//. Додайте до компонента *Edit Grid* компоненти, передбачені бізнес-логікою. Наприклад, *Text Field* (двічі) та *Date / Time*. + . Add components to the *Edit Grid* according to the business logic--for example, *Text Field* (twice) and *Date / Time*. + image:bp-modeling/forms/components/edit-grid/sort-as-number/edit-grid-sort-as-number-3.png[] + image:bp-modeling/forms/components/edit-grid/submit-data-as-array/edit-grid-submit-data-as-array-1.png[] + -//В результаті панель моделювання виглядатиме наступним чином: + As a result, the modeling canvas looks like this: + image:bp-modeling/forms/components/edit-grid/submit-data-as-array/edit-grid-submit-data-as-array-2.png[] + -//. Перейдіть на вкладку [.underline]#Перегляд#, щоб побачити, як змодельована форма виглядатиме на інтерфейсі користувача. + . Open the *Preview* tab to see how the form will appear in the UI. -//. Натисніть `Додати`, щоб наповнити колонки таблиці значеннями. + . Click *`Add`* to fill out the table. + image:bp-modeling/forms/components/edit-grid/submit-data-as-array/edit-grid-submit-data-as-array-3.png[] + -//. У новому вікні введіть значення для компонентів та натисніть `Зберегти`. Повторіть процедуру декілька разів, щоб наповнити таблицю. + . In the new window, fill out the fields and click *`Save`*. . Add more records to the table if necessary. + -image:bp-modeling/forms/components/edit-grid/submit-data-as-array/edit-grid-submit-data-as-array-4.png[] +image:bp-modeling/forms/components/edit-grid/submit-data-as-array/edit-grid-submit-data-as-array-4-en.png[] + +This is how you create a table with columns of different types (_in our example, components *Text Field* and *Date / Time_*) combined into a single array under the *Edit Grid* component. From now on, officer users can fill out the UI forms with real data as part of the business processes. After the data is digitally signed, it will be saved to corresponding tables in the database. -//Таким чином сформується таблиця, яка складається із записів різного типу (у нашому прикладі -- *Text Field* та *Date / Time*), які об'єднані в єдиний масив під компонентом *Edit Grid*. Надалі користувачі Кабінету посадової особи зможуть в рамках проходження бізнес-процесів наповнювати змодельовані форми задач реальними даними, які, після підписання їх КЕП, зберігатимуться до відповідних таблиць бази даних. -This is how you create a table with fields of different types (in our example, *Text Field* and *Date / Time*) combined into a single array under the *Edit Grid* component. From now on, officer users can fill out the task forms with real data as part of the business processes. After the data is digitally signed, it will be saved to corresponding tables in the database. \ No newline at end of file +.Request to data factory in a JSON format +image::bp-modeling/forms/components/edit-grid/submit-data-as-array/edit-grid-submit-data-as-array-5-en.png[] \ No newline at end of file diff --git a/docs/en/modules/registry-develop/pages/bp-modeling/forms/components/index.adoc b/docs/en/modules/registry-develop/pages/bp-modeling/forms/components/index.adoc index b5706ee05b..07e08fa143 100644 --- a/docs/en/modules/registry-develop/pages/bp-modeling/forms/components/index.adoc +++ b/docs/en/modules/registry-develop/pages/bp-modeling/forms/components/index.adoc @@ -1,88 +1,62 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - -//= Компоненти моделювання UI-форм = UI form modeling components +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] -//Цей розділ надає загальний огляд +++оновлених компонентів+++ для моделювання UI-форм. Ми рекомендуємо використовувати ці компоненти для підвищення ефективності процесу розробки регламенту та покращення користувацького досвіду. Оновлені компоненти стандартного сету *Form IO* надають більше гнучкості та розширюють функціональні можливості. -This section provides an overview of the _updated components_ for UI form modeling. We recommend using these components to develop the regulations more efficiently and improve the user experience. The updated components of the standard *Form IO* set provide more flexibility and expanded functionality. +include::platform:ROOT:partial$admonitions/language-en.adoc[] + +This section provides an overview of the *_Updated components_* for UI form modeling. We recommend using these components to develop the regulations more efficiently and improve the user experience. The updated components of the standard *Form IO* set provide more flexibility and expanded functionality. image:registry-develop:bp-modeling/forms/components/components-panel.png[] -//Ви можете використовувати функціональність у +++Кабінеті адміністратора регламентів+++ > +++UI-форми+++ (_режим створення або редагування форми_) > +++Конструктор+++ > +++Оновлені+++. -You can use these features in the regulations administrator portal > *UI forms* (creating or editing) > *Builder* > *Updated*. +You can use these features in the Administrative portal > *UI forms* (creating or editing) > *Builder* > *Updated*. -//.Опис оновлених компонентів для моделювання UI-форм .Updated UI form modeling components [cols="1,2",options="header"] |=== |Component|Description |xref:bp-modeling/forms/components/text-field.adoc[*Text Field*] -//|Компонент для введення тексту користувачем. Він може бути використаний для створення полів, таких як ім'я, адреса тощо. |A component for text input. Used for short fields such as a name, address, and so on. |xref:bp-modeling/forms/components/number.adoc[*Number*] -//|Компонент, що дозволяє користувачам вводити лише числові значення. -|A component limited to number type values. +|A component limited to the number of type values. |xref:bp-modeling/forms/components/content.adoc[*Content*] -//|Компонент для відображення статичного вмісту, як-от текст, зображення або HTML. -|A component for displaying static content such as text, images, or HTML. +|A component for displaying static content such as a text, images, or HTML. |xref:bp-modeling/forms/components/email.adoc[*Email*] -//|Спеціалізований текстовий компонент, призначений для введення та перевірки адрес електронної пошти. |A specialized text component for entering and validating email addresses. |xref:bp-modeling/forms/components/edit-grid/edit-grid.adoc[*Edit Grid*] -//|Компонент, який дозволяє користувачам створювати, редагувати та видаляти рядки в таблиці. |A component for creating, editing, and deleting rows in a table. |xref:bp-modeling/forms/components/columns.adoc[*Columns*] -//|Компонент для створення розташування стовпців на сторінці або в рамках інших компонентів. |A component for creating column layouts on a page or within other components. |xref:bp-modeling/forms/components/text-area.adoc[*Text Area*] -//|Компонент, призначений для введення великого об'єму тексту. |A component for longer text input. |xref:bp-modeling/forms/components/fieldset.adoc[*Field Set*] -//|Компонент, що групує декілька полів або компонентів для кращої організації. -|A component that groups several fields or components for better organization. +|A component that groups several fields or components for a better organization. |xref:bp-modeling/forms/components/date-time.adoc[*Date & Time*] -//|Компонент, що дозволяє користувачам вибрати дату та/або час. |A component that enables users to select a date and/or time. |xref:bp-modeling/forms/components/table.adoc[*Table*] -//|Компонент для створення та відображення таблиці. |A component for creating and displaying a table. |xref:bp-modeling/forms/components/select/select-overview.adoc[*Select*] -//|Компонент, що дозволяє користувачам вибрати один або декілька варіантів із попередньо визначеного списку. |A component that enables users to select one or more options from a predefined list. |xref:bp-modeling/forms/components/checkbox.adoc[*Checkbox*] -//|Компонент, який надає користувачам можливість вибрати один або декілька варіантів зі списку. |A component that enables users to select one or more options from a list. |xref:bp-modeling/forms/components/map/map.adoc[*Map*] -//|Компонент, який дозволяє відображати географічні дані на карті та інтерактивно взаємодіяти з ними. |A component for displaying geographic data on an interactive map. |xref:bp-modeling/forms/components/radio.adoc[*Radio*] -//|Компонент, що дозволяє користувачам вибрати лише одну опцію з передвизначеного набору. |A component that allows users to select only one option from a predefined set. |xref:bp-modeling/forms/components/file/file.adoc[*File*] -//|Компонент, що дозволяє користувачам завантажувати файли на сервер. |A component that enables users to upload files to a server. |=== diff --git a/docs/en/modules/registry-develop/pages/bp-modeling/forms/components/select/bp-select-component-form-io.adoc b/docs/en/modules/registry-develop/pages/bp-modeling/forms/components/select/bp-select-component-form-io.adoc index 4db2106044..a374578c9d 100644 --- a/docs/en/modules/registry-develop/pages/bp-modeling/forms/components/select/bp-select-component-form-io.adoc +++ b/docs/en/modules/registry-develop/pages/bp-modeling/forms/components/select/bp-select-component-form-io.adoc @@ -1,31 +1,19 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - -//= Налаштування компонента Select для отримання та фільтрації даних від API-ресурсів = Configuring the Select component to get and filter data from API resources +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] + +include::platform:ROOT:partial$admonitions/language-en.adoc[] -//TIP: *API Endpoint (Кінцева точка інтеграційної взаємодії, ендпоінт)* -- це точка входу у сервісі для отримання даних при взаємодії двох систем. TIP: An _API endpoint_ is a service entry point that enables communication between different systems, allowing them to interact and exchange data. -//Для інтеграції форм бізнес-процесів із фабрикою даних використовується компонент **Select** із додатковими налаштуваннями. To integrate business process UI forms with the data factory, you need to use the *Select* component with additional settings. -//Поточна інструкція описує налаштування компонента Select для показу даних з ендпоінту та фільтрації даних з іншого компонента Select. This topic shows how to configure a Select component to display data from an endpoint and filter data from another Select component. [NOTE] ==== -//Ви можете налаштувати компонент *Select* для отримання даних за посиланням [.underline]#як до внутрішніх, так і до зовнішніх ресурсів (ендпоінтів)#. + You can configure the *Select* component to get data from internal and external resources (endpoints). -//Зовнішні ресурси доступні за абсолютними посиланнями, мають бути публічними API, не вимагати автентифікації та повертати дані у форматі JSON як масив об'єктів: To get data from an external resource, you need to specify an absolute URL. The resource must be a public API without authentication and return data in JSON format as an array of objects: [source,json] @@ -33,12 +21,10 @@ To get data from an external resource, you need to specify an absolute URL. The [{},{},{}] ---- -//Ось приклад абсолютної URL-адреси, яка надає дані у форматі JSON за допомогою методу `/get` і повертає список об'єктів: Here is an example of an absolute URL address that returns data in JSON format using the GET method and provides a list of objects: https://jsonplaceholder.typicode.com/comments -//Ця URL-адреса вказує на загальнодоступний API із назвою `JSONPlaceholder`, який надає несправжні дані для тестування та прототипування. У цьому випадку ендпоінтом є `/comments`, який повертає список коментарів. Ось приклад даних, які ви можете отримати: This URL points to a public API called `JSONPlaceholder` that provides dummy data for testing and prototyping. In this case, the endpoint is `/comments`, which returns a list of comments. Here's an example of the data you can get: [source,json] @@ -70,43 +56,54 @@ This URL points to a public API called `JSONPlaceholder` that provides dummy dat ==== -//== Налаштування компонента Select для підтягнення даних з ендпоінту == Configuring the Select component to get data from an endpoint -//. Увійдіть до **Кабінету адміністратора регламентів** та створіть форму. -. Sign in to the regulations administrator portal and create a form. -//. Перейдіть на вкладку **Компоненти** та додайте компонент **Select**. +. Sign in to the *Administrative portal* and create a form. + . Open the *Components* tab and add a *Select* component. -//. Відкрийте меню налаштувань для компонента (кнопка налаштувань із шестернею). + . Open component settings by clicking the gear icon. + image:registry-develop:bp-modeling/forms/bp-select/bp-select-form-io-1.png[] -+ -//. На вкладці **Display**, у полі `Label`, зазначте назву компонента. + . In the *Display* tab > *Label* field, specify the component name. + image:registry-develop:bp-modeling/forms/bp-select/bp-select-form-io-2.png[] -+ -//. Перейдіть на вкладку **API** та у полі `Property Name` введіть назву компонента для API-ендпоінту (наприклад, значення `selectProcessInstanceId`). + . Open the *API* tab and enter the component name for the API endpoint into the *Property Name* field--for example, `selectProcessInstanceId`. + image:registry-develop:bp-modeling/forms/bp-select/bp-select-form-io-3.png[] + +. Open the *Data* tab and choose the *URL* into the *Data Source Type* field. + +. Specify the value for the endpoint URL in the *Data Source URL* field. For example: ++ +[source,http] +---- +https://-./api/process-instance +---- + -//. Перейдіть на вкладку **Data** -> далі в полі **Data Source Type** введіть значення `URL`. -. Open the *Data* tab and enter `URL` into the *Data Source Type* field. -//. Вкажіть значення для endpoint URL у полі **Data Source URL** (наприклад, `https://user-proc-mng-lowcode-pipe-qa.apps.cicd.mdtu-ddm.projects.epam.com/api/process-instance`). -. Enter the endpoint URL into the *Data Source URL* field--for example, `https://user-proc-mng-lowcode-pipe-qa.apps.cicd.mdtu-ddm.projects.epam.com/api/process-instance`. +[TIP] +==== +* `` -- the name of the service. For instance, `test-service`. +* `` -- Openshift namespace/project. For instance, `test-project`. +* `` points to the domain and subdomain names for the Platform instance. For example, `example.com`. +* `/api/process-instance` -- the specific API endpoint of the service. + +The final URL will look like: + +[source,http] +---- +https://test-service-test-project.example.com/api/process-instance +---- +==== + image:registry-develop:bp-modeling/forms/bp-select/bp-select-form-io-5.png[] -+ -//. Зазначте **Value Property** у відповідному полі -- назва властивості із JSON-відповіді ендпоінту, яка зберігатиметься як значення після select (наприклад, `id`). -//TODO: Let's double-check this sentence + . Specify the name of the property from the endpoint's JSON response that will be stored as the value property after the select in the *Value Property* field--for example, `id`. -+ -//. Встановіть **Item Template** -- HTML-шаблон для відображення значень у селекті, як показано на прикладі нижче. + . Define the HTML template to display values in a select in the *Item Template* field, as shown in the following example. + -//NOTE: `processDefinitionName` _та `id` беруться із відповіді ендпоінту та відображатимуться в селекті)._ NOTE: `processDefinitionName` and `id` are taken from the endpoint's response and shown in the select. + .HTML template @@ -119,60 +116,70 @@ NOTE: `processDefinitionName` and `id` are taken from the endpoint's response an ==== + image:registry-develop:bp-modeling/forms/bp-select/bp-select-form-io-6.png[] -//.Запит та відповідь у Swagger UI (сервіс registry-rest-api реєстру) + .Request and response in Swagger (registry's "registry-rest-api" service) ==== image:registry-develop:bp-modeling/forms/bp-select/bp-select-form-io-4.png[] ==== -+ -//. Збережіть зміни до компонента, натиснувши кнопку `Save`. + . Click *`Save`* to save changes to the component. + image:registry-develop:bp-modeling/forms/bp-select/bp-select-form-io-7.png[] -//В результаті у випадному списку підтягнеться назва та ідентифікатор (`id`) усіх послуг, ініційованих посадовою особою. As a result, the dropdown list will contain the names and IDs of all the services initiated by an officer. -//== Налаштування залежного компонента Select для фільтрації даних з іншого компонента == Configuring a dependent Select component to filter data from another component -//. Відкрийте форму із компонентом, дані якого потрібно фільтрувати. . Open the form with the component whose data you need to filter. -//. Перейдіть на вкладку **Компоненти** та додайте компонент **Select**. + . Open the *Components* tab and add a *Select* component. -//. Відкрийте меню налаштувань для компонента (кнопка налаштувань із шестернею). + . Open component settings by clicking the gear icon. + image:registry-develop:bp-modeling/forms/bp-select/bp-select-form-io-1.png[] -//. На вкладці **Display**, у полі `Label`, зазначте назву компонента. + . In the *Display* tab > *Label* field, specify the component name. + image:registry-develop:bp-modeling/forms/bp-select/bp-select-form-io-2.png[] -//. Перейдіть на вкладку **API** та у полі `Property Name` введіть назву компонента для API-ендпоінту FormIO (наприклад, значення `selectRelatedTasks`). + . Open the *API* tab and enter the component name for the Form.io API endpoint into the *Property Name* field--for example, `selectRelatedTasks`. + image:registry-develop:bp-modeling/forms/bp-select/bp-select-form-io-8.png[] + +. Open the *Data* tab and choose the *URL* into the *Data Source Type* field. + +. Specify the value for the endpoint URL in the *Data Source URL* field. For example: + -//. Перейдіть на вкладку **Data** -> далі в полі **Data Source Type** введіть значення `URL`. -//. Open the *Data* tab and enter `URL` into the *Data Source Type* field. -//. Вкажіть значення для endpoint URL у полі **Data Source URL** (наприклад, `https://user-task-mng-lowcode-pipe-qa.apps.cicd.mdtu-ddm.projects.epam.com/api/task`). -. Enter the endpoint URL into the *Data Source URL* field--for example, `https://user-task-mng-lowcode-pipe-qa.apps.cicd.mdtu-ddm.projects.epam.com/api/task`. +[source,http] +---- +https://-./api/task +---- + -image:registry-develop:bp-modeling/forms/bp-select/bp-select-form-io-9.png[] +[TIP] +==== +* `` -- the name of the service. For instance, `test-service`. +* `` -- Openshift namespace/project. For instance, `test-project`. +* `` points to the domain and subdomain names for the Platform instance. For example, `example.com`. +* `/api/process-instance` -- the specific API endpoint of the service. + +The final URL will look like: + +[source,http] +---- +https://test-service-test-project.example.com/api/task +---- +==== + -//. Визначте **Value Property** у відповідному полі -- назва властивості із JSON-відповіді ендпоінту, яка зберігатиметься як значення після селекту (наприклад, `formKey`). +image:registry-develop:bp-modeling/forms/bp-select/bp-select-form-io-9.png[] + . Specify the name of the property from the endpoint's JSON response that will be stored as the value property after the select in the *Value Property* field--for example, `formKey`. -//. Вкажіть **Filter Query** у відповідному полі -- запит параметрів, який додаватиметься до ендпоінту та фільтруватиме його відповідь (наприклад, `processInstanceId={{data.selectProcessInstanceId}}`) + . Enter the query with parameters to add to the endpoint and filter its response into the *Filter Query* field--for example, `processInstanceId={{data.selectProcessInstanceId}}`. + -//NOTE: `data.selectProcessInstanceId` -- _назва `Property Name` (вкладка **API**) компонента, дані якого необхідно фільтрувати, і який зберігається в об'єкті `data`._ NOTE: `data.selectProcessInstanceId` is the name (*Property Name* field in the *API* tab) of the component whose data needs to be filtered and which is stored in the `data` object. -+ -//. Встановіть **Item Template** -- HTML-шаблон для відображення значень у селекті, як показано на прикладі нижче. + . Define the HTML template to display values in a select in the *Item Template* field, as shown in the following example. + -//NOTE: `name` _та `id` беруться із відповіді ендпоінту та відображатимуться в селекті)._ NOTE: `name` and `id` are taken from the endpoint's response and shown in the select. + .HTML template @@ -184,16 +191,12 @@ NOTE: `name` and `id` are taken from the endpoint's response and shown in the se {{ item.id}} ---- ==== -+ -//. Встановіть **Refresh On** -- компонент, на який повинен орієнтуватися поточний компонент під час фільтрації. -//TODO: Let's double-check this sentence + . In *Refresh Options On*, set the component which the current component should depend on when filtering data. -//. Встановіть прапорець для `Clear Value On Refresh Options` + . Select the *Clear Value On Refresh Options* checkbox. + image:registry-develop:bp-modeling/forms/bp-select/bp-select-form-io-11.png[] -//TODO: ua typo "запитА" -//.Запита у Swagger UI (сервіс `registry-rest-api` реєстру) + .Request in Swagger (registry's "registry-rest-api" service) ==== @@ -204,5 +207,4 @@ image:registry-develop:bp-modeling/forms/bp-select/bp-select-form-io-10.png[] + image:registry-develop:bp-modeling/forms/bp-select/bp-select-form-io-12.png[] -//В результаті у випадному списку підтягнеться назва та ідентифікатор (`id`) усіх задач, які належать до послуги, обраної в іншому Select-компоненті. As a result, the dropdown list will contain the names and IDs of all the tasks that belong to the service selected in the other Select component. \ No newline at end of file diff --git a/docs/en/modules/registry-develop/pages/bp-modeling/index.adoc b/docs/en/modules/registry-develop/pages/bp-modeling/index.adoc index da5ae32947..ed67c87baf 100644 --- a/docs/en/modules/registry-develop/pages/bp-modeling/index.adoc +++ b/docs/en/modules/registry-develop/pages/bp-modeling/index.adoc @@ -1,12 +1,14 @@ = Business process modelers -include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] +:sectanchors: +:sectlinks: -include::platform:ROOT:partial$admonitions/language-en.adoc[] +The *_Business Process (BP) modelers_* craft the core of the Registries Platform — *Business Processes*, which underpin all services offered. -Business Process (BP) modelers create the "lifeblood" of the _Registry Platform_ -- Business Processes. They are the basis for all the services that the Platform offers to the users. To create Business Processes, BP modelers use visual modelling and managing instruments (**Camunda Modeler**) of a low-code-subsystem via the functionality for the creation of Business Processes, UI-forms, and interactions with other Registries/systems and components. In addition, modeling BP involves using Groovy-scripts and JSON-structures for more complex models. In order to configure integrations with external systems or other Registries within the same Platform instance, API/SOAP-based connectors are used. +Using tools like the *_Administrative portal_*, _Camunda Modeler_, and standards like *_BPMN_* and _DMN_, BP modelers design *_processes_*, *_UI forms_*, and *_integrations_*. +Complex models often incorporate *_Groovy scripting_*, *_JUEL functions_*, and *_JSON structures_*. Modelers and developers employ *_REST and SOAP connectors_* for interactions with external systems or other Registries on the Platform. -You can find more information on BP modeling on the section pages. +For more details on BP modeling, see the section pages. == Section Overview diff --git a/docs/en/modules/registry-develop/pages/data-modeling/data/physical-model/liquibase-ddm-ext.adoc b/docs/en/modules/registry-develop/pages/data-modeling/data/physical-model/liquibase-ddm-ext.adoc index cec4473598..7b95026cd0 100644 --- a/docs/en/modules/registry-develop/pages/data-modeling/data/physical-model/liquibase-ddm-ext.adoc +++ b/docs/en/modules/registry-develop/pages/data-modeling/data/physical-model/liquibase-ddm-ext.adoc @@ -1,52 +1,47 @@ = Liquibase extensions for data modeling -include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] +:page-layout: swagger + WARNING: Use *UTF-8* encoding to describe the registry data model. == General description -//Модель даних реєстру описується декларативно за допомогою XML-шаблонів, які обробляє інструмент Liquibase та генерує на SQL-структури. The registry data model is defined declaratively using XML templates that the Liquibase tool processes and generates SQL structures. -//Через складні вимоги до архітектури Платформи, використання стандартної функціональності Liquibase не покриває всі потреби при роботі зі структурами даних. Due to the Platform's architecture complexity, standard Liquibase functionality only covers some of the needs when working with data structures. -//Функціональність Liquibase розширено платформним модулем `**liquibase-ddm-ext**`, який забезпечує роботу з додатковими _кастомними тегами_ (в термінології Liquibase -- _**change types**_) XML-шаблону Liquibase, що покривають наступні категорії: The Platform's *`liquibase-ddm-ext`* module extends Liquibase's functionality and provides additional _custom tags_ for the Liquibase XML templates. In Liquibase terminology, these tags are called *Change Types*. Custom tags cover the following categories: -//- xref:#createTable[створення таблиць з підтримкою історичності даних]; * xref:#createTable[Creating tables with data history support] -//- xref:#createDomain [створення/видалення користувацьких даних (Domain)]; + * xref:#createDomain [Creating and deleting user data (domain)] -//- xref:#ENUM[створення/видалення користувацьких типів даних (Type)]; + * xref:#ENUM[Creating and deleting user data types] -//- xref:#createSimpleSearchCondition[створення/видалення простого критерію пошуку (Simple Search Condition)]; + * xref:#createSimpleSearchCondition[Creating and deleting simple search conditions] -//- xref:#createSearchCondition[створення/видалення критерію пошуку (Search Condition)]; + * xref:#createSearchCondition[Creating and deleting search conditions] -//- xref:#createMany2Many[створення типу зв'язку "багато до багатьох" (many-to-many)]; + * xref:#createMany2Many[Creating many-to-many relationship type] -//- xref:#createAnalyticsView[створення аналітичного представлення на репліці (Analytics View)]; + * xref:#createAnalyticsView[Creating an analytics view for a replica] -//- xref:#createCompositeEntity[збереження декількох сутностей в рамках однієї транзакції (Composite Entity)]; + * xref:#createCompositeEntity[Storing multiple entities within a single transaction (composite entity)] -//- xref:#partialUpdate[генерація ендпоінтів для зміни окремих частин сутності (partial Update)]; + * xref:#partialUpdate[Generating endpoints for modifying separate parts of an entity (partial update)] -//- xref:#grantAll[надання/видалення прав ролі ена всі аналітичні представлення (grantAll/revokeAll)]. -//TODO: ua typo (ена -> на) + + * xref:#grantAll[Granting and revoking rights to all analytics views (grantAll/revokeAll)] -//TIP: Для прикладу, повний перелік розширених тегів з їх параметрами зберігається в xsd-схемі за https://nexus.apps.envone.dev.registry.eua.gov.ua/nexus/repository/extensions/com/epam/digital/data/platform/liquibase-ext-schema/1.5.0-SNAPSHOT.74/liquibase-ext-schema-1.5.0-SNAPSHOT.74.xsd[посиланням]. -//TODO: Is this link ua-specific? + TIP: A complete list of advanced tags and their parameters is stored in this https://nexus.apps.envone.dev.registry.eua.gov.ua/nexus/repository/extensions/com/epam/digital/data/platform/liquibase-ext-schema/1.5.0-SNAPSHOT.74/liquibase-ext-schema-1.5.0-SNAPSHOT.74.xsd[XSD schema]. [#table-management] == Table management -//.Файли створення таблиць структурі регламенту реєстру -//TODO: ua typo (_в_ структурі) .Files for creating tables in the structure of the registry regulations [plantuml, create-tables-regulation-structure, svg] ---- @@ -67,13 +62,10 @@ TIP: A complete list of advanced tags and their parameters is stored in this htt [#createTable] === Creating tables -//Тег *`createTable`* використовується для створення нової таблиці в базі даних. The *`createTable`* tag creates a table in the database. -//Також для тегу *`createTable`* необхідно використовувати атрибут *`ext:historyFlag`* зі значенням *`true`*. Це розширений атрибут, який використовується для відстеження історії змін. When using the `createTable` tag, you must also use the `ext:historyFlag` attribute and set it to `true`. This extended attribute is used to track the history of changes. -//._Приклад XML-схеми_ ._XML schema example_ [%collapsible] ==== @@ -92,36 +84,28 @@ When using the `createTable` tag, you must also use the `ext:historyFlag` attrib [WARNING] ==== -//В рамках процесу верифікації регламенту, атрибут `*historyFlag*` зі значенням `*true*` _вимагатиметься для всіх тегів_ `*createTable*`. + Each `createTable` tag is required to have a `historyFlag` attribute with a `true` value as part of the regulations verification. -//Тому при створенні таблиці необхідно вказувати відповідне значення `historyFlag="true"`. Таким чином буде додатково згенерована історична таблиця, і для кожної з таблиць буде згенеровано свій специфічний набір службових полів. Therefore, the `historyFlag="true"` attribute is required when creating a table. This way, the system generates a historical table and a set of service fields for each table. ==== -//TIP: За детальною інформацією щодо створення таблиць зверніться до статті xref:data-modeling/data/physical-model/liquibase-changes-management-sys-ext.adoc#create-table-hst[Схема моделювання таблиць та функція підтримки історичності]. TIP: For details on creating tables, see xref:data-modeling/data/physical-model/liquibase-changes-management-sys-ext.adoc#create-table-hst[]. [#create-table-attributes] -//==== Атрибути створення таблиць та доступні значення ==== Table creation attributes and possible values [#bulk-load] -//===== Атрибут bulkLoad та доступні значення -===== bulkLoad attribute +===== _bulkLoad_ attribute -//Атрибут *`bulkLoad`* дозволяє швидко завантажувати дані до таблиць із файлів або масивом. The *`bulkLoad`* attribute lets you quickly load data into tables from files or arrays. -//Атрибут приймає наступні значення: :: Possible values: :: -//* *`true`* -- якщо значення *`bulkLoad`* встановлено як *`true`*, це дозволяє виконувати масове завантаження даних до таблиці з файлів (наприклад, `CSV`) або масивів (`LIST`). Це забезпечує оптимальну продуктивність та ефективність при роботі з великими наборами даних. * *`true`*: Enable bulk data loading into the table from files (for example, CSV) or arrays (`LIST`). This ensures optimal performance and efficiency when working with large datasets. -//* *`false`* -- якщо значення *`bulkLoad`* встановлено як *`false`*, масове завантаження даних до таблиці з файлів або масивів буде відключено. У цьому випадку, дані будуть імпортовані до таблиці за допомогою окремих операцій вставки (`INSERT`), що може бути менш ефективним при роботі з великими об'ємами даних. + * *`false`*: Disable bulk data loading into the table from files or arrays. In this case, data is imported into the table using separate `INSERT` operations, which can be less efficient when working with large volumes of data. -//._Приклад створення таблиці із bulkLoad="true"_ ._Example of creating a table with bulkLoad="true"_ [%collapsible] ==== @@ -142,21 +126,16 @@ Possible values: :: ==== [#read-mode] -//===== Атрибут readMode та доступні значення -===== readMode attribute +===== _readMode_ attribute -//Атрибут *`readMode`* дозволяє контролювати поведінку читання даних із таблиць бази даних реєстру. Він визначає, як система читає дані з таблиці: _синхронно_ або _асинхронно_. Залежно від вимог до продуктивності, ви можете встановити відповідне значення для цього атрибута. The *`readMode`* attribute lets you control the read behavior for the registry's database tables. It determines how the system should read data from the table: _synchronously_ or _asynchronously_. Set the read behavior depending on your performance requirements. -//Атрибут приймає наступні значення: :: Possible values: :: -//* *`sync`* -- синхронний режим. У синхронному режимі читання даних, процес читання відбувається послідовно (читання даних виконується на рівні `registry-rest-api`). Запит на читання блокується до тих пір, поки дані не будуть повернуті від сервера бази даних. Це означає, що виконання додатка зупиняється на час отримання результатів запита. Синхронний режим може бути корисним у випадках, коли важливо забезпечити послідовність операцій. * *`sync`*: Set synchronous read mode. In this mode, the system reads data in a sequence (data is read at the `registry-rest-api` level). The read request is blocked until the database server returns data. This means the application is paused while waiting for the query results. The synchronous mode can be useful in cases where it is important to ensure the sequence of operations. -//* *`async`* -- асинхронний режим. В асинхронному режимі читання даних, запит на читання відправляється серверу бази даних, але не блокує виконання додатка (читання даних виконується шляхом `rest-api > registry-kafka-api > rest-api`). Замість цього, додаток продовжує виконувати наступні дії, а результати читання обробляються коли вони стануть доступними. Асинхронний режим дозволяє збільшити продуктивність додатка, оскільки він не чекає завершення операцій читання. Це може бути корисним у випадках, коли необхідно одночасно обробляти велику кількість запитів або коли час відгуку сервера бази даних є непередбачуваним. + * *`async`*: Set asynchronous read mode. In this mode, the read request sent to the database server does not block the application from running (data is read via `rest-api` > `registry-kafka-api` > `rest-api`). Instead, the application continues working, and the reading results are processed when available. The asynchronous mode increases the application's performance because it does not wait until the reading operations are completed. This can be useful in cases where it is necessary to process a large number of requests simultaneously or when the response time of the database server is unpredictable. -//._Приклад створення таблиці із readMode="sync"_ ._Example of creating a table with readMode="sync"_ [%collapsible] ==== @@ -177,13 +156,10 @@ Possible values: :: ==== [#ext-auto-generate] -//===== Атрибут ext:autoGenerate та доступні значення -===== ext:autoGenerate attribute +===== _ext:autoGenerate_ attribute -//Атрибут *`ext:autoGenerate`* є нестандартним атрибутом розширення Liquibase, який використовується для автоматичної генерації значень для стовпця під час вставки записів у таблицю. Використовується у тегу *``*. The *`ext:autoGenerate`* attribute is a custom Liquibase extension attribute that automatically generates column values when inserting records into a table. It is used in the *``* tag. -//Дозволяє згенерувати унікальний та зрозумілий для користувача номер для сутності, створеної у реєстрі (документа/акту). Номер формується під час збереження сутності та є унікальним у рамках окремого реєстру. Use this attribute to generate a unique and user-friendly number for an entity created in the registry (such as a document or certificate). The number is generated when the entity is saved and is unique within the registry instance. ._XML schema_ @@ -199,60 +175,50 @@ Use this attribute to generate a unique and user-friendly number for an entity c ---- -//У цьому конкретному випадку, атрибут `*ext:autoGenerate*` встановлює шаблон значення для стовпця *`column_name`* у форматі *`AA-{dd-MM-yyyy}-{SEQ}`*. In this example, the `ext:autoGenerate` attribute defines a template for the *`column_name`* column values using the following format: *`AA-{dd-MM-yyyy}-{SEQ}`* -//Значення, що будуть автоматично генеруватися, матимуть вигляд `AA-день-місяць-рік-послідовність`. The system will automatically generate values that will look like this: `AA-day-month-year-sequence`. -//Тут "АА" -- код документа, "день", "місяць" та "рік" -- це дата у форматі *`dd-MM-yyyy`*, а "послідовність" -- це унікальний порядковий номер запису, що додається. Here "AA" is the document code, "day," "month," and "year" define the date in the *`dd-MM-yyyy`* format, and "sequence" contains a unique record number. ==== [TIP] ==== -//Детальний опис функціональності ви можете переглянути за посиланням: -//* xref:data-modeling/data/physical-model/auto-generate-number.adoc[] + + For details, see xref:data-modeling/data/physical-model/auto-generate-number.adoc[]. ==== [#alter-table-api] -//=== Зміна налаштувань поведінки API на рівні структури створення таблиць === Changing API behavior at the level of the table creation structure -//Розробники регламенту мають змогу змінювати налаштування поведінки API на рівні структури створення таблиць. Regulations developers can modify API behavior settings at the level of the table creation structure. -//Для цього імплементовано тег *`ext:alterTableApi`*, який є нестандартним тегом розширення Liquibase. За допомогою цього тегу можна змінювати деякі атрибути таблиці, які не впливають на структуру даних, але впливають на генерацію коду API. For this, you can use *`ext:alterTableApi`*, a custom Liquibase extension tag. This tag enables you to modify specific table attributes that do not affect the data structure but influence the API code generation. -//Наприклад, у відповідному контексті, *`ext:alterTableApi`* може дозволити змінювати атрибути, такі як *`bulkLoad`* або *`readMode`*, що регулюють можливість завантаження даних до таблиці з файлів або масивом та режим читання даних (синхронний або асинхронний), відповідно. For example, `ext:alterTableApi` can allow editing attributes such as `bulkLoad` or `readMode` that control the ability to load data into the table from files or arrays and the data read mode (synchronous or asynchronous), respectively. [TIP] ==== -//Див. детальніше про *`bulkLoad`* та *readMode* у відповідних розділах: + For details on `bulkLoad` and `readMode`, jump to: * xref:#bulk-load[] * xref:#read-mode[] ==== -//Цей тег допомагає розробникам і моделювальникам регламентів керувати налаштуваннями поведінки API _для таблиць після їх створення, без зміни структури даних_. This tag helps regulations developers and modelers control API behavior settings _for tables after they are created without changing the data structure_. -//Тег використовує розширення *`ext:attribute`*, яке приймає ключ (*`name`*) та значення (*`value`*) атрибута, для якого необхідно змінити поведінку. The tag uses the *`ext:attribute`* extension, which accepts the key (*`name`*) and the value (*`value`*) of the attribute for which the behavior needs to be changed. [NOTE] ==== -//* Обов'язковим є вказання назви таблиці (`name`) та хоча б одного з 2-х атрибутів (`bulkLoad` або `readMode`). Атрибути та їх значення зберігаються у таблиці *`ddm_liquibase_metadata`*. + * Specifying the table's `name` and at least one of the two attributes (`bulkLoad` or `readMode`) is mandatory. Attributes and their values are stored in the `ddm_liquibase_metadata` table. -//* За відсутності атрибутів `bulkLoad` або `readMode` у тегу `ext:alterTableApi`, значення у таблиці метаданих `ddm_liquibase_metadata` залишається незмінним та не впливає на поведінку системи. + * If both the `bulkLoad` and `readMode` attributes are absent in the `ext:alterTableApi` tag, the values in the `ddm_liquibase_metadata` metadata table remain unchanged, and system behavior is unaffected. ==== -//._XML-схема використання тегу ext:alterTableApi_ ._XML schema of using the ext:alterTableApi tag_ [%collapsible] ==== @@ -273,19 +239,18 @@ The tag uses the *`ext:attribute`* extension, which accepts the key (*`name`*) a [WARNING] ==== [%collapsible] -//.Використовуйте тег *`ext:alterTableApi`* у новому changeSet, після відпрацьованого changeSet для створення відповідної таблиці. + .Use the *`ext:alterTableApi`* tag in a new changeSet after executing a changeSet to create the table. ===== -//* Вже створені структури даних можуть лише розширюватись. + * Existing data structures can only be extended. -//* Теги в регламенті, які вже було опрацьовано, не можуть бути змінені. + * Tags in the regulations that have already been processed cannot be changed. -//* Усі зміни є ідемпотентними, означає, що якщо ви виконаєте один і той же changeSet кілька разів, стан бази даних залишиться незмінним після першого виконання. + * All changes are idempotent, meaning that if you execute the same changeSet multiple times, the database state will remain the same after the first execution. ===== ==== -//._Розширена XML-схема. Розгортання таблиць з одними значеннями атрибутів та подальша зміна цих значень із використанням тегу ext:alterTableApi_ ._Extended XML schema. Deploying tables with certain attribute values and subsequently changing these values using the ext:alterTableApi tag_ [%collapsible] ==== @@ -327,13 +292,10 @@ The tag uses the *`ext:attribute`* extension, which accepts the key (*`name`*) a ==== [#create-search-conditions] -//== Керування критеріями пошуку (Search Conditions) == Managing search conditions -//Модель даних реєстру будується у регламенті за допомогою XML-тегів, серед яких є `**` для створення критеріїв пошуку -- *Search Conditions* або скорочено *SC*. Наприклад: `**`. You build the registry data model in the regulations using XML tags. One of these tags, `**`, creates search conditions, or *SC* for short. For example: `**`. -//.Критерії пошуку у структурі регламенту реєстру .Search conditions in the structure of the registry regulations [plantuml, registry-sc-regulation-structure, svg] ---- @@ -351,19 +313,14 @@ You build the registry data model in the regulations using XML tags. One of thes @endsalt ---- -//Кожен критерій містить інформацію про таблицю, що буде використовуватися для пошуку, а також параметри пошуку, такі як тип пошуку та колонка, по якій він здійснюється тощо. Each condition contains information about search parameters such as the table and the column to search, which type of search to use, and so on. -//Liquibase обробляє XML-модель та створює таблиці-представлення (`*VIEW*`) у базі даних, які є зведеними таблицями та містять інформацію, отриману з інших таблиць. До назви такої таблиці в БД додається префікс `*_v*`. Наприклад, *`search_condition_test_v`*. Liquibase processes the XML model and creates view tables, virtual tables that contain information from one or more real tables within the database. View tables have a *_v* prefix added to their name--for example, `search_condition_test_v`. -//При розгортанні моделі даних реєстру, для кожного критерію пошуку створюється REST API-ендпоінт з аналогічною назвою, але в іншій конвенції (dash-case), наприклад *`search-condition-test`*. When the registry data model is deployed, the system creates a REST API endpoint for each search condition using the table name without the prefix but with a dash-case convention--for example, `search-condition-test`. -//При виконанні запита до API-ресурсу `*/search-condition-test*`, дані зі зведеної таблиці `*search_condition_test_v*` повертаються у відповідь. When you make a request to the `/search-condition-test` API resource, the response returns data from the `search_condition_test_v` view table. -//Приклад запита до API SC може виглядати так: :: Example of calling the SC API: :: + [source,http] @@ -372,12 +329,10 @@ https://-/search-condition-test?offset=0&limit=10. ---- [#createSimpleSearchCondition] -//=== Тег створення простого критерію пошуку -=== Tag for creating a simple search criteria +=== Tag for creating a simple search condition Change type name: `` :: -//Цей тег надає можливість створити простий критерій пошуку, а саме створити для однієї таблиці відбиток даних (view) та індекс за вказаним полем пошуку. The *`createSimpleSearchCondition`* tag creates a simple search condition, including a view for one table and an index for the specified search field. ._XML schema example_ @@ -394,24 +349,20 @@ The *`createSimpleSearchCondition`* tag creates a simple search condition, inclu ---- ==== -//WARNING: Якщо вказати створення індексу без вказання поля пошуку, то буде згенерована помилка. WARNING: If you create an index without specifying the search field, the system will return an error. -//TIP: За детальною інформацією щодо створення простого критерію пошуку зверніться до секції xref:data-modeling/data/physical-model/liquibase-changes-management-sys-ext.adoc#create-sc-simple[XML-шаблон дизайну простого критерію пошуку (Сценарій 1)] відповідного документа. TIP: For details on creating a simple search condition, see the xref:data-modeling/data/physical-model/liquibase-changes-management-sys-ext.adoc#create-sc-simple[XML template for a simple search condition (scenario 1)] section. [#createSearchCondition] -//=== Тег створення критерію пошуку === Tag for creating a search condition Change type name: `` :: -//Цей тег надає можливість створити критерій пошуку, який створює відбиток даних (`view`) за декількома таблицями та зв'язками між ними. The *`createSearchCondition`* tag creates a search condition, including a view for several tables and their relationships. [CAUTION] ==== -//Тег може також створювати індекси для кожного поля пошуку. Для цього використовуйте додатковий атрибут `indexing` зі значенням `true` в рамках тегу `` відповідно до наступної схеми: + This tag can also create indexes for each search field. Set the additional `indexing` attribute to `true` within the `` tag, as shown in the following example: [source,xml] @@ -456,21 +407,21 @@ columnName="type" operator="eq" value="'text'"/> [WARNING] ==== -//* Якщо вказати створення індексу без вказання поля пошуку, то буде згенерована помилка. + * If you create an index without specifying the search field, the system will return an error. -//* Перший тег `` в умові `` не повинен містити атрибуту `logicOperator`, всі інші теги `` — повинні. + * The first `` tag in the `` condition must not contain the `logicOperator` attribute. All other `` tags must contain it. -//* Перший тег ``, як і всі інші, в умові `` повинен містити атрибут `logicOperator`. + * The first `` tag in the `` condition must contain the `logicOperator` attribute, the same as other tags. -//* Атрибут `logicOperator` приймає значення _and_ і _or_. + * Possible values of the `logicOperator` attribute are _and_ and _or_. -//* Якщо тег `` вкладений в інший, то вони обгортаються дужками. + * If the `` tag is nested, you must wrap it in parentheses. ==== [TIP] ==== -//За детальною інформацією щодо сценаріїв використання критеріїв пошуку зверніться до наступних секцій відповідного документа: + For details on different scenarios of using search conditions, see the following sections: * xref:data-modeling/data/physical-model/liquibase-changes-management-sys-ext.adoc#create-sc-uc2[XML template for a search condition (scenario 2)]; @@ -480,10 +431,8 @@ For details on different scenarios of using search conditions, see the following ==== [#ext-where-operator-values] -//==== Оператор та доступні значення ==== operator -//Оператор `` приймає наступні значення: :: Possible values: :: + |=== @@ -532,7 +481,7 @@ Possible values: :: |`isNull` |is null | -//|Якщо значення (value) = `true`, то перевірка колонки _is null_; якщо значення (value) = `false`, то перевірка колонки _is not null_. + |If value = `true`, then the column check is _is null_; if value = `false`, then the column check is _is not null_. |`similar` @@ -541,32 +490,24 @@ Possible values: :: | |=== -//* Value - якщо потрібно передати текстове значення, то потрібно це значення обгорнути в одинарні лапки; * To specify a text value, wrap it in single quotes. -//* `` — дозволяє використовувати агрегатні функції (`min()`, `max()`, `avg()`, `count()`, `sum()`), при цьому поля таблиці, які використовуються в цих функціях, вилучаються з виводу (`SELECT`). Всі інші поля включаються в групування (`GROUP BY`). * With ``, you can use aggregate functions: `min()`, `max()`, `avg()`, `count()`, `sum()`. The fields used in these functions are removed from the output (`SELECT`). All other table fields are included in grouping (`GROUP BY`). [#sc-attribute-values] -//==== Атрибути критеріїв пошуку та доступні значення -==== Search conditions attributes and possible values +==== Search condition attributes and possible values [search-type-attribute-values] -//===== Атрибут searchType та доступні значення -===== searchType attribute +[#search-type-attribute-values] +===== _searchType_ attribute -//Атрибут `*searchType*` в елементі `**` вказує на тип операції, яку необхідно виконати для певної колонки при пошуку в таблиці. -The `*searchType*` attribute in the `**` element indicates the type of operation to perform for a specific column when searching the table. +The attribute `*searchType*` in the element `**` indicates the type of operation needed for a specific column when searching in a table. -//_Атрибут приймає наступні значення:_ -_Possible values:_ +*_The attribute accepts the following values:_* -`*equal*`:: - -//повертає значення, що мають точну відповідність (дорівнюють) заданим. -Returns values that exactly match the one you specified. +*equal*:: +returns values with an exact match (equal) to the specified ones. + .XML schema -==== [source, xml] ---- @@ -577,38 +518,138 @@ Returns values that exactly match the one you specified. ---- ++ +.Description of the table `table_one` +-- +* `name` -- field name +* `type` -- field type +* `uuid` -- unique identifier +-- ++ +[NOTE] +==== +[%collapsible] +.What is the `count` function needed for? +===== +The element `` in the XML schema does not perform a search or data filtering function. + +The `count` function in SQL counts the number of rows in the selection you get from the query. In our example ``, the `count` function counts the number of records in the `uuid` column and returns this number under the alias `cnt`. + +Here's how it works: + +* `name="count"` indicates that you use the `count` function. +* `alias="cnt"` specifies an alias for the computation result, which can be used for further references. +* `columnName="uuid"` specifies the column where you want to count the number of records. + +For example, if there are ten records in the `uuid` column, the result of this function will be the number 10, which can be used in subsequent operations or displayed as a query result. +===== ==== ++ +.SQL script (_search query_) +[source,sql] +---- +SELECT name, type FROM table_one +WHERE name = 'search_value' +---- + ++ +.HTTP request with search parameter for the `equal` operation +[source,bash] +---- +GET https://.../search-condition?name=search_value&type=... +---- ++ +This HTTP request performs a search on the resource `https://.../search-condition` for an exact match of the name (field `name`) and type (field `type`) with the specified value. Each search parameter is defined as a separate request parameter, making it more informative and understandable. + ++ +.HTTP request with reference values +[source,bash] +---- +GET https://api.example.com/search-condition?name=John&type=Employee +---- + ++ +In this example: + +* `https://api.example.com/search-condition` -- base URL of the resource and endpoint where the search is performed. +* `name=John` -- search parameter by name, where the value `John` is searched for in the `name` field. +* `type=Employee` -- search parameter by type, where the value `Employee` is searched for in the `type` field. `*startsWith*`:: -//повертає значення зі вказаним префіксом, тобто значення, які "починаються із" заданої умови. -Returns values with the prefix you specified--that is, values that "start with" the given condition. +returns values with the specified prefix, i.e., values that "start with" the specified condition. + -.XML schema example -==== +._XML schema_ [source, xml] ---- - - + + - + - + ---- -==== ++ +.Description of the table `consent_table` +-- +* `consent_id` -- consent identifier, which links to another table (_fetch type:_ `entity`). ++ +TIP: For more information about the `fetchType` attribute and its application scenarios, see section xref:#nested-structures[]. +* `document_copy` -- a scanned copy of the document. +* `legal_entity_name` -- name of the legal entity, which can be used for "starts with" type of search. +* `subject_id` -- subject identifier. +-- + ++ +.SQL script (_search query_) +[source,sql] +---- +SELECT legal_entity_name FROM consent_table +WHERE legal_entity_name LIKE 'search_value%' +ORDER BY legal_entity_name ASC; +---- ++ +-- +In this query: + +* Names of legal entities (`legal_entity_name`) are selected from the `consent_table`. +* The search is based on the "starts with" principle for the value `'search_value'`. +* The results are alphabetically sorted by the legal entity name (ascending). +-- ++ +.HTTP request with search parameter for the `startsWith` operation +[source,bash] +---- +GET https://.../subject-name-starts-with?legal_entity_name=search_value +---- ++ +This HTTP request uses the GET method to query the server to retrieve results that match the "starts with" search criteria for the `legal_entity_name` field. + ++ +.HTTP request with reference values +[source,bash] +---- +GET https://api.example.com/subject-name-starts-with?legal_entity_name=Corp +---- + ++ +In this example: + +* `https://api.example.com/subject-name-starts-with` -- this is the base URL of the resource where the search takes place. +* `legal_entity_name=Corp` -- request parameter indicating a search for legal entities whose names start with `Corp`. + +Sure, here's the translation while preserving the syntax: `*contains*`:: -//повертає значення, які мають збіги із вказаним значенням умови у будь-якому місці рядка (на початку, в середині, в кінці тощо). -Returns values that match the value you specified anywhere in the string (beginning, middle, or end). +returns values that match the specified condition value anywhere in the string (at the beginning, middle, end, etc.). + .XML schema -==== [source, xml] ---- - + @@ -616,114 +657,274 @@ Returns values that match the value you specified anywhere in the string (beginn ---- ++ +TIP: Learn more about the `limit` attribute in section xref:limit-attribute-values[]. ++ +.Description of the `table_two` table +-- +* `name` (alias `tt_name`) -- name of the item. +* `code` -- item code that can be used for "contains" type search. +* `sum` -- a function that calculates the sum of the values in the `code` column and returns this number under the alias `sm`. ++ +[NOTE] +==== +[%collapsible] +.What is the purpose of the `sum` function? +===== +The `` element in the XML schema does not perform a search or data filtering function. + +The `sum` function in SQL calculates the total sum of values in a specified selection column. In our example ``, the `sum` function calculates the total sum of values in the `code` column and returns this sum under the alias `sm`. + +Here's how it works: + +* `name="sum"` indicates that you use the `sum` function. +* `alias="sm"` specifies an alias for the calculation result, which can be used for further references to this result. +* `columnName="code"` specifies the column where you want to calculate the total sum of values. + +For example, if the `code` column has entries with values 10, 20, and 30, the result of this function will be the number 60, which can be used in further operations or output as a query result. +===== ==== +-- + ++ +.SQL script (_search query_) +[source,sql] +---- +SELECT name, code FROM table_two +WHERE code LIKE '%search_value%' +---- ++ +-- +In this query: + +* Names (`name`) and codes (`code`) are selected from the `table_two` table. +* The type performs the search "contains" for the value `'search_value'`, which can be anywhere in the string. +-- + ++ +.HTTP request with the `contains` search parameter +[source,bash] +---- +GET https://.../search-condition?code=search_value +---- ++ +This HTTP request uses the GET method to query the server to obtain results that match the "contains" search criterion for the `code` field. + ++ +.HTTP request with reference values +[source,bash] +---- +GET https://api.example.com/search-condition?code=1234AB +---- + ++ +In this example: + +* `https://api.example.com/search-condition` -- is the base URL of the resource and endpoint where the search is conducted. +* `code=1234AB` -- a query parameter that specifies a search for codes containing `1234AB`. `*in*`:: -//повертає значення, що мають точну відповідність (дорівнюють) заданим значенням у масиві. Подібний до `equal`, але множинний. -Returns values that exactly match the values you specified in an array. Similar to `equal` but works with multiple values. +returns values that match (equal) the specified values in the array. Similar to `equal`, but multiple. + .XML schema -==== [source, xml] ---- - - - - - + + + + + ---- -==== -//.HTTP-запит із використанням оператора in + -.An HTTP request using the "in" operator -==== -[source,http] +.Description of the `users` table +-- +* `first_name` -- user's first name, returned as a result. +* `last_name` -- user's last name, also returned. +* `user_age` -- user's age, which can be used for multiple searches using the `in` operator. + +TIP: Learn more about the `returning` attribute in section xref:#returning-attribute-values[]. +-- + ++ +.SQL script (_search query_) +[source,sql] ---- -https://..../findInAge?age=18,21,42 +SELECT first_name, last_name FROM users +WHERE user_age IN (search_value) ---- -==== ++ +-- +In this query: + +* First names (`first_name`) and last names (`last_name`) are selected from the `users` table. +* The search is performed by age (`user_age`), which should be one of the values specified in the set `search_value`. +-- + ++ +.HTTP request using the `in` operator +[source,bash] +---- +GET https://.../find-in-age?user_age=search_value +---- ++ +This HTTP request uses the GET method to query the server to obtain results that match the "in list" search criterion for the `user_age` field. + ++ +.HTTP request with reference values +[source,bash] +---- +GET https://api.example.com/find-in-age?user_age=25,30,35 +---- + ++ +In this example: + +* `https://api.example.com/find-in-age` -- is the base URL of the resource and endpoint where the search is conducted. +* `user_age=25,30,35` -- a query parameter that specifies a search for users aged 25, 30, or 35 years. `*notIn*`:: -//повертає значення, що не мають відповідність (не дорівнюють) заданим значенням у масиві. Він є протилежним до значення `in` атрибута `searchType`. -Returns values that do not match the values you specified in an array. The opposite of the `in` search type. +returns values that do not match any of the specified values in the array. It is the opposite of the `in` value of the `searchType` attribute. + .XML schema -==== [source, xml] ---- - - - - - - + + + + + + ---- -==== -//.HTTP-запит із використанням оператора notIn + -.An HTTP request using the "notIn" operator -==== -[source,http] +.Description of the `users` table +-- +* `first_name` -- user's first name, returned as a result. +* `last_name` -- user's last name, also returned. +* `user_age` -- user's age, which can be used for multiple searches but excluding the values specified in the `notIn` operator. + +TIP: Learn more about the `returning` attribute in section xref:#returning-attribute-values[]. +-- + ++ +.SQL script (_search query_) +[source,sql] ---- -https://..../findNotInAge?age=18,21,42 +SELECT first_name, last_name FROM users +WHERE user_age NOT IN (search_value) ---- -==== ++ +-- +In this query: + +* First names (`first_name`) and last names (`last_name`) are selected from the `users` table. +* The search is performed by age (`user_age`), which should NOT be one of the values specified in the set `search_value`. +-- + ++ +.HTTP request using the `notIn` operator +[source,bash] +---- +GET https://.../find-not-in-age?user_age=search_value +---- ++ +This HTTP request uses the GET method to query the server to obtain results that _DO NOT_ match the "in list" search criterion for the `user_age` field. + ++ +.HTTP request with reference values +[source,bash] +---- +GET https://api.example.com/find-not-in-age?user_age=25,30,35 +---- + ++ +In this example: + +* `https://api.example.com/find-not-in-age` -- is the base URL of the resource and endpoint where the search is conducted. +* `user_age=25,30,35` -- a query parameter that specifies a search for users who are NOT aged 25, 30, or 35 years. `*between*` :: -//повертає значення, що мають приналежність до заданого діапазону значень (в межах "з"-"до"). -Returns values that belong to the range you specified (from/to). +returns values that belong to a specified range of values (inclusive of both "from" and "to"). + .XML schema -==== [source, xml] ---- - - - - - + + + + + ---- -==== -//.HTTP-запит із використанням оператора between + -.An HTTP request using the "between" operator -==== -[source,http] +.Description of the `users` table +-- +* `first_name` -- user's first name, returned as a result. +* `last_name` -- user's last name, also returned. +* `user_age` -- user's age, which can be used for searching within the specified range (inclusive) using the `between` operator. + +TIP: Learn more about the `returning` attribute in section xref:#returning-attribute-values[]. +-- + ++ +.SQL script (_search query_) +[source,sql] ---- -https://..../findBetweenAge?ageFrom=18&ageTo=42 +SELECT first_name, last_name FROM users +WHERE user_age BETWEEN value_from AND value_to ---- -==== ++ +-- +In this query: + +* First names (`first_name`) and last names (`last_name`) are selected from the `users` table. +* The search is performed by age (`user_age`), which should fall within the range from `value_from` to `value_to` (inclusive). +-- + ++ +.HTTP request using the `between` operator +[source,bash] +---- +GET https://.../find-between-age?user_age_from=value_from&user_age_to=value_to +---- ++ +This HTTP request uses the GET method to query the server to obtain results that match the "between" search criterion for the `user_age` field. + ++ +.HTTP request with reference values +[source,bash] +---- +GET https://api.example.com/find-between-age?user_age_from=20&user_age_to=30 +---- + ++ +In this example: + +* `https://api.example.com/find-between-age` -- is the base URL of the resource and endpoint where the search is conducted. +* `user_age_from=20&user_age_to=30` -- query parameters that specify a search for users aged between 20 and 30 years (inclusive). [limit-attribute-values] -//===== Атрибут limit та доступні значення -===== limit attribute +[#limit-attribute-values] +===== _limit_ attribute -//Атрибут `*limit*` визначає максимальну кількість результатів (рядків), які повертаються до API за пошуковою умовою. The `*limit*` attribute specifies the maximum number of results (rows) to return in an API response for a search condition. Possible values: :: -//* `*limit="all"*` -- повертає усі результати за умовою пошуку; * `*limit="all"*`: Returns all results for a search condition. -//* `*limit="10"*` (тобто конкретні числа як String) -- повертає обмежену кількість результатів за умовою пошуку. * `*limit="10"*` (any number provided as string): Returns a limited number of results for a search condition. + -//NOTE: Якщо не вказати атрибут, повертатимуться усі записи за умовою. NOTE: If this attribute is not specified, all results are returned. -//Наприклад, якщо атрибут *limit* у тегу `**` має значення *`10`*, це означає, що максимальна кількість результатів, які повертатимуться до API за пошуковою умовою, становитиме `*10*`. For example, if the *limit* attribute in the `**` tag has a value of *10*, the maximum number of results that the API for the search condition will return will be 10. -//.Простий критерій пошуку із використанням атрибута limit .A simple search condition using the "limit" attribute ==== [source,xml] @@ -737,27 +938,21 @@ For example, if the *limit* attribute in the `* ---- ==== -//Іншими словами, якщо у таблиці `*search_condition_simple_test*` більше 10 записів, які відповідають критеріям пошуку, що визначені у тегу `**`, а атрибут `*limit*` має значення `*10*`, то пошукова умова поверне лише перші 10 рядків. In other words, if the `*search_condition_simple_test*` table has more than 10 records that meet the search criteria defined in the `**` tag, and the `*limit*` attribute is set to `*10*`, the search condition will return only the first 10 rows. [indexing-attribute-values] -//===== Атрибут indexing та доступні значення -===== indexing attribute +[#indexing-attribute-values] +===== _indexing_ attribute -//Атрибут `*indexing*` дозволяє автоматично створювати індекси на колонки, по яких відбувається пошук. The `*indexing*` attribute automatically creates indexes for the columns that are searched. Possible values: :: -//* *`indexing="true"`* -- створює індекс; * *`indexing="true"`*: Create an index. -//* *`indexing="false"`* -- не створює індекс. * *`indexing="false"`*: Don't create an index. + -//NOTE: Можна не вказувати цей атрибут взагалі, якщо не потрібно створювати індекси. *`indexing="false"`* вказується, коли необхідно явно зазначити це на схемі моделі даних. NOTE: You can omit this attribute if you don't need to create indexes. Use *`indexing="false"`* when it is necessary to state this in the data model schema explicitly. -//.Простий критерій пошуку із використанням атрибута indexing .A simple search condition using the "indexing" attribute ==== [source,xml] @@ -771,28 +966,22 @@ NOTE: You can omit this attribute if you don't need to create indexes. Use *`ind ---- ==== -//Атрибут `*indexing="true"*` у тегу `**` вказує на те, що створення індексу для вказаної колонки (`*person_full_name*`) має бути увімкнено. The `*indexing="true"*` attribute in the `**` tag indicates that indexing for the specified column (`*person_full_name*`) must be enabled. -//У такому випадку, якщо атрибут `*indexing*` встановлений як `*true*`, то буде створено індекс для колонки `*person_full_name*`. Індекс дозволяє прискорити пошук даних в таблиці, зменшити час виконання запитів і зробити їх більш ефективними. In this example, an index will be created for the `*person_full_name*` column since `*indexing*` is set to `*true*`. The index speeds up the search, reduces the time it takes to process the queries, and makes them more efficient. [returning-attribute-values] -//===== Атрибут returning та доступні значення -===== returning attribute +[#returning-attribute-values] +===== _returning_ attribute -//Атрибут `*returning*` вказує, чи повинно значення повертатися у відповіді до API. The `*returning*` attribute indicates whether to return a value in an API response. Possible values: :: -//* *`returning="true"`* -- повертає значення; * *`returning="true"`*: Return the value. -//* *`returning="false"`* -- не повертає значення. * *`returning="false"`*: Don't return the value. -//.Критерій пошуку з атрибутом returning .Search condition using the "returning" attribute ==== [source,xml] @@ -821,52 +1010,38 @@ Possible values: :: ---- ==== -//TODO: ua-specific edrpou field is mentioned in the example -//Атрибут `*returning*` в елементі `**` вказує на те, що значення відповідної колонки повинні повертатися у вихідному наборі даних запита. Якщо атрибут `*returning*` встановлено як `*true*`, значення відповідної колонки будуть включені до результату запита. + If the `*returning*` attribute in the `**` element is set to `*true*`, the values of the corresponding column will be included in the query result. -//У цьому випадку, якщо атрибут `*returning*` встановлено як `*true*`, то для колонок `*person_full_name*`, `*person_pass_number*` та `*consent_date*` з таблиці `*consent_data_person*`, а також для колонок `*legal_entity_name*` та `*edrpou*` з таблиці `*consent_subject*` значення будуть включені до результату запита. In this example, the values of `*person_full_name*`, `*person_pass_number*`, and `*consent_date*` columns from the `*consent_data_person*` table and the `*legal_entity_name*` and `*edrpou*` columns from the `*consent_subject*` table will be included in the query result since `*returning*` is set to `*true*`. -//NOTE: За замовчування `*returning="true"*`. Якщо ви хочете виключити із результату значення певних колонок, вкажіть *`returning="false"`*. NOTE: By default, `*returning*` is set to `*true*`. If you want to exclude the values of specific columns from the response, set *`returning="false"`*. [#pagination-attribute-values] [pagination-attribute-values] -//===== Атрибут pagination та доступні значення -===== pagination attribute +===== _pagination_ attribute -//NOTE: Доступ для запитів від зовнішніх систем надається згідно з наявною реалізацією, додаванням тегу *``* (_див. детальніше у розділі xref:#exposeSearchCondition[]_). NOTE: Allowing external systems to run requests works by adding the *``* tag (for details, jump to xref:#exposeSearchCondition[]). -//_Атрибут *`pagination`* приймає наступні значення:_ _The *`pagination`* attribute can have the following values:_ offset :: -//повертає певну кількість записів, враховуючи пагінацію на основі зміщення. При запиті до API кількість записів регулюється параметром *`limit`*. Returns a specified number of records, considering offset-based pagination. In an API request, the number of records is determined by the *`limit`* parameter. + -//NOTE: За замовчуванням пагінація увімкнена і налаштована як `*pagination="offset"*`. NOTE: By default, pagination is enabled and set as `*pagination="offset"*`. + [TIP] ==== -//Як працює `*offset*` та *`limit`*? :: How do offset and limit work? :: + -//Наприклад, таблиця містить 100 записів. Consider a table with 100 records. + -//Ви хочете отримати відразу не усі 100, а перші 10 (з 1 по 10) -- тоді передаєте до API `offset=0` (або не вказуєте взагалі), `limit=10`. To get just the first 10 records (from 1 to 10), set your API request to `offset=0` (or omit it) and `limit=10`. + -//Тепер, якщо потрібно отримати наступні 10 записів (з 11 по 20), то встановлюємо `offset=10`, `limit=10`. Якщо ж потрібно отримати записи з 11 по 30, то встановлюємо `offset=10`, `limit=20` тощо. To get the next 10 records (from 11 to 20), set `offset=10` and `limit=10`. If you need to get the records from 11 to 30, set `offset=10` and `limit=20`, and so on. + -//Таким чином, відбувається зміщення на 1 десяток від значення, яке ви передаєте у запиті. This way, the records in a request are offset by 10s. ==== -//.Створення пошукового запита з атрибутом pagination="offset" у моделі даних реєстру + .Creating a search condition in the registry data model using the pagination="offset" attribute ==== @@ -884,10 +1059,8 @@ This way, the records in a request are offset by 10s. ---- -//Цей Search Condition створює умову пошуку із назвою `*get_requests_by_search_param_offset*` і дозволяє виконувати пошук запитів із таблиці `*request_by_search_param*` за допомогою параметра *`search_param`* з пагінацією на основі зміщення (атрибут *`pagination="offset"`*). This example creates a search condition called `*get_requests_by_search_param_offset*` and allows querying the `*request_by_search_param*` table using the `search_param` parameter with offset-based pagination (the `pagination="offset"` attribute). ==== -//.HTTP-запит до ресурсу із query-параметрами offset та limit + .An HTTP request using query "offset" and "limit" parameters ==== @@ -918,12 +1091,9 @@ swagger::{attachmentsdir}/data-model/sc/pagination/swagger-offset.yml[] ==== page :: -//повертає інформацію про поточну сторінку, кількість елементів на сторінці, загальну кількість елементів та загальну кількість сторінок. Returns information about the current page, the number of items on the page, the total number of items, and the total number of pages. + -//NOTE: За замовчуванням пагінація увімкнена і налаштована як `*pagination="offset"*`. NOTE: By default, pagination is enabled and set as `*pagination="offset"*`. -//.Створення пошукового запита з атрибутом pagination="page" + .Creating a search condition using the pagination="page" attribute ==== @@ -941,10 +1111,8 @@ NOTE: By default, pagination is enabled and set as `*pagination="offset"*`. ---- -//Цей Search Condition створює умову пошуку з назвою `*get_requests_by_search_param_page*`, яка дозволяє виконувати пошук запитів з таблиці `*request_by_search_param*` за допомогою параметра `*search_param*` з пагінацією на основі сторінок (атрибут `*pagination="page"*`). This example creates a search condition called `*get_requests_by_search_param_page*` and allows querying the `*request_by_search_param*` table using the `search_param` parameter with page-based pagination (the `pagination="page"` attribute). ==== -//.HTTP-запит до ресурсу із query-параметрами pageSize та pageNo + .An HTTP request using query "pageSize" and "pageNo" parameters ==== @@ -953,11 +1121,8 @@ This example creates a search condition called `*get_requests_by_search_param_pa https://registry-rest-api-mdtu-ddm-edp-cicd-platform-demo.apps.cicd2.mdtu-ddm.projects.epam.com/get-requests-by-search-param-page?pageSize=10&pageNo=0 ---- -//Query-параметри запита: :: Request query parameters: :: -//* `*pageSize*` -- бажана кількість елементів на сторінці. За замовчуванням `10`. * `*pageSize*`: The number of elements on the page. `10` by default. -//* `*pageNo*` -- бажаний номер сторінки. За замовчуванням `0`. * `*pageNo*`: The page number. `0` by default. ==== + @@ -980,18 +1145,12 @@ Request query parameters: :: } ---- -//API повертає наступні атрибути у відповіді: :: API returns the following attributes: :: -//* `*content*` -- масив елементів, що підпадають під вказані критерії пошуку. * `*content*`: An array of elements that match the search criteria. -//* `*totalElements*` -- загальна кількість елементів за запитом. * `*totalElements*`: The total number of elements requested. -//* `*totalPages*` -- загальна кількість сторінок за запитом. * `*totalPages*`: The total number of pages requested. -//* `*pageSize*` -- кількість елементів на сторінці. * `*pageSize*`: The number of elements on the page. -//* *`pageNo`* -- номер сторінки що повертається. * *`pageNo`*: The page number being returned. ==== + @@ -1002,21 +1161,20 @@ swagger::{attachmentsdir}/data-model/sc/pagination/swagger-page.yml[] ==== none :: -//атрибут дозволяє вимкнути пагінацію при пошукових запитах до API. + This attribute allows disabling pagination for API queries. + -//NOTE: За замовчуванням пагінація увімкнена і налаштована як `*pagination="offset"*`. + NOTE: By default, pagination is enabled and set as `*pagination="offset"*`. -//.Створення пошукового запита з атрибутом pagination="none" + + .Creating a search condition using the pagination="none" attribute ==== -//TODO: In ua version, the example contains pagination="page" from the previous example. Also, I changed the name of the SC from get_requests_by_search_param_page to get_requests_by_search_param_nopage [source,xml] ---- - - + + @@ -1026,31 +1184,23 @@ NOTE: By default, pagination is enabled and set as `*pagination="offset"*`. ---- -//Цей Search Condition створює умову пошуку з назвою `*get_requests_by_search_param_page*`, яка дозволяє виконувати пошук запитів з таблиці `*request_by_search_param*` за допомогою параметра `*search_param*` без пагінації (атрибут `*pagination="none"*`) -This example creates a search condition called `*get_requests_by_search_param_nopage*` and allows querying the `*request_by_search_param*` table using the `search_param` parameter without pagination (the `pagination="none"` attribute). +This example creates a search condition called `*get_requests_by_search_param_none*` and allows querying the `*request_by_search_param*` table using the `search_param` parameter without pagination (the `pagination="none"` attribute). ==== -//==== Використання операції JOIN з умовами AND та OR ==== Using the JOIN operation with AND and OR conditions -//Операція `**` дозволяє поєднувати таблиці за певними умовами. Використовується при створенні критеріїв пошуку всередині тегу `**` для отримання необхідних даних у зведених таблицях. The `**` operation enables joining tables using different conditions. It is used when creating search conditions inside the `**` tag to get the necessary data in roll-up tables. -//Є 3 основні типи поєднання таблиць за допомогою JOIN: :: There are three main join types: :: -//* *INNER JOIN* -- Перетин даних двох таблиць. Наприклад, *``*. * *INNER JOIN*: An intersection of data from two tables. For example, *``*. -//* *LEFT JOIN* -- вивід даних з першої таблиці (зліва) та приєднання даних другої таблиці (справа), де це можливо. Наприклад, *``*. * *LEFT JOIN*: Extracts data from the first table (left) and joins data from the second table (right) where possible. For example, *``*. -//* *RIGHT JOIN* -- протилежний до LEFT JOIN. Наприклад, *``*. * *RIGHT JOIN*: The opposite of LEFT JOIN. For example, *``*. -//Операцію `**` можна використовувати із додатковими умовами `*and*` та `*or*`, які визначаються в рамках тегу `**` як значення атрибута `*logicOperator*`. You can use the `**` operation with additional `AND` and `OR` operators, which you can define within the `**` tag as the value of the `*logicOperator*` attribute. -//.Використання inner join в рамках критерію пошуку -.Using inner join in a search condition +._Using *inner join* in a search condition_ +[%collapsible] ==== [source,xml] ---- @@ -1076,8 +1226,8 @@ You can use the `**` operation with additional `AND` and `OR` operator ---- ==== -//.Використання inner join з умовою AND в рамках критерію пошуку -.Using inner join with an AND operator in a search condition +._Using *inner join* with an *AND* operator in a search condition_ +[%collapsible] ==== [source,xml] ---- @@ -1104,8 +1254,8 @@ You can use the `**` operation with additional `AND` and `OR` operator ---- ==== -//.Використання inner join з умовою OR в рамках критерію пошуку -.Using inner join with an OR operator in a search condition +._Using *inner join* with an *OR* operator in a search condition_ +[%collapsible] ==== [source,xml] ---- @@ -1137,19 +1287,16 @@ You can use the `**` operation with additional `AND` and `OR` operator [TIP] ==== -//Більше про використання JOIN та додаткові умови дивіться на сторінці xref:data-modeling/data/physical-model/join-and-or-usage.adoc[]. To learn more about using JOIN and additional operators, see xref:data-modeling/data/physical-model/join-and-or-usage.adoc[]. ==== [#dropSearchCondition] -//=== Тег видалення критерію пошуку === Tag for deleting a search condition Change type name: `` :: -//Цей тег надає можливість видалити критерій пошуку. The *`dropSearchCondition`* tag deletes a search condition. - ++ ._XML schema example_ [%collapsible] ==== @@ -1161,54 +1308,63 @@ The *`dropSearchCondition`* tag deletes a search condition. [TIP] ==== -//За детальною інформацією щодо сценарію використання видалення критерію пошуку у секцій xref:data-modeling/data/physical-model/liquibase-changes-management-sys-ext.adoc#delete-sc[XML-шаблон видалення критерію пошуку]. відповідного документа. For details, see the following section: xref:data-modeling/data/physical-model/liquibase-changes-management-sys-ext.adoc#delete-sc[XML template for deleting a search condition]. ==== [#exposeSearchCondition] -//=== Тег визначення точок інтеграції з іншими реєстрами, зовнішніми системами та ШБО "Трембіта" -=== Tag for setting integration points with other registries and external systems +=== Tag for configuring registry API access -Change type name: `` :: +*``* is a tag that allows making your registry accessible for integration from other registries, external systems, and the "Trembita" secure exchange gateway. -//Цей тег надає можливість визначити точки інтеграції з іншими реєстрами, зовнішніми системами та ШБО "Trembita". -The *`exposeSearchCondition`* tag enables you to set integration points with other registries and external systems. +==== Key attributes -//TODO: Following XML example contains trembita attribute, perhaps should be deleted -._XML schema example_ -[%collapsible] -==== +This tag accepts the following attributes: :: ++ +.Attributes of the tag +[%header,cols="3*"] +|=== +| Attribute | Purpose | Default value + +| `name` | Name of the search criterion | Not specified +| `platform` | Grants access to views and the registry's REST API for another registry on the Platform | `false` +| `externalSystem` | Grants access to views and the registry's REST API for an external system | `false` +| `trembita` | Grants access to registry views for participants of the SEI SEIR via the "Trembita" secure exchange gateway using the SOAP protocol | `false` +| `publicAccess` | Determines if there should be public access to the search condition/view | `false` +|=== ++ +[NOTE,caption=UA-specific] +The "Trembita" functionality is specific to the Ukrainian implementation and may not apply or function as described in other contexts or regions. +Please consult the local guidelines or documentation if implementing this outside Ukraine. + +==== Examples + +._Example XML schema with platform, externalSystem, and trembita attributes_ [source, XML] ---- - + ---- -==== -//Тег приймає 4 атрибути: :: -The exposeSearchCondition tag accepts the following attributes: :: +._Example XML schema with the publicAccess attribute_ +[source,xml] +---- + +---- + +==== Recommendations + +* All attributes have a default value of `false`. Consider this when working with the `` tag. +* Ensure that the `name` attribute is always specified, as it's essential for identifying the search condition. -//* `name` -- назва критерію пошуку (search condition); -* *name*: Search condition name. -//* *`platform`* -- для надання доступу до представлень та REST API реєстру для іншого реєстру на Платформі; -* *platform*: A flag that provides access to the registry's views and REST API for another registry on the Platform. -//* *`externalSystem`* -- для надання доступу до представлень та REST API реєстру для зовнішньої системи; -* *externalSystem*: A flag that provides access to the registry's views and REST API for an external system. -//TODO: Omitting ua-specific mention of Trembita -//* *`trembita`* -- Надання доступу до представлень реєстру для сервісів-учасників СЕВ ДЕІР через інтерфейс ШБО "Трембіта" за протоколом SOAP. -//== Керування користувацькими типами даних == Managing custom data types [#ENUM] -//=== Тег створення перелічувального типу даних (ENUM) === Tag for creating an enumerated data type (ENUM) Change type name: ` ` :: -//Цей тег надає можливість створити перелічувальний тип даних (ENUM). This tag creates an enumerated data type (ENUM). -//TODO: Example contains translation attribute with Ukrainian values. ._XML schema example_ [%collapsible] ==== @@ -1224,12 +1380,10 @@ This tag creates an enumerated data type (ENUM). ==== [#Composite] -//=== Тег створення композитного типу даних (Composite) === Tag for creating a composite data type Change type name: ` ` :: -//Цей тег надає можливість створити композитний тип даних (Composite). This tag creates a composite data type. ._XML schema example_ @@ -1250,16 +1404,13 @@ This tag creates a composite data type. ---- ==== -//TIP: За детальною інформацією щодо створення типу даних `ENUM` та `Composite` зверніться до секції xref:data-modeling/data/physical-model/liquibase-changes-management-sys-ext.adoc#create-type-enum-composite[Схема створення типів даних ENUM та Composite] відповідного документа. TIP: For details, see the following section: xref:data-modeling/data/physical-model/liquibase-changes-management-sys-ext.adoc#create-type-enum-composite[Schema for creating enumerated and composite data types]. [#dropType] -//=== Тег видалення типу даних === Tag for deleting a data type Change type name: `` :: -//Цей тег надає можливість видалити тип даних. The *`dropType`* tag deletes a data type. ._XML schema example_ @@ -1272,12 +1423,10 @@ The *`dropType`* tag deletes a data type. ==== [#createDomain] -//=== Тег створення користувацького типу даних з перевіркою на певні умови === A tag for creating a custom data type with optional constraints Change type name: `` :: -//Цей тег надає можливість створити користувацький тип даних з перевіркою на певні умови. The *`createDomain`* tag creates a custom data type with optional constraints. ._XML schema example_ @@ -1294,16 +1443,13 @@ implementation="CHECK (VALUE ~ '^[АВЕІКМНОРСТХ]{2}[0-9]{6}$)"/> ---- ==== -//TIP: За детальною інформацією щодо створення типу даних `Domain` зверніться до секції xref:data-modeling/data/physical-model/liquibase-changes-management-sys-ext.adoc#create-type-domain[Схема створення типу даних Domain] відповідного документа. TIP: For details, see the following section: xref:data-modeling/data/physical-model/liquibase-changes-management-sys-ext.adoc#create-type-domain[Schema for creating a domain data type]. -//=== Тег видалення користувацького типу даних === Tag for deleting custom data types [#dropDomain] Change type name: `` :: -//Цей тег надає можливість видалити користувацький тип даних. The *`dropDomain`* tag deletes a custom data type. ._XML schema example_ @@ -1316,15 +1462,11 @@ The *`dropDomain`* tag deletes a custom data type. ==== [#createMany2Many] -//== Створення типу зв'язку "Багато до багатьох" == Creating a many-to-many relationship type Change type name: `` :: -//Цей тег надає можливість створити особливий тип зв'язку "Багато до багатьох", що виконує наступні функції: The *`createMany2Many`* tag creates a many-to-many relationship type that performs the following functions: -//- створює відбиток даних (view), розгортаючи масив у рядки; -//- створює індекс. * Creates a data view by unwrapping an array into rows. * Creates an index. @@ -1339,21 +1481,17 @@ The *`createMany2Many`* tag creates a many-to-many relationship type that perfor referenceTableName="table2" referenceKeysArray="columns"/> ---- -//_де “columns” має тип "UUID[ ]" -"Масив ідентифікаторів"_ -//TODO: Please double-check this paragraph: -Where "columns" has the following type: "UUID[ ]" -"Array of identifiers" + +* where `"columns"` has the following type: `"UUID[ ]"` -- an array of identifiers. ==== -//TIP: За детальною інформацією щодо створення зв'язків між таблицями зверніться до розділу xref:data-modeling/data/physical-model/liquibase-changes-management-sys-ext.adoc#create-many2many[Схема моделювання зв'язків між сутностями в БД] відповідного документа. TIP: For details on creating relationships between the tables, see the following section: xref:data-modeling/data/physical-model/liquibase-changes-management-sys-ext.adoc#create-many2many[Schema for modeling relationships between database entities]. [#createCompositeEntity] -//== Збереження декількох сутностей в рамках однієї транзакції == Saving multiple entities within a single transaction Change type name: `` :: -//Цей тег надає можливість зберегти декілька сутностей в рамках однієї транзакції. The *`createCompositeEntity`* tag enables you to save multiple entities within a single transaction. ._XML schema example_ @@ -1374,12 +1512,10 @@ The *`createCompositeEntity`* tag enables you to save multiple entities within a ==== [#partialUpdate] -//== Генерація ендпоінтів для часткового оновлення сутності в БД == Generating endpoints for partial updates of database entities Change type name: `` :: -//Цей тег надає можливість генерувати ендпоінти для зміни окремих частин сутності. The *`partialUpdate`* tag generates endpoints for updating separate parts of an entity. ._XML schema example_ @@ -1396,16 +1532,13 @@ The *`partialUpdate`* tag generates endpoints for updating separate parts of an ==== [#create-analytical-views] -//== Керування аналітичними представленнями == Managing analytics views [#createAnalyticsView] -//=== Тег створення аналітичного представлення === Tag for creating an analytics view Change type name: `` :: -//Цей тег надає можливість створити аналітичні представлення на репліці. The *`createAnalyticsView`* tag creates analytics views on a replica. ._XML schema example_ @@ -1423,12 +1556,10 @@ The *`createAnalyticsView`* tag creates analytics views on a replica. ==== [#dropAnalyticsView] -//=== Тег видалення аналітичного представлення === Tag for deleting an analytics view Change type name: `` :: -//Цей тег надає можливість видалити аналітичні представлення на репліці. The *`dropAnalyticsView`* tag deletes analytics views on a replica. ._XML schema example_ @@ -1441,12 +1572,10 @@ The *`dropAnalyticsView`* tag deletes analytics views on a replica. ==== [#createAnalyticsIndex] -//=== Тег створення індексу === Tag for creating an index Change type name: `` :: -//Цей тег надає можливість створити індекс _лише_ на репліці. The *`createAnalyticsIndex`* tag creates an index _only_ on a replica. ._XML schema example_ @@ -1464,16 +1593,11 @@ The *`createAnalyticsIndex`* tag creates an index _only_ on a replica. [#manage-access-to-analytical-data] == Managing access rights to analytical data -//TIP: За детальною інформацією щодо прав доступу до аналітичних даних зверніться до розділу xref:registry-develop:data-modeling/reports/data-analytical-data-access-rights.adoc[Права доступу до аналітичних даних] відповідного документа. -TIP: For details, see xref:registry-develop:data-modeling/reports/data-analytical-data-access-rights.adoc[]. - -//=== Тег надання доступу до всіх аналітичних представлень === Tag for granting access to all analytics views [#grantAll] Change type name: `` :: -//Цей тег надає можливість доступу до всіх аналітичних представлень для певної ролі. The *`grantAll`* tag grants access to all analytics views for a specific role. ._XML schema example_ @@ -1488,12 +1612,11 @@ The *`grantAll`* tag grants access to all analytics views for a specific role. ==== [#revokeAll] -//=== Тег видалення доступу до всіх аналітичних представлень + === Tag for revoking access to all analytics views Change type name: `` :: -//Цей тег надає можливість видаляти права доступу до всіх аналітичних представлень для певної ролі. The *`revokeAll`* tag revokes access to all analytics views for a specific role. ._XML schema example_ @@ -1509,12 +1632,11 @@ The *`revokeAll`* tag revokes access to all analytics views for a specific role. ==== [#grant] -//=== Тег надання доступу до окремого аналітичного представлення + === Tag for granting access to an individual analytics view Change type name: `` :: -//Цей тег надає можливість доступу до окремого аналітичного представлення для певної ролі. The *`grant`* tag grants access to an individual analytics view for a specific role. ._XML schema example_ @@ -1534,12 +1656,11 @@ The *`grant`* tag grants access to an individual analytics view for a specific r ==== [#revoke] -//=== Тег видалення доступу до окремого аналітичного представлення + === Tag for revoking access to an individual analytics view Change type name: `` :: -//Цей тег надає можливість видаляти права доступу до окремого аналітичного представлення для певної ролі. The *`revoke`* tag revokes access to an individual analytics view for a specific role. ._XML schema example_ @@ -1555,35 +1676,29 @@ The *`revoke`* tag revokes access to an individual analytics view for a specific ---- ==== -//== Використання вкладених структур в таблицях БД реєстру за вказаним параметром +[#nested-structures] == Using nested structures in registry database tables by a specified parameter -//=== Тег використання вкладених структур === Tag for using nested structures Change type name: `` :: -//Цей тег надає можливість моделювати вкладені структури в таблицях БД реєстру за вказаним параметром. The *`tableReadParameters`* tag enables you to model nested structures in registry database tables by a specified parameter. [NOTE] ==== -//Для використання у критеріях пошуку (search conditions) додано атрибут `fetchType`. Його зазначають для колонки, що містить масив даних. + You can specify the `fetchType` attribute for a column containing a data array to use it in search conditions. -//Застосовується для двох типів зв'язку: It applies to two types of relationships: -//* Колонок, в яких визначено тип зв`яку "Багато до багатьох" (Many2Many); -//* Колонок, в яких є зовнішній ключ (foreign key) до іншої таблиці. + * Columns with a Many2Many relationship type. * Columns with a foreign key to another table. -//Атрибут `fetchType` приймає наступні значення: The `fetchType` attribute can have the following values: -//* `id` -- отримати ідентифікатори (поведінка за замовчуванням); -//* `entity` -- отримати інформацію з таблиці, до якої налаштовано посилання. + * *`id`*: Fetch identifiers (default value). * *`entity`*: Fetch information from a referenced table. ==== @@ -1615,14 +1730,13 @@ The `fetchType` attribute can have the following values: ---- ==== -//.Використання тегу та атрибуту _fetchType_ при моделюванні даних .Using the "tableReadParameters" tag and "fetchType" attribute when modeling data ==== -//* `Таблиця 1` має зв'язок many2many з `Таблицею 2`. + * *Table 1* has a Many2Many relationship with *Table 2*. -//* `Таблиця 1` має колонку з масивом id (зовнішні ключі до `Таблиці 2`). + * *Table 1* has a column with an array of IDs (foreign keys to *Table 2*). -//* Відповідь при запиті до ресурсу з `Таблиці 1` повинна мати у полі з посиланнями до `Таблиці 2` інформацію, відповідну до записів з `Таблиці 2`. + * When a resource from *Table 1* is requested, *Table 1* fields referencing *Table 2* must have values corresponding to *Table 2* records in the response. .Table 1 @@ -1657,7 +1771,6 @@ The `fetchType` attribute can have the following values: ] ---- -//TODO: Examples contain ua-specific term VPO .An example of creating a `vpo_person_type_contains_name` search condition [source,xml] ---- @@ -1697,7 +1810,6 @@ The `fetchType` attribute can have the following values: ---- -//.Приклад результат виконання запита за замовчуванням (search conditions або resource) .An example of a default response (search conditions or resource) [source,json] ---- @@ -1713,7 +1825,6 @@ The `fetchType` attribute can have the following values: } ---- -//.Приклад результат виконання запита з атрибутом fetchType (search conditions або resource) .An example of executing a request with "fetchType" attribute (search conditions or resource) [source,json] ---- @@ -1738,26 +1849,23 @@ The `fetchType` attribute can have the following values: ---- ==== -//== Керування процесом перевірки коду (Code review pipeline) == Managing the code review process -//У моделі даних можна налаштовувати атрибути, які дозволяють виключати окремі набори змін (changeSets) або цілі файли із процесу розгортання у пайплайні Code Review. Це дозволяє прискорити процес проходження code-review при роботі з моделлю даних реєстру в рамках версій-кандидатів у Кабінеті адміністратора регламентів (_детальніше про особливості роботи з моделлю даних в рамках версій-кандидатів -- див. на сторінці xref:registry-admin/admin-portal/registry-modeling/tables/tables-data-structures.adoc[]_). -You can configure attributes in the data model to exclude individual change sets or entire files from the deployment process of the Code Review pipeline. This helps accelerate the code review process when working with the registry data model in scope of version candidates in the regulations administrator's portal. For details on working with the data model in scope of version candidates, see xref:registry-admin/admin-portal/registry-modeling/tables/tables-data-structures.adoc[]. +You can configure attributes in the data model to exclude individual change sets or entire files from the deployment process of the Code Review pipeline. This helps accelerate the code review process when working with the registry data model in scope of version candidates in the Administrative portal. For details on working with the data model in scope of version candidates, see xref:registry-admin/admin-portal/registry-modeling/tables/tables-data-structures.adoc[]. [TIP] ==== -//*Code Review pipeline* -- це процес перевірки коду, який забезпечує, що розроблюваний код відповідає вимогам якості та стандартам кодування. The *Code Review pipeline* is a process to ensure the code meets quality requirements and coding standards. -//Основним Code Review пайплайном у регламенті вашого реєстру є `*MASTER-Code-review-registry-regulations*`. Знайти його можна за посиланням: + -//https://admin-tools-<службова-назва-реєстру>.apps.envone.dev.registry.eua.gov.ua/cicd/job/registry-regulations/job/MASTER-Code-review-registry-regulations/. The main Code Review pipeline in your registry regulations is `*MASTER-Code-review-registry-regulations*`. You can find it using the following link: -//TODO: ua-specific link -https://admin-tools-.apps.envone.dev.registry.eua.gov.ua/cicd/job/registry-regulations/job/MASTER-Code-review-registry-regulations/. +---- +https://admin-tools-./cicd/job/registry-regulations/job/MASTER-Code-review-registry-regulations/ +---- + +where `` is a name for registry's service and `` is a domain and subdomain names for the cluster instance. -//При роботі із моделлю даних реєстру в рамках версій-кандидатів, Code review пайплайн додатково розгортає тимчасову репліку бази даних реєстру. Відповідний крок показаний на зображенні нижче. -When working with the registry's data model in scope of version candidates, the Code Review pipeline additionally deploys a temporary replica of the registry database. The corresponding step is shown in the image below. +When working with the registry's data model in the scope of version candidates, the Code Review pipeline additionally deploys a temporary replica of the registry database. The corresponding step is shown in the image below. .An overview of the MASTER-Code-review-registry-regulations pipeline image::data-modeling/data/physical-model/code-review/data-model-code-review-01.png[] @@ -1765,19 +1873,15 @@ image::data-modeling/data/physical-model/code-review/data-model-code-review-01.p ==== [configure] -//=== Опис налаштування у моделі даних === Configuring the data model -//Виключити зміни із Code review пайплайну можна за допомогою атрибута `*context="!code-review"*` двома способами: You can exclude changes from the Code Review pipeline using the `*context="!code-review"*` attribute in two ways: -//. Виключити конкретний набір змін (changeSet). Для цього необхідно додати атрибут `*context="!code-review"*` на рівні тегу `**`. . Exclude a specific change set. To do this, add the `*context="!code-review"*` attribute at the `**` tag level. + .Excluding a specific changeSet from the Code Review pipeline image::data-modeling/data/physical-model/code-review/data-model-code-review-1.png[image,width=468,height=56] + -//. Виключити цілий файл зі змінами. Для цього необхідно додати атрибут `*context="!code-review"*` на рівні тегу `**`. . Exclude an entire file with changes. To do this, add the `*context="!code-review"*` attribute at the `**` tag level. + .Excluding a file from the Code Review pipeline @@ -1785,7 +1889,6 @@ image::data-modeling/data/physical-model/code-review/data-model-code-review-2.pn [NOTE] ==== -//Якщо у тегу вже існує атрибут `*context*`, зокрема `*context="pub"*`, то значення `*!code-review*` необхідно додати до цього атрибута через оператор `*and*`. Наприклад: If the tag already contains the `*context*` attribute (for instance, `*context="pub"*`), the `*!code-review*` value should be added to the attribute using the `*and*` operator. For example: [source,xml] @@ -1797,9 +1900,7 @@ context="pub and !code-review" [WARNING] ==== -//Якщо додати *`!code-review`* до changeSet, який вже був розгорнутий, то у першому Code review пайплайні цей changeSet все одно виконається. Однак, після того, як застосувати цей changeSet ще раз, але вже з *`context="!code-review"`*, він буде пропущений у наступних Code review пайплайнах. If you add *`!code-review`* to a changeSet that has already been deployed, this changeSet will still be executed during the first Code Review pipeline. However, after applying the changeSet one more time with *`context="!code-review"`*, it will be skipped in subsequent Code Review pipelines. -//Проте, якщо додати *`!code-review`* до абсолютно нового changeSet, то цей changeSet буде ігнорований не лише у першому Code review пайплайні, а й в усіх наступних. If you add *`!code-review`* to an entirely new changeSet, this changeSet will be ignored during the first Code Review pipeline and all subsequent ones. ==== \ No newline at end of file diff --git a/docs/en/modules/registry-develop/pages/data-modeling/data/physical-model/liquibase-introduction.adoc b/docs/en/modules/registry-develop/pages/data-modeling/data/physical-model/liquibase-introduction.adoc index 041c4556a3..3d557ae83e 100644 --- a/docs/en/modules/registry-develop/pages/data-modeling/data/physical-model/liquibase-introduction.adoc +++ b/docs/en/modules/registry-develop/pages/data-modeling/data/physical-model/liquibase-introduction.adoc @@ -1,153 +1,119 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - -//= Інструмент створення та керування фізичною моделлю даних Liquibase = Liquibase: physical data model creation and management tool +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] + +include::platform:ROOT:partial$admonitions/language-en.adoc[] -//== Вступ == Introduction -//Платформа для розгортання та супроводження державних електронних реєстрів — це набір конструкторів, кожен з яких виконує певну роль. The Platform for deployment and maintenance of state electronic registers is a set of constructors, each of which performs a specific role. -//Для створення фізичної моделі даних реєстру для СКБД PostgreSQL використовується https://docs.liquibase.com/home.html[Liquibase]. The Platform uses https://docs.liquibase.com/home.html[Liquibase] to create a physical data model of the registry for PostgreSQL DBMS. -//Liquibase за замовчуванням підтримує функціональність для розгортання та версіонування об'єктів в базі даних, тобто створення або видалення таблиць, створення зв'язків між цими таблицями, створення views та налаштування обмежень (constraints) тощо. Out of the box, Liquibase supports deploying and versioning objects in a database, that is, creating or deleting tables, establishing relationships between these tables, creating views, setting constraints, and more. -//Для цього Liquibase має власний набір конструкцій -- https://docs.liquibase.com/change-types/home.html[**change types**], кожна з яких визначає певну версію змін до БД, а формується набором XML-тегів. Наприклад, ``, ``, тощо. Liquibase uses its own constructs called https://docs.liquibase.com/change-types/home.html[*Change Types*], each defining a specific version of database changes using XML tags. For example: ``, ``. -//Оскільки в рамках Платформи реєстрів Liquibase використовується як єдиний інструмент для роботи з фізичною моделлю даних в PostgreSQL, то його стандартної функціональності не достатньо з одного боку, а з іншого — деяка функціональність є надлишковою. Since Liquibase is used within the Platform as a single tool for working with the physical data model in PostgreSQL, its out-of-the-box functionality can be insufficient and redundant at the same time. -//NOTE: З метою безпеки, БД-розробники або інші категорії користувачів не мають прямого доступу до даних, тобто вони не зможуть виконати SQL-запит до PostgreSQL напряму. NOTE: For security purposes, database developers and other categories of users do not have direct access to the data, meaning they cannot run SQL queries directly to PostgreSQL. -//Liquibase має набір впроваджених розширень, які: -Liquibase has a set of built-in extensions, which: +Liquibase has a set of built-in extensions, which: :: -//1) розширюють функціональність стандартного додатка Liquibase зовнішнім модулем xref:registry-develop:data-modeling/data/physical-model/liquibase-ddm-ext.adoc[Liquibase DDM Extension]. * Extend the functionality of the standard Liquibase application with an external xref:registry-develop:data-modeling/data/physical-model/liquibase-ddm-ext.adoc[Liquibase DDM Extension] module. -//2) розширюють систему керування змінами моделі даних Liquibase: xref:registry-develop:data-modeling/data/physical-model/liquibase-changes-management-sys-ext.adoc[Створення сценаріїв побудови фізичної моделі даних реєстру за допомогою функціональних розширень Liquibase]. * Extend the Liquibase data model change management system: xref:registry-develop:data-modeling/data/physical-model/liquibase-changes-management-sys-ext.adoc[]. -//:sectnums: - -//== Запуск Liquibase та розширень == Starting Liquibase with extensions -//=== Що відбувається на стороні Java? === What happens on the Java side? -//**Liquibase** - це програмне забезпечення з відкритим кодом, написане мовою Java, що являє собою `.jar`-файл зі стандартною назвою `liquibase.jar`. *Liquibase* is an open-source program written in Java and distributed via a _liquibase.jar_ file. -//Архітектура Liquibase дозволяє розробляти розширення (додаткову функціональність) і цю функціональність складати в інший, окремий `.jar`-файл зі стандартною назвою для розширень — `liquibase-ext.jar` (в нашому випадку — `liquibase-ddm-ext.jar`). The Liquibase architecture allows developing extensions with additional functionality and compiling them into separate .jar files, typically called _liquibase-ext.jar_ (in our case, _liquibase-ddm-ext.jar_). -//==== Локальний запуск Liquibase та розширень із командного рядка ==== Starting Liquibase and extensions locally from the command line -//Для того, аби запрацюв Liquibase та його розширення, необхідно запустити й сам Liquibase, і також підкласти файл з розширеннями в командному рядку. For Liquibase and its extensions to work, you need to start Liquibase with the extensions file from the command line. -//TIP: Приклад локального запуску Liquibase та розширень із командного рядка для ОС Windows: -TIP: Here is an example of starting Liquibase with extensions locally from the Windows command line: - +.Starting Liquibase with extensions locally from the command line for different environments +[tabs] +==== +Windows:: ++ +-- [source, shell script] ---- Java -jar liquibase.jar --driver=org.postgresql.Driver --classpath=postgresql-{version}.jar;liquibase-ddm-ext-{version}.jar --changeLogFile=changeLog.xml --url="jdbc:postgresql://{server_ip}:{server_port}/{db_name}" --username={username} --password={password} --labels="!citus" update -Dbname={db_name} ---- +-- -//TIP: Приклад локального запуску Liquibase та розширень із командного рядка для ОС Linux: -TIP: Here is an example of starting Liquibase with extensions locally from the Linux command line: +Linux:: ++ +-- +[source, bash] +---- +Java -jar liquibase.jar --driver=org.postgresql.Driver --classpath=postgresql-{version}.jar:liquibase-ddm-ext-{version}.jar --changeLogFile=changeLog.xml --url="jdbc:postgresql://{server_ip}:{server_port}/{db_name}" --username={username} --password={password} --labels="!citus" update -Dbname={db_name} +---- +-- +macOS:: ++ +-- [source, bash] ---- Java -jar liquibase.jar --driver=org.postgresql.Driver --classpath=postgresql-{version}.jar:liquibase-ddm-ext-{version}.jar --changeLogFile=changeLog.xml --url="jdbc:postgresql://{server_ip}:{server_port}/{db_name}" --username={username} --password={password} --labels="!citus" update -Dbname={db_name} ---- +-- + +==== -//Оскільки це Java-застосунок, розробник повинен явно вказати наступне: Since this is a Java application, the developer must explicitly specify the following: -//- `liquibase.jar` — файл, який використовується для Liquibase; * The file with Liquibase: `liquibase.jar`. -//- підключаємося до PostgresSQL, відповідно драйвер має бути `org.postgresql.Driver`; * The driver: `org.postgresql.Driver` (since we are connecting to PostgresSQL). -//- розширення знаходяться у файлі `liquibase-ddm-ext-{version}.jar`; * The file with the extensions: `liquibase-ddm-ext-{version}.jar`. -//- changelog, що має застосуватися — `changeLog.xml`. * The changelog to be applied: `changeLog.xml`. -//- username та password, для яких має бути створена сесія підключення до БД. * The username and password for which a session must be created to connect to the database. -//NOTE: Локальний запуск `.jar`-файлів з Liquibase та розширеннями Liquibase є зручним для тестових цілей. У промисловому середовищі буде впроваджено автоматизований процес на базі Jenkins pipelines. В такому випадку вихідні XML-шаблони буду завантажуватися до репозитарію з вихідним кодом певного реєстру, звідки Jenkins автоматично відстежуватиме та застосовуватиме зміни. NOTE: Running _.jar_ files with Liquibase and its extensions locally is convenient for testing. In a production environment, the process is automated by the Jenkins pipelines. In this case, the XML templates are uploaded to the source code repository of a specific registry, where Jenkins tracks and applies changes automatically. -//==== Changelog та changesets в Liquibase ==== Liquibase changelog and changesets -//https://docs.liquibase.com/concepts/basic/changelog.html[**Changelog**] - це файл, який містить записи всіх змін, які вносяться до бази даних. Такі зміни називаються https://docs.liquibase.com/concepts/basic/changeset.html[**changesets**]. Він може бути оформлений одним окремим файлом — таким чином, що всі зміни до структури БД будуть зазначені в одному файлі, а може складатися з окремих файлів, розташованих за певною ієрархією. Тобто, наприклад, візьмемо файл `changeLog.xml`. Він може містити найперші "master" changesets на початку, а далі — лише посилання до окремих файлів з атомарними змінами (changesets). В одному такому файлі може бути описано декілька таких змін. A https://docs.liquibase.com/concepts/basic/changelog.html[changelog] is a text-based file that contains all changes made to the database. An individual unit of change in a changelog is called a https://docs.liquibase.com/concepts/basic/changeset.html[changeset]. A changelog can be set up as a single file or several files arranged in a hierarchy. For example, a _changeLog.xml_ file may contain "master" changesets followed by references to separate files with minor changesets. Each file may contain descriptions of several changesets. -//TIP: Отже, changelog - набір атомарних змін, які називаються changesets, що наповнюють XML-шаблони, які в результаті перетворюються на SQL-запити та виконуються на цільовій базі даних (_див. xref:registry-develop:data-modeling/data/physical-model/liquibase-changes-management-sys-ext.adoc[Створення сценаріїв побудови фізичної моделі даних реєстру за допомогою функціональних розширень Liquibase]_). TIP: In summary, a changelog is a collection of changes called changesets that populate the XML templates, which are then converted into SQL queries and executed on the target database (for details, see xref:registry-develop:data-modeling/data/physical-model/liquibase-changes-management-sys-ext.adoc[]). -//==== Відновлення попереднього стану (Changeset rollback) ==== Changeset rollback -//Кожну зміну (changeset) можна "відкотити" до одного з попередніх станів. Для деяких тегів, наприклад, https://docs.liquibase.com/change-types/community/create-index.html[`createIndex`], rollback реалізований за замовчуванням. Там, де він не реалізований, необхідно в рамках тегу `` додати тег ``. You can revert each changeset to one of the previous states. Rollback statements are implemented automatically for some tags, for example, https://docs.liquibase.com/change-types/community/create-index.html[createIndex]. For custom rollbacks, you need to add the `` tag within the `` tag. -//=== Що відбувається на стороні бази даних? === What happens on the database side? -//Коли вперше застосовується Liquibase, тобто вперше виконується changelog, Liquibase перевіряє наявність двох службових таблиць: When Liquibase applies a changelog for the first time, it verifies that the following two service tables exist in the database: * `ddm_db_changelog` * `ddm_db_change_loglock` -//Таблиця `ddm_db_changelog` зберігає історію застосування changesets в Liquibase. Кожний changeset тут представлений окремим записом. The `ddm_db_changelog` table stores the history of changesets applied in Liquibase. Each changeset is represented as a separate record. -//Найважливіша інформація представлена в колонках `id`, `author` та `filename`, записи в яких зберігають інформацію про ідентифікатор зміни, автора зміни та файл, в якому така зміна застосована. The `id`, `author`, and `filename` columns store the most critical information: the change identifier, change author, and the name of the file in which the change was made. -//Таблиця `ddm_db_change_loglock` використовується для того, щоб Liquibase міг переконатися, що одночасно запущений лише один його екземпляр. The `ddm_db_change_loglock` table ensures that only one instance of Liquibase is running at a time. [TIP] ==== -//Для чого все це фіксується? Why keep track of all this information? -//Якщо повторно виконати один і той самий changelog, Liquibase проаналізує, які з changesets цього changelog ще не були застосовані, та застосує тільки їх. If the same changelog is executed repeatedly, Liquibase will apply only those changesets that have not been applied yet. ==== [checksum] -//==== Checksum як додатковий механізм захисту ==== Additional protection with checksum -//По кожному changeset рахується checksum, тобто його хеш, що представлений колонкою `md5sum`. Liquibase computes a checksum (hash) for each changeset and stores it in the `md5sum` column. -//Якщо адміністратор раптом змінив наявний changeset та намагається виконати його повторно, то Liquibase перевірить колонку `exectype` та її статус (значення) для цього changeset. Якщо статус `EXECUTED` (виконано), то Liquibase встановить, що такий changeset вже було виконано, згенерує для нього checksum із поточної версії, яку адміністратор намагається перевиконати, і, коли хеш-суми не збігатимуться, користувач отримає помилку. If an administrator accidentally modifies an existing changeset and tries to execute it again, Liquibase will check the `exectype` column and its status. If the status is `EXECUTED`, Liquibase will determine that this changeset has already been executed. It will then generate a checksum for the version the administrator is trying to re-execute, and if the hashes don't match, the user will receive an error. -//WARNING: Checksum не може збігатися при зміні changeset. Якщо changeset має статус `EXECUTED`, то він НЕ підлягає модифікації, а лише відновленню до попереднього стану (тобто можна виконати rollback). WARNING: Checksums cannot match when a changeset is modified. A changeset with an `EXECUTED` status should never be modified -- only reverted to a previous state via a rollback. -//NOTE: Є виключні випадки, коли changeset містить зміни, які постійно еволюціонують. В таких випадках модифікація допускається. Коли changeset застосується повторно, то буде позначений в БД статусом `REEXECUTED` (перевиконано). NOTE: There is an exception when a changeset contains changes that constantly evolve. In this case, changeset modification is allowed. When a changeset is applied again, it gains a `REEXECUTED` status in the database. \ No newline at end of file diff --git a/docs/en/modules/registry-develop/pages/data-modeling/data/physical-model/rest-api-view-access-to-registry.adoc b/docs/en/modules/registry-develop/pages/data-modeling/data/physical-model/rest-api-view-access-to-registry.adoc index 9914ff049c..303e77020e 100644 --- a/docs/en/modules/registry-develop/pages/data-modeling/data/physical-model/rest-api-view-access-to-registry.adoc +++ b/docs/en/modules/registry-develop/pages/data-modeling/data/physical-model/rest-api-view-access-to-registry.adoc @@ -1,66 +1,49 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: += Configuring access to the registry's API views +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] -//= Налаштування атрибутів доступу до API-представлень реєстру -= Setting access attributes for registry API views +include::platform:ROOT:partial$admonitions/language-en.adoc[] -//== Загальний опис -== Overview +== General description -//Окрім надання доступу до реєстру для інших реєстрів або зовнішніх систем в адміністративній панелі Control Plane (_див. xref:admin:registry-management/control-plane-registry-grant-access.adoc[]_), адміністратор реєстру має відкрити доступ до представлень (view) та REST API-ендпоінтів, які згенеровані на базі цих представлень, на рівні моделі даних. -In addition to granting access to the registry for other registries or external systems in the Control Plane admin console (see xref:admin:registry-management/control-plane-registry-grant-access.adoc[]), the registry administrator must provide access to the views and REST API endpoints generated based on these views at the data model level. +In addition to granting access to the registry for other registries or external systems in the Control Plane administrative panel (_see xref:admin:registry-management/control-plane-registry-grant-access.adoc[]_), the registry administrator must open access to views and REST API endpoints generated based on these views, at the data model level. -//Налаштування доступу до REST API представлень (view) реєстру відбувається за допомогою спеціальних атрибутів доступу на рівні моделі даних Liquibase. Це дозволяє відкрити доступ до API реєстру, що створюються із відповідних представлень, іншим реєстрам на Платформі або зовнішнім системам. -You can configure access to the registry's REST API views using access attributes at the Liquibase data model level. This way you can provide access to the registry API based on those views for other registries on the Platform or external systems. +Setting access to the REST API views of the registry is done using unique access attributes at the Liquibase data model level. This allows access to the registry's API, created from the corresponding views, to other registries on the Platform or external systems. -//Для цього використовується спеціальний тег *``*. -Access to registry API views is configured using the *``* tag. +For this, a particular tag *``* is used. -//TIP: Опис тегу `` ви можете також переглянути на сторінці xref:data-modeling/data/physical-model/liquibase-ddm-ext.adoc[]. -TIP: For details on the `` tag, see xref:data-modeling/data/physical-model/liquibase-ddm-ext.adoc[]. +TIP: A description of the `` tag can also be reviewed on the page xref:data-modeling/data/physical-model/liquibase-ddm-ext.adoc[]. -//Тег *``* приймає 1 атрибут для назви критерію пошуку (search condition), а також 3 атрибути для різних сценаріїв використання: -The *``* tag accepts several attributes: one for the search condition name, and others for various usage scenarios. +== Main attributes -//* Надання доступу до представлень та REST API реєстру для іншого реєстру на Платформі -- для цього використовується атрибут *`platform`*. -* Providing access to the registry's views and REST API for another registry on the Platform is done via the *`platform`* attribute. -//* Надання доступу до представлень та REST API реєстру для зовнішньої системи -- для цього використовується атрибут *`externalSystem`*. -* Providing access to the registry's views and REST API for an external system is done via the *`externalSystem`* attribute. -//TODO: Omitting ua-specific mention of Trembita -//* Надання доступу до представлень реєстру для сервісів-учасників СЕВ ДЕІР через інтерфейс ШБО "Трембіта" за протоколом SOAP -- для цього використовується атрибут *`trembita`*. +The tag accepts the following attributes: :: ++ +.Attributes of the tag +[%header,cols="3*"] +|=== +| Attribute | Purpose | Default Value -//._Приклад XML-схеми використання тегу та його атрибутів у моделі даних_ -//TODO: Following XML example contains trembita attribute, perhaps should be deleted -._XML schema example of using the tag and its attributes in the data model_ -==== +| `name` | Name of the search criterion | Not specified +| `platform` | Provides access to views and the REST API of the registry for another registry on the Platform | `false` +| `externalSystem` | Provides access to views and the REST API of the registry for an external system | `false` +| `trembita` | Provides access to the registry views for SEV DEIR member services through the "Trembita" BOS interface using the SOAP protocol | `false` +| `publicAccess` | Determines if there should be public access to the search criterion/view | `false` +|=== +== Examples + +._Example of an XML schema with platform, externalSystem, and trembita attributes_ [source, XML] ---- - + ---- -[NOTE] -===== -//* `name` -- назва представлення для критерію пошуку (search condition) -* *name*: Search condition name. -//* `platform` -- для надання доступу має бути у значенні `"true"` -* *platform*: Set to `"true"` to give access. -//* `externalSystem` -- для надання доступу має бути у значенні `"true"`. -* *externalSystem*: Set to `"true"` to give access. -//* `trembita` -- для надання доступу має бути у значенні `"true"` +._Example of an XML schema with the publicAccess attribute_ +[source, XML] +---- + +---- -//Якщо необхідно закрити доступ до представлень API реєстру, то відповідні атрибути мають бути у значенні `false`. -To revoke access to the registry's API views, set the corresponding attributes to `false`. +== Recommendations -//Поточний приклад конфігурації показує, що доступ до даних реєстру може бути відкритий для іншого реєстру на Платформі, а також для зовнішньої системи. Для сервісів, що отримуватимуть дані через SOAP-інтерфейс ШБО "Трембіта", доступ до даних є закритим. -In this example, access to the registry data can be granted to another registry on the Platform, as well as to an external system. -//TODO: once more, skipping trembita -===== -==== \ No newline at end of file +* All attributes have a default value of `false`. Consider this when working with the `` tag. +* Ensure that the `name` attribute is always specified, as it is essential for identifying the search criterion. \ No newline at end of file diff --git a/docs/en/modules/registry-develop/pages/data-modeling/initial-load/data-initial-data-load-pl-pgsql.adoc b/docs/en/modules/registry-develop/pages/data-modeling/initial-load/data-initial-data-load-pl-pgsql.adoc index b8c5eccb8d..bfe59f9003 100644 --- a/docs/en/modules/registry-develop/pages/data-modeling/initial-load/data-initial-data-load-pl-pgsql.adoc +++ b/docs/en/modules/registry-develop/pages/data-modeling/initial-load/data-initial-data-load-pl-pgsql.adoc @@ -108,6 +108,7 @@ CALL p_load_table_from_csv('staff','D:\PostgreSQL\csv\staff.csv' To load data into the database, use the standard Liquibase functionality. //=== Приклад XML-шаблону для завантаження даних +[#data-load-xml-template] === An example of an XML template for loading data [source, xml] @@ -175,10 +176,66 @@ File requirements for automatic uploads to the database: //== Рекомендації для завантаження великої кількості даних == Recommendations for loading large amounts of data -//Для завантаження великої кількості даних (понад 1 млн рядків) рекомендується тимчасова зміна конфігурації БД -- у файлі з налаштуваннями PostgreSQL `postgresql.conf` встановити наступні значення для часу очікування підключень між реплікою та основною (master) БД: -If you need to load a large amount of data (over 1 million rows), we recommend temporarily changing the database configuration. Set the following values for the connection waiting time between the replica and the main database in the `postgresql.conf` file: +//Для завантаження великих csv-файлів (десятки і сотні мегабайт) можна використати стандартний SQL код замість процедури. Для коректної роботи реєстру такий SQL код повинен також створити історичні дані (таблиця `\_hst`) та заповнити поля з метаданими (колонки `ddm_`), тобто повторити ті операції що процедура виконує автоматично. В прикладі наведений коректний та найбільш ефективний метод це зробити. +To load large CSV files (tens or hundreds megabytes), standard SQL code can be used instead of the procedure. For proper registry operations, such SQL code should also create historical data (`\_hst` table) and populate metadata fields (`ddm_` columns), essentially replicating the operations that the procedure would perform automatically. The following example demonstrates the correct and most efficient method to do this. +//.Приклад SQL коду для завантаження даних +.Data load using SQL +[source, sql] +---- +-- Create a temporary staging table +-- that matches the format of the CSV file. +CREATE TABLE account_csv_stage (username text, bank_number text); + +-- Load data into the staging table from the CSV +COPY account_csv_stage (username,bank_number) +FROM '${dataLoadPath}account.csv' +WITH (HEADER, FORMAT CSV); + +-- Insert data into the main and historical tables +WITH main_table_cte AS ( + INSERT INTO account ( + username + , bank_number + , ddm_created_by + , ddm_updated_by + ) + SELECT username + , bank_number + , 'admin' + , 'admin' + FROM account_csv_stage + RETURNING *) +INSERT INTO account_hst ( + id + , username + , bank_number + , ddm_created_by + , ddm_created_at + , ddm_dml_op + , ddm_system_id + , ddm_application_id + , ddm_business_process_id) +SELECT id + , username + , bank_number + , ddm_created_by + , CURRENT_TIMESTAMP + , 'I' as ddm_dml_op + , (SELECT ss.system_id + FROM ddm_source_system ss + WHERE ss.system_name ='initial load') ddm_system_id + , (SELECT sa.application_id + FROM ddm_source_application sa + WHERE sa.application_name ='initial load') ddm_application_id + , (SELECT sb.business_process_id + FROM ddm_source_business_process sb + WHERE sb.business_process_name ='initial load process') ddm_business_process_id +FROM main_table_cte; + +-- Remove temporary staging table +DROP TABLE account_csv_stage; ---- -wal_sender_timeout = 900s -wal_receiver_timeout = 900s ----- \ No newline at end of file + +//Таким кодом можна замінити виклик процедури в xref:data-load-xml-template[XML-шаблоні для завантаження даних]. Для кожного завантаження файлу таким методом, варто створювати окремий ченджсет. +This code lets you swap out the procedure call in the xref:data-load-xml-template[XML template used for loading data]. Whenever you use this method to load a file, it's a good idea to make a new changeset for it. \ No newline at end of file diff --git a/docs/en/modules/registry-develop/pages/data-modeling/initial-load/data-initial-data-load-prep.adoc b/docs/en/modules/registry-develop/pages/data-modeling/initial-load/data-initial-data-load-prep.adoc index 00d6a50754..57f0c61a99 100644 --- a/docs/en/modules/registry-develop/pages/data-modeling/initial-load/data-initial-data-load-prep.adoc +++ b/docs/en/modules/registry-develop/pages/data-modeling/initial-load/data-initial-data-load-prep.adoc @@ -1,165 +1,98 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - -//= Підготовка даних до міграції = Preparing data for migration +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] + +include::platform:ROOT:partial$admonitions/language-en.adoc[] -//== Вступ == Introduction -//Завантаження даних до системи (первинне або повторне) на цей час здійснюється за допомогою файлів формату https://uk.wikipedia.org/wiki/CSV[CSV]. Перед тим, як розпочати процес міграції даних зі старого реєстру до нового, необхідно розв'язати організаційні питання взаємодії між власником даних і розробником реєстру. Uploading data into the system, whether initial or ongoing, is implemented via https://uk.wikipedia.org/wiki/CSV[CSV] files. Before migrating data from an old registry to the new one, we recommend resolving organizational issues between the data owner and registry developer. -//== Основні питання, на які варто звернути увагу на етапі підготовки -== Key issues to consider during the preparation stage +== Key issues during the preparation stage -//* Хто готує вихідні файли для завантаження: власник даних або розробник реєстру? * Who prepares the files for the upload: the data owner or registry developer? -//* Як буде відбуватися передача файлу для завантаження: актом прийняття-передання, в робочому порядку, протоколом, супроводжувальним листом? + * Will the file transfer be accompanied by a handover certificate, protocol, accompanying letter, or as part of the standard working procedures? -//* Якщо дані містять персональні дані, тоді повинно бути врегульовано питання безпеки при роботі з файлами. + * If the data contains personal information, you need to work out security requirements. -//* Визначити порядок взаємодії в процесі завантаження файлу розробником: повідомлення про помилки можна висилати в робочому порядку з зазначенням типу і необхідних виправлень. Якщо завантаження виконано успішно — виконавець повідомляє власника даних офіційним листом про успішне завантаження. + * Determine the format of interactions with the developer during the file upload process. This may include error notifications specifying the issue type and required changes or an official letter to notify the data owner of the successful upload. -//* Інші організаційні питання. + * Other organizational issues. -//== Контрольний список готовності даних до міграції == Data migration readiness checklist -//* Описані формати, структура полів і дата модель в стані “To Be”. * Describe the format and structure of fields for the "To be" data model. -//* Виконано зіставлення (mapping) полів дата моделі “As is” із “To be”. + * Map data model fields between the "As is" and "To be" states. -//* Сформульовані правила і вимоги до файлів (шаблонів) завантаження. + * Define the rules and requirements for the upload files (templates). -//== Етапи міграції даних == Data migration stages -//Етапи міграції даних представлені на діаграмі нижче. Data migration stages are presented in the following diagram. image:registry-develop:data-modeling/initial-load/dataload-migration-stages.png[] [#data-load-temp-preparation] -//=== Підготовка шаблонів завантаження даних === Preparing data upload templates -//Шаблон завантаження даних містить технічні описи таблиць даних для завантаження, алгоритми й правила завантаження для поточного шаблону. Кожен шаблон в загальному випадку призначений для однієї або декількох пов'язаних таблиць в новій моделі даних. The data upload template contains technical descriptions of the data tables to load, algorithms, and rules of loading. Each template is commonly used for one or several related tables in the new data model. -//У шаблоні вказується: A template contains the following: -//* Опис усіх полів CSV-файлу даних для завантаження, включаючи: * A description of all the fields in the CSV file, including: -+ -//** Ім'я поля + ** Field name -+ -//** Ознака обов'язковості заповнення поля ** Whether the field is required or not -+ -//** Приклад заповнення поля ** Sample value -+ -//** Коментар ** Comment -//* Опис правил завантаження таблиці нового реєстру на підставі даних для завантаження (черговість в разі декількох пов'язаних таблиць, алгоритми пошуку за ключовими полями, унікальність найменувань і т.п.) * A description of the rules of filling the table in the new registry based on the load data. This may include processing order in case of several related tables, search algorithms by key fields, uniqueness of names, and so on. -+ -//* Опис заповнення безпосередньо полів таблиць нового реєстру в разі, якщо передбачається щось відмінне від перенесення даних «один в один» з файлу даних для завантаження. Актуально для посилальних полів, наприклад. + * A description of how exactly the table fields in the new registry should be filled in case the goal differs from a one-to-one data transfer from a file. Take reference fields, for example. -//В процесі робіт цього етапу, в новому реєстрі має бути доступною функція первинного завантаження. During this stage, the new registry must be ready for the initial data upload. -//=== Виявлення джерел даних === Identifying data sources -//Цей етап краще починати разом з попереднім етапом -- xref:data-load-temp-preparation["Підготовка шаблонів завантаження даних"]. В рамках цього етапу фахівці Замовника визначають, з яких систем або джерел, та які дані можуть бути вивантажені. -//TODO: A customer is mentioned here, as if someone else is our target audience? We recommend starting this stage simultaneously with xref:data-load-temp-preparation[preparing the data upload templates]. At this stage, the experts on the customer's side determine the sources, systems, and types of data that can be downloaded. -//Також слід визначити, які дані, можливо, можуть знадобитися. Як правило, у великих проєктах міграції виявлення повного вичерпного переліку джерел даних триває досить довго і відбувається, виходячи з робіт на подальших етапах. It is also worth determining the data you might need. For large migration projects, identifying a comprehensive list of data sources will take some time and may continue based on subsequent stages. -//На практиці часто трапляються ситуації, коли надалі для забезпечення цілісності інформації деякі дані доводиться переносити з паперових джерел (зацифровувати) або навіть заносити в таблиці зі слів ключових співробітників Замовника. Проте, на цьому етапі необхідно виявити якомога більше потрібних даних. In practice, ensuring the integrity of information may require digitizing data from paper sources and even interviewing key employees. However, it is necessary to discover as much relevant data as possible. -//=== Вивантаження вихідних даних === Extracting source data -//Процес вивантаження даних з історичних реєстрів або систем може тривати довго, особливо якщо реєстр складається із декількох різних підсистем, відповідальні за які різні підрозділи Замовника. -//Необхідно враховувати цей момент при тестових і підсумкових міграціях. Extracting data from historical registries or systems can take some time, especially if the registry consists of several subsystems handled by different departments. You need to consider this during the test and final migrations. -//NOTE: *[red]##Увага!##* Замовник з тих чи інших причин (наприклад, питання безпеки -- зберігання персональних даних) не завжди може вивантажити дані в повному обсязі -- тільки структуру даних та кілька тестових позицій. Таким чином, вірогідним є виникнення ситуації, коли при тестових і підсумкових завантаженнях виявлятимуться невалідніfootnote:[**Невалідний** (_англ. -- invalid_) -- недійсний, невірний, неправильний.] дані у вихідних таблицях, що призводитиме до незапланованих помилок і додаткових трудовитрат на їх виправлення. NOTE: Keep in mind that downloading the data in full may not always be feasible due to security or other considerations, in which case loading is limited to the structure and several test records. This may lead to validation errors and additional efforts to fix them during the test and final data loads. -//Для мінімізації цієї проблеми, слід заздалегідь продумати обсяги тестових вивантажень з історичних реєстрів. Planning the test loads from historical registries in advance can help minimize this issue. -//[[heading,Heading]] -//=== Зіставленняfootnote:[**Data mapping** -- визначення відповідності даних між потенційно різними семантиками одного об'єкта або різних об'єктів.] даних === Data mapping -//Зіставлення даних (data mapping), в загальному, — процес зіставлення даних історичних систем і нової (цільової) системи-приймача, у нашому випадку — старого реєстру і нового, тобто, вихідних даних і даних для завантаження. Етап зіставлення — найбільш трудомісткий етап і може займати понад 50% всіх робіт з міграції. На цьому етапі повною мірою залучається вся робоча група проєкту з міграції. In general, data mapping refers to the process of establishing a connection between the data fields from one system to another. In our case, we are mapping the old and new registries, or source data and the data to be loaded. The mapping stage is the most resource-intensive and can take up more than 50% of all migration work. This stage involves the entire working group of the migration project. -//В процесі зіставлення даних необхідно виділити такі підетапи: The data mapping process involves the following phases: -//* **зіставлення таблиць**; * tables mapping -//* **зіставлення полів**. * fields mapping [#tables-mapping] -//==== Зіставлення таблиць ==== Tables mapping -//**Зіставлення таблиць** або **зіставлення шаблонів** — зіставлення таблиць вихідних даних і шаблонів даних для завантаження. Відповідність може бути як 1:1, так і N:N. В результаті такої роботи складається і підтримується реєстр зіставлення таблиць. Цей підетап є необхідним для наступного підетапу зіставлення полів та відстеження загального стану справ із зіставлення. *Tables mapping*, or *templates mapping*, is the process of mapping the source data tables and data upload templates. The relationship can be one-to-one (1:1) or one-to-many (N:N). The result of this work is the table mapping registry that needs to be compiled and maintained. This phase is the prerequisite for the next phase of fields mapping and tracking the overall mapping status. -//Приблизний вигляд реєстру зіставлення таблиць може бути, наприклад, таким: Here is an example of how a table mapping registry may look like: [options="header"] |======================================================================= -//|Назва шаблону для нового реєстру|Найменування файлу-джерела|Правила формування файлу-джерела|Відповідальна особа|Статус|Коментар -|New registry template name|Source file name|Source file compilation rules|Responsible person|Status|Comment +|New registry template name|Source file name|Source file compilation rules|Responsible person|Status|Comment |`laboratory.xls` - -//|Журнал обліку заяв та внесених до інформаційного переліку лабораторій.xlsx -//Відомості про кадрове забезпечення лабораторій.xlsx - a|* Applications and laboratories registry.xlsx * Laboratories staffing.xlsx -//a|* Виконати аналіз і встановити відбір унікальних значень найменувань лабораторій. -//* Сформувати єдиний перелік лабораторій з унікальними значеннями. - -//*Вимоги до файлу*: - -//Перший рядок - шапка. - -//Кількість стовпців -- в залежності від структури шаблону. - -//Проаналізувати додаткові атрибути, необхідні для заповнення шаблону. - -//Найменування листа завжди "Sheet 1" - a|* Analyze and compile a selection of unique laboratory names. * Create a single list of laboratories with unique values. @@ -171,114 +104,99 @@ a|* Analyze and compile a selection of unique laboratory names. * The sheet must be called "Sheet 1". |Jared O. Holmes - |In progress - |Test comment + |======================================================================= [#fields-mapping] -//==== Зіставлення полів ==== Fields mapping -//**Зіставлення полів** -- це зіставлення полів таблиць в рамках вже наявного зіставлення таблиць. Результатом цієї роботи є реєстр зіставлення полів. -*Fields mapping* is the process of mapping the fields within the current tables mapping. The result of this work is the fields mapping registry. -//Приблизний вигляд реєстру зіставлення полів може бути наступним (на прикладі Реєстру атестованих лабораторій): -Here is an example of how a fields mapping registry may look like for a registry of certified laboratories: +*Fields mapping* is the process of mapping the fields within the current tables mapping. The result of this work is the field mapping registry. + +Here is an example of how a field mapping may look for the _Registry of certified laboratories_: + +[NOTE,caption=UA-specific] +The _Registry of certified laboratories_ is an actual Ukrainian registry (IT system,) but the same approach can be considered for any system. image:registry-develop:data-modeling/initial-load/data-load-prep-fields-mapping.png[] -//В рамках цього етапу необхідно також виконати всі можливі роботи з нормалізації даних. During this stage, you also need to perform data normalization. -//=== Підготовка правил трансформації === Preparing transformation rules -//На підставі узгоджених реєстрів зіставлення полів, фахівці Виконавця розробляють правила трансформації даних. Цей етап може виконуватися одночасно з попереднім -- xref:fields-mapping["Зіставлення полів"]. -Based on the approved fields mapping registry, the experts on the customer's side must develop the data transformation rules. This stage can be performed simultaneously with xref:fields-mapping[fields mapping]. +Based on the approved fields mapping registry, the experts on the customer's side must develop the data transformation rules. This stage can be performed simultaneously with xref:fields-mapping[field mapping]. -//Для оперативної роботи в процесі підготовчих етапів міграції й далі, в ході самої міграції в реєстрі реалізована технічна можливість первинного завантаження. Після відпрацювання етапу зіставлення, на виході повинні з’явитися заповнені файли-шаблони відповідно до вимог заповнення та форматів полів. To speed up the process of preparing for migration and beyond, use the registry's initial data load feature. After the mapping stage, you should have the template files filled out according to the fields format and other requirements. -//==== Підтримувані версії та формати файлів +[supported-files-formats] ==== Supported file versions and formats -//* Для завантаження підтримуються тільки файли формату `.csv`; * Only CSV files are supported for data uploading. -//* зведені таблиці не підтримуються. + * Pivot tables are not supported. -//===== Аналіз файлів для завантаження +[file-analysis] ===== Analyzing the upload files -//* файли CSV підтримують лише одну таблицю на лист. * CSV files support only one table per sheet. -//* кожен стовпчик файлу має заголовок, найменування якого має відповідати найменуванню поля в моделі даних (назва поля в базі даних); + * Each column must have a header whose name must correspond to the field name in the data model (field name in the database). -//* дані не містять об'єднаних рядків або стовпців; + * Data cannot contain merged rows or columns. -//* у файлах CSV як роздільники повинні використовуватися коми. + * Values in CSV files must be separated by commas. -//* Відсутні порожні рядки над заголовками. + * There are no empty rows above the headers. -//Слід враховувати, що файли CSV не підтримують ті ж формати, що й Excel. Якщо файл CSV має поля дати або часу, вони відображатимуться в CSV як рядкові поля. Таким чином, необхідно переконатися, що значення, які можуть починатися з символів "0" (коди, номери телефонів, дата, час тощо), представлені у файлі коректно. Note that CSV files do not support the same data formats as Excel. If a CSV file contains date or time fields, they are stored as strings. Therefore, you must ensure the values that start with zero (such as codes, phone numbers, date, time, and so on) are stored correctly. -//TIP: За детальною специфікацією щодо формату файлів для первинного завантаження даних до БД зверніться до секції xref:data-initial-data-load-pl-pgsql.adoc#initial-load-csv-requirements[Вимоги до файлів для автоматичного завантаження до БД]. TIP: For details, see xref:data-modeling/initial-load/data-initial-data-load-pl-pgsql.adoc#initial-load-csv-requirements[File requirements for automatic uploads to the database]. -//=== Вивантаження, трансформація та завантаження даних === Extract, transform, and load -//В ході попередніх етапів підготовча частина роботи в цілому завершується — виявлені всі джерела даних, виконано вивантаження вихідних даних із джерел, підготовлені шаблони завантаження до цільової бази, підготовлене зіставлення даних і, нарешті, підготовлені правила трансформації даних. The previous steps mark the end of the preparation stage. By now, all data sources are identified, the data is downloaded, the upload templates for the target database are ready, data mapping is prepared, and the transformation rules are defined. -//Починаючи з цього етапу і далі, можлива організація та проведення тестових і підсумкової міграцій. Слід зазначити, що перед фінальною міграцією слід обов'язково виконати декілька тестових. From this stage onwards, you can organize and run the test and final migrations. Note that running several tests before the final migration is highly recommended. -//В ході тестових міграцій Виконавець спільно із Замовником виявляють: Test migrations allow you to: -//* помилки конвертації, помилки завантаження даних; * Discover conversion and data loading errors. -//* проводять попередню оцінку якості даних, що завантажуються до нового реєстру; -* Conduct a preliminary assessment of the quality of the data uploaded to the new registry. -//* за підсумками тестових міграцій складають або актуалізують план підсумкової міграції. + +* Conduct a preliminary assessment of the data quality uploaded to the new registry. + * Draw up or update the final migration plan based on test results. -//=== Узгодження даних === Data validation -//Перевірка якості завантажених даних повинна проводитися як після тестових міграцій, так і по закінченню підсумкової міграції. You need to assess the quality of the loaded data both after test migrations and after the final one. -//Варто звернути увагу, що ті або інші перевірки міграційних даних, питання нормалізації даних необхідно вирішувати протягом усіх міграційних процесів. Необхідно завжди шукати відповіді на запитання, що потрібно зробити на поточному етапі, щоб уникнути помилок на наступних етапах. It is worth noting that various data assessments and normalization steps should be carried out throughout the migration process. Consider what you can do during the current stage to avoid having issues during the next stages. *For example*: -//* перевірка дублювання за ключовими полями -- можна і необхідно виконувати ще з вихідними даними; * Check for duplicates by key fields. This can and should be done even with the original data. -//* встановлення типів полів; + * Define field types. -//* цілісність посилань; + * Check link integrity. -//* математичні нестикування; + * Check for mathematical inconsistencies. -//* перевірки обов'язкового заповнення полів; + * Check that the mandatory fields are filled out. -//* заміна некоректних символів. Наприклад, латинські символи в кириличних полях («о», «а», «е» тощо) -- особливо актуально це для ключових полів; + * Check for invalid symbols, especially for key fields. -//* перевірка значень строкових полів на відповідність типів нового реєстру (обмеження за довжиною); + * Check that the string fields comply with the new registry field types and do not exceed the length limits. -//* перевірка орфографічних помилок у довідниках, особливо тих довідниках, які створювалися додатково; + * Check for spelling errors. -//* вибір типу роздільника: кома або крапка з комою можуть зустрічатися всередині довідника в одному рядку -- тоді доцільно вибирати інші символи, наприклад, `#`, `$` тощо. + * Choose the delimiter type. Commas and semicolons may occur within the same line inside the directory, in which case it is advisable to use other characters--for example, `#` or `$`. -//Після завершення підсумкової міграції відповідно до завчасно визначеної стратегії міграції та плану міграції, приймається рішення щодо подальшої експлуатації історичного реєстру та процедури введення нового реєстру в експлуатацію. After the final migration is completed per the migration strategy and plan, a decision must be made regarding the further usage of the historical registry and the procedure for putting the new registry into operation. -//CAUTION: *[red]##_Важливо!##* Варто пам'ятати, що будь-який проєкт з міграції даних вимагає ретельної підготовки та повинен супроводжуватися індивідуальним планом. Однак, незалежно від типу реєстрів, що мігрують, обсягів баз даних тощо, загальна схема міграції виглядає практично ідентично_. -CAUTION: Each data migration project requires careful preparation and an individual plan. However, the overall migration pattern is almost identical in all cases, regardless of the type of registries being migrated, the number of databases, and other factors. \ No newline at end of file +CAUTION: Each data migration project requires careful preparation and an individual plan. However, the overall migration pattern is almost identical in all cases, regardless of the type of registries being migrated, the number of databases, and other factors. + +== Related pages + +* xref:admin:migration/migration-overview.adoc[] \ No newline at end of file diff --git a/docs/en/modules/registry-develop/pages/it-system-classes.adoc b/docs/en/modules/registry-develop/pages/it-system-classes.adoc index 7f74f44125..6d5eb152e6 100644 --- a/docs/en/modules/registry-develop/pages/it-system-classes.adoc +++ b/docs/en/modules/registry-develop/pages/it-system-classes.adoc @@ -3,7 +3,7 @@ include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc include::platform:ROOT:partial$admonitions/language-en.adoc[] -== What is the Registries Platform? +== What is the _Registries Platform_? The *_Registries Platform_* is a flexible, secure, low-code digital backend for building various IT systems. Let's elaborate: diff --git a/docs/en/modules/registry-develop/pages/registry-admin-study/registry-admin-profile.adoc b/docs/en/modules/registry-develop/pages/registry-admin-study/registry-admin-profile.adoc index 633c5b1ad5..42a98b69e4 100644 --- a/docs/en/modules/registry-develop/pages/registry-admin-study/registry-admin-profile.adoc +++ b/docs/en/modules/registry-develop/pages/registry-admin-study/registry-admin-profile.adoc @@ -3,154 +3,81 @@ include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc include::platform:ROOT:partial$admonitions/language-en.adoc[] -//== Обов'язки та вимоги до адміністратора реєстру == Job description and requirements for the registry administrator position -//Обов'язки та вимоги до адміністратора реєстру передбачають обслуговування, підтримку та моніторинг реєстру і його компонентів, та включають: The responsibilities and requirements for the registry administrator include servicing, supporting, and monitoring the registry and its components. The responsibilities encompass the following activities: -//Розуміння специфіки роботи регламенту реєстру: :: Understanding the specifics of the registry's regulations: :: - -//* Адміністратор має чітко розуміти особливості регламенту, що розгортається у конкретному реєстрі. * The administrator must have a clear understanding of the regulations governing the specific registry in question. -//Керування реєстрами: :: Managing registry: :: -//* Використання централізованого адміністративного інтерфейсу Control Plane для керування реєстрами. * Utilizing the centralized Control Plane administrative interface to manage registries. -//Призначення адміністраторів реєстру: :: Appointing registry administrators: :: - -//* Створення адміністраторів реєстру із відповідними правами доступу. * Creating registry administrators with appropriate access rights. -//Управління користувачами та доступом: :: -Managing users and accesses: :: - -//* Використання Keycloak для управління ідентифікацією та доступом користувачів реєстру. +Managing users and access: :: * Utilizing Keycloak for managing user identification and access to the registry. -//* Встановлення та налаштування процесів автентифікації для кінцевих користувачів. * Setting up and configuring authentication processes for end users. -//Резервне копіювання та відновлення: :: Configuring backup and recovery: :: - -//* Налаштування резервного копіювання та аварійного відновлення ресурсів і бази даних реєстру за допомогою автоматизованих процесів у Jenkins. * Configuring backup and emergency recovery of registry resources and databases through automated processes in Jenkins. -//Оновлення компонентів реєстру: :: Updating registry components: :: - -//* Виконання оновлень компонентів реєстру. * Performing updates to registry components. -//Керування ресурсами компонентів реєстру: :: Managing registry component resources: :: - -//* Налаштування та керування ресурсами сервісів реєстру: CPU, RAM, змінні оточення. * Configuring and managing resource allocation for registry services, such as CPU, RAM, and environment variables. -//Налаштування інтеграційних взаємодій: :: Configuring integration interactions: :: - -//* Налаштування доступу до реєстрів для інших реєстрів на платформі та зовнішніх систем. * Configuring access to registries for other registries on the platform and external systems. -//* Налаштування взаємодії з реєстрами та зовнішніми системами через REST API. * Configuring interactions with registries and external systems through REST API. - -//* Налаштування взаємодії з реєстрами через ШБО "Трембіта" за SOAP-протоколом. * Configuring interactions with registries through the Trembita middleware via the SOAP protocol. -//Робота із ключами цифрового підпису: :: Working with digital signature keys: :: -//* Налаштування та оновленням ключів і сертифікатів цифрового підпису для реєстру (ЕЦП/КЕП). * Configuring and updating keys and digital signature certificates for the registry (digital signature/Qualified Electronic Signature). -//Налаштування доменних імен (DNS): :: Configuring domain name (DNS): :: -//* Налаштування доменних імен для порталів реєстру. * Configuring domain names for registry portals. -//Налаштування обмежень доступу до компонентів реєстру: :: Configuring access restrictions to registry components: :: - -//* Обмеження доступу до реєстрових компонентів за допомогою CIDR. * Restricting access to registry components using CIDR. -//Підтвердження запитів на внесення змін: :: Confirming change requests: :: - -//* Підтвердження або відхилення запитів на внесення змін до реєстру. * Approving or rejecting change requests to the registry. -//Робота з OpenShift-консоллю: :: Working with the OpenShift console: :: - -//* Використання централізованого інтерфейсу OpenShift для моніторингу ресурсів реєстру. * Utilizing the centralized OpenShift interface to monitor registry resources. -//Моніторинг та логування: :: Monitoring and logging: :: - -//* Моніторинг та аналіз метрик системи за допомогою Grafana та Prometheus. * Monitoring and analyzing system metrics using Grafana and Prometheus. -//* Моніторинг логів з використанням Kibana або Openshift-консолі. * Monitoring logs using Kibana or the OpenShift console. -//* Розуміння принципів моніторингу та трейсингу сервісів, використання Kiali та Jaeger. * Understanding the principles of service monitoring and tracing, using Kiali and Jaeger. -//Адміністрування бізнес-процесів: :: Administering business processes: :: - -//* Використання Camunda BPM для моніторингу та відлагодження екземплярів виконання бізнес-процесів, описаних у BPMN-нотації. * Utilizing Camunda BPM to monitor and debug instances of business processes described in BPMN notation. -//Автоматизація: :: Automating processes: :: -//* Знання Jenkins для моніторингу процесів безперервної інтеграції та розгортання (CI/CD). * Experience working with Jenkins for organizing continuous integration and deployment (CI/CD) processes. -//* Навички налаштування та використання VCS git та Gerrit для інтеграції, версіонування та рецензування коду. * Skills in configuring and using Git and Gerrit VCS for integration, versioning, and code review. -//* Знання Nexus для моніторингу та управління артефактами. * Proficiency with Nexus for artifact storage and management. -//Управління налаштуваннями та лімітами доступу до внутрішніх ресурсів: :: Managing internal resources configuration and access limits: :: -//* Конфігурування Kong API-шлюзу, включаючи налаштування лімітів на кількість запитів від клієнта (Rate Limiting). -* Configuring the Kong API gateway, including setting limits on the number of client requests (Rate Limiting). - -//Управління секретами: :: -Managing secrets: :: -//* Використання Hashicorp Vault для управління секретами. -* Using Hashicorp Vault to manage secrets. +* Configuring the Kong API gateway, including setting limits on the number of client requests (_Rate limiting_). -//Моніторинг API-ресурсів реєстру: :: Monitoring registry API resources: :: -//* Розуміння концептів REST API. * Understanding REST API concepts. -//* Знання OpenAPI Specification (OAS). * Knowledge of OpenAPI Specification (OAS). -//* Використання Swagger для перегляду згенерованих API-точок доступу реєстру. * Using Swagger to view generated registry API endpoints. -//Робота з даними реєстру: :: Working with registry data: :: - -//* Знання PostgreSQL. * Knowledge of PostgreSQL. -//* Робота з операційними та аналітичними даними реєстру за допомогою pgAdmin та подібних інструментів. * Working with operational and analytical registry data using pgAdmin and similar tools. -//Налаштування поштового сервера: :: Configuring mail server: :: -//* Налаштування підключення до платформного поштового сервера для забезпечення обміну повідомленнями у реєстрі. -* Configuring connection to the platform's mail server to facilitate message exchange within the registry. +* Configuring connection to the external mail servers to facilitate Email messaging within the registry. -//== Пов'язанні сторінки == Related pages -//Детальну інформацію щодо технологій, які має використовувати адміністратор при роботі з реєстром, ви можете переглянути на сторінці xref:arch:architecture/platform-technologies.adoc[]. For detailed information on the technologies that the administrator should utilize when working with the registry, please refer to the xref:arch:architecture/platform-technologies.adoc[] page. \ No newline at end of file diff --git a/docs/en/modules/registry-develop/pages/registry-admin-study/registry-admin-study.adoc b/docs/en/modules/registry-develop/pages/registry-admin-study/registry-admin-study.adoc index 50cfa47c73..e602c4822d 100644 --- a/docs/en/modules/registry-develop/pages/registry-admin-study/registry-admin-study.adoc +++ b/docs/en/modules/registry-develop/pages/registry-admin-study/registry-admin-study.adoc @@ -116,6 +116,8 @@ Actual configurations are applied to the registry through the convenient interfa === Setting up the local environment +We recommend configuring your local environment to make working with the registry and its entities more convenient. Install the following tools on your machine: + include::partial$snippets/study/local-environment-setup-en.adoc[] === Development tools: work environment diff --git a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/overview.adoc b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/overview.adoc index bcddf69f96..8eda532aa8 100644 --- a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/overview.adoc +++ b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/overview.adoc @@ -3,27 +3,10 @@ include::ROOT:partial$templates/document-attributes/default-set-en.adoc[] include::ROOT:partial$admonitions/language-en.adoc[] - == Functional capabilities -//Кабінет адміністратора регламентів (Адміністративний портал) -- це інструмент, призначений для розробників та моделювальників реєстру, який надає користувачам наступні функціональні можливості: The administrative portal is an instrument for Registry developers and modelers, which provides the users with the following functional capabilities: - -//// -Управління версіями регламенту:: -* [*] Огляд майстер-версії регламенту; -* [*] Створення запитів на внесення змін; -* [*] Активація запита на внесення змін; -* [*] Перегляд запитів на внесення змін; -* [*] Перегляд статусів сутностей-складових у версії-кандидаті; -* [*] Внесення змін до складових версії-кандидата; -* [*] Автоматичне оновлення та актуалізація стану відкритих запитів на внесення змін; -* [*] Інтеграція запитів на внесення змін до майстер-версії регламенту; -* [*] Перегляд метаданих відкритого запита на внесення змін до регламенту. Застосування та відкликання запита; -* [*] Перевірка та фіксація наявності конфліктів запита на внесення змін до майстер-версії регламенту. -//// - Regulations version management:: * [*] Viewing regulations master-version; * [*] Creating requests for changes; @@ -36,55 +19,23 @@ Regulations version management:: * [*] Viewing open change request metadata. Applying and recalling request; * [*] Checking and recording change request conflicts with the master-version. - -//// -Моделювання регламенту:: -* [*] Управління глобальними налаштуваннями реєстру; -* [*] Перегляд та вивантаження шаблонів звітів; -* [*] Перегляд переліку таблиць моделі даних та їх структур; -* [*] Управління бізнес-процесами. -//// - Regulations modeling:: * [*] Registry global configuration management; * [*] Viewing and downloading report templates; * [*] Viewing the list of data model tables and their structures; * [*] Business Process management. - - -//// -Управління користувачами:: -* [*] Завантаження користувачів в систему. -//// User management:: * [*] Importing users into the system. - -//// -Зв'язок зі службою підтримки:: -* [*] Зв'язок зі службою підтримки під час виникнення некритичних помилок -//// Contacting support service:: * [*] Contacting support for non-critical errors. - -//.Функціональні можливості адміністративного порталу .Administrative portal functional capabilities image::registry-admin/admin-portal/admin-portal-new-diagram.png[] -//== Огляд секції == Section overview - -//// -* [*] xref:registry-admin/admin-portal/version-control/version-control-overview.adoc[Управління версіями регламенту] -* [*] xref:registry-admin/admin-portal/registry-modeling/overview.adoc[Моделювання регламенту] -* [*] xref:registry-admin/admin-portal/admin-portal-user-mgmt.adoc[Управління користувачами] -* [*] xref:registry-admin/admin-portal/error-non-critical.adoc[Зв'язок зі службою підтримки] -//// - - * [*] xref:registry-admin/admin-portal/version-control/version-control-overview.adoc[] * [*] xref:registry-admin/admin-portal/registry-modeling/overview.adoc[] * [*] xref:registry-admin/admin-portal/admin-portal-user-mgmt.adoc[] diff --git a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/overview.adoc b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/overview.adoc index 89eeb725dd..18628c2805 100644 --- a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/overview.adoc +++ b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/overview.adoc @@ -1,2 +1,17 @@ -//= Моделювання регламенту -= Registry modeling \ No newline at end of file += Registry regulations modeling +:sectlinks: +:sectanchors: + +include::platform:ROOT:partial$admonitions/language-en.adoc[] + +The *_Registry regulations modeling_* section provides essential tools and methods for effective registry development and management. It begins with setting the _global parameters_ and transitioning into the configuration of _business process models_. Further, it delves into the design of _user interface forms_, facilitating data interaction. Integral to this process are _tables_—fundamental structures storing registry data. For those seeking precision, modeling the structure through an _XML code editor_ provides an advanced approach. Additionally, this section encompasses the management of _analytical reporting templates_, ensuring comprehensive data representation. + +For more context, refer to the dedicated section pages. + +== Section overview + +***** xref:registry-develop:registry-admin/admin-portal/registry-modeling/registry-global-settings.adoc[] +***** xref:registry-develop:registry-admin/admin-portal/registry-modeling/process-models/process-models-overview.adoc[] +***** xref:registry-develop:registry-admin/admin-portal/registry-modeling/ui-forms/ui-forms-overview.adoc[] +***** xref:registry-develop:registry-admin/admin-portal/registry-modeling/tables/tables-overview.adoc[] +***** xref:registry-develop:registry-admin/admin-portal/registry-modeling/report-templates.adoc[] \ No newline at end of file diff --git a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/components/edit-groovy-scripts.adoc b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/components/edit-groovy-scripts.adoc index 2d3b933490..d213cc031a 100644 --- a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/components/edit-groovy-scripts.adoc +++ b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/components/edit-groovy-scripts.adoc @@ -1,98 +1,59 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - -//= Редагування скриптів бізнес-процесів у візуальному редакторі коду = Editing business process scripts in a visual code editor +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] + +include::platform:ROOT:partial$admonitions/language-en.adoc[] -//== Загальний опис == General description -//Розробник регламенту реєстру може у вбудованому редакторі діаграм *BPMN.iO* редагувати https://uk.wikipedia.org/wiki/Groovy[*Groovy*]-скрипти через візуальний редактор коду. Для цього імплементовано рішення https://microsoft.github.io/monaco-editor/[Monaco Editor], візуалізоване темою *Visual Studio Dark*. The developer of the registry regulations can edit https://uk.wikipedia.org/wiki/Groovy[*Groovy*] scripts using the visual code editor in the embedded *BPMN.iO* diagram editor. The solution implements the https://microsoft.github.io/monaco-editor/[Monaco Editor], visualized with the *Visual Studio Dark* theme. -//Рішення є збагаченим вебредактором коду (спрощеною версією середовищ розробки IDE), яке дозволяє набагато ефективніше працювати із Groovy-скриптами у бізнес-процесах. Інструмент підтримує основні функції при роботі з вихідним кодом, дозволяючи створювати та редагувати скрипти в єдиному місці -- скрипт-задачах бізнес-процесів регламенту, не виходячи за межі середовища для використання сторонніх настільних додатків. -The solution provides an enriched web code editor (a simplified version of an IDE development environment) that significantly enhances working with Groovy scripts in business processes. The tool supports essential functions for working with source code, allowing you to create and edit scripts in a single place -- the script tasks of the registry's business processes, without the need for external desktop applications. +The solution provides an enriched web code editor (a simplified version of an IDE development environment) that significantly enhances working with Groovy scripts in business processes. The tool supports essential functions for working with source code, allowing you to create and edit scripts in a single place—the script tasks of the registry's business processes, without the need for external desktop applications. -//Підтримуються наступні функції при роботі з редактором: :: The following features are supported when working with the editor: :: -//* [*] Автодоповнення -//* [*] Автодоповнення для кастомних функцій -//* [*] Синтаксичний аналіз коду та перевірка помилок -//* [*] Підтримка коментарів -//* [*] Згортання та розгортання блоку з кодом * [*] Autocompletion * [*] Autocompletion for custom functions * [*] Syntax code analysis and error checking * [*] Comment support * [*] Code folding and unfolding -//== Функціональні можливості == Functional capabilities -//=== Загальний процес використання === General usage process -//Використовуйте візуальний редактор коду при створенні та редагуванні скриптів у рамках моделювання бізнес-процесів. Use the visual code editor when creating and editing scripts within the scope of business process modeling. [CAUTION] ==== -//Редагування складових регламенту реєстру можливе лише в рамках версій-кандидатів на внесення змін. Для майстер-версії доступна лише опція перегляду. Editing components of the registry regulations is only possible within change candidate versions. For the master version, only the viewing option is available. -//Детальніше про особливості роботи з версіями регламенту дивіться на сторінці For more details on working with versions of the regulations, refer to xref:registry-admin/admin-portal/version-control/version-control-overview.adoc[]. ==== -//. У [.underline]#Кабінеті адміністратора регламентів# відкрийте розділ [.underline]#Моделі процесів#. . In the [.underline]#Regulations administrator portal#, open the [.underline]#Process models# section. + - -[TIP] -//Портал адміністратора ви можете знайти за посиланням: + -//https://admin-tools-<назва-реєстру>.apps.envone.dev.registry.eua.gov.ua/. -You can find the Regulations administrator portal at the following link: + -https://admin-tools-.apps.envone.dev.registry.eua.gov.ua/. -+ image:registry-develop:registry-admin/admin-portal/process-models/process-models-1.png[] -+ -//. В рамках версії-кандидата оберіть процес і натисніть [.underline]#🖉 іконку редагування#. + . Within the candidate version, select the process and click the [.underline]#🖉 edit icon#. + image:registry-develop:registry-admin/admin-portal/process-models/process-models-6.png[] -+ -//. Перейдіть на вкладку [.underline]#Конструктор# та змоделюйте бізнес-процес у вебредакторі. + . Navigate to the [.underline]#Builder# tab and model the business process in the web editor. + -//TIP: Можливості вкладки [.underline]#Конструктор# більш детально описані на сторінці TIP: The capabilities of the [.underline]#Builder# tab are described in more detail at xref:registry-admin/admin-portal/registry-modeling/process-models/components/tab-bpmn-editor.adoc[]. + image:registry-develop:registry-admin/admin-portal/process-models/process-models-4.png[] -+ -//. Створіть скрипт-задачу (*Script Task*). + . Create a script task (*Script Task*). -//. Натисніть kbd:[*Open script editor*], щоб відкрити [.underline]#Редактор скриптів#. . Click kbd:[Open script editor] to open the [.underline]#Script editor#. -+ -//. Створіть або відредагуйте скрипт. + . Create or edit the script. + -//TIP: Розгорніть вікно редагування, або перегляду скрипту у повноекранному режимі для зручності. TIP: Expand the editing window or view the script in full-screen mode for convenience. -+ -//* Натисніть kbd:[Зберегти], щоб зберегти зміни. + * Click kbd:[Save] to save the changes. -//* Натисніть kbd:[Закрити], щоб скасувати зміни. * Click kbd:[Close] to cancel the changes. + image::registry-admin/hierarchical-model/hierarchical-model-bp-2.png[] @@ -101,36 +62,28 @@ image::registry-admin/hierarchical-model/hierarchical-model-bp-3.png[] + [NOTE] ==== -//Якщо скрипт міститиме ймовірні помилки, редактор попередить про це через відповідне повідомлення на екрані. If the script contains any potential errors, the editor will provide a corresponding message on the screen. image:registry-admin/admin-portal/process-models/edit-groovy-scripts/edit-groovy-scripts-6.png[] ==== -//=== Автодоповнення коду та кастомних JUEL-функцій === Code autocompletion and custom JUEL function autocompletion -//При роботі зі скриптами у редакторі моделювальник може використовувати [.underline]#автодоповнення коду#, зокрема [.underline]#автодоповнення кастомних JUEL-функцій# з випадного списку. Це дозволить уникати помилок при ручному введенні параметрів. When working with scripts in the modeling editor, you can utilize [.underline]#code autocompletion#, including [.underline]#autocompletion for custom JUEL functions# from the dropdown list. This helps prevent errors during manual parameter entry. -//==== Автодоповнення коду ==== Code autocompletion -//Вбудовані можливості інтелектуального завершення передбачають тип і потік даних і пропонують параметри, що відповідають контексту. Наприклад, підказки щодо можливих методів, які використовуються у змінних, доповнення функцій тощо. -The built-in intelligent completion features predict data type and flow and suggest parameters based on the context. For example, prompts for possible methods used in variables, function completions, and more. +The built-in intelligent completion features predict a data type and flow and suggest parameters based on the context. For example, prompts for possible methods used in variables, function completions, and more. image:registry-admin/admin-portal/process-models/edit-groovy-scripts/edit-groovy-scripts-1-1.png[] -//==== Автодоповнення кастомних JUEL-функцій ==== Autocompletion for custom JUEL functions -//Вбудовані можливості інтелектуального завершення передбачають автодоповнення власних JUEL-функцій, які розширюють можливості бізнес-процесів та полегшують моделювання. The built-in intelligent completion features also include autocompletion for custom JUEL functions that enhance business process capabilities and facilitate modeling. [TIP] ==== -//Використовуйте платформні JUEL-функції для спрощення моделювання бізнес-процесів. Наразі імплементовано такі функції та їх автодоповнення у візуальному редакторі коду: Use platform JUEL functions to simplify business process modeling. Currently, the following functions and their autocompletion are implemented in the visual code editor: * *`initiator()`* @@ -146,7 +99,6 @@ Use platform JUEL functions to simplify business process modeling. Currently, th * *`save_digital_document_from_url()`* * *`get_trembita_auth_token()`*. -//Детальніше про використання JUEL-функцій ви можете переглянути на сторінці For more information on using JUEL functions, please refer to xref:bp-modeling/bp/modeling-facilitation/modelling-with-juel-functions.adoc[]. ==== @@ -155,76 +107,56 @@ image:registry-admin/admin-portal/process-models/edit-groovy-scripts/edit-groovy image:registry-admin/admin-portal/process-models/edit-groovy-scripts/edit-groovy-scripts-1-3.png[] -//=== Синтаксичний аналіз коду та перевірка помилок === Code syntax analysis and error checking -//Редактор підтримує синтаксиний аналіз коду та пояснення для деталізації помилок. The editor supports code syntax analysis and provides explanations to detail errors. -//При наведенні на певні елементи, наприклад, на змінну, що використовується у скрипті, редактор підкаже, до якого пакету та класу вона відновиться. When hovering over specific elements, such as a variable used in the script, the editor suggests the package and class it refers to. image:registry-admin/admin-portal/process-models/edit-groovy-scripts/edit-groovy-scripts-1.png[] -//==== Критичні помилки ==== Critical errors -//Якщо код містить критичну помилку, допущену моделювальником, редактор підсвітить червоним кольором, де саме у скрипті виявлено помилку, та виведе відповідне пояснення на екран. If the code contains a critical error made by the modeler, the editor highlights the error in red within the script and displays a corresponding explanation on the screen. image:registry-admin/admin-portal/process-models/edit-groovy-scripts/edit-groovy-scripts-2.png[] image:registry-admin/admin-portal/process-models/edit-groovy-scripts/edit-groovy-scripts-3.png[] -//==== Не критичні помилки ==== Non-critical errors -//Якщо код містить НЕ критичну помилку, допущену моделювальником, при наведенні курсора редактор підсвітить жовтим кольором, де саме у скрипті виявлено помилку, та виведе відповідне пояснення на екран. If the code contains a non-critical error made by the modeler, when hovering over the cursor, the editor highlights the error in yellow within the script and displays a corresponding explanation on the screen. image:registry-admin/admin-portal/process-models/edit-groovy-scripts/edit-groovy-scripts-4.png[] image:registry-admin/admin-portal/process-models/edit-groovy-scripts/edit-groovy-scripts-5.png[] -//=== Коментування коду === Code commenting -//Вбудований редактор скриптів дозволяє вносити коментарі до коду. Коментарі надають [.underline]#зрозуміле для розробника пояснення, або анотацію у вихідному коді# скрипту/програми. Вони додаються з метою зробити вихідний код легшим для розуміння людьми, й ігноруються компіляторами та інтерпретаторами. Тобто ви можете таким чином "приховати" від виконання частину програми, або певний рядок тощо. The built-in script editor allows you to add comments to the code. Comments provide clear explanations or annotations in the source code of the script/program. They are added to make the source code easier to understand for humans and are ignored by compilers and interpreters. This means you can "hide" parts of the program or specific lines from execution. -//Використовуйте [.underline]#однорядкові#, або [.underline]#багаторядкові# коментарі. Use [.underline]#single-line# or [.underline]#multi-line# comments. -//==== Однорядкові коментарі ==== Single-line comments -//Однорядкові коментарі починаються з *`//`* (подвійна коса риска) і можуть використовуватися у будь-якому місці рядка. Символи після *`//`* і до кінця рядка вважаються частиною коментаря. Single-line comments start with `//` (double forward slash) and can be used anywhere within a line. Characters after `//` until the end of the line are considered part of the comment. image:registry-admin/admin-portal/process-models/edit-groovy-scripts/edit-groovy-scripts-7.png[] -//==== Багаторядкові коментарі ==== Multi-line comments -//Багаторядковий коментар починається з +++/*+++ (_одинарна коса риска та зірочка_) і може бути використаний у будь-якому місці рядка. Символи після +++/*+++ вважатимуться частиною коментаря, включаючи символи нового рядка, до першого +++*/+++ (_зірочка та одинарна коса риска_), який закриває коментар. Таким чином, багаторядкові коментарі можна розмістити в кінці, або навіть усередині висловлювання тощо. Multi-line comments start with +++/*+++ (_forward slash followed by an asterisk_) and can be used anywhere within a line. Characters after +++/*+++ are considered part of the comment, including newline characters, until the first +++*/+++ (_asterisk followed by a forward slash_) that closes the comment. Therefore, multi-line comments can be placed at the end or even within an expression, and so on. image:registry-admin/admin-portal/process-models/edit-groovy-scripts/edit-groovy-scripts-8.png[] - -//=== Згортання та розгортання блоків коду === Code folding and unfolding -//Використовуйте функції згортання та розгортання блоків з кодом. Це дозволить зробити ваш код більш читабельним та сховати, або, навпаки, розкрити деталі певного блоку за потреби. Use code folding and unfolding functions to make your code more readable and hide or reveal details of specific blocks as needed. -//Ви можете організовувати блокову структуру, використовуючи зарезервовані висловлювання, як-то `def`, `for`, `if`, `else` тощо. You can organize block structure using reserved statements such as `def`, `for`, `if`, `else`, and so on. -//Якщо навести курсор навпроти певного висловлювання (відкритого блоку), з'явиться перемикач, який дозволить вам його згорнути. -When hovering the cursor next to a specific statement (an open block), a switch will appear allowing you to fold it. +When hovering the cursor next to a specific statement (an open block), a switch will appear to allow you to fold it. -//Перемикачі для розгортання видимі завжди. Просто натисніть на такий, щоб показати деталі у блоці з кодом. Unfolding switches are always visible. Simply click on one to show the details in the code block. image:registry-admin/admin-portal/process-models/edit-groovy-scripts/edit-groovy-scripts-9.png[] diff --git a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/components/process-components-overview.adoc b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/components/process-components-overview.adoc index 668c309acf..62f2452e7e 100644 --- a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/components/process-components-overview.adoc +++ b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/components/process-components-overview.adoc @@ -1,12 +1,9 @@ = Viewing and editing business process components -//Адміністратор регламенту може працювати зі складовими бізнес-процесів на відповідних вкладках [.underline]#Загальна#, [.underline]#Код# та [.underline]#Конструктор#. -The Regulations administrator can work with the components of business processes on the corresponding [.underline]#General#, [.underline]#Code#, and [.underline]#Builder# tabs. +The registry regulations administrator can work with the components of business processes on the corresponding *General*, *Code*, and *Builder* tabs. -//== Огляд секції == Section overview -//* [*] xref:registry-admin/admin-portal/registry-modeling/process-models/create-process.adoc#tab-general[Керування назвами процесу] * [*] xref:registry-admin/admin-portal/registry-modeling/process-models/create-process.adoc#tab-general[Managing process names] * [*] xref:registry-admin/admin-portal/registry-modeling/process-models/components/tab-code.adoc[] * [*] xref:registry-admin/admin-portal/registry-modeling/process-models/components/tab-bpmn-editor.adoc[] diff --git a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/components/tab-bpmn-editor.adoc b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/components/tab-bpmn-editor.adoc index 44a4aeb9c6..0ea75138ba 100644 --- a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/components/tab-bpmn-editor.adoc +++ b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/components/tab-bpmn-editor.adoc @@ -1,94 +1,65 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - -//= Моделювання бізнес-процесів у BPMN-редакторі = Modeling business processes in BPMN editor +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] + +include::platform:ROOT:partial$admonitions/language-en.adoc[] -//Кабінет адміністратора регламентів дозволяє легко та просто моделювати бізнес-процеси за допомогою вбудованого вебредактора https://bpmn.io/[BPMN.io] у вашому браузері. Інструмент дозволяє _переглядати, створювати та редагувати_ діаграми у нотації *BPMN 2.0* на базі XML. The Regulations administrator portal allows easy and straightforward modeling of business processes using the built-in web editor https://bpmn.io/[BPMN.io] in your browser. This tool enables you to view, create, and edit diagrams in BPMN 2.0 notation based on XML. -.Візуальне представлення бізнес-процесу у вебредакторі на вкладці [.underline]#Конструктор# -.Visual representation of a business process in the web editor on the [.underline]#Builder# tab +.Visual representation of a business process in the web editor on the *Builder* tab image::registry-develop:registry-admin/admin-portal/process-models/process-models-9.png[] -//Функціональність представляє типове рішення, що дозволяє моделювати бізнес-процеси у нотації BPMN 2.0 з використанням типових інтеграційних розширень-конекторів, вбудованих до порталу адміністратора. The functionality offers a standard solution that enables modeling of business processes in BPMN 2.0 notation with the use of built-in integration extensions-connectors within the administrator portal. [NOTE] ==== -//Каталог містить типові інтеграційні розширення (_делегати_), які дозволяють створювати заздалегідь визначені конфігурації для елементів BPMN (система умовних позначень (нотація) та їх опис для моделювання бізнес-процесів), як-от сервісні та користувацькі задачі тощо. Після застосування через панель властивостей вони надають налаштовані кастомні параметри для користувача. The catalog includes typical integration extensions (delegates) that allow you to create predefined configurations for BPMN elements (conditional notation system and their description for business process modeling), such as service and user tasks, and more. After applying them through the properties panel, they provide customized parameters for the user. -//Типові розширення спрощують процес моделювання, скорочують великі діаграми, скрипти й економлять ваш час. These typical extensions simplify the modeling process, reduce large diagrams, scripts, and save your time. -//TIP: Останні версії типових розширень бізнес-процесів будуть автоматично доступні у Кабінеті адміністратора регламентів після оновлення реєстру. TIP: The latest versions of typical business process extensions will be automatically available in the Regulations administrator portal after updating the registry. -//Детальний опис наявних інтеграційних розширень ви можете знайти на сторінці A detailed description of available integration extensions can be found at xref:bp-modeling/bp/element-templates/element-templates-overview.adoc[]. ==== -//Полегшує роботу із бізнес-процесами також використання скриптів. Скрипти виконуються безпосередньо двигуном процесів (BPMN Engine). Основна мова для скриптування на Платформі -- https://uk.wikipedia.org/wiki/Groovy[*Groovy*]. Скрипти використовуються в рамках елемента *Script Task*. The use of scripts also facilitates working with business processes. Scripts are executed directly by the process engine (BPMN Engine). The main scripting language for the Platform is https://uk.wikipedia.org/wiki/Groovy[*Groovy*]. Scripts are used within the *Script Task* element. -//Разом зі скриптами для спрощення моделювання імплементовано підтримку https://juel.sourceforge.net/[JUEL]-функцій. Alongside scripts, support for https://juel.sourceforge.net/[JUEL] functions has been implemented to streamline modeling. -//TIP: Детальніше про використання JUEL-функцій ви можете переглянути на сторінці TIP: For more information on the use of JUEL functions in business processes, please refer to xref:bp-modeling/bp/modeling-facilitation/modelling-with-juel-functions.adoc[]. -//xref:registry-admin/admin-portal/registry-modeling/process-models/create-process.adoc[Створити нову], або xref:registry-admin/admin-portal/registry-modeling/process-models/edit-process.adoc[відредагувати] наявну схему бізнес-процесу можна на вкладці [.underline]#Конструктор#, у вбудованому вебредакторі BPMN.io. -You can xref:registry-admin/admin-portal/registry-modeling/process-models/create-process.adoc[create new], or xref:registry-admin/admin-portal/registry-modeling/process-models/edit-process.adoc[edit] an existing business process diagram on the [.underline]#Builder# tab, in the built-in web editor BPMN.io. +You can xref:registry-admin/admin-portal/registry-modeling/process-models/create-process.adoc[create new], or xref:registry-admin/admin-portal/registry-modeling/process-models/edit-process.adoc[edit] an existing business process diagram on the *Builder* tab, in the built-in web editor BPMN.io. -.Редагування схеми бізнес-процесу у вебредакторі .Editing a business process diagram in the web editor image::registry-develop:registry-admin/admin-portal/process-models/process-models-10.png[] -//Моделювальник може використовувати як можливості Кабінету адміністратора регламентів, так і моделювати бізнес-процес у будь-якому іншому BPMN-редакторі, наприклад Camunda Modeler тощо. The modeler can utilize both the capabilities of the Regulations administrator portal and model business processes in any other BPMN editor, such as Camunda Modeler, and more. [TIP] ==== -//Процес моделювання показаний на сторінці The process modeling is illustrated at xref:bp-modeling/bp/bp-modeling-instruction.adoc[]. -//Додаткові корисні посилання для роботи із бізнес-процесами та регламентом реєстру: Additional useful links for working with business processes and the registry: * xref:study-project/study-tasks/task-2-bp-modeling-without-integration.adoc[] * xref:study-project/study-tasks/task-3-bp-modeling-with-integration.adoc[] * xref:study-project/study-tasks/task-4-bp-modeling-with-start-form-and-depending-components.adoc[] * xref:study-project/study-tasks/task-5-bp-modeling-multiple-participants.adoc[] -* xref:study-project/study-tasks/task-7-bp-modeling-trembita-invocation.adoc[] ==== [NOTE] ==== -//Принцип моделювання процесів на базі стандарту BPMN 2.0 є однаковим для усіх редакторів. The principle of process modeling based on the BPMN 2.0 standard is the same for all editors. -//Водночас робота із процесами на вкладці [.underline]#Конструктор# в інтерфейсі адміністратора регламенту не вимагає встановлення додаткового програмного забезпечення, як-от моделера, бібліотеки розширень та плагінів, та є коробковим рішенням. -At the same time, working with processes on the [.underline]#Builder# tab in the registry administrator interface does not require additional software installation, such as a modeler, extension libraries, and plugins, as it is an out-of-the-box solution. +At the same time, working with processes on the *Builder* tab in the registry administrator interface does not require additional software installation, such as a modeler, extension libraries, and plugins, as it is an out-of-the-box solution. ==== [TIP] ==== -//Розробник може змоделювати новий бізнес-процес, використовуючи можливості вкладки [.underline]#Код#. Вкладка дозволяє працювати напряму з кодом процесу, тобто його XML-представленням. -Developers can model a new business process using the capabilities of the [.underline]#Code# tab. The tab allows direct work with the process code, i.e., its XML representation. +Developers can model a new business process using the capabilities of the *Code* tab. The tab allows direct work with the process code, i.e., its XML representation. -//Детальніше про можливості роботи з кодом процесів ви можете переглянути на сторінці For more information on working with process code, please refer to xref:registry-admin/admin-portal/registry-modeling/process-models/components/tab-code.adoc[] ==== -//IMPORTANT: Усі зміни на вкладках xref:registry-admin/admin-portal/registry-modeling/process-models/create-process.adoc#tab-general[[.underline]#Загальна#], xref:registry-admin/admin-portal/registry-modeling/process-models/components/tab-code.adoc[[.underline]#Код#] та [.underline]#Конструктор# синхронізуються. Тобто, якщо ви зміните елемент у конструкторі, це відобразиться й у коді й навпаки. -IMPORTANT: All changes on the xref:registry-admin/admin-portal/registry-modeling/process-models/create-process.adoc#tab-general[[.underline]#General#], xref:registry-admin/admin-portal/registry-modeling/process-models/components/tab-code.adoc[[.underline]#Code#], and [.underline]#Builder# tabs are synchronized. This means that if you modify an element in the constructor, it will be reflected in the code and vice versa. +NOTE: All changes on the xref:registry-admin/admin-portal/registry-modeling/process-models/create-process.adoc#tab-general[General], xref:registry-admin/admin-portal/registry-modeling/process-models/components/tab-code.adoc[Code], and xref:registry-admin/admin-portal/registry-modeling/process-models/components/tab-bpmn-editor.adoc[Builder] tabs are synchronized. This means that if you modify an element in the constructor, it will be reflected in the code and vice versa. diff --git a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/components/tab-code.adoc b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/components/tab-code.adoc index cb27165bd8..e6fa7c2799 100644 --- a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/components/tab-code.adoc +++ b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/components/tab-code.adoc @@ -1,73 +1,43 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Viewing and editing business process XML code representation +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] -//Використовуйте можливості вкладки [.underline]#Код# для моделювання бізнес-процесів. Функціональність дозволяє працювати напряму з кодом процесу, тобто його XML-представленням. -Utilize the capabilities of the [.underline]#Code# tab to model business processes. This functionality allows you to work directly with the code of the process, namely its XML representation. +include::platform:ROOT:partial$admonitions/language-en.adoc[] -.XML-представлення бізнес-процесу у на вкладці [.underline]#Код# -.XML representation of a business process on the [.underline]#Code# tab -image::registry-develop:registry-admin/admin-portal/process-models/process-models-11.png[] +Utilize the capabilities of the *Code* tab to model business processes. This functionality allows you to work directly with the code of the process, namely its XML representation. -[CAUTION] -==== -//Редагування складових регламенту реєстру можливе лише в рамках версій-кандидатів на внесення змін. Для майстер-версії доступна лише опція перегляду. -Editing the components of the registry regulations is only possible within change candidate versions. For the master version, only the viewing option is available. +.XML representation of a business process on the *Code* tab +image::registry-develop:registry-admin/admin-portal/process-models/process-models-11.png[] -//Детальніше про особливості роботи з версіями регламенту дивіться на сторінці: -For more information on working with registry versions, please refer to the following page: +include::partial$snippets/admin-portal-master-candidate-edit-en.adoc[] -* xref:registry-admin/admin-portal/version-control/version-control-overview.adoc[] -==== - -//Звичайно, створювати BPMN-моделі напряму у коді складно і недоречно, коли під рукою є xref:registry-admin/admin-portal/registry-modeling/process-models/components/tab-bpmn-editor.adoc[візуальний редактор]. Водночас доступ до XML-коду відкриває нові можливості та полегшує моделювання, коли потрібно, наприклад: Creating BPMN models directly in the code is generally challenging and impractical when there is a xref:registry-admin/admin-portal/registry-modeling/process-models/components/tab-bpmn-editor.adoc[visual editor] at hand. However, access to the XML code opens up new possibilities and simplifies modeling when, for example, you need to: -//* швидко підправити шматки діаграми (назву процесу, задач тощо); * quickly adjust parts of the diagram (process name, tasks, etc.). -//* мігрувати старі бізнес-процеси, змодельовані в інших редакторах та системах (Camunda Modeler тощо); + * migrate old business processes modeled in other editors and systems (such as Camunda Modeler). -//* швидко інтегрувати процес до регламенту, якщо його передали електронною поштою, або у чаті; + * rapidly integrate a process into the registry if it was sent via email or chat. -//* використати корисні приклади при розробці бізнес-процесу: шматки коду із різних тематичних спільнот (Stack Overflow, Camunda, BPMN-спільноти тощо), або готові рішення для ваших бізнес-процесів та задач. + * utilize useful examples while developing a business process: code snippets from various thematic communities (Stack Overflow, Camunda, BPMN communities, etc.) or ready-made solutions for your business processes and tasks. -//Просто скопіюйте готову BPMN-діаграму та вставте XML-опис у відповідне поле на вкладці [.underline]#Код#. -Simply copy the ready BPMN diagram and paste the XML description into the corresponding field on the [.underline]#Code# tab. +Simply copy the ready BPMN diagram and paste the XML description into the corresponding field on the *Code* tab. [CAUTION] ==== -//XML-код бізнес-процесів валідується за XSD-схемою. The XML code of business processes is validated against an XSD schema. -//При перенесенні коду до процесу, спрацьовує системний валідатор. Якщо поле `Код бізнес-процесу` порожнє, або містить помилки у синтаксисі, на екрані ви побачите відповідне попередження -- валідаційну помилку: When transferring code to a process, the system validator kicks in. If the *Business-process code* field is empty or contains syntax errors, you will see a corresponding warning on the screen, indicating a validation error: -//`Увага!` -//`XML-представлення бізнес-процесу містить помилки`. `Attention! The XML representation of the business process contains errors.` ==== -//.Копіювання коду BPMN-діаграми у блокноті .Copying BPMN diagram code in a text editor image::registry-develop:registry-admin/admin-portal/process-models/process-models-12.png[] -//.Поле для вставлення коду BPMN-діаграми на вкладці [.underline]#Код# -.Field for inserting BPMN diagram code on the [.underline]#Code# tab +.Field for inserting BPMN diagram code on the *Code* tab image::registry-develop:registry-admin/admin-portal/process-models/process-models-12-1.png[] -.Вставлення коду BPMN-діаграми на вкладці [.underline]#Код# -.Inserting BPMN diagram code on the [.underline]#Code# tab +.Inserting BPMN diagram code on the *Code* tab image::registry-develop:registry-admin/admin-portal/process-models/process-models-12-2.png[] - -//IMPORTANT: Усі зміни на вкладках xref:registry-admin/admin-portal/registry-modeling/process-models/create-process.adoc#tab-general[[.underline]#Загальна#], [.underline]#Код# та xref:registry-admin/admin-portal/registry-modeling/process-models/components/tab-bpmn-editor.adoc[[.underline]#Конструктор#] синхронізуються. Тобто, якщо ви зміните елемент у конструкторі, це відобразиться й у коді, й навпаки. -IMPORTANT: All changes on the xref:registry-admin/admin-portal/registry-modeling/process-models/create-process.adoc#tab-general[[.underline]#General#], xref:registry-admin/admin-portal/registry-modeling/process-models/components/tab-code.adoc[[.underline]#Code#], and [.underline]#Builder# tabs are synchronized. This means that if you modify an element in the constructor, it will be reflected in the code and vice versa. +NOTE: All changes on the xref:registry-admin/admin-portal/registry-modeling/process-models/create-process.adoc#tab-general[General], xref:registry-admin/admin-portal/registry-modeling/process-models/components/tab-code.adoc[Code], and xref:registry-admin/admin-portal/registry-modeling/process-models/components/tab-bpmn-editor.adoc[Builder] tabs are synchronized. This means that if you modify an element in the Builder, it will be reflected in the code and vice versa. diff --git a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/copy-process.adoc b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/copy-process.adoc index ce2bb9ad1b..a046fde858 100644 --- a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/copy-process.adoc +++ b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/copy-process.adoc @@ -1,44 +1,22 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - -//= Копіювання бізнес-процесів = Copying business processes +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] -//Використовуйте функціональність копіювання бізнес-процесів. Це дозволяє полегшити та пришвидшити створення схем процесів. Не потрібно моделювати процеси з нуля -- просто оберіть подібну діаграму, змодельовану раніше та скопіюйте її. -Utilize the functionality of business process copying. This allows for easier and faster creation of process diagrams. There is no need to model processes from scratch -- simply select a similar diagram that has been previously modeled and copy it. +include::platform:ROOT:partial$admonitions/language-en.adoc[] + +Utilize the functionality of business process copying. This allows for easier and faster creation of process diagrams. There is no need to model processes from scratch—simply select a similar diagram that has been previously modeled and copy it. -//Відкрийте розділ [.underline]#Моделі процесів# та натисніть _іконку копіювання_ навпроти потрібного бізнес-процесу. Open the [.underline]#Process models# section and click on the copying icon next to the desired business process. image:registry-develop:registry-admin/admin-portal/process-models/process-models-15.png[] -//В результаті створюється _повна копія_ обраного процесу (дублікат), тобто копіюється увесь код. As a result, a _complete copy_ of the selected process (duplicate) is created, meaning that the entire code is copied. [NOTE] ==== -//* Бізнес-назва процесу за замовчуванням створюється із префіксом `*Copy_*`. * The default business name of the process is created with the prefix *`Copy_`*. -//* Службова назва процесу за замовчуванням -- `*new-bp*`. * The default technical name of the process is *`new-bp`*. ==== image:registry-develop:registry-admin/admin-portal/process-models/process-models-16.png[] -[CAUTION] -==== -//Редагування складових регламенту реєстру можливе лише в рамках версій-кандидатів на внесення змін. Для майстер-версії доступна лише опція перегляду. -Editing the components of the registry regulations is only possible within change candidate versions. The master version only has the viewing option available. - -//Детальніше про особливості роботи з версіями регламенту дивіться на сторінці: -For more information on working with registry regulation versions, please refer to the following page: - -* xref:registry-admin/admin-portal/version-control/version-control-overview.adoc[] -==== \ No newline at end of file +include::partial$snippets/admin-portal-master-candidate-edit-en.adoc[] \ No newline at end of file diff --git a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/create-process.adoc b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/create-process.adoc index 4a7ca928bc..8683e97b4c 100644 --- a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/create-process.adoc +++ b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/create-process.adoc @@ -1,133 +1,90 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - -//= Створення бізнес-процесів = Creating business processes +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] -//Кабінет адміністратора регламентів дозволяє легко та просто моделювати бізнес-процеси за допомогою вбудованого вебредактора https://bpmn.io/[BPMN.io] у вашому браузері. Функціональність надає можливості _перегляду, створення та редагування_ діаграм у нотації *BPMN 2.0* на базі XML. -The Regulations administrator portal allows for easy and straightforward modeling of business processes using the built-in https://bpmn.io/[BPMN.io] web editor in your browser. The functionality provides viewing, creation, and editing of diagrams in BPMN 2.0 notation based on XML. +include::platform:ROOT:partial$admonitions/language-en.adoc[] + +The *Administrative portal* allows for easy and straightforward modeling of business processes using the built-in https://bpmn.io/[BPMN.io] web editor in your browser. The functionality provides viewing, creation, and editing of diagrams in BPMN 2.0 notation based on XML. -//Створіть новий бізнес-процес у кілька простих кроків: Create a new business process in a few simple steps: -//. У Кабінеті адміністратора регламентів відкрийте розділ [.underline]#Моделі процесів#. -. In the Regulations administrator portal, open the [.underline]#Process models# section. +. In the *Administrative portal*, open the *Process models* section. + image:registry-develop:registry-admin/admin-portal/process-models/process-models-1.png[] -+ -//. Натисніть кнопку [.underline]#`+ Створити новий процес`#. -. Click the [.underline]#+ Create new process# button. + +. Click the *`Create new process`* button. + image:registry-develop:registry-admin/admin-portal/process-models/process-models-2.png[] + [#tab-general] -//. На вкладці [.underline]#Загальна# заповніть бізнес- та службову назви бізнес-процесу: -. On the [.underline]#General# tab, fill in the business and technical names of the business process: -+ -//* У полі `Бізнес-назва процесу` введіть зручну та зрозумілу назву. +. On the *General* tab, fill in the business and technical names of the business process: + * Enter a convenient and understandable name in the *Business process name* field. + [NOTE] ==== -//Бізнес-назва виконує інформативну функцію та може використовуватися, наприклад, для відображення в інтерфейсах Кабінетів посадової особи та отримувача послуг, для юридичних цілей, у документообігу тощо. + The business name serves an informative function and can be used, for example, for display in the interfaces of the Officer and Citizen portals, for legal purposes, in document circulation, and so on. -//Може мати від 3 до 100 символів. Допустимі символи: "А-Z", "a-z", "А-Я", "а-я", української абетки, "0-9", "-", "_", ",", ".", апостроф ('), пробіл. -It can have 3 to 100 characters. Allowed characters: "A-Z," "a-z," "А-Я," "а-я," Ukrainian alphabet, "0-9," "-", "_," ",", ".", apostrophe ('), space. +It can have 3 to 100 characters. Allowed characters: "A-Z", "a-z", cyrillic "А-Я", "а-я", "0-9", "-", "_", ",", ".", apostrophe ('), space. ==== -+ -//* У полі `Службова назва бізнес-процесу` введіть технічну назву процесу. + * Enter the technical name of the process in the *Business process technical name* field. + [NOTE] ==== -//Службова назва є ідентифікатором процесу (`process id`) в системі. Її використовують для технічних цілей: у коді, BPMN-нотації, файлах конфігурації тощо. The technical name is the process identifier (`process ID`) in the system. It is used for technical purposes, such as in code, BPMN notation, configuration files, and so on. -//Повинна бути унікальною у межах екземпляра реєстру. Довжина 3--50 символів. + -//Допустимі символи: "А-Z", "a-z", "0-9", "-", "_". При цьому цифри, "-" не можуть бути на початку, або в кінці службової назви. It must be unique within the registry instance. Length: 3-50 characters. Allowed characters: "A-Z," "a-z," "0-9," "-", "_." However, digits and "-" cannot be at the beginning or end of the technical name. ==== - + image:registry-develop:registry-admin/admin-portal/process-models/process-models-3.png[] + -//. Перейдіть на вкладку [.underline]#Конструктор# та змоделюйте бізнес-процес у вебредакторі. -. Switch to the [.underline]#Builder# tab and model the business process in the web editor. +NOTE: All changes on the xref:registry-admin/admin-portal/registry-modeling/process-models/create-process.adoc#tab-general[General], xref:registry-admin/admin-portal/registry-modeling/process-models/components/tab-code.adoc[Code], and xref:registry-admin/admin-portal/registry-modeling/process-models/components/tab-bpmn-editor.adoc[Builder] tabs are synchronized. This means that if you modify an element in the Builder, it will be reflected in the code and vice versa. + +. Switch to the *Builder* tab and model the business process in the web editor. + -//TIP: Можливості вкладки [.underline]#Конструктор# більш детально описані на сторінці -TIP: The capabilities of the [.underline]#Builder# tab are more detailed at: +TIP: The capabilities of the *Builder* tab are more detailed at xref:registry-admin/admin-portal/registry-modeling/process-models/components/tab-bpmn-editor.adoc[]. + image:registry-develop:registry-admin/admin-portal/process-models/process-models-4.png[] -+ -//. Натисніть клавішу `Зберегти зміни`, щоб зберегти внесену інформацію. -. Press the **Save change**s button to save the entered information. + +. Press the *`Save changes`* button to save the entered information. + [TIP] ==== -//Користувач отримує нотифікацію про успішне створення процесу: The user receives a notification of successful process creation: -//* ✅ `Бізнес-процес "<Назва процесу>" успішно створено` -* ✅ `Business process` `` `successfully created`. +* ✅ `Business process` `` `successfully created`. ==== + image:registry-develop:registry-admin/admin-portal/process-models/process-models-5.png[] -+ -//Ви можете побачити створений бізнес-процес у загальному переліку процесів. Надалі його можна редагувати (детальніше -- на сторінці xref:registry-admin/admin-portal/registry-modeling/process-models/edit-process.adoc[]). -You can see the created business process in the general list of processes. It can be edited later (more details at xref:registry-admin/admin-portal/registry-modeling/process-models/edit-process.adoc[]). -+ + +You can see the created business process in the general list of processes. It can be edited later (_see more details at xref:registry-admin/admin-portal/registry-modeling/process-models/edit-process.adoc[]_). + [IMPORTANT] ==== -//Коли користувач намагається зберегти зміни при створенні, або редагуванні бізнес-процесу, чи UI-форми, та знаходиться на будь-якій вкладці розділів [.underline]#Моделі процесів# та [.underline]#UI-форми#, то на усіх вкладках цих розділів спрацьовує валідація, якщо: -When a user tries to save changes during creation or editing of a business process or UI forms and is on any tab of the [.underline]#Process models# and [.underline]#UI# Forms sections, validation is triggered if: +When a user tries to save changes during creation or editing of a business process or UI forms and is on any tab of the *Process models* and *UI forms* sections, validation is triggered if: + +* A business process with the same technical name already exists—then the user sees the following validation message in the top right corner: -//* Бізнес-процес із такою службовою назвою вже існує -- тоді користувач бачить наступне валідаційне повідомлення у правому верхньому куті: -* A business process with the same technical name already exists -- then the user sees the following validation message in the top right corner: -+ -//** `"Бізнес-процес із такою службовою назвою вже існує"`. ** `A business process with this technical name already exists`. -//* Валідаційні правила порушені -- тоді користувач бачить валідаційне повідомлення у правому верхньому куті: -* Validation rules are violated -- then the user sees a validation message in the top right corner: +* Validation rules are violated—then the user sees a validation message in the top right corner: + -//** `"Перевірте формат обов'язкових полів"`. + ** `Check the format of mandatory fields`. -//* Для бізнес-назви процесу: * For the business process name: -+ -//** Валідаційні правила порушені -- тоді користувач бачить валідаційне повідомлення у правому верхньому куті: -** Validation rules are violated -- then the user sees a validation message in the top right corner: -+ -//** `"Перевірте формат обов'язкових полів"` + +** Validation rules are violated—then the user sees a validation message in the top right corner: + ** `Check the format of mandatory fields`. image:registry-develop:registry-admin/admin-portal/process-models/process-models-5-1.png[] -//При спрацьовуванні перевірок, користувач лишається на поточній сторінці/вкладці. When the checks are triggered, the user stays on the current page/tab. - ==== -[CAUTION] -==== -//Створення бізнес-процесу відбувається лише у межах вашої версії-кандидата. Як створити нову версію-кандидат -- дивіться на сторінці xref:registry-admin/admin-portal/version-control/create-new-change-request.adoc[]. -The creation of a business process occurs only within your candidate version. To create a new candidate version, refer to xref:registry-admin/admin-portal/version-control/create-new-change-request.adoc[]. - -//Ви можете переглянути внесені зміни та їх статус у секції [.underline]#Внесені зміни# (детальніше -- на сторінці xref:registry-admin/admin-portal/version-control/overview-new-change-request.adoc#review-changes-candidate[Перегляд переліку внесених змін]). -You can review the made changes and their status in the [.underline]#Latest changes# section (see xref:registry-admin/admin-portal/version-control/overview-new-change-request.adoc#review-changes-candidate[Viewing list of latest changes]) ) - -//Якщо ви завершили створення бізнес-процесу і хочете опублікувати зміни у регламенті Gerrit-репозиторію, необхідно застосувати зміни до майстер-версії (детальніше -- на сторінці xref:registry-admin/admin-portal/version-control/overview-new-change-request.adoc#push-changes-master[Застосування змін до майстер-версії]). -If you have finished creating a business process and want to publish the changes to the Gerrit repository, you need to apply the changes to the master version (more details on xref:registry-admin/admin-portal/version-control/overview-new-change-request.adoc#push-changes-master[Applying changes to the master version]). -==== \ No newline at end of file +include::partial$snippets/admin-portal-master-candidate-edit-en.adoc[] \ No newline at end of file diff --git a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/delete-process.adoc b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/delete-process.adoc index cba2ea2f5d..02cd9fd6c5 100644 --- a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/delete-process.adoc +++ b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/delete-process.adoc @@ -1,44 +1,29 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - -//= Видалення бізнес-процесів = Deleting business processes +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] + +include::platform:ROOT:partial$admonitions/language-en.adoc[] -//Видаляйте непотрібні та застарілі бізнес-процеси -- тримайте регламент в актуальному стані. Remove unnecessary and outdated business processes to keep the regulations up to date. -//Відкрийте розділ [.underline]#Моделі процесів# та натисніть _іконку копіювання_ навпроти потрібного бізнес-процесу. Open the [.underline]#Process models# section and click on the _deletion icon_ next to the desired business process. image:registry-develop:registry-admin/admin-portal/process-models/process-models-17.png[] -//В результаті користувач отримує нотифікацію про успішне видалення процесу: As a result, the user receives a notification of successful process deletion: -//* ✅ `Бізнес-процес "<Назва процесу>" успішно видалено` -* ✅ `Business process "" successfully` deleted. +* ✅ `Business process "" successfully` deleted. image:registry-develop:registry-admin/admin-portal/process-models/process-models-18.png[] [IMPORTANT] ==== -//Видалення процесу відбувається у межах вашої версії-кандидата на внесення змін. Якщо необхідно видалити бізнес-процес із регламенту в Gerrit-репозиторії, необхідно xref:registry-admin/admin-portal/version-control/overview-new-change-request.adoc#push-changes-master[застосувати зміни до майстер-версії]. The deletion of the process occurs within your change candidate version. If you need to delete a business process from the regulations in the Gerrit repository, you need to xref:registry-admin/admin-portal/version-control/overview-new-change-request.adoc#push-changes-master[apply changes to the master version]. ==== [CAUTION] ==== -//Редагування складових регламенту реєстру можливе лише в рамках версій-кандидатів на внесення змін. Для майстер-версії доступна лише опція перегляду. Editing the components of the registry regulations is only possible within change candidate versions. The master version only has the viewing option available. -//Детальніше про особливості роботи з версіями регламенту дивіться на сторінці: For more information on the features of working with registry regulations versions, please refer to the following page: * xref:registry-admin/admin-portal/version-control/version-control-overview.adoc[] diff --git a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/edit-process.adoc b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/edit-process.adoc index eb5f75785c..8d29c53c8b 100644 --- a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/edit-process.adoc +++ b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/edit-process.adoc @@ -1,63 +1,41 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - -//= Редагування бізнес-процесів = Editing business processes +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] -//Кабінет адміністратора регламентів дозволяє редагувати, змінювати та розвивати наявні бізнес-процеси. Якщо моделювальник припустився помилки у назві, або хоче змінити елемент діаграми процесів, чи підправити XML-код, то він може перейти до _режиму редагування_ та внести необхідні зміни. -The Regulations administrator portal allows for editing, modifying, and developing existing business processes. If the modeler has made an error in the name, wants to change an element of the process diagram, or modify the XML code, they can enter the _editing mode_ and make the necessary changes. +include::platform:ROOT:partial$admonitions/language-en.adoc[] + +The *Administrative portal* allows for editing, modifying, and developing existing business processes. If the modeler has made an error in the name, wants to change an element of the process diagram, or modify the XML code, they can enter the _editing mode_ and make the necessary changes. -//NOTE: Неможливо редагувати службову назву. При першому збереженні службова назва записується до сховища як унікальний ідентифікатор процесу в межах екземпляра реєстру і не може бути змінена. NOTE: It is not possible to edit the internal technical name. Upon initial save, the technical name is stored in the repository as a unique identifier for the process within the registry instance and cannot be changed. -Відредагуйте наявний бізнес-процес у кілька простих кроків: Edit an existing business process in a few simple steps: -//. У Кабінеті адміністратора регламентів відкрийте розділ [.underline]#Моделі процесів#. -. In the Regulations administrator portal, open the [.underline]#Process Models# section. +. In the *Administrative portal*, open the [.underline]#Process Models# section. + image:registry-develop:registry-admin/admin-portal/process-models/process-models-1.png[] -+ -//. Оберіть процес і натисніть [.underline]#🖉 іконку редагування#. + . Select the process and click on the [.underline]#🖉 editing icon#. + image:registry-develop:registry-admin/admin-portal/process-models/process-models-6.png[] -+ -//. Змініть будь-яку складову бізнес-процесу (бізнес-назву, код чи BPMN-елемент у моделері). + . Modify any component of the business process (business name, code, or BPMN element in the modeler). + image:registry-develop:registry-admin/admin-portal/process-models/process-models-7.png[] -+ -//. Натисніть клавішу [.underline]#`Зберегти зміни`#, щоб зберегти внесену інформацію. + . Click the [.underline]#Save changes# button to save the entered information. + [TIP] ==== -//Користувач отримує нотифікацію про успішне створення процесу: The user receives a notification of successful process creation: -//* ✅ `Бізнес-процес "<Назва процесу>" успішно збережено` * ✅ `Business process "" successfully saved`. ==== + image:registry-develop:registry-admin/admin-portal/process-models/process-models-8.png[] ++ +You can view the changes and their status in the [.underline]#Proposed changes# section (_for more details, see the page xref:registry-admin/admin-portal/version-control/overview-new-change-request.adoc#review-changes-candidate[Reviewing the list of proposed changes]_). ++ +Suppose you have completed editing within the candidate version and want to publish the changes in the registry's regulation. In that case, you need to apply the changes to the master version (for more details, see the page xref:registry-admin/admin-portal/version-control/overview-new-change-request.adoc#push-changes-master[Applying changes to the master version]). -[CAUTION] -==== -//Редагування складових бізнес-процесу стосується лише вашої версії-кандидата. Як створити нову версію-кандидат -- дивіться на сторінці xref:registry-admin/admin-portal/version-control/create-new-change-request.adoc[]. -Editing the components of the business process applies only to your change candidate version. To create a new change candidate version, refer to the page xref:registry-admin/admin-portal/version-control/create-new-change-request.adoc[]. - -//Ви можете переглянути зміни та їх статус у секції [.underline]#Внесені зміни# (детальніше -- на сторінці xref:registry-admin/admin-portal/version-control/overview-new-change-request.adoc#review-changes-candidate[Перегляд переліку внесених змін]). -You can review changes and their status in the [.underline]#Latest changes# section (more details at xref:registry-admin/admin-portal/version-control/overview-new-change-request.adoc#review-changes-candidate[Viewing latest changes]). -//Якщо ви завершили редагування і хочете опублікувати зміни у регламенті Gerrit-репозиторію, необхідно застосувати зміни до майстер-версії (детальніше -- на сторінці xref:registry-admin/admin-portal/version-control/overview-new-change-request.adoc#push-changes-master[Застосування змін до майстер-версії]). -If you have finished editing and want to publish the changes to the Gerrit repository, you need to apply the changes to the master version (more details at xref:registry-admin/admin-portal/version-control/overview-new-change-request.adoc#push-changes-master[Applying Changes to the Master Version page]). -==== +include::partial$snippets/admin-portal-master-candidate-edit-en.adoc[] diff --git a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/process-groups.adoc b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/process-groups.adoc index d5989f3a2a..e05bc476e1 100644 --- a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/process-groups.adoc +++ b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/process-groups.adoc @@ -1,72 +1,42 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Categorizing available services in user portals +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] + +include::platform:ROOT:partial$admonitions/language-en.adoc[] -//== Проблематика == Problem statement -//У Кабінетах користувачів усі доступні послуги представлені в єдиному списку, що є незручним для користувачів реєстрів із великою кількістю таких послуг. In user portals, all available services are presented in a single list, which is inconvenient for users of registries with a large number of such services. -//Щоб поліпшити досвід користувачів, реалізовано можливість категоризації послуг за допомогою груп та можливість управління порядком їх відображення. Це дозволяє більш ефективно відображати та знаходити необхідні послуги у реєстрах. To improve user experience, the ability to categorize services using groups and the ability to manage their display order has been implemented. This allows for more efficient display and easier access to the necessary services in registries. -//== Загальні принципи та положення == General principles and provisions -//Розробник регламенту може групувати та сортувати бізнес-процеси через вебінтерфейс адміністративного порталу. Зміни до налаштувань групування та сортування валідуються на етапі публікації регламенту реєстру та розгортаються на відповідному середовищі. -The regulations developer can group and sort business processes through the web interface of the administrative portal. Changes to grouping and sorting settings are validated during the publication of the registry regulations and deployed in the corresponding environment. +The registry regulations developer can group and sort business processes through the web interface of the administrative portal. Changes to grouping and sorting settings are validated during the publication of the registry regulations and deployed in the corresponding environment. -//Надалі користувачі Кабінетів посадової особи та отримувача послуг зможуть переглядати список бізнес-процесів із розділенням на групи та впорядкованих згідно з налаштуваннями регламенту. Subsequently, users of the Officer and Citizen portals will be able to view the list of business processes divided into groups and ordered according to the regulation settings. [NOTE] ==== -//Бізнес-процес не може бути прив'язаний до двох чи більше груп одночасно. Група не є обов'язковою, і якщо бізнес-процес не прив'язаний до групи, він відображається поза групою. Якщо відсутні налаштування груп, це означає, що жоден бізнес-процес не прив'язаний до групи. A business process cannot be assigned to two or more groups simultaneously. The group is not mandatory, and if a business process is not assigned to a group, it is displayed outside of any group. If there are no group settings, it means that no business process is assigned to a group. -//Групи, в яких немає жодного бізнес-процесу, доступного користувачу, не відображаються в Кабінетах користувачів, але вони відображаються в інтерфейсі Кабінету адміністратора регламентів. Вкладеність груп не підтримується. Groups that do not have any business processes available to the user are not displayed in user portals but are shown in the Regulations administrator portal's interface. Nesting of groups is not supported. ==== [#configure-bp-groups-in-admin-portal] -//== Налаштування груп бізнес-процесів у Кабінеті адміністратора регламентів == Configuring business process groups in the Regulations administrator portal -//TIP: Ви можете згрупувати бізнес-процеси, відсортувати групи та доступні послуги для відображення в Кабінетах. Користувачі бачитимуть лише ті послуги, до яких вони мають доступ. Група не відобразиться, якщо усі її процеси недоступні для користувача. TIP: You can group business processes, sort groups, and manage accessible services for display in the portals. Users will only see the services they have access to. A group will not be displayed if all its processes are inaccessible to the user. -//Налаштувати категоризацію бізнес-процесів за допомогою груп можна наступним чином: To configure the categorization of business processes using groups, follow these steps: -//. Увійдіть до [.underline]#Кабінету адміністратора регламентів# у своєму реєстрі. . Access the [.underline]#Regulations administrator portal# in your registry. -+ -//. Відкрийте, або створіть нову версію-кандидат на внесення змін. + . Open or create a new candidate version for merging changes. -//TODO: merging changes above is fine as a translation for внесення змін? -+ -//. Відкрийте розділ [.underline]#Моделі процесів# та перейдіть на вкладку `Відображення в кабінетах`. + . Go to the [.underline]#Process models# section and navigate to the *Display in portals* tab. -+ -//. Далі виконайте налаштування відповідно до потреб. Адміністратор регламенту може: -. Customize the settings according to your needs. The regulations administrator can: - -//* xref:#create-group[Створити групу] -//* xref:#rename-group[Перейменувати групу] -//* xref:#delete-group[Видалити групу] -//* xref:#sorting-groups[Сортувати групи] -//* xref:#add-bp-to-group[Додавати процеси до групи] -//* xref:#delete-bp-from-group[Видаляти бізнес-процеси із групи] -//* xref:#sorting-grouped-bp[Сортувати бізнес-процеси у групі] + +. Customize the settings according to your needs. The administrator can: + * xref:#create-group[Create a group] * xref:#rename-group[Rename a group] * xref:#delete-group[Delete a group] @@ -75,234 +45,174 @@ To configure the categorization of business processes using groups, follow these * xref:#delete-bp-from-group[Remove processes from a group] * xref:#sorting-grouped-bp[Sort business processes within a group] -//=== Операції з групами процесів === Operations with process groups -//Адміністратор регламенту може створювати, перейменовувати та видаляти групи процесів. -The regulations administrator can create, rename, and delete process groups. +The registry regulations administrator can create, rename, and delete process groups. -//NOTE: Усі операції зі створення та редагування можливо виконати лише в рамках версії-кандидата на внесення змін до регламенту. Для майстер-версії доступний лише режим перегляду (_детальніше -- див. xref:registry-admin/admin-portal/version-control/version-control-overview.adoc[]_). NOTE: All creation and editing operations can only be performed within a change candidate version of the regulations. The master version only allows viewing mode (see more at _xref:registry-admin/admin-portal/version-control/version-control-overview.adoc[]_) [#create-group] -//==== Створення групи бізнес-процесів ==== Creating a business process group -//Створити групу для об'єднання бізнес-процесів можна так: :: To create a group for consolidating business processes, follow these steps: :: -+ -//. Відкрийте вкладку `Відображення в кабінетах` та натисніть `[.underline]#Створити групу#`. + . Open the *Display in portals* tab and click on [.underline]#Create group#. + image::registry-admin/admin-portal/process-models/process-groups/process-groups-1.png[] -+ -//. Введіть назву нової групи. Назва має бути унікальною у межах регламенту. + . Enter a unique name for the new group within the regulations. + -//NOTE: Може мати від 3 до 512 символів. Допустимі символи: “А-Я”, “а-я” української абетки, пробіл, апостроф, тире, дефіс, "()", "/",":", ";", ",", ".", "№", цифри 0-9. NOTE: The name can have 3 to 512 characters. Allowed characters include "A-Z," "a-z" of the Ukrainian alphabet, space, apostrophe, hyphen, parentheses, "/", ":", ";", ",", ".", "№," and numbers 0-9. + image::registry-admin/admin-portal/process-models/process-groups/process-groups-2.png[] + [WARNING] ==== -//* Якщо порушено формат вводу даних, то ви отримаєте наступну валідаційну помилку: * If the data input format is violated, you will receive the following validation error: + image::registry-admin/admin-portal/process-models/process-groups/process-groups-2-1.png[] -//* Якщо група з такою назвою вже існує, то ви отримаєте наступну валідаційну помилку: * If a group with the same name already exists, you will receive the following validation error: + image::registry-admin/admin-portal/process-models/process-groups/process-groups-2-2.png[] - ==== -+ -//. Натисніть kbd:[Зберегти зміни]. + . Click kbd:[Save changes]. + image::registry-admin/admin-portal/process-models/process-groups/process-groups-3.png[] [#rename-group] -//==== Перейменування групи бізнес-процесів ==== Renaming a business process group -//Перейменувати групу можна так: :: To rename a group, follow these steps: :: -//. Відкрийте вкладку `Відображення в кабінетах`. . Open the *Display in portals* tab. -+ -//. Навпроти відповідної групи, або всередині групи оберіть меню "три крапки" (⋮) та натисніть kbd:[Перейменувати]. + . Next to the corresponding group or inside the group, select the "ellipsis" menu (⋮) and click on kbd:[Rename]. + image::registry-admin/admin-portal/process-models/process-groups/process-groups-4.png[] + image::registry-admin/admin-portal/process-models/process-groups/process-groups-4-1.png[] -+ -//. У новому вікні введіть бажану назву. + . In the new window, enter the desired name. + -//NOTE: Може мати від 3 до 512 символів. Допустимі символи: “А-Я”, “а-я” української абетки, пробіл, апостроф, тире, дефіс, "()", "/",":", ";", ",", ".", "№", цифри 0-9. NOTE: The name can have 3 to 512 characters. Allowed characters include "A-Z," "a-z" of the Ukrainian alphabet, space, apostrophe, hyphen, parentheses, "/", ":", ";", ",", ".", "№," and numbers 0-9. + image::registry-admin/admin-portal/process-models/process-groups/process-groups-5.png[] -+ -//. Натисніть kbd:[Зберегти зміни]. + . Click kbd:[Save changes]. + image::registry-admin/admin-portal/process-models/process-groups/process-groups-6.png[] [#delete-group] -//==== Видалення групи бізнес-процесів ==== Deleting a business process group -//NOTE: Зверніть увагу, що при видаленні групи, бізнес-процеси не видаляються, а переходять до стану [.underline]#не згрупованих#. NOTE: Note that when deleting a group, the business processes are not deleted but become [.underline]#ungrouped#. -//Видалити групу можна так: :: To delete a group, follow these steps: :: -//. Відкрийте вкладку `Відображення в кабінетах`. . Open the *Display in portals* tab. -+ -//. Навпроти відповідної групи, або всередині групи оберіть меню "три крапки" (⋮) та натисніть kbd:[Видалити]. + . Next to the corresponding group or inside the group, select the "ellipsis" menu (⋮) and click on kbd:[Delete]. + image::registry-admin/admin-portal/process-models/process-groups/process-groups-7.png[] + image::registry-admin/admin-portal/process-models/process-groups/process-groups-8.png[] -+ -//. У новому вікні підтвердьте, або скасуйте дію. + . In the new window, confirm or cancel the action. + image::registry-admin/admin-portal/process-models/process-groups/process-groups-9.png[] -+ -//. Натисніть kbd:[Зберегти зміни]. + . Click kbd:[Save changes]. + image::registry-admin/admin-portal/process-models/process-groups/process-groups-10.png[] [#sorting-groups] -//==== Сортування груп ==== Sorting business process groups -//Використання вертикальних стрілок на інтерфейсі для переміщення груп бізнес-процесів дозволяє користувачам зручно та швидко знаходити та вибирати потрібні бізнес-процеси зі списку. Using the vertical arrows on the interface to move business process groups allows users to conveniently and quickly find and select the desired processes from the list. image::registry-admin/admin-portal/process-models/process-groups/process-groups-13.png[] -//Наприклад, якщо на інтерфейсі є список груп, таких як "Кадровий склад", "Заяви", "Майно" тощо, то використання вертикальних стрілок дозволяє сортувати ці групи за різними логічними критеріями, щоб надати користувачам зручний доступ до необхідної інформації. For example, if the interface has a list of groups such as "Personnel," "Requests," "Assets," etc., using the vertical arrows allows sorting these groups based on different logical criteria to provide users with convenient access to the necessary information. -//TIP: При створенні групи через Кабінет адміністратора регламентів, вона потрапляє у низ списку груп. Надалі її можна посунути, куди необхідно. TIP: When creating a group through the Regulations administrator portal, it is placed at the bottom of the group list. Later on, it can be moved wherever necessary. -//Крім того, сортування груп бізнес-процесів може допомогти забезпечити консистентність та логічність в інтерфейсі, що полегшує навігацію користувачів та поліпшує їх досвід взаємодії з системою. Additionally, sorting business process groups can help ensure consistency and logical structure in the interface, facilitating user navigation and improving their interaction experience with the system. -//=== Операції із процесами === Operations with processes [#add-bp-to-group] -//==== Додавання бізнес-процесів до групи ==== Adding business processes to a group -//Додати бізнес-процес до групи можна так: :: To add a business process to a group, follow these steps: :: -//. Відкрийте вкладку `Відображення в кабінетах`.. . Open the *Display in portals* tab. -+ -//. Створіть групу (_див. розділ xref:#create-group[]_). + . Create a group (_see xref:#create-group[]_). -+ -//. Навпроти відповідного бізнес-процесу, натисніть іконку з текою (📁). + . Next to the respective business process, click on the folder icon (📁) + image::registry-admin/admin-portal/process-models/process-groups/process-groups-11.png[] -+ -//. У новому вікні оберіть бажану групу, до якої необхідно перенести бізнес-процес. + . In the new window, select the desired group to which you want to transfer the business process. + image::registry-admin/admin-portal/process-models/process-groups/process-groups-12.png[] + -//TIP: Ви можете перенести бізнес-процес в іншу групу чи виключити з поточної. Він буде доданий у кінець обраного переліку бізнес-процесів. TIP: You can move the business process to another group or exclude it from the current one. It will be added to the end of the selected list of business processes. -+ -//. Натисніть kbd:[Підтвердити]. + . Click kbd:[Confirm]. + image::registry-admin/admin-portal/process-models/process-groups/process-groups-12-1.png[] -+ -//. Збережіть зміни. + . Save changes. [#delete-bp-from-group] -//==== Видалення бізнес-процесу із групи ==== Removing a business process from a group -//Видалити бізнес-процес із групи можна так: :: To remove a business process from a group, follow these steps: :: -//. Відкрийте вкладку `Відображення в кабінетах`. . Open the *Display in portals* tab. -+ -//. Відкрийте наявну групу із процесами. + . Open the existing group with processes. -+ -//. Навпроти відповідного бізнес-процесу, натисніть іконку з текою (📁). + . Next to the respective business process, click on the folder icon (📁) + image::registry-admin/admin-portal/process-models/process-groups/process-groups-14.png[] -+ -//. У новому вікні оберіть `Виключити з групи`, з якої необхідно виключити бізнес-процес. + . In the new window, select `Exclude from the group` to remove the business process from the group. + image::registry-admin/admin-portal/process-models/process-groups/process-groups-15.png[] + -//TIP: Ви можете також перенести бізнес-процес в іншу групу. Він буде доданий у кінець обраного переліку бізнес-процесів. TIP: You can also move the business process to another group. It will be added to the end of the selected list of business processes. -+ -//. Натисніть kbd:[Підтвердити]. + . Click kbd:[Confirm]. + image::registry-admin/admin-portal/process-models/process-groups/process-groups-15-1.png[] -+ -//. Збережіть зміни. + . Save changes. [#sorting-grouped-bp] -//==== Сортування бізнес-процесів у групі ==== Sorting business processes within a group -//Впровадження можливості сортування бізнес-процесів на інтерфейсі дозволить користувачам легко та швидко знаходити та вибирати необхідні послуги. Зокрема, можна використовувати вертикальні стрілки для переміщення процесів у рамках груп, або за їх межами. Implementing the ability to sort business processes in the interface allows users to easily and quickly find and select the required services. Vertical arrows can be used to move processes within groups or outside of them. image::registry-admin/admin-portal/process-models/process-groups/process-groups-16.png[] -//== Моделювання регламенту реєстру == Modeling the registry regulations -//Налаштування категоризації (групування) бізнес-процесів у Кабінетах користувачів знаходяться у конфігураційному файлі *_bp-grouping.yaml_* у регламенті вашого реєстру. -The configuration of categorization (grouping) of business processes in user portals is located in the *_bp-grouping.yaml_* configuration file within the regulations of your registry. +The configuration for categorization (grouping) of business processes in user portals is located in the *_bp-grouping.yaml_* configuration file within the regulations of your registry. -//NOTE: Якщо такий файл відсутній, то створіть та заповніть його відповідно (_див. приклад нижче_). NOTE: If such a file is absent, create and fill it accordingly (_see the example below_). -//Є 2 способи, як можна налаштувати групування послуг у Кабінетах користувачів: :: There are two ways to configure service grouping in user portals: :: -//. xref:#configure-bp-groups-in-admin-portal[В інтерфейсі Кабінету адміністратора регламентів] -- в такому разі після внесення змін до майстер-версії регламенту, налаштування [.underline]#_автоматично_# застосуються до файлу *_bp-grouping.yaml_* у Gerrit-репозиторії. . In the xref:#configure-bp-groups-in-admin-portal[Regulations administrator portal interface] -- in this case, after making changes to the master version of the regulations, the settings will [.underline]#automatically# be applied to the *_bp-grouping.yaml_* file in the Gerrit repository. -+ -//. У структурі регламенту в Gerrit-репозиторії [.underline]#_вручну_# -- в такому разі, після розгортання регламенту пайплайном публікацій зміни стануть доступні в інтерфейсах Кабінетів адміністратора та користувачів. + . In the structure of the regulations in the Gerrit repository [.underline]#manually# -- in this case, after deploying the regulations through the publication pipeline, the changes will become available in the interfaces of the Regulations administrator portal. + -//NOTE: За замовчуванням налаштування групування _bp-grouping.yaml_ порожні. NOTE: By default, the *_bp-grouping.yaml_* grouping settings are empty. + -.Структура регламенту реєстру .Registry regulations structure [plantuml, registry-settings-regulation-structure, svg] ---- @@ -320,47 +230,39 @@ NOTE: By default, the *_bp-grouping.yaml_* grouping settings are empty. @endsalt ---- + -.Приклад конфігурації реєстру bp-grouping/bp-grouping.yaml .Registry configuration example: bp-grouping/bp-grouping.yaml ==== [source, yaml] ---- groups: - - name: Перша група + - name: First group processDefinitions: - bp-1-process_definition_id - bp-2-process_definition_id - - name: Друга група + - name: Second group processDefinitions: - bp-3-process_definition_id - - name: Третя група + - name: Third group ungrouped: - bp-4-process_definition_id - bp-5-process_definition_id ---- -//* Масив `*groups*` містить групи бізнес-процесів. * The `*groups*` array contains groups of business processes. -//* Масив `*ungrouped*` містить не згруповані бізнес-процеси. + * The `*ungrouped*` array contains ungrouped business processes. -//NOTE: Бізнес-процеси, що вказані у масивах `processDefinitions` та `ungrouped`, мають існувати у регламенті реєстру, у теці *_bpmn_*. NOTE: The business processes listed in the `processDefinitions` and `ungrouped` arrays must exist in the registry's regulations, in the *_bpmn_* directory. ==== -//NOTE: При видаленні бізнес-процесу, він автоматично видаляється з файлу *_bp-grouping.yml_*. NOTE: When a business process is deleted, it is automatically removed from the *_bp-grouping.yaml_* file. -//== Зовнішній вигляд Кабінетах користувачів == User portal interfaces -//Після розгортання регламенту та застосування налаштувань, групи бізнес-процесів відображатимуться у Кабінетах посадової особи та отримувача послуг. After deploying the regulations and applying the settings, groups of business processes will be displayed in the user portals for the Officers and Citizens. -.Групи процесів у Кабінеті посадової особи .Process groups in the Officer portal image::registry-admin/admin-portal/process-models/process-groups/process-groups-17.png[] -.Групи процесів у Кабінеті отримувача послуг .Process groups in the Citizen portal image::registry-admin/admin-portal/process-models/process-groups/process-groups-18.png[] \ No newline at end of file diff --git a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/process-models-overview.adoc b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/process-models-overview.adoc index aa649b17cd..4d646040d0 100644 --- a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/process-models-overview.adoc +++ b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/process-models-overview.adoc @@ -1,63 +1,39 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: += Managing business process models :sectlinks: -:partnums: +:sectanchors: -= Managing business process models +include::platform:ROOT:partial$admonitions/language-en.adoc[] + +This section demonstrates the functionality of modeling and managing business process diagrams the Administrative portal for registry regulations developers. image:registry-develop:registry-admin/admin-portal/process-models/process-models-1.png[] -//Розділ показує функціональність моделювання та управління схемами бізнес-процесів у Кабінеті адміністратора регламентів. Функціональність дозволяє: -This section demonstrates the functionality of modeling and managing business process diagrams in Regulations administrator portal. The functionality allows you to: - -//* [*] xref:registry-admin/admin-portal/registry-modeling/process-models/create-process.adoc[Створювати процеси] -* [*] xref:registry-admin/admin-portal/registry-modeling/process-models/create-process.adoc[Create processes] -//* [*] xref:registry-admin/admin-portal/registry-modeling/process-models/edit-process.adoc[Редагувати процеси] -* [*] xref:registry-admin/admin-portal/registry-modeling/process-models/edit-process.adoc[Edit processes] -//* [*] xref:registry-admin/admin-portal/registry-modeling/process-models/search-process.adoc[Шукати процеси за назвою] -* [*] xref:registry-admin/admin-portal/registry-modeling/process-models/search-process.adoc[Search for processes by name] -//* [*] xref:registry-admin/admin-portal/registry-modeling/process-models/copy-process.adoc[Копіювати процеси] -* [*] xref:registry-admin/admin-portal/registry-modeling/process-models/copy-process.adoc[Copy processes] -//* [*] xref:registry-admin/admin-portal/registry-modeling/process-models/upload-process.adoc[Завантажувати (upload) процеси] -* [*] xref:registry-admin/admin-portal/registry-modeling/process-models/upload-process.adoc[Upload processes] -//TODO: TBD in future: Експортувати (download) процеси -//* [*] xref:registry-admin/admin-portal/registry-modeling/process-models/sorting-process.adoc[Сортувати процеси] -* [*] xref:registry-admin/admin-portal/registry-modeling/process-models/sorting-process.adoc[Sort processes] -//* [*] xref:registry-develop:registry-admin/admin-portal/registry-modeling/process-models/process-groups.adoc[Категоризувати послуги] -* [*] xref:registry-develop:registry-admin/admin-portal/registry-modeling/process-models/process-groups.adoc[Categorize services] -//* [*] xref:registry-admin/admin-portal/registry-modeling/process-models/delete-process.adoc[Видаляти процеси] -* [*] xref:registry-admin/admin-portal/registry-modeling/process-models/delete-process.adoc[Delete processes] -//* [*] xref:registry-admin/admin-portal/registry-modeling/process-models/components/process-components-overview.adoc[Переглядати та редагувати складові процесів], а саме: -* [*] xref:registry-admin/admin-portal/registry-modeling/process-models/components/process-components-overview.adoc[View and edit process components], and namely: - -//** xref:registry-admin/admin-portal/registry-modeling/process-models/create-process.adoc#tab-general[керувати назвами процесу]; -** xref:registry-admin/admin-portal/registry-modeling/process-models/create-process.adoc#tab-general[Manage process names]; -//** xref:registry-admin/admin-portal/registry-modeling/process-models/components/tab-code.adoc[переглядати та редагувати код XML-представлення процесів]; -** xref:registry-admin/admin-portal/registry-modeling/process-models/components/tab-code.adoc[View and edit the processes XML representation code]; -//** xref:registry-admin/admin-portal/registry-modeling/process-models/components/tab-bpmn-editor.adoc[моделювати процеси у BPMN-конструкторі]. -** xref:registry-admin/admin-portal/registry-modeling/process-models/components/tab-bpmn-editor.adoc[Model processes in the BPMN constructor]. +The functionality allows you to: :: + +* Create processes +* Edit processes +* Search for processes by name +* Copy processes +* Upload processes +* Sort processes +* Categorize processes +* Delete processes +* View and edit process components, namely: + +** Manage process names +** View and edit the processes XML representation code +** Build processes in the BPMN constructor [CAUTION] ==== -//Редагування складових регламенту реєстру можливе лише в рамках версій-кандидатів на внесення змін. Для майстер-версії доступна лише опція перегляду. Editing the components of the registry regulations is only possible within change candidate versions. For the master version, only the view option is available. -//У рамках майстер-версії на внесення змін моделювальник регламенту може: Within the master version, the regulation modeler can: -//* переглядати доступні бізнес-процеси; -// сортувати бізнес-процеси; -//* переглядати складові бізнес-процесів на вкладках [.underline]#Загальна#, [.underline]#Код# та [.underline]#Конструктор#. * View available business processes * Sort business processes -* View components of business processes on the [.underline]#General#, [.underline]#Code#, and [.underline]#Constructor# tabs +* View components of business processes on the *General*, *Code*, and *Builder* tabs -//Детальніше про особливості роботи з версіями регламенту дивіться на сторінці: For more information on working with regulation versions, please refer to the page: * xref:registry-admin/admin-portal/version-control/version-control-overview.adoc[] @@ -65,19 +41,26 @@ For more information on working with regulation versions, please refer to the pa [WARNING] ==== -//Рекомендації для збереження та видалення об'єктів у Кабінеті адміністратора регламентів: Recommendations for saving and deleting objects in the Regulations administrator portal: -//* Зверніть увагу, що у Кабінеті адміністратора регламентів немає попереджувальних вікон, тому будьте особливо уважні та обережні при роботі з об'єктами. * Please note that there are no warning windows in the Regulations administrator portal, so be particularly careful when working with objects. -//* Будьте особливо обережні та уважні при збереженні або видаленні об'єктів, таких як бізнес-процеси, форми тощо. * Exercise caution and attentiveness when saving or deleting objects such as business processes, forms, and so on. -//* Перед створенням або видаленням об'єкта, рекомендується перевірити його, щоб уникнути непередбачуваних наслідків. * Before creating or deleting an object, it is recommended to check it to avoid unforeseen consequences. -//* Врахуйте, що видалення або зміна об'єкта може призвести до втрати даних та порушення бізнес-процесів. * Please be aware that deleting or modifying an object may result in data loss and disruption of business processes. ==== +== Section overview + +* xref:registry-admin/admin-portal/registry-modeling/process-models/create-process.adoc[Create processes] +* xref:registry-admin/admin-portal/registry-modeling/process-models/edit-process.adoc[Edit processes] +* xref:registry-admin/admin-portal/registry-modeling/process-models/search-process.adoc[Search for processes by name] +* xref:registry-admin/admin-portal/registry-modeling/process-models/copy-process.adoc[Copy processes] +* xref:registry-admin/admin-portal/registry-modeling/process-models/upload-process.adoc[Upload processes] +* xref:registry-admin/admin-portal/registry-modeling/process-models/sorting-process.adoc[Sort processes] +* xref:registry-develop:registry-admin/admin-portal/registry-modeling/process-models/process-groups.adoc[Categorize services] +* xref:registry-admin/admin-portal/registry-modeling/process-models/delete-process.adoc[Delete processes] +* xref:registry-admin/admin-portal/registry-modeling/process-models/components/process-components-overview.adoc[View and edit process components] + diff --git a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/search-process.adoc b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/search-process.adoc index a5258a81f7..de8db376b3 100644 --- a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/search-process.adoc +++ b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/search-process.adoc @@ -1,25 +1,14 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: += Searching processes by name +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] -//= Пошук процесів за назвою -= Searching for processes by name +include::platform:ROOT:partial$admonitions/language-en.adoc[] -//Використовуйте функціональність пошуку бізнес-процесів за назвою. Це дозволяє полегшити та пришвидшити роботу зі схемами процесів. Utilize the functionality of searching for business processes by name. This helps to streamline and expedite work with process diagrams. image:registry-develop:registry-admin/admin-portal/process-models/process-models-13.png[] -//Відкрийте розділ [.underline]#Моделі процесів# та введіть принаймні 3 перші символи назви процесу у полі `Шукати за назвою 🔍`. В результаті ви отримаєте список, що задовольняє введеному значенню. -Open the [.underline]#Process models# section and enter at least the first 3 characters of the process name in the `Search by name` field 🔍`. As a result, you will receive a list that matches the entered value. +Open the *Process models* section and enter at least the first 3 characters of the process name in the `Search by name` field 🔍`. As a result, you will receive a list that matches the entered value. -//NOTE: Шукати процес можна як за бізнес-, так і за службовою назвою. NOTE: You can search for a process by both the business name and the technical name. image:registry-develop:registry-admin/admin-portal/process-models/process-models-14.png[] \ No newline at end of file diff --git a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/sorting-process.adoc b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/sorting-process.adoc index 6c5c241319..1251909bdf 100644 --- a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/sorting-process.adoc +++ b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/sorting-process.adoc @@ -1,38 +1,22 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - -//= Сортування бізнес-процесів = Sorting business processes +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] + +include::platform:ROOT:partial$admonitions/language-en.adoc[] -//Використовуйте функціональність сортування бізнес-процесів. Це дозволяє упорядкувати доступні моделі процесів у висхідному `↑` та низхідному `↓` порядку, покращити користувацький досвід та досліджувати історичність створення та модифікації процесів. Utilize the functionality of sorting business processes. This allows you to arrange available process models in ascending `↑` or descending `↓` order, improve user experience, and explore the history of creation and modification of processes. -//Застосовуйте бажаний тип сортування до наступних колонок: :: Apply the desired sorting type to the following columns: :: -//* `Назва БП` -//* `Службова назва` -//* `Створено` -//* `Відредаговано` -* `Process name` -* `Technical name` -* `Created` -* `Last Edited` +* *Process name* +* *Technical name* +* *Created* +* *Last edited* image:registry-develop:registry-admin/admin-portal/process-models/process-models-19.png[] [TIP] ==== -//Механізм сортування є однаковим для бізнес-процесів UI-форм. The sorting mechanism is the same for both business processes and UI forms. -//Детальнішу інформацію щодо сортування записів у Кабінеті адміністратора ви можете переглянути на сторінці xref:registry-admin/admin-portal/registry-modeling/ui-forms/sorting-paginating-forms.adoc[]. For more detailed information on sorting records in the Regulations administrator portal, please refer to xref:registry-admin/admin-portal/registry-modeling/ui-forms/sorting-paginating-forms.adoc[]. ==== \ No newline at end of file diff --git a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/upload-process.adoc b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/upload-process.adoc index 080d0ec359..e5c92667bb 100644 --- a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/upload-process.adoc +++ b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/upload-process.adoc @@ -1,37 +1,21 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - -//= Завантаження (upload) бізнес-процесів = Uploading business processes +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] -//Завантажити бізнес-процес до регламенту можна через копіювання та вставлення XML-схеми готового процесу на вкладці [.underline]#Код#. Пряма опція `Drag & Drop` (перетягування файлу зі схемою) недоступна. -You can upload a business process to the regulation by copying and pasting the XML schema of the ready process in the [.underline]#Code# tab. The direct option of `Drag & Drop` (dragging a file with the schema) is not available. +include::platform:ROOT:partial$admonitions/language-en.adoc[] -.Вставлення коду BPMN-діаграми на вкладці [.underline]#Код# -.Inserting BPMN diagram code in the [.underline]#Code# tab +You can upload a business process to the regulation by copying and pasting the XML schema of the ready process in the *Code* tab. The direct option of `Drag & Drop` (dragging a file with the schema) is not available. + +.Inserting BPMN diagram code in the *Code* tab image::registry-develop:registry-admin/admin-portal/process-models/process-models-12-2.png[] -//TIP: Детальніше про особливості роботи з кодом бізнес-процесу -- на сторінці TIP: For more details on working with the code of a business process, please refer to xref:registry-admin/admin-portal/registry-modeling/process-models/components/tab-code.adoc[]. - [CAUTION] ==== -//Редагування складових регламенту реєстру можливе лише в рамках версій-кандидатів на внесення змін. Для майстер-версії доступна лише опція перегляду. Editing components of the registry regulations is only possible within change candidate versions. For the master version, only the viewing option is available. -//Детальніше про особливості роботи з версіями регламенту дивіться на сторінці: -For more information on working with regulations versions, please refer to - -* xref:registry-admin/admin-portal/version-control/version-control-overview.adoc[] +For more information on working with registry regulations versions, please refer to xref:registry-admin/admin-portal/version-control/version-control-overview.adoc[]. ==== diff --git a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/registry-global-settings.adoc b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/registry-global-settings.adoc index 2d74743e59..54652e151c 100644 --- a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/registry-global-settings.adoc +++ b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/registry-global-settings.adoc @@ -1,122 +1,87 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - -//= Управління глобальними налаштуваннями реєстру = Configuring global registry settings +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] + +include::platform:ROOT:partial$admonitions/language-en.adoc[] -//Платформа надає можливість керувати глобальними налаштуваннями реєстру в інтерфейсі порталу адміністратора регламенту. The platform provides the ability to manage the global settings of the registry within the administrator portal interface. image:registry-admin/admin-portal/global-settings/registry-global-settings-1.png[] -//Наразі адміністратор регламенту може налаштувати такі параметри: :: Currently, the registry administrator can configure the following parameters: :: -//* xref:#support-email[Поштова адреса служби підтримки] * xref:#support-email[Support service mailing address] -//* xref:#registry-full-name[Повна назва реєстру] + * xref:#registry-full-name[Full registry name] -//* xref:#registry-short-name[Скорочена назва реєстру] + * xref:#registry-short-name[Abbreviated registry name] -//* xref:#ui-theme[Тема інтерфейсу] + * xref:#ui-theme[Interface theme] -//Надалі перелік налаштувань буде розширено. The list of settings will be expanded in the future. -//CAUTION: Редагування складових регламенту реєстру можливо внести лише в рамках версій-кандидатів на внесення змін. Для майстер-версії доступна лише опція перегляду. CAUTION: Editing the components of the registry regulations can only be done within change candidate versions. For the master version, only the view option is available. -//IMPORTANT: Для того, щоб застосувати бажані параметри, натисніть кнопку `Зберегти зміни`, як показано на зображенні вище. IMPORTANT: To apply the desired parameters, click the *Save changes* button as shown in the image above. [#support-email] -//== Поштова адреса служби підтримки == Support service mailing address -//Якщо користувач Кабінету посадової особи, або отримувача послуг отримає критичну помилку, він зможе звернутись до підтримки за цією адресою. If a user of the Officer or the Citizen portal encounters a critical error, they can contact support using this address. -//Параметр задається у полі `Поштова адреса служби підтримки`. The parameter is set in the *Support service mailing address* field. image:registry-admin/admin-portal/global-settings/registry-global-settings-2.png[] [IMPORTANT] ==== -//Електронна адреса має бути у форматі "test@example.com". Якщо введена адреса не відповідає заданому формату, користувач отримає відповідну валідаційну помилку: The email address should be in the format "test@example.com". If the entered address does not match the specified format, the user will receive a corresponding validation error: -//`❗ Електронна адреса має бути в форматі "test@example.com"` `❗ The email address should be in the format "test@example.com"` - image:registry-admin/admin-portal/global-settings/registry-global-settings-3.png[] ==== [WARNING] ==== -//Користувач не зможе вносити в налаштуваннях адреси доменів, що заборонені чинним законодавством України (наприклад, домени `mail.ru`, або `yandex.ru` тощо). Система видасть відповідну валідаційну помилку: -Users cannot enter domain addresses that are prohibited by current legislation in Ukraine (for example, domains like `mail.ru` or `yandex.ru`). The system will display a corresponding validation error: +Users cannot enter domain addresses that are prohibited by current legislation in Ukraine, for example, domains like `mail.ru` or `yandex.ru`. The system will display a corresponding validation error: -//`❗ Дана поштова адреса не може використовуватись через політику безпеки` `❗ This email address cannot be used due to security policy` image:registry-admin/admin-portal/global-settings/registry-global-settings-4.png[] ==== [#registry-full-name] -//== Повна назва реєстру == Full registry name -//_Повна назва_ -- це офіційна юридична назва реєстру. Використовується в офіційному листуванні, у документах, колонтитулах кабінетів тощо. _The full name_ is the official legal name of the registry. It is used in official correspondence, documents, and cabinet headers, among others. -//CAUTION: Може мати від 3 до 512 символів. Допустимі символи: `"А-Я"`, `"а-я"` української абетки, `"0-9"`, `"-"`, `","`, `"."`, апостроф (`'`), пробіл. CAUTION: It can have 3 to 512 characters. Permissible characters are: "A-Z," "a-z" of the Ukrainian alphabet, "0-9," "-", ",", ".", apostrophe ('), space. -.Повна назва реєстру ЄДР .Full name of the Unified state register ==== -//`ЄДИНИЙ ДЕРЖАВНИЙ РЕЄСТР ЮРИДИЧНИХ ОСІБ, ФІЗИЧНИХ ОСІБ - ПІДПРИЄМЦІВ ТА ГРОМАДСЬКИХ ФОРМУВАНЬ` `STATE REGISTER OF LEGAL ENTITIES, INDIVIDUAL ENTREPRENEURS, AND PUBLIC FORMATIONS` ==== image:registry-admin/admin-portal/global-settings/registry-global-settings-5.png[] [#registry-short-name] -//== Скорочена назва реєстру == Abbreviated registry name -//_Скорочену назву_ використовують у неофіційному спілкуванні, а також там, де недостатньо місця для повної назви, наприклад, у верхній частині кабінетів. _The abbreviated name_ is used in informal communication and where there is limited space for the full name, such as in the upper part of portals. -//CAUTION: Може мати від 1 до 42 символів. Допустимі символи: `"А-Я"`, `"а-я"` української абетки, `"0-9"`, `"-"`, `","`, `"."`, апостроф (`'`), пробіл. CAUTION: It can have 1 to 42 characters. Permissible characters are: "A-Z," "a-z" of the Ukrainian alphabet, "0-9," "-", ",", ".", apostrophe ('), space. image:registry-admin/admin-portal/global-settings/registry-global-settings-6.png[] [#ui-theme] -//== Тема інтерфейсу == Interface theme -//Обрана тема застосовується для усіх кабінетів (отримувача послуг, посадової особи, адміністратора). Не впливає на інтерфейс адміністративної панелі керування платформою та реєстрами Control Plane. The selected theme is applied to all portals (Citizens, Officers, Administrators). It does not affect the interface of the platform's administrative control panel and *Control Plane* registries. -//Наразі підтримуються 2 теми для інтерфейсів користувача: Currently, two themes for user interfaces are supported: -//* Світла тема (за замовчуванням) * Light theme (default) -//* Темна тема * Dark theme image:registry-admin/admin-portal/global-settings/registry-global-settings-7.png[] \ No newline at end of file diff --git a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/report-templates.adoc b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/report-templates.adoc index fa20b66fa9..05c988603d 100644 --- a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/report-templates.adoc +++ b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/report-templates.adoc @@ -3,111 +3,86 @@ include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc include::platform:ROOT:partial$admonitions/language-en.adoc[] -//== Огляд == Overview -//Розділ +++Шаблони звітів+++ у Кабінеті адміністратора регламентів містить аналітичну звітність реєстру у форматі JSON, розроблену у відповідному екземплярі Вебінтерфейсу моделювання звітів (Redash Admin). -The *Report templates* section of the Regulations administrator portal contains a list of the registry's analytical reports in JSON format developed in the corresponding instance of the Reports modeling service (Redash Admin). +The *Report templates* section of the Regulations administrator portal contains a list of the registry's analytical reports in JSON format developed in the corresponding instance of the Report modeling service (Redash Admin). -//Ви маєте можливість переглядати та завантажувати створені об'єкти для подальшого публікування їх у регламенті. Here you can view and download these objects for further publication in the regulations. -//IMPORTANT: Цей розділ не залежить від обраної версії регламенту. Будь-які зміни застосовуються до всіх версій регламенту (включно з майстер-версією). -IMPORTANT: This section does not depend on the selected version of the regulations. Any changes apply to all versions of the regulations (including the master version). +IMPORTANT: This section does not depend on the selected version of the regulations. Any changes apply to all versions of the registry regulations, including the `master` version. [TIP] ==== -//* Детальніше про розробку аналітичної звітності дивіться на сторінці xref:registry-develop:data-modeling/reports/reports-overview.adoc[]. + * For details on developing analytical reports, see xref:registry-develop:data-modeling/reports/reports-overview.adoc[]. -//* Детальніше про публікацію аналітичних звітів у регламенті дивіться практичне завдання з розробки аналітичних звітів, розділ xref:registry-develop:study-project/study-tasks/task-6-registry-reports-modeling.adoc#reports-publication[Публікація створених об'єктів користувачам]. + * For details on publishing analytical reports to the regulations, see the study task for developing analytical reports, xref:registry-develop:study-project/study-tasks/task-6-registry-reports-modeling.adoc#reports-publication[Publishing the objects to users] section. ==== -//== Навігація та пошук == Navigation and search -//Ви можете переглядати об'єкти аналітичної звітності у Кабінеті адміністратора регламентів. You can view the analytical reporting objects in the Regulations administrator portal. -//. Увійдіть до Кабінету адміністратора регламентів. . Sign in to the Regulations administrator portal. -+ -//. Відкрийте розділ +++Шаблони звітів+++. + . Open the *Report templates* section. + image:registry-develop:registry-admin/admin-portal/report-templates/report-templates-section.png[] -+ -//. На сторінці +++Змодельовані звіти+++ переглядайте об'єкти аналітичної звітності за допомогою навігаційних елементів та пошуку. + . On the *Modeled reports* page, browse the analytical reporting objects using navigation and search. -//=== Пошук === Search -//Ви можете шукати об'єкти за назвою звіту. Для цього введіть назву звіту у пошукове поле. You can search objects by the report name. For this, enter the report name into the search field. -//NOTE: Пошук працює як за бізнес-назвою, так і за службовою назвою звіту. NOTE: You can search by the report's business name or service name. image:registry-develop:registry-admin/admin-portal/report-templates/report-templates-search.png[] -//=== Сортування === Sorting -//Ви можете сортувати об'єкти за будь-яким стовпцем таблиці. Для цього виконайте наступні кроки: You can sort objects by any of the table's columns. For this, perform the following steps: -//. Натисніть назву стовпця, за якою треба відсортувати об'єкти. . Click the name of the column by which you wish to sort the objects. + image:registry-develop:registry-admin/admin-portal/report-templates/report-templates-sort.png[] + -//. Оберіть опцію сортування: + . Select the sorting option: -//* `↓` -- Низхідне сортування (ascending). За алфавітом -- від `А` до `Я`. За датою -- найновіші вгорі. За числами -- від найменших до найбільших. + * `↓` -- Sort ascending. String values sort alphabetically A through Z, numbers sort lowest to highest, and dates sort latest to earliest (latest on top). -//* `↑` -- Висхідне сортування (descending). За алфавітом -- від `Я` до `А`. За датою -- найдавніші вгорі. За числами -- від найбільших до найменших. + * `↑` -- Sort descending. String values sort alphabetically Z through A, numbers sort highest to lowest, and dates sort earliest to latest (earliest on top). -//=== Пагінація === Pagination -//Ви можете переходити між сторінками та змінювати кількість рядків, що відображаються на одній сторінці. Для цього прокрутіть бігунок униз сторінки. You can switch between pages and adjust the number of rows displayed on a page. For this, scroll down to the bottom of the page. -//* Для переходу між сторінками використовуйте позначки `>` (вперед) або `<` (назад). * To switch between pages, use the `>` (next) or `<` (previous) icons. -//* Тут ви також можете обрати кількість рядків на сторінці (10 за замовчанням). + * Here you can also change the number of rows displayed on a page (10 by default). image:registry-develop:registry-admin/admin-portal/report-templates/report-templates-pagination.png[] -//== Завантаження об'єктів == Downloading objects -//Після того, як ви знайшли потрібний об'єкт на сторінці +++Змодельовані звіти+++, можете завантажити його для подальшої публікації у регламенті. Для цього виконайте наступні кроки: After you find the object on the *Modeled reports* page, you can download it for further publication in the regulations. For this, perform the following steps: -//. Натисніть іконку завантаження (`⤓`) біля потрібного об'єкта. . Click the download icon (`⤓`) next to the object. + image:registry-develop:registry-admin/admin-portal/report-templates/report-templates-download.png[] -+ -//. Розпакуйте отриманий архів. + . Unzip the archive. [TIP] ==== -//Архів містить дві сутності: The archive contains two entities: -//* Дашборди у JSON форматі. Кожний дашборд зберігається в окремому файлі з унікальною назвою (наприклад, _dashboard_1.json_, _dashboard_2.json_, _dashboard_3.json_ тощо). * Dashboards in JSON format. Each dashboard is stored in a separate file with a unique name (for example, _dashboard_1.json_, _dashboard_2.json_, _dashboard_3.json_, and so on). -//* Файл _queries.json_, що містить запити (queries), які формують обраний звіт. + * The _queries.json_ file containing the queries that define the selected report. ==== -//== Пов'язані сторінки == Related topics * xref:registry-develop:data-modeling/reports/reports-overview.adoc[] diff --git a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/tables/tables-data-structures.adoc b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/tables/tables-data-structures.adoc index 39d46b8e21..f784630d9e 100644 --- a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/tables/tables-data-structures.adoc +++ b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/tables/tables-data-structures.adoc @@ -1,81 +1,52 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - -//= Таблиці моделі даних реєстру та їх структури = Registry data model tables and their structures +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] + +include::platform:ROOT:partial$admonitions/language-en.adoc[] -//Розробка регламенту передбачає розробку моделі даних реєстру. Кабінет адміністратора регламентів дозволяє працювати із таблицями бази даних реєстру у режимі перегляду (read-only). The development of regulations involves the creation of a registry data model. The Regulations administrator portal allows working with registry database tables in a read-only mode. [NOTE] ==== -//Перегляд переліку таблиць та їх структури доступний для майстер- та кандидат-версії регламенту. The list of tables and their structures is available for both the master and candidate versions of the regulations. -//Детальніше про версійність регламенту ви можете переглянути за посиланням: For more information about the versioning of regulations, see xref:registry-admin/admin-portal/version-control/version-control-overview.adoc[] ==== [#overview] -//== Загальний огляд == General overview -//Адміністратор може виконати пошук таблиці за назвою (латиницею), сортувати таблиці за назвою, історичністю, суб'єктністю та описом, а також досліджувати їх структуру відповідно до моделі даних. The administrator can search for a table by its name (in Latin characters), sort tables by name, historicity, subjectivity, and description, as well as explore their structure according to the data model. -//Переглянути повний перелік таблиць можна наступним чином: You can view the complete list of tables as follows: -//. Увійдіть до Кабінету адміністратора регламентів. . Sign in to the Regulations administrator portal. -//. Оберіть майстер-версію змін, або версію-кандидат. + . Select either the master version of changes, or the candidate version. + -TIP: Майстер-версія -- це гілка регламенту за замовчуванням. При вході до Кабінету, адміністратор завжди потрапляє на ⌂ Домашню сторінку із майстер-версією змін. TIP: Master version is the default branch of the regulations. Upon entering the portal, the administrator always lands on the ⌂ Home page with the master version of changes. -+ -//. Перейдіть до розділу [.underline]#Таблиці#. -. Navigate to the [.underline]#Tables# section. + +. Navigate to the *Tables* section. + image:registry-admin/admin-portal/tables-data-structures/tables-data-structures-1.png[] -//== Пошук таблиць за назвою == Searching tables by name -//Адміністратор регламенту може швидко та зручно знайти потрібну таблицю за допомогою поля `Шукати за назвою`. Просто введіть початкові літери. Registry regulations administrator can quickly and conveniently find the required table using the *Search by name* field. Simply enter the initial letters. image:registry-admin/admin-portal/tables-data-structures/tables-data-structures-2.png[] -//== Сортування таблиць == Sorting tables -//Адміністратор регламенту може сортувати таблиці за назвою, історичністю, суб'єктністю та описом, швидко знаходячи необхідні значення. Registry regulations administrator can sort tables by name, historical relevance, subjectivity, and description, quickly finding the necessary values. -//Підтримується 2 типи сортування: :: There are 2 types of sorting supported: :: -//* `↓` -- Низхідне сортування. -//* `↑` -- Висхідне сортування. * `↓` -- Descending sorting. * `↑` -- Ascending sorting. -//Поля, до яких застосовується сортування: :: Fields to which sorting is applied: :: -//* `Назва таблиці`; -//* `Історична`; -//* `Суб'єкт`; -//* `Опис`. * `Table name`; * `Historical`; * `Subject`; @@ -83,133 +54,92 @@ Fields to which sorting is applied: :: image:registry-admin/admin-portal/tables-data-structures/tables-data-structures-3.png[] -//== Перегляд структури таблиць == Viewing table structures -//Адміністратор регламенту може переглядати структуру таблиць бази даних реєстру відповідно до передбаченої моделі. Registry regulations administrator can view the structure of the database registry tables according to the provided model. -//Щоб переглянути структуру таблиць, у розділі [.underline]#Таблиці# відкрийте будь-яку таблицю. -To view the table structures, open any table in the [.underline]#Tables# section. +To view the table structures, open any table in the *Tables* section. image:registry-admin/admin-portal/tables-data-structures/tables-data-structures-5.png[] [#tab-general] -//=== Вкладка "Загальна" -=== "General" tab +=== _General_ tab -//На вкладці [.underline]#Загальна# доступна основна інформація про таблицю, що дозволяє поверхнево ознайомитися із призначенням цієї таблиці, а також деякими її атрибутами, а саме: -The [.underline]#General# tab provides basic information about the table, allowing a superficial understanding of the purpose of the table, as well as some of its attributes, namely: +The *General* tab provides basic information about the table, allowing a superficial understanding of the purpose of the table, as well as some of its attributes, namely: -//* Поле `Назва` -- містить назву таблиці із бази даних реєстру. Наприклад, `diplomas`. -* `Name` field -- contains the name of the table from the database registry. For example, `diplomas`. -//* Поле `Опис` -- містить опис, тобто призначення таблиці у базі даних реєстру. Наприклад, `Отримані дипломи`. -* `Description` field -- contains the description, i.e., the purpose of the table in the database registry. For example, `Received diplomas`. +* *Name* field—contains the name of the table from the database registry. For example, `diplomas`. -//// -This checkbox has been removed in 1.9.2. See NOTE. +* *Description* field—contains the description, i.e., the purpose of the table in the database registry. For example, `Received diplomas`. -* Чекбокс `Історичність` -- дозволяє визначати історичність таблиці. -+ -NOTE: Усі таблиці розгортаються з атрибутом історичності за замовчуванням. Без цього атрибута таблиця не створиться. Наприклад, ``. Тому в майбутніх релізах цей чекбокс буде прибрано з інтерфейсу. -//// +This checkbox has been removed in 1.9.2. See NOTE. -//* Чекбокс `Суб'єктність` -- дозволяє визначати суб'єктність таблиці. -* `Subject` checkbox -- allows determining the subjectivity of the table. +* *Subject* checkbox—allows determining the subjectivity of the table. + -//NOTE: Чекбокс показує наявність зв'язку із суб'єктом. На рівні таблиці об'єктів можна задати атрибут `isObject="true"`, який дозволяє додати колонку із посиланням до таблиці суб'єктів (`tableName="subject"`), тобто до певного власника даних. NOTE: The checkbox indicates the presence of a connection with the subject. At the object level, it is possible to set the attribute `isObject`="`true`," which adds a column with a reference to the subject table (`tableName=`"`subject`"), i.e., to a specific data owner. + image:registry-admin/admin-portal/tables-data-structures/tables-data-structures-6.png[] -//=== Вкладка "Індекси" -=== "Indexes" tab +=== _Indexes_ tab -//Вкладка [.underline]#Індекси# дозволяє переглядати перелік індексів конкретної таблиці у базі даних, а також правил, за якими вони працюють. -The [.underline]#Indexes# tab allows viewing the list of indexes for a specific table in the database, as well as the rules by which they operate. +The *Indexes* tab allows viewing the list of indexes for a specific table in the database, as well as the rules by which they operate. [TIP] ==== -//Індекс (_англ. index_) -- об'єкт бази даних, що створений з метою підвищення ефективності виконання запитів. Таблиці в базі даних можуть мати велику кількість рядків, які зберігаються у довільному порядку, і їх пошук за заданим значенням шляхом послідовного перегляду таблиці, рядок за рядком, може займати багато часу. An index is a database object created to improve query execution efficiency. Database tables can contain a large number of rows stored in arbitrary order, and searching for them based on a given value by sequentially scanning the table row by row can be time-consuming. -//Індекс формується зі значень одного чи кількох стовпчиків таблиці й вказівників на відповідні рядки таблиці й, таким чином, дозволяє знаходити потрібний рядок за заданим значенням. The index is formed from the values of one or more columns of the table and pointers to the corresponding rows of the table, thus enabling the retrieval of the required row based on the given value. ==== image:registry-admin/admin-portal/tables-data-structures/tables-data-structures-7.png[] -//Вкладка містить 2 колонки: :: The tab contains 2 columns: :: -//* `Назва` -- назва індекса (об'єкта). * `Name` -- the name of the index (of an object). -//* `Правило` -- правило, що застосовуються до відповідного індекса при вибірці даних. Наприклад, як саме представити дані у відповіді на запит -- висхідним списком (`ASC`), або низхідним (`DESC`) тощо. * `Rule` -- the rule applied to the corresponding index when selecting data. For example, how to represent the data in response to a query - in ascending order (`ASC`), or descending (`DESC`), and so on. -//Моделювальник може також відсортувати (висхідне та низхідне сортування) індекси за назвою, а також правилом, яке застосовується до індекса при пошуку даних. The modeler can also sort the indexes by name and the rule applied to the index when searching for data. -//Також доступна опція пагінації (розбивки на сторінки), якщо кількість записів з індексами перевищує 10 на сторінці. Pagination option (paging) is also available if the number of records with indexes exceeds 10 per page. -//=== Вкладка "Колонки" -=== "Columns" tab +=== _Columns_ tab -//Вкладка "Колонки" дозволяє переглядати структуру колонок у певній таблиці бази даних реєстру. The *Columns* tab allows you to view the structure of columns in a specific table of the registry database. -//Наразі є можливість переглянути такі параметри: :: Currently, you can view the following parameters: :: -//* `Колонка` -- назва колонки у БД реєстру. -//* `Тип` -- тип даних, який зберігається у полі. -//* `Значення за замовчуванням` -- значення поля за замовчуванням, якщо не явно не вказане інше. * `Column` -- the name of the column in the registry database. * `Type` -- the data type stored in the field. * `Default value` -- the default value of the field if another value is not explicitly specified. image:registry-admin/admin-portal/tables-data-structures/tables-data-structures-4.png[] -//Також підтримується 2 типи сортування за усіма колонками: :: Two types of sorting by all columns are supported: :: -//* `↓` -- Низхідне сортування. -//* `↑` -- Висхідне сортування. * `↓` -- Descending sorting. * `↑` -- Ascending sorting. [#data-model-version-candidate] -//== Особливості роботи з таблицями в рамках версій-кандидатів == Working with tables within candidate versions -//Розробка регламенту передбачає розробку моделі даних реєстру. Перегляд переліку таблиць та їх структури доступний у режимі читання (read-only) для версій-кандидатів (детальніше -- див. The development of regulations involves designing a data model for the registry. Viewing the list of tables and their structure is available in read-only mode for candidate versions (for more information, see _xref:registry-admin/admin-portal/version-control/version-control-overview.adoc[]_). -//Функціональні сценарії: :: Functional scenarios: :: -//- Перегляд поточного стану моделі даних регламенту реєстру (перелік таблиць), що розробляється (в рамках версії-кандидату). - Viewing the current state of the data model for the registry regulations (list of tables) being developed (within a candidate version). -//- Отримання результату перевірки можливості успішного розгортання моделі даних. + - Obtaining the result of checking the feasibility of successful deployment of the data model. -//- Перегляд значення атрибута "суб'єктність" у переліку таблиць. + - Viewing the "subjectivity" attribute value in the list of tables. -//- Видалення тимчасових БД для версій-кандидатів - Deleting temporary databases for candidate versions. -//=== Особливості розгортання тимчасових реплік === Deploying temporary replicas -//При роботі з даними реєстру, [.underline]#для кожної версії-кандидата# створюється та розгортається тимчасова репліка з еталонної бази даних (PostgreSQL). Еталонна БД містить лише структуру, без жодних даних реєстру. -When working with registry data, a temporary replica is created and deployed [.underline]#for each candidate version# from the reference database (PostgreSQL). The reference database contains only the structure without any registry data. +When working with registry data, a temporary replica is created and deployed _for each candidate version_ from the reference database (PostgreSQL). The reference database contains only the structure without any registry data. -//Підсистема розгортання регламенту (регламентний jenkins) створює структуру БД шляхом розгортання liquibase-конфігурацій регламенту реєстру (див. детальніше -- The regulations deployment subsystem (regulatory Jenkins) creates the database structure by deploying the liquibase configurations of the registry regulations. For more details, see -xref:data-modeling/data/physical-model/overview.adoc[]). +xref:data-modeling/data/physical-model/overview.adoc[]. -.Скрипт автоматичного розгортання тимчасової репліки з еталонної БД .Script for automatic deployment of temporary replica from the reference database ==== [source,sql] @@ -217,90 +147,62 @@ xref:data-modeling/data/physical-model/overview.adoc[]). CREATE DATABASE [registry-dev-] WITH TEMPLATE registry-template OWNER [our owner user]; ---- -//Цей скрипт створює нову тимчасову БД з іменем `registry-dev-`, яка буде скопійована з еталонної БД `registry-template`. `` -- це унікальний ідентифікатор версії-кандидата. This script creates a new temporary database with the name `registry-dev-`, which is copied from the reference database `registry-template`. `` is a unique identifier of the candidate version. -//* `registry-template` -- ім'я еталонної БД, отриманої після відпрацювання OKD run-db-script-job. -//* `registry-dev-` -- шаблон імені тимчасової БД для версії-кандидата. * `registry-template` -- the name of the reference database obtained after running the OKD run-db-script-job. * `registry-dev-` -- the template name for the temporary database for the candidate version. ==== -//Підсистема управління регламентом (`registry-regulations-management`) зчитує структуру дата-моделі тимчасової БД та зберігає її як знімок поточного стану моделі даних до файлу _DataModelSnapshot_ у форматі JSON. Надалі ці дані передаються до Кабінету адміністратора регламентів, де для кожної окремої версії-кандидата відображається актуальний стан таблиць БД. -The regulations management subsystem (`registry-regulations-management`) reads the data model structure of the temporary database and saves it as a snapshot of the current state of the data model to the _DataModelSnapshot_ file in JSON format. Later, this data is passed to the Regulations administrator portal, where the current state of the database tables is displayed for each individual candidate version. +The Registry regulations management subsystem (`registry-regulations-management`) reads the data model structure of the temporary database and saves it as a snapshot of the current state of the data model to the _DataModelSnapshot_ file in JSON format. Later this data is passed to the Regulations administrator portal, where the current state of the database tables is displayed for each candidate version. -//Після успішної генерації тимчасової БД для певної версії-кандидата, адміністратор матиме змогу працювати зі створеною реплікою та може переглядати усі таблиці та їх структуру у розділі [.underline]#Таблиці# Кабінету адміністратора регламентів. -After successfully generating the temporary database for a specific candidate version, the administrator can work with the created replica and view all the tables and their structure in the [.underline]#Tables# section of the Regulations administrator portal. +After successfully generating the temporary database for a specific candidate version, the administrator can work with the created replica and view all the tables and their structure in the *Tables* section of the Registry regulations administrator portal. -//Загальний вигляд інтерфейсу Кабінету адміністратора регламентів для версій _майстер_ та _кандидат_ при роботі із таблицями однаковий (_див. розділ xref:#overview[]_). -The general interface of the Regulations administrator portal for master and candidate versions when working with tables is the same (see xref:#overview[]_). +The general interface of the Regulations administrator portal for master and candidate versions when working with tables is the same (_see xref:#overview[]_). -//=== Перевірка працездатності наявної конфігурації розгортання тимчасової БД === Verifying the operability of the temporary database deployment configuration -//Під час розгортання тимчасових БД проводиться також перевірка працездатності наявної конфігурації _liquibase changelog_ регламенту реєстру. Під час цього процесу до Кабінету адміністратора регламентів передається інформація про стан виконання відповідного Jenkins-пайплайну. During the deployment of temporary databases, the operability of the existing _liquibase changelog_ configuration of the registry regulations is also checked. During this process, information about the execution status of the corresponding Jenkins pipeline is passed to the Regulations administrator portal. -//До відповідного MR (запита на злиття змін до майстер-гілки) у Gerrit публікується статус розгортання тимчасової БД. The deployment status of the temporary database is published to the corresponding merge request (MR or change request to merge the changes into the master branch) in Gerrit. -//Підсистема управління регламентом зчитує стан розгортання регламенту реєстру (розгортання liquibase) з відповідного MR у Gerrit. Стан виконання відповідного пайплайну відображається в Gerrit MR для версії-кандидата за допомогою специфічних міток (specific labels): -The regulations management subsystem reads the deployment status of the registry regulations (liquibase deployment) from the corresponding merge request in Gerrit. The execution status of the corresponding pipeline is displayed in the Gerrit merge request for the candidate version using specific labels: +The Registry regulations management subsystem reads the deployment status of the registry regulations (liquibase deployment) from the corresponding merge request in Gerrit. The execution status of the corresponding pipeline is displayed in the Gerrit merge request for the candidate version using specific labels: -//* `*SUCCESS*`: процес розгортання та перевірки успішний (`Verified +1`) * `*SUCCESS*`: the deployment and verification process is successful (`Verified +1`) + image:registry-admin/admin-portal/tables-data-structures/tables-data-structures-8.png[] -//* `*FAILED*`: процес розгортання та перевірки не успішний (`Verified -1`) * `*FAILED*`: the deployment and verification process is unsuccessful (`Verified -1`) + image:registry-admin/admin-portal/tables-data-structures/tables-data-structures-9.png[] -//* `*UNKNOWN*`: процес розгортання та перевірки відбувається/не відбувався (відсутня мітка `Verified`) * `*UNKNOWN*`: the deployment and verification process is ongoing/not performed (`Verified` label is absent) + image:registry-admin/admin-portal/tables-data-structures/tables-data-structures-10.png[] -//=== Реконсиляція застарілих схем тимчасових БД === Reconciling outdated schemas of temporary databases -//При роботі з даними реєстру, для кожної версії-кандидата створюється та розгортається тимчасова репліка з еталонної бази даних (PostgreSQL). Часто це призводить до того, що гілка-кандидат може бути вже видалена, а тимчасова БД продовжує існувати та використовувати ресурси реєстру. -When working with registry data, a temporary replica is created and deployed from the reference database (PostgreSQL) for each candidate version. Often, this leads to a situation where the candidate branch may have been deleted, but the temporary database continues to exist and utilize registry resources. +When working with registry data, a temporary replica is created and deployed from the reference database (PostgreSQL) for each candidate version. Often, this leads to a situation where the candidate branch may have been deleted, but the temporary database continues to exist and utilizes registry resources. -//Для розв'язання цієї проблеми впроваджено спеціальний [.underline]#процес реконсиляції (reconciliation process)# для періодичного видалення застарілих схем БД по версіях-кандидатах (версії-кандидати, що були інтегровані/злиті до майстер-версії, або ж такі, що видалені без інтеграції). -To address this issue, a special [.underline]#reconciliation process# has been implemented to periodically remove outdated database schemas based on candidate versions (candidate versions that have been integrated/merged into the master version or those that have been deleted without integration). +To address this issue, a special *reconciliation process* has been implemented to periodically remove outdated database schemas based on candidate versions (_candidate versions that have been integrated/merged into the master version or those that have been deleted without integration_). -//[.underline]#Reconciliation process# (пайплайн `cleanup-of-version-candidate-db`) -- це Jenkins-процес, запланований до виконання у певний час. Параметр періодичності виклику налаштовується на рівні _helm_-файлу конфігурації реєстру та передається на рівень тригера Jenkins-пайплайну. Значення за замовчуванням: 1 раз на добу, 17:00 GMT+2 (Київ). -[.underline]#Reconciliation process# (`cleanup-of-version-candidate-db` pipeline) is a Jenkins process scheduled to run at a specific time. The frequency parameter for triggering the process is configured at the _helm_ configuration file level of the registry and passed to the Jenkins pipeline trigger level. The default value is once a day at 17:00 GMT+2 (Kyiv time). +*Reconciliation process* (`cleanup-of-version-candidate-db` pipeline) is a Jenkins process scheduled to run at a specific time. The frequency parameter for triggering the process is configured at the _helm_ configuration file level of the registry and passed to the Jenkins pipeline trigger level. The default value is once a day at 17:00 GMT+2 (Kyiv time). -//Налаштувати процес можна у сервісі Jenkins вашого реєстру. Для цього: :: You can configure the process in your registry's Jenkins service by following these steps: :: -//. Відкрийте Jenkins-консоль у проєкті вашого реєстру. -//. Знайдіть пайплайн *cleanup-of-version-candidate-db*. -//. Відкрийте налаштування (⚙ *Configure*). . Open the Jenkins console in your registry project. . Find the *`cleanup-of-version-candidate-db`* pipeline. . Open the settings (⚙ *Configure*). + image:registry-admin/admin-portal/tables-data-structures/tables-data-structures-11.png[] -+ -//. Перейдіть до розділу *`Build Triggers`* та задайте бажану періодичність запуску процесу. Періодичність налаштовується у форматі https://uk.wikipedia.org/wiki/Cron[*unix-cron*]. + . Go to the *`Build Triggers`* section and set the desired frequency for running the process. The frequency is configured in the https://uk.wikipedia.org/wiki/Cron[*unix-cron*] format. + image:registry-admin/admin-portal/tables-data-structures/tables-data-structures-12.png[] - -//При виклику процесу реконсиляції здійснюється: :: When the reconciliation process is triggered, the following actions are performed: :: -//* Отримання переліку версій-кандидатів у Gerrit-репозиторії. -//* Отримання переліку тимчасових БД для версій-кандидатів у базі даних. -//* Видалення тимчасових схем БД версій-кандидатів, для яких не існує відкритих запитів на внесення змін (MR) у Gerrit. * Retrieval of the list of candidate versions from the Gerrit repository. * Retrieval of the list of temporary databases for candidate versions in the database. * Deletion of temporary database schemas for candidate versions for which there are no open merge requests (MR) in Gerrit. -//Після запуску процесу `cleanup-of-version-candidate-db`, система видаляє усі тимчасові БД, які не є у статусі `*Open*` у Gerrit. After running the `cleanup-of-version-candidate-db process`, the system deletes all temporary databases that are not in an "*`Open`*" status in Gerrit. \ No newline at end of file diff --git a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/tables/tables-overview.adoc b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/tables/tables-overview.adoc index d708e3e44a..199fd6d186 100644 --- a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/tables/tables-overview.adoc +++ b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/tables/tables-overview.adoc @@ -1,7 +1,9 @@ -//= Таблиці = Tables +:sectanchors: +:sectlinks: + +include::platform:ROOT:partial$admonitions/language-en.adoc[] -//== Огляд секції == Section overview * xref:registry-develop:registry-admin/admin-portal/registry-modeling/tables/tables-data-structures.adoc[] diff --git a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/tables/xml-editor.adoc b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/tables/xml-editor.adoc index a4addb80aa..7831dabfc5 100644 --- a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/tables/xml-editor.adoc +++ b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/tables/xml-editor.adoc @@ -1,117 +1,85 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Modeling the structure of registry database tables in an XML code editor +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] + +include::platform:ROOT:partial$admonitions/language-en.adoc[] -//== Загальні положення == General provisions -//Адміністративний портал пропонує вбудований XML-редактор, який спеціалізується на роботі зі структурою таблиць у файлі *_data-model/createTables.xml_* і спрощує роботу з моделлю даних у регламенті реєстру. Всього існують два підходи до створення та редагування таблиць: The administrative portal offers a built-in XML editor specialized in working with the table structure in the *_data-model/createTables.xml_* file, simplifying the data model management in the registry regulations. There are two approaches to creating and editing tables: -// Робота безпосередньо у файлах регламенту Gerrit. У цьому випадку може бути декілька різних файлів для роботи з різними таблицями. * Working directly with the registry regulations files in Gerrit. In this case, there can be multiple files for different tables. + -//TIP: Детальніше про роботу з таблицями у моделі даних див. -- + TIP: For more information on working with tables in the data model, refer to -xref:data-modeling/data/physical-model/liquibase-ddm-ext.adoc#table-management[Керування таблицями]. +xref:data-modeling/data/physical-model/liquibase-ddm-ext.adoc#table-management[Tables management]. -//* Робота через XML-редактор в адміністративному порталі. Зміни, внесені тут, після їх застосування до майстер гілки репозиторію *_registry-regulations_*, потрапляють лише до одного файлу -- *_data-model/createTables.xml_*. * Working through the XML editor in the administrative portal. Changes made here, after being applied to the master branch of the *_registry-regulations_* repository, only affect one file - *_data-model/createTables.xml_*. + [NOTE] ==== -//У такому випадку необхідно дотримуватися таких рекомендацій: + In this case, it is necessary to follow the following recommendations: -//* Усі операції, пов'язані зі створенням або зміною структури таблиць бази даних, слід зберігати у файлі _data-model/createTables.xml_. Це допоможе забезпечити правильну організацію структури даних та зручність роботи з ними. * All operations related to creating or modifying the structure of database tables should be saved in the _data-model/createTables.xml_ file. This ensures proper organization of data structure and facilitates work with them. -//* Файл *_data-model/createTables.xml_* має бути явно включений до переліку файлів для розгортання у конфігурації *_data-model/main-liquibase.xml_*. Це гарантує належне врахування змін у таблицях бази даних під час розгортання системи. * The *_data-model/createTables.xml_* file should be explicitly included in the list of deployment files in the *_data-model/main-liquibase.xml_* configuration. This guarantees that changes in database table structures are correctly accounted for during system deployment. -//Дотримуючись цих рекомендацій, ви зможете забезпечити ефективну роботу зі структурою таблиць та забезпечити коректність розгортання бази даних у вашому реєстрі. By adhering to these recommendations, you can ensure efficient work with table structures and ensure the correctness of database deployment in your registry. ==== -//Ви самі обираєте, який підхід використовувати для створення та редагування таблиць. Якщо ви обираєте роботу з адміністративного порталу через вбудований XML-редактор, то для полегшення роботи зі структурою таблиць у файлі _createTables.xml_ було імплементовано рішення https://microsoft.github.io/monaco-editor/[Monaco Editor], візуалізоване темою *Visual Studio Dark*. Це дозволяє швидко та зручно вносити зміни через єдиний інтерфейс і зменшує кількість помилок, забезпечуючи більш продуктивний процес роботи з моделлю даних. You can choose which approach to use for creating and editing tables. If you choose to work with the administrative portal through the built-in XML editor, for easier handling of table structures in the _createTables.xml_ file, the https://microsoft.github.io/monaco-editor/[Monaco Editor] solution has been implemented, visualized with the *Visual Studio Dark* theme. This allows for quick and convenient changes through a unified interface and reduces the number of errors, ensuring a more productive data model management process. -//Однією з переваг цього редактора є _синтаксичний аналіз коду_ -- можливість отримувати сповіщення про синтаксичні помилки, якщо такі виникли. Крім того, редактор надає підказки та дозволяє використовувати функцію автозаповнення, що спрощує процес додавання нової таблиці до моделі даних. One advantage of this editor is _syntax code analysis_, which provides notifications about syntax errors, if any occur. Additionally, the editor provides suggestions and enables auto-completion, simplifying the process of adding new tables to the data model. -//== Сценарії використання == Usage scenarios -//* Зручне редагування структури даних у моделі регламенту реєстру за допомогою простого вікна редагування. * Convenient editing of data structure in the registry regulations model using a simple editing window. -//* Автоматичне збереження внесених змін до версії-кандидата регламенту, що дозволяє ефективно вести процес редагування. + * Automatic saving of changes made to the candidate version of the regulations, facilitating efficient editing process. -//* Відображення повідомлень про помилки у вікні редагування структури таблиць моделі даних регламенту реєстру, що допомагає швидко виявляти та виправляти помилки. + * Display of error messages in the table structure editing window of the registry regulations data model, aiding in quick error detection and correction. -//* Надання автопідказок та автодоповнень при редагуванні *`liquibase changelog xml`*, що спрощує процес редагування та дозволяє уникнути помилок. + * Provision of auto-suggestions and auto-completion while editing *`liquibase changelog xml`*, simplifying the editing process and preventing errors. -//* Перевірка liquibase-конфігурації згідно з *liquibase* та *DDM xsd*, що допомагає налаштувати конфігурацію коректно та уникнути проблем. + * Verification of liquibase configuration according to *liquibase* and *DDM xsd*, helping configure the configuration correctly and avoid issues. -//== Функціональні можливості == Functional capabilities -//=== Загальний процес використання === General usage process -//Використовуйте візуальний редактор коду при створенні та редагуванні таблиць моделі даних реєстру за допомогою XML-тегів. Use the visual code editor to create and edit tables in the registry data model using XML tags. [CAUTION] ==== -//Редагування складових регламенту реєстру можливе лише в рамках версій-кандидатів на внесення змін. Для майстер-версії доступна лише опція перегляду. + Editing registry regulations components is only possible within change candidate versions. For the master version, only the viewing option is available. -//Детальніше про особливості роботи з версіями регламенту дивіться на сторінці For more information on working with regulation versions, refer to xref:registry-admin/admin-portal/version-control/version-control-overview.adoc[]. ==== -//. У [.underline]#Кабінеті адміністратора регламентів# відкрийте розділ [.underline]#Таблиці#. -. In the [.underline]#Regulations administrator portal# open the [.underline]#Tables# section. -+ -//TIP: Портал адміністратора ви можете знайти за посиланням: -TIP: You can find the Regulations administrator portal at + -https://admin-tools-<назва-реєстру>.apps.envone.dev.registry.eua.gov.ua/. +. In the *Administrative portal* open the *Tables* section. + image:registry-develop:registry-admin/admin-portal/tables-data-structures/xml-editor/xml-editor-1.png[] + -//. В рамках версії-кандидата відкрийте вкладку [.underline]#Файл опису структури# та розгорніть візуальний редактор у повноекранному режимі, натиснувши `Розгорнути`. -. Within the change candidate version, open the [.underline]#Structure description file# tab and expand the visual editor in full-screen mode by clicking on `Expand`. -+ -//. Внесіть відповідні зміни до моделі даних та натисніть kbd:[Зберегти зміни]. -. Make the necessary changes to the data model and click kbd:[Save Changes]. + +. Within the change candidate version, open the *Structure description file* tab and expand the visual editor in full-screen mode by clicking on *`Expand`*. + +. Make the necessary changes to the data model and click *`Save Changes`*. + -//TIP: Детальніше про роботу з моделлю даних реєстру ви можете дізнатися на сторінці -TIP: For more information on working with the registry data model, refer to -xref:data-modeling/data/physical-model/overview.adoc[]. +TIP: For more information on working with the registry data model, refer to xref:data-modeling/data/physical-model/overview.adoc[]. + image:registry-develop:registry-admin/admin-portal/tables-data-structures/xml-editor/xml-editor-2.png[] + -//Ви отримаєте відповідне повідомлення-підказку про те, що зміни збережено. You will receive a corresponding notification indicating that the changes have been saved. + image:registry-develop:registry-admin/admin-portal/tables-data-structures/xml-editor/xml-editor-3.png[] + -//Скасуйте зміни, натиснувши kbd:[Відмінити зміни]. При натисканні на цю кнопку, ви отримаєте наступне попереджувальне повідомлення із варіантами продовження: + Cancel the changes by clicking kbd:[Cancel changes]. When you click this button, you will receive the following warning message with options for proceeding: + ==== -//`Ви впевнені, що хочете скасувати зміни?` `Are you sure you want to cancel the changes?` ==== + @@ -120,140 +88,104 @@ image:registry-develop:registry-admin/admin-portal/tables-data-structures/xml-ed + [WARNING] ==== -//Якщо ви змінили файл, але не зберегли зміни, і хочете вийти із вікна редагування, то отримаєте наступне повідомлення: -If you have made changes to the file but have not saved them and want to exit the editing window, you will receive the following message: +If you have made changes to the file but have not saved them and want to exit the editing window, you will receive the following message: ===== -//`Файл опису структури було змінено. Якщо покинути сторінку зараз, то незбережені зміни будуть скасовані.` `The structure description file has been modified. If you leave the page now, unsaved changes will be discarded.` ===== image:registry-develop:registry-admin/admin-portal/tables-data-structures/xml-editor/xml-editor-4.png[] - ==== + -//NOTE: Кнопка kbd:[Зберегти зміни] заблокована, якщо файл опису структури містить помилки, знайдені під час аналізу коду та liquibase-конфігурації згідно з liquibase та DDM xsd (_детальніше -- див. у розділі xref:#xsd-liquibase-validation[]_). + NOTE: The kbd:[Save changes] button is disabled if the structure description file contains errors detected during code analysis and liquibase configuration according to liquibase and DDM xsd (_for more details, see xref:#xsd-liquibase-validation[]_) + -//. Перейдіть до розділу [.underline]#Огляд версії# та перевірте, що зміни у файлі додалися до переліку змін вашої версії-кандидата з відповідним статусом. -. Go to the [.underline]#Version overview# section and verify that the changes in the file have been added to the list of changes in your change candidate version with the corresponding status. + +. Go to the *Version overview* section and verify that the changes in the file have been added to the list of changes in your change candidate version with the corresponding status. + -//NOTE: Якщо у файлі *_data-model/createTables.xml_* було внесено зміни через адміністративний портал або безпосередньо через додавання патчсет-у в Gerrit у відповідний MR до версії-кандидата, то на сторінці [.underline]#Огляд версії# в розділі [.underline]#Внесені зміни# відображатиметься секція [.underline]#Структура таблиць БД#. -NOTE: If changes have been made to the *_data-model/createTables.xml_* file through the administrative portal or directly by adding a patch set to Gerrit in the corresponding merge request for the change candidate version, the *Structure the database tables* section will be displayed on the [.underline]#Version overview# page under [.underline]#Latest changes#. + +NOTE: If changes have been made to the *_data-model/createTables.xml_* file through the administrative portal or directly by adding a patch set to Gerrit in the corresponding merge request for the change candidate version, the *Structure the database tables* section will be displayed on the *Version overview* page under the *Latest changes*. + image:registry-develop:registry-admin/admin-portal/tables-data-structures/xml-editor/xml-editor-9.png[] + -//. Застосуйте зміни до майстер-версії регламенту. + . Apply the changes to the master version of the regulation. + -//TIP: Детальніше дивіться на сторінці + TIP: For more information, see xref:registry-admin/admin-portal/version-control/overview-new-change-request.adoc[]. [WARNING] ==== -.Виникнення помилок під час обробки файлу з описом структури моделі даних -.Error handling during the processing of the data model description file. +.Error handling during the processing of the data model description file [%collapsible] ===== - -* При відкритті вкладки [.underline]#Файл опису структури# в адміністративному порталі, у разі відсутності файлу _data-model/createTables.xml_ у репозиторії з регламентом, може виникнути 404 помилка. +* Upon opening an XML editor on the Admin Portal's *File description structure* tab, if the file data-model/createTables.xml is missing in the registry regulations repository, a `404` error might occur. + image:registry-admin/admin-portal/tables-data-structures/xml-editor/xml-editor-7.png[] -* У випадку проблем із обробкою файлу _data-model/createTables.xml_, може виникнути 500 помилка. +* In case of issues processing the file data-model/createTables.xml, a `500` error might occur. + image:registry-admin/admin-portal/tables-data-structures/xml-editor/xml-editor-8.png[] - ===== ==== - [#xsd-liquibase-validation] -//=== Синтаксичний аналіз коду, підказки та автодоповнення === Code syntax analysis, hints, and auto-completion -//Вбудований синтаксичний аналізатор коду в редакторі Monaco пропонує переваги, які є специфічними для роботи з XML-розміткою: The built-in code syntax analyzer in the Monaco editor offers advantages specific to working with XML markup: -//TODO: Add screenshot -//. [.underline]#Підсвічування синтаксису XML#: Редактор Monaco підсвічує відповідні елементи XML-файлу, такі як теги, атрибути та текстовий контент. Це полегшує читання та редагування XML-файлів. . [.underline]#XML syntax highlighting#: The Monaco editor highlights the relevant elements of an XML file, such as tags, attributes, and text content. This makes it easier to read and edit XML files. -+ -//TODO: Add screenshot -//. [.underline]#Автодоповнення XML-тегів#: Редактор Monaco надає автодоповнення закривальних тегів, базуючись на відкритих тегах, а також автодоповнення для тегів `` та їхнього вмісту. Крім того, він пропонує автодоповнення для типових і нетипових (розширених) тегів та атрибутів Liquibase, що сприяє правильній структурі XML-файлів та знижує ризик виникнення помилок. + . [.underline]#Auto-completion of XML tags#: The Monaco editor provides auto-completion for closing tags based on open tags. It also offers auto-completion for `` tags and their contents. Additionally, it suggests auto-completion for standard and non-standard (extended) Liquibase tags and attributes, promoting proper XML file structure and reducing the risk of errors. + -//TIP: Детальніше про доступні теги для побудови моделі даних див. на сторінках -//xref:data-modeling/data/physical-model/liquibase-standard-change-types.adoc[] та xref:data-modeling/data/physical-model/liquibase-ddm-ext.adoc[] відповідно. TIP: For more information on available tags for building a data model, refer to xref:data-modeling/data/physical-model/liquibase-standard-change-types.adoc[] and xref:data-modeling/data/physical-model/liquibase-ddm-ext.adoc[] respectively. -//. [.underline]#Валідація XML#: Синтаксичний аналізатор перевіряє коректність XML-структури в реальному часі, виявляючи неправильні або відсутні теги та атрибути, що дозволяє швидко виправити помилки. . [.underline]#XML validation#: The syntax analyzer checks the correctness of the XML structure in real-time, detecting incorrect or missing tags and attributes. This allows for quick error correction. + image:registry-develop:registry-admin/admin-portal/tables-data-structures/xml-editor/xml-editor-6.png[] [NOTE] ==== -//Функції синтаксичного аналізатора коду ґрунтуються на правилах, встановлених у XSD для редагування XML Liquibase документів. Відповідні XSD зберігаються у сховищі артефактів Nexus Платформи. The code syntax analyzer functions are based on the rules established in the XSD for editing Liquibase XML documents. The corresponding XSD files are stored in the Nexus artifact repository of the Platform. -//Для використання автопідказок, автодоповнення та аналізу коду згідно з `Liquibase XSD` та `DDM Liquibase Extension` під час редагування файлу структури моделі даних, замініть `http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-4.5.xsd` та `https://nexus-public-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/repository/extensions/com/epam/digital/data/platform/liquibase-ext-schema/latest/liquibase-ext-schema-latest.xsd` на актуальні схеми, розміщені у Nexus. To use auto-suggestions, auto-completion, and code analysis according to the `Liquibase XSD` and `DDM Liquibase Extension` while editing the data model structure file, replace `http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-4.5.xsd` and `https://nexus-public-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/repository/extensions/com/epam/digital/data/platform/liquibase-ext-schema/latest/liquibase-ext-schema-latest.xsd` with the updated schemas hosted in Nexus. -//Зверніться до адміністратора платформи для отримання посилань на схеми. Please contact the platform administrator for the links to the schemas. ==== -//== Інтеграція структури таблиць БД з різних файлів регламенту для відображення в адміністративному порталі == Integration of database table structures from various rule files for display in the administrative portal -//Цей розділ допоможе вам інтегрувати структуру таблиць бази даних (БД) із різних файлів регламенту для відображення у Кабінеті адміністратора регламентів. Мета полягає у тому, щоб зібрати всі структури таблиць БД в одному файлі -- *_createTables.xml_*. This section will help you integrate the structure of database tables from different rule files to display them in the Regulations administrator portal. The goal is to gather all database table structures in one file, *_createTables.xml_*. -//. Аналіз файлів регламенту . Analysing regulations files + -//Перегляньте файли теки *_data-model_*, такі як _createTables.xml_, _tablesCommon.xml_, _tablesKatottg.xml_ тощо, які містять набори змін (changeSets) із таблицями та їх атрибутами. Review the files in the *_data-model_* directory, such as _createTables.xml_, _tablesCommon.xml_, _tablesKatottg.xml_, etc., which contain sets of changesets with tables and their attributes. -+ -//. Перенесення структур таблиць до файлу _createTables.xml_. + . Transferring table structures to the _createTables.xml_ file -+ -//* Знайдіть усі changeSets, які стосуються структури таблиць БД, у різних файлах регламенту. + * Identify all changesets related to the structure of the database tables in the different regulations files. -+ -//* Перенесіть ці changeSets до файлу _createTables.xml_ у хронологічному порядку. + * Transfer these changesets to the _createTables.xml_ file in chronological order. -+ -//. Визначення дати створення changeSet. + . Determining the creation date of a changeset + -//Щоб знайти дату створення changeSet, скористайтеся функцією *`Annotate with Git Blame`* в Intellij IDEA (або іншому середовищі розробки): To find the creation date of a changeset, use the *`Annotate with Git Blame`* function in IntelliJ IDEA (or any other development environment): -+ -//* Натисніть правою кнопкою миші на лівому стовпці з номерами рядків у файлі. + * Right-click on the left column with line numbers in the file. -+ -//* Оберіть опцію *`Annotate with Git Blame`*. + * Select the *`Annotate with Git Blame`* option. + image:registry-admin/admin-portal/tables-data-structures/xml-editor/xml-editor-10.png[] -+ -//* Після цього лівий стовпчик розшириться, і поряд з номером рядка будуть відображені _дата останнього оновлення_ та _автор_ цього рядка. -* After that, the left column will expand, and next to each line number, you will see the date of the last update and the author of that line. -+ +* After that, the left column will expand, and next to each line number, you will see the date of the last update and the author of that line. + image:registry-admin/admin-portal/tables-data-structures/xml-editor/xml-editor-11.png[] -+ -//. Перевірка результатів у Кабінеті адміністратора регламентів. + . Checking the results in the Regulations administrator portal. + -//Після завершення попередніх кроків, відкрийте адміністративний портал та перейдіть до розділу [.underline]#Таблиці# > [.underline]#Файл опису структури#. Тепер ви повинні побачити всю структуру таблиць БД, зібрану з різних файлів регламенту та відображену в одному файлі _createTables.xml_. -After completing the previous steps, open the administrative portal and navigate to the [.underline]#Tables# section > [.underline]#Structure description file#. You should now see the entire structure of the database tables collected from various rule files and displayed in the _createTables.xml_ file. +After completing the previous steps, open the administrative portal and navigate to the *Tables* section > *Structure description file*. You should now see the entire structure of the database tables collected from various rule files and displayed in the _createTables.xml_ file. -//NOTE: Зверніть увагу, що інтеграція структури таблиць БД в одному файлі -- це лише рекомендація для поліпшення відображення структури даних у Кабінеті адміністратора. Ви завжди можете продовжити розробку структури даних безпосередньо в адміністративному порталі, враховуючи ваші власні вимоги та обмеження. NOTE: Please note that integrating the database table structure in one file is a recommendation to improve the visualization of data structure in the Regulations administrator portal. You can always continue developing the data structure directly in the administrative portal, considering your own requirements and limitations. \ No newline at end of file diff --git a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/copy-forms.adoc b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/copy-forms.adoc index a96c81581e..af69bcd421 100644 --- a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/copy-forms.adoc +++ b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/copy-forms.adoc @@ -1,32 +1,28 @@ -= UI-forms registry copying += Copying UI forms include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] -//Розробники регламенту мають можливість створювати дублікати UI-форм, що передбачає відтворення усіх їх складових, включаючи JSON-код і компоненти моделювання. Кожна копія отримує префікс `_COPY_` у своїй назві. Ця функція особливо корисна, коли потрібно розробити ряд схожих форм або використовувати наявну форму як шаблон. Regulation developers have the ability to create duplicates of UI forms, which involves reproducing all their components, including JSON code and modeling components. Each copy is given the prefix `_COPY_` in its name. This feature is especially useful when developing a series of similar forms or when using an existing form as a template. - -//Копіюйте UI-форму наступним чином: Follow these steps to copy a UI form: -//. Оберіть розділ "UI-форми" у меню зліва. . Select the *UI forms* section in the left-hand menu. + image:registry-admin/admin-portal/ui-forms/ui-forms-1.png[] . Click on the _copy icon_ next to the form you want to copy -- 📋 -//. Натисніть _іконку копіювання_ біля потрібної форми -- 📋 + image:registry-admin/admin-portal/ui-forms/ui-forms-5.png[] . Fill in the fields: _Business form name_ and _Service form name_, and then click on `Create form`." -//. Заповніть поля: _Бізнес-назва форми_ та _Службова назва форми_, після чого натисніть `Створити форму`. + image:registry-admin/admin-portal/ui-forms/ui-forms-6.png[] -//NOTE: Після завершення ви побачите сповіщення про успішне створення копії. -NOTE: After completion, you will receive a notification of the successful creation of a copy. -image:registry-admin/admin-portal/ui-forms/ui-forms-7.png[] +[NOTE] +==== +After completion, you will receive a notification of the successful creation of a copy. +image:registry-admin/admin-portal/ui-forms/ui-forms-7.png[] +==== \ No newline at end of file diff --git a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/create-forms.adoc b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/create-forms.adoc index 7c9f5b6493..2bc4db1a38 100644 --- a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/create-forms.adoc +++ b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/create-forms.adoc @@ -1,33 +1,20 @@ -= UI-forms registry creation += Creating UI forms include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] -//Розробники регламенту можуть легко створювати UI-форми для бізнес-процесів. Registry developers can easily create UI forms for business processes. -[NOTE] -==== -//Щоб розпочати створення форми, спершу визначтеся з версією регламенту. -To start creating a form, first determine the version of the regulation. -//Наразі розробники можуть створювати та редагувати форми як майстер-версії, так і у версії-кандидаті регламенту. -//Докладніше про версії змін читайте на сторінці -At present, developers can create and edit forms in both master versions and candidate versions of the regulation. -For more information about versions of changes, please refer to the corresponding page -xref:registry-develop:registry-admin/admin-portal/version-control/version-control-overview.adoc[]. -==== -//Для створення форми необхідно виконати наступні кроки: +include::partial$snippets/admin-portal-master-candidate-edit-en.adoc[] + To create a form, you need to follow these steps: -//. Відкрийте розділ "UI-форми" у меню зліва. . Open the *UI forms* section in the left-hand menu." + image:registry-admin/admin-portal/ui-forms/ui-forms-1.png[] -//. Натисніть `Створити нову форму`. . Click on *Create new form*. + image:registry-develop:bp-modeling/forms/admin-portal-form-modeling-step-4.png[] -//TIP: Ознайомтеся детальніше із процесом створення форм на сторінці xref:registry-develop:bp-modeling/forms/registry-admin-modelling-forms.adoc[]. TIP: Learn more about the process of creating forms on the page xref:registry-develop:bp-modeling/forms/registry-admin-modelling-forms.adoc[]. \ No newline at end of file diff --git a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/delete-forms.adoc b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/delete-forms.adoc index 4fc27c6276..8214f1d5cd 100644 --- a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/delete-forms.adoc +++ b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/delete-forms.adoc @@ -1,23 +1,22 @@ -= UI-forms registry deleting += Deleting UI forms include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] -//Розробники регламенту мають змогу видаляти UI-форми. Для цього виконайте наступні кроки: -Regulation developers have the ability to delete UI forms. To do so, follow these steps +Registry regulations developers can delete UI forms. To do so, follow these steps . Open the *UI forms* section in the left-hand menu. -//. Відкрийте розділ "UI-форми" у меню зліва. + image:registry-admin/admin-portal/ui-forms/ui-forms-1.png[] . Select the context menu *Three dots* and click on `Delete`. -//. Оберіть контекстне меню "Три крапки" та натисніть `Видалити`. + image:registry-admin/admin-portal/ui-forms/ui-forms-8.png[] -//NOTE: Після завершення ви побачите сповіщення про успішне видалення. -NOTE: After completion, you will receive a notification of the successful deletion. +[NOTE] +==== +After completion, you will receive a notification of the successful deletion. image:registry-admin/admin-portal/ui-forms/ui-forms-9.png[] +==== diff --git a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/download-forms.adoc b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/download-forms.adoc index a0c4d89cc9..bef4da1495 100644 --- a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/download-forms.adoc +++ b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/download-forms.adoc @@ -1,25 +1,20 @@ -= UI-forms downloading += Downloading UI forms include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] -//Розробники регламенту мають змогу завантажувати (download) UI-форми у форматі JSON для подальшого опрацювання в локальному середовищі. Regulation developers have the ability to download UI forms in JSON format for further processing in a local environment. -//Щоб завантажити форму, виконайте наступні кроки: To download a form, follow these steps: . Open the *UI forms* section in the left-hand menu. -//. Відкрийте розділ "UI-форми" у меню зліва. + image:registry-admin/admin-portal/ui-forms/ui-forms-1.png[] . Click on the _download icon_ ⤓ -//. Натисність _іконку завантаження_ ⤓ + image:registry-admin/admin-portal/ui-forms/ui-forms-10.png[] -//NOTE: Після успішного завантаження форми ви побачите відповідне сповіщення NOTE: After successfully downloading the form, you will see a corresponding notification. image:registry-admin/admin-portal/ui-forms/ui-forms-11.png[] diff --git a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/edit-forms.adoc b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/edit-forms.adoc index dd91c33294..d006a380cf 100644 --- a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/edit-forms.adoc +++ b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/edit-forms.adoc @@ -1,28 +1,23 @@ -= UI-forms editing += Editing UI forms include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] -//Розробники регламенту можуть редагувати UI-форми для бізнес-процесів. Щоб редагувати форму, виконайте наступні кроки: - Regulation developers can edit UI forms for business processes. To edit a form, follow these steps: . Open the *UI forms* section in the left-hand menu. -//. Відкрийте розділ "UI-форми" у меню зліва. + image:registry-admin/admin-portal/ui-forms/ui-forms-1.png[] . Click on the _edit icon_ ✎ -//. Натисність _іконку редагування_ ✎ + image:registry-admin/admin-portal/ui-forms/ui-forms-2.png[] . Make the necessary changes to the components of the UI form and click `Save changes`. -//. Внесіть необхідні зміни до складових UI-форми та натисніть `Зберегти зміни`. + image:registry-admin/admin-portal/ui-forms/ui-forms-3.png[] -//TIP: Ознайомтеся детальніше зі складовими UI-форми на сторінці - TIP: Learn more about the components of UI forms on the page -xref:registry-admin/admin-portal/registry-modeling/ui-forms/form-tabs.adoc[] \ No newline at end of file +xref:registry-admin/admin-portal/registry-modeling/ui-forms/form-tabs.adoc[] + +include::partial$snippets/admin-portal-master-candidate-edit-en.adoc[] \ No newline at end of file diff --git a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/form-tabs.adoc b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/form-tabs.adoc index 2c3b5afe37..63b84b3007 100644 --- a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/form-tabs.adoc +++ b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/form-tabs.adoc @@ -1,99 +1,68 @@ -//= Вкладки на сторінці редагування форми -= Form editing page tabs += Form editing tabs include::ROOT:partial$templates/document-attributes/default-set-en.adoc[] include::ROOT:partial$admonitions/language-en.adoc[] -//Сторінка редагування UI-форми доступна за натисканням назви форми або іконки редагування (🖉). Для редагування форми, функціональність сторінки розділена на наступні вкладки: The UI-form editing page is accessed by clicking on a form name, or `edit form` icon (🖉). The functionality of the page is provided on the following tabs: [#general] -//== Загальна == General -//Тут користувачеві доступні поля для заповнення бізнес-назви та службової назви форми. Бізнес-назву можна змінювати без обмежень, а службова назва формується один раз під час створення, і більше не змінюється. Fields for entering UI-form business-name and service name are available on this tab. Business-name can be edited without any restrictions, while the service name is entered once on form creation, and can't be changed. image:registry-admin/admin-portal/ui-forms/main.png[] [#code] -//== Код == Code -//На цій вкладці формується код форми, який можна редагувати та копіювати. Якщо форма створюється у xref:#constructor[Конструкторі], то код заповнюється автоматично, і навпаки. -This tab displays UI-form code, which can be copied and edited. If the form is being created in the xref:#constructor[], the code will be updated automatically, and vice versa. +This tab displays UI-form code, which can be copied and edited. If the form is being created in the xref:#builder[], the code will be updated automatically, and vice versa. image:registry-admin/admin-portal/ui-forms/code.png[] -//TIP: Ознайомтеся детальніше із функціональністю на сторінці xref:registry-admin/admin-portal/registry-modeling/ui-forms/json-code-view-edit.adoc[]. TIP: You can find more details on the functionality on the following page: xref:registry-admin/admin-portal/registry-modeling/ui-forms/json-code-view-edit.adoc[]. -[#constructor] -//== Конструктор -== Constructor +[#builder] +== Builder -//Ця вкладка дозволяє розробникам створювати форму за допомогою вбудованих UI-компонентів. Компоненти знаходяться у меню ліворуч, звідки їх можна перетягнути у робочу зону, щоб сформувати відповідні поля UI-форми. Пошукове поле дозволяє відшукати потрібний елемент за назвою або частиною назви. This tab allows UI-form developers to create forms using in-built UI-components. The components can be found in the left menu, where they can be dragged from onto the work zone to create the corresponding fields of the UI-form. The search field on top of the menu allows the user to search for the required element by name or part of the name. image:registry-admin/admin-portal/ui-forms/constructor.png[] [TIP] ==== -//Детальніше ознайомитися із процесом, а також компонентами моделювання UI-форм ви можете на відповідних сторінках: + You can find more details on the process, and UI-form modeling components on the corresponding pages: * xref:bp-modeling/forms/registry-admin-modelling-forms.adoc[] * xref:bp-modeling/forms/components/index.adoc[] ==== -//== Перегляд == Preview -//Тут розробник може перевірити, як виглядатиме створена ним форма у Кабінетах надавачів та отримувачів послуг. Вкладка частково емулює роботу форми, щоб можна було переглянути її елементи. Here the developer can check the way their UI-form looks in the service provider or service recipient portals. The tab emulates part of the form's operation, so that all its elements can be previewed. image:registry-admin/admin-portal/ui-forms/view.png[] -//== Запит == Request -//На цій вкладці знаходиться код запиту форми до API _Фабрики даних_. Цей код можна скопіювати, але редагування доступне лише через певні зміни у вкладках xref:#constructor[Конструктор] чи xref:#code[Код]. -This tab displays the form's _Data Factory_ API request code. This code can be copied, but it only can be edited indirectly by making certain changes in the xref:#constructor[] чи xref:#code[] tabs. +This tab displays the form's _Data Factory_ API request code. This code can be copied, but it only can be edited indirectly by making certain changes in the xref:#builder[] or xref:#code[] tabs. image:registry-admin/admin-portal/ui-forms/request.png[] -//== Контекстне меню ⋮ == Context menu (⋮) -//Окрім вкладок сторінка має контекстне меню, що відкривається натисканням іконки *`⋮`*. У цьому меню є наступні пункти: Near the tabs you can find a context menu that is activated by clicking the *`⋮`* icon. This menu includes the following items: -//* [*] Скопіювати форму. Цей пункт дозволяє створити копію вашої форми, і почати її редагувати на вкладці xref:#general[Загальна]. * [*] Copy form. This item allows the user to copy the current form and start editing the copy in its xref:#general[] tab. + - -//// -TIP: Також читайте про копіювання форм на сторінці xref:registry-admin/admin-portal/registry-modeling/ui-forms/copy-forms.adoc[]. -//// - TIP: You can find more information on form copying on the following page: xref:registry-admin/admin-portal/registry-modeling/ui-forms/copy-forms.adoc[]. -//* [*] Експорт `.json`. Цей пункт дозволяє експортувати код форми у форматі `.json`. * [*] Export `.json`. This item allows the user to export the form in `.json` format. + - -//// -TIP: Також читайте про експорт/завантаження форм на сторінці xref:registry-admin/admin-portal/registry-modeling/ui-forms/download-forms.adoc[]. -//// TIP: You can find more information on form downloading/exporting on the following page: xref:registry-admin/admin-portal/registry-modeling/ui-forms/download-forms.adoc[]. -//* [*] Видалити. Цей пункт дозволяє видалити форму. * [*] Delete. This item allows the user to delete the form. + - -//// -TIP: Також читайте про видалення форм на сторінці xref:registry-admin/admin-portal/registry-modeling/ui-forms/delete-forms.adoc[]. -//// TIP: You can find more information on form deleting on the following page: xref:registry-admin/admin-portal/registry-modeling/ui-forms/delete-forms.adoc[]. diff --git a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/json-code-view-edit.adoc b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/json-code-view-edit.adoc index d870f48e3e..b850c22020 100644 --- a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/json-code-view-edit.adoc +++ b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/json-code-view-edit.adoc @@ -1,84 +1,56 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: += Viewing and editing a UI form JSON representation +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] -= Viewing and editing a UI-form JSON representation +include::platform:ROOT:partial$admonitions/language-ua.adoc[] -//Платформа надає можливість переглядати та редагувати JSON-представлення форми на вкладці [.underline]#Код#. -The platform provides the ability to view and edit the JSON representation of a form on the [.underline]#Code# tab. +The platform provides the ability to view and edit the JSON representation of a form on the *Code* tab. -//Функціональність дозволяє швидко та легко внести зміни до даних форми без використання конструктора для моделювання. -This functionality allows for quick and easy changes to the form data without using the modeling constructor. +This functionality allows for quick and easy changes to the form data without using the modeling builder. -//CAUTION: Редагування складових регламенту реєстру можливе лише в рамках версій-кандидатів на внесення змін. Для майстер-версії доступна лише опція перегляду. CAUTION: Editing the components of a registry regulation is only possible within change candidate versions. The master version only allows viewing. -//. Увійдіть до розділу для управління UI-формами. . Go to the section for managing UI forms. -+ -//. Відкрийте будь-яку форму. + . Open any form. + image:registry-admin/admin-portal/ui-forms/json-code/form-json-code-view-edit-1.png[] + -//Припустімо, що ви помітили помилку у назві текстового поля й хочете її виправити. Let's assume you have noticed an error in the label of a text field and would like to correct it. + image:registry-admin/admin-portal/ui-forms/json-code/form-json-code-view-edit-2.png[] -+ -//. Перейдіть до вкладки [.underline]#Код# та внесіть зміни до відповідного поля (у нашому прикладі -- значення параметра `label` масиву `components`). -. Go to the [.underline]#Code# tab and make changes to the respective field (in our example, the value of the `label` parameter in the `components` array). + +. Go to the *Code* tab and make changes to the respective field (in our example, the value of the `label` parameter in the `components` array). + image:registry-admin/admin-portal/ui-forms/json-code/form-json-code-view-edit-3.png[] + -//IMPORTANT: Вкладки [.underline]#Загальна#, [.underline]#Код# та [.underline]#Конструктор# пов'язані між собою. Зміни, що вносяться на одній із цих вкладок, з'являються і на інших. -IMPORTANT: The [.underline]#General#, [.underline]#Code#, and [.underline]#Constructor# tabs are interconnected. Changes made on one of these tabs will appear on the others as well. +IMPORTANT: The *General*, *Code*, and *Builder* tabs are interconnected. Changes made on one of these tabs will appear on the others as well. Open a preview of the form and ensure that the changes have been applied correctly. -+ -//. Відкрийте попередній перегляд форми та переконайтеся, що зміни внесено вірно. + . Open a preview of the form and ensure that the changes have been applied correctly. -. + image:registry-admin/admin-portal/ui-forms/json-code/form-json-code-view-edit-4.png[] -+ -//. Натисніть `Зберегти зміни`, щоб застосувати оновлення коду форми. + . Click `Save changes` to apply the updated form code. -//TODO: Move to form-modeling section after it's created [IMPORTANT] ==== -//Коли користувач намагається зберегти зміни при створенні, або редагуванні бізнес-процесу, чи UI-форми, та знаходиться на будь-якій вкладці розділів [.underline]#Моделі процесів# та [.underline]#UI-форми#, то на усіх вкладках цих розділів спрацьовує валідація, якщо: -When a user attempts to save changes during the creation or editing of a business process or UI form and is on any tab within the [.underline]#Process models# or [.underline]#UI Forms# sections, validation is triggered if: +When a user attempts to save changes during the creation or editing of a business process or UI form and is on any tab within the *Process models* or *UI Forms* sections, validation is triggered if: + +* The UI form with the same system name already exists. In this case, the user will see the following validation message in the top right corner: -//* UI-форма з такою службовою назвою вже існує -- тоді користувач бачить наступне валідаційне повідомлення у правому верхньому куті: -* An UI form with the same system name already exists. In this case, the user will see the following validation message in the top right corner: -+ -//** `"Форма з такою службовою назвою вже існує"`. ** `Form with this system name already exists`. -+ -//* Валідаційні правила порушені -- тоді користувач бачить валідаційне повідомлення у правому верхньому куті: + * Validation rules are violated. In this case, the user will see the validation message in the top right corner: -+ -//** `"Перевірте формат обов'язкових полів"`. + ** `Check the format of required fields`. -+ -//* Для бізнес-назви UI-форми: + * For the business name of the UI form: -//** Валідаційні правила порушені -- тоді користувач бачить валідаційне повідомлення у правому верхньому куті: + ** Validation rules are violated. In this case, the user will see the validation message in the top right corner: -+ -//** `"Перевірте формат обов'язкових полів"` + ** `Check the format of required fields`. image:registry-develop:registry-admin/admin-portal/ui-forms/json-code/form-json-code-view-edit-5.png[] -//При спрацьовуванні перевірок, користувач лишається на поточній сторінці/вкладці. During validation checks, the user remains on the current page/tab. - ==== \ No newline at end of file diff --git a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/search-forms.adoc b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/search-forms.adoc index b8e8cd8e59..0e148169e5 100644 --- a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/search-forms.adoc +++ b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/search-forms.adoc @@ -1,34 +1,24 @@ -= Searching of registry UI-forms by name += Searching registry UI forms include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] -//Розробники регламенту можуть здійснювати пошук UI-форм. -//Пошук спрацьовує динамічно за одним з параметрів: Regulation developers can search for UI forms. The search works dynamically based on one parameter:" -//// -* назвою форми; -* службовою назвою форми. -//// * form name; * service form name. -//Шукати змодельовані UI-форми на інтерфейсі можна так: To search for modeled UI forms in the interface, follow these steps: . Open the *UI forms* section in the left-hand menu. -//. Відкрийте розділ "UI-форми" у меню зліва. + image:registry-admin/admin-portal/ui-forms/ui-forms-1.png[] . Enter the form name in the search window. -//. Введіть назву форми в пошуковому вікні + image:registry-admin/admin-portal/ui-forms/ui-forms-4.png[] -//NOTE: Пошук спрацьовує при введенні від 3 і більше символів. NOTE: The search works when 3 or more characters are entered. diff --git a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/sorting-paginating-forms.adoc b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/sorting-paginating-forms.adoc index af008cf875..e3d8e8424b 100644 --- a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/sorting-paginating-forms.adoc +++ b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/sorting-paginating-forms.adoc @@ -3,103 +3,76 @@ include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc include::platform:ROOT:partial$admonitions/language-en.adoc[] -//Платформа дозволяє сортувати змодельовані форми за різними параметрами: The platform allows you to sort modeled forms by various parameters: -//* xref:#sorting-by-name[назвою]; -//* xref:#sorting-by-date[датою та часом створення або редагування]. * xref:#sorting-by-name[by name]; * xref:#sorting-by-date[by creation or modification date and time]. -//Також доступна xref:#pagination[пагінація] рядків. -There is also the rows xref:#pagination[pagination] option available. +There is also the row xref:#pagination[pagination] option available. [#sorting-by-name] -//== Сортування форм за назвою == Sorting forms by name -//Платформа надає дозволяє відсортувати наявні форми за назвою у Кабінеті адміністратора регламентів. Такий тип сортування надає можливість сформувати висхідний, або низхідний список форм для зручності та покращення користувацького досвіду. The platform provides you with the ability to sort existing forms by name in the Regulations administrator portal. This type of sorting allows generating an ascending or descending list of forms for convenience and improved user experience. -//. Увійдіть до розділу для управління UI-формами. . Navigate to the section for managing UI forms. + -.Розділ управління формами .Forms management section image::registry-admin/admin-portal/ui-forms/ui-forms-1.png[] -+ -//. У стовпці `Назва форми` оберіть опцію сортування: + . In the `Form name` column, select the sorting option: -//* `↓` -- Низхідне сортування за назвою (від `А` до `Я` за алфавітом). -//* `↑` -- Висхідне сортування за назвою (від `Я` до `А` за алфавітом) -* `↓` -- Descending sorting by name (from `A` to `Z` alphabetically). -* `↑` -- Ascending sorting by name (from `Z` to `A` alphabetically). + +* `↓` — Descending sorting by name (from `A` to `Z` alphabetically). +* `↑` — Ascending sorting by name (from `Z` to `A` alphabetically). + -.Сортування форм за назвою .Sorting forms by name image::registry-admin/admin-portal/ui-forms/sorting/form-sorting-1.png[] [#sorting-by-date] -//== Сортування форм за датою і часом створення або редагування == Sorting forms by creation or modification date and time -//Платформа дозволяє відсортувати наявні форми за датою і часом створення або редагування у Кабінеті адміністратора регламентів. Такий тип сортування надає можливість сформувати висхідний, або низхідний список форм для зручності та покращення користувацького досвіду. The platform allows sorting existing forms by creation or modification date and time in the Regulations administrator portal. This type of sorting enables creating an ascending or descending list of forms for convenience and improved user experience. -//. Увійдіть до розділу для управління UI-формами. . Navigate to the section for managing UI forms. + -.Розділ управління формами .Forms management section image::registry-admin/admin-portal/ui-forms/ui-forms-1.png[] -+ -//. У стовпці `Дата створення` оберіть опцію сортування за датою і часом створення форми: + . In the `Creation date` column, select the sorting option by creation date and time: -//* `↓` -- Низхідне сортування (найновіші зверху списку). -//* `↑` -- Висхідне сортування (найновіші знизу списку). -* `↓` -- Descending sorting (most recent on top of the list). -* `↑` -- Ascending sorting (most recent at the bottom of the list). + +* `↓` — Descending sorting (most recent on top of the list). +* `↑` — Ascending sorting (most recent at the bottom of the list). + -.Сортування форм за датою і часом редагування .Sorting forms by the date and time modified image::registry-admin/admin-portal/ui-forms/sorting/form-sorting-2.png[] -+ -//. У стовпці `Відредаговано` оберіть опцію сортування за датою і часом редагування форми: . In the `Modified` column, select the sorting option by modification date and time of the form: -//* `↓` -- Низхідне сортування (найновіші зверху списку). -//* `↑` -- Висхідне сортування (найновіші знизу списку). -* `↓` -- Descending sorting (most recent on top of the list). -* `↑` -- Ascending sorting (most recent at the bottom of the list). + +* `↓` — Descending sorting (most recent on top of the list). +* `↑` — Ascending sorting (most recent at the bottom of the list). + -//.Сортування форм за датою і часом створення .Sorting forms by creation date and time image::registry-admin/admin-portal/ui-forms/sorting/form-sorting-3.png[] [NOTE] ==== -//Після редагування форми, змінюється дата і час редагування, а форма підіймається уверх списку, якщо обрано низхідне сортування. After editing a form, the modification date and time change, and the form moves up the list if descending sorting is chosen. -//UI-форми можливо редагувати лише в рамках версії-кандидата на внесення змін. Для того, щоб зміни із версії-кандидата потрапили до майстер-версії, необхідно їх xref:registry-develop:registry-admin/admin-portal/version-control/overview-new-change-request.adoc#push-changes-master[застосувати]. Після застосування змін до майстер-версії, усі гілки-кандидати автоматично отримають оновлення, включно з датами редагування форм. UI forms can only be edited within the change candidate version. To apply the changes from the candidate version to the master version, they need to be applied. After applying the changes to the master version, all candidate branches will automatically receive updates, including the form's modification dates. -//Такий підхід дозволяє розробникам регламенту працювати у різних гілках-кандидатах на внесення змін та досліджувати історичність форм. -This approach allows regulations developers to work in different change candidate branches and explore the history of forms. +This approach allows developers to work in different change candidate branches and explore the history of forms. ==== [#pagination] == Pagination -//Ви можете переходити між сторінками та змінювати кількість рядків, що відображаються на одній сторінці. Для цього прокрутіть бігунок униз сторінки. You can switch between pages and adjust the number of rows displayed on a page. For this, scroll down to the bottom of the page. -//* Для переходу між сторінками використовуйте позначки `>` (вперед) або `<` (назад). * To switch between pages, use the `>` (next) or `<` (previous) icons. -//* Тут ви також можете обрати кількість рядків на сторінці (10 за замовчанням). + * Here you can also change the number of rows displayed on a page (10 by default). image::registry-admin/admin-portal/ui-forms/sorting/form-sorting-4.png[] \ No newline at end of file diff --git a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/ui-forms-overview.adoc b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/ui-forms-overview.adoc index 372acf06df..f21eb0e6c1 100644 --- a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/ui-forms-overview.adoc +++ b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/ui-forms-overview.adoc @@ -1 +1,43 @@ -= Managing UI forms \ No newline at end of file += Managing UI forms +:sectlinks: +:sectanchors: + +include::platform:ROOT:partial$admonitions/language-en.adoc[] + +The *_Managing UI Forms_* section demonstrates the functionality for modeling and managing form schemas for business processes in the Administrative portal. + +image:registry-admin/admin-portal/ui-forms/ui-forms-1.png[] + +The registry regulations developers can conveniently and quickly work with UI forms using the following features: + +* [*] Creating UI forms +* [*] Editing UI forms +* [*] Searching registry UI forms +* [*] Copying UI forms +* [*] Downloading UI forms +* [*] Sorting and paginating UI forms +* [*] Deleting UI forms +* [*] Viewing and editing a UI form JSON representation +* [*] Form editing tabs + +[WARNING] +==== +Recommendations for saving and deleting objects in the Administrative portal: :: + +* Please note that the Administrative portal has limited warning prompts; exercise extreme caution when interacting with objects. +* Be careful and attentive when saving or deleting objects, such as business processes, forms, etc. +* Before creating or deleting an object, it's recommended to verify it to avoid unintended consequences. +* Understand that deleting or altering an object could result in data loss and disrupt business processes. +==== + +== Section overview + +* xref:registry-develop:registry-admin/admin-portal/registry-modeling/ui-forms/create-forms.adoc[Creating UI forms] +* xref:registry-develop:registry-admin/admin-portal/registry-modeling/ui-forms/edit-forms.adoc[Editing UI forms] +* xref:registry-develop:registry-admin/admin-portal/registry-modeling/ui-forms/search-forms.adoc[Searching registry UI forms] +* xref:registry-develop:registry-admin/admin-portal/registry-modeling/ui-forms/copy-forms.adoc[Copying UI forms] +* xref:registry-develop:registry-admin/admin-portal/registry-modeling/ui-forms/download-forms.adoc[Downloading UI forms] +* xref:registry-develop:registry-admin/admin-portal/registry-modeling/ui-forms/sorting-paginating-forms.adoc[Sorting and paginating UI forms] +* xref:registry-develop:registry-admin/admin-portal/registry-modeling/ui-forms/delete-forms.adoc[Deleting UI forms] +* xref:registry-develop:registry-admin/admin-portal/registry-modeling/ui-forms/json-code-view-edit.adoc[Viewing and editing a UI form JSON representation] +* xref:registry-develop:registry-admin/admin-portal/registry-modeling/ui-forms/form-tabs.adoc[Form editing tabs] \ No newline at end of file diff --git a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/version-control/create-new-change-request.adoc b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/version-control/create-new-change-request.adoc index 2cd00f245a..7eea55bf14 100644 --- a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/version-control/create-new-change-request.adoc +++ b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/version-control/create-new-change-request.adoc @@ -9,71 +9,52 @@ :sectlinks: :partnums: -//= Створення запитів на внесення змін = Creating merge requests include::platform:ROOT:partial$admonitions/language-en.adoc[] -//TODO: Translated "запит на внесення змін" in this doc as "merge request", as suggested in our glossary. -//Після розгортання регламенту реєстру, доступна лише одна версія змін -- xref:registry-admin/admin-portal/version-control/master-version-settings.adoc[майстер-версія]. After deploying the registry regulations, only one version of changes is available -- the xref:registry-admin/admin-portal/version-control/master-version-settings.adoc[master version]. -//Користувач має змогу створити новий запит на внесення змін. Операція призведе до створення нового запита на внесення змін до регламенту на базі поточної майстер-версії. Кожний такий запит створює нову гілку, тобто версію-кандидат, в рамках якої вносяться зміни до регламенту. -Users have the ability to create a new merge request. This operation will create a new merge request based on the current master version of the regulations. Each request creates a new branch, which represents a candidate version, for making changes to the regulations. +Users have the ability to create a new merge request. This operation will create a new merge request based on the current master version of the regulations. _Each request creates a new branch, which *represents a candidate version*, for making changes to the regulations_. -//IMPORTANT: Вносити будь-які зміни до регламенту неможливо у майстер-версії. Необхідно створити новий запит на внесення змін, в рамках якого виконувати роботу з регламентом. -IMPORTANT: Making any changes to the regulations in the master version is not possible. It is necessary to create a new merge request to work with the regulations. +include::partial$snippets/admin-portal-master-candidate-edit-en.adoc[] -//IMPORTANT: Будь-яка нова версія змін завжди створюється на базі останніх змін майстер-версії. Тобто навіть якщо ви перебуваєте на версії-кандидаті й хоче створити новий запит на внесення змін, то нова версія-кандидат однаково створюється на основі майстер-версії. IMPORTANT: Any new version of changes is always created based on the latest changes in the master version. So, even if you are on a candidate version and want to create a new merge request, the new candidate version will still be created based on the master version. -//== Створення запита == Creating a request -//Для того, щоб створити запит на внесення змін, виконайте наступні кроки: To create a merge request, follow these steps: -//. У лівому верхньому куті сторінки розгорніть випадний список для управління версіями регламенту. . Expand the drop-down menu for version control in the top left corner of the page. + image:registry-admin/admin-portal/new-admin-portal-2.png[] -//. Оберіть `Створити новий запит`. . Select *Create new request*. -//. У новому вікні заповніть обов'язкові поля: . In the new window, fill in the required fields: -//* У полі `Назва версії` введіть назву зміни. Це буде назва вашої версії-кандидата. Наприклад, `версія-кандидат-01`. * In the *Version name* field, enter the name of the change. This will be the name of your candidate version. For example, `candidate-version-01`. + -//NOTE: Довжина: 3-32 символи. Допускаються `"a-z"`, `"а-я"`, `0-9`, `"-"`. NOTE: Length: 3-32 characters. Allowed characters are "`a-z`", "`а-я`", `0-9`, "`-`". + image:registry-admin/admin-portal/new-admin-portal-3.png[] + -//* У полі `Опис зміни` коротко опишіть, які саме зміни запропоновані до внесення у цій версії-кандидаті. Наприклад, `Внесення тестових змін до регламенту реєстру`. * In the *Change description* field, briefly describe the proposed changes for this candidate version. For example, `Test changes to the registry regulations`. + [NOTE] ==== -//Довжина до 512 символів. Допускаються всі символи, окрім `""` (подвійні лапки), замість них використовуйте `''` (одинарні лапки). Length up to 512 characters. All characters are allowed except `""` (double quotes), use `''` (single quotes) instead. -//Якщо поле `Опис зміни` міститиме подвійні лапки (`""`), то ви не зможете створити запит на внесення змін, оскільки спрацює валідація. Така ж логіка спрацює при перевірчих правил, описаних у підказці до кожного поля. При цьому на інтерфейсі ви побачите відповідну помилку у вигляді підказки: `"Перевірте формат поля"`: If the *Change description* field contains double quotes (" "), you will not be able to create the merge request due to validation. The same logic applies to the validation rules described in the tooltip for each field. In this case, you will see an error prompt on the interface: "Check the format of the field": image:registry-admin/admin-portal/new-admin-portal-3-1.png[] ==== + -//. Натисніть `Створити`. . Click `Create`. - -//В результаті нова версія-кандидат буде створена. Користувач автоматично перейде до щойно створеної версії. ++ As a result, a new candidate version will be created. The user will automatically switch to the newly created version. - ++ image:registry-admin/admin-portal/new-admin-portal-4.png[] -//Після створення нової версії-кандидата, можна xref:registry-admin/admin-portal/version-control/overview-new-change-request.adoc[переглянути її стан та налаштування]. After creating a new candidate version, you can xref:registry-admin/admin-portal/version-control/overview-new-change-request.adoc[view its status and settings]. diff --git a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/version-control/master-version-settings.adoc b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/version-control/master-version-settings.adoc index d823daeeb9..1716bac931 100644 --- a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/version-control/master-version-settings.adoc +++ b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/version-control/master-version-settings.adoc @@ -10,36 +10,26 @@ = Reviewing and configuring the master version -//Майстер-версія змін -- це основна версія або гілка зі змінами регламенту реєстру. До неї потрапляють зміни з усіх інших версій-кандидатів. The master version of changes represents the main version or branch containing the registry regulations updates. It includes changes from all other candidate versions. -//TIP: `master` -- це постійна гілка, яка створюється автоматично з розгортанням git-репозиторію. Вона завжди показує зміни у стані production-ready. TIP: The `master` branch is a permanent branch that is automatically created with the deployment of the git repository. It always reflects the production-ready state of the changes. image:registry-admin/admin-portal/new-admin-portal-1.png[] -//Здійснивши вхід до Кабінету, адміністратор потрапляє на домашню сторінку -- `Огляд версії > Майстер версія регламенту`. -Upon logging into the portal, the administrator is directed to the home page - *Version overview* > *Regulations master version*. +Upon logging into the portal, the administrator is directed to the home page - *Version overview* > *Master version of registry regulations*. -//Також перейти до майстер-версії можна, відкривши випадний список версій регламенту у лівому верхньому куті сторінки. You can also navigate to the master version by opening the dropdown menu for version control in the top left corner of the page. image:registry-admin/admin-portal/new-admin-portal-2.png[] -//До налаштувань майстер-версії регламенту відносять: :: -The configuration of the master version of regulations includes: :: +The configuration of the regulations' master version includes: :: -//* Назву майстер-версії -//* Дату та час останніх змін -//* Опис зміни * Master version name * Date and time of the latest changes * Change description image:registry-admin/admin-portal/new-admin-portal-1-1.png[] -//Надалі список налаштувань майстер-версії буде розширено. In the future, the list of master version configurations will be expanded. -//IMPORTANT: Вносити будь-які зміни до регламенту неможливо у майстер-версії. Необхідно xref:registry-admin/admin-portal/version-control/create-new-change-request.adoc[створити новий запит на внесення змін], в рамках якого виконувати роботу з регламентом. -IMPORTANT: Making any changes to the regulations is not possible in the master version. It is necessary to xref:registry-admin/admin-portal/version-control/create-new-change-request.adoc[create a new merge request] to work with the regulations. +include::partial$snippets/admin-portal-master-candidate-edit.adoc[] \ No newline at end of file diff --git a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/version-control/overview-new-change-request.adoc b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/version-control/overview-new-change-request.adoc index fe19a1b482..5fe99bffb0 100644 --- a/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/version-control/overview-new-change-request.adoc +++ b/docs/en/modules/registry-develop/pages/registry-admin/admin-portal/version-control/overview-new-change-request.adoc @@ -1,180 +1,128 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - -= Reviewing metadata and managing the candidate version settings += Reviewing and managing the candidate version settings +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] + +include::platform:ROOT:partial$admonitions/language-en.adoc[] [#general-description] -//== Загальний опис == General description -//В результаті xref:registry-admin/admin-portal/version-control/create-new-change-request.adoc[створення нової версії-кандидата] на внесення змін до регламенту реєстру, можна переглянути її стан та налаштування. By xref:registry-admin/admin-portal/version-control/create-new-change-request.adoc[creating a new candidate version] for making changes to the registry regulations, you can review its status and settings. -//Знайти нову версію-кандидат можна у лівому верхньому куті сторінки, розгорнувши випадний список для управління версіями регламенту. -You can find the new candidate version in the top left corner of the page by expanding the dropdown menu for managing regulations version. +You can find the new candidate version in the top left corner of the page by expanding the dropdown menu for managing the regulations version. image:registry-admin/admin-portal/new-admin-portal-5.png[] -//При створенні версії, адміністратор регламенту може переглянути _дату та час_ створення, а також _опис зміни_. When creating a version, the regulation administrator can view the _date and time_ of creation, as well as the _description of the change_. -//Також адміністратор регламенту може: :: -The regulations administrator can also: :: +The registry regulations administrator can also: :: -//* xref:#merge-conflict[Отримати інформацію про конфліктні зміни відносно майстер-версії] * xref:#merge-conflict[Get information about conflicting changes relative to the master version] -//* xref:#review-changes-candidate[Переглянути перелік внесених змін] + * xref:#review-changes-candidate[Review the list of the changes made] -//* xref:#pull-changes-master[Отримати оновлення] + * xref:#pull-changes-master[Get updates] -//* xref:#push-changes-master[Застосувати зміни до майстер-версії] + * xref:#push-changes-master[Apply changes to the master version] -//* xref:#abandon-changes[Відкликати запит] + * xref:#abandon-changes[Withdraw the request] image:registry-admin/admin-portal/new-admin-portal-4.png[] [#merge-conflict] -//== Інформація про конфліктні зміни відносно майстер-версії == Conflicting changes relative to the master version -//Конфлікт злиття -- це подія, яка виникає, коли система (Git) не може автоматично вирішити відмінності в коді між двома версіями змін. A merge conflict is an event that occurs when the system (Git) cannot automatically resolve differences in code between two versions of changes. -.Сценарій конфлікту злиття .Merge conflict scenario ==== -//Припустімо, що є два моделювальники регламенту: моделювальник A та моделювальник Б. Обидва вони працюють над тим самим файлом коду зі сховища та намагаються внести різні зміни в цей файл в рамках своїх версій-кандидатів (наприклад, просто змінити назву бізнес-процесу). Після внесення змін моделювальник А застосовує зміни до майстер-версії. Тепер, коли моделювальник Б намагається застосувати свої зміни над цим же файлом в рамках своєї версії-кандидата, він не може це зробити, оскільки файл уже змінено моделювальником А, а зміни злиті до майстер-гілки. + Suppose there are two persons working on changes to the regulations: user A and user B. Both are working on the same code file from the repository and trying to make different changes to this file within their candidate versions (e.g., simply changing the name of a business process). After making changes, user A applies the changes to the master version. Now, when user B tries to apply their changes to the same file within their candidate version, they cannot do so because the file has already been modified by user A, and the changes are merged into the master branch. ==== -.Внесення змін до моделі бізнес-процесів моделювальником А у версії-кандидаті-01 .Making changes to the business process model by user A in candidate ==== image:registry-admin/admin-portal/new-admin-portal-7.png[] ==== -.Приклад. Оновлення версії-кандидата-01 та застосування змін до майстер-версії моделювальником А .Updating candidate version-01 and applying changes to the master version by user A ==== image:registry-admin/admin-portal/new-admin-portal-11.png[] ==== -.Оновлення версії-кандидата-02 та застосування змін до майстер-версії моделювальником Б .Updating candidate version-02 and applying changes to the master version by user B ==== image:registry-admin/admin-portal/new-admin-portal-8.png[] ==== -//NOTE: В такому випадку моделювальник Б не зможе отримати оновлення із майстер-версії через конфлікт. Шляхом до вирішення конфлікту є відкликання запита на внесення змін, тобто скасування версії-кандидата-02, та створення нового запита на внесення змін. NOTE: In such a case, user B cannot get updates from the master version due to the conflict. The way to resolve the conflict is to withdraw the change request, i.e., cancel candidate version-02 and create a new change request. [#review-changes-candidate] -//== Перегляд переліку внесених змін == Reviewing the list of changes -//В Кабінетів адміністратора регламентів можна легко переглядати перелік внесених змін. -In the Regulations administrator portal, you can easily review the list of changes made. +In the *Administrative portal*, you can easily review the list of changes made. -//Для того, щоб переглянути внесені зміни до версії-кандидата, необхідно: To review the changes made to the candidate version, follow these steps: -//. Перейти до відповідної версії-кандидата у лівому верхньому куті сторінки, розгорнувши випадний список для управління версіями регламенту. . Go to the respective candidate version in the top left corner of the page by expanding the dropdown menu for managing regulation versions. -+ -//. Знайти секцію `Внесені зміни`. -. Navigate to the section *Latest changes*. -//TODO: The suggested version of the translation of the section above to be confirmed -//. Розгорнути категорію змін. Наприклад, `Моделі бізнес-процесів`. -. Expand the change category. For example, `Business Process Models`. -//. Переглянути файли, до яких внесено зміни. +. Navigate to the *Proposed changes* section. +. Expand the change category. For example, *Business process models*. . Review the files that have been changed. - + image:registry-admin/admin-portal/new-admin-portal-9.png[] [#pull-changes-master] -//== Оновлення та актуалізація стану відкритих запитів на внесення змін == Getting updates and updating the status of open change requests -//CAUTION: Для постійної синхронізації майстер-версії з усіма версіями-кандидатами та актуалізації стану відкритих запитів згідно з останньою майстер-версією, система автоматично оновлює усі відкриті запити (версії-кандидати) на внесення змін. CAUTION: To continuously synchronize the master version with all candidate versions and update the status of open requests according to the latest master version, the system automatically updates all open change requests (candidate versions). -//Також адміністратор регламенту час від часу може оновлювати свою версію-кандидат в ручному режимі. Зробити це можна наступним чином: -The regulations administrator can also manually update their candidate version from time to time. This can be done as follows: +The registry regulations administrator can also manually update their candidate version from time to time. This can be done as follows: -//. Перейдіть до відповідної версії-кандидата у лівому верхньому куті сторінки, розгорнувши випадний список для управління версіями регламенту. . Go to the respective candidate version in the top left corner of the page by expanding the dropdown menu for managing regulations versions. -+ -//. Натисніть кнопку `Отримати оновлення`. -. Click the `Update` button. +. Click the `Update` button. + image:registry-admin/admin-portal/new-admin-portal-10.png[] [#push-changes-master] -//== Застосування змін до майстер-версії == Applying changes to the master version -//Після виконання робіт в рамках версії-кандидата, необхідно застосувати внесені зміни до майстер-версії, щоб інші адміністратори могли бачити актуальний стан репозиторію регламенту реєстру. Для цього виконайте наступні кроки: After completing the work within the candidate version, it is necessary to apply the changes made to the master version so that other administrators can see the current state of the registry regulations repository. To do this, follow these steps: -//. Перейдіть до відповідної версії-кандидата у лівому верхньому куті сторінки, розгорнувши випадний список для управління версіями регламенту. . Go to the corresponding candidate version in the top left corner of the page by expanding the drop-down menu for version control. - + -//NOTE: Перед застосуванням змін до майстер-версії, необхідно спочатку xref:#pull-changes-master[отримати оновлення] NOTE: Before applying changes to the master version, you need to xref:#pull-changes-master[get updates] first. -+ -//. Натисніть кнопку `Застосувати зміни до майстер-версії`. -. Click the *Apply changes to master version* button. +. Click the *Apply changes to master version* button. + image:registry-admin/admin-portal/new-admin-portal-11.png[] -+ -//. У вікні із попередженням підтвердьте внесення змін до майстер-версії, або закрийте його. + . In the warning window, confirm the changes to the master version or close it. + image:registry-admin/admin-portal/new-admin-portal-11-1.png[] + [NOTE] ==== -//Ви отримаєте вікно із попередженням про підтвердження дії наступного змісту: + You will receive a confirmation window for the following action: ===== -//Будь ласка, зверніть увагу, що процес розгортання та перевірки ще не завершився або завершився з помилками. Застосування змін може призвести до помилок у майстер-версії регламенту. + Please note that the deployment and verification process is not yet complete or has encountered errors. Applying changes may result in errors in the master version of the regulations. ===== -//Процес розгортання та перевірки -- це пайплайн *`MASTER-Code-review-registry-regulations`* у Jenkins. Він передує процесу збірки коду та публікації змін у регламенті -- *`MASTER-Build-registry-regulations`*. Наразі адміністратор регламенту може вручну пропускати процес Code review, відразу застосовуючи зміни до майстер-гілки репозиторію. -The deployment and verification process is the *`MASTER-Code-review-registry-regulations`* pipeline in Jenkins. It precedes the process of code compilation and publishing changes to the *`MASTER-Build-registry-regulations`* regulations. Currently, the regulations administrator can manually bypass the Code review process by directly applying changes to the master branch of the repository. +The deployment and verification process is the *`MASTER-Code-review-registry-regulations`* pipeline in Jenkins. It precedes the process of code compilation and publishing changes to the *`MASTER-Build-registry-regulations`* regulations. Currently, the registry regulations administrator can manually bypass the Code review process by directly applying changes to the master branch of the repository. ==== -//В результаті внесені зміни потраплять до майстер-гілки, а обрана версія-кандидат автоматично видалиться зі списку версій. As a result, the changes will be included in the master branch, and the selected candidate version will be automatically removed from the list of versions. [#abandon-changes] -//== Відкликання запита на внесення змін в рамках версії-кандидата == Withdrawing a change request within the candidate version -//За потреби відкликання запита на внесення змін у власній версії-кандидаті, наприклад, при xref:#merge-conflict[конфлікті злиття], виконайте наступні кроки: If necessary to withdraw a change request within your own candidate version, for example, due to xref:#merge-conflict[merge conflicts], follow these steps: -//. Перейдіть до відповідної версії-кандидата у лівому верхньому куті сторінки, розгорнувши випадний список для управління версіями регламенту. -. Go to the corresponding candidate version in the top left corner of the page by expanding the drop-down menu for regulations version control. -+ -//. Натисніть кнопку `Відізвати`. -. Click the *Withdraw* button. +. Go to the corresponding candidate version in the top left corner of the page by expanding the drop-down menu for the regulations version control. +. Click the *Withdraw* button. + image:registry-admin/admin-portal/new-admin-portal-12.png[] -//В результаті внесені зміни буде анульовано, а обрана версія-кандидат автоматично видалиться зі списку версій. As a result, the changes will be canceled, and the selected candidate version will be automatically removed from the list of versions. \ No newline at end of file diff --git a/docs/en/modules/registry-develop/pages/registry-admin/api-rate-limits.adoc b/docs/en/modules/registry-develop/pages/registry-admin/api-rate-limits.adoc index e1fa6ddf4f..c77e5ba3ed 100644 --- a/docs/en/modules/registry-develop/pages/registry-admin/api-rate-limits.adoc +++ b/docs/en/modules/registry-develop/pages/registry-admin/api-rate-limits.adoc @@ -1,142 +1,87 @@ -//= API Рейт-ліміти: обмеження кількості запитів за одиницю часу -= API Rate Limits: limiting the number of requests per time unit -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: += API Rate Limits: Restricting the number of requests per time unit +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] +include::platform:ROOT:partial$admonitions/language-en.adoc[] - -//== Загальний опис == Overview -____ -//Рейт-лімітування (_англ. -- Rate limiting_) -- це стратегія для обмеження мережевого трафіку. -*Rate limiting* is a network trafic limiting strategy. -____ -//_API рейт-ліміти_ (_англ. -- API Rate Limits_) -- обмеження кількості HTTP-запитів до сервісу чи маршруту за заданий період секунд, хвилин, годин, днів, місяців або років. -_API Rate Limits_ -- these are limits of the number of HTTP-requests to the service or route per a defined time period in seconds. +TIP: *Rate limiting* is a network traffic limiting strategy. + +*_API rate limits_* are limits of the number of HTTP requests to the service or route per a defined period. It is set _in seconds_. -//Механізм рейт-лімітів реалізований на базі -//https://docs.konghq.com/hub/kong-inc/rate-limiting/[Rate-Limiting]-плагіну для Kong API Gateway. Якщо сервіс/маршрут не має рівня аутентифікації, ліміт буде встановлено для IP-адреси клієнта. В іншому випадку для лімітів можна використовувати значення власного заголовка запита, що містить інформацію про користувача: наприклад, ідентифікатор -//користувача, його роль чи ідентифікатор організації, яку він представляє. Такий заголовок можна додати засобами Kong OIDC-плагіну. -The mechanism of API Rate Limits is based on the https://docs.konghq.com/hub/kong-inc/rate-limiting/[Rate-Limiting]-plugin for Kong API Gateway. If the service/route does not have an authentication level, the limit will be set for client IP address. Otherwise, HTTP-header can be used for limiting, for example user ID, user role ID, or user organization ID. +The mechanism of API Rate Limits is based on the https://docs.konghq.com/hub/kong-inc/rate-limiting/[Rate-Limiting]-plugin for Kong API Gateway. If the service/route does not have an authentication level, the limit will be set for the client's IP address. Otherwise, the HTTP header can be used for limiting, for example, user ID, user role ID, or user organization ID. [CAUTION] ==== -//Важливо, щоб плагін _rate-limiting виконувався після OIDC-плагіну_! It is imperative that the _rate-limiting plugin is executed after the OIDC-plugin_! -//Тобто пріоритет OIDC-плагіну має бути вищим за значення пріоритету для плагіну rate-limiting, який за https://github.com/Kong/kong/blob/master/kong/plugins/rate-limiting/handler.lua#L49[замовчуванням становить 910]. Цей механізм більш детально описаний нижче. This means that the OIDC-plugin priority must be higher than the rate-limiting plugin priority, which is https://github.com/Kong/kong/blob/master/kong/plugins/rate-limiting/handler.lua#L49[910 by default]. The mechanism is described in detail further. ==== [IMPORTANT] ==== -//Всі рейт-ліміти обчислюються виключно в межах одного екземпляру Kong API Gateway. Якщо кількість екземплярів Kong більше одного, то загальна кількість запитів від користувача може бути більшою в _n_ разів за значення, встановлене в налаштуваннях для лімітів, де _n_ -- це кількість //розгорнутих екземплярів Kong API Gateway. All rate-limits are calculated within one Kong API Gateway instance. If there are _n_ Kong API Gateway instances, then the general number of requests from the user can be _n_ times the set limit value. -//Kong API Gateway розгортається на рівні сервісів реєстру. Kong API Gateway is deployed on the registry services level. ==== -//.Верхньорівнева діаграма функціонування рейт-лімітів у Kong .High-level diagram of rate-limits functioning in Kong ==== image:registry-admin/api-rate-limits/Kong-Rate-Limits.drawio.png[] ==== -//== Принцип роботи рейт-лімітів для неавтентифікованих користувачів == Rate-limits operation principle for non-authenticated users -//Для неавтентифікованих користувачів можливо встановити ліміт лише за IP-адресою (`config.limit_by: ip`). Limits can only be set by IP address for non-authenticated users (`config.limit_by: ip`). -//// -Такий ліміт працюватиме виключно для публічних API, які не потребують автентифікації, адже в разі наявності -автентифікації, OIDC-плагін, який виконується першим, повертатиме -користувачу помилку `HTTP 403 Forbidden` до надходження запита до Rate-limiting-плагіну. -//// - -//.Схема роботи рейт-лімітів для неавтентифікованих користувачів -. Rate-limits operation scheme for non-authenticated users +.Rate-limits operation scheme for non-authenticated users ==== [plantuml] ---- include::partial$registry-admin/api-rate-limiting-unauthenticated-user.puml[] ---- -//. Користувач надсилає запит до платформи, який надходить до Kong API Gateway. . The user sends a request to the platform. The request goes to Kong API Gateway. -//. Запит обробляється Kong Rate-Limiting плагіном, який, базуючись на правилах для конкретного сервісу/маршруту, визначає, чи досягнуто ліміт запитів для IP-адреси користувача. + . The request is processed by the Kong Rate-Limiting plugin, which decides if the request limit was achieved by the user, based on the given service/route rules. -//. Якщо ліміт запитів від користувача не досягнуто, запит перенаправляється на відповідний сервіс платформи для подальшого опрацювання. -. If the request limit was not achieved by the user, the request is rerouted to the corresponding service for processing. -//. Користувач отримує відповідь від сервісу. +. If the user did not achieve the request limit, the request is rerouted to the corresponding service for processing. . The user receives a response from the service. -//. Якщо ліміт запитів досягнуто, плагін Rate-Limiting повертає відповідь з помилкою `HTTP 429`. -.If the request limit was achieved by the user, the Rate-Limiting plugin responds with the `HTTP 429` error. +.If the user achieved the request limit, the Rate-Limiting plugin responds with the `HTTP 429` error. ==== -//== Принцип роботи рейт-лімітів для автентифікованих користувачів -== Rate-limits operation principle for authenticated users +== Rate limits operation principle for authenticated users -//Якщо сервіс/маршрут має рівень автентифікації, то ліміт -//можна встановити не лише для IP-адреси клієнта, а й для -//конкретного автентифікованого користувача чи їх групи. If the service/route has an authentication level, then the limit can be set not only for IP-address, but for any authenticated user or user group. -//В такому разі для обчислення ліміту можна використовувати значення власного заголовка `"token-claim"` запита, що містить інформацію про користувача: наприклад, ідентифікатор користувача, роль, або ідентифікатор організації, яку він представляє. -//Такий заголовок можна додати засобами Kong OIDC-плагіну. -In this case the request's own `"token-claim"` header value can be used to calculate the limit, as the header contains user data, such as: user ID, role, organization ID, etc. Such a header can be added using Kong OIDC-plugin. +In this case, the request's own `"token-claim"` header value can be used to calculate the limit, as the header contains user data, such as user ID, role, organization ID, etc. This header can be added using Kong OIDC-plugin. -//.Принцип роботи рейт-лімітів для автентифікованих користувачів -.Rate-limits operation principle for authenticated users +.Rate limits operation principle for authenticated users ==== [plantuml] ---- include::partial$registry-admin/api-rate-limiting-authenticated-user.puml[] ---- -//. Користувач надсилає запит до платформи, який надходить до Kong API Gateway. . The user sends a request to the platform. The request goes to Kong API Gateway. -//. Першим запит обробляє Kong OIDC-плагін, який перевіряє сесію -//користувача. + . Kong OIDC-plugin gets to process the request, checking user session. + -//Якщо користувач успішно пройшов автентифікацію (існує активна сесія), то OIDC-плагін додає до запита заголовки із JWT-токенами користувача та заголовок `"token-claim"`, що містить значення атрибута (claim) з токена доступу автентифікованого користувача. Надалі значення цього заголовка використовується плагіном rate-limiting для обчислення лімітів для автентифікованого користувача чи групи таких користувачів. . If the user was successfully authenticated (active session present), then the OIDC-plugin adds two headers to the request: one with the user's JWT-tokens, and one `"token-claim"` that contains the claim attribute value from the user's access token. From this point, the rate-limiting plugin will use the `"token-claim"` header to calculate rate-limits for the authenticated user, or user group. -//. Обробка запита передається до наступного плагіну -- Rate-Limiting. . The request goes to Rate-Limiting plugin for processing. -//. Плагін Rate-Limiting, базуючись на правилах для конкретного сервісу/маршруту, визначає, чи досягнуто ліміт запитів для користувача. + . The Rate-Limiting plugin decides if the request limit was achieved by the user, based on the given service/route rules. + -//Ліміт може бути встановлений як за IP-адресою, так і на основі значення заголовка `"token-claim"`. . The limit can be set by IP-address, as well as `"token-claim"` header value. -//. Якщо ліміт запитів від користувача не досягнуто, запит перенаправляється на відповідний сервіс платформи для подальшого опрацювання. -. If the request limit was not achieved by the user, the request is rerouted to the corresponding service for processing. -//. Користувач отримує відповідь від сервісу. +. If the user did not achieve the request limit, the request is rerouted to the corresponding service for processing. . The user receives a response from the service. -//. Якщо ліміт запитів досягнуто, плагін Rate-Limiting повертає відповідь з помилкою `HTTP 429`. -.If the request limit was achieved by the user, the Rate-Limiting plugin responds with the `HTTP 429` error. +.If the user achieved the request limit, the Rate-Limiting plugin responds with the `HTTP 429` error. ==== [header-setup-unauth-user] [#header-setup-unauth-user] -//=== Налаштування власного заголовка для автентифікованого користувача === Setting up header for authenticated user -//Для обчислення лімітів для автентифікованих користувачів можна використовувати значення заголовка `"token-claim"` запита, що містить інформацію про користувача. Встановити значення для цього заголовка можна в налаштуваннях OIDC-плагіну для Kong. Цей заголовок може містити значення кореневого атрибута (`claim`) з JWT-токена доступу користувача. The values of `"token-claim"` header that contains user info can be used to calculate limits for authenticated users. You can set the values via Kong OIDC-plugin configuration. The header can include the value of root attribute (`claim`) from the user's access JWT-token. -//.Приклад налаштування OIDC-плагіну KONG для додавання заголовка "token-claim" .Example: configuring Kong OIDC-plugin to add "token-claim" header ==== - .OIDC Config [source,yaml] ----------------- @@ -144,10 +89,8 @@ config: token_claim_header_value: "sub" ----------------- -//В такому випадку, після обробки запита OIDC-плагіном, до запита буде додано заголовок `"token-claim"`, значення для якого буде взято з атрибута `"sub"` (claim) токена доступу користувача. In this case, `"token-claim"` header will be added after processing the request by OIDC-plugin. The header will be taken from the `"sub"` (claim) attribute of the user access token. -//Тобто ми отримаємо заголовок `"token-claim"`, що містить ідентифікатор користувача. Надалі цей заголовок можна використати в плагіні rate-limiting для обчислення ліміту за ідентифікатором користувача. As a result, we get a `"token-claim"` header that contains user ID. This header can be used in the rate-limiting plugin to calculate limit by user ID. .Rate-Limiting Config @@ -157,38 +100,25 @@ config: limit_by: header header_name: "token-claim" ----------------- - ==== -//Для складніших варіантів обчислення ліміту можна додати власний атрибут до JWT-токена, що містить значення яке обчислюється. Зробити це можливо засобами https://www.keycloak.org/docs/latest/server_admin/#_protocol-mappers[Keycloak protocol mappers]. -For more complex limit calculations you can add your own dedicated attribute to the JWT-token. This is done via https://www.keycloak.org/docs/latest/server_admin/#_protocol-mappers[Keycloak protocol mappers]. +For more complex limit calculations, you can add your own dedicated attribute to the JWT-token. This is done via https://www.keycloak.org/docs/latest/server_admin/#_protocol-mappers[Keycloak protocol mappers]. [#rate-limits-configuration] -//== Налаштування рейт-лімітів адміністратором == Configuring rate-limits -//=== Механізм налаштування рейт-лімітів === Rate-limits configuration mechanism -//Механізм рейт-лімітів реалізований на базі -//https://docs.konghq.com/hub/kong-inc/rate-limiting/[Rate-Limiting]-плагіну для Kong API Gateway. The mechanism is based on https://docs.konghq.com/hub/kong-inc/rate-limiting/[Rate-Limiting]-plugin for Kong API Gateway. -//Плагін Kong Rate-limiting є частиною Kong API Gateway та розгортається автоматично, разом з ним. Kong Rate-limiting is a part of Kong API Gateway and is deployed along with it. -//Механізм налаштування рейт-лімітів адміністратором є наступним: :: The Rate-limits configuration mechanism goes as follows: :: -//. Адміністратор створює або редагує конфігураційний файл у форматі _.yaml (.yml)_ -//з налаштуваннями для розширень Kong API Gateway -- OIDC та Rate-Limiting. -. The administrator creates and edits the configuration file in _.yaml (.yml)_ file for OIDC and Rate-Limiting plugins Kong API Gateway. -//. Адміністратор зберігає зміни в Gerrit-репозиторії у відповідному каталозі. +. The administrator creates and edits the configuration file in _.yaml (.yml)_ file for *OIDC* and *Rate-Limiting* plugins Kong API Gateway. . Changes are saved in the corresponding catalog of Gerrit-repository. -//. Запускається процес Jenkins, який перевіряє наявність змін в репозиторії, та застосовує змінену конфігурацію для всіх запущених екземплярів Kong API Gateway в межах реєстру. . Jenkins checks the repository for changes and applies the changed configuration for all the deployed instances of Kong API Gateway within the registry. + -//.Схема налаштування рейт-лімітів адміністратором .Rate-limit configuration scheme ==== image:registry-admin/api-rate-limits/Rate-limit-configuration.drawio.png[] @@ -196,59 +126,43 @@ image:registry-admin/api-rate-limits/Rate-limit-configuration.drawio.png[] [CAUTION] ==== -//Щоб налаштувати ліміти для автентифікованих користувачів чи їх груп, що об`єднані за певним атрибутом, необхідно спершу додати до запита заголовки з потрібними атрибутами. Базуючись на значеннях цих атрибутів, Rate-Limiting плагін зможе рахувати ліміти для кожного автентифікованого користувача чи групи індивідуально. Додати до запита заголовки з атрибутами користувача можна за допомогою OIDC-плагіну, який дозволяє додати власний заголовок `"token-claim"` зі значенням з JWT-токена (_детальніше -- у розділі xref:#header-setup-unauth-user[]_). -To configure limits for authenticated users or user groups assembled by a certain attribute, you need to add header with said attributes to the request. Based on the attributes values, the Rate-Limiting plugin will calculate limits for each authenticated user or group individually. Use OIDC-plugin to add the headers with user attributes, as it allows you to add your own `"token-claim"` header with the JWT-token value (see xref:#header-setup-unauth-user[]_ for details). +To configure limits for authenticated users or user groups assembled by a certain attribute, you need to add header with said attributes to the request. Based on the attribute values, the Rate-Limiting plugin will calculate limits for each authenticated user or group individually. Use OIDC-plugin to add the headers with user attributes, as it allows you to add your own `"token-claim"` header with the JWT-token value (see xref:#header-setup-unauth-user[]_ for details). ==== -//=== Процес налаштування лімітів за допомогою values.yaml === The process of configuring limits in values.yaml -//Налаштування рейт-лімітів відбувається у конфігураційному файлі _values.yaml_, у шаблоні розгортання відповідного реєстру. Метадані розгортання реєстрів із шаблону зберігаються у компоненті `control-plane-gerrit` -- центральному репозиторії Gerrit. -Rate-limits are configured in the _values.yaml_ configuration file, in the deployment template of the corresponding registry. Registry deployement metadata is stored in the `control-plane-gerrit` component -- central Gerrit repository. +Rate-limits are configured in the _values.yaml_ configuration file, in the deployment template of the corresponding registry. Registry deployment metadata is stored in the `control-plane-gerrit` component -- central Gerrit repository. [TIP] ==== -//Для прикладу розглянемо шаблон реєстру `registry-tenant-template-registry-dev-minimal`, що містить відповідну мінімальну конфігурацію ресурсів для реєстру, що розгортатиметься (_див. сторінку xref:admin:registry-management/control-plane-create-registry.adoc[]_). As an example, let's look at the `registry-tenant-template-registry-dev-minimal` registry template that contains the minimum resource configuration for the deployed registry (_see xref:admin:registry-management/control-plane-create-registry.adoc[]_) ==== [NOTE] ==== -//* За замовчуванням рейт-ліміти вимкнені. * Rate-limits are turned off by default. -//* Увімкнути їх може адміністратор безпеки з належними правами доступу. * A security administrator with the corresponding access rights can turn them off. ==== -//. У локальному середовищі адміністратора відкрийте репозиторій центрального Gerrit -- `control-plane-gerrit`. . Open the central Gerrit repository `control-plane-gerrit` in a local environment. -//. Відкрийте конфігураційний файл відповідного шаблону розгортання реєстру. . Open the configuration file of the corresponding registry deployment template. + -//Шлях до файлу може бути, наприклад, такий: The route to the file would look similar to this: + ____ resources/repositories/templates/registry-tenant-template-.git/deploy-templates/values.yaml ____ + -//TIP: Для прикладу ми використовуємо шаблон _registry-tenant-template-registry-dev-minimal.git_ -- шаблон розгортання реєстру із відповідним набором ресурсів (_тут -- мінімальна (minimal) конфігурація_). TIP: As an example we'll use the _registry-tenant-template-registry-dev-minimal.git_ template for registry deployment with the corresponding resources (_minimal configuration_). + image:registry-admin/api-rate-limits/api-rate-limits-1.png[] -//. Всередині файлу _values.yml_ знайдіть секцію параметрів, яка відповідає за налаштування плагінів Kong -- `kongPluginsConfig`. - -//. Увімкніть плагін встановлення рейт-лімітів. Для цього встановіть значення параметра `rateLimitingPluginEnable: true`. . Activate the Rate-Limiting plugin by setting `rateLimitingPluginEnable: true`. + -//NOTE: Функціональність рейт-лімітів здатна обмежити кількість запитів за одиницю часу _від вебпорталів_ (Кабінети посадової особи, отримувача послуг та адміністрування регламентів) _до API внутрішніх сервісів_ реєстру. NOTE: The rate-limit functionality limits the amount of requests per time unit _from the webportals_ (Officer portal, citizen portal, etc.) _to the external services APIs_ of the registry. -//. За замовчуванням налаштування Kong Rate Limiting плагіну виглядають наступним чином: -. By default the Kong Rate Limiting plugin configuration looks as follows: +. By default, the Kong Rate-Limiting plugin configuration looks as follows: + -//.Налаштування values.yml для плагіну Kong Rate Limiting .Configuring values.yml for Kong Rate Limiting plugin ==== [source,yaml] @@ -268,66 +182,33 @@ kongPluginsConfig: pluginsRateLimitByIpHideClientHeaders: "false" ---- -//Поточна конфігурація показує налаштування рейт-лімітів за секунду та годину за: This configuration shows rate-limits per second and hour by: -//* заголовком (`ByHeader`) -- лише для авторизованих користувачів -- параметри `pluginsRateLimitByHeaderRequestsPerSecond` та `pluginsRateLimitByHeaderRequestsPerHour` відповідно; * Header (`ByHeader`) -- only for authorized users -- `pluginsRateLimitByHeaderRequestsPerSecond` and `pluginsRateLimitByHeaderRequestsPerHour` parameters, accordingly; -//* IP-адресою (`ByIp`) -- для будь-яких користувачів -- параметри `pluginsRateLimitByIpRequestsPerSecond` та `pluginsRateLimitByIpRequestsPerHour` відповідно. * IP-address (`ByIp`) -- for all users -- `pluginsRateLimitByIpRequestsPerSecond` and `pluginsRateLimitByIpRequestsPerHour` parameters, accordingly. -//IMPORTANT: Для коректної роботи плагіну, значення лімітів для параметрів `LimitByHeader` та `LimitByIP` мають бути однаковими. IMPORTANT: For proper plugin operation, the limit valiues for `LimitByHeader` and `LimitByIP` parameters must be identical. - ==== + -//NOTE: Повний список налаштувань та можливостей Kong Rate Limiting плагіну з описом параметрів доступний за https://docs.konghq.com/hub/kong-inc/rate-limiting/[посиланням]. -NOTE: The full list of Kong Rate Limiting plugin configurations and capabilities is available https://docs.konghq.com/hub/kong-inc/rate-limiting/[here]. +NOTE: The full list of Kong Rate-Limiting plugin configurations and capabilities is available https://docs.konghq.com/hub/kong-inc/rate-limiting/[here]. -//. Після усіх налаштувань, виконайте commit до відповідного репозиторію. Після проходження збірки, нові ліміти набудуть чинності. . After configuring, perform a commit into the corresponding repository. -//TODO: Додати в опис примітку про дефолтні ліміти для ендпоінтів: 1.8.2+ - -//== Відображення помилок на формах Кабінетів при перевищенні кількості запитів до сервісів == Displaying errors on Portal forms on exceeding the service request limits -//Перевищення кількості дозволених запитів від кабінетів адміністратора регламенту реєстру (`admin-portal`), посадової особи (`officer-portal`) та отримувача послуг (`citizen-portal`) до сервісів (бекенд-API) призводить до виникнення помилок, які відображаються на інтерфейсах користувачів. -Exceeding the amount of permitted requests from the `admin-portal`, `officer-portal`, and `citizen-portal` to backend API services causes errors that are displayed in the UI. - -//Якщо при спробі доступу до сторінок кабінетів перевищено ліміт дозволеної кількості запитів до сервісів, то робота зі сторінкою блокується і відбувається перехід на сторінку з описом помилки `HTTP 429`. -If the rate-limit are exceeded when trying to access portal pages, the access is blocked, and the user is redirected to `HTTP 429` error page. +Exceeding the number of permitted requests from the `admin-portal`, `officer-portal`, and `citizen-portal` to backend API services causes errors that are displayed in the UI. -//Обмеження кількості запитів та час відновлення роботи зі сторінкою порталу встановлює адміністратор безпеки у xref:#rate-limits-configuration[налаштуваннях плагіну] Rate Limiting. +If the rate limit is exceeded when trying to access portal pages, the access is blocked, and the user is redirected to `HTTP 429` error page. -//.Приклади відображення помилок у кабінетах користувачів при перевищенні встановлених лімітів -.Examples of error displaying in user portals on exceeding rate-limits +.Examples of error displayed in user portals on exceeding rate-limits ==== -//.Помилка при перевищенні лімітів запитів до сервера за встановлену одиницю часу у кабінеті адміністратора регламентів: .Rate-limit exceeding error in regulations administrator portal: image:registry-admin/api-rate-limits/api-rate-limits-2.png[] -//.Перевищення лімітів запитів до сервера за встановлену одиницю часу у кабінеті посадової особи: .Rate-limit exceeding error in officer portal: image:registry-admin/api-rate-limits/api-rate-limits-4.png[] -//.Перевищення лімітів запитів до сервера за встановлену одиницю часу у кабінеті отримувача послуг: .Rate-limit exceeding error in citizen portal: image:registry-admin/api-rate-limits/api-rate-limits-3.png[] -==== - -//// ----- -//TODO: Уточнити: Заголовок RateLimit-Reset, cхоже, підтримується лише в enterprise версії плагіну (Advanced). -Значення "хх секунд" в тексті помилки визначається значенням отриманою з HTTP заголовка відповіді сервера "RateLimit-Reset". -Сторінка з описом помилки відображається для користувача при виконанні запитів з усіх сторінок Admin/Citizen/Officer Portal. -Користувач має змогу оновити сторінку після того, як буде вичерпано встановлений проміжок часу блокування порталу і повернутись на активну сторінку за допомогою: -а) засобів навігації браузера; -б) клавіатури; -в) кнопки "Оновити сторінку" на інтерфейсі сторінки з описом помилки. -Користувач має змогу оновити сторінку з описом помилки до закінчення встановленого проміжку часу блокування порталу(RateLimit Reset)після чого сторінка з описом помилки відображається з оновленим значенням RateLimit-Reset до розблокування. -Користувач має змогу оновити сторінку з описом помилки до закінчення встановленого проміжку часу блокування порталу(RateLimit Reset), однак для продовження роботи час становлений в RateLimit Reset має бути завершеним. -При спробі користувача перейти на будь-яку іншу сторінку порталу за допомогою засобів навігації браузера, система повертає користувача на сторінку з описом помилки. -Перелік критичних запитів та способи відображення нотифікації про помилки пп. 31 Переліку сценаріїв помилок та способів їх обробки. -//// \ No newline at end of file +==== \ No newline at end of file diff --git a/docs/en/modules/registry-develop/pages/registry-admin/cp-auth-setup/cp-auth-setup-officers.adoc b/docs/en/modules/registry-develop/pages/registry-admin/cp-auth-setup/cp-auth-setup-officers.adoc index 07862aafb6..f272130af9 100644 --- a/docs/en/modules/registry-develop/pages/registry-admin/cp-auth-setup/cp-auth-setup-officers.adoc +++ b/docs/en/modules/registry-develop/pages/registry-admin/cp-auth-setup/cp-auth-setup-officers.adoc @@ -5,46 +5,43 @@ include::platform:ROOT:partial$admonitions/language-en.adoc[] [IMPORTANT] ==== -//Зміна типу автентифікації доступна для версій реєстру `*1.9.3*` та вище. + Changing the authentication type is available for the registry versions *`1.9.3`* and later. -//Усі попередні версії реєстрів використовують один тип автентифікації за замовчуванням для Кабінету посадової особи -- автентифікація за допомогою КЕП з використанням IIT-віджета. All earlier versions of the registry use the authentication with the Qualified Electronic Signature (QES) and the IIT widget, which is the default authentication type for the Officer portal. ==== -//== Загальний опис == General description -//Адміністратори реєстру можуть налаштувати тип автентифікації для Кабінету посадової особи. Платформа дозволяє використовувати [.underline]#власний IIT-віджет# для автентифікації за допомогою КЕП, або налаштувати інтеграцію із [.underline]#зовнішнім провайдером# -- `*id.gov.ua*`. -Registry administrators can configure the desired authentication type for the Officer portal. The platform allows using their [.underline]#own IIT widget# for authenticating with a Qualified Electronic Signature or configuring integration with an external provider *`id.gov.ua`*. +Registry administrators can configure the desired authentication type for the Officer portal. The platform allows using their [.underline]#own IIT widget# for authenticating with a Qualified Electronic Signature or configuring integration with an external xref:platform:ROOT:platform-glossary.adoc#digital-identification-services[digital authentication provider] (in the Ukrainian implementation it is the *`id.gov.ua`* service). [TIP] ==== -//Посилання до офіційних ресурсів: :: + Links to official resources: :: -//* Інститут інформаційних технологій (IIT) -- https://iit.com.ua/ + * Institute of Information Technologies (IIT) -- https://iit.com.ua/ -//* Інтегрована система електронної ідентифікації (ICEI) ID.GOV.UA -- https://id.gov.ua/ * Integrated System of Electronic Identification (ICEI) ID.GOV.UA -- https://id.gov.ua/ ==== -//Одночасно посадові особи реєстру зможуть використовувати лише один тип автентифікації при вході до Кабінету: або КЕП, або `id.gov.ua`. -Registry officers will be able to use only one type of authentication at a time when logging into the Officer portal: either a Qualified Electronic Signature or *`id.gov.ua`*. +Registry officers will be able to use only one type of authentication at a time when logging into the Officer portal: either a Qualified Electronic Signature or a digital identification service. + +[NOTE] +The `*id.gov.ua*` digital identification service is specific to the Ukrainian market and may not apply or function as described in other contexts or regions. +Please consult the local guidelines or documentation if you are implementing this outside of Ukraine. -//== Автентифікація за допомогою віджета IIT == Authenticating with the IIT widget -//. Увійдіть до консолі *Control Plane* як адміністратор реєстру. . Log in to the *Control Plane* console as a registry administrator. + image:admin:infrastructure/cluster-mgmt/update-cluster-mgmt-01.png[] + -//. Перейдіть до розділу [.underline]#Реєстри#, відкрийте необхідний та натисніть `РЕДАГУВАТИ`. + . Go to the *Registries* section, open the necessary registry, and click on *`EDIT`*. + [NOTE] ==== -//Налаштування типу автентифікації для надавачів послуг можливе також під час створення реєстру. + You can also configure authentication type for the officers during the registry creation. ==== + @@ -52,78 +49,76 @@ image:registry-admin/cp-auth-setup-officers/cp-id-gov-ua-iit-setup-01.png[] + image:registry-admin/cp-auth-setup-officers/cp-id-gov-ua-iit-setup-02.png[] + -//. Оберіть секцію [.underline]#Автентифікація надавачів послуг# та виконайте налаштування: + . Select the *Officer authentication* section and perform the following configuration: + -//* [.underline]#Вкажіть тип автентифікації# -- `Віджет`. Цей тип призначений для автентифікації посадових осіб за допомогою КЕП на формі входу до Кабінету. + * [.underline]#Specify the authentication type# as `Widget`. This type is intended for authenticating officers using the Qualified Electronic Signature on the login form of the Officer portal. + -//TIP: `Віджет` є типом автентифікації за замовчуванням. + TIP: `Widget` is the default authentication type. + -//* [.underline]#Додайте посилання до ресурсу із віджетом#. Стандартний IIT-віджет має такий URL: https://eu.iit.com.ua/sign-widget/v20200922/. + * [.underline]#Add a link to the resource with a widget#. The standard IIT widget is at the following URL: https://eu.iit.com.ua/sign-widget/v20200922/. + [NOTE] ==== -//Ви можете використовувати віджет будь-якого провайдера, за іншим посиланням, але в такому разі зверніть увагу на параметр висоти, який конфігурується у наступному полі (_див. нижче_). + You can use a widget from any provider with a different URL, but in that case, pay attention to the height parameter, which can be configured in the next field (_see below_). ==== + -//* Визначте висоту віджета у пікселях, `px`. За замовчуванням параметр становить 720 `px` для віджета IIT. + * Define the widget height in pixels (px). By default, the parameter is set to `*720*` px for the IIT widget. + -//NOTE: Збільште, або зменште висоту за потреби. Наприклад, 1000 `px`. Особливо зверніть на це увагу, якщо використовуєте URL іншого провайдера, щоб віджет КЕП виглядав належним чином у Кабінеті. + NOTE: Increase or decrease the height as needed. For example, *`1000`* px. Pay special attention to this if you use the URL of another provider to ensure the Qualified Electronic Signature widget appears correctly in the Cabinet. + image:registry-admin/cp-auth-setup-officers/cp-id-gov-ua-iit-setup-1.png[] + -//. Натисніть kbd:[Підтвердити], щоб зберегти налаштування. + . Click kbd:[Confirm] to save the configuration. + -//В результаті формується запит на внесення змін до конфігурації реєстру. + This will result in a merge request to the registry configuration. + -//. Поверніться до відомостей про реєстр і знайдіть розділ [.underline]#Запити на оновлення#. + . Go back to the registry details and find the section *Update requests*. + image:registry-admin/cp-auth-setup-officers/cp-id-gov-ua-iit-setup-3.png[] + -//. Відкрийте сформований запит, натиснувши іконку перегляду -- 👁. + . Open the generated request by clicking on the view icon - 👁. + -//NOTE: Запропоновані зміни зберігаються до конфігурації реєстру у файлі *_deploy-templates/values.yaml_* у разі підтвердження. + NOTE: The proposed changes will be saved to the registry configuration in the _deploy-templates/values.yaml_ file upon confirmation. + -//. У новому вікні зіставте 2 версії змін, переконайтеся, що внесені вами дані вірні, та натисніть kbd:[Підтвердити]. Ви також можете відразу відхилити зміни до конфігурації, натиснувши kbd:[Відхилити]. + . In the new window, compare the 2 versions of the changes, make sure the data you entered is correct, and click kbd:[Confirm]. You can also reject the changes to the configuration immediately by clicking kbd:[Reject]. + -//TIP: У вікні для порівняння можна зручно перевірити 2 версії змін: поточну (зліва) та нову (справа). + TIP: The comparison window allows you to conveniently check the current (left) and new (right) versions of the changes. + image:registry-admin/cp-auth-setup-officers/cp-id-gov-ua-iit-setup-5.png[] + [NOTE] ==== -//Одночасно посадові особи реєстру зможуть використовувати лише один тип автентифікації при вході до Кабінету: [.underline]#або КЕП#, [.underline]#або `id.gov.ua`#. + Registry officers will be able to use only one type of authentication at a time when logging into the Officer portal: either a Qualified Electronic Signature or `id.gov.ua`. -//При перемиканні типу автентифікації, параметри для іншого типу лишаються незмінними. Таким чином одночасно [.underline]#може співіснувати 2 конфігурації#, але [.underline]#активною може бути лише одна#. При зміні `browserFlow` надлишкові ресурси у Helm chart видаляються. When switching the authentication type, the parameters for the other type remain unchanged. Thus, [.underline]#two configurations can coexist# at the same time, but [.underline]#only one can be active#. When changing the `browserFlow`, the excessive resources in the Helm chart are deleted. -//У нашому прикладі використовується стандартний `browserFlow` для автентифікації через КЕП -- `*dso-officer-auth-flow*`. In our example, the standard `browserFlow` is used for authentication via Qualified Electronic Signature -- *`dso-officer-auth-flow`*. ==== + -//В результаті запит набуває статусу `Підтверджено`, і запускається Jenkins-пайплайн `*MASTER-Build-*`, де [.underline]#``# -- назва реєстру. Він застосовує параметри заданої конфігурації. + As a result, the request obtains the `Confirmed` status and triggers the Jenkins pipeline *`MASTER-Build-`*, where [.underline]#``# is name of the registry. It applies the parameters of the specified configuration. + -//. Зачекайте, доки виконається збірка коду. Це може зайняти до 15 хвилин. + . Wait while the code is being built. This may take up to 15 minutes. + -//Ви можете перевірити поточний статус та результат виконання за посиланням *`CI`* на інтерфейсі. + You can check the current status and execution result by following the *`CI`* link in the interface. + image:registry-admin/cp-auth-setup-officers/cp-id-gov-ua-iit-setup-6.png[] @@ -133,44 +128,40 @@ image:registry-admin/cp-auth-setup-officers/cp-id-gov-ua-iit-setup-7.png[] image:registry-admin/cp-auth-setup-officers/cp-id-gov-ua-iit-setup-8.png[] + -//В результаті успішного виконання збірки, задана конфігурація буде застосована до реєстру. + Upon successful completion of the build, the specified configuration will be applied to the registry. -//== Автентифікація за допомогою id.gov.ua == Authenticating via the id.gov.ua system -//=== Передумови +include::ROOT:partial$admonitions/ua-specific.adoc[] + === Prerequisites -//. Зареєструйтеся в системі ICEI `id.gov.ua`. + -//Для цього перейдіть за посиланням https://id.gov.ua/connect та укладіть електронний [.underline]#Договір про приєднання до інтегрованої системи електронної ідентифікації#. . Register in the ICEI `id.gov.ua` system. To do this, go to https://id.gov.ua/connect and conclude an electronic agreement on access to the integrated system of electronic identification. + [NOTE] ==== -//Укладання договору та інші супутні юридичні й технічні процедури виконуються на стороні `id.gov.ua` між власником даних (технічним адміністратором реєстру) та ІСЕІ. + The conclusion of the agreement and other related legal and technical procedures are performed on the `id.gov.ua` side between the data owner (_registry technical administrator_) and ICEI. ==== -//. Після реєстрації клієнта (реєстру), отримайте від ICEI ідентифікатор клієнта в системі id.gov.ua (`client_id`) та пароль (`secret`). + . After registering as a client (of the registry), obtain the client identifier in the `id.gov.ua` system (`client_id`) and the password (`secret`) from ICEI. -//. Використовуйте отримані дані при налаштуванні автентифікації з `id.gov.ua` в інтерфейсі *Control Plane*. + . Use the obtained data to configure authentication with `id.gov.ua` in the *Control Plane* interface. -//=== Налаштування === Configuring -//. Увійдіть до консолі *Control Plane* як адміністратор реєстру. . Log in to the *Control Plane* console as the registry administrator. + image:admin:infrastructure/cluster-mgmt/update-cluster-mgmt-01.png[] + -//. Перейдіть до розділу [.underline]#Реєстри#, відкрийте необхідний та натисніть `РЕДАГУВАТИ`. + . Go to the *Registries* section, open the necessary registry, and click *`EDIT`*. + [NOTE] ==== -//Налаштування типу автентифікації для надавачів послуг можливе також під час створення реєстру. + You can also configure authentication type for the officers during the registry creation. ==== + @@ -178,102 +169,97 @@ image:registry-admin/cp-auth-setup-officers/cp-id-gov-ua-iit-setup-01.png[] + image:registry-admin/cp-auth-setup-officers/cp-id-gov-ua-iit-setup-02.png[] + -//. Оберіть секцію [.underline]#Автентифікація надавачів послуг# та виконайте налаштування: + . Select the *Officer authentication* section and perform the following settings: + -//* [.underline]#Вкажіть тип автентифікації# -- `*id.gov.ua*`. Цей тип призначений для автентифікації посадових осіб за допомогою зовнішнього провайдера на формі входу до Кабінету. + * [.underline]#Specify the authentication type# as *`id.gov.ua`*. This type is intended for authenticating officers using an external provider on the Officer portal login form. + -//* [.underline]#Додайте посилання до ресурсу#. Наприклад, URL може виглядати так: https://test.id.gov.ua?auth_type=dig_sign. + * [.underline]#Add a link to the resource#. For example, the URL may look like this: https://test.id.gov.ua?auth_type=dig_sign. + [IMPORTANT] ==== -//У query-параметрах запита (в URL після `*?*`) необхідно визначити доступні для посадової особи типи автентифікації через `id.gov.ua`. + In the request's query parameters (in the URL after *`?`*), specify the authentication types available for the official through `id.gov.ua`. -//Можливі значення для параметра `auth_type`: Possible values for the `auth_type` parameter: -//* *`dig_sign`* -- автентифікація з цифровим підписом; -//* *`bank_id`* -- автентифікація через `BankID`; -//* *`diia_id`* -- автентифікація через `Дія.Підпис`. + + * *`dig_sign`* - authentication with a Qualified Electronic Signature (_digital signature_); * *`bank_id`* - authentication via `BankID`; * *`diia_id`* - authentication via `Diia.Sign`. -//TODO: ua-specific items above -//❗ Вкажіть лише *`auth_type=dig_sign`*, як це показано на прикладі. + -//Це обумовлено тим, що методи `BankID` та `Дія.Підпис` не передають параметр `edrpou`, що необхідно для успішної автентифікації посадової особи в системі. Інші параметри, які потрібні для вдалої автентифікації посадової особи -- `drfo` та `fullName` (детальніше -- див. xref:user:citizen-officer-portal-auth.adoc[]) + + ❗ Specify only *`auth_type=dig_sign`*, as shown in the example. This is due to the fact that the `BankID` and `Diia.Sign` methods do not pass the `edrpou` parameter, which is necessary for successful authentication of the official in the system. Other parameters required for successful official authentication - `drfo` and `fullName` (see xref:user:citizen-officer-portal-auth.adoc[] for more details). -//TODO: ua-specific items above + ==== + -//* [.underline]#Вкажіть ідентифікатор клієнта (`client_id`)#, отриманий в системі `id.gov.ua`. Наприклад, `17f33242543e4340b690391d6f1d1513`. + * [.underline]#Specify the client identifier (`client_id`)# obtained in the `id.gov.ua` system. For example, *`17f33242543e4340b690391d6f1d1513`*. + [TIP] ==== -//Ідентифікатор клієнта в системі id.gov.ua подібний до формату https://www.uuidgenerator.net/[UUID], але визначається без тире (`-`) між символами. + The client identifier in the `id.gov.ua` system is similar to the https://www.uuidgenerator.net/[UUID] format but without the hyphens (`-`) between characters. ==== + -//* [.underline]#Вкажіть клієнтський секрет (`secret`)#, отриманий в системі `id.gov.ua`. + * [.underline]#Specify the client secret (`secret`)# obtained from the `id.gov.ua` system. + -//TIP: Це може бути будь-який випадково згенерований пароль у системі id.gov.ua. + TIP: This can be any randomly generated password in the `id.gov.ua` system. + image:registry-admin/cp-auth-setup-officers/cp-id-gov-ua-iit-setup-2.png[] + -//. Натисніть kbd:[Підтвердити], щоб зберегти налаштування. + . Click kbd:[Confirm] to save the settings. + -//В результаті формується запит на внесення змін до конфігурації реєстру. + This will result in a merge request to the registry configuration. + -//. Поверніться до відомостей про реєстр і знайдіть розділ [.underline]#Запити на оновлення#. -. Go back to the registry details and find the section *Update requests* section. + +. Go back to the registry details and find the *Update requests* section. + image:registry-admin/cp-auth-setup-officers/cp-id-gov-ua-iit-setup-3.png[] + -//. Відкрийте сформований запит, натиснувши іконку перегляду -- 👁. -. Open the generated request by clicking the view icon - 👁. + +. Open the generated request by clicking the view icon—👁. + -//NOTE: Запропоновані зміни зберігаються до конфігурації реєстру у файлі *_deploy-templates/values.yaml_* у разі підтвердження. + NOTE: The proposed changes are saved to the registry configuration in the _deploy-templates/values.yaml_ file upon confirmation. + -//. У новому вікні зіставте 2 версії змін, переконайтеся, що внесені вами дані вірні, та натисніть kbd:[Підтвердити]. Ви також можете відразу відхилити зміни до конфігурації, натиснувши kbd:[Відхилити]. + . In the new window, compare the two versions of the changes, make sure the data you entered is correct, and click kbd:[Confirm]. You can also reject the changes to the configuration immediately by clicking kbd:[Reject]. + -//TIP: У вікні для порівняння можна зручно перевірити 2 версії змін: поточну (зліва) та нову (справа). + TIP: The comparison window allows you to conveniently check the current (left) and new (right) versions of the changes. + image:registry-admin/cp-auth-setup-officers/cp-id-gov-ua-iit-setup-4.png[] + [NOTE] ==== -//Одночасно посадові особи реєстру зможуть використовувати лише один тип автентифікації при вході до Кабінету: [.underline]#або КЕП#, [.underline]#або `id.gov.ua`#. + Registry officers will be able to use only one type of authentication at a time when logging into the Officer portal: either a Qualified Electronic Signature or `id.gov.ua`. -//При перемиканні типу автентифікації, параметри для іншого типу лишаються незмінними. Таким чином одночасно [.underline]#може співіснувати 2 конфігурації#, але [.underline]#активною може бути лише одна#. При зміні `browserFlow` надлишкові ресурси у Helm chart видаляються. When switching the authentication type, the parameters for the other type remain unchanged. Thus, [.underline]#two configurations can coexist# at the same time, but [.underline]#only one can be active#. When changing the `browserFlow`, the excessive resources in the Helm chart are deleted. -//У нашому прикладі використовується `browserFlow` для автентифікації із переадресацією до зовнішнього провайдера -- `*id-gov-ua-officer-redirector*`. In our example, `browserFlow` is used for authentication with redirection to an external provider -- the *`id-gov-ua-officer-redirector`*. ==== + -//В результаті запит набуває статусу `Підтверджено`, і запускається Jenkins-пайплайн `*MASTER-Build-*`, де [.underline]#``# -- назва реєстру. Він застосовує параметри заданої конфігурації. + As a result, the request obtains the `Confirmed` status and triggers the Jenkins pipeline *`MASTER-Build-`*, where [.underline]#``# is name of the registry. It applies the parameters of the specified configuration. + -//. Зачекайте, доки виконається збірка коду. Це може зайняти до 15 хвилин. + . Wait while the code is being built. This may take up to 15 minutes. + -//Ви можете перевірити поточний статус та результат виконання за посиланням *`CI`* на інтерфейсі. + You can check the current status and execution result by following the *`CI`* link in the interface. + image:registry-admin/cp-auth-setup-officers/cp-id-gov-ua-iit-setup-6.png[] @@ -283,15 +269,9 @@ image:registry-admin/cp-auth-setup-officers/cp-id-gov-ua-iit-setup-7.png[] image:registry-admin/cp-auth-setup-officers/cp-id-gov-ua-iit-setup-8.png[] + -//В результаті успішного виконання збірки, задана конфігурація буде застосована до реєстру. + Upon successful completion of the build, the specified configuration will be applied to the registry. -//== Пов'язані сторінки == Related pages * xref:user:citizen-officer-portal-auth.adoc[] - -//== Додаткові відеоматеріали -== Additional video materials - -video::QJ83n3lhyE4[youtube, width=680, height=380] diff --git a/docs/en/modules/registry-develop/pages/registry-admin/cp-auth-setup/cp-auth-setup-overview.adoc b/docs/en/modules/registry-develop/pages/registry-admin/cp-auth-setup/cp-auth-setup-overview.adoc index 451ad5e455..e401fc9db8 100644 --- a/docs/en/modules/registry-develop/pages/registry-admin/cp-auth-setup/cp-auth-setup-overview.adoc +++ b/docs/en/modules/registry-develop/pages/registry-admin/cp-auth-setup/cp-auth-setup-overview.adoc @@ -1,37 +1,28 @@ -//= Налаштування автентифікації користувачів = Configuring user authentication -//Цей розділ описує процес налаштування автентифікації для двох ключових груп користувачів: _посадових осіб_ (_надавачів послуг_) та _отримувачів послуг_. Всі налаштування виконуються через консоль *Control Plane*, яка надає зручний єдиний інтерфейс для основних конфігурацій реєстру. This section describes the process of configuring user authentication for two key user groups: *officers* (_service providers_) and *citizens* (_service recipients_). All configurations are performed through the *Control Plane* console, which provides a convenient unified interface for basic registry configurations. -//Платформа дозволяє адміністраторам налаштувати тип автентифікації для Кабінету посадової особи, використовуючи власний IIT-віджет для аутентифікації за допомогою _КЕП_ або інтегруючись із зовнішнім провайдером, таким як _ID.GOV.UA_ (ICEI). В результаті, посадові особи реєстру зможуть використовувати один з двох типів автентифікації при вході до Кабінету: або КЕП, або ID.GOV.UA. The platform allows administrators to configure the authentication type for the Officer portal by using their own IIT widget for authentication with the Qualified Electronic Signature (_QES_) or by integrating with an external provider such as ID.GOV.UA (_ICEI_). As a result, officials of the registry will be able to use one of two authentication types when accessing the Cabinet: either QES or ID.GOV.UA. -//// Щодо отримувачів послуг, система передбачає можливість налаштування перевірки наявності активного запису в ЄДР для бізнес-користувачів. Такий механізм забезпечує зв'язок між КЕП користувача та їх юридичною особою чи фізичною особою-підприємцем, зареєстрованими в Єдиному державному реєстрі (ЄДР). Він відіграє важливу роль у забезпеченні відповідності даних користувача та підтвердження їх особистості, що є важливим аспектом безпеки та надійності системи. -//// -//Крім того, платформа надає можливість налаштування самореєстрації для посадових осіб. Це спрощує процес реєстрації користувачів, оскільки не вимагає залучення адміністратора. Завдяки такому підходу, посадові особи можуть самостійно реєструватися, що оптимізує роботу адміністраторів та покращує загальний досвід користувачів. + Additionally, the platform provides the ability to configure self-registration for officers. This simplifies the user registration process as it does not require administrator involvement. With this approach, officers can register themselves, optimizing the work of administrators and improving the overall user experience. -//== Огляд секції == Section overview [%collapsible] -//.+++ Надавачі послуг +++ + .*Officers* ==== * xref:registry-admin/cp-auth-setup/cp-auth-setup-officers.adoc[] * xref:registry-admin/cp-auth-setup/cp-officer-self-registration.adoc[] ==== - - - - //// [%collapsible] .+++Отримувачі послуг +++ ==== * xref:registry-admin/cp-auth-setup/cp-auth-setup-citizens.adoc[] -==== \ No newline at end of file +==== +//// \ No newline at end of file diff --git a/docs/en/modules/registry-develop/pages/registry-admin/cp-auth-setup/cp-officer-self-registration.adoc b/docs/en/modules/registry-develop/pages/registry-admin/cp-auth-setup/cp-officer-self-registration.adoc index ab8f8825d8..6cccfa2366 100644 --- a/docs/en/modules/registry-develop/pages/registry-admin/cp-auth-setup/cp-officer-self-registration.adoc +++ b/docs/en/modules/registry-develop/pages/registry-admin/cp-auth-setup/cp-officer-self-registration.adoc @@ -1,105 +1,67 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - -//= Налаштування автореєстрації для посадових осіб = Configuring self-registration for officers +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] + +include::platform:ROOT:partial$admonitions/language-en.adoc[] -//== Загальний опис == General description -//Платформа надає можливість налаштування самореєстрації для посадових осіб, що спрощує процес реєстрації користувачів без необхідності залучення адміністратора. The platform provides the ability to configure self-registration for officers, simplifying the registration process for users without the need for administrator involvement. image:registry-admin/cp-auth-setup-officers/self-registration/cp-officer-self-register-1.png[] -//Це створює ряд переваг для організацій та користувачів: :: This creates several advantages for organizations and users: :: -//* Ефективність: зменшує час та зусилля адміністраторів на створення облікових записів для нових користувачів, особливо у реєстрах із великою кількістю користувачів. * Efficiency: reduces the time and effort administrators spend on creating user accounts, especially in registries with a large number of users. -+ -//* Самостійність користувачів: надає користувачам можливість самостійно створювати обліковий запис в системі без додаткової допомоги адміністратора. + * User autonomy: allows users to create their own accounts in the system without additional assistance from the administrator. -+ -//* Зменшення помилок: Процес самореєстрації зазвичай передбачає перевірку введених користувачами даних, що зменшує ймовірність помилок адміністратора при створенні облікових записів. + * Reduced errors: The self-registration process typically involves verifying the data entered by users, reducing the likelihood of administrator errors when creating user accounts. -+ -//* Економія часу: Завдяки самореєстрації, користувачі можуть швидко отримати доступ до системи та почати використовувати її функціональність без очікування на затвердження адміністратора. + * Time savings: With self-registration, users can quickly access the system and start using its functionality without waiting for administrator approval. -//== Налаштування == Setting up self-registration for officers -//Адміністратори реєстру можуть налаштувати самореєстрацію для посадових осіб через адміністративну панель *Control Plane*, у розділі +++ Реєстри +++ > +++Автентифікація надавачів послуг +++. Registry administrators can configure self-registration for officers through the *Control Plane* administrative panel, in the *Registries* > *Officer authentication* section. -//У разі ввімкнення, посадові особи можуть автоматично реєструватись в системі управління користувачами та доступом *Keycloak*. При цьому, при першому вході користувача до Кабінету, його обліковий запис створюється із _системною роллю_ *`unregistered-officer`*, а користувач автоматично перенаправляється на бізнес-процес самореєстрації. When enabled, officers can automatically register in *Keycloak* -- the system for user and access management. Upon the user's first login to the Officer portal, their account is created with the system role `unregistered-officer` assigned, and the user is automatically redirected to the self-registration business process. -//NOTE: Не рекомендовано надавати доступ для ролі *`unregistered-officer`* до жодних бізнес-процесів, крім одного з процесів самореєстрації, в авторизаційному файлі регламенту _bp-auth/officer.yml_. -NOTE: It is not recommended to grant the `unregistered-officer` role access to any business processes except for self-registration in the registry authorization file _file bp-auth/officer.yml_. +NOTE: It is not recommended to grant the `unregistered-officer` role access to any business processes except for self-registration in the registry authorization file _bp-auth/officer.yml_. -//У разі вимкнення самореєстрації, автентифікація посадових осіб відбувається за стандартним процесом, де користувачів необхідно спочатку створити в системі управління користувачами (_детальніше про це див. у розділі When self-registration is disabled, authentication for officers follows the standard process, where users need to be initially created in the user management system (see xref:registry-admin/create-users/overview.adoc[] for more details). -//Щоб вимкнути або увімкнути налаштування, виконайте наступні кроки: :: To enable or disable self-registration for officers, follow these steps: :: -//. Увійдіть до адміністративної панелі *Control Plane*. . Log in to the *Control Plane* administrative panel. -//. Перейдіть до розділу +++ Реєстри +++ > +++ Редагувати +++ > +++Автентифікація отримувачів послуг +++. . Go to the *Registries* > *Edit* > *Citizen authentication* section. -//. Вимкніть або увімкніть перемикач, щоб дозволити або заборонити самостійну реєстрацію. . Toggle the switch to allow or disallow self-registration. + -//NOTE: При вимкненні можливості, користувачі, які почали процес самореєстрації, не зможуть виконати свої задачі, якщо вони змодельовані. NOTE: When the ability is turned off, users who have started the self-registration process will not be able to complete their tasks if they are modeled. + image:registry-admin/cp-auth-setup-officers/self-registration/cp-officer-self-register-1.png[] + [NOTE] ==== -//Самостійна реєстрація користувачів передбачає наявність у реєстрі попередньо змодельованого бізнес-процесу самореєстрації. User self-registration requires that a pre-modeled self-registration business process is already created in the registry. -//Детальніше про це -- див. на сторінках: -//* xref:best-practices/bp-officer-self-register-auto.adoc[] -//* xref:best-practices/bp-officer-self-register-manual.adoc[] - -//TODO: the above files do not resolve since they are not created in the En version For now I commented the above 3 lines. What do we do in such cases? +For more details see xref:best-practices/bp-officer-self-register-manual.adoc[]. ==== -+ -//. Натисніть кнопку kbd:[Підтвердити], щоб зберегти зміни. + . Click the kbd:[Confirm] button to save the changes. + -//У результаті система сформує запит на оновлення конфігурації реєстру, який необхідно підтвердити. This will result in a merge request to the registry configuration, which needs to be confirmed. -+ -//. Поверніться до розділу +++ Реєстри +++ > +++ Запити на оновлення +++ та перегляньте новий запит, натиснувши іконку перегляду -- 👁. + . Go back to the *Registries* > *Update Requests* section and review the new request by clicking the "View" icon -- 👁. + image::admin:registry-management/cp-cidr/cp-cidr-8.png[] -+ -//. У новому вікні перегляньте зміни та натисніть kbd:[Підтвердити]. + . In the new window, review the changes and click kbd:[Confirm]. + -//NOTE: Запропоновані зміни вносяться до конфігурації реєстру у файлі _deploy-templates/values.yaml_ у разі підтвердження. NOTE: The proposed changes will be applied to the registry configuration in the _deploy-templates/values.yaml_ file upon confirmation. + -//Налаштування регулюється параметром *`keycloak.officerPortal.selfRegistration`*, який може приймати 2 значення: `true` або `false`. The setting is controlled by the *`keycloak.officerPortal.selfRegistration`* parameter, which can be set to either `*true*` or `*false*`. + -//.Налаштування selfRegistration: true у файлі deploy-templates/values.yaml -.Example 1. Setting *`selfRegistration`* to *`true`* in the _deploy-templates/values.yaml_ file: -keycloak: +.Example 1. Setting *`selfRegistration`* to *`true`* in the _deploy-templates/values.yaml_ file ==== [source,yaml] ---- @@ -110,17 +72,13 @@ keycloak: selfRegistration: true ---- ==== ++ +. Wait for Jenkins to apply the configuration using the `MASTER-Build-` pipeline. This may take a few minutes. -//Дочекайтеся, доки Jenkins виконає застосування конфігурації за допомогою пайплайну `MASTER-Build-<назва-реєстру>`. Це може зайняти декілька хвилин. -Wait for Jenkins to apply the configuration using the `MASTER-Build-` pipeline. This may take a few minutes. - -//== Особливості автентифікації при вході до Кабінету == Authenticating upon logging into the Officer portal -//Посадові особи можуть після автентифікації у Кабінеті автоматично розпочати процес самореєстрації, якщо він попередньо змодельований у реєстрі та увімкнена автореєстрація для цього реєстру. Officers can automatically start the self-registration process after logging into the portal if the self-registration business process has been pre-modeled in the registry and self-registration is enabled for that registry. -//Після завершення реєстрації, система перенаправляє користувача на сторінку для повторного логіну з уже виданою роллю *`officer`*. Після цього посадова особа матиме доступ до послуг, доступних у реєстрі. After completing the registration, the system redirects the user to the login page, this time with the `officer` role assigned. After the login the officer will have access to the services available in the registry. image:release-notes:wn-1-9-4/whats-new-1-9-4-11.png[] diff --git a/docs/en/modules/registry-develop/pages/registry-admin/cp-deploy-consent-data.adoc b/docs/en/modules/registry-develop/pages/registry-admin/cp-deploy-consent-data.adoc index ed38740c85..f70d0c6971 100644 --- a/docs/en/modules/registry-develop/pages/registry-admin/cp-deploy-consent-data.adoc +++ b/docs/en/modules/registry-develop/pages/registry-admin/cp-deploy-consent-data.adoc @@ -3,57 +3,44 @@ include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc include::platform:ROOT:partial$admonitions/language-en.adoc[] -//Ви маєте змогу розгорнути демо-реєстр на Платформі з референтними прикладами моделювання регламенту. Структура такого регламенту аналогічна структурі типового регламенту, який використовується для будь-якого реєстру, розгорнутого на Платформі. You can deploy a demo-registry with reference examples of a registry regulations modeling. The structure of such regulations is the same as the typical regulations structure, used for any registry deployed on the Platform. -//Регламент демо-реєстру включає референтні приклади, які позначені префіксом *`reference-`*, та приклади для тестування, позначені префіксом *`feature-`*. Це можуть бути зразки _.bpmn_-схем бізнес-процесів, _.json_-форм для внесення даних до процесів, а також _.xml_-схем для розгортання моделі даних реєстру тощо. -Regulations of the demo-registry includes reference examples marked with the *`reference-`* prefix, and testing examples marked with *`feature-`* prefix. They can be examples of _.bpmn_- business process schemes, _.json_-forms for process data, _.xml_-schemes for the deployment of registry data models, and other file types. +Regulations of the demo-registry includes reference examples marked with the *`reference-`* prefix, and testing examples marked with *`feature-`* prefix. They can be examples of _.bpmn_ business process schemes, _.json_-forms for process data, _.xml_-schemes for the deployment of registry data models, and other file types. -//Важливо відзначити, що ці референтні приклади, а також інші зразки, розроблені фахівцями core-команди Платформи. Вони регулярно оновлюються і поповнюються з кожним новим релізом. Це надає можливість бути в курсі останніх тенденцій та практик при моделюванні власного регламенту, експериментувати та тестувати різні сценарії у контрольованих умовах. It's important to remark that these reference examples, as well as other examples, were developed by specialists from the core-team of the Platform. Existing ones are continuously updated, and new ones are added with every release. This approach allows you stay updated on the latest tendencies and practices of regulations modelling, experiment and test different scenarios in controlled environments. -//== Розгортання демо-реєстру та регламенту == Deployment of demo-registry and regulations -//Щоб розгорнути демо реєстр та скопіювати регламент із готовими зразками, виконайте наступні кроки: To deploy a demo-registry and copy regulations with ready examples, take the following steps: -//. Створіть новий реєстр *`demo`* відповідно до інструкції на сторінці xref:admin:registry-management/control-plane-create-registry.adoc[]. -. Create a new *'demo''* registry according to the instructions on the followig page: xref:admin:registry-management/control-plane-create-registry.adoc[]. -//. Увійдіть до консолі *OpenShift* > *Home* > *Projects* та знайдіть проєкт *`control-plane`*. +. Create a new *"demo"* registry according to the instructions on the followig page: xref:admin:registry-management/control-plane-create-registry.adoc[]. + . Navigate to the *OpenShift* > *Home* > *Projects* console and find *`control-plane`* project. + -//Відкрийте розділ *Networking* > *Routes* та перейдіть за посиланням до компонента *`control-plane-console`*. Open *Networking* > *Routes* section and follow the link to *`control-plane-console`* component. + image:registry-admin/cp-deploy-consent-data/cp-deploy-consent-data-1.png[] -//. Відкрийте консоль *Control Plane* > +++Дашборд+++ та перейдіть за посиланням до центрального компонента *Gerrit*. -. Navigate to *Control Plane* > +++Dashboard+++ console and follow the link to *Gerrit* central component. +. Navigate to *Control Plane* > *Dashboard* console and follow the link to *Gerrit* central component. + image::admin:registry-management/control-plane-overview.png[] -//. Перейдіть до налаштувань облікового запису Gerrit та знайдіть розділ *HTTP Credentials*. . Navigate to Gerrit account configuration and find *HTTP Credentials* section. + image:registry-admin/cp-deploy-consent-data/cp-deploy-consent-data-2.png[] -//. Згенеруйте новий HTTP-пароль та скопіюйте його до блокнота. . Generate a new HTTP-password and copy it to Notepad. + image:registry-admin/cp-deploy-consent-data/cp-deploy-consent-data-2-1.png[] + -//NOTE: Цей HTTP-пароль надалі потрібен для автентифікації при клонуванні Gerrit-репозиторію _consent-data_. NOTE: This HTTP-password is needed further for authentification in order to clone the _consent-data_ Gerrit-repository. -//. Відкрийте вкладку *Browse* > *Repositories* та у полі *Filter* знайдіть репозиторій *_consent-data_.* . Open *Browse* > *Repositories* tab and find *_consent-data_* in the *Filter* field. + image:registry-admin/cp-deploy-consent-data/cp-deploy-consent-data-3.png[] -//. Клонуйте репозиторій *_consent-data_* на локальну машину. Зробити це можна наступним чином: . Clone the *_consent-data_* repository to your local machine the following way: -//* Оберіть вкладку Anonymous HTTP (_за замовчуванням_) та скопіюйте команду Clone with commit-msg hook. + * Select the Anonymous HTTP tab (_by default_) and copy the `Clone with commit-msg hook` command. + image:registry-admin/cp-deploy-consent-data/cp-deploy-consent-data-4.png[] @@ -61,120 +48,90 @@ image:registry-admin/cp-deploy-consent-data/cp-deploy-consent-data-4.png[] [IMPORTANT] ==== [%collapsible] -//.Обов'язково клонуйте репозиторій із опцією `commit-msg hook`. + .It is imperative to use `commit-msg hook` option when cloning the repository. ===== -//Один з ключових елементів Gerrit -- це використання "hooks" (або "гуків"). Hooks -- це скрипти, які виконуються перед або після певних подій у Git, наприклад, перед `git commit` або `git push`. One of the key elements of Gerrit is using "hooks". Hooks are scripts that are executed before or after particular Git events, like `git commit` or `git push`. -//Команда *Clone with commit-msg hook* у Gerrit дозволяє клонувати репозиторій і автоматично додає спеціальний `commit-msg hook` до локального репозиторію. Цей hook автоматично генерує унікальний *Change-Id* для кожного нового коміту. *Change-Id* використовується Gerrit для слідкування за різними версіями зміни. *Clone with commit-msg hook* command in Gerrit allows you to clone a repository while automatically adding a special `commit-msg hook` to the local repository. This hook automatically generates a unique *Change-Id* for every new commit. Gerrit uses *Change-Id* to monitor different versions of the change. ===== ==== -//* Відкрийте https://git-scm.com/downloads[Git Bash] та перейдіть до бажаної директорії, куди потрібно скопіювати _consent-data_: * Open https://git-scm.com/downloads[Git Bash] and navigate to the directory where you need to copy _consent-data_: + -//.Перехід до цільової директорії .Navigation to the target directory [source,bash] -//---- -//cd <шлях/до/вашої/локальної/директорії> -//---- ---- cd ---- -//* Вставте скопійовану команду *Clone with commit-msg hook* та натисніть kbd:[Enter]. + * Paste the copied *Clone with commit-msg hook* command *Clone with commit-msg hook* and press kbd:[Enter]. + image:registry-admin/cp-deploy-consent-data/cp-deploy-consent-data-5.png[] + -//Зачекайте, доки репозиторій буде остаточно клоновано. Wait until the repository is completely cloned. + image:registry-admin/cp-deploy-consent-data/cp-deploy-consent-data-6.png[] -//. Увійдіть до консолі *OpenShift* > *Home* > *Projects* та знайдіть проєкт зі створеним демо-реєстром *`demo`*. . Navigate to the *OpenShift* > *Home* > *Projects* console and find the project with the created *`demo`* demo-registry. + -//Відкрийте розділ *Networking* > *Routes* та перейдіть за посиланням до компонента *Gerrit* реєстру. Open the *Networking* > *Routes* section and follow the link to the registry *Gerrit* component. + image:registry-admin/cp-deploy-consent-data/cp-deploy-consent-data-7.png[] -//. Перейдіть до налаштувань облікового запису Gerrit та знайдіть розділ *HTTP Credentials*. . Navigate to Gerrit account configuration and find *HTTP Credentials* section. + image:registry-admin/cp-deploy-consent-data/cp-deploy-consent-data-2.png[] -//. Згенеруйте новий HTTP-пароль та скопіюйте його до блокнота. . Generate a new HTTP-password and copy it to Notepad. + image:registry-admin/cp-deploy-consent-data/cp-deploy-consent-data-2-1.png[] + -//NOTE: Цей HTTP-пароль надалі потрібен для автентифікації при клонуванні та подальшій взаємодії із Gerrit-репозиторієм, що містить регламент _registry-regulations_. NOTE: This HTTP-password is needed further for authentification in order to clone and interact with the Gerrit-repository that includes _registry-regulations_ regulations. -//. Відкрийте вкладку Browse > Repositories та у полі Filter знайдіть репозиторій *_registry-regulations_.* + . Open *Browse* > *Repositories* tab and find *_registry-regulations_* in the *Filter* field. + -//NOTE: Після розгортання реєстру, Gerrit міститиме порожній регламент _registry-regulations_. Його необхідно наповнити. NOTE: After deploying the registry, Gerrit will have empty regulations _registry-regulations_. You need to fill it in. -//. Клонуйте репозиторій *_registry-regulations_* на локальну машину. Зробити це можна наступним чином: . Clone the *_registry-regulations_* repository to your local machine the following way: -//* Оберіть вкладку Anonymous HTTP (_за замовчуванням_) та скопіюйте команду Clone with commit-msg hook. * Select the Anonymous HTTP tab (_by default_) and copy the `Clone with commit-msg hook` command. + [IMPORTANT] ==== [%collapsible] -//.Обов'язково клонуйте репозиторій із опцією `commit-msg hook`. + .It is imperative to use `commit-msg hook` option when cloning the repository. ===== -//Один з ключових елементів Gerrit -- це використання "hooks" (або "гуків"). Hooks -- це скрипти, які виконуються перед або після певних подій у Git, наприклад, перед `git commit` або `git push`. One of the key elements of Gerrit is using "hooks". Hooks are scripts that are executed before or after particular Git events, like `git commit` or `git push`. -//Команда *Clone with commit-msg hook* у Gerrit дозволяє клонувати репозиторій і автоматично додає спеціальний `commit-msg hook` до локального репозиторію. Цей hook автоматично генерує унікальний *Change-Id* для кожного нового коміту. *Change-Id* використовується Gerrit для слідкування за різними версіями зміни. *Clone with commit-msg hook* command in Gerrit allows you to clone a repository while automatically adding a special `commit-msg hook` to the local repository. This hook automatically generates a unique *Change-Id* for every new commit. Gerrit uses *Change-Id* to monitor different versions of the change. ===== ==== -//* Відкрийте https://git-scm.com/downloads[Git Bash] та перейдіть до бажаної директорії, куди потрібно скопіювати _consent-data_: * Open https://git-scm.com/downloads[Git Bash] and navigate to the directory where you need to copy _consent-data_: + -//.Перехід до цільової директорії .Navigation to the target directory [source,bash] -//---- -//cd <шлях/до/вашої/локальної/директорії> -//---- ---- cd ---- -//* Вставте скопійовану команду *Clone with commit-msg hook* та натисніть kbd:[Enter]. + * Paste the copied *Clone with commit-msg hook* command *Clone with commit-msg hook* and press kbd:[Enter]. + -//Зачекайте, доки репозиторій буде остаточно клоновано. Wait until the repository is completely cloned. -//. На локальній машині скопіюйте вміст репозиторію _consent-data_ та вставте його із заміною до _registry-regulations_. -On the local machine copy the contents of _consent-data_ repository, and then paste (replacing original files) it to _registry-regulations_. +. On the local machine copy the contents of _consent-data_ repository, and then paste (replacing original files) it to _registry-regulations_. + -//IMPORTANT: Обов'язково перенесіть вміст репозиторію _consent-data_ без системної теки _.git_. IMPORTANT: Be sure to move the contents of _consent-data_ repository without _.git_ system directory. + -//WARNING: Якщо демо-реєстр не передбачає налаштувань підключення до "Дії", то для успішного розгортання регламенту необхідно видалити теку *_diia_* із репозиторію _registry-regulations_, яка знаходиться за шляхом: _./notifications/diia_. WARNING: If the demo-registry is not expected to be configured for connection to "Diia", then it is important to delete *_diia_* directory from the _registry-regulations_ repository, which can be found via the following path: _./notifications/diia_. Otherwise, regulations deployment will fail. -//. Опублікуйте зміни у регламенті демо-реєстру. Після публікації, сутності регламенту, як-от модель даних, бізнес-процеси, форми тощо стануть доступними для використання у Кабінетах користувачів, зокрема у Кабінеті адміністратора регламентів (`admin-portal`), посадової особи (`officer-portal`) та отримувача послуг (`citizen-portal`). . Publish the changes in demo-registry regulations. Regulations entities like data model, business process or forms will become available for use in user portals after publishing, including Regulations administrator portal (`admin-portal`), officer portal (`officer-portal`) and citizen portal (`citizen-portal`). + -//TIP: На цьому кроці вам необхідно наповнити регламент _registry-regulations_ онлайн-репозиторію Gerrit реєстру. TIP: Fill in the regulations in _registry-regulations_ Gerrit online-repository of the registry on this step. -//* Підготуйте `commit` зі змінами до _registry-regulations_ та відправте його до репозиторію. Для цього виконайте по черзі наступні команди у Git Bash-терміналі: * Prepare `commit` with the changes to _registry-regulations_ and send it to the repository. To do this, execute commands in Git Bash terminal in the following order: + [source,bash] @@ -182,7 +139,6 @@ TIP: Fill in the regulations in _registry-regulations_ Gerrit online-repository git add --all ---- + -//Ця команда додає всі нові, змінені або видалені файли в поточному каталозі та його підкаталогах до індексу (`stage`) для наступного коміту. Тобто, вона готує всі зміни у проєкті до виконання команди `git commit`. This command adds all the new, changed or deleted files in the current catalog and subcatalogs to the `stage` index for subsequent commit. Basically, it prepares all the changes on the project to `git commit` command. + [source,bash] @@ -190,148 +146,78 @@ This command adds all the new, changed or deleted files in the current catalog a git commit -m "added demo registry data" ---- + -//Команда `git commit` створює новий коміт зі змінами, які були попередньо додані до індексу за допомогою команди `git add`. Опція `-m` дозволяє додати коротке повідомлення до коміту, яке описує виконані зміни. У нашому випадку повідомлення буде таке: `"added demo registry data"`. `Git commit` command creates a new commit with the changes previously added to the index with `git add` command. The `-m` option allows you to add a short message to the commit in order to describe the changes made. In this case, the message is: `"added demo registry data"`. -+ -//. Після відправки змін, перейдіть за посиланням до Gerrit, яке з'явиться у терміналі. -After sending the changes, follow the link to Gerrit that will appear in the terminal. + +. After sending the changes, follow the link to Gerrit that will appear in the terminal. + [TIP] ==== -//Шлях до реєстрового Gerrit буде таким: The path to registry Gerrit will be as follows: ---- https://admin-tools-./gerrit ---- - -//* `` -- назва вашого реєстру (_тут_ -- `demo`). -//* `` -- назва середовища в OpenShift, в якому розгорнуто реєстр. * `` -- name of the new registry (_in this case_ -- `demo`). * `` -- name of OpenShift environment where the registry is deployed. ==== -//. Зачекайте, доки виконається системний пайплайн перевірки коду -- `MASTER-Code-review-registry-regulations`. Перевірити прогрес можна за посиланням внизу сторінки у Gerrit. + . Wait until `MASTER-Code-review-registry-regulations` code check system pipeline is executed. You can check the progress by following the corresponding link at the bottom of the page in Gerrit. + -//У результаті успішної перевірки, ваш запит на внесення змін отримає статус `VERIFIED +1`. ++ As a result of a successful check, your change request will get `VERIFIED +1` status. -//. Підтвердьте внесення змін натисканням кнопки *`CODE-REVIEW+2`* як модератор. . Confirm the application of changes as moderator by clicking *`CODE-REVIEW+2`* button. + image:registry-admin/cp-deploy-consent-data/cp-deploy-consent-data-10.png[] -//. Застосуйте зміни до `master`-гілки репозиторію з регламентом натисканням кнопки *`SUBMIT`*, тобто виконайте `git merge` змін. . Apply the changes to the `master` branch of the repository that contains regulations, by clicking *`SUBMIT`*, which will execute `git merge` of the changes. + -//У результаті запускається автоматична публікація регламенту пайплайном `MASTER-Build-registry-regulations`. Перевірити прогрес розгортання можна за посиланням внизу сторінки у Gerrit. + As a result, `MASTER-Build-registry-regulations` pipeline automatically publishes the regulations. You can check the progress by following the corresponding link at the bottom of the page in Gerrit. + -//Після успішної публікації, у регламенті демо-реєстру будуть доступні референтні приклади, помічені префіксом *`reference-`* та приклади для тестування, помічені префіксом *`feature-`*. After successful publication, reference examples marked with *`reference-`* prefix, and testing examples marked with *`feature-`* prefix will become available in the demo-registry regulations. -//. Перейдіть до Кабінету адміністратора регламентів та перевірте наявність бізнес-процесів, UI-форм тощо. Службова назва референтних прикладів міститиме префікс *`reference-`*. -. Navigate to the regulations administrator portal and check if entities like business processes and UI-forms are available. The service name of reference examples will contain the *`reference-`* prefix. +. Navigate to the Administrative portal and check if entities like business processes and UI-forms are available. The service name of reference examples will contain the *`reference-`* prefix. + -//TIP: Адміністративний портал доступний за посиланням: https://admin-tools-.[]. -TIP: Administrator portal is accessed via the following link: https://admin-tools-.[]. +TIP: The Administrator portal is accessed via the following link: https://admin-tools-.[]. + image:registry-admin/cp-deploy-consent-data/cp-deploy-consent-data-11.png[] + -//Ці ж референтні бізнес-процеси стануть доступними у вигляді послуг у Кабінетах посадової особи та отримувача послуг. + The same reference business processes will become available as services in officer and citizen portals. -//== Опис вмісту регламенту демо-реєстру == Demo-registry regulations content description -//Вміст регламенту демо-реєстру подібний до типового регламенту будь-якого реєстру, що розгорнуто на Платформі (_див. детальніше -- xref:platform-develop:registry-regulations-deployment.adoc#registry-regulations-structure[Структура регламенту]_). -The content of demo-registry regulations is the same as the typical regulations structure, used for any registry deployed on the Platform (_see more_ -- xref:platform-develop:registry-regulations-deployment.adoc#registry-regulations-structure[Regulations structure]_). +The content of demo-registry regulations is the same as the typical regulations structure, used for any registry deployed on the Platform (_see more -- xref:registry-develop:registry-admin/regulations-deploy/registry-regulations-structure.adoc[]_). -//Регламент демо-реєстру містить референтні приклади, відмічені префіксом *`reference-`* та приклади для тестування, відмічені префіксом *`feature-`*. Це можуть бути _.bpmn_-схеми бізнес-процесів, _.json_-форми внесення даних до процесу, _.xml_-схеми розгортання моделі даних реєстру тощо. Regulations of the demo-registry includes reference examples marked with the *`reference-`* prefix, and testing examples marked with *`feature-`* prefix. They can be examples of _.bpmn_- business process schemes, _.json_-forms for process data, _.xml_-schemes for the deployment of registry data models, and other file types. - -//.Вміст регламенту демо-реєстру -. Demo-registry regulations content +.Demo-registry regulations content image::registry-admin/cp-deploy-consent-data/cp-deploy-consent-data-6.png[] -//Для того, щоб посадова особа в особистому Кабінеті змогла отримати доступ до відповідного референтного процесу, необхідно створити користувача у реалмі `<назва-реєстру>-officer` для відповідного реєстру в сервісі Keycloak та надати такому користувачеві відповідні права доступу. In order to let an officer get access to a corresponding reference process, you need to create a user in `-officer` realm for the corresponding registry in Keycloak service, and give this user the corresponding access rights. -//Права доступу можуть відрізнятися, згідно з логікою вашого реєстру. Це можуть бути як загальні права для посадових осіб, зокрема роль `-officer`, так і специфічні, як-от посадова особа, відповідальна за управління ієрархічними структурами -- `hierarchy-registry-manager`. Access rights can differ according to the registry logic. They can be common officer rights, like the `-officer` role, or specific, like the officer responsible for hierarchy structure management -- `hierarchy-registry-manager`. image::registry-admin/cp-deploy-consent-data/cp-deploy-consent-data-12.png[] -//TIP: Детальніше про створення користувачів та надання їм прав доступу див. у розділі xref:registry-admin/create-users/overview.adoc[]. TIP: Find more information on creating users and managing their access rights in the following section: xref:registry-admin/create-users/overview.adoc[]. image::registry-admin/cp-deploy-consent-data/cp-deploy-consent-data-13.png[] -//Список ролей, що передбачає регламент демо-реєстру, доступний у файлах _roles/*.yml_. Ролі посадової особи знаходяться у файлі _roles/officer.yml_, ролі отримувачів послуг -- у файлі _roles/citizen.yml_. The list of roles supported by demo-registry regulations is available in _roles/*.yml_ files. Officer roles are listed in _roles/officer.yml_ file, and citizen roles can be found in _roles/citizen.yml_ file. -//Для перегляду процесів, які належать до feature-прикладів, у Keycloak передбачена роль `op-regression`. У Кабінеті стануть доступними процеси для тестування функціональності, зокрема для перевірки JUEL-функцій, делегатів тощо. To view the processes associated with feature-examples, use the `op-regression` role in Keycloak. With this role functionality testing processes like JUEL-function or delegate checking will become available in the portal. -//Для перегляду процесів, які належать до reference-прикладів, у Keycloak передбачена роль `op-reference`. To view the processes associated with reference-examples, use the `op-reference` role in Keycloak. [TIP] ==== [%collapsible] -//.Ролі регламенту демо-реєстру -. Roles of the demo-registry regulations +.Roles of the demo-registry regulations ===== [source,yaml] .roles/officer.yml -//---- -//roles: -//# feature roles -// - name: officer -// description: Officer role -// - name: task-dispatcher -// description: Task orchestrator -// - name: officer-first-rank -// description: Посадова особа першого рангу -// - name: officer-second-rank -// description: Посадова особа другого рангу -// - name: op-regression -// description: Available all business processes -// - name: op-layouts -// description: Available layouts business processes -// - name: op-sorting -// description: Available sorting business processes -// - name: officer-grant -// description: Role with granted analytic view -// - name: officer-revoke -// description: Role without revoked analytic view -// - name: officer-grant-all -// description: Role with all analytic views -// - name: officer-revoke-all -// description: Role without all analytic views -// - name: citizen -// description: Role for citizen on officer portal for RBAC -// - name: death-officer -// description: Role for RBAC validation -// - name: inn-officer -// description: Role for RBAC validation -// - name: birth-officer -// description: Role for RBAC validation -// - name: personnel-officer-admin -// description: Personnel officer admin role -// - name: officer-moderator -// description: Moderator of manual registration -// - name: hierarchy-registry-user -// description: Користувач реєстру з управлінням ієрархією -// - name: hierarchy-registry-manager -// description: Керівник реєстру з управлінням ієрархією -// - name: head-officer -// description: Head officer -// - name: op-reference -// description: Available all reference business processes -//---- ---- roles: # feature roles @@ -380,44 +266,16 @@ roles: ---- ===== ==== - -//Орієнтуватися, яка роль матиме доступ до тих чи інших процесів, можна за допомогою авторизаційних файлів регламенту _bp-auth/*.yml_. + -//Доступ для посадових осіб визначається у файлі _bp-auth/officer.yml_, для отримувачів послуг -- у файлі _bp-auth/citizen.yml_. Авторизація для зовнішніх систем встановлюється у файлі _bp-auth/external-system.yml_. To check access rights for each corresponding role, see regulations authorization files _bp-auth/*.yml_. + Access rights for officers are defined in _bp-auth/officer.yml_ file, while for citizens the file is _bp-auth/citizen.yml_. External systems authorization is defined in _bp-auth/external-system.yml_ file. - [TIP] ==== [%collapsible] -//.Доступ до бізнес-процесів демо-реєстру для відповідних ролей -. Access to demo-registry business processes for the corresponding roles +.Access to demo-registry business processes for the corresponding roles ===== [source,yaml] .bp-auth/officer.yml -//---- -//authorization: -// realm: "officer" -// ##### Доступ до feature-процесу ##### -// process_definitions: -// - process_definition_id: "feature-systemErrorAfterUserTask" -// process_name: "AUTO test process description" -// process_description: "AUTO test process description" -// roles: -// - 'op-regression' -// ##### Доступ до референтного процесу ##### -// - process_definition_id: 'reference-upload-update-digital-document' -// process_name: 'Завантаження файлу та його редагування' -// process_description: 'Завантаження файлу та його редагування' -// roles: -// - 'op-reference' -// ##### Доступ до процесу для управління ієрархічною структурою ##### -// - process_definition_id: 'reference-hierarchy-management' -// process_name: 'Управління ієрархічною структурою' -// process_description: 'Управління ієрархічною структурою' -// roles: -// - 'hierarchy-registry-manager' -//---- ---- authorization: realm: "officer" @@ -444,13 +302,10 @@ authorization: ===== ==== -//== Референтні приклади == Reference examples -//Опис референтних прикладів моделювання регламенту доступний на сторінках розділу xref:registry-develop:best-practices/best-practices-overview.adoc[]. -Reference examples of regulations modelling are described on the pages of the following section: xref:registry-develop:best-practices/best-practices-overview.adoc[]. +Reference examples of regulations modeling are described on the pages of the following section: xref:registry-develop:best-practices/best-practices-overview.adoc[]. -//== Корисні посилання == Useful links * xref:registry-develop:study-project/index.adoc[] \ No newline at end of file diff --git a/docs/en/modules/registry-develop/pages/registry-admin/create-users/import-users-officer.adoc b/docs/en/modules/registry-develop/pages/registry-admin/create-users/import-users-officer.adoc index b0984bfafe..e146e8d5e9 100644 --- a/docs/en/modules/registry-develop/pages/registry-admin/create-users/import-users-officer.adoc +++ b/docs/en/modules/registry-develop/pages/registry-admin/create-users/import-users-officer.adoc @@ -1,422 +1,302 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - -//= Імпорт користувачів через файл та надання прав доступу = Importing users through a file and granting access rights +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] + +include::platform:ROOT:partial$admonitions/language-en.adoc[] -//== Загальний опис == General description -//З метою реалізації можливості спрощеного створення великої кількості користувачів (посадових осіб) у Keycloak, впроваджено функціональність для завантаження переліку користувачів у систему через файл. -To simplify the creation of a large number of users (officers) in Keycloak, the functionality to load a list of users into the system using a file has been implemented. +To simplify the creation of many users (officers) in Keycloak, the functionality to load a list of users into the system using a file has been implemented. -//В Кабінет адміністратора регламентів додано нову сторінку "Управління користувачами", на якій реалізовано можливість завантажити файл з даними користувачів цього реєстру. -A new page called *User management* has been added to the Regulations administrator portal. You can upload a file with user data for this registry there. +A new page called *User management* has been added to the Administrative portal. You can upload a file with user data for this registry there. -//З метою мінімізації помилок при створенні нових користувачів запроваджено первинну перевірку валідаційних правил до файлу (розмір, формат, кодування). To minimize errors when creating new users, preliminary validation rules have been introduced for the file (size, format, encoding). -//Задля виконання вимог безпеки та надійності збереження даних, виконується шифрування файлу та його збереження в об'єктне сховище реєстру (Ceph). To meet the security and data storage reliability requirements, the file is encrypted and stored in the object storage of the registry (Ceph). -//Усі подальші кроки щодо запуску процесу імпорту користувачів в Keycloak та парсинг і валідація даних користувачів з файлу, обробка даних у файлі та створення користувачів в Keycloak виконується автоматично без участі адміністратора реєстру. All subsequent steps for initiating the user import process in Keycloak, parsing and validating user data from the file, processing data in the file, and creating users in Keycloak are performed automatically without the involvement of the registry administrator. -//Для моніторингу процесу виконання та його результату реалізовано функціональність у сервісі логування Kibana. Адміністратор реєстру може переглянути інформацію, що файл було опрацьовано, та підсумковий результат: кількість оброблених записів, кількість успішних, кількість помилкових, а також детальну інформацію за кожним помилковим записом. To monitor the execution process and its results, functionality has been implemented in the Kibana logging service. The registry administrator can view information about the processed file and the summary result, including the number of processed records, successful imports, erroneous imports, as well as detailed information for each erroneous record. -//Також на основі розробленого в Redash "Журналу подій системи" окремо створено новий -- "Журнал управління користувачами". Адміністратор реєстру в "Журналі управління користувачів" може бачити дії, пов'язані зі створенням користувачів в Keycloak, в т.ч. інформацію щодо імпорту через файл. Additionally, based on the developed *System event log* in Redash, a new log called *User management log* has been created separately. In the *User management log*, the registry administrator can see actions related to the creation of users in Keycloak, including information about imports through a file. -//== Налаштування атрибутів адміністратора в Keycloak == Configuring administrator attributes in Keycloak -//Попередньо необхідно в Keycloak разово виконати наступні дії: Before proceeding, the following actions need to be performed once in Keycloak: -//. Перейдіть у відповідний `-admin` реалм і виберіть розділ `Users`. . Go to the corresponding `-admin` realm in Keycloak and select the `Users` section. -//. Оберіть користувача адміністратора, що імпортує файл, і перейдіть у розділ `Attributes`. + . Choose the administrator user who will import the file and go to the `Attributes` section. -//. Створіть три ключі для атрибутів: + . Create three keys for the attributes: + -//* `fullName` -- ПІБ; * `fullName` -- Full name; -//TODO: ua-specific below -//* `drfo` -- особистий реєстраційний номер облікової картки платника податків (РНОКПП); * drfo -- The personal registration number of the taxpayer's account card. -//* `edrpou` -- унікальний ідентифікаційний номер юридичної особи в Єдиному державному реєстрі підприємств та організацій України (ЄДРПОУ). * `edrpou` - The unique identification number of the legal entity in the Unified state register of enterprises and organizations of Ukraine. -+ -//. Натисніть `Save`. -. Click `Save`. +. Click *`Save`*. + image:registry-develop:registry-admin/import-users(officer)/import-users(officer)-00.png[] [IMPORTANT] ==== -//Якщо не виконати вищезазначених дій буде показано помилку: :: If the above actions are not performed, the following error will be displayed: :: -//В системі управління користувачами не створено необхідні атрибути. Будь ласка, зверніться до адміністратора. The necessary attributes are not created in the user management system. Please contact the administrator. -+ + image:admin:user-management/user-management-75.png[] ==== [CAUTION] ==== -//Налаштування атрибутів в Keycloak виконується один раз. При наступних процедурах імпорту користувачів виконувати її немає потреби. The configuration of attributes in Keycloak is performed once. There is no need to repeat it during subsequent user import procedures. ==== [#admin-portal-import-users] -//== Імпорт користувачів через Кабінет адміністратора регламенту == Importing users through the Regulations administrator portal -//. Перейдіть до Кабінету адміністратора регламентів. . Go to the Regulations administrator portal. + [TIP] ==== -//Посилання до Кабінету адміністратора регламентів відповідного реєстру можливо отримати, наприклад, в *Openshift*, для цього необхідно перейти до меню `Networking` → `Routes`, обрати у `Project` необхідний проєкт, у пошуку вказати `admin-portal` та перейти за посиланням у колонці `Location`. You can obtain the link to the Regulations administrator portal of the corresponding registry in *Openshift*. To do this, go to the `Networking` → `Routes menu`, select the necessary project, enter `admin-portal` in the search, and follow the link in the *Location* column. image:admin:user-management/user-management-45.png[] ==== + image:registry-develop:registry-admin/import-users(officer)/import-users(officer)-01.png[] -+ -//. Оберіть розділ `Управління користувачами` та натисніть кнопку `Додати користувачів`. + . Select the `User management` section and click the `Add users` button. + image:admin:user-management/user-management-05.png[] -+ -//. Завантажте шаблон файлу `Users_Upload.csv` для заповнення даними користувачів. + . Download the `Users_Upload.csv` file template for filling in the user data. -+ -//. Ознайомтеся з `Поясненнями до заповнення файлу "Users_Upload"`. -//TODO: Не впевнена чи правильно переклала Поясненнями до заповнення файлу "Users_Upload"`. + . Familiarize yourself with the *Instructions for filling in the Users_Upload* file. + [IMPORTANT] ==== -//Обов'язково зверніть увагу на особливості заповнення параметрів шалону файлу, щоб уникнути помилок. + Pay attention to the peculiarities of filling in the file template parameters to avoid errors. -//Якщо під час імпорту користувачів з файлу буде виявлена хоча б одна помилка, то процес імпорту буде перервано і жоден з користувачів не буде доданий до системи Keycloak. xref:#validation-rules[Див. схему нижче]. If any errors are detected during the user import from the file, the import process will be interrupted, and none of the users will be added to the Keycloak system. xref:#validation-rules[See the diagram below]. ==== + image:admin:user-management/user-management-08.png[] -+ -//. Заповніть файл даними користувачів, яким потрібно надати доступ до реєстру. + . Fill in the file with data of the users that need to be granted access to the registry. + [WARNING] ==== -//Вимоги до файлу: + File requirements: -//* максимальний розмір файлу -- *`30 МБ`*; * Maximum file size - *`30 MB`*; -//* формат файлу -- *`CSV`*; * File format - *`CSV`*; -//* кодування файлу -- *`UTF-8`*. * File encoding - *`UTF-8`*. -//Якщо файл не відповідає одному з вищеописаних критеріїв, користувач отримає відповідне повідомлення: If the file does not meet any of the criteria described above, the user will receive the corresponding message: -//* kbd:[Файл занадто великого розміру.] * kbd:[The file is too large.] -//* kbd:[Невідповідний формат файлу.] * kbd:[Incorrect file format.] -//* kbd:[Файл невідповідного кодування.] * kbd:[File has an incompatible encoding.] -//Це означатиме, що завантаження файлу не відбулося. xref:#validation-rules[Див. схему нижче]. This means that the file upload did not occur. xref:#validation-rules[Refer to the diagram below]. ==== + [NOTE] ==== -//Валідаційні правила для даних у файлі: Validation rules for data in the file: -//TODO: ua-specific info below: -//Атрибут `drfo`: :: Attribute `drfo`: :: -//обов'язковий до заповнення, є унікальним у зв'язці з атрибутами `edrpou` та `fullName`; + Required, must be unique in relation to attributes `edrpou` and `fullName`. -//Атрибут `edrpou`: :: обов'язковий до заповнення, є унікальним у зв'язці з атрибутами `drfo` та `fullName`, для введення доступні лише цифри; + Attribute `edrpou`: :: Required, must be unique in relation to attributes `drfo` and `fullName`, only digits are allowed. -//Атрибут `fullName`: :: обов'язковий до заповнення, є унікальним у зв'язці з атрибутами `drfo` та `edrpou`; + Attribute `fullName`: :: Required, must be unique in relation to attributes `drfo` and `edrpou`. -//Атрибут `Realm Roles`: :: обов'язковий до заповнення, може містити декілька ролей (системні та регламентні ролі, при наявності), які вказані через кому. Вказані ролі повинні бути вже створені в Officer Realm у відповідному реєстрі у Keycloak. + Attribute `Realm Roles`: :: Required, may contain multiple roles (system and regulatory roles, if applicable), specified separated by commas. The specified roles must already be created in the Officer Realm in the corresponding registry in Keycloak. -//Атрибут `KATOTTG`: ::обов'язковий до заповнення для реєстрів, які використовують рольову модель за територіальною ознакою, для інших випадків необов'язковий. Значення складається із літер «UA», за якими слідують 17 цифр (наприклад, UA53060230000098362). Якщо користувач матиме доступ до декількох територіальних одиниць, їх коди вносяться через кому. Максимально можлива кількість значень для одного користувача -- 16. У випадку надання користувачу доступу до записів всієї України в значенні KATOTTG потрібно вказати тільки два символи – UA. + Attribute `KATOTTG`: :: Required for registries that use a territorial-based role model, optional for other cases. The value consists of the letters `UA` followed by 17 digits (for example, `UA53060230000098362`). If the user has access to multiple territorial units, their codes are entered separated by commas. The maximum number of values for one user is 16. In case the user is granted access to records throughout Ukraine, the value of KATOTTG should only be specified as two characters - `UA`. -//Будь-який інший атрибут: :: не обов'язковий атрибут з довільною назвою та значенням за потреби (наприклад, назва організації, область, район, населений пункт тощо), якщо надалі буде необхідність будувати на основі нього статистику щодо створених користувачів. Заборонено включати до значення спеціальні символи ([, ], {, }, \, "), а також значення, які містять понад 255 символів. Any other attribute: :: Optional attribute with a custom name and value as needed (e.g., organization name, region, district, locality, etc.), if there is a future need to build statistics based on it for created users. It is prohibited to include special characters (`[, ], {, }, , "`), as well as values containing more than 255 characters. - -//[.underline]#Назва кожного додаткового атрибута обов'язково повинна бути однаковою для всіх користувачів реєстру і мати унікальну назву серед інших параметрів.# [.underline]#The name of each additional attribute must be the same for all users in the registry and have a unique name among other parameters.# ==== -+ -//. Завантажте файл перетягнувши його у відповідне поле `Завантажити перелік посадових осіб` або обравши його у відповідній директорії. + . Upload the file by dragging it to the corresponding *Upload a list of officials* field or selecting it from the appropriate directory. + image:admin:user-management/user-management-06.png[] -+ -//. Натисніть кнопку `Почати імпорт`. + . Click the `Start import` button. + image:admin:user-management/user-management-07.png[] -+ -//. На наступному кроці буде показано, що файл взято в обробку. Зачекайте декілька хвилин до повного завантаження користувачів реєстру. Також у повідомленні зазначене посилання на сервіс Kibana, де можна переглянути результат опрацювання файлу: кількість оброблених записів, кількість успішних, кількість помилкових. + . On the next step, there will be an indication that the file is being processed. Please wait a few minutes for the complete loading of registry users. The message will also include a link to the Kibana service, where you can view the processing results of the file: the number of processed records, the number of successful imports, and the number of errors. + image:admin:user-management/user-management-70.png[] -//== Перегляд результату виконання процесу в сервісі Kibana == Viewing the execution result in Kibana service -//Модуль перевіряє увесь файл і пише всі знайдені проблеми в сховище технічних логів `Kibana`. У логах фіксується інформація про кожен запис, пропущений при створенні, із зазначеною причиною пропуску, а успішно відпрацьовані порядково не фіксуються (показується лише загальна кількість успішних). Також присвоюється унікальний ідентифікатор користувача в Keycloak (Username), який дублюється. The module checks the entire file and writes all found issues to the Kibana technical log repository. The logs record information about each skipped entry during creation, along with the reason for skipping, while successfully processed entries are not logged (only the total count is displayed). Additionally, a unique user identifier in Keycloak (Username) is assigned and duplicated. [CAUTION] ==== -//Під час першого використання сервісу Kibana необхідно створити `index pattern`. During the initial use of the Kibana service, it is necessary to create an `index pattern`. -//Для цього слід виконати наступні кроки: To do this, follow these steps: -//. Відкрийте додаток, перейдіть до секції *Management*. . Open the application and go to the *Management* section. -//. Натисніть `Create index pattern`, щоб отримати можливість прочитати журнали з індексів, -що потрапляють до *Elasticsearch*. . Click on `Create index pattern` to be able to read logs from the indexes that go to *Elasticsearch*. + image:registry-develop:bp-modeling/bp/kibana/kibana-section1-figure1.png[] -+ -//. У полі *Define Index Pattern*, створіть свій індекс-паттерн згідно з шаблоном. Наприклад, якщо всі журнали починаються з *app-*, створіть індекс-паттерн *app-**, щоб відобразити відповідні журнали. + . In the *Define Index Pattern* field, create your index pattern according to the template. For example, if all logs start with *app-*, create the index pattern *app-** to display the corresponding logs. -+ -//. Натисніть `Next step`, щоб перейти до наступного кроку. + . Click `Next step` to proceed to the next step. + image:registry-develop:bp-modeling/bp/kibana/kibana-section1-figure2.png[] -+ -//. Використайте фільтр на вкладці *Configure Settings*, щоб обрати період, дані за який слід показати. + . Use the filter on the *Configure Settings* tab to select the period for which the data should be shown. + -//TIP: За замовчуванням, будуть відображені журнали за останні 15 хвилин. + TIP: By default, logs for the last 15 minutes will be displayed. -+ -//. Натисніть `Create Index Pattern`. + . Click `Create Index Pattern`. + image:registry-develop:bp-modeling/bp/kibana/kibana-section1-figure3.png[] -+ -//. Після створення індекс-паттерну `app-*`, перейдіть на вкладку **Discover**, щоб отримати необхідну інформацію. -. After creating the index pattern *app-**, navigate to the *Discover* tab to obtain the necessary information. +. After creating the index pattern *app-**, navigate to the *Discover* tab to obtain the necessary information. ==== - [#validation-rules] -//=== Загальні валідаційні правила для перевірки даних користувачів з файлу. === General validation rules for checking user data from the file. -//Загальну схему валідаційних правил представлено нижче. -The general schema of validation rules is presented below. - -image:registry-develop:registry-admin/import-users(officer)/import-users(officer).jpg[] +.The general schema of validation rules +image::registry-develop:registry-admin/import-users(officer)/import-users-officer.svg[] -//У разі порушення валідаційного правила запису даних у файлі буде показана відповідна помилка: In case of violating a validation rule during data entry in the file, the corresponding error will be displayed: -//* _обов'язкове поле пусте `або` складається тільки з пробілів `або` має кілька значень через кому замість одного (для поля edrpou, drfo, fullName)_ -- помилка про відсутність обов'язкового атрибута; * _A required field is empty or consists only of spaces `or` has multiple values separated by commas instead of one (for the fields edrpou, drfo, fullName)_ — an error indicating the absence of a mandatory attribute. -//* _поле `edrpou` містить недопустимі символи (має складатися лише з цифр)_-- помилка про присутність неприпустимих символів; + * _The `edrpou` field contains invalid characters (it should only consist of digits)_ — an error indicating the presence of forbidden characters. -//* _вказана роль відсутня у переліку наявних ролей Officer Realm відповідного реєстру у Keycloak_ -- помилка про відсутність вказаної ролі; + * _The specified role is not present in the list of available roles in the Officer Realm of the corresponding registry in Keycloak_ — an error indicating the absence of the specified role. -//* _структура файлу не відповідає заданій_ -- помилка про невідповідність файлу закладеній структурі. + * _The file structure does not match the specified structure_ — an error indicating the file's mismatch with the intended structure. -//В такому випадку процес імпорту користувачів не відбувається. In such cases, the user import process does not occur. [CAUTION] ==== -//Якщо імпорт користувачів у Keycloak відбувся з порушенням валідаційних правил, потрібно повторно з самого початку повторити процедуру імпорту користувачів з файлу, попередньо виконавши потрібні корегування. + If the user import to Keycloak violates the validation rules, it is necessary to repeat the user import procedure from the beginning after making the necessary adjustments. ==== - -//Виконання часткового імпорту користувачів з помилкою можливе в наступних випадках: Partial import of users with errors is possible in the following cases: -//. користувач із таким username і такими атрибутами (`drfo`, `edrpou`, `fullName`) вже є в Keycloak; . A user with the same username and attributes (`drfo`, `edrpou`, `fullName`) already exists in Keycloak. -//. користувач із таким `username`, але з іншими атрибутами вже є в Keycloak; + . A user with the same `username` but different attributes already exists in Keycloak. -//. користувач із такими атрибутами, але з іншим `username` вже є у Keycloak (тоді у логах буде вказано, який реальний `username` у користувача в Keycloak); + . A user with the same attributes but a different `username` already exists in Keycloak (in this case, the logs will indicate the actual username of the user in Keycloak). -//. користувач із такими атрибутами вже зустрівся в CSV-файлі раніше (дублювання записів). + . The user with the same attributes has been encountered in the CSV file before (duplicate entries). -//. у процесі імпорту виникла помилка в Keycloak. + . An error occurred in Keycloak during the import process. -//В такому випадку процес імпорту користувачів відбувається частково, записи користувачів з помилками фіксуються в логах Kibana як `Failed to import` та `Skipped`, і вони не додаються до системи Keycloak, а усі інші успішні записи користувачів додаються до системи Keycloak. In such cases, the user import process occurs partially, and user records with errors are logged in Kibana as `Failed to import` and `Skipped`, and they are not added to the Keycloak system. All other successful user records are added to the Keycloak system. -//Алгоритм запису логів при імпорті користувачів з помилкою: Logging algorithm for user import containing errors: -//* Якщо один із запитів в групі з N записів повертає помилку, запис користувачів саме з цієї групи починається порядково. Користувач, на якому сталася помилка, пропускається. * If one of the requests in a group of N entries returns an error, the user record from that specific group starts sequentially. The user on which the error occurred is skipped. -//* У логах фіксується інформація про всі записи, пропущені при створенні, з фіксацією причини пропуску (позначені як `Skipped` або `Failed to import`). + * The logs record information about all skipped entries during creation, including the reason for skipping (marked as `Skipped` or `Failed to import`). [CAUTION] ==== -//Якщо імпорт користувачів у Keycloak відбувся з помилками (часткове створення користувачів), потрібно наново завантажити файл з користувачами, яких не вдалося створити, виконавши потрібні корегування. If importing users into Keycloak was done with errors (partial user creation), it is necessary to reload the file with the users who couldn't be created and make the necessary adjustments. ==== - -//=== Результат виконання процесу імпорту з помилкою === Result of the import process with an error -//Першочергово необхідно в логах знайти відповідний запис з загальним результатом опрацювання імпорту. First, it is necessary to find the corresponding entry in the logs with the overall result of the import processing. image:registry-develop:registry-admin/import-users(officer)/import-users(officer)-08.png[] -//* `Total users in file` -- відображає загальну кількість користувачів, що було додано через файл; * `Total users in the file` -- displays the total number of users that were added via the file; -//* `Successfully imported` -- кількість успішно доданих користувачів; + * `Successfully imported` -- the number of users successfully added; -//* `Skipped` - кількість пропущених користувачів; + * `Skipped` -- the number of skipped users; -//* `Failed to import` -- кількість користувачів, що не вдалося додати через помилку з сервісом Keycloak. + * `Failed to import` -- the number of users that couldn't be added due to an error with the Keycloak service. -//За кожним користувачем, що не вдалося додати до сервісу (пропущені) буде показано окремий запис у логах з інформацією про валідаційну помилку. For each user that couldn't be added to the service (skipped), a separate log entry will be shown with information about the validation error. image:registry-develop:registry-admin/import-users(officer)/import-users(officer)-09.png[] -//Якщо імпорт користувачів у Keycloak відбувся з помилками (часткове створення користувачів), потрібно наново підвантажити файл з користувачами, яких не вдалося створити (виконавши потрібні корегування). If importing users into Keycloak was done with errors (partial user creation), it is necessary to reload the file with the users who couldn't be created (after making the necessary adjustments). -//=== Успішний результат виконання процесу імпорту користувачів === Successful result of the user import process -//У разі успішного проходження валідаційних правил виконується процес імпорту всіх користувачів з файлу у Keycloak. `Skipped` та `Failed to import` вказуються с нулями. `Total users in file` відповідає кількості `Successfully imported`. In case the validation rules are successfully passed, the import process will import all users from the file into Keycloak. `Skipped` and `Failed to import` will be indicated with zeros. `Total users in the file` corresponds to the number of `Successfully imported`. image:admin:user-management/user-management-71.png[] -//Створення користувачів у Keycloak відбувається групами (окремими запитами) по N записів (значення N задається в налаштуваннях процесу). The creation of users in Keycloak is done in groups (individual requests) in batches of N records (N value is specified in the process settings). -//За результатом успішного проведення імпорту користувачів у Keycloak створюються облікові записи користувачів з відповідними атрибутами та ролями. After successfully importing the users into Keycloak, user accounts with corresponding attributes and roles are created. image:registry-develop:registry-admin/import-users(officer)/import-users(officer)-11.png[] -//== Перегляд логів аудиту в "Журналі управління користувачами" системи Redash == Viewing audit logs in the User management journal of the Redash system -//TODO: не впевнена чи правильно переклала Журналі управління користувачами у попередній лінійці - -//Адміністратор безпеки (з відповідним правом доступу) має можливість переглянути в Redash "Журнал управління користувачами", наприклад, з метою проведення аудиту надання доступу користувачам. Security administrator (with the appropriate access rights) can view the *User management* journal in Redash, for example, to conduct an audit of user access provision. [NOTE] ==== -//Для надання прав доступу до системи Redash у користувача має бути роль `redash-admin`. + To grant access rights to the Redash system, the user must have the `redash-admin` role assigned. -//Посилання до системи Redash можна знайти в консолі Openshift → _Networking_ → _Routes_, та обравши необхідний проєкт знайти реалм `redash-viewer`. The link to the Redash system can be found in the Openshift console → _Networking_ → _Routes_ and by selecting the relevant project, find the `redash-viewer` realm. image:registry-develop:registry-admin/import-users(officer)/import-users(officer)-14.png[] ==== -//У журналі представлено всі записи, які відповідають наступним параметрам: applicationName="Keycloak", type="SYSTEM_EVENT". The journal includes all entries that match the following parameters: `applicationName="Keycloak"`, `type="SYSTEM_EVENT"`. -//Кожен користувач, якого було створено через імпорт файлом, відображається окремим рядком з зазначеним набором додаткових параметрів. Each user created through file import is displayed as a separate row with the specified set of additional parameters. image:registry-develop:registry-admin/import-users(officer)/import-users(officer)-12.png[] -//Звіт містить наступні параметри:: The report includes the following parameters: :: |=== -//|_Назва в Redash_|_Назва параметру_|_Опис параметру_ -|_Redash name_|_Parameter name_|_Parameter description_ -//|Ідентифікатор запиту|`requestId`|Ідентифікатор запиту з MDC + +|*Redash name*|*Parameter name*|*Parameter description* |Query Identifier|`requestId`|Request identifier with MDC -//|Назва події в БД|`name`|"USER_CREATE" |Event name in the database|`name`|"USER_CREATE" -//|Назва додатку/поди |`sourceApplication` |Назва пайплайну для імпорту користувачів (pod_name) |Application/Pod Name|`sourceApplication`|Pipeline name for user import (pod_name) -//|Дата та час операції |`timestamp`|Мітка часу |Operation date and time|`timestamp`|Timestamp -//|ПІБ адміністратора |`userName`|ПІБ користувача який запустив процес імпорту |Administrator's full name|`userName`|Full name of the user who initiated the import process -//|Ідентифікатор адміністратора |`userKeycloakId`|Keycloak ідентифікатор користувача який запустив процес імпорту |Administrator's identifier|`userKeycloakId`|Keycloak identifier of the user who initiated the import process -//|ДРФО адміністратора |`userDrfo`|ДРФО код користувача який запустив процес імпорту |Administrator's tax identification number|userDrfo|Tax identification number of the user who initiated the import process -//|ID створеного користувача |`userId`|Keycloak ідентифікатор створеного користувача |Created user's ID|`userId`|Keycloak identifier of the created user -//|Username створеного користувача |`username`|username створеного користувача |Created user's username|`username`|Username of the created user -//|Користувач активний |`enabled`|true/false |User is active|`enabled`|true/false -//|КАТОТТГ|`katottg`|Кодифікатор адміністративно-територіальних одиниць та територій територіальних громад. Може містити кілька значень. |KATOTTG|`katottg`|Code of administrative-territorial units and territories of territorial communities. May contain multiple values. -//|Довільні поля|`customAttributes`|Власні (довільні) додаткові атрибути користувача |Custom Fields|`customAttributes`|Custom additional attributes of the user -//|Ідентифікатор реалму |`realmId`|Keycloak ідентифікатор реалму в якому був створений користувач |Realm identifier|`realmId`|Keycloak identifier of the realm in which the user was created -//|Ім'я реалму |`realmName`|Ім'я реалму в якому був створений користувач |Realm name|`realmName`|Name of the realm in which the user was created -//|Ім'я клієнта в Keycloak |`clientId`|Значення "Client ID" атрибута реалму, від імені якого був створений користувач |Keycloak client name|`clientId`|Value of the "Client ID" attribute of the realm from which the user was created -//|Ідентифікатор клієнта в Keycloak |`keycloakClientId` |Keycloak-ідентифікатор клієнта від імені якого був створений користувач |Keycloak client identifier|`keycloakClientId`|Keycloak identifier of the client on behalf of which the user was created -//|Ролі створеного користувача |`roles`|Ролі створеного користувача |Roles of the created user|`roles`|Roles of the created user -//|Ідентифікатор CSV файлу |`sourceFileId`|Ідентифікатор CSV файлу у Ceph-сховищі |CSV file identifier|`sourceFileId`|Identifier of the CSV file in the Ceph storage -//|Оригінальне ім'я CSV файлу |`sourceFileName`|Оригінальне ім'я CSV файлу, з якого проводився імпорт користувачів |Original CSV file name|`sourceFileName`|Original name of the CSV file from which the user import was performed -//|Контрольна сума CSV файлу |`sourceFileSHA256Checksum` |Чек сума завантаженого користувачем CSV файлу (незашифрованого) |Checksum of the CSV File|`sourceFileSHA256Checksum`|Checksum of the CSV file uploaded by the user (unencrypted) |=== -//Функціональністю сервісу Redash передбачено можливість фільтрування, сортування параметрів та експорту сформованої вибірки. The Redash service functionality allows filtering, sorting parameters, and exporting the generated selection. image:registry-develop:registry-admin/import-users(officer)/import-users(officer)-13.png[] diff --git a/docs/en/modules/registry-develop/pages/registry-admin/create-users/manual-user-creation.adoc b/docs/en/modules/registry-develop/pages/registry-admin/create-users/manual-user-creation.adoc index f1043609c4..6d96cd51f8 100644 --- a/docs/en/modules/registry-develop/pages/registry-admin/create-users/manual-user-creation.adoc +++ b/docs/en/modules/registry-develop/pages/registry-admin/create-users/manual-user-creation.adoc @@ -1,111 +1,96 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - -//= Створення окремого користувача та надання прав доступу = Creating a user and granting access rights +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] + +include::platform:ROOT:partial$admonitions/language-en.adoc[] -//== Створення користувача у системі == Creating a user in the system -//Щоб створити нового користувача (посадову особу) у Keycloak, необхідно виконати наступні кроки: To create a new user (officer) in Keycloak, follow these steps: ["arabic"] -//. Перейдіть до realm *`-officer-portal*` відповідного реєстру: + . Go to the *`-officer-portal`* realm of the respective registry: -//** На вкладці *Users* натисніть kbd:[View all users]. + ** On the *Users* tab, click kbd:[View all users]. -//** Натисніть кнопку kbd:[Add user]. + ** Click the kbd:[Add user] button. + image:admin:user-management/user-management-04.png[] -//. У відкритому вікні введіть дані користувача: + . In the opened window, enter the following user's data: + -- -//** `Username` (_обов'язковий_) -- системне ім'я користувача у Keycloak. _Не впливає на автентифікацію користувачів_. + ** `Username` (_required_) -- the system name of the user in Keycloak. _It does not affect user authentication_. + -//NOTE: Може використовуватися як виключення для входу до внутрішніх системних сервісів, які передбачають автентифікацію за логіном та паролем. + NOTE: It can be used as an exception for logging into internal system services that require login and password authentication. -//** `First Name` (_не обов'язковий_) -- ім'я користувача. + ** `First Name` (_optional_) -- the user's first name. -//** `Last Name` (_не обов'язковий_) -- прізвище користувача. + ** `Last Name` (_optional_) -- the user's last name. -//** `User Enabled` (_увімкнено за замовчуванням_) -- позначка, що користувач активований у системі (якщо вона не активна, доступ такого користувача до систем буде обмежено). + ** `User Enabled` (_enabled by default_) -- a mark indicating that the user is activated in the system (if not active, the user's access to the system will be restricted). -//** `Email Verified` (_не обов'язковий_) -- активується у разі необхідності підтвердження електронної пошти. + ** `Email Verified` (_optional_) -- activated if email confirmation is required. -- + image:admin:user-management/user-management-33.png[] -//. Натисніть кнопку kbd:[Save]. + . Click the kbd:[Save] button. -//. Перейдіть до вкладки *Credentials*. + . Go to the *Credentials* tab. -//. Введіть пароль у полі `Password` та підтвердьте його в полі `Password Confirmation`. + -//Активуйте позначку `Temporary`, щоб згенерувати тимчасовий пароль. + + . Enter the password in the *Password* field and confirm it in the *Password Confirmation* field. Check the *Temporary* box to generate a temporary password. + [CAUTION] ==== -//З метою безпеки необхідно змінити тимчасовий пароль при першій авторизації в системі. + For security reasons, it is necessary to change the temporary password during the first login to the system. ==== + image:admin:user-management/user-management-34.png[] -//. Натисніть кнопку kbd:[Set Password]. + . Click the kbd:[Set Password] button. + image:admin:user-management/user-management-35.png[0,740] -//. Перейдіть на вкладку *Role Mappings* та призначте необхідні ролі користувачу. -//Натисніть кнопку kbd:[Add selected]. + + . Go to the *Role Mappings* tab and assign the necessary roles to the user. Click the kbd:[Add selected] button. + [NOTE] ==== -//Переконайтеся, що користувач має обов'язкову роль *`officer`* -- вона надає доступ до Кабінету посадової особи. + Verify that the user has the mandatory *`officer`* role assigned, which provides access to the Officer Portal. -//Ви можете також призначати додаткові ролі, передбачені логікою вашого реєстру. You can also assign additional roles depending on your registry's logic. ==== + image:admin:user-management/user-management-36.png[] -//. Надані ролі будуть показані в секції *Assigned Roles*. + . The assigned roles are displayed in the *Assigned Roles* section. + image:admin:user-management/user-management-37.png[] + -//. Перейдіть на вкладку *Attributes* та встановіть значення для ключів параметрів *`drfo`*, *`edrpou`*, *`fullName`*, які є обов'язковими для автентифікації через кваліфікований електронний підпис (КЕП) користувача (_детальніше -- див. xref:user:citizen-officer-portal-auth.adoc[]_), а також *`KATOTTG`* (_опціонально -- для використання ієрархічної рольової моделі за територіальною ознакою_). Новий параметр додається після натискання кнопки kbd:[Add]. + . Go to the *Attributes* tab and set values for the parameter keys: *`drfo`*, *`edrpou`*, *`fullName`*, which are mandatory for authentication with the user's Qualified Electronic Signature (_see xref:user:citizen-officer-portal-auth.adoc[]_). A new parameter is added after you click the kbd:[Add] button. + [CAUTION] ==== -//У разі невідповідності значень атрибутів до значень, заданих у КЕП, користувач не матиме можливості увійти до Кабінету посадової особи та підписувати задачі КЕП. + If the attribute values do not correspond to the values specified in the Qualified Electronic Signature, the user will not be able to access the Officer portal or sign the Qualified Electronic Signature tasks. ==== + -//// + *`drfo`* -- особистий реєстраційний номер облікової картки платника податків (РНОКПП) посадової особи. Якщо через релігійні переконання особа не отримувала РНОКПП, необхідно вказати серію та номер паспорта або номер ID-картки. -//* *`edrpou`* -- унікальний ідентифікаційний номер юридичної особи в Єдиному державному реєстрі підприємств та організацій України (8 цифр). -//* *`fullName`* -- прізвище, ім'я, по батькові (за наявності). -//* додатково `будь-який інший атрибут` з довільною назвою та значенням за потреби (наприклад, назва організації, область, район, населений пункт тощо), якщо надалі буде необхідність будувати на основі нього статистику щодо створених користувачів. Заборонено включати до значення спеціальні символи ([, ], {, }, \, "), а також значення, які містять понад 255 символів. Назва кожного додаткового атрибута обов'язково повинна бути однаковою для всіх користувачів реєстру і мати унікальну назву серед інших параметрів. -//// + |=== |Attribute |Description |Mandatory @@ -140,122 +125,99 @@ E.g. `location`, `age` and so on. + image:admin:user-management/user-management-42.png[] - -//. Натисніть кнопку kbd:[Save]. [start=10] . Click the kbd:[Save] button. -//Користувача успішно створено. The user has been successfully created. [#delete-user-role] -//== Видалення ролі користувачу + == Removing a role from a user -//Щоб видалити надані користувачу ролі, виконайте наступні кроки: To remove roles assigned to a user, follow these steps: -//. Оберіть необхідного користувача. Для цього оберіть відповідний realm, перейдіть до розділу *Users*, натисніть kbd:[View all users] та оберіть користувача зі списку. . Select a user. To do this, choose the corresponding realm, go to the *Users* section, click kbd:[View all users], and select the user from the list. + image:admin:user-management/user-management-40.png[] -//. Виберіть зі списку ролі, що необхідно видалити та натисніть kbd:[Remove selected]. + . Select the roles you want to remove from the list and click kbd:[Remove selected]. + image:admin:user-management/user-management-38.png[] -//. Видалені ролі стануть доступними та будуть показані в секції *Available Roles*. + . The removed roles will become available and will be shown in the *Available Roles* section. + image:admin:user-management/user-management-39.png[] -//// - -//* *`KATOTTG`* _(до заповнення для реєстрів, які використовують рольову модель за територіальною ознакою)_ -- перелік кодів з Кодифікатора адміністративно-територіальних одиниць та територій територіальних громад. Після визначення коду KATOTTG для до Keycloak потрібно записати скорочене значення коду. Користувач Кабінету посадової особи матиме доступ до записів саме тієї області/району/територіальної громади тощо, код якої буде вказано. -//TODO: Not sure how to best translate KATTOTG. Added the below suggestion to the glossary and waiting for the approval * *`KATOTTG`* _or_ Codifier of administrative-territorial units and territories of territorial communities (_to be filled in for registries using the territorial role model_) - a list of codes from the Codifier of administrative-territorial units and territories of territorial communities. After determining the code, the abbreviated value of the code should be recorded in Keycloak. The user of the Officer portal will have access to records of the specific region/district/territorial community, etc., whose code is indicated. + [TIP] ==== -//Для перегляду значення коду KATOTTG перейдіть за link:https://www.minregion.gov.ua/napryamki-diyalnosti/rozvytok-mistsevoho-samovryaduvannya/administratyvno/kodyfikator-administratyvno-terytorialnyh-odynycz-ta-terytorij-terytorialnyh-gromad/[посиланням]. + To view the decryption of the code KATOTTG, please follow the link:https://www.minregion.gov.ua/napryamki-diyalnosti/rozvytok-mistsevoho-samovryaduvannya/administratyvno/kodyfikator-administratyvno-terytorialnyh-odynycz-ta-terytorij-terytorialnyh-gromad/[link]. -//Знайдіть найактуальніший файл «Кодифікатор». Для зручності використовуйте додаткове фільтрування по колонці «Категорія об'єкта» файлу, яка містить наступні значення: Find the most up-to-date file _Codifier_. For convenience, use additional filtering by the *Object Category* column of the file, which contains the following values: |=== -//|Рівень|Значення + |Level|Value -//|Перший рівень|«O» – Автономна Республіка Крим, області + |First level|*`O`* - Autonomous Republic of Crimea, regions -//«K» – міста, що мають спеціальний статус *`K`* - cities with special status -//|Другий рівень|«P» – райони в областях та Автономній Республіці Крим + |Secod level| `*P*` - districts in regions and the Autonomous Republic of Crimea -//|Третій рівень|«H» – території територіальних громад (назви територіальних громад) в областях, територіальні громади Автономної Республіки Крим + |Third level| *`H`* - territories of territorial communities (names of territorial communities) in regions, territorial communities of the Autonomous Republic of Crimea -//|Четвертий рівень|«M» – міста + |Fourth level| *`M`* - cities -//«T» – селища міського типу *`T`* - urban-type settlements -//«C» – села *`C`* - villages -//«X» – селища *`X`* - settlements -//|Додатковий рівень|«B» – райони в містах + |Additional level|*`B`* - districts in cities |=== -//Приклад 1: :: Example 1: :: -//Необхідно надати доступ користувачу до Кабінету посадової особи на рівні Миргородської територіальної громади (Третій рівень) Полтавської області. Для цього: + To provide user with access to the Officer portal at the level of the _Myrhorod_ territorial community (Third level) in Poltava region, do the following: -//* в колонці «Категорія об'єкта» виберіть значення «Н». * select the value *`H`* in the *Object category* column. -//* в колонці «Назва об'єкта» введіть в пошуку назву територіальної громади «Миргородська». + * enter the name of the territorial community *`Myrhorodska`* in the *Object name* column as a search query. -//* скопіюйте з колонки «Третій рівень» код значення територіальної одиниці (UA53060230000098362). + * copy the code value of the territorial unit (*`UA53060230000098362`*) from the "Third level" column. -//* згідно з розшифровкою нижче визначте який з блоків є останнім ненульовим, видаліть всі нульові блоки разом з системним номером і заповніть до Keycloak тільки це значення. В прикладі 1 до Keycloak потрібно занести UA5306023 (блоки до рівня територіальної громади є ненульовими). + * according to the decryption below, determine which blocks are the last non-zero ones, delete all zero blocks along with the system number, and enter only this value into Keycloak. In Example 1, you need to enter *`UA5306023`* into Keycloak (blocks up to the level of territorial communities are non-zero). + image:admin:user-management/user-management-41.png[] -//Приклад 2: :: Example 2: :: -//Необхідно надати доступ користувачу до Кабінету посадової особи на рівні Шевченківського району м. Полтава (Додатковий рівень). Для цього: + To provide user with access to the Officer portal at the level of _Shevchenkivskyi_ district in Poltava city (Additional level), do the following: -//* спочатку в колонці «Категорія об'єкта» виберіть значення «О». * first, select the value *`O`* in the *Object category* column. -//* в колонці «Назва об'єкта» введіть в пошуку назву області «Полтавська». + * enter the name of the region *`Poltavska`* in the *Object name* column for search. -//* скопіюйте з колонки «Перший рівень» код значення області (UA53000000000028050). + * copy the code value of the region *`UA53000000000028050`* from the *First level* column. -//* за допомогою фільтра залиште лише ті значення, які в колонці «Перший рівень» містять значення UA53000000000028050. + * use the filter to leave only the values in the *First level* column that contain the value *`UA53000000000028050`*. -//* в колонці «Категорія об'єкта» виберіть значення «В». + * select the value *`B`* in the "Object Category" column. -//* в колонці «Назва об'єкта» введіть в пошуку назву району «Шевченківський». + * enter the name of the district *`Shevchenkivskyi`* in the *Object name* column as a search query. -//* скопіюйте з колонки «Додатковий рівень» код значення територіальної одиниці (UA53080370010339303). + * copy the code value of the territorial unit (*`UA53080370010339303`*) from the *Additional level* column. -//* згідно з прикладом 1 визначте який з блоків є останнім ненульовим, видаліть усі нульові блоки разом з системним номером і заповніть до Keycloak тільки це значення. В прикладі 2 до Keycloak потрібно занести UA530803700103 (блоки до рівня районів у містах є ненульовими). + * according to Example 1, determine which blocks are the last non-zero ones, delete all zero blocks along with the system number, and enter only this value into Keycloak. In Example 2, you need to enter *`UA530803700103`* into Keycloak (blocks up to the level of districts in cities are non-zero). -//Якщо користувач матиме доступ до декількох територіальних одиниць, їх коди вносяться до Keycloak з роздільником ##. Максимально можлива кількість значень для одного кристувача – 16. If a user has access to multiple territorial units, their codes are entered into Keycloak with a separator `##`. The maximum number of values for one user is 16. -//У випадку надання користувачу доступу до записів всієї України в значенні KATOTTG потрібно вказати тільки два символи – *UA*. If you are granting a user access to records of the entire Ukraine, within the *KATOTTG* field only two characters should be specified: *`UA`* -//TIP: Детальніше про рольову модель за територіальною прив'язкою див. на сторінці xref:registry-admin/hierarchical-model.adoc[]. TIP: For more information on the territory-based hierarchical role model, see xref:registry-admin/hierarchical-model.adoc[] - -//// \ No newline at end of file diff --git a/docs/en/modules/registry-develop/pages/registry-admin/db-connection/db-connection-pgadmin.adoc b/docs/en/modules/registry-develop/pages/registry-admin/db-connection/db-connection-pgadmin.adoc index b6ff042f34..5bcbf1c3fb 100644 --- a/docs/en/modules/registry-develop/pages/registry-admin/db-connection/db-connection-pgadmin.adoc +++ b/docs/en/modules/registry-develop/pages/registry-admin/db-connection/db-connection-pgadmin.adoc @@ -1,20 +1,14 @@ -//= Взаємодія з базою даних реєстру через pgAdmin = Interacting with the registry database through pgAdmin include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] -//Ви можете переглядати зміни у базі даних реєстру, працювати з таблицями та іншими структурами даних за допомогою інструмента *pgAdmin*. The *pgAdmin* tool enables you to view changes in the registry database and work with tables and other data structures. -//Для цього виконайте декілька простих кроків: To use the tool, perform the following steps: -//. Перейдіть в адміністративну панель Control Plane. . Sign in to the Control Plane admin console. -//. Відкрийте +++Реєстри > Швидкі посилання > Адміністративна зона реєстру+++ . Go to *Registries* > *Quick links* > *Registry administrative zone*. -//та перейдіть за посиланням до +++Вебінтерфейсу перегляду даних реєстру+++ -- *pgAdmin*. . Click the *Registry data viewing service (pgAdmin)* link. + image:registry-admin/db-connection/pgadmin/db-connection-pgadmin-1.png[] @@ -22,34 +16,28 @@ image:registry-admin/db-connection/pgadmin/db-connection-pgadmin-1.png[] [TIP] ==== [%collapsible] -//.Альтернативний спосіб входу -.Alternative route +.Alternative method ===== -//. Відкрийте *Openshift*-консоль > *Projects* > Оберіть ваш реєстр. . Sign in to the OpenShift console. . Open the *Projects* section and select your registry. -//. Перейдіть до *Networking* > *Routes* та у пошуку знайдіть роут сервісу `pgadmin`. . Go to *Networking* > *Routes* and search for `pgadmin` service route. + image:registry-develop:best-practices/review-db-changes-before-merge/review-db-changes-before-merge-17.png[] ===== ==== - + [TIP] ==== [%collapsible] -//.Де знайти логін та пароль для pgadmin? + .Where do I find the credentials for pgadmin? ===== -//Логін та пароль для `pgadmin` можна знайти у секції *Workloads* > *Secrets*, у секреті під назвою *pgadmin-secret*. To find the username and password for `pgadmin`, go to *Workloads* > *Secrets* and locate the *pgadmin-secret* secret. image:registry-develop:best-practices/review-db-changes-before-merge/review-db-changes-before-merge-18.png[] ===== ==== -+ -//. В інтерфейсі *pgAdmin* знайдіть розділ *Servers* та введіть пароль для системного користувача `application_role`, щоб встановити з'єднання із реєстровим БД-сервером. + . In the *pgAdmin* interface, go to the *Servers* section and enter the password for the `application_role` system user to connect to the registry database server. + image:registry-develop:best-practices/review-db-changes-before-merge/review-db-changes-before-merge-19.png[] @@ -57,10 +45,8 @@ image:registry-develop:best-practices/review-db-changes-before-merge/review-db-c [TIP] ==== [%collapsible] -//.Де знайти пароль для з'єднання із реєстровим БД-сервером? .Where do I find the password for connecting to the registry database server? ===== -//Пароль для з'єднання із реєстровим БД-сервером `Registry` для користувача `application_role` можна знайти у секції *Workloads* > *Secrets*, у секреті під назвою *citus-roles-secrets*. Скопіюйте пароль у полі *appRolePass*. To find the password for connecting to the `Registry` database server for the `application_role` user, go to *Workloads* > *Secrets* and locate the *citus-roles-secrets* secret. Copy the password from the *appRolePass* field. image:registry-develop:best-practices/review-db-changes-before-merge/review-db-changes-before-merge-20.png[] @@ -68,33 +54,28 @@ image:registry-develop:best-practices/review-db-changes-before-merge/review-db-c image:registry-develop:best-practices/review-db-changes-before-merge/review-db-changes-before-merge-21.png[] ===== ==== -+ -//. Знайдіть операційну базу даних `registry` та перегляньте зміни. Вона буде доступна за шляхом: + -//*Servers* > *Registry* > *Databases* > `registry`. + . Find the `registry` operational database and review the changes. It is available via the following path: + *Servers* > *Registry* > *Databases* > `registry` + image:registry-admin/db-connection/pgadmin/db-connection-pgadmin-2.png[] + -//NOTE: Про перегляд даних у тимчасових БД детально описано на сторінці xref:registry-develop:best-practices/review-db-changes-before-merge.adoc[]. NOTE: For details on viewing data in temporary databases, see xref:registry-develop:best-practices/review-db-changes-before-merge.adoc[]. -+ -//* Створені таблиці можна переглянути за шляхом: *Schemas* > `registry` > *Tables*. + * To view the tables, use the following path: *Schemas* > `registry` > *Tables*. + image:registry-admin/db-connection/pgadmin/db-connection-pgadmin-3.png[] + -//* Створені пошукові критерії (search conditions) можна переглянути за шляхом: *Schemas* > `registry` > *Views*. + * To view the search conditions, use the following path: *Schemas* > `registry` > *Views*. + image:registry-admin/db-connection/pgadmin/db-connection-pgadmin-4.png[] + [NOTE] ==== -//Критерії пошуку у базі даних є таблицями-представленнями (`VIEW`), що призначені виключно для читання даних. Конвенція назв для search conditions на рівнях моделі даних та БД збігається, за єдиним винятком -- у БД до назви кожного критерію пошуку додається суфікс `_v`. + In the database, search conditions are presented as view tables intended only for reading data. The naming convention for search conditions at the data model and database levels coincide with one exception: in the database, the `_v` suffix is added to the name of each search condition. -//Наприклад, якщо ви створили search condition із назвою `get_parent_by_name`, то у базі даних ця назва трансформується у `get_parent_by_name_v`. For example, if you created a search condition called `get_parent_by_name`, the view table will have the following name: `get_parent_by_name_v`. ==== \ No newline at end of file diff --git a/docs/en/modules/registry-develop/pages/registry-admin/external-integration/api-publish/index.adoc b/docs/en/modules/registry-develop/pages/registry-admin/external-integration/api-publish/index.adoc index f6892e2223..872c4f5de1 100644 --- a/docs/en/modules/registry-develop/pages/registry-admin/external-integration/api-publish/index.adoc +++ b/docs/en/modules/registry-develop/pages/registry-admin/external-integration/api-publish/index.adoc @@ -3,9 +3,13 @@ == Section overview -* xref:registry-develop:registry-admin/external-integration/api-publish/rest-soap-api-expose.adoc[] +* Private data +** xref:registry-develop:registry-admin/external-integration/api-publish/rest-soap-api-expose.adoc[] //* ШБО "Трембіта" //** xref:registry-develop:registry-admin/external-integration/api-publish/trembita-bp-invoking.adoc[] //** xref:registry-develop:registry-admin/external-integration/api-publish/trembita-data-invoking.adoc[] //* Інші реєстри та системи -* xref:registry-develop:registry-admin/external-integration/api-publish/get-jwt-token-postman.adoc[] \ No newline at end of file +** xref:registry-develop:registry-admin/external-integration/api-publish/get-jwt-token-postman.adoc[] + +* Public data +** xref:registry-admin/external-integration/api-publish/public-api/expose-public-api.adoc[] \ No newline at end of file diff --git a/docs/en/modules/registry-develop/pages/registry-admin/external-integration/api-publish/public-api/expose-public-api.adoc b/docs/en/modules/registry-develop/pages/registry-admin/external-integration/api-publish/public-api/expose-public-api.adoc new file mode 100644 index 0000000000..8a79bd73f8 --- /dev/null +++ b/docs/en/modules/registry-develop/pages/registry-admin/external-integration/api-publish/public-api/expose-public-api.adoc @@ -0,0 +1,230 @@ += Configuring access to registry's public data +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] + +include::platform:ROOT:partial$admonitions/language-en.adoc[] + +== Overview + +Third-party systems and users can retrieve public information from the registry in its current state and process and visualize it without authentication using the public API access points. + +This document consists of two main parts: creation and publication of access points at the level of the registry regulations and access configuration at the registry's configuration level. + +== Usage scenarios + +The platform provides the following functionality for working with public data in the registry:: + +* [*] Publication of search queries +* [*] Configuration of public API resources +* [*] Creation of integration points for the public API by the technical administrator of the registry +* [*] Accessing documentation and using the public API +* [*] Monitoring the status and use of public search criteria +* [*] Adjusting rate limits for existing integration points + +== Action plan for configuration and use + +Follow the action plan below to configure and use the public APIs in the registry: + +Configuration at the registry regulations level: :: ++ +[%interactive] +* [ ] xref:#regulations-modeling[] +* [ ] xref:#regulations-api-publish[] +* [ ] xref:#view-endpoints-openapi[] + +Configuration at the registry's configuration level: :: ++ +[%interactive] +* [ ] xref:#control-plane-public-access[Configuring access to public data and setting rate limits] +* [ ] (_Optional_) xref:#grafana-monitoring[] +* [ ] (_Optional_) xref:#public-user-account[] + +[#regulations-modeling] +== Registry regulations modeling + +. Open the *Administrative Portal* and create a candidate version. ++ +TIP: Learn more about this on the page xref:registry-admin/admin-portal/version-control/create-new-change-request.adoc[]. + +. Navigate to *Tables* > *Structure description file* and add a new changeset with a Search Condition. ++ +[TIP] +==== +* Read more about the structure description file on the page xref:registry-admin/admin-portal/registry-modeling/tables/xml-editor.adoc[]. + +* Learn more about search criteria (Search Conditions) on the page xref:data-modeling/data/physical-model/liquibase-ddm-ext.adoc[]. +==== + ++ +image:registry-develop:registry-admin/external-integration/api-publish/public-api/expose-public-api-1.png[] + +. Determine which specific search criterion you want to make public. Add a new changeset with the `exposeSearchCondition` tag and the `publicAccess` attribute. ++ +[source,xml] +---- + +---- ++ +TIP: For more detailed information on `exposeSearchCondition`, see xref:data-modeling/data/physical-model/liquibase-ddm-ext.adoc#exposeSearchCondition[API access setting tag in the registry]. + ++ +[NOTE] +==== +We recommend setting up page-based pagination (type `page`) to manage the display of data returned from `exposeSearchCondition` (`count`). Also, set the `limit` to the number of registry data items returned in the response. + +Learn more about the `limit` and `pagination` in the following documentation sections: + +* xref:data-modeling/data/physical-model/liquibase-ddm-ext.adoc#limit-attribute-values[Limit attribute] +* xref:data-modeling/data/physical-model/liquibase-ddm-ext.adoc#pagination-attribute-values[Pagination attribute] +==== + +. Proceed to the next section for publishing the data model in the regulation. + +[#regulations-api-publish] +== Publishing the API in the registry regulations + +Publish the data model by applying changes to the master version of the regulations. The API access point for the data will be generated based on each defined search criterion. + +TIP: Learn more about publishing changes to the regulation in the section xref:registry-admin/admin-portal/version-control/overview-new-change-request.adoc#push-changes-master[Applying changes to the master version]. + +[#view-endpoints-openapi] +== Viewing published APIs in Swagger + +After completing all stages of publication, you can review the submitted search queries available for public access in the OpenAPI specification. To do this: + +. Navigate to the OpenShift cluster management web interface. +. Select the project with your registry, open Networking > Routes, and follow the link to the *`platform-gateway-kong-proxy`* service. ++ +[NOTE] +==== +Be sure to add `/openapi` to the end of the URL; otherwise, you will be directed to a sandbox environment with pet endpoints. Your browser URL should look like this: + +---- +https://example.com/api/public/data-factory/openapi +---- +==== + +. Open openapi and find the published public endpoints. +. Copy the endpoint name to the clipboard and proceed to the next setup step. ++ +image:registry-develop:registry-admin/external-integration/api-publish/public-api/expose-public-api-2.png[] + +[NOTE] +==== + +TTL-based caching is set for links to API documentation for GET requests to reduce the load on the Kong API Gateway service. The response is cached using the `proxy-cache` plugin. + +You can configure the cache value at the plugin configuration level through Gerrit. The default value is 15 minutes. + +The cache is stored in the memory of the API Gateway. +==== + +[#control-plane-public-access] +== Configuring access to public data + +=== Configuring access to public data and setting rate limits + +Enable access to public data and set rate limits. + +. Log in to the *Control Plane* admin panel. +. On the *Registry information* tab, find the *Public access* section. +. Click the *`Grant access`* button. +. In the new window, fill in the fields: + +* *Service request name*: enter the service request name. For example, `city-lab`. + +* *Integration point*: indicate the integration point, configured by the regulation developer at the xref:#regulations-modeling[] stage and published in the API registry service. For example, `/search-laboratories-by-city`. + +* Set *rate limits* for access -- the number of requests from users/systems per unit of time, for example, per hour, month, etc. + +. Click the *`Grant`* button. ++ +image:registry-develop:registry-admin/external-integration/api-publish/public-api/expose-public-api-3.png[] + +. Go to the *Update Requests* section, open and confirm the new request. The proposed changes will be applied to the registry settings in the *_deploy-templates/values.yaml_* file. ++ +image:registry-develop:registry-admin/external-integration/api-publish/public-api/expose-public-api-5.png[] ++ +TIP: See more about confirming changes on the xref:admin:registry-management/control-plane-submit-mr.adoc[] page. ++ +After configuration, the registry setup will look like this: ++ +[source,yaml] +---- +publicApi: + - name: vpo-person-type-test + url: /vpo-person-type-contains-name-public-test + limits: + second: 5 + hour: 100 + enabled: true + - ... +---- ++ +Once the deployment pipeline is executed, public access to the data via the specified API endpoint will be available. + +=== Checking the operation of public access + +. Open the browser in _Incognito_ mode and paste the link to the added search query copied in the xref:#view-endpoints-openapi[] section. ++ +image:registry-develop:registry-admin/external-integration/api-publish/public-api/expose-public-api-6.png[] + +. An unauthenticated user/system will receive data in JSON format. ++ +image:registry-develop:registry-admin/external-integration/api-publish/public-api/expose-public-api-6-1.png[] ++ +[CAUTION] +==== +When the limit is reached, an API Gateway response is generated with code 429 and a body: +---- +{ "message": "API rate limit exceeded" } +---- +==== + +=== Access management + +. Edit integration points and rate limits: :: + +.. Click on the _edit_ icon 🖉 next to the relevant request. +.. Make the necessary changes and confirm them. ++ +image:registry-develop:registry-admin/external-integration/api-publish/public-api/expose-public-api-7.png[] + +. Block access by clicking the _block_ icon 🔒. Technically, this will mean suspending access to a particular API endpoint. ++ +TIP: Access can be restored by clicking on _unblock_ (_double click on the blocked item_ 🔒). ++ +image:registry-develop:registry-admin/external-integration/api-publish/public-api/expose-public-api-7-1.png[] + +. Revoke access entirely by clicking on the _delete_ icon 🚫. ++ +NOTE: After each action, check and confirm the application of changes in the +++Update Requests+++ section. + +CAUTION: If you delete existing integration points or temporarily disable them, the user will receive an HTTP 404 error message when trying to access them. + +[NOTE] +==== +Changing the status icons following the public API in the *Public access* section means that the created update request has been applied to the `master` branch, and the changes have been incorporated into the registry configuration file -- _deploy-templates/values.yml_. +To verify the successful application of changes and the correctness of the set access to public endpoints, the technical registry administrator must check the `master` branch pipeline status. +==== + +[#grafana-monitoring] +== Grafana metrics monitoring + +The Platform has a Grafana dashboard designed for monitoring performance metrics and the number of requests to public integration points from unauthenticated users and third-party systems. + +image:registry-develop:registry-admin/external-integration/api-publish/public-api/expose-public-api-4.png[] + +The technical registry administrator can use the data from the dashboard to track dynamics and the status of metrics. This data can help determine the need for optimization settings, such as adjusting request limits. + +TIP: For detailed monitoring information, you can review the page xref:registry-admin/grafana-monitoring/public-api-kong-metrics.adoc[]. + +[#public-user-account] +== Creating a service account for executing public requests + +Although formally the integration points are public, to maintain consistency in audit and logging within the Platform, such requests will be made on behalf of a service user from the Keycloak realm `external-system`. The system will automatically create a service user `public-user` for authorization at the `platform-gateway` level. + +_Ensure_ that such a system user is created in the appropriate realm of the Keycloak service. To do this: + +. Open the Keycloak authentication and authorization service. +. Find the `-external-system` realm for your registry. +. Open the *Clients* menu > `public-user`. \ No newline at end of file diff --git a/docs/en/modules/registry-develop/pages/registry-admin/external-integration/api-publish/rest-soap-api-expose.adoc b/docs/en/modules/registry-develop/pages/registry-admin/external-integration/api-publish/rest-soap-api-expose.adoc index edb30bd734..89a3f8c172 100644 --- a/docs/en/modules/registry-develop/pages/registry-admin/external-integration/api-publish/rest-soap-api-expose.adoc +++ b/docs/en/modules/registry-develop/pages/registry-admin/external-integration/api-publish/rest-soap-api-expose.adoc @@ -1,56 +1,37 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - -//= Налаштування регламенту для надання доступу до даних через SOAP та REST API = Configuring the regulations to provide access to data via SOAP and REST APIs +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] + +include::platform:ROOT:partial$admonitions/language-en.adoc[] -//Якщо ваш реєстр є власником даних, і ви хочете виставляти інтеграційні API-точки, отримувати запити та віддавати дані іншим реєстрам або системам, виконайте наступні налаштування регламенту: If your registry is the data owner, and you wish to establish integration API points, receive requests, and provide data to other registries and systems, configure the following regulations settings: -//. xref:#authorization-settings[Виконайте авторизаційні налаштування -- надайте доступ для виклику бізнес-процесу]. . xref:#authorization-settings[Set up authorization and grant permission to call the business process]. -//. xref:#target-registry-bp-modeling[Змоделюйте бізнес-процес, що викликатиметься іншим реєстром]. . xref:#target-registry-bp-modeling[Model the business process to be called by another registry]. -//. xref:#create-data-model[Створіть модель даних (надайте доступ на читання даних реєстру через API-представлення)] . xref:#create-data-model[Create a data model and provide read access to the registry data via the API representation)]. [NOTE] ==== -//Для REST-взаємодії необхідно також надати доступ до реєстру в адміністративній панелі *Control Plane*. Детальніше про це -- див. на сторінці xref:admin:registry-management/control-plane-registry-grant-access.adoc[]. For REST interactions, you must also grant access to the registry in the *Control Plane* admin console. For details, see xref:admin:registry-management/control-plane-registry-grant-access.adoc[]. ==== [#authorization-settings] -//== Налаштування авторизації для доступу до бізнес-процесів реєстру == Setting up authorization to access the registry business processes -//Адміністратор реєстру має виконати налаштування авторизації на рівні регламенту. -Registry administrator must set up authorization at the regulations level. +Registry administrators must set up authorization at the registry regulations level. [NOTE] ==== -//Виконайте налаштування у 2-х конфігураційних файлах: :: + Configure the following files: :: -//* *_bp-auth/external-system.yml_* -- відповідає за доступ до бізнес-процесів; * *_bp-auth/external-system.yml_* defines access to business processes -//* *_bp-trembita/external-system.yml_* -- відповідає за обмін даними (передачу параметрів) для запуску бізнес-процесу. + * *_bp-trembita/external-system.yml_* configures the exchange of parameters for starting the business processes ==== -//. Налаштуйте доступ до бізнес-процесів у цільовому реєстрі, який надаватиме свій API для обміну даними. . Set up access to the business processes in the target registry, which will provide a data exchange API. + -//Для цього перейдіть до файлу *_bp-auth/external-system.yml_* у регламенті та визначте конфігурацію: To do this, configure the _bp-auth/external-system.yml_ file in the regulations: -//.Конфігураційний файл для надання доступу до бізнес-процесів у цільовому реєстрі + .A configuration that grants access to the business processes in the target registry ==== @@ -67,24 +48,17 @@ authorization: ---- ==== + -//У цьому прикладі ми вказуємо, що доступ необхідно надати до бізнес-процесу `my-process-id` для ролі `*trembita-invoker*` з Keycloak-реалму `*-external-system*`. Параметри `process_name` та `process_description` є опціональними, і не впливають на процес авторизації. In this example, access to the `my-process-id` business process is granted for the `*trembita-invoker*` role from the `*-external-system*` Keycloak realm. The `process_name` and `process_description` parameters are optional and do not affect authorization. + -//IMPORTANT: Клієнт `*trembita-invoker*` з однойменною роллю створюється автоматично оператором Keycloak в реалмі `*-external-system*` при розгортанні реєстру. Облікові дані цього клієнта необхідно використовувати для всіх зовнішніх систем, яким потрібен доступ до реєстру на Платформі. IMPORTANT: The `*trembita-invoker*` client with the same role is automatically created by the Keycloak operator in the `*-external-system*` realm when the registry is deployed. All external systems that require access to the registry on the Platform must use this client's credentials. -+ -//. Налаштуйте файл *_bp-trembita/external-system.yml_* у регламенті: + . Configure the *_bp-trembita/external-system.yml_* file in the regulations: -+ -//* Налаштуйте змінні старту бізнес-процесу. Для цього вкажіть, які параметри очікуватиме бізнес-процес у блоці *`start_vars`*. + .. Configure the start variables for the business process. To do this, specify which parameters the business process will expect in the *`start_vars`* section. + -//IMPORTANT: Без визначення *`start_vars`* бізнес-процес не запрацює. IMPORTANT: If *`start_vars`* are not defined, the business process will not work. -+ -//* Налаштуйте змінні повернення. Для цього вкажіть у блоці *`return_vars`*, які параметри повертатиме бізнес-процес. + .. Configure the return variables. To do this, specify which parameters the business process will return in the *`return_vars`* section. -//.Налаштування API-контракту для бізнес-процесу + .Configuring an API contract for a business process ==== @@ -101,51 +75,40 @@ trembita: ---- ==== + -//У цьому прикладі ми вказуємо, що для запуску бізнес-процесу `*my-process-id*` у цільовому реєстрі, необхідно передати стартові змінні. Без них ви не зможете ініціювати бізнес-процес. Тут ми передаємо параметр `eduname` -- умовне ім'я учня. In this example, the `*my-process-id*` business process in a target registry requires start variables to run. Without them, the process cannot be initiated. In particular, the process expects the `eduname` parameter to contain a student's name. + -//TIP: Приклад, як прийняти змінні у цільовому процесі, див. у розділі нижче: xref:#target-registry-bp-modeling[]. TIP: For an example of accepting variables in a target process, jump to xref:#target-registry-bp-modeling[]. -+ -//* Також налаштуйте змінні повернення. Тут ми налаштовуємо, що бізнес-процес повертатиме параметри `id` та `name`. Вони будуть записані до змінної результату в *Output Parameters* цієї ж сервісної задачі з делегатом. + .. Configure the return variables. In this example, the business process will return the `id` and `name` parameters. They will be written to the result variable in the *Output Parameters* of the same service task with the delegate. [#create-data-model] -//== Налаштування моделі даних == Configuring the data model -//Створіть модель даних реєстру. Додайте нові критерії пошуку, що надаватимуть доступ на читання даних БД через API-представлення реєстру. Create a registry data model. Add new search conditions to provide read access to database data through the registry API representation. [TIP] -//Детальніше про налаштування моделі даних ви можете переглянути на сторінці xref:registry-develop:data-modeling/data/physical-model/rest-api-view-access-to-registry.adoc[]. For details on configuring the data model, see xref:registry-develop:data-modeling/data/physical-model/rest-api-view-access-to-registry.adoc[]. [#target-registry-bp-modeling] -//== Моделювання бізнес-процесу для виклику у цільовому реєстрі == Modeling the business process to be called in a target registry -//Змоделюйте бізнес-процес, до якого звертатимуться інші реєстри для отримання даних. Це може бути будь-який процес, передбачений бізнес-логікою вашого реєстру. Model a business process that other registries will call to obtain data. This can be any process within your registry's business logic. [NOTE] ==== -//Для того, щоб запустити бізнес-процес у вашому реєстрі, вам необхідно прийняти надіслані стартові змінні, які очікуються. Це можна зробити за допомогою скрипт-задачі, як показано на прикладі. To start a business process in your registry, the system needs to accept the incoming start variables it expects. This is done using a scripted task, as shown in the following example. -//.Приймання стартових змінних процесу у цільовому реєстрі .Accepting the process start variables in a target registry image::registry-admin/external-integration/rest-api-no-trembita/accept-map-params-bp.png[] ==== [TIP] ==== -//Приклад _.bpmn_-моделі процесу, а також користувацькі _.json_-форми до нього ви можете знайти у регламенті демо-реєстру *_consent-data_* за посиланням: -To see an example of the _.bpmn_ model of a process with a user _.json_ form, refer to the *_consent-data_* demo registry's regulations here: -//TODO: Link to demo doesn't work - -https://admin-tools-consent-data.apps.envone.dev.registry.eua.gov.ua/gerrit +[%collapsible] +.Where can I find an example of a reference business process? +===== +include::partial$snippets/demo-reg-reference-examples-en.adoc[] -//Процес буде доступний за назвою *_BPMN-create-school-auto-sign.bpmn_*. Назви форм ви можете знайти всередині відповідних користувацьких задач бізнес-процесу у полі *`Form key`*. -The process is called *_BPMN-create-school-auto-sign.bpmn_*. You can find the names of the forms inside the corresponding user tasks of the business process in the *Form key* field. +An example of a BPMN process diagram will be available in the demo-registry's regulations by searching for the keywords -- *_create-school-auto-sign_*. The names of the forms can be found inside the corresponding User Tasks of the business process in the *`Form key`* field. +===== ==== \ No newline at end of file diff --git a/docs/en/modules/registry-develop/pages/registry-admin/external-integration/ext-integration-overview.adoc b/docs/en/modules/registry-develop/pages/registry-admin/external-integration/ext-integration-overview.adoc index 486f25c43f..8d07888be5 100644 --- a/docs/en/modules/registry-develop/pages/registry-admin/external-integration/ext-integration-overview.adoc +++ b/docs/en/modules/registry-develop/pages/registry-admin/external-integration/ext-integration-overview.adoc @@ -1,177 +1,105 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - -//= Управління зовнішніми інтеграціями = Managing external integrations +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] + +include::platform:ROOT:partial$admonitions/language-en.adoc[] -//== Загальні положення == General description -//Управління зовнішніми інтеграціями відіграє критичну роль у забезпеченні інформаційного обміну між різними системами та джерелами даних. Management of external integrations plays a critical role in ensuring information exchange between different systems and data sources. -//REST (Representational State Transfer) та SOAP (Simple Object Access Protocol) є двома основними протоколами взаємодії з іншими реєстрами та системами, що використовуються для передачі даних. -REST (Representational State Transfer) and SOAP (Simple Object Access Protocol) are two main protocols used for interaction with other registries and systems to transmit data. +*_REST_* (*_Representational State Transfer_*) and *_SOAP_* (*_Simple Object Access Protocol_*) are the primary protocols for interacting with other registries and systems to transmit data. -//REST, що базується на протоколі HTTP, дозволяє взаємодіяти з іншими реєстрами на Платформі та зовнішніми системами шляхом передачі запитів та отримання відповідей у форматі JSON. + -//SOAP, з іншого боку, використовує XML-схему для взаємодії з іншими системами, дозволяючи викликати методи й передавати параметри використовуючи певний набір правил. -REST, based on the HTTP protocol, allows interaction with other registries on the Platform and external systems by sending requests and receiving responses in JSON format. + -SOAP, on the other hand, uses an XML schema to interact with other systems, enabling the invocation of methods and passing parameters using a specific set of rules. +Based on the HTTP protocol, *_REST_* allows interaction with other registries on the Platform and external systems by sending requests and receiving responses in JSON format. + +On the other hand, *_SOAP_* uses an XML schema to interact with other systems, invocating methods and passing parameters using a specific set of rules. -//Основні принципи інтеграції з іншими реєстрами та системами: :: -Key principles of integration with other registries and systems: :: +Fundamental principles of integration with other registries on the Platform and external systems: :: -//. Регламент реєстру не містить налаштувань, які залежать від "оточення"/екземпляра реєстру, щоб забезпечити однаковість налаштувань для всіх екземплярів. -. The registry regulations do not contain environment-specific settings to ensure consistency of settings across all instances. -+ -//. Регламент реєстру не містить конфіденційних даних ні в якій формі, щоб запобігти їх неправомірному використанню. +. The registry regulations do not contain environment-specific settings to ensure configuration consistency across all instances. . The registry regulations do not contain any confidential data in any form to prevent unauthorized use. -+ -//. Налаштування параметрів зовнішніх інтеграцій не дублюється та використовується централізовано, що забезпечує консистентність налаштувань. . Configuration settings for external integrations are not duplicated and are centrally used to ensure consistency. -+ -//. Додавання зовнішніх систем для інтеграції з реєстром не потребує ручних дій налаштування мережевих політик для забезпечення швидкої та безпечної інтеграції. . Adding external systems for integration with the registry does not require manual configuration of network policies to facilitate fast and secure integration. -+ -//. Секрети з параметрами доступу до зовнішніх систем зберігаються у захищеному сховищі сервісу управління секретами `HashiCorp Vault`, щоб запобігти несанкціонованому доступу до цих даних. -. Secrets with access parameters to external systems are stored in a secure vault service called `HashiCorp Vault` to prevent unauthorized access to this data. -+ -//. Адміністратор реєстру налаштовує інтеграції з іншими системами на рівні екземпляра реєстру в адміністративній панелі Control Plane, включаючи протокол інтеграції, адресу, протокол аутентифікації, секрети тощо. +. Secrets with access parameters to external systems are stored in a secure vault service called *HashiCorp Vault* to prevent unauthorized access to this data. . The registry administrator configures integrations with other systems at the registry instance level in the *Control Plane* administrative panel, including integration protocol, address, authentication protocol, secrets, etc. -+ -//. Адміністратор реєстру відповідає за ротацію секретів та параметрів доступу до зовнішніх систем. . The registry administrator is responsible for secret rotation and access parameter management for external systems. +. The administrator provides minimal pre-configuration at the registry regulation level for external integrations in business processes. +. Cross-registry SOAP integration uses standard extension connectors in the registry and does not require additional configuration at the regulation level. Such integration is performed via the Ukrainian https://trembita.gov.ua/["Trembita" Secure exchange gateway]. + -//. Адміністратор забезпечує мінімальну попередню конфігурацію на рівні регламенту для використання зовнішніх інтеграцій у бізнес-процесах. -. The administrator provides minimal pre-configuration at the registry regulation level for the use of external integrations in business processes. -+ -//// -//TODO: commenting the next line since it is related to ua-specific tool Trembita. In this doc further I will comment any sentence about Trembita. -. Міжреєстрова інтеграція через "Трембіту" здійснюється за допомогою типових розширень-конекторів, які містяться у реєстрі, і не вимагає додаткової конфігурації на рівні регламенту. -//// -+ -//. Інтеграція зі сторонніми (3rd-party) системами потребує додаткової конфігурації на рівні регламенту, зокрема необхідно визначити перелік операцій та їх типів, які використовує реєстр через типове інтеграційне розширення-конектор *Connect to external system* (*REST*-конектор). -. Integration with third-party systems requires additional configuration at the registry regulation level, including defining a list of operations and their types used by the registry through the standard integration connector extension *Connect to external system* (*REST* connector). +include::ROOT:partial$admonitions/ua-specific.adoc[] + +. The SOAP integration is also possible through the universal SOAP connector that extends Platform capabilities. See xref:#soap-integration[] for more details. + +. Integration with third-party systems requires additional configuration at the registry regulation level, including defining a list of operations and their types used by the registry through the standard *REST* integration extension—*Connect to external system* or simply *REST connector*. + [IMPORTANT] ==== -//Для версій Платформи 1.9.3 та вище основні налаштування виконуються на рівні екземпляра реєстру у консолі Control Plane. + For Platform versions 1.9.3 and above, major configurations are performed at the registry instance level in the *Control Plane* console. -//Для версій 1.9.2 та нижче усі налаштування виконуються на рівні регламенту реєстру. For versions 1.9.2 and below, all configurations are performed at the registry regulations level. ==== [NOTE] ==== -//Налаштування взаємодії із зовнішніми системами можливе лише при редагуванні реєстру. Interaction settings with external systems are only possible during registry editing. -//// -За замовчуванням при розгортанні реєстру, створюється три не налаштовані точки для сервісів ШБО "Трембіта" й одна для зовнішньої системи -- "Дія". -//// -==== -//== Типи інтеграційної взаємодії -== Integration interaction types +By default, when deploying the registry, three unconfigured endpoints are created for the "Trembita" SOAP services and one for the external system "Diia". + +TIP: "Trembita" and "Diia" services are specific to the Ukrainian implementation and may not apply or function as described in other contexts or regions. Please consult the local guidelines or documentation if you are implementing this outside Ukraine. +==== -//Платформа дозволяє гнучко інтегруватися з іншими реєстрами та системами й підтримує 2 типи взаємодії: :: -The platform allows for flexible integration with other registries and systems and supports the following interaction: :: +== Integration types +The Platform allows for flexible integration with other registries and systems and supports the following interaction: :: *SOAP API* :: -//TODO: Translated the below passage without mentioning Trembita. Please review. -//Взаємодія через інтерфейси ШБО "Трембіта" за допомогою SOAP-інтеграційних конекторів. Це основний тип інтеграційної взаємодії. Екземпляр ШБО встановлюється на рівні Платформи. Кожна подібна зовнішня система повинна мати встановлений екземпляр ШБО на своїй стороні та бути зареєстрованим учасником єдиного захищеного простору, який називають СЕВ ДЕІР "Трембіта", де основним протоколом інтеграційної взаємодії є SOAP. -Interaction through the API using SOAP integration connectors. This is the primary type of integration interaction. An instance of the API is installed at the Platform level. Each external system of this kind must have an instance of the API installed on its side and be a registered participant in the unified secure space, where SOAP is the main protocol of integration interaction. +_Interaction through the API using SOAP integration connectors_ is the primary type of integration interaction. An instance of the API is installed at the Platform level. Each external system of this kind must have an instance of the API installed on its side and be a registered participant in the unified, secure space where SOAP is the primary protocol for integration. *REST API* :: -//Взаємодія з іншими реєстрами на Платформі та зовнішніми системами поза її межами через REST-інтерфейси. Це додатковий тип підключення розширення можливостей інтеграційної взаємодії. -Interaction with other registries on the Platform and external systems beyond its boundaries through REST interfaces. This is an additional type of connection that extends the capabilities of integration interaction. +_Interaction with other registries on the Platform and external systems beyond its boundaries through REST interfaces_ is an additional universal connection that extends the integration capabilities. -//TODO: commenting the below section since it is linked to the ua-specific tool Trembita. Please add below some general phrases about using the SOAP and not mentioning Trembita. -//// -[#exchange-data-trembita] -=== Обмін даними за допомогою SOAP через програмний інтерфейс "Трембіта" +[#soap-integration] +=== Data exchange via SOAP -ШБО "Трембіта" є програмним інтерфейсом, який дозволяє взаємодіяти з реєстрами, які до нього підключені, зокрема ЄДР, ДРАЦС, або ЄІБДВПО. +The Platform allows modeling data exchange with other registries and their services in the regulation's business processes using SOAP integration connectors. -Загальний механізм взаємодії з реєстрами через ШБО "Трембіта" представлено на діаграмі нижче. +Data exchange between such systems occurs via the SOAP (Simple Object Access Protocol) in XML format. -.Загальний механізм взаємодії з реєстрами через ШБО "Трембіта" -image::registry-admin/external-integration/cp-integrate-trembita/trembita-integration.png[] - -Для успішної взаємодії з реєстрами через ШБО "Трембіта", необхідно дотримуватися вимог щодо формату даних та забезпечити їх правильну обробку в системі. Обмін даними між реєстрами-учасниками СЕВ ДЕІР "Трембіта" відбувається за протоколом SOAP (Simple Object Access Protocol) у форматі XML. - -SOAP-взаємодія між реєстрами через ШБО "Трембіта" є надійним і безпечним методом передачі даних. Дані передаються у зашифрованому вигляді, що забезпечує їх конфіденційність. Також ШБО "Трембіта" дозволяє перевіряти правдивість запитів, що запобігає можливим атакам. - -Щоб налаштувати взаємодію з реєстрами через ШБО "Трембіта", Вам необхідно: :: - -. Зареєструвати підсистему нового реєстру на ШБО "Трембіта" Платформи: - -* Зареєструвати свою організацію в системі "Трембіта" та вказати необхідні реквізити. -* Узгодити та отримати доступ до необхідних сервісів СЕВ ДЕІР "Трембіта". -+ -TIP: Детальніше -- див. на сторінці xref:registry-admin/external-integration/registration-subsystem-trembita/registration-subsystem-trembita.adoc[] -+ -Якщо підсистема зареєстрована, перейдіть до наступного кроку. - -. Налаштувати взаємодію з реєстрами, до яких Ви отримали доступ, в адміністративній панелі *Control Plane*. -+ -TIP: Детальніше -- див. на сторінці xref:registry-admin/external-integration/cp-integrate-trembita.adoc[]. - -. Змоделювати обмін даними з іншими реєстрами та їх сервісами через ШБО "Трембіта" у бізнес-процесах за допомогою SOAP-інтеграційних конекторів. -+ -TIP: Детальніше -- див. на сторінці xref:bp-modeling/external-integration/api-call/connectors-external-registry.adoc[]. -//// +TIP: For more details see xref:bp-modeling/external-integration/api-call/connectors-external-registry.adoc[]. [#exchange-data-ext-system] -//=== Обмін даними з іншими системами за допомогою REST -=== Data exchange with other systems using REST +=== Data exchange via REST -//Інтеграційна REST-взаємодія реєстрів з іншими реєстрами на Платформі та зовнішніми системами означає можливість передачі даних з одного реєстру в інший або між зовнішніми системами за допомогою *REST*-запитів. -The integration REST interaction of registries with other registries on the Platform and external systems allows the transfer of data from one registry to another or between external systems using REST requests. +The REST integration of registries with other registries on the Platform and external systems allows data transfer from one registry to another or between external systems using REST requests. -//*REST (Representational State Transfer)* -- це стиль архітектури програмного забезпечення для створення вебсервісів. У REST-архітектурі існує ряд обмежень, які забезпечують взаємодію між клієнтом та сервером. REST використовує *HTTP*-протокол для передачі даних. -*REST (Representational State Transfer)* is a software architecture style for creating web services. In the REST architecture, there are a set of constraints that ensure the interaction between the client and the server. REST utilizes the *HTTP* protocol for data transmission. +*REST (Representational State Transfer)* is a software architecture style for creating web services. In the REST architecture, there is a set of constraints that ensure the interaction between the client and the server. REST utilizes the *HTTP* protocol for data transmission. -//Така взаємодія використовує програмні інтерфейси *REST API* та HTTP-запити для отримання інформації. Інтерфейс може забезпечити доступ до функціональності реєстру, а також надати можливість зчитувати та змінювати дані. Передача даних здійснюється у форматі *JSON*. Дані можуть бути передані в обидві сторони -- від зовнішньої системи до реєстру або від реєстру до зовнішньої системи. -Such interaction utilizes the *REST API* and *HTTP* requests to obtain information. The interface can provide access to the registry's functionality and allow reading and modifying data. Data is transmitted in the *JSON* format. Data can be transferred in both directions - from the external system to the registry or from the registry to the external system. +Such interaction utilizes the *REST API* and *HTTP* requests to obtain information. The interface can access the registry's functionality and allow reading and modifying data. Data is transmitted in the *JSON* format. Data can be transferred in both directions—from the external system to the registry or from the registry to the external system. -//Щоб налаштувати взаємодію з іншими системами за допомогою REST, Вам необхідно: :: To set up the interaction with other systems using REST, you need to: :: + -//. Налаштувати взаємодію з реєстрами в адміністративній панелі *Control Plane*. . Configure the interaction with registries in the *Control Plane* administrative panel. + -//TIP: Детальніше -- див. на сторінці TIP: For more information, see xref:registry-admin/external-integration/cp-integrate-ext-system.adoc[]. + -//. Виконати мінімальні налаштування на рівні регламенту. -. Perform minimal configuration at the regulations level. + +. Perform minimal configuration at the registry regulations level. + -//TIP: Детальніше -- див. на сторінці TIP: For more information, see -xref:registry-develop:bp-modeling/bp/rest-connector.adoc#regulations-configuration[REST-конектор: налаштування регламенту]. -+ -//. Змоделювати обмін даними з іншими системами у бізнес-процесах за допомогою інтеграційного REST конектора *Connect to external system*. +xref:registry-develop:bp-modeling/bp/rest-connector.adoc#regulations-configuration[REST connector: Registry regulations' settings]. + . Model data exchange with other systems in business processes using the *Connect to external system* REST integration connector. + -//TIP: Детальніше -- див. на сторінці TIP: For more information, see -xref:registry-develop:bp-modeling/bp/rest-connector.adoc#bp-modeling[REST-конектор: моделювання у бізнес-процесі]. +xref:registry-develop:bp-modeling/bp/rest-connector.adoc#bp-modeling[REST connector: Business process modeling]. -//NOTE: Розгорнуту інформацію щодо можливостей REST-інтеграції ви можете отримати на сторінці -NOTE: For a detailed information on REST integration, see +NOTE: For detailed information on REST integration, see xref:registry-admin/external-integration/rest-api-no-trembita.adoc[]. -//== Додаткові відеоматеріали -== Additional video materials +== Related pages + +* xref:bp-modeling/external-integration/api-call/connectors-external-registry.adoc[] +* xref:registry-admin/external-integration/cp-integrate-ext-system.adoc[] +* xref:registry-develop:bp-modeling/bp/rest-connector.adoc[REST connector] +* xref:registry-admin/external-integration/rest-api-no-trembita.adoc[] -video::lRLCfFwWXxk[youtube, width=680, height=380] \ No newline at end of file diff --git a/docs/en/modules/registry-develop/pages/registry-admin/external-integration/rest-api-no-trembita.adoc b/docs/en/modules/registry-develop/pages/registry-admin/external-integration/rest-api-no-trembita.adoc index 3e91eb2d18..1b1f739b2c 100644 --- a/docs/en/modules/registry-develop/pages/registry-admin/external-integration/rest-api-no-trembita.adoc +++ b/docs/en/modules/registry-develop/pages/registry-admin/external-integration/rest-api-no-trembita.adoc @@ -1,272 +1,191 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Interacting via REST between Platform registries and with external systems +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] + +include::platform:ROOT:partial$admonitions/language-en.adoc[] -//== Загальний опис == General description -//Платформа підтримує [.underline]#інтеграційну взаємодію реєстрів# за допомогою *REST API*-інтерфейсів. Така взаємодія можлива завдяки [.underline]#Підсистемі міжреєстрових інтеграцій#. -The Platform supports [.underline]#integrative interaction of registries# using *REST API* interfaces. This interaction is made possible due to the [.underline]#Inter registry integration subsystem#. +The Platform supports [.underline]#integrative interaction of registries# using *REST API* interfaces. This interaction is possible due to the [.underline]#Inter registry integration subsystem#. -//Функціональність забезпечує інтероперабельність Платформи з можливістю надавати доступи до бізнес-процесів та API читання даних, а також дозволяє читати дані та викликати бізнес-процеси в інших реєстрах. The functionality ensures interoperability of the Platform, providing access to business processes and data reading APIs, as well as allowing reading data and invoking business processes in other registers. -//// -//TODO: not sure if the below paragraphs is needed. -За замовчуванням на Платформі використовується інтеграційна взаємодія між реєстрами через шлюз безпечного обміну (ШБО) https://trembita.gov.ua/ua[«Трембіта»]. Така взаємодія здійснюється за протоколом SOAP та вимагає розв'язання підготовчих питань у юридичній площині (_див. детальніше -- xref:registry-develop:registry-admin/external-integration/registration-subsystem-trembita/registration-subsystem-trembita.adoc[]_). -By default, the Platform utilizes interregister interaction between registers through the secure exchange gateway (SEG) *Trembita* (for details, see https://trembita.gov.ua/ua[«Трембіта»]). This interaction is carried out using the SOAP protocol and requires resolving preparatory matters in the legal domain (for more details, see xref:registry-develop:registry-admin/external-integration/registration-subsystem-trembita/registration-subsystem-trembita.adoc[]_). -//Міжреєстрова взаємодія за допомогою REST дозволяє зменшити надлишкове використання обчислювальних потужностей, зовнішнього трафіку, скоротити час відповіді при інтеграції між реєстрами, не використовуючи SOAP-інтерфейси ШБО «Трембіта», а також відійти від складних бюрократичних механізмів. -Interregister interaction via REST allows reducing excessive utilization of computational resources, external traffic, and response time in register integration, without employing SOAP interfaces of the Trembita SEG, as well as moving away from complex bureaucratic mechanisms. -//// +By default, the Platform utilizes cross-registry interaction between registers through the Ukrainian Secure exchange gateway (SEG) *Trembita* (_for details, see https://trembita.gov.ua/ua[trembita.gov.ua]_). This interaction is carried out using the SOAP protocol. It requires resolving preparatory matters in the legal domain. + +Cross-registry interaction via REST reduces excessive utilization of computational resources, external traffic, and response time in register integration without employing SOAP interfaces of the Trembita SEG and moving away from complex bureaucratic mechanisms. -//Основні функції підсистеми міжреєстрових інтеграцій: :: -Main functions of the inter registry integration subsystem: :: +Main functions of the cross-registry integration subsystem: :: -//* [*] Надання API для виклику бізнес-процесів реєстру сторонніми для реєстру системами. * [*] Providing an API for invoking registry business processes by external systems. -+ -//* [*] Надання доступу іншим реєстрам або системам до окремих запитів читання Підсистеми управління даними реєстру. + * [*] Providing access for other registries or systems to individual data read requests of the registry data management subsystem. -+ -//* [*] Маршрутизація запитів до зовнішніх реєстрів, до яких було надано доступ. + * [*] Routing requests to external registries with granted access. -//== Схеми міжреєстрової REST-взаємодії -== Inter registry REST interaction schemes +== Cross-registry interaction: REST schemes -//Виділяють 2 схеми інтеграційної взаємодії реєстрів, що розгорнуті на Платформі: :: -There are two schemes of integration of the registries deployed on the Platform: :: +There are two integration schemes for the registries deployed on the Platform: :: * xref:#int-registry-ext-system[] * xref:#platform-registries[] [#int-registry-ext-system] -//=== REST-взаємодія реєстрів на Платформі із зовнішньою інформаційною системою === REST interaction of registries on the Platform with an external information system -//Інтеграційну взаємодію реєстрів із зовнішніми системами можна поділити на [.underline]#вихідну# та [.underline]#вхідну#, залежно від напряму трафіку. Integration interaction of registers with external systems can be divided into [.underline]#outbound# and [.underline]#inbound#, depending on the direction of traffic. -//.Взаємодія реєстрів на Платформі зі сторонньою інформаційною системою .Interaction of registries on the Platform with a third-party information system image::registry-develop:registry-admin/external-integration/rest-api-no-trembita/int-reg-ext-system.png[] - -//. [.underline]#Вихідна взаємодія# можлива завдяки інтеграційному [.underline]#REST-конектору# *Connect to external system*. Конектор має REST-інтерфейс для виклику зовнішніх ендпоінтів. Його можна використовувати при моделюванні бізнес-процесів у регламенті певного реєстру. Для автентифікації необхідно використовувати OpenShift (Kubernetes) секрети. . Outbound interaction is possible through the integration [.underline]#REST connector# -- *Connect to external system*. The connector has a REST interface for calling external endpoints. It can be used when modeling business processes in the regulations of a specific register. OpenShift (Kubernetes) secrets should be used for authentication. + -//. [.underline]#Вхідна взаємодія# можлива завдяки імплементованим реєстровим сервісам `*external-system-api-kong-proxy*` та `*registry-rest-api-ext*`. + . [.underline]#Inbound interaction# is possible through the implemented registry services: *`external-system-api-kong-proxy`* and *`registry-rest-api-ext`*. + [NOTE] -//Зовнішня система має спочатку отримати пароль доступу від адміністратора реєстру. З цим паролем -- отримати токен доступу у сервісі Keycloak. З цим токеном надалі можливо авторизуватися у сервісах та отримувати доступ до ресурсів. -The external system needs to initially obtain an access password from the registry administrator. With this password, it can obtain an access token in the Keycloak service. This token can then be used for authorization in services and accessing resources. -+ -//* Сервіс `*external-system-api-kong-proxy*` розгортається автоматично, разом з реєстром та має REST-інтерфейс, що дозволяє ініціювати бізнес-процеси у реєстрах на Платформі та отримувати з них дані. Сервіс використовує точку входу (ендпоінт) `*/startBp*` для старту бізнес-процесу. -* The *`external-system-api-kong-proxy`* service is automatically deployed along with the register and has a REST interface that allows initiating business processes in registers on the Platform and retrieving data from them. The service uses the entry point (endpoint) /*`startBp`* to start a business process. -+ -//* Сервіс `*registry-rest-api-ext*` розгортається автоматично, після створення моделі даних у регламенті реєстру. Він дозволяє звертатися до API-представлень операційної бази даних реєстру. -* The *`registry-rest-api-ext`* service is automatically deployed after creating the data model in the registry regulations. It allows accessing API representations of the registry operational database. +The external system must initially obtain an access password from the registry administrator. With this password, it can get an access token in the Keycloak service. This token can then be used to authorize in services and access the resources. + +* The *`external-system-api-kong-proxy`* service is automatically deployed along with the register. It has a REST interface allows initiating business processes in registries on the Platform and retrieving data from them. The service uses the entry point (endpoint) /*`startBp`* to start a business process. + +* The *`registry-rest-api-ext`* service is automatically deployed after creating the data model in the registry regulations. It allows access to API representations of the registry operational database. [#platform-registries] -//=== REST-взаємодія реєстрів в межах одного екземпляра Платформи === REST interaction of registries within a single Platform -//При інтеграційній взаємодії реєстрів в межах Платформи завжди є [.underline]#реєстр-клієнт (споживач/запитувач даних)# та [.underline]#цільовий реєстр (власник даних)#. During the integration interaction of registries within the Platform, there is always a [.underline]#registry client (data consumer/requester)# and a [.underline]#target registry (data owner)#. -//.REST-взаємодія реєстрів в межах одного екземпляра Платформи .REST Interaction of registries within a single Platform image::registry-develop:registry-admin/external-integration/rest-api-no-trembita/internal-registries-platform.png[] -//Реєстр-клієнт може запитати дані у цільового реєстру 2-ма шляхами: :: -The registry client can request data from the target registry in two ways: :: +The registry client can request data from the target registry in two ways through: :: + [NOTE] -//Реєстр-клієнт має спочатку отримати токен доступу іншого реєстру у сервісі Keycloak. З цим токеном надалі можливо авторизуватися у сервісах. -The registry client needs to obtain an access token from the Keycloak service for another registry. This token can be used for authentication in the services. +The registry client needs to obtain another registry's access token from the Keycloak service. This token can be used for authentication in the services. -//. Через сервіс `*bp-webservice-gateway*` -- розгортається автоматично, разом з реєстром та має REST-інтерфейс, що дозволяє ініціювати бізнес-процеси у реєстрах на Платформі та отримувати з них дані. Сервіс використовує точку входу (ендпоінт) `*/startBp*` для старту бізнес-процесу. -. Through the *`bp-webservice-gateway`* service, which is automatically deployed with the registry and has a REST interface allowing the initiation of business processes in the registries on the Platform and retrieving data from them. The service utilizes the entry point (endpoint) /*`startBp`* to start a business process. +. The *`bp-webservice-gateway`* service, which is automatically deployed with the registry and has a REST interface, allows business process initiation in the Platform's registries and retrieving data from them. The service utilizes the entry point (endpoint) /*`startBp`* to start a business process. + [NOTE] ==== -//* Ініціювати бізнес-процеси в іншому (цільовому) реєстрі можливо за допомогою спеціального розширення-делегата -- *Start business process in another registry*. Він призначений _лише_ для інтеграції реєстрів у межах Платформи. -* Initiating business processes in another (target) registry is possible using a special delegate extension called *Start business process in another registry*. It is designed solely for registry integration within the Platform. -+ -//* Отримати дані з операційної БД реєстру іншого (цільового) реєстру в рамках виконання бізнес-процесів можливо за допомогою спеціального розширення-делегата -- *Search for entities from another registry data factory*. Він призначений _лише_ для інтеграції реєстрів у межах Платформи. -* To retrieve data from the operational database of another (target) registry within the execution of business processes, a special delegate extension called *Search for entities from another registry data factory* can be used. It is intended only for registry integration within the Platform. +* Initiating business processes in another (target) registry is possible using a delegate extension called *Start business process in another registry*. It is designed solely for registry integration within the Platform. + +* To retrieve data from the operational database of another (target) registry within the execution of business processes, a delegate extension called *Search for entities from another registry data factory* can be used. It is intended only for registry integration within the Platform. ==== -+ -//. Через сервіс `*registry-rest-api-ext*` -- розгортається автоматично, після створення моделі даних у регламенті реєстру. Він дозволяє звертатися до API-представлень операційної бази даних реєстру з форм Кабінету користувача (за критеріями пошуку). + . Through the *`registry-rest-api-ext`* service, which is automatically deployed after creating a data model in the registry regulations, it is possible to access the API representations of the registry's operational database from the User interface (based on search condition) in the User portal. -//== Налаштування взаємодії між реєстрами == Setting up interaction between registries -//Налаштуйте REST-взаємодію з іншими реєстрами в межах одного екземпляра Платформи, або зовнішніми системами. Configure REST interaction with other registries within a single Platform instance or external systems. -//* Якщо ваш реєстр отримує запити та віддає дані, зверніться до розділу * If your registry receives requests and provides data, refer to the section xref:#target-registry-setup[]. -//* Якщо ваш реєстр запитує дані з інших реєстрів на Платформі, зверніться до розділу + * If your registry queries data from other registries on the Platform, refer to the section xref:#client-registry-setup[]. -//* Для зовнішніх систем важливо отримати токен доступу до реєстру з Keycloak, щоб використовувати його при подальшій авторизації у сервісах реєстру. Приклад реалізації логіки отримання токена через Postman дивіться на сторінці -* For external systems, it is important to obtain an access token to the registry from Keycloak to use it for further authorization in registry services. An example of implementing token retrieval logic through Postman can be found here: xref:#get-access-token-keycloak[]. +* For external systems, obtaining an access token to the registry from Keycloak is essential to use it for further authorization in registry services. An example of implementing token retrieval logic through Postman can be found here: xref:#get-access-token-keycloak[]. -//* Окремим сценарієм є налаштування вихідної взаємодії із зовнішніми системами, при якій реєстру на Платформі необхідно викликати інші системи. Це можна зробити за допомогою REST-конектора (_дивіться розділ xref:#rest-connector[]_). -* A separate scenario is configuring outbound interaction with external systems, where the registry on the Platform needs to call other systems. This can be done using a REST connector (see xref:#rest-connector[]). +* A separate scenario is configuring outbound interaction with external systems, where the registry on the Platform needs to call other systems. This case requires using a REST connector (see xref:#rest-connector[]). [#target-registry-setup] -//=== Налаштування цільового реєстру (власника даних) === Configuring target registry (data owner) -//Якщо ваш реєстр є власником даних, і ви хочете виставляти інтеграційні API-точки, отримувати запити та віддавати дані іншим реєстрам або системам, виконайте наступні налаштування регламенту: -If your registry is the data owner and you want to expose integration API endpoints, receive requests, and provide data to other registries or systems, perform the following regulations settings: +If your registry is the data owner, and you want to expose integration API endpoints, receive requests, and provide data to other registries or systems, perform the following regulations settings: + +. Configure authorization settings—provide access to invoking the business process. -//. Виконайте авторизаційні налаштування -- надайте доступ для виклику бізнес-процесу. -. Configure authorization settings -- provide access for invoking the business process. -//. Змоделюйте бізнес-процес, що викликатиметься іншим реєстром. . Model the business process to be invoked by another registry. -//. Створіть модель даних (надайте доступ на читання даних реєстру через API-представлення). + . Create a data model (grant read access to the registry data through the API representation). -//TIP: Детальніше про налаштування регламенту для кроків 1-3 див. на сторінці TIP: For more details on setting regulatory requirements for steps 1-3, refer to xref:registry-admin/external-integration/api-publish/rest-soap-api-expose.adoc[]. [start=4] -//. _Також для REST-взаємодії_ -- надайте доступ до реєстру для іншого реєстру на Платформі або зовнішньої системи в адміністративній панелі *Control Plane*. Адміністратор може додавати, видаляти, або призупиняти доступ до реєстру для інших реєстрів на Платформі та зовнішніх систем. . _Also, for REST interaction_, grant access to the registry for another registry on the Platform or external system in the *Control Plane* administrative panel. Administrators can add, delete, or suspend access to the registry for other registries on the Platform and external systems. + -//TIP: Деталі дивіться на сторінці TIP: For more details, see xref:admin:registry-management/control-plane-registry-grant-access.adoc[]. [#client-registry-setup] -//TODO: Не впевнена, що правильно перекладаю реєстру-клієнта та реєстру-споживача даних (нижче). -//=== Налаштування реєстру-клієнта (споживача даних) === Configuring the client registry (data consumer) -//Налаштуйте взаємодію з іншими реєстрами для реєстру-споживача даних. Для цього: :: Configure interaction with other registries for the data-consuming registry. To do this: :: + -//. Змоделюйте бізнес-процес з можливістю виклику зовнішнього реєстру. . Model the business process with the ability to call an external registry. + [TIP] ==== -//Приклад _.bpmn_-моделі процесу, а також користувацькі _.json_-форми до нього ви можете знайти у регламенті демо-реєстру *_consent-data_* за посиланням: -//https://admin-tools-consent-data.apps.envone.dev.registry.eua.gov.ua/gerrit. -Example _.bpmn_ process model, as well as custom _.json_ forms for it, can be found in the *_consent-data_* demo registry regulatory document at the following link: https://admin-tools-consent-data.apps.envone.dev.registry.eua.gov.ua/gerrit. +[%collapsible] +.Where can I find an example of a reference business process? +===== +include::partial$snippets/demo-reg-reference-examples-en.adoc[] -//Процес буде доступний за назвою *_BPMN-create-school-auto.bpmn_*. Назви форм ви можете знайти всередині відповідних користувацьких задач бізнес-процесу у полі *`Form key`*. -The process will be available under the name *_BPMN-create-school-auto.bpmn_*. You can find the form names inside the respective user tasks of the business process in the *`Form key`* field. +An example of a BPMN process diagram will be available in the demo-registry's regulations by searching for the keywords -- *_create-school-auto_*. The names of the forms can be found inside the corresponding User Tasks of the business process in the *`Form key`* field. +===== ==== -+ -//. В рамках бізнес-процесу використовуйте типові інтеграційні розширення для взаємодії з іншими реєстрами на Платформі: + . Within the business process, use standard integration extensions to interact with other registries on the Platform: -+ -//* старту бізнес-процесів в іншому реєстрі на Платформі -- для цього використовуйте типове інтеграційне розширення-конектор *Start business process in another registry*; -* Start business processes in another registry on the Platform - use the standard integration extension-connector *Start business process in another registry*. -//* отримання даних з операційної БД іншого реєстру на Платформі -- для цього використовуйте типове інтеграційне розширення-конектор *Search for entities from another registry data factory*. -* Retrieve data from the operational database of another registry on the Platform - use the standard integration extension-connector *Search for entities from another registry data factory*. + +* Launch business processes in another registry on the Platform—use the standard integration connector—*Start business process in another registry*. + +* Retrieve data from the operational database of another registry on the Platform—use the standard integration connector—*Search for entities from another registry data factory*. + [TIP] -//Опис та налаштування делегатів ви можете знайти на сторінці For descriptions and configurations of delegates, see xref:registry-develop:bp-modeling/bp/element-templates/rest-integration-registries/rest-integration-registries-overview.adoc[]. + [NOTE] ==== -//Для того, щоб запустити бізнес-процес у цільовому реєстрі, вам необхідно передати стартові змінні, які ним очікуються. -To start a business process in the target registry, you need to pass the initial variables that are expected by it. - -//Наприклад, стартові змінні можна передати як *`Map`* вхідних параметрів (*Input Parameters*), тобто як _ключі-значення_, при налаштуванні делегата для старту бізнес-процесу. -For example, you can pass the initial variables as a *`Map`* of input parameters (*Input Parameters*), for example, as _key-value_ pairs when configuring the delegate for starting the business process. +To start a business process in the target registry, you need to pass the initial variables expected by it. -//.Формування стартових змінних процесу у реєстрі-клієнті для передачі до цільового реєстру +You can pass the initial variables as a *`Map`* of input parameters (*Input Parameters*), for example, as _key-value_ pairs when configuring the delegate for starting the business process. .Formation of initial variables of the process in the client registry for transfer to the target registry image::registry-develop:registry-admin/external-integration/rest-api-no-trembita/pass-map-params-bp.png[] ==== -+ -//. Змоделюйте UI-форму для читання даних з операційної БД реєстру за критеріями пошуку (search condition). Це дозволить звертатися до БД іншого реєстру з користувацької форми. Для цього: -. Model a UI form to read data from the operational database of the registry based on search condition. This allows accessing the database of another registry from a user form. To do this: -+ -//* Перейдіть до [.underline]#Кабінету адміністратора регламентів# > Відкрийте розділ [.underline]#UI-форми# > Створіть форму введення даних > Відкрийте [.underline]#Конструктор форм#. + +. Model a UI form to read data from the operational database of the registry based on search conditions. This scenario allows accessing the database of another registry from a user form. To do this: + * Go to the [.underline]#Regulations administrator portal#> Open the [.underline]#UI Forms# section > Create a data input form > Open the [.underline]#Form builder#. -//* У компоненті *Select* перейдіть на вкладку *Data* > У полі `*Data Source URL*` введіть шлях до ресурсу у фабриці даних іншого реєстру: -* In the *Select* component, switch to the *Data* tab > In the *`Data Source URL`* field, enter the path to the resource in the data factory of another registry: -//TODO: Please help restore the formatting of the below table and image (they have to be moved to the right to be under the bullet point. -//.Поле Data Source URL на UI-формі +* In the *Select* component, switch to the *Data* tab > In the *`Data Source URL`* field, enter the path to the resource in the data factory of another registry. ++ .Data Source URL field on the UI form ==== ---- /api/integration/data-factory/test-registry/resource-name ---- - |=== -//| Параметр/Шлях | Опис | Parameter/Path | Description - | `/api/integration/data-factory` -//| Кореневий шлях (не змінюється). | Root path (unchanged). - | `test-registry` -//| Службова назва цільового реєстру, вказана у Control Plane. | Service name of the target registry specified in the Control Plane. - | `resource-name` -//| Назва ресурсу/ендпоінту, до якого звертатися для отримання даних. Наприклад, `/edu-type`. | Name of the resource/endpoint to be accessed for data retrieval. For example, `/edu-type`. |=== ==== - -//.Запит до БД іншого реєстру за критерієм пошуку з UI-форми користувача -.Request to the database of another registry based on the search condition from the UI form. ++ +.Request the database of another registry based on the search condition from the UI form image::registry-develop:registry-admin/external-integration/rest-api-no-trembita/create-sc-data-source-url.png[] [#get-access-token-keycloak] -//=== Отримання токена авторизації зовнішніми системами -=== Obtaining authorization token from external systems +=== Obtaining authorization tokens from external systems -//Щоб отримати дозвіл на звернення до ресурсів реєстру, зовнішня система має отримати спеціальний токен доступу -- JWT-токен. Він призначений для подальшої авторизації зовнішніх систем при взаємодії з реєстрами, що розгорнуті в межах Платформи. -To access registry resources, an external system needs to obtain a special access token --a *_JWT_* token. It is intended for further authorization of external systems when interacting with registries deployed within the Platform. +An external system must obtain a unique access token, the *_JWT_*, to access registry resources. It is intended for further authorization of external systems when interacting with registries deployed within the Platform. -//TIP: Детальніше дивіться на сторінці -TIP: For more details see xref:registry-develop:registry-admin/external-integration/api-publish/get-jwt-token-postman.adoc[]. +TIP: For more details, see xref:registry-develop:registry-admin/external-integration/api-publish/get-jwt-token-postman.adoc[]. [#rest-connector] -//=== Вихідна інтеграція із зовнішніми системами === Outbound integration with external systems -//Якщо необхідно інтегруватися із зовнішнім сервісом, або системою, що знаходиться поза кластером Платформи, використовуйте спеціальний REST-конектор -- *Connect to external system*. If there is a need to integrate with an external service or a system outside the Platform cluster, use a special REST connector -- *Connect to external system*. [TIP] -//Детальніше дивіться на сторінці For more details, see xref:registry-develop:bp-modeling/bp/rest-connector.adoc[]. -//=== Пов'язані сторінки === Related pages -//Опис функціональності охоплює пов'язані сторінки з документацією. Вони подані списком у цьому розділі для зручності. -The functionality description includes related pages from the documentation. They are listed in this section for convenience. - * xref:admin:registry-management/control-plane-registry-grant-access.adoc[] * xref:registry-admin/external-integration/api-publish/rest-soap-api-expose.adoc[] * xref:registry-develop:data-modeling/data/physical-model/rest-api-view-access-to-registry.adoc[] diff --git a/docs/en/modules/registry-develop/pages/registry-admin/grafana-monitoring/grafana-camunda-metrics.adoc b/docs/en/modules/registry-develop/pages/registry-admin/grafana-monitoring/grafana-camunda-metrics.adoc index bfb827c26a..4f43da361d 100644 --- a/docs/en/modules/registry-develop/pages/registry-admin/grafana-monitoring/grafana-camunda-metrics.adoc +++ b/docs/en/modules/registry-develop/pages/registry-admin/grafana-monitoring/grafana-camunda-metrics.adoc @@ -1,100 +1,64 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - -//= Моніторинг показників виконання бізнес-процесів = Monitoring business process execution metrics +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] + +include::platform:ROOT:partial$admonitions/language-en.adoc[] -//== Загальний опис == Overview -//Функціональність моніторингу загальних метрик виконання бізнес-процесів доступна для технічного адміністратора реєстру через вебінтерфейс *Grafana*. Завдяки цьому адміністратори та розробники можуть легко відстежувати ключові метрики бізнес-процесів та використовувати цю інформацію для своєчасного виявлення та корегування проблем, а також покращення продуктивності системи. A registry technical administrator can monitor business process metrics via *Grafana* web-interface. Administrators and developers can monitor the key metrics and use this info to identify and correct possible issues, and increase system productivity. image:release-notes:wn-1-9-4/whats-new-1-9-4-14.png[] -//Основні особливості моніторингу включають: :: The main points of monitoring include: :: -//* [.underline]#Доступ до окремого дашборду *Camunda Metrics*#: технічному адміністратору реєстру надається доступ до дашборду у Grafana з визначеним набором метрик -- *Camunda Metrics*. -//* [.underline]#Вибір проєкту реєстру#: якщо адміністратор має доступ до декількох реєстрів, він може вказати проєкт (namespace) реєстру, для якого потрібно переглянути метрики. -//* [.underline]#Автоматичне встановлення дашборду#: при оновленні наявних реєстрів дашборд Grafana встановлюється автоматично. * [.underline]#Access to the dedicated *Camunda Metrics* dashboard#: the technical administrator gets access to a dashboard with a defined list of metrics -- *Camunda Metrics*. * [.underline]#Selection of the registry project#: if the administrator has access to multiple registries, they can specify a project (namespace) of a registry, which they need metrics for. -//== Встановлення та налаштування метрик == Metrics setup and configuration -//В рамках процедури оновлення наявних реєстрів, _автоматично надаються_ наступні можливості: The procedure of registry updating _automatically provides_ the following abilities: -//* [.underline]#Реєстрація даних метрик увімкнена за замовчуванням#: це означає, що система автоматично реєструє та відстежує важливі метрики виконання, такі як продуктивність, навантаження, час відгуку та інші відомості про стан системи. -//* [.underline]#Налаштування збору та зберігання метрик в Prometheus#: система автоматично налаштовується на збір та зберігання метрик у Prometheus, гарантуючи безперебійний доступ до цих даних для аналізу та оптимізації. -//* [.underline]#Встановлення та налаштування Grafana-дашборда#: встановлення та налаштування Grafana-дашборда дозволяє адміністраторам легко візуалізувати метрики, відстежувати зміни в реальному часі та отримувати сповіщення про можливі проблеми або аномалії. Це полегшує роботу з метриками та дозволяє оперативно реагувати на зміни в системі. * [.underline]#Metrics registration is enabled by default#: this means that the system automatically registers and monitors important execution metrics, such as productivity, load, response time, and other info on system state. * [.underline]#Configuring gathering and storing of metrics in Prometheus#: the system automatically configures the gathering and storing of metrics in Prometheus, ensuring continuous access to this data for analysis and optimization. * [.underline]#Setup and configuration of Grafana dashboard#: setting up and configuring Grafana dashboard allows the administrators to visualize the metrics, monitor live changes and get notifications about possible problems or anomalies. This way it's easier to work with the metrics and react to any changes in the system. -//== Загальний вигляд дашборда == Dashboard general view -//Щоб переглянути дашборд, виконайте наступні кроки: To view the dashboard, take the following steps: -//. Увійдіть до адміністративної панелі *Control Plane*. . Navigate to the administrator panel *Control Plane*. -//. Оберіть ваш реєстр > `Редагувати` > +++Швидкі посилання+++. . Select your registry > `Edit` > +++ Quick links +++ + -//TIP: Детальніше про швидкі посилання див. на сторінці xref:admin:registry-management/control-plane-quick-links.adoc[]. TIP: See more info on quick links here: xref:admin:registry-management/control-plane-quick-links.adoc[]. -//. Перейдіть за посиланням до вебінтерфейсу моніторингу Платформи -- *Grafana*. . Follow the link to *Grafana* monitoring Platform web-interface. + image:registry-admin/grafana/bpms/grafana-bpms-1.png[] -//. Виконайте вхід за допомогою опції *`Sign in with OAuth`*. . Sign in using the *`Sign in with OAuth`* option. + image:registry-admin/grafana/bpms/grafana-bpms-2.png[] -//. На боковій панелі зліва оберіть *Manage* > *Dashboards* > *Go to folder*. . On the left side panel, select *Manage* > *Dashboards* > *Go to folder*. + image:registry-admin/grafana/bpms/grafana-bpms-3.png[] -//. Відкрийте дашборд *Camunda Metrics Dashboard*. . Open the *Camunda Metrics Dashboard*. + Тут ви можете ознайомитися із групами метрик, представленими на дашборді. + image:registry-admin/grafana/bpms/grafana-bpms-4.png[] + -//Метрики *Camunda Metrics* поділяються на декілька груп, про що детальніше описано у наступних підрозділах. *Camunda Metrics* are differentiated by several groups, which are described later in this document. -//=== Загальні метрики Process Engine === Process Engine general metrics -//[.underline]#Загальні метрики Process Engine# надають важливу інформацію про стан і функціонування Process Engine, дозволяючи адміністраторам контролювати та оптимізувати роботу системи. [.underline]#Process Engine general metrics# provide important information about the state and functioning of the Process Engine, allowing the administrators to control and optimize system operation. -//Ці метрики включають наступні показники: :: These metrics include the following indicators: :: -//* *User count*: показує загальну кількість зареєстрованих користувачів в системі. -//* *Authorization count*: відображає кількість наданих дозволів на виконання певних дій користувачам або групам користувачів. -//* *Active deployments*: показує кількість поточних розгортань процесів у системі. -//* *Active process definitions*: відображає кількість унікальних визначень бізнес-процесів, які наразі активні в системі. * *User count*: shows the general number of registered users in the system. * *Authorization count*: shows the number of rights for different actions granted to users of user groups. * *Active deployments*: shows the number of current process deployments in the system. @@ -103,111 +67,88 @@ These metrics include the following indicators: :: [NOTE] ==== [%collapsible] -//.Що таке Active process definition? -. What is Active process definition? + +.What is Active process definition? ===== -//*Active process definition* не означає, що процес вже запущений у системі, але він доступний для запуску нових екземплярів процесів. Запуск процесу зі стану Active process definition створює новий екземпляр процесу, який виконується в системі. *Active process definition* means that the process may not be running yet, but is available for new instance deployment. Starting a process from the Active process definition state will deploy a new instance. ===== ==== image:registry-admin/grafana/bpms/grafana-bpms-5.png[] -//=== Загальні метрики бізнес-процесів === Business process general metrics -//[.underline]#Загальні метрики бізнес-процесів# показують статистику по запуску, виконанню та завершенню бізнес-процесів. [.underline]#Business process general metrics# show the statistics on starting, executing and completing business processes. -//Ці метрики включають наступні показники: :: These metrics include the following indicators: :: -//* *Root Process Instances*: основні екземпляри процесів, які представляють окремі випадки виконання бізнес-процесів в Camunda. Вони відрізняються від підпроцесів, які запускаються в рамках інших процесів. * *Root Process Instances*: the main process instances that represent certain business process use cases in Camunda. They differ from subprocesses that deploy within other processes. + -//** *Camunda Total Root Process Instances*: показує загальну кількість створених основних екземплярів процесів, включаючи активні, призупинені, завершені та зупинені. ** *Camunda Total Root Process Instances*: shows the general number of the created main process instances, including active, suspended, completed and terminated. -//** *Camunda Active Root Process Instances*: відображає кількість основних екземплярів процесів, які зараз активні та виконуються в системі. + ** *Camunda Active Root Process Instances*: shows the number of main process instances, which are currently active and running in the system. -//** *Camunda Suspended Root Process Instances*: показує кількість основних екземплярів процесів, які були призупинені та наразі не виконуються. + ** *Camunda Suspended Root Process Instances*: shows the number of main process instances, which were suspended and aren't currently running. -//** *Camunda Completed Root Process Instances*: відображає кількість основних екземплярів процесів, які успішно завершили своє виконання. + ** *Camunda Completed Root Process Instances*: shows the number of successfully completed main process instances. -//** *Camunda Terminated Root Process Instances*: показує кількість основних екземплярів процесів, які були зупинені до завершення, зазвичай через виняткові ситуації або адміністративні дії. + ** *Camunda Terminated Root Process Instances*: shows the number of main process instances terminated before completion, usually due to unplanned situations or administrator actions. + image:registry-admin/grafana/bpms/grafana-bpms-6.png[] -+ -//* *User Tasks*: користувацькі задачі, які вимагають взаємодії з користувачами у процесі виконання бізнес-процесів. Вони дозволяють адміністраторам стежити за робочим навантаженням користувачів та контролювати процес прийняття рішень. + * *User Tasks*: user tasks that user interaction during business process execution. They allow the administrators to monitor user workload and control decision making. -//** *Camunda Total User Tasks*: показує загальну кількість користувацьких задач, створених у рамках всіх процесів. ** *Camunda Total User Tasks*: shows the general amount of user tasks created within all the processes. -//** *Camunda Assigned User Tasks*: відображає кількість користувацьких задач, які були призначені певним користувачам або групам користувачів для виконання. + ** *Camunda Assigned User Tasks*: shows the general amount of user tasks assigned to users or user groups. -//** *Camunda Unassigned User Tasks*: показує кількість користувацьких задач, які наразі не призначені жодному користувачеві або групі користувачів. Ці завдання можуть бути призначені у майбутньому або виконані за допомогою автоматичних правил. -** *Camunda Unassigned User Tasks*: shows the general amount of user tasks not assigned to a user or user group. These tasks may be assigned later or resolved using automatic rules. + +** *Camunda Unassigned User Tasks*: shows the general amount of user tasks not assigned to a user or user group. These tasks may be assigned later or resolved using automatic rules.x + + image:registry-admin/grafana/bpms/grafana-bpms-6-1.png[] image:registry-admin/grafana/bpms/grafana-bpms-6-2.png[] -//=== Загальні метрики обміну повідомленнями в рамках бізнес-процесу === General metrics of message exchange within a business process -//[.underline]#Загальні метрики обміну повідомленнями в рамках бізнес-процесу#: ці метрики показують інформацію про роботу з повідомленнями в межах бізнес-процесів, включаючи активні підписки на події та обробку повідомлень. [.underline]#General metrics of message exchange within a business process#: these metrics show information about message exchange in a certain business process, including active event subscriptions and message processing. -//Ці метрики включають наступні показники: :: These metrics include the following indicators: :: -//* *Active Signal Event Subscriptions*: показує кількість активних підписок на події сигналів, які використовуються для координації між різними процесами або елементами в межах одного процесу. * *Active Signal Event Subscriptions*: shows the number of active subscriptions for signal events used to coordinate between different processes or different elements within a single process. -//* *Active Compensate Event Subscriptions*: відображає кількість активних підписок на події компенсації, які використовуються для відкликання дій у процесі у разі виникнення виняткових ситуацій. + * *Active Compensate Event Subscriptions*: shows the number of active subscriptions for compensate events used to revert actions in a process in case of unplanned cases. -//* *Active Conditional Event Subscriptions*: показує кількість активних підписок на умовні події, які використовуються для реагування на зміни стану виконання процесу або зовнішніх факторів. + * *Active Conditional Event Subscriptions*: shows the number of active subscriptions for conditional events used to react on changes of process state, or external factors. -//* *Active Message Event Subscriptions*: відображає кількість активних підписок на події повідомлень, які дозволяють обмінюватися повідомленнями між різними процесами або компонентами. + * *Active Message Event Subscriptions*: shows the number of active subscriptions for message events that allow for the exchange of messages between different processes and components. image:registry-admin/grafana/bpms/grafana-bpms-7.png[] -//=== Загальні метрики асинхронного виконання задач бізнес-процесу === General metrics of asynchronous business process task execution -//[.underline]#Загальні метрики асинхронного виконання задач бізнес-процесу#: надають статистику з асинхронного виконання задач, як-от кількість активних, відкладених та завершених задач. [.underline]#General metrics of asynchronous business process task execution#: provide statistics of asynchronous task execution, like the number of active, timed and executed jobs. -//Ці метрики включають наступні показники: :: These metrics include the following indicators: :: -//* *Message Jobs*: показує кількість активних задач та задач в очікуванні, пов'язаних з обробкою повідомлень у рамках бізнес-процесів. * *Message Jobs*: shows the number of active and timed tasks, associated with message processing in a business process. -//* *Timer Jobs*: відображає кількість активних задач та задач в очікуванні, пов'язаних з таймерами, які використовуються для контролю часових інтервалів та інших часових обмежень у рамках бізнес-процесів. + * *Timer Jobs*: shows the number of active and timed tasks, associated with timers used to control time periods and other time restrictions in a business process. * *Executable Timer Jobs*: a specific category of jobs that utilize timers and are ready for execution or are waiting for a free worker thread for their execution. They can be used to control time intervals and other time constraints within business processes. -//* *Suspended Jobs*: shows the number of suspended tasks that are not currently being executed for different reasons, like delay or administrator actions. -//* *Executable Jobs*: відображає кількість задач, які готові до виконання або очікують на вільний робочий потік для свого виконання. + * *Executable Jobs*: shows the number of tasks ready for execution, or awaiting a free workflow for execution. -//* *Failed Jobs*: shows the number of tasks that could not be executed, because of unplanned cases, configuration errors, or other issues. image:registry-admin/grafana/bpms/grafana-bpms-8.png[] -//=== Видалення історичних даних виконання бізнес-процесів === Deleting business process execution historical data -//[.underline]#Видалення історичних даних виконання бізнес-процесів#: містить метрики, пов'язані з видаленням історичних даних про виконання бізнес-процесів для оптимізації ресурсів системи. [.underline]#The deletion of business process execution historical data#: contains metrics associated with the deletion of business process historical data for system resource optimization. -//Ці метрики включають наступні показники: :: These metrics include the following indicators: :: -//* *Removed process instances*: показує кількість видалених історичних екземплярів процесів у рамках системи. Видалення історичних даних виконання бізнес-процесів допомагає забезпечити оптимальне використання ресурсів, покращуючи продуктивність та зменшуючи навантаження на систему. -* *Removed process instances*: shows the number of deleted historical business process instances within the system. It allows for the optimal resource usage, improving the productivity and reducing system workload. +* *Removed process instances*: shows the number of deleted historical business process instances within the system. It allows for optimal resource usage, improving the productivity and reducing system workload. -//* *Removed tasks*: відображає кількість видалених історичних завдань у рамках бізнес-процесів. Видалення історичних завдань також сприяє оптимальному використанню ресурсів та забезпеченню стабільної роботи системи, оскільки зменшує навантаження на базу даних та інші компоненти. * *Removed tasks*: shows the number of removed historical tasks within business processes. The deletion of historical tasks also improves the resource usage and system operation stability, because it reduces database and other components' workload. image:registry-admin/grafana/bpms/grafana-bpms-9.png[] \ No newline at end of file diff --git a/docs/en/modules/registry-develop/pages/registry-admin/grafana-monitoring/overview.adoc b/docs/en/modules/registry-develop/pages/registry-admin/grafana-monitoring/overview.adoc new file mode 100644 index 0000000000..8d42bfdba2 --- /dev/null +++ b/docs/en/modules/registry-develop/pages/registry-admin/grafana-monitoring/overview.adoc @@ -0,0 +1,26 @@ += Monitoring Platform systems (Grafana) +:sectlinks: +:sectanchors: + +include::platform:ROOT:partial$admonitions/language-en.adoc[] + +_Monitoring_ is a critical element of the effective operation of any IT platform. To ensure complete control over the functioning of our systems and to detect and remedy potential problems, we employ a powerful monitoring tool -- *_Grafana_*. + +In Grafana, we've designed various dashboards that allow us to configure and track key performance indicators, including: + +* The operation different Platform components (like Camunda or Strimzi Kafka); +* The status of databases and file system (e.g., PostgreSQL or Ceph cluster); +* Metrics and request statistics in Public API Kong; +* Analytical data via Redash; +* Cache memory status using Redis; +* Metrics from Spring Boot, Prometheus, and others. + +These dashboards provide an in-depth analysis of our Platform's operation and the registries deployed on it. This aids us in ensuring stability and productivity and identifying potential deviations or issues before they become critical. + +TIP: A complete list of available monitoring dashboards can be found on the page xref:arch:architecture/platform/operational/monitoring/overview.adoc[]. + +== Section overview + +//* xref:registry-develop:registry-admin/grafana-monitoring/grafana-alerting-notifications.adoc[] +* xref:registry-develop:registry-admin/grafana-monitoring/grafana-camunda-metrics.adoc[] +* xref:registry-develop:registry-admin/grafana-monitoring/public-api-kong-metrics.adoc[] diff --git a/docs/en/modules/registry-develop/pages/registry-admin/grafana-monitoring/public-api-kong-metrics.adoc b/docs/en/modules/registry-develop/pages/registry-admin/grafana-monitoring/public-api-kong-metrics.adoc new file mode 100644 index 0000000000..99634e072b --- /dev/null +++ b/docs/en/modules/registry-develop/pages/registry-admin/grafana-monitoring/public-api-kong-metrics.adoc @@ -0,0 +1,71 @@ += Monitoring metrics of public API +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] + +include::platform:ROOT:partial$admonitions/language-en.adoc[] + +== Dashboard overview + +The Platform features a Grafana dashboard designed to monitor performance metrics and the volume of requests made to public integration points from unauthenticated users and third-party systems. + +image:registry-develop:registry-admin/external-integration/api-publish/public-api/expose-public-api-4.png[] + +The registry's technical administrators can utilize data from the dashboard to monitor trends and the state of metrics. This information can assist in determining the need for optimization adjustments, such as altering request limits. + +== Accessing the dashboard + +To view the dashboard, follow these steps: + +. Log in to the *Control Plane* administrative panel. +. Select your registry > `Edit` > +++Quick Links+++. ++ +TIP: For more on quick links, refer to the page xref:admin:registry-management/control-plane-quick-links.adoc[]. + +. Follow the link to the Platform's monitoring web interface – *Grafana*. ++ +image:registry-admin/grafana/bpms/grafana-bpms-1.png[] + +. Sign in using the *`Sign in with OAuth`* option. ++ +image:registry-admin/grafana/bpms/grafana-bpms-2.png[] + +. On the left sidebar, select *Manage* > *Dashboards* > *Go to folder*. ++ +image:registry-admin/grafana/bpms/grafana-bpms-3.png[] + +. In the search bar, locate *Public API Kong Metrics*, click *namespace*, and then select your registry. ++ +image:registry-develop:registry-admin/external-integration/api-publish/public-api/expose-public-api-8.png[] + +== Viewing dashboard metrics + +For monitoring the performance and tracking requests to your API, utilize the metrics dashboard. Continuously monitoring these metrics will help you identify potential API performance issues and address them timely. + +Select the public endpoint for which you want to view metrics. This can be done in the *public endpoint* section. Choose either all the created points or specific ones. + +image:registry-develop:registry-admin/external-integration/api-publish/public-api/expose-public-api-9.png[] + +* The *Request rate* section shows the number of requests for each integration point. + +** *Total requests per second (RPS)* displays the overall volume of API requests per second. +** *RPS per route* analyzes the volume of requests for each route individually. + ++ +image:registry-develop:registry-admin/external-integration/api-publish/public-api/expose-public-api-4.png[] + +* The *Requests by status code* sections (*_2xx, 4xx, 5xx, and other_*) present statistics on successful requests, client errors, server errors, and other response codes. ++ +image:registry-develop:registry-admin/external-integration/api-publish/public-api/expose-public-api-10.png[] + +* The *Latencies* section indicates the server's response time to requests. + +** *Request time per route* denotes the average server response time for each route. ++ +image:registry-develop:registry-admin/external-integration/api-publish/public-api/expose-public-api-11.png[] + +** *Kong Proxy latency per route* reflects the delay between the server receiving a request and sending its response. ++ +image:registry-develop:registry-admin/external-integration/api-publish/public-api/expose-public-api-11-1.png[] + +** *Upstream time across per route* determines the time the server takes to process the request and receive a response from the upstream service. ++ +image:registry-develop:registry-admin/external-integration/api-publish/public-api/expose-public-api-11-2.png[] \ No newline at end of file diff --git a/docs/en/modules/registry-develop/pages/registry-admin/hierarchical-model.adoc b/docs/en/modules/registry-develop/pages/registry-admin/hierarchical-model.adoc index 18b8ad1083..c3fb78082e 100644 --- a/docs/en/modules/registry-develop/pages/registry-admin/hierarchical-model.adoc +++ b/docs/en/modules/registry-develop/pages/registry-admin/hierarchical-model.adoc @@ -747,7 +747,7 @@ The initial data is loaded into the tables using a PL/pgSQL database procedure. //* Детальний опис процедури для первинного завантаження даних читайте на сторінці xref:data-modeling/initial-load/data-initial-data-load-pl-pgsql.adoc[]. For details on initial data loading, see xref:data-modeling/initial-load/data-initial-data-load-pl-pgsql.adoc[]. -//* Також перегляньте xref:study-project/study-tasks/task-1-registry-db-modeling.adoc[] для ознайомлення із практичним застосуванням первинного завантаження при моделюванні регламенту. +//* Також перегляньте xref:study-project/study-tasks/task-registry-update-registry-db-modeling.adoc[] для ознайомлення із практичним застосуванням первинного завантаження при моделюванні регламенту. //TODO: study-task topics are out of translation scope ==== diff --git a/docs/en/modules/registry-develop/pages/registry-admin/regulations-deploy/registry-admin-deploy-regulation.adoc b/docs/en/modules/registry-develop/pages/registry-admin/regulations-deploy/registry-admin-deploy-regulation.adoc index 792e4e0e32..8eeff20504 100644 --- a/docs/en/modules/registry-develop/pages/registry-admin/regulations-deploy/registry-admin-deploy-regulation.adoc +++ b/docs/en/modules/registry-develop/pages/registry-admin/regulations-deploy/registry-admin-deploy-regulation.adoc @@ -1,41 +1,32 @@ -= Deploying regulations in Gerrit += Deploying registry regulations in Gerrit include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] include::platform:ROOT:partial$admonitions/language-en.adoc[] This guide provides instructions on deploying pre-configured registry regulations. -//TIP: Для перегляду списку основних елементів регламенту реєстру, зверніться до секції xref:registry-admin/regulations-deploy/registry-regulations-structure.adoc[]. TIP: For an overview of the registry regulations' main elements, see xref:registry-admin/regulations-deploy/registry-regulations-structure.adoc[]. Step 1 :: - -//Відкрийте **Gerrit** реєстру та виконайте вхід. Sign in to the registry's *Gerrit* code review system. + [TIP] ==== -//Посилання до системи рецензування коду *Gerrit* можливо отримати в Openshift-консолі. Для цього перейдіть до розділу `Networking` → `Routes`, оберіть відповідний проєкт, в рядку пошуку вкажіть назву сервісу `gerrit`, після чого посилання буде доступне у колонці `Location`. You can obtain the *Gerrit* link in the *OpenShift* web console. Go to *Networking* > *Routes*, select your project, search for `gerrit`, and copy the link from the *Location* column. image:registry-admin/regulations-deploy/registry-deploy-regulation-04.png[] ==== + -//Після успішної авторизації перейдіть до розділу **Browse** -> **Repositories**. Вам буде доступний репозитарій з регламентом реєстру -- **registry-regulations**. In Gerrit, go to *Browse* > *Repositories*. Find the registry regulations' repository called *registry-regulations*. + image:registry-admin/regulations-deploy/registry-deploy-regulation-step-1.png[] Step 2:: - -//Перейдіть до репозиторію **registry-regulations** (натиснувши назву репозиторію) та скопіюйте виділену червоним команду для локального завантаження репозиторію, тобто виконайте `git clone`. Це посилання необхідно для того, щоб виконати копіювання віддаленого репозиторію на локальну машину. Open the *registry-regulations* repository by clicking its name and copy the entire `git clone` command from the *Clone with commit-smg hook* field. Save it in any text editor. This command copies the remote repository to the local machine. + image:registry-admin/regulations-deploy/registry-deploy-regulation-step-2.png[] Step 3:: - -//Запустіть link:https://git-scm.com/downloads[*Git Bash*]-консоль у директорії (папці), до якої необхідно склонувати репозиторій. Вставте та виконайте скопійовану команду з попереднього кроку 2. Start the link:https://git-scm.com/downloads[*Git Bash*] terminal from the directory to which you want to clone the repository. Paste the command you copied in step 2 into the console and run it. + image:registry-admin/regulations-deploy/registry-deploy-regulation-01.png[] @@ -44,30 +35,23 @@ image:registry-admin/regulations-deploy/registry-deploy-regulation-02.png[0,375] + [TIP] ==== -//`Username` та `Password` можливо отримати у профілі користувача в **Gerrit**, у розділі **Settings** -> **User Settings** → **HTTP Credentials**. You can obtain the credentials in your Gerrit user profile in the *Settings* > *User Settings* > *HTTP Credentials* section. -//TODO: I edited the en version of registry-deploy-regulation-step-4.png to not mention Kseniia's last name; recommend copying it to the ua version as well. image:registry-admin/regulations-deploy/registry-deploy-regulation-step-4.png[] ==== + image:registry-admin/regulations-deploy/registry-deploy-regulation-03.png[] + -//Після успішного копіювання віддаленого репозиторію він стане доступний на локальній машині. After the remote repository is copied successfully, it becomes available on the local machine. Step 4:: + -//Розкладіть попередньо підготовлені файли регламенту _(наприклад, ті, що були отримані при передачі архіву з регламентом вже розробленого реєстру або відредаговані файли зі змінами)_ до відповідних директорій каталогу *_registry-regulations_*. -//TODO: Modified the sentence in the parenthesis as a tip. Copy the pre-configured regulations files to their corresponding subdirectories inside the *_registry-regulations_* directory. You may copy the regulations files from a working registry and modify them if needed. + -//Відкрийте Git Bash-термінал у директорії, в якій розташовано підготовлений до розгортання регламент. Open the Git Bash terminal from the directory containing the regulations that are ready for deployment. + -image:registry-admin/regulations-deploy/registry-deploy-regulation-05.png[] +image:registry-admin/regulations-deploy/registry-deploy-regulation-05-en.png[] + -//Виконайте у Git Bash-терміналі наступні команди: Execute the following commands in the Git Bash terminal: + [source, bash] @@ -81,43 +65,32 @@ git push origin HEAD:refs/for/master ==== Where: -//* `git add .` -- означає додати всі файли _(локально)_; * `git add .` adds all files _(locally)_ * `git commit -m "Message commit with changes"`: -//** `git commit` -- внесення змін до регламенту реєстру _(локально)_; ** `git commit` updates the registry regulations _(locally)_ -//** `-m` -- атрибут коментаря до змін; ** `-m` adds a comment to the commit -//** `"Message commit with changes"` -- коментар до змін, що вносяться до регламенту; ** `"Message commit with changes"` is a placeholder for the comment message + * `git push origin HEAD:refs/for/master`: -//** `git push origin` -- команда відправлення локальних змін до віддаленого репозиторію з регламентом реєстру; ** `git push origin` pushes local changes to the remote repository containing the registry regulations -//** `HEAD:refs/for/master` -- шлях до майстер-гілки віддаленого репозиторію. ** `HEAD:refs/for/master` is the path to the master branch of the remote repository ==== + -//В результаті виконання зазначених команд, локальні файли регламенту будуть розгорнуті у Gerrit-репозиторії. As a result, the local regulations files are deployed to the Gerrit repository. Step 5:: - -//Перейдіть до **Gerrit** → **Changes** → **Open** та переконайтеся, що зміна створена. Go to *Gerrit* > *Changes* > *Open* and ensure the change is created. + image:registry-admin/regulations-deploy/registry-deploy-regulation-step-6.png[] Step 6:: - -//Виконайте процедуру рецензування, увійшовши до створеної зміни. Open the change you created and follow the review procedure. + Click `Reply`. + image:admin:user-management/user-management-53.png[] + -//У новому вікні, натисніть наступні кнопки оцінки: In the new window, apply the following votes: + -- @@ -132,37 +105,29 @@ This process may take a few minutes. + image:admin:user-management/user-management-54.png[] + -//Натисніть `SEND`, а далі `SUBMIT` для застосування зміни у віддаленому репозиторії (`git merge`). Click *`SEND`*, then click *`SUBMIT`* to merge the changes to the remote repository (`git merge`). + image:admin:user-management/user-management-55.png[] + -//У спливному вікні натисніть `CONTINUE` для підтвердження. In the dialog, click *`CONTINUE`*. + image:admin:user-management/user-management-56.png[0,700] Step 7:: - -//В *Gerrit* перейдіть до розділу **Changes** -> **Merged**. Знайдіть зміну, перейдіть до неї та переконайтеся, що *CI Jenkins pipeline* з назвою `MASTER-Build-` (де `` назва регламенту реєстру) запущено, дочекавшись закінчення його виконання. In *Gerrit*, go to *Changes* > *Merged*. Find your change, open it, and ensure that the *CI Jenkins* pipeline named *MASTER-Build-registry-regulations* is running. Wait until it is completed. + -- -//* Перевірити виконання pipeline можна: * To monitor the pipeline in Jenkins, use one of these options: -//** за посиланням *CI Jenkins* у секції **Change Log**; + ** Click the *CI Jenkins* link in the *Change Log* section. -//** або перейдіть до *Jenkins job* за посиланням, що доступне внизу сторінки. ** Alternatively, open the *Jenkins job* using the link at the bottom of the page. + image:admin:user-management/user-management-57.png[] -//* У новому вікні зліва натисніть `Back to Project`. * In Jenkins, click *`Back to Project`* in the leftmost menu. + image:admin:user-management/user-management-58.png[] + -//* Переконайтеся, що збірка пройшла успішно. В такому разі усі етапи збірки виконано без помилок, а всі етапи процесу позначені зеленим кольором. * Verify that the build is successful. All the build stages must be completed without errors and marked with green. + image:admin:user-management/user-management-59.png[] @@ -170,12 +135,9 @@ image:admin:user-management/user-management-59.png[] + [CAUTION] ==== -//У разі, якщо збірка регламенту була виконана з помилкою, наприклад, якщо регламент не пройшов серверну валідацію, в такому випадку необхідно визначити причину помилки (знайти її в логах), усунути причину помилки, після чого повторно виконати внесення змін. If there are any errors during the regulations build, you must look through the logs to find the issue causing the error, solve it, and perform the update again. -//Приклад пошуку та виявлення помилок у журналі подій (логах) Jenkins доступний за xref:registry-admin/regulations-deploy/registry-regulations-auto-validation.adoc#example-validation-fk-name[посиланням]. -For an example of analyzing the Jenkins logs for errors, see xref:registry-admin/regulations-deploy/registry-regulations-auto-validation.adoc#example-validation-fk-name. +For an example of analyzing the Jenkins logs for errors, see xref:registry-admin/regulations-deploy/registry-regulations-auto-validation.adoc#example-validation-fk-name[Automatic validation for the foreignKeyName attribute]. ==== -//Після успішного виконання Jenkins job, сутності регламенту реєстру створено і можливо переходити до їх перевірки. After the Jenkins job is completed successfully, the registry regulations entities are created, and you can proceed to validate them. \ No newline at end of file diff --git a/docs/en/modules/registry-develop/pages/registry-admin/regulations-deploy/registry-regulations-auto-validation.adoc b/docs/en/modules/registry-develop/pages/registry-admin/regulations-deploy/registry-regulations-auto-validation.adoc index 191036fc31..8b686f0ce8 100644 --- a/docs/en/modules/registry-develop/pages/registry-admin/regulations-deploy/registry-regulations-auto-validation.adoc +++ b/docs/en/modules/registry-develop/pages/registry-admin/regulations-deploy/registry-regulations-auto-validation.adoc @@ -3,11 +3,9 @@ include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc include::platform:ROOT:partial$admonitions/language-en.adoc[] -//== Загальний опис == Overview -//Цей документ описує валідацію змін до регламенту на прикладі виникнення помилок при збірці pipeline `MASTER-build-registry-regulations` у реєстрах. -This document illustrates how the regulations changes are validated using `MASTER-build-registry-regulations` pipeline errors as an example. +This document illustrates how the changes to registry regulations are validated using *MASTER-build-registry-regulations* pipeline errors. [TIP] ==== @@ -18,103 +16,80 @@ Please get in touch with the Platform administrator to deploy such a registry or You can find instructions for deploying the demo registry and obtaining modeling examples on page xref:registry-develop:registry-admin/cp-deploy-consent-data.adoc[]. ==== -//Відповідно до архітектури безпеки Платформи та реєстрів, що на ній розгортаються, регламент кожного реєстру має проходити процедуру перевірки коду (Code Review) перед внесенням змін до цільового репозиторію. According to the security architecture of the Platform and the registries deployed on it, the regulations of each registry must go through a code review procedure before updating the target repository. -//Така процедура є надійним фільтром для виявлення небажаних помилок при моделюванні елементів регламенту, і, за потреби, коригування змін. Однак там, де існує людський фактор, існує і ймовірність додаткових помилок. Прикладом таких помилок під час роботи з налаштуваннями файлів регламенту є неправильне використання регістру, внесення неунікальних значень та дублювання атрибутів тощо. -A code review procedure provides a reliable way of detecting errors when modeling the regulations elements before the changes are applied. Still, there is always a possibility of human error. For example, when working with the regulations configuration files, someone may use the wrong letter case, provide non-unique values, or duplicate attributes. +A code review procedure provides a reliable way of detecting errors when modeling the regulations' elements before the changes are applied. Still, there is always a possibility of human error. For example, when working with the regulations configuration files, someone may use the wrong letter case, provide non-unique values, or duplicate attributes. -//З метою уникнення подібних помилок, на Платформі реалізована додаткова автоматична валідація змін. To avoid similar mistakes, the Platform performs additional automatic validation of changes. -//Автоматична валідація змін до регламенту наразі передбачає: :: Automatic validation of the regulations changes currently includes the following checks: :: -//. Перевірку регістрів при налаштуванні зовнішніх ключів у моделі даних. . Checking that the foreign keys in the data model use the correct letter case. -//. Перевірку регістрів при налаштуванні ролей посадових осіб. + . Checking that the officer roles use the correct letter case. + -//IMPORTANT: Значення параметрів необхідно вказувати у нижньому регістрі, тобто всі символи -- з маленької літери. Механізм валідації для обох випадків є однаковим. -IMPORTANT: Attribute values must use lower case. The validation works the same in both situations. -+ -//. Перевірку на дублювання та унікальність атрибутів у формах бізнес-процесів. +IMPORTANT: Attribute values must use a lower case. The validation works the same in both situations. + . Checking that the attributes in the business process forms are not duplicated and have unique values. -//. Перевірку на унікальність значення ідентифікатора бізнес-процесу. + . Checking that the business process identifiers have unique values. -//. Перевірку наявності бізнес-процесу в регламенті за значенням ідентифікатора. + . Checking that the business processes with the specified identifiers are present in the regulations. -//При внесенні змін до регламенту (_див. xref:registry-admin/regulations-deploy/registry-admin-deploy-regulation.adoc[]_), автоматично запускається процес збірки файлів регламенту, що має назву `MASTER-build-registry-regulations`. -Merging changes to the regulations automatically starts the regulations files build process titled `MASTER-build-registry-regulations`. For details, see xref:registry-admin/regulations-deploy/registry-admin-deploy-regulation.adoc[]. +Merging changes to the regulations automatically starts the regulations' files build process titled *MASTER-build-registry-regulations*. For details, see xref:registry-admin/regulations-deploy/registry-admin-deploy-regulation.adoc[]. -//IMPORTANT: Якщо не дотримано критеріїв правильності внесення інформації до регламенту, у процесі складання коду станеться помилка. -IMPORTANT: If the regulations data is not correct, the build will fail. +IMPORTANT: If the registry regulations' data is not correct, the build will fail. -//== Перевірка регістрів при налаштуванні зовнішніх ключів у моделі даних == Checking the foreign keys letter case -//У системі реалізовано регламентну валідацію для перевірки регістрів у значенні параметра `foreignKeyName` в рамках моделювання структур даних реєстру у каталозі _data-model_. When building the regulations, the system performs letter case validation of the `foreignKeyName` attribute value as part of the registry data structures modeling in the _data-model_ directory. -//Якщо в одному з файлів на рівні Фабрики даних (наприклад, _data-model/tablesSubjects.xml_, що визначає структуру таблиць та зв'язків між ними) значення параметра зовнішнього ключа `foreignKeyName` вказано у верхньому регістрі (наприклад, `foreignKeyName="FK_suBject_subject_id"`), то збірка не пройде валідацію та завершиться помилкою на кроці `registry-regulations-validation`. If in one of the files at the data factory level (for example, _data-model/tablesSubjects.xml_, which defines the structure of the tables and the relationships between them) the value of the foreign key attribute `foreignKeyName` is specified in uppercase (for example `foreignKeyName="FK_suBject_subject_id"`), the build will fail at the `registry-regulations-validation` step. [#example-validation-fk-name] -//.Приклад. Спрацьовування автоматичної валідації для значення параметра foreignKeyName -.Automatic validation of the foreignKeyName attribute +.Automatic validation for the foreignKeyName attribute ==== -//Розглянемо приклад спрацьовування автоматичної валідації при внесенні змін до файлу _data-model/tablesSubjects.xml_. + Consider an example of automatic validation triggering when you update the _data-model/tablesSubjects.xml_ file. Perform these steps: :: -//. Відкрийте файл _data-model/tablesSubjects.xml_ у середовищі розробки та моделювання регламенту. . Open the _data-model/tablesSubjects.xml_ file in the regulations development and modeling environment. -//. В рамках моделювання структур даних, у тегу ``, для атрибута `foreignKeyName` введіть значення `"Fk_subject_subject_id"`, використовуючи верхній регістр. + . When modeling your data structures, provide a value that contains uppercase letters (`"Fk_subject_subject_id"`) for the `foreignKeyName` attribute in the `` tag. -//. Перенесіть локальні зміни до цільового репозиторію в Gerrit (_див. xref:registry-admin/regulations-deploy/registry-admin-deploy-regulation.adoc[]_). + . Push local changes to the target repository in Gerrit (for details, see xref:registry-admin/regulations-deploy/registry-admin-deploy-regulation.adoc[]). -//. Пройдіть процедуру перевірки коду в Gerrit. + . Go through the code review procedure in Gerrit. + image:registry-admin/regulations-deploy/auto-validation/registry-regulations-auto-validation-4.png[] -+ -//. Виконайте злиття змін (`git merge`) до `master`-гілки репозиторію. + . Merge the changes (via `git merge`) with the `master` branch of the repository. + image:registry-admin/regulations-deploy/auto-validation/registry-regulations-auto-validation-3.png[] + -//За фактом злиття змін до `master`-гілки репозиторію в Gerrit, відбудеться автоматичний запуск процесу збірки внесених змін інструментом Jenkins. Merging the changes with the `master` branch of the Gerrit repository automatically starts the build process in Jenkins. -+ -//. Перейдіть до інтерфейсу *Jenkins* за відповідним посиланням для перегляду процесу збірки. + . To monitor the build process, go to *Jenkins* using a corresponding link. + image:registry-admin/regulations-deploy/auto-validation/registry-regulations-auto-validation-5.png[] + -//Збірка завершиться помилкою на кроці `registry-regulations-validation`. The build fails with a validation error at the `registry-regulations-validation` step. -+ -//. Відкрийте деталі збірки, натиснувши її номер. Далі перейдіть до журналу подій у консолі (*Console Output*). + . Click the build number to open its details and select the *Console Output* section in the leftmost menu. + image:registry-admin/regulations-deploy/auto-validation/registry-regulations-auto-validation-8.png[] + image:registry-admin/regulations-deploy/auto-validation/registry-regulations-auto-validation-7.png[] -+ -//. Ознайомтеся із причинами виникнення помилки. До консолі виводиться відповідне повідомлення та значення параметра, до якого застосовано валідацію: + . Find out what is causing the validation error. The log contains a corresponding error message and mentions the value of the parameter that triggered the validation check. + -//[ERROR] Наступні foreign keys містять символи у верхньому регістрі, що неприпустимо: [Fk_subject_subject_id] -+ ---- [ERROR] The following foreign keys contain uppercase letters, which is not allowed: [Fk_subject_subject_id] ---- + image:registry-admin/regulations-deploy/auto-validation/registry-regulations-auto-validation-1.png[] -+ -//. Прокрутіть бігунок униз сторінки та знайдіть повідомлення про результат невдалої збірки: + . Scroll to the bottom of the page and look for the build failed message: + ---- @@ -125,32 +100,23 @@ Finished: FAILURE image:registry-admin/regulations-deploy/auto-validation/registry-regulations-auto-validation-2.png[] ==== -//== Перевірка регістрів при налаштуванні ролей посадових осіб == Checking the officer roles letter case -//У системі реалізовано регламенту валідацію для перевірки регістрів для значень параметра `name` у файлі _roles/officer.yml_. Допускається лише нижній регістр. When building the regulations, the system performs letter case validation of the `name` parameter value in the _roles/officer.yml_ file. Only lowercase letters are allowed. -//Якщо у файлі _roles/officer.yml_, на рівні бізнес-процесів, значення параметра `name`, тобто назву ролі посадової особи, вказано у верхньому регістрі (наприклад, `name: Officer`), то збірка не пройде валідацію та завершиться помилкою на кроці `registry-regulations-validation`. If the value of the `name` parameter in the _roles/officer.yml_ file at the business processes level contains uppercase letters (for example, `name: Officer`), the build will fail at the `registry-regulations-validation` step. -//TIP: Процес спрацьовування валідації дивіться на прикладі перевірки регістрів у каталозі _data-model_ за xref:#example-validation-fk-name[посиланням]. TIP: For an example of how validation triggers when checking the letter case in the _data-model_ directory, see the xref:#example-validation-fk-name[previous section]. -//== Перевірка на дублювання та унікальність атрибутів у формах бізнес-процесів == Checking the uniqueness of attributes in the business process forms -//У системі реалізовано регламентну валідацію для перевірки атрибутів `name`, `display`, `title` і `type` на унікальність у каталозі _forms_. Валідація призначена для того, щоб коректно генерувати назву, тип і шлях знаходження форми у порталах (Кабінетах). When building the regulations, the system checks the uniqueness of the `name`, `display`, `title`, and `type` attributes in the _forms_ directory. This validation ensures that the name, type, and path to the form in user portals are generated correctly. -//Якщо значення параметрів не є унікальними та дублюються, то збірка регламенту не пройде валідацію та завершиться помилкою на кроці `registry-regulations-validation`. If the attributes are duplicated and their values are not unique, the build will fail at the `registry-regulations-validation` step. -//Виділять 2 основних критерії у цьому типі валідації: :: -There are 2 main criteria for this type of validation: :: -//. Атрибути `name`, `display`, `title` і `type` не повинні дублюватись у каталозі `forms`. +There are two main criteria for this type of validation: :: + . The `name`, `display`, `title`, and `type` attributes cannot be duplicated in the `forms` directory. -//.Приклад. Дублювання атрибута у формі + .The attribute is duplicated ==== @@ -162,10 +128,8 @@ There are 2 main criteria for this type of validation: :: } ---- ==== -+ -//. Атрибути `name`, `display`, `title` і `type` мають бути унікальними у каталозі `forms` при розгортанні регламенту реєстру. + . The `name`, `display`, `title`, and `type` attributes must have unique values in the `forms` directory when the registry regulations are deployed. -//.Приклад. Неунікальність атрибута у формі + .The attribute value is not unique ==== @@ -178,19 +142,14 @@ There are 2 main criteria for this type of validation: :: ---- ==== -//TIP: Процес спрацьовування валідації дивіться на прикладі перевірки регістрів у каталозі _data-model_ за xref:#example-validation-fk-name[посиланням]. TIP: For an example of how validation triggers when checking the letter case in the _data-model_ directory, see the xref:#example-validation-fk-name[previous section]. -//== Перевірка на унікальність значення ідентифікатора бізнес-процесу == Checking the uniqueness of business process identifiers -//У системі реалізовано регламентну валідацію для перевірки значення атрибута `process_definition_id` на унікальність у каталозі _bp-auth_. Валідація призначена для того, щоб коректно визначати ідентифікатор бізнес-процесу, до якого надається доступ користувачу. When building the regulations, the system checks the uniqueness of the `process_definition_id` attribute value is unique in the _bp-auth_ directory. This validation ensures the correct identification of the business process to which access is given. -//Якщо _значення_ атрибута `process_definition_id` в масиві `process_definitions` не є унікальним, то збірка не пройде валідацію та завершиться помилкою на кроці `registry-regulations-validation`, а в журналі виводитиметься опис помилки із текстом: `"[Process_id] Process_id не унікальний".` If the value of the `process_definition_id` attribute in the `process_definitions` array is not unique, the build will fail on the `registry-regulations-validation` step. The log will display the following error message: `"[Process_id] Process_id is not unique"` -//.Приклад. Неунікальність значення атрибута 'process_definition_id' .The process_definition_id value is not unique ==== [source,yaml] @@ -201,19 +160,14 @@ process_definitions: ---- ==== -//TIP: Процес спрацьовування валідації дивіться на прикладі перевірки регістрів у каталозі _data-model_ за xref:#example-validation-fk-name[посиланням]. TIP: For an example of how validation triggers when checking the letter case in the _data-model_ directory, see the xref:#example-validation-fk-name[previous section]. -//== Перевірка наявності бізнес-процесу в регламенті за значенням ідентифікатора == Checking the existence of business processes in the regulations -//У системі реалізовано регламенту перевірку наявності бізнес-процесу за значенням атрибута `process_definition_id` у каталозі _bp-auth_. Валідація призначена для того, щоб адміністратор регламенту міг внести значення _лише_ наявного в системі бізнес-процесу, до якого необхідно призначити доступ. When building the regulations, the system checks that a business process with a specified `process_definition_id` in the _bp-auth_ directory exists. This validation ensures that the registry administrator only grants access to business processes that exist in the system. -//Якщо _значення_ атрибута `process_definition_id` в масиві `process_definitions` не збігається з ідентифікатором вже змодельованого бізнес-процесу, то збірка не пройде валідацію та завершиться помилкою на кроці `registry-regulations-validation`. If the `process_definition_id` attribute value in the `process_definitions` array does not match any of the available business processes, the build will fail at the `registry-regulations-validation` step. -//.Приклад. Значення атрибута 'process_definition_id' для бізнес-процесу, що не існує в реєстрі .The process_definition_id value does not match any business processes in the registry ==== [source,yaml] @@ -223,7 +177,7 @@ authorization: process_definitions: - process_definition_id: 'add-lab777777777777777' process_name: 'Create lab' - process_description: 'Lab creation regulations' + process_description: 'Regulations for creating a lab' roles: - officer ---- diff --git a/docs/en/modules/registry-develop/pages/study-project/control-tasks/control-task-1.adoc b/docs/en/modules/registry-develop/pages/study-project/control-tasks/control-task-1.adoc index 2fe0fb378f..afa37db991 100644 --- a/docs/en/modules/registry-develop/pages/study-project/control-tasks/control-task-1.adoc +++ b/docs/en/modules/registry-develop/pages/study-project/control-tasks/control-task-1.adoc @@ -1,46 +1,31 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - -//= Контрольне завдання 1 = Test 1 +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] + +include::platform:ROOT:partial$admonitions/language-en.adoc[] -//== Мета завдання == Objectives -//_Виконання цього завдання має на меті:_ -//* отримати поглиблені практичні знання зі створення бізнес-процесів на Платформі. This test aims to give you in-depth practical knowledge of creating business processes on the Platform. - -//== Завдання == Tasks -//. Створіть модель даних на базі представленої таблиці. . Create a data model based on the following table. -//.Поля та їх опис + + .Fields and descriptions |==== -//|_№_|_Назва поля на формі та в логічній моделі даних_|_Назва поля у фізичній моделі даних_|_Формат_|_Довідник, що використовується_|_Обов'язковість_ + |No. |Field name on the form and in the logical data model |Field name in the physical data model |Format |Reference used |Required field -//|||Сутність ЗЗСО edu_organization||| 6+^|*edu_organization* entity |1|EDEBO ID|edu_organization_id_external|Number||+ |2|EDRPOU code|edrpou|dn_edrpou||+ |3|Full name|full_name|Text||+ |4|Short name|short_name|Text||+ -//|5|Статус закладу (Ідентифікатор статусів закладу)|edu_status_id|UUID|Статус закладу (edu_status)|+ + |5|Institution status (Institution status ID)|edu_status_id|UUID|Institution status (edu_status)|+ -//|6|Форма власності (Ідентифікатор форм власності)|ownership_id|UUID|Форми власності (ownership)|+ + |6|Ownership type (Ownership type ID)|ownership_id|UUID|Ownership type (ownership)|+ |7|Town|settlement|Text||+ |8|Address|address|Text||+ @@ -52,11 +37,11 @@ This test aims to give you in-depth practical knowledge of creating business pro |14|Accreditation date|date_of_accreditation|Date||- |==== + -//. Створіть endpoint (за типом Search condition) для заповнення поля `_Статус закладу_` з підтримкою доступу `READ ALL`. + . Create a search condition endpoint to fill the *Institution status* field with `READ ALL` access support. + .Input parameters: -[source, roomsql] +[source, sql] ---- SELECT edu_status_id, name, constant_code FROM edu_status ORDER BY name ASC; Parameters: none @@ -64,7 +49,7 @@ Constants: none ---- + .Output parameters: -[source, roomsql] +[source, sql] ---- UUID, working, WORKING UUID, suspended, SUSPENDED @@ -72,11 +57,11 @@ UUID, reorganized, REORGANIZED UUID, liquidated, LIQUIDATED ---- + -//. Створити endpoint (за типом Search condition) для заповнення поля `_Форма власності_` з підтримкою `LIKE` та `READ ALL`. + . Create a search condition endpoint to fill out the *Ownership type* field with `LIKE` and `READ ALL` support. + .Input parameters: -[source, roomsql] +[source, sql] ---- SELECT ownership_id, name FROM ownership ORDER BY name ASC; Parameters: none @@ -84,7 +69,7 @@ Constants: none ---- + .Output parameters: -[source, roomsql] +[source, sql] ---- UUID, State UUID, Private @@ -95,7 +80,7 @@ UUID, Corporate SEARCH BY LIKE:: + .Input parameters: -[source, roomsql] +[source, sql] ---- Input: SELECT ownership_id, name FROM ownership WHERE name LIKE '%держ%' ORDER BY name ASC ; Parameters: name @@ -103,21 +88,19 @@ Constants: none ---- + .Output parameters: -[source, roomsql] +[source, sql] ---- l.UUID, State ---- + -//. Створити форму для додавання інформації про школу (використати створені критерії пошуку в select-компонентах) та форму для підписання внесених даних. + . Create a form for adding information about schools and a form for signing data. Use the previously created search conditions in the Select components. + -//. Розробити бізнес-процесс створення школи, де businessKey: `ID EDEBO`, `Скорочена назва`, `Код ЄДРПОУ`. + . Develop a business process for adding schools using the following businessKey: `EDEBO ID`, `Short name`, `EDRPOU code`. -//== Очікуваний результат завдання == Expected result -//Змодельовано бізнес-процес створення нової школи у тестовому реєстрі. Бізнес-процес доступний у вигляді послуги в Кабінеті користувача. After completing this test, you should have the following: * A business process for adding schools to a test registry. diff --git a/docs/en/modules/registry-develop/pages/study-project/control-tasks/control-task-2.adoc b/docs/en/modules/registry-develop/pages/study-project/control-tasks/control-task-2.adoc index db9c0d743c..e955c197de 100644 --- a/docs/en/modules/registry-develop/pages/study-project/control-tasks/control-task-2.adoc +++ b/docs/en/modules/registry-develop/pages/study-project/control-tasks/control-task-2.adoc @@ -1,34 +1,22 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - -//= Контрольне завдання 2 = Test 2 +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] + +include::platform:ROOT:partial$admonitions/language-en.adoc[] -//== Мета завдання == Objectives -//_Виконання цього завдання має на меті:_ -//* отримати поглиблені практичні знання зі створення бізнес-процесів на Платформі. This test aims to deepen your practical skills in developing business processes. -//== Завдання == Tasks ["upperroman"] -//. Створіть модель даних на базі представленої таблиці. + . Create a data model based on the following table. + .Fields and descriptions |==== -//|_№_|_Назва поля на формі та в логічній моделі даних_|_Назва поля у фізичній моделі даних_|_Формат_|_Довідник, що використовується_|_Обов'язковість_ + |No. |Field name on the form and in the logical data model |Field name in the physical data model |Format |Reference used |Required field 6+^|*person_profile* entity @@ -36,11 +24,11 @@ This test aims to deepen your practical skills in developing business processes. |2|First name|first_name|Text||+ |3|Middle name|second_name|Text||- |4|Date of birth|birthday|Date||+ -//|5|Тип документа, що посвідчує особу дитини (ідентифікатор типів документів, що посвідчує особу дитини)|doc_type_id|UUID|link:{attachmentsdir}/study-project/control-task-2/dict_doc_type.csv[Тип документа (doc_type)]|+ + |5|Type of document certifying child's identity (document type ID)|doc_type_id|UUID|link:{attachmentsdir}/study-project/control-task-2/dict_doc_type.csv[Document type (doc_type)]|+ |6|Birth certificate series|birthday_doc_series|Text||- |7|Birth certificate number|birthday_doc_number|Text||- -//|8|Серія (за наявності) та номер документа дитини|document_series_number|Text||- + |8|Child's document series (if available) and number|document_series_number|Text||- |9|Gender|gender|Enum type="type_gender"||+ 6+^|*unit* entity @@ -52,13 +40,11 @@ This test aims to deepen your practical skills in developing business processes. |15|Maximum students|students_max_number|Smallint||+ |==== -//TIP: За детальною інформацією щодо створення *_Enum type_* зверніться до розділу xref:data-modeling/data/physical-model/liquibase-ddm-ext.adoc#ENUM[Тег створення перелічувального типу даних (ENUM)] відповідного документа. TIP: For details on creating *_Enum type_* fields, see xref:data-modeling/data/physical-model/liquibase-ddm-ext.adoc#ENUM[Tag for creating an enumerated data type (ENUM)]. -//. Створіть наступний перелік Search condition: . Create the following search conditions: + -//...... Створіть endpoint (за типом Search condition) для заповнення поля `Назва ЗЗСО, який я представляю` та `Назва ЗЗСО для зарахування` з підтримкою `EQUALS` *(edu_organization_edrpou_equals)*. + .. Create a search condition endpoint to fill the *Name of the institution I represent* and *Name of the institution for enrollment* fields with `EQUALS` *(edu_organization_edrpou_equals)* support. + SEARCH BY EQUALS:: @@ -80,7 +66,7 @@ Constants: none 6731fad5-8c80-4965-9fc6-c2cebd508f24, Yaroslav Osmomysl Galicia Lyceum ---- + -//...... Створіть endpoint (за типом Search condition) для перевірки наявності в ЗЗСО класу з відповідною назвою і паралеллю з підтримкою `EQUALS` *(unit_name_parallel_equals)*. + .. Create a search condition endpoint to check whether specific classes (name and grade) are available in the institution with `EQUALS` *(unit_name_parallel_equals)* support. + SEARCH BY EQUALS:: @@ -103,7 +89,7 @@ Or NULL ---- + -//...... Створіть endpoint (за типом Search condition) для заповнення поля `Тип класу` з підтримкою `LIKE` та `READ ALL` *(unit_type_name_contains)*. + .. Create a search condition endpoint to fill the *Class type* field with `LIKE` and `READ ALL` *(unit_type_name_contains)* support. + READ ALL:: @@ -144,7 +130,7 @@ Constants: none UUID, Special, SPECIAL_TYPE ---- + -//...... Створіть endpoint (за типом Search condition) для заповнення поля `Тип документа` з підтримкою `LIKE` та `READ ALL` *(doc_type_contains)*. + .. Create a search condition endpoint to fill the *Document type* field with `LIKE` and `READ ALL` *(doc_type_contains)* support. + READ ALL:: @@ -187,7 +173,7 @@ UUID, Birth certificate of a citizen of Ukraine, BIRTH_CERT_UKRAINE UUID, Birth certificate of a foreign citizen, BIRTH_CERT_FOREIGN ---- + -//...... Створіть endpoint (за типом Search condition) для заповнення поля `ПІБ дитини` та `Дата народження дитини` (для громадян України) з підтримкою `EQUALS` *(person_profile_equal_doc_type_birthday_ua)*. + .. Create a search condition endpoint to fill out the *Child's name* and *Child's date of birth* fields (for citizens of Ukraine) with `EQUALS` *(person_profile_equal_doc_type_birthday_ua)* support. + SEARCH BY EQUALS:: @@ -209,7 +195,7 @@ UUID, Ivanov, Ivan, Ivanovych, 01.01.2012 If the record does not exist Output:null ---- + -//...... Створіть endpoint (за типом Search condition) для заповнення поля `ПІБ дитини` та `Дата народження дитини` (для іноземних громадян) з підтримкою `EQUALS` *(person_profile_equal_doc_type_birthday_foreigner)*. + .. Create a search condition endpoint to fill out the *Child's name* and *Child's date of birth* fields (for foreign citizens) with `EQUALS` *(person_profile_equal_doc_type_birthday_foreigner)* support. + SEARCH BY EQUALS:: @@ -234,24 +220,24 @@ Output: null ---- + -//. Створіть наступний перелік форм: + . Create the following forms: + -//...... Форма для додавання інформації про клас (стартова форма). + .. A form for adding information about classes (start form). -//...... Форма для підписання внесених даних про клас. + .. A form for signing class data. -//...... Форма для додавання інформації про дитину (стартова форма). + .. A form for adding information about children (start form). -//...... Інформаційна форма про те, що дані провалідовані у ДРАЦС та можуть відрізнятися від введених. + .. An informational form stating that the data has been validated in the State registry of civil status acts and may differ from the data provided. -//...... Форма для підписання внесених даних про дитину. + .. A form for signing child data. + -//. Створіть наступні бізнес-процеси: + . Create the following business processes: -//["arabic"] -//.. Розробіть бізнес-процес створення класу, де `businessKey` -- `"паралель + назва класу"`. Додайте формування валідаційної помилки у разі якщо клас з такою назвою вже було створено й відобразіть це у повідомленні. Додайте динамічне формування назви задачі, щоб у повідомленні про виконання задачі відображалася інформація: _"Підписати дані про клас `"паралель + назва класу"` за допомогою КЕП"_. Перед завершенням бізнес-процесу необхідно визначати статусу цього бізнес-процесу. + + .. Develop a business process for adding classes, where `businessKey` is `"grade + class name"`. + Add validation to check whether a class with the same name has already been added and display an error message if true. @@ -260,7 +246,7 @@ Configure a dynamic task name so that the message about the execution of the tas + Before completing the business process, determine its status. + -//.. Розробіть бізнес-процесс створення профілю дитини, де `businessKey` - `ФІО дитини`. Додайте формування валідаційної помилки у разі якщо профіль дитини з таким документом вже було створено й відобразіть це у повідомленні. У разі якщо дитина має українське свідоцтво про народження необхідно здійснити пошук дитини у ДРАЦС. Наразі можливі два варіанти пошуку: + .. Develop a business process for creating a child profile, where `businessKey` is `child's full name`. + Add validation to check whether a child profile with the same document has already been created and display an error message if true. @@ -268,19 +254,17 @@ Add validation to check whether a child profile with the same document has alrea If a child has a Ukrainian birth certificate, search for the child in the State registry of civil status acts. Currently, two search options are possible: + -- -//* серія, номер свідоцтва та дата народження дитини; + * certificate series, certificate number, date of birth -//* серія, номер свідоцтва та ПІБ дитини. + * certificate series, certificate number, full name -- + -//Перед завершенням бізнес-процесу необхідно визначати статус цього бізнес-процесу. + Before completing the business process, determine its status. -//== Очікуваний результат завдання == Expected result -//Змодельовано бізнес-процес створення класу і профілю дитини у тестовому реєстрі. Бізнес-процес доступний у вигляді послуги в Кабінеті користувача. After completing this test, you should have the following: * Business processes for adding classes and child profiles in a test registry. diff --git a/docs/en/modules/registry-develop/pages/study-project/control-tasks/control-task-3.adoc b/docs/en/modules/registry-develop/pages/study-project/control-tasks/control-task-3.adoc index 57774ba78e..cbed1d9042 100644 --- a/docs/en/modules/registry-develop/pages/study-project/control-tasks/control-task-3.adoc +++ b/docs/en/modules/registry-develop/pages/study-project/control-tasks/control-task-3.adoc @@ -1,43 +1,31 @@ -:toc-title: On this page: -:toc: auto -:toclevels: 5 -:experimental: -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Test 3 +include::platform:ROOT:partial$templates/document-attributes/default-set-en.adoc[] + +include::platform:ROOT:partial$admonitions/language-en.adoc[] -//== Мета завдання == Objectives -//_Виконання цього завдання має на меті:_ During this test, you will: -//* отримати поглиблені практичні знання зі створення бізнес-процесів на Платформі; * Deepen your practical skills in developing the business processes on the Platform. -//* ознайомитися з вкладеними сутностями. + * Get familiar with nested entities. -//== Завдання == Tasks -//["upperroman"] -//. Створіть модель даних на базі представленої таблиці. + . Create a data model based on the following table. + [cols="5%,30%,30%,10%,20%,5%", options="header"] .Fields and descriptions |==== -//|_№_|_Назва поля на формі та в логічній моделі даних_|_Назва поля у фізичній моделі даних_|_Формат_|_Довідник, що використовується_|_Обов'язковість_ + |No. |Field name on the form and in the logical data model |Field name in the physical data model |Format |Reference used |Required field 6+^|*person_edu_profile* entity |1|Child profile ID|person_profile_id|Text||+ |2|Student status (Student status ID)|person_edu_state_id|UUID|link:{attachmentsdir}/study-project/control-task-3/dict-person-edu-state.csv[Student status (person_edu_state)]|+ -//|3|Ідентифікатор ЗЗСО (заклад освіти в якому навчається, або навчався учень на останній момент часу)|edu_organization_id|UUID Паспорту ЗЗСО (Edu_organization) з Паспорта ЗЗСО||+ + |3|Institution of general secondary education ID (Institution where the student is currently or was last studying)|edu_organization_id|UUID of the institution passport (Edu_organization) from the institution passport||+ 6+^|*orders* entity |4|Class ID|unit_id|UUID||+ @@ -52,17 +40,17 @@ During this test, you will: |12|Student's educational profile ID|person_edu_profile_id|UUID||+ |==== + -//. Створіть endpoint для сутностей `person_edu_profile`, `transaction`, `orders` за типом *_Composite Entity_*, в якій `orders` та `person_edu_profile` виступають батьківськими сутностями для `transaction`. + . Create a *Composite Entity* endpoint for the `person_edu_profile`, `transaction`, and `orders` entities, where `orders` and `person_edu_profile` entities are parents of the `transaction` entity. + -//TIP: За детальною інформацією щодо створення Composite Entity зверніться до розділу xref:data-modeling/data/physical-model/liquibase-ddm-ext.adoc#createCompositeEntity[Збереження декількох сутностей в рамках однієї транзакції] відповідного документа. + TIP: For details on creating Composite Entities, see xref:data-modeling/data/physical-model/liquibase-ddm-ext.adoc#createCompositeEntity[Saving multiple entities within a single transaction]. + -//. Створіть наступний перелік Search condition: + . Create the following search conditions: + -//["arabic"] -//.. Створіть за типом Search condition (*unit_edu_organization_id_equals*) для пошуку класів ЗЗСО з підтримкою `EQUALS`. + + .. Create a search condition (*unit_edu_organization_id_equals*) for searching institution classes with `EQUALS` support. SEARCH BY EQUALS:: @@ -87,7 +75,7 @@ Constants: none UUID, 1, A, general, 25, 5 ---- + -//.. Створіть за типом Search condition (*person_profile_equal*) для перевірки значення поля `'person_edu_profile_id'` з підтримкою `EQUALS`. + .. Create a search condition (*person_profile_equal*) to check the `'person_edu_profile_id'` field with `EQUALS` support. + SEARCH BY EQUALS:: @@ -112,7 +100,7 @@ If the record does not exist Output: null ---- + -//.. Створіть за типом Search condition (*person_edu_state_equal*) для заповнення поля "Статус учня" з підтримкою `READ ALL` та `EQUALS`. + .. Create a search condition (*person_edu_state_equal*) to fill out the `Student status` field with `READ ALL` and `EQUALS` support. + READ ALL:: @@ -154,7 +142,7 @@ Constants: none UUID, Studying, STUDYING ---- + -//.. Створіть за типом Search condition (*order_type_code_equals*) для заповнення поля "Тип наказу" з підтримкою `EQUALS`. + .. Create a search condition (*order_type_code_equals*) to fill out the `Order type` field with `EQUALS` support. + SEARCH BY EQUALS:: @@ -175,40 +163,38 @@ Constants: none UUID, Initial creation of an educational profile ---- + -//. Створіть наступний перелік форм: -//["arabic"] + + . Create the following forms: -//.. _Форма внесення даних для пошуку дитини (стартова)_ + .. A form for entering data to search for a child (start) -//.. _Форма внесення даних про освітній профіль_ + .. A form for entering data into the educational profile -//.. _Форма підписання даних про освітній профіль_ + .. A form for signing data for the educational profile -//{empty} + -//{empty} + + + + -//. Створіть наступний бізнес-процес: + . Create the following business process: + -//* Бізнес-процес створення освітнього профілю дитини, де `businessKey` - `"ФІО дитини"`. Додайте наступні перевірки: + * Develop a business process for creating a child's educational profile, where `businessKey` is `child's full name`. Add the following validations: + -- -//** профіль дитини було створено в реєстрі; + ** A child's profile was created in the registry. -//** освітній профіль дитини раніше не було створено. + ** A child's educational profile was not created previously. -- + -//Об'єкт, який зберігається в базу даних являє собою вкладену сутність. Перед завершенням бізнес-процесу необхідно визначати статус цього бізнес-процесу. + The object stored in the database is a nested entity. + Before completing the business process, determine its status. -//== Очікуваний результат завдання == Expected result -//Змодельовано бізнес-процес створення освітнього профілю дитини у тестовому реєстрі. Бізнес-процес доступний у вигляді послуги в Кабінеті користувача. After completing this test, you should have the following: * A business process for creating a child's educational profile in a test registry. diff --git a/docs/en/modules/registry-develop/pages/study-project/control-tasks/overview.adoc b/docs/en/modules/registry-develop/pages/study-project/control-tasks/overview.adoc index 9405bcb6ef..c4be650732 100644 --- a/docs/en/modules/registry-develop/pages/study-project/control-tasks/overview.adoc +++ b/docs/en/modules/registry-develop/pages/study-project/control-tasks/overview.adoc @@ -1,12 +1,9 @@ -//= Контрольні завдання = Tests -//Розділ охоплює контрольні завдання для самоперевірки після завершення навчальної частини. Наразі розроблені такі завдання, від простого до складного: This section covers the self-assessment tests you can take after completing the learning part of the training. Tests go from simple to complex. -//* xref:registry-develop:study-project/control-tasks/control-task-1.adoc[] -- має на меті отримати поглиблені практичні знання зі створення бізнес-процесів на Платформі. * xref:registry-develop:study-project/control-tasks/control-task-1.adoc[]: Gain in-depth practical knowledge of creating business processes on the Platform. -//* xref:registry-develop:study-project/control-tasks/control-task-2.adoc[] -- подальше поглиблення практичних навичок зі створення бізнес-процесів. + * xref:registry-develop:study-project/control-tasks/control-task-2.adoc[]: Deepen your practical skills in developing business processes. -//* xref:registry-develop:study-project/control-tasks/control-task-3.adoc[] -- подальше поглиблення практичних навичок зі створення бізнес-процесів, ознайомлення із вкладеними сутностями. + * xref:registry-develop:study-project/control-tasks/control-task-3.adoc[]: Deepen your business process creation skills even further by mastering nested entities. \ No newline at end of file diff --git a/docs/en/modules/registry-develop/pages/study-project/index.adoc b/docs/en/modules/registry-develop/pages/study-project/index.adoc index e310f2db11..1cef850806 100644 --- a/docs/en/modules/registry-develop/pages/study-project/index.adoc +++ b/docs/en/modules/registry-develop/pages/study-project/index.adoc @@ -3,55 +3,45 @@ include::ROOT:partial$templates/document-attributes/default-set-en.adoc[] include::ROOT:partial$admonitions/language-en.adoc[] -//Розділ містить xref:study-project/study-tasks/overview.adoc[навчальні] та xref:study-project/control-tasks/overview.adoc[контрольні] матеріали для розвитку практичних навичок по роботі з регламентом реєстрів. This section contains xref:study-project/study-tasks/overview.adoc[educational] and xref:study-project/control-tasks/overview.adoc[testing] materials for developing practical skills when working with registry regulations. -//Цей курс містить перелік навчальних завдань, які адміністратор регламенту виконуватиме покроково, від простого до складного. The course consists of a set of training tasks for the regulations administrators to complete one by one, from simple to complex. -//Також для закріплення практичного матеріалу розроблено контрольні завдання. Practical assignments are developed to reinforce the learning materials. -//== Загальні положення == Overview === What are registry regulations -//[.underline]#Регламент реєстру# -- це набір сутностей, що зібрані в окремому git-каталозі за певною структурою. Кожна сутність -- це папка, що містить набір файлів (шаблони, схеми, конфігураційні файли тощо), які виконують певні задачі для роботи за певними правилами у рамках бізнес-процесів. _Registry regulations_ are a set of entities collected in a separate Git directory according to a particular structure. Each entity is a folder with a group of files (such as templates, schemas, and configuration files) that perform specific tasks according to the rules within the business processes framework. TIP: For details, see xref:registry-develop:registry-admin/regulations-deploy/registry-regulations-structure.adoc[]. === How are the regulations deployed -//Розгортання регламенту реєстру автоматизовано інструментами CI/CD. За розгортання регламенту відповідає Jenkins-пайплайн публікацій `*MASTER-Build-registry-regulations*` та пов'язані пайплайни. Registry regulations deployment is automated by the CI/CD tools. The `*MASTER-Build-registry-regulations*` Jenkins pipeline and related pipelines are responsible for deploying the regulations. TIP: For details, see xref:arch:architecture/registry/administrative/regulation-management/registry-regulation/registry-regulation.adoc[]. [NOTE] ==== -//Збірка коду (Build) стосується лише тих файлів, які були в останньому коміті (commit). + Code build applies only to the files that were in the latest commit. For example: :: -//* У першому коміті (`git commit`) ви внесли зміни до 2-х файлів (_form.json_ для UI-форми та _process.bpmn_ для процесу) та зберегли зміни до майстер-версії Gerrit-репозиторію (`git push` + `git merge`). * In the first commit (`git commit`), you modified two files (_form.json_ for the UI form and _process.bpmn_ for the process) and saved the changes to the master version of the Gerrit repository (`git push` + `git merge`). -//* Пайплайн публікацій регламенту не пройшов із помилкою на кроці валідації. + * The regulations publication pipeline failed the validation step. -//* У другому коміті ви вносите зміни до файлу _form.json_, виправляючи помилку. Припустимо, що з ним була проблема. + * In the second commit, you make changes to the _form.json_ file, fixing the error. -//* Пайплайн публікацій проходить, але в такому випадку ваш бізнес-процес не розгорнеться й не відобразиться у Кабінеті користувачів (хоча в Gerrit-репозиторії й лежатиме). + * This time the publication pipeline goes through, but your business process is not deployed and does not appear in the user portal, even though it is present in the Gerrit repository. -//Для розв'язання такої проблеми необхідно, щоб після невдалої збірки (проходження пайплайну) у новому коміті також були присутні усі ті файли, які ви намагалися розгорнути з попереднім комітом. To solve this issue, ensure that the next commit after a failed build contains all the files you previously tried to deploy. -//Повертаючись до прикладу вище, вам необхідно у другому коміті додати й файл з UI-формою, яку ви підправили, й файл зі схемою бізнес-процес, який після невдалої збірки не розгорнувся. Going back to our example, your second commit must include both the UI form file that you patched *and* the business process schema file that failed to deploy previously. -//Щоб додати файл (в якому не було помилок) в репозиторій, можете внести незначні зміни (відступ у кінці, або пробіл) -- це необхідно для того, щоб він потрапив до нового коміту. To ensure a file that had no fixable errors gets into the new commit, make minor changes, such as an indent or a space at the end. ==== @@ -61,143 +51,21 @@ To ensure a file that had no fixable errors gets into the new commit, make minor === Local environment setup -//Snippet include::partial$snippets/study/local-environment-setup-en.adoc[] === Development tools: work environment include::partial$snippets/study/platform-tools-en.adoc[] -//// -Цей розділ презентує перелік основних сервісів та інструментів, якими доведеться, або зручно користуватися в процесі розробки та супроводу реєстрів. - -. https://console-openshift-console.apps.envone.dev.registry.eua.gov.ua/[*OpenShift (Kubernetes)*] -- консоль керування Платформою. Призначення: - -+ -* Перегляд технічних логів. -* Управління подами (програмами, частинами мікросервісної архітектури реєстру). -* Перегляд посилань, що доступні в рамках реєстру (список посилань до вебпорталів, Gerrit, Jenkins тощо). -* Перегляд секретів (username:password) для доступу до різних систем. - -. https://kibana-openshift-logging.apps.envone.dev.registry.eua.gov.ua/app/kibana[*Kibana*] -- сервіс перегляду технічних логів. -+ -Найбільш поширені випадки використання Kibana: - -* Пошук причин помилки за `traceId`. -* Пошук причетних логів за id конкретного бізнес-процесу (за аналогію до `traceId`). - -+ -[TIP] -==== -Документація: :: -xref:registry-develop:bp-modeling/bp/kibana.adoc[]. -==== - -. https://gerrit-control-plane-platform-main.apps.envone.dev.registry.eua.gov.ua/[*Gerrit*] -- система рецензування коду, сховище коду регламенту реєстру. -+ -[TIP] -==== -Документація: :: -xref:registry-develop:registry-admin/regulations-deploy/registry-admin-deploy-regulation.adoc[]. -==== - -. https://jenkins-control-plane-platform-main.apps.envone.dev.registry.eua.gov.ua/[*Jenkins*] -- сервіс для автоматизованої збірки коду та розгортання компонентів регламенту. Призначення: - -* Перегляд та управління процесом збірки коду. -* Перегляд логів, пов'язаних зі збіркою та розгортанням. - -+ -[TIP] -==== -Документація: :: - -* xref:platform-develop:registry-regulations-deployment.adoc[] -* xref:registry-develop:registry-admin/regulations-deploy/registry-regulations-auto-validation.adoc[] -==== - -. *Camunda Cockpit* -- сервіс для адміністрування екземплярів бізнес-процесів. -+ -Призначення: - -* Адміністрування бізнес-процесів -* Моніторинг бізнес-процесів -* Перевірка розгортання бізнес-процесів - -+ -[TIP] -==== -Посилання до сервісу: :: https://business-proc-admin-.apps.envone.dev.registry.eua.gov.ua/ - -Документація: :: -xref:registry-develop:registry-admin/registry-admin-bp-management-cockpit.adoc[]. -==== - -. https://platform-keycloak.apps.envone.dev.registry.eua.gov.ua/[*Keycloak*] -- сервіс управління ідентифікацією користувачів та надання їм прав доступу. - -+ -[TIP] -==== -Документація: :: - -* xref:registry-develop:registry-admin/create-users/manual-user-creation.adoc[] -* xref:admin:user-management-auth/keycloak-create-users.adoc[] -==== - -. *Swagger* -- інструмент для перегляду згенерованих API-точок доступу реєстру. - -+ -[TIP] -==== -Посилання до сервісу: :: https://registry-rest-api-.apps.envone.dev.registry.eua.gov.ua/openapi. - -Обов'язково додавайте [.underline]`*/openapi*` в кінець посилання, інакше ви потрапите до тестового середовища (пісочниці) Swagger. -==== - -. *pgAdmin* -- інструмент для роботи із базою даних реєстру, перегляд таблиць та представлень (Search Conditions). -+ -[TIP] -==== -Посилання до сервісу: :: https://pgadmin-.apps.envone.dev.registry.eua.gov.ua/. -==== - -. *Redash* -- інструмент для роботи з аналітичною звітністю. Створення та перегляд аналітичної звітності, створення запитів (Queries) та дашбордів (Dashboards), публікація та експорт звітності. -+ -Є 2 екземпляри (сервіси) Redash: :: - -* `*redash-admin*` -- необхідний для моделювання запитів та звітів зі сторони розробників/адміністраторів реєстру. -+ -[TIP] -==== -Посилання до сервісу: :: -https://redash-admin-.apps.envone.dev.registry.eua.gov.ua/ - -Документація: :: - -* xref:registry-develop:study-project/study-tasks/task-6-registry-reports-modeling.adoc[] (Детальний опис створення та публікації аналітичної звітності) - -* xref:registry-develop:data-modeling/reports/data-analytical-reports-creation.adoc[] -* xref:registry-develop:data-modeling/reports/data-analytical-data-access-rights.adoc[] -==== - -* `*redash-viewer*` -- необхідний для перегляду сформованих звітів зі сторони користувачів кабінету посадової особи (авторизація за допомогою КЕП ключа). -+ -[TIP] -==== -Посилання до сервісу: https://redash-viewer-.apps.envone.dev.registry.eua.gov.ua/ -==== -//// - == Registry regulations modeling roadmap -//Дорожня карта з моделювання регламенту (Roadmap) показує верхньорівневі етапи по роботі з основними сутностями регламенту та надає загальний контекст командам розробки та супроводу реєстрів. The regulations modeling roadmap shows high-level stages of working with the main elements of the regulations and provides a general context for the registry development and maintenance teams. [NOTE] ==== -//На діаграмі представлено лише основні елементи регламенту. + The diagram shows only the main elements of the regulations. -//Платформа наразі дозволяє гнучко налаштовувати широкий спектр функціональності в рамках роботи з регламентом. Наприклад, _моделювання витягів різних форматів_, _налаштування відправлення повідомлень різними каналами зв'язку_, _управління налаштування реєстру_ тощо. The Platform provides flexible customization options for a wide range of features related to working with the regulations—for example, modeling excerpts in different formats, configuring notifications through various communication channels, managing registry settings, and so on. ==== @@ -205,162 +73,141 @@ image:study-project/registry-regulations-roadmap.png[] == Study tasks -//У цьому розділі представлені етапи, які знайомлять безпосередньо із практичними завданнями курсу та проводять короткий екскурс до основних задач, над якими працюватиме розробник регламенту. This section goes over the training stages and introduces the practical tasks that the registry regulations developer is required to perform. -//=== Створити модель даних реєстру === Create the registry data model -//В рамках цього завдання моделювальники мають: :: As part of this task, the modeler needs to: :: -//. Створити логічну модель даних, створити ERD-діаграму. . Create a logical data model and an ERD diagram. -//. Створити фізичну модель даних відповідно до логічної моделі: + . Create a physical data model based on the logical model: + -//* Створити план розробки фізичної моделі: + * Create a physical model development plan: -//** Визначити первинні ключі для кожної із сутностей. + ** Define primary keys for each of the entities. -//** Визначити вторинні ключі, якщо вони є в сутності. + ** Define secondary keys if the entity has them. -//** Визначити обов'язкові поля. + ** Identify mandatory fields. -//** Визначити поля або комбінацію полів, що мають унікальні значення. + ** Identify fields or a combination of fields that have unique values. -//** Визначити назву таблиць та полів латиницею. + ** Define the names of tables and fields in Latin characters. + -//* Створити таблиці та зв'язки між ними. + * Create tables and relationships between them. -//* Створити критерії пошуку (таблиці-представлення, `VIEW`). + * Create search conditions (view tables). -//* Виконати первинне наповнення даними таблиць-довідників. -//TODO: Таблиці-довідники - це reference tables? -* Perform initial data load for reference tables. -//. Застосувати розроблену модель у регламенті. + + +* Perform an initial data load for reference tables. + . Apply the developed model via the regulations. TIP: For details, see xref:study-project/study-tasks/task-1-registry-db-modeling.adoc[]. -//=== Змоделювати простий бізнес-процес без інтеграцій === Model a simple business process without integration As part of this task, the modeler needs to: :: -//. Змоделювати простий бізнес-процес без інтеграцій із фабрикою даних або іншими реєстрами. . Model a simple business process without integration with the data factory or other registries. -//. Створити UI-форми введення даних до бізнес-процесу. + . Create data entry UI forms for the business process. -//. Визначити ролі та надати права доступу до бізнес-процесу. + . Define the roles and grant access to the business process. -//. Застосувати зміни у регламенті. + . Apply changes to the regulations. TIP: For details, see xref:study-project/study-tasks/task-2-bp-modeling-without-integration.adoc[]. -//=== Змоделювати бізнес-процес з інтеграцією === Model a business process with integration As part of this task, the modeler needs to: :: -//. Змоделювати бізнес-процес, що має інтеграцію з фабрикою даних. . Model a business process integrated with the data factory. -//* Змоделювати гілки у бізнес-процесі. + * Model business process branches. -//* Змоделювати уніфіковані кроки у бізнес-процесах за допомогою `Call Activity`. + * Model unified steps in the business processes using `Call Activity`. -//. Змоделювати UI-форми введення даних до бізнес-процесу та налаштувати компоненти `Select` для отримання даних із фабрики даних. + . Model the UI forms for entering data into the business process and configure the `Select` components to retrieve data from the data factory. -//. Визначити ролі та надати права доступу до бізнес-процесу. + . Define the roles and grant access to the business process. -//. Застосувати зміни у регламенті. + . Apply changes to the regulations. TIP: For details, see xref:study-project/study-tasks/task-3-bp-modeling-with-integration.adoc[]. -//=== Змоделювати бізнес-процес зі стартовою формою та залежними компонентами на формах === Model a business process with a start form and dependent components on forms As part of this task, the modeler needs to: :: -//. Змоделювати бізнес-процес, який має стартову форму. . Model a business process that has a start form. -//. Змоделювати UI-форми введення даних із залежними компонентами та компонентом *Edit Grid*. + . Model data entry UI forms with dependent components and an *Edit Grid* component. -//. Визначити ролі та надати права доступу до бізнес-процесу. + . Define the roles and grant access to the business process. -//. Застосувати зміни у регламенті. + . Apply changes to the regulations. TIP: For details, see xref:study-project/study-tasks/task-4-bp-modeling-with-start-form-and-depending-components.adoc[]. -//=== Змоделювати бізнес-процес із декількома учасниками === Model a business process with multiple participants As part of this task, the modeler needs to: :: -//. Змоделювати бізнес-процес, що має декількох учасників. . Model a business process that has multiple participants. -//. Змоделювати UI-форми введення даних та налаштувати їх за допомогою *formVariables*. + . Model data entry UI forms and configure them using *formVariables*. . Define the roles and grant access to the business process. . Apply changes to the regulations. TIP: For details, see xref:study-project/study-tasks/task-5-bp-modeling-multiple-participants.adoc[]. -//=== Розробити аналітичну звітність === Prepare analytical reports As part of this task, the modeler needs to: :: -//. Змоделювати аналітичне представлення. . Model an analytics view. -//. Надати доступ до аналітичного представлення. + . Provide access to the analytics view. -//. Створити 3 запити (Query) в Redash. + . Create three queries in Redash. -//. Створити дашборд в Redash. + . Create a dashboard in Redash. -//. Вивантажити архів із дашбордом та розпакувати його в регламенті. + . Download the archive with the dashboard and unpack it in the regulations. -//. Перенести зміни до віддаленого Gerrit-репозиторію. + . Apply the changes to the remote Gerrit repository. -//. Перевірити сформований звіт у Кабінеті посадової особи. + . Verify the report in the officer's portal. TIP: For details, see xref:study-project/study-tasks/task-6-registry-reports-modeling.adoc[]. === Model a business process with a call to Secure exchange gateway -//TODO: Maybe delete this point: UA specific or substitute with the REST connector As part of this task, the modeler needs to: :: -//. Змоделювати 1 бізнес-процес. . Model one business process. -//. Змоделювати 3 форми внесення даних до бізнес-процесу. -. Model 3 data entry UI forms for the business process. -//. Надати доступи до бізнес-процесу для відповідних ролей. + +. Model three data entry UI forms for the business process. + . Grant access to the business process for corresponding roles. -//. Зберегти створені артефакти до локального git-репозиторію. + . Save the created artifacts to the local Git repository. -//. Перенести локальні зміни до віддаленого Gerrit-репозиторію. + . Apply local changes to the remote Gerrit repository. -//. Перевірити працездатність бізнес-процесу. -. Check the functionality of the business process. -TIP: For details, see xref:study-project/study-tasks/task-7-bp-modeling-trembita-invocation.adoc[]. +. Check the functionality of the business process. -//== Контрольні завдання == Tests -//Розділ охоплює контрольні завдання для самоперевірки після завершення навчальної частини. Наразі розроблені такі завдання, від простого до складного: This section covers the self-assessment tests you can take after completing the learning part of the training. Tests go from simple to complex. -//* xref:registry-develop:study-project/control-tasks/control-task-1.adoc[] -- має на меті отримати поглиблені практичні знання зі створення бізнес-процесів на Платформі. * xref:registry-develop:study-project/control-tasks/control-task-1.adoc[]: Gain in-depth practical knowledge of creating business processes on the Platform. -//* xref:registry-develop:study-project/control-tasks/control-task-2.adoc[] -- подальше поглиблення практичних навичок зі створення бізнес-процесів. + * xref:registry-develop:study-project/control-tasks/control-task-2.adoc[]: Deepen your practical skills in developing business processes. -//* xref:registry-develop:study-project/control-tasks/control-task-3.adoc[] -- подальше поглиблення практичних навичок зі створення бізнес-процесів, ознайомлення із вкладеними сутностями. + * xref:registry-develop:study-project/control-tasks/control-task-3.adoc[]: Deepen your business process creation skills even further by mastering nested entities. \ No newline at end of file diff --git a/docs/en/modules/registry-develop/pages/study-project/study-tasks/task-2-bp-modeling-without-integration.adoc b/docs/en/modules/registry-develop/pages/study-project/study-tasks/task-2-bp-modeling-without-integration.adoc index 78e1f85313..b7f75499e9 100644 --- a/docs/en/modules/registry-develop/pages/study-project/study-tasks/task-2-bp-modeling-without-integration.adoc +++ b/docs/en/modules/registry-develop/pages/study-project/study-tasks/task-2-bp-modeling-without-integration.adoc @@ -55,7 +55,7 @@ Before you start working on the task, complete these prerequisite steps: //На етапі моделювання бізнес-процесу необхідно створити та зберегти відповідну BPMN-діаграму. At the business process modeling stage, you need to create and save the corresponding BPMN diagram. -//Використовуйте файл _link:{attachmentsdir}/study-project/task-1/bp-schema/add-lab-test.bpmn[add-lab-test.bpmn]_ із готовою схемою бізнес-процесу для прикладу. +//Використовуйте файл _link:{attachmentsdir}/study-project/task-registry-update/bp-schema/add-lab-test.bpmn[add-lab-test.bpmn]_ із готовою схемою бізнес-процесу для прикладу. Download the _link:{attachmentsdir}/study-project/task-1/bp-schema/add-lab-test.bpmn[add-lab-test.bpmn]_ file with a sample business process schema to use as an example. ==== @@ -307,7 +307,7 @@ During the forms modeling stage, you need to create and connect JSON forms to th //Форми прив'язуються до бізнес-процесів за службовою назвою. The forms are connected to business processes using the service name. -//Використовуйте файли _link:{attachmentsdir}/study-project/task-1/bp-forms/add-lab-bp-add-lab-test.json[add-lab-bp-add-lab-test.json]_ та _link:{attachmentsdir}/study-project/task-1/bp-forms/add-lab-bp-view-lab-test.json[add-lab-bp-view-lab-test.json]_ зі змодельованими формами для прикладу. +//Використовуйте файли _link:{attachmentsdir}/study-project/task-registry-update/bp-forms/add-lab-bp-add-lab-test.json[add-lab-bp-add-lab-test.json]_ та _link:{attachmentsdir}/study-project/task-registry-update/bp-forms/add-lab-bp-view-lab-test.json[add-lab-bp-view-lab-test.json]_ зі змодельованими формами для прикладу. Use the _link:{attachmentsdir}/study-project/task-1/bp-forms/add-lab-bp-add-lab-test.json[add-lab-bp-add-lab-test.json]_ and _link:{attachmentsdir}/study-project/task-1/bp-forms/add-lab-bp-view-lab-test.json[add-lab-bp-view-lab-test.json]_ sample files with form examples. ==== @@ -374,7 +374,7 @@ To add and edit forms, you need to create a version candidate by selecting the * image:registry-develop:study-project/task-1/task-1-16-forms.png[] //. У полі `Назва версії` вкажіть, наприклад, _"завдання-1"_, а в полі `Опис зміни` _“Створення форм для Завдання 1”_. Після зазначення назви та опису натисніть `Створити`. . In the *Create new request* window, fill out the following fields: -* *Version name*: Enter `task-1`. +* *Version name*: Enter `task-registry-update`. * *Version description*: Enter `Creating forms for task 1`. + Click the *`Create`* button. @@ -493,7 +493,7 @@ image:registry-develop:study-project/task-1/task-1-14-forms.png[] //На цьому етапі необхідно надати доступ до бізнес-процесу із Кабінету посадової особи. At this stage, you need to grant access to the business process from the officer portal. -//Параметри доступу налаштовуються у конфігураційному файлі, що має назву _link:{attachmentsdir}/study-project/task-1/bp-access/officer.yml[officer.yml]_. +//Параметри доступу налаштовуються у конфігураційному файлі, що має назву _link:{attachmentsdir}/study-project/task-registry-update/bp-access/officer.yml[officer.yml]_. Access parameters are configured via the _link:{attachmentsdir}/study-project/task-1/bp-access/officer.yml[officer.yml]_ file. ==== diff --git a/docs/en/modules/registry-develop/pages/study-project/study-tasks/task-3-bp-modeling-with-integration.adoc b/docs/en/modules/registry-develop/pages/study-project/study-tasks/task-3-bp-modeling-with-integration.adoc index 7cb8fb3f81..31d312aa35 100644 --- a/docs/en/modules/registry-develop/pages/study-project/study-tasks/task-3-bp-modeling-with-integration.adoc +++ b/docs/en/modules/registry-develop/pages/study-project/study-tasks/task-3-bp-modeling-with-integration.adoc @@ -52,7 +52,7 @@ Before proceeding with the task, the following prerequisites must be fulfilled: //На етапі моделювання бізнес-процесу необхідно створити та зберегти відповідну BPMN-діаграму. During the business process modeling phase, it is necessary to create and save the corresponding BPMN diagram. -//Використовуйте файл _link:{attachmentsdir}/study-project/task-3/bp-schema/add-lab.bpmn[add-lab.bpmn]_ із готовою схемою бізнес-процесу для прикладу. +//Використовуйте файл _link:{attachmentsdir}/study-project/task-backup-restore/bp-schema/add-lab.bpmn[add-lab.bpmn]_ із готовою схемою бізнес-процесу для прикладу. Please use the _link:{attachmentsdir}/study-project/task-3/bp-schema/add-lab.bpmn[add-lab.bpmn]_ file with the pre-designed business process schema as an example. ==== @@ -712,7 +712,7 @@ During the form modeling stage, you need to create and link JSON forms to the pr //Форми прив'язуються до бізнес-процесів за службовою назвою. Forms are linked to business processes by the service name. -//Використовуйте файли _link:{attachmentsdir}/study-project/task-3/bp-forms/add-lab-bp-add-lab.json[add-lab-bp-add-lab.json]_ та _link:{attachmentsdir}/study-project/task-3/bp-forms/add-lab-sign-lab-data.json[add-lab-sign-lab-data.json]_ зі змодельованими формами для прикладу. +//Використовуйте файли _link:{attachmentsdir}/study-project/task-backup-restore/bp-forms/add-lab-bp-add-lab.json[add-lab-bp-add-lab.json]_ та _link:{attachmentsdir}/study-project/task-backup-restore/bp-forms/add-lab-sign-lab-data.json[add-lab-sign-lab-data.json]_ зі змодельованими формами для прикладу. Use the files _link:{attachmentsdir}/study-project/task-3/bp-forms/add-lab-bp-add-lab.json[add-lab-bp-add-lab.json]_ and _link:{attachmentsdir}/study-project/task-3/bp-forms/add-lab-sign-lab-data.json[add-lab-sign-lab-data.json]_ with the modeled forms as examples. ==== @@ -1111,7 +1111,7 @@ image:registry-develop:study-project/task-3/task-3-51-forms.png[] //На цьому етапі необхідно надати доступ до бізнес-процесу в Кабінеті посадової особи для стандартної ролі `officer` . At this stage, it is necessary to provide access to the business process in the Officer portal for the standard `officer` role. -//Параметри доступу налаштовуються у конфігураційному файлі, що має назву _link:{attachmentsdir}/study-project/task-3/bp-access/officer.yml[officer.yml]_ із директорії _bp-auth_. +//Параметри доступу налаштовуються у конфігураційному файлі, що має назву _link:{attachmentsdir}/study-project/task-backup-restore/bp-access/officer.yml[officer.yml]_ із директорії _bp-auth_. Access parameters are configured in the configuration file named _link:{attachmentsdir}/study-project/task-3/bp-access/officer.yml[officer.yml]_ in the _bp-auth_ directory. ==== diff --git a/docs/en/modules/registry-develop/pages/study-project/study-tasks/task-4-bp-modeling-with-start-form-and-depending-components.adoc b/docs/en/modules/registry-develop/pages/study-project/study-tasks/task-4-bp-modeling-with-start-form-and-depending-components.adoc index b90af8ffe1..d898a1abf3 100644 --- a/docs/en/modules/registry-develop/pages/study-project/study-tasks/task-4-bp-modeling-with-start-form-and-depending-components.adoc +++ b/docs/en/modules/registry-develop/pages/study-project/study-tasks/task-4-bp-modeling-with-start-form-and-depending-components.adoc @@ -917,7 +917,7 @@ image:registry-develop:study-project/task-4/task-4-31-forms.png[] //На цьому етапі необхідно надати доступ до бізнес-процесу в Кабінеті посадової особи для стандартної ролі `officer` . At this stage, you need to grant access to the business process from the officer portal for the standard `officer` role. -//Параметри доступу налаштовуються у конфігураційному файлі, що має назву _link:{attachmentsdir}/study-project/task-3/bp-access/officer.yml[officer.yml]_ із директорії _bp-auth_. +//Параметри доступу налаштовуються у конфігураційному файлі, що має назву _link:{attachmentsdir}/study-project/task-backup-restore/bp-access/officer.yml[officer.yml]_ із директорії _bp-auth_. Access parameters are configured via the _link:{attachmentsdir}/study-project/task-3/bp-access/officer.yml[officer.yml]_ file from the _bp-auth_ folder. ==== diff --git a/docs/en/modules/registry-develop/pages/study-project/study-tasks/task-5-bp-modeling-multiple-participants.adoc b/docs/en/modules/registry-develop/pages/study-project/study-tasks/task-5-bp-modeling-multiple-participants.adoc index 809105e9ff..9e15b73add 100644 --- a/docs/en/modules/registry-develop/pages/study-project/study-tasks/task-5-bp-modeling-multiple-participants.adoc +++ b/docs/en/modules/registry-develop/pages/study-project/study-tasks/task-5-bp-modeling-multiple-participants.adoc @@ -52,7 +52,7 @@ Before proceeding with the task, the following prerequisites must be completed: //На етапі моделювання бізнес-процесу необхідно створити та зберегти відповідну BPMN-діаграму. During the modeling phase of the business process, it is necessary to create and save the corresponding BPMN diagram. -//Використовуйте файл _link:{attachmentsdir}/study-project/task-5/bp-schema/citizen-add-lab.bpmn[citizen-add-lab.bpmn]_ із готовою схемою бізнес-процесу як приклад. +//Використовуйте файл _link:{attachmentsdir}/study-project/task-3/bp-schema/citizen-add-lab.bpmn[citizen-add-lab.bpmn]_ із готовою схемою бізнес-процесу як приклад. Use the file _link:{attachmentsdir}/study-project/task-5/bp-schema/citizen-add-lab.bpmn[citizen-add-lab.bpmn]_ with a ready-made business process schema as an example. ==== @@ -207,7 +207,7 @@ image:study-project/task-5/task-5-bp-3.png[] //На цьому етапі необхідно _змоделювати користувацьку задачу_ `Додати інформацію про лабораторію`. At this stage, it is necessary to _model a user task_ `Add laboratory information` for data entry by the user. To do this, follow these steps: -//На прикладі xref:study-project/study-tasks/task-3-bp-modeling-with-integration.adoc#create-task-add-lab-data[Завдання 3] створіть користувацьку задачу, призначену для внесення даних користувачем. Для цього виконайте наступні кроки: +//На прикладі xref:study-project/study-tasks/task-backup-restore-bp-modeling-with-integration.adoc#create-task-add-lab-data[Завдання 3] створіть користувацьку задачу, призначену для внесення даних користувачем. Для цього виконайте наступні кроки: Using the example from xref:study-project/study-tasks/task-3-bp-modeling-with-integration.adoc#create-task-add-lab-data[Task 3], create a new user task for data entry by the user. To do this, follow these steps: //. Оберіть прямокутник із задачею скриптування, змодельованою на xref:#create-script-task-prepare-data-view[попередньому етапі], та приєднайте нову задачу. @@ -243,7 +243,7 @@ image:study-project/task-5/task-5-bp-4.png[] //На цьому етапі необхідно _створити сервісну задачу_ `Пошук даних про лабораторію (transient var)`. At this stage, it is necessary to _create a service task_ `Search for laboratory data (transient var)` for searching laboratory data. To do this, follow these steps: -//На прикладі xref:study-project/study-tasks/task-3-bp-modeling-with-integration.adoc#create-service-task-search-lab-data[Завдання 3] змоделюйте сервісну задачу для пошуку даних про лабораторію. Для цього виконайте наступні кроки: +//На прикладі xref:study-project/study-tasks/task-backup-restore-bp-modeling-with-integration.adoc#create-service-task-search-lab-data[Завдання 3] змоделюйте сервісну задачу для пошуку даних про лабораторію. Для цього виконайте наступні кроки: Using the example from xref:study-project/study-tasks/task-3-bp-modeling-with-integration.adoc#create-service-task-search-lab-data[Task 3] model a service task for searching for laboratory data. To do this, follow these steps: //. Оберіть прямокутник із користувацькою задачею `Додати інформацію про лабораторію`, змодельованою на xref:#create-user-task-add-lab-data[попередньому етапі], та приєднайте нову задачу, натиснувши іконку *Append Task*. @@ -322,7 +322,7 @@ image:study-project/task-5/task-5-bp-7.png[] //==== Створення та заповнення XOR-шлюзу "Дані присутні?" ==== Creating and configuring an XOR gateway "Are data present?" -//На прикладі xref:study-project/study-tasks/task-3-bp-modeling-with-integration.adoc#create-xor-gateway[Завдання 3] приєднайте XOR-шлюз. Для цього виконайте кроки, подані нижче: +//На прикладі xref:study-project/study-tasks/task-backup-restore-bp-modeling-with-integration.adoc#create-xor-gateway[Завдання 3] приєднайте XOR-шлюз. Для цього виконайте кроки, подані нижче: Using the example from xref:study-project/study-tasks/task-3-bp-modeling-with-integration.adoc#create-xor-gateway[Task 3] attach an XOR Gateway. Follow the steps below: //. Оберіть прямокутник із сервісною задачею `Пошук даних про лабораторію (transient var)`, змодельованою на xref:#create-service-task-search-lab-data-transient-var[попередньому етапі], та приєднайте XOR-шлюз, натиснувши іконку *Append Gateway*. @@ -338,7 +338,7 @@ image:study-project/task-5/task-5-bp-8.png[] //==== Створення гілки з валідаційною помилкою ==== Creating a branch with a validation error -//На прикладі xref:study-project/study-tasks/task-3-bp-modeling-with-integration.adoc#create-validation-error-branch[Завдання 3] створіть гілку з валідаційною помилкою. Для цього виконайте кроки, подані нижче: +//На прикладі xref:study-project/study-tasks/task-backup-restore-bp-modeling-with-integration.adoc#create-validation-error-branch[Завдання 3] створіть гілку з валідаційною помилкою. Для цього виконайте кроки, подані нижче: Using the example from xref:study-project/study-tasks/task-3-bp-modeling-with-integration.adoc#create-validation-error-branch[Task 3] create a branch with a validation error. Follow the steps below: //. Оберіть ромб із XOR-шлюзом `Дані присутні?`, змодельованим на xref:#create-xor-gateway[попередньому етапі], та створіть нову сервісну задачу, натиснувши іконку *Append Task*. @@ -388,7 +388,7 @@ image:study-project/task-5/task-5-bp-10.png[] //==== Створення гілки з подальшим продовженням бізнес-процесу ==== Creating a branch with continuing the business process -//На прикладі xref:registry-develop:study-project/study-tasks/task-3-bp-modeling-with-integration.adoc#create-continuation-of-bp-branch[Завдання 3] необхідно _створити гілку, що продовжить бізнес-процес_. +//На прикладі xref:registry-develop:study-project/study-tasks/task-backup-restore-bp-modeling-with-integration.adoc#create-continuation-of-bp-branch[Завдання 3] необхідно _створити гілку, що продовжить бізнес-процес_. Using the example from xref:registry-develop:study-project/study-tasks/task-3-bp-modeling-with-integration.adoc#create-continuation-of-bp-branch[Task 3] _create a branch that continues the business process_. //Для цього на гілці, що прямує від шлюзу `Дані присутні?` до користувацької задачі `Підписати дані про лабораторію` (_див. нижче xref:#create-user-task-lab-data-signing[]_) налаштуйте такі параметри: @@ -410,7 +410,7 @@ image:study-project/task-5/task-5-bp-11.png[] //==== Створення користувацької задачі для підпису даних ==== Creating a user task for data signing -//На прикладі xref:study-project/study-tasks/task-3-bp-modeling-with-integration.adoc#create-task-lab-data-signing[Завдання 3] необхідно _створити користувацьку задачу для підпису даних_. Для цього виконайте наступні кроки: +//На прикладі xref:study-project/study-tasks/task-backup-restore-bp-modeling-with-integration.adoc#create-task-lab-data-signing[Завдання 3] необхідно _створити користувацьку задачу для підпису даних_. Для цього виконайте наступні кроки: Using the example from xref:study-project/study-tasks/task-3-bp-modeling-with-integration.adoc#create-task-lab-data-signing[Task 3],_create a user task for data signing_. Follow these steps: //. Визначте тип задачі, натиснувши іконку ключа та обравши з меню пункт *User Task* (Користувацька задача). @@ -893,7 +893,7 @@ Modeling components related to "Data factory" and all dashed lines are purely in //==== Створення сервісної задачі для встановлення результату бізнес-процесу ==== Creating a service task to set business process result -//На прикладі xref:study-project/study-tasks/task-3-bp-modeling-with-integration.adoc#create-service-task-create-entity-end[Завдання 3] _змоделюйте нову сервісну задачу, що встановлюватиме результат бізнес-процесу_. Для цього виконайте кроки, подані нижче: +//На прикладі xref:study-project/study-tasks/task-backup-restore-bp-modeling-with-integration.adoc#create-service-task-create-entity-end[Завдання 3] _змоделюйте нову сервісну задачу, що встановлюватиме результат бізнес-процесу_. Для цього виконайте кроки, подані нижче: Using xref:study-project/study-tasks/task-3-bp-modeling-with-integration.adoc#create-service-task-create-entity-end[Task 3] as an example, model a new service task that will set the result of the business process. Follow the steps below: //. Оберіть прямокутник із сервісною задачею, створеною на xref:#create-service-task-save-data-to-data-factory[попередньому етапі], та приєднайте нову задачу, натиснувши іконку *Append Task*. @@ -921,7 +921,7 @@ image:study-project/task-5/task-5-bp-26.png[] //На цьому етапі необхідно _створити подію, яка завершуватиме бізнес-процес_. At this stage, create an event that will _mark the completion of the business process_. -//. На прикладі xref:study-project/study-tasks/task-3-bp-modeling-with-integration.adoc#create-task-entity-finish[Завдання 3] приєднайте та налаштуйте подію завершення бізнес-процесу. +//. На прикладі xref:study-project/study-tasks/task-backup-restore-bp-modeling-with-integration.adoc#create-task-entity-finish[Завдання 3] приєднайте та налаштуйте подію завершення бізнес-процесу. . Using xref:study-project/study-tasks/task-3-bp-modeling-with-integration.adoc#create-task-entity-finish[Task 3] as an example, attach and configure the end event for the business process. + //. На панелі налаштувань справа для параметра `Name` вкажіть значення `Лабораторія створена`. @@ -983,7 +983,7 @@ CAUTION: After completing all stages, upload and save the form schema files to t //==== Створення форми для внесення даних ==== Creating a form for data entry -//TIP: Змоделюйте форму для внесення даних користувачем, використовуючи приклад із xref:study-project/study-tasks/task-3-bp-modeling-with-integration.adoc#form-insert-data[Завдання 3]. +//TIP: Змоделюйте форму для внесення даних користувачем, використовуючи приклад із xref:study-project/study-tasks/task-backup-restore-bp-modeling-with-integration.adoc#form-insert-data[Завдання 3]. TIP: Model a form for data entry by the user, using the example from xref:study-project/study-tasks/task-3-bp-modeling-with-integration.adoc#form-insert-data[Task 3]. //. Увійдіть до застосунку [.underline]#Кабінет адміністратора регламентів#. @@ -1041,7 +1041,7 @@ For more details about creating and viewing change requests for the regulations + image:registry-develop:study-project/task-5/task-5-forms-overview.png[] + -//. Скопіюйте форму xref:study-project/study-tasks/task-3-bp-modeling-with-integration.adoc#form-insert-data[ add-lab-bp-add-lab], змодельовану в рамках Завдання 3, натиснувши _іконку копіювання_ -- це дозволить створити форму із готового шаблону. +//. Скопіюйте форму xref:study-project/study-tasks/task-backup-restore-bp-modeling-with-integration.adoc#form-insert-data[ add-lab-bp-add-lab], змодельовану в рамках Завдання 3, натиснувши _іконку копіювання_ -- це дозволить створити форму із готового шаблону. . Copy the xref:study-project/study-tasks/task-3-bp-modeling-with-integration.adoc#form-insert-data[ add-lab-bp-add-lab] form modeled in Task 3 by clicking the _copy icon_ -- this will allow you to create a form from an existing template. + @@ -1088,7 +1088,7 @@ image:study-project/task-5/task-5-forms-3.png[] //Після завершення xref:#form-insert-data[попереднього етапу] зі створенням форми для внесення даних, _створіть ще одну форму -- для підпису даних_. After completing the xref:#form-insert-data[previous stage] of creating a data input form, create another form specifically for data signature. -//TIP: Змоделюйте форму для внесення даних користувачем, використовуючи приклад із xref:study-project/study-tasks/task-3-bp-modeling-with-integration.adoc#form-data-signing[Завдання 3]. +//TIP: Змоделюйте форму для внесення даних користувачем, використовуючи приклад із xref:study-project/study-tasks/task-backup-restore-bp-modeling-with-integration.adoc#form-data-signing[Завдання 3]. TIP: Model a form for user input using the example from ref:study-project/study-tasks/task-3-bp-modeling-with-integration.adoc#form-data-signing[Task 3]. //. Скопіюйте xref:#form-insert-data[UI-форму для внесення даних про лабораторію], натиснувши _іконку копіювання_ -- це дозволить створити форму із готового шаблону. @@ -1334,7 +1334,7 @@ authorization: //==== Створення нової ролі для розподілення задач в Кабінеті посадової особи ==== Creating a new role for task allocation in the Officer portal -//. Перейдіть до регламентної папки *_roles_*, знайдіть файл _link:{attachmentsdir}/study-project/task-5/bp-access/officer.yml[officer.yml]_ та додайте у ньому до наявних 2 нових параметри: +//. Перейдіть до регламентної папки *_roles_*, знайдіть файл _link:{attachmentsdir}/study-project/task-3/bp-access/officer.yml[officer.yml]_ та додайте у ньому до наявних 2 нових параметри: . Navigate to the regulatory *_roles_* folder, find the _link:{attachmentsdir}/study-project/task-5/bp-access/officer.yml[officer.yml]_, and add 2 new parameters to it: + diff --git a/docs/en/modules/registry-develop/partials/nav.adoc b/docs/en/modules/registry-develop/partials/nav.adoc index fc26ed7b87..d1277a1d84 100644 --- a/docs/en/modules/registry-develop/partials/nav.adoc +++ b/docs/en/modules/registry-develop/partials/nav.adoc @@ -1,4 +1,4 @@ -* xref:registry-develop:overview.adoc[Registry development and support teams] +* xref:registry-develop:overview.adoc[Registry development and maintenance teams] + // // ================= REGISTRY ADMINISTRATORS ================= ** xref:registry-develop:registry-admin/index.adoc[Registry administrators] @@ -31,8 +31,15 @@ ******* xref:registry-develop:registry-admin/admin-portal/registry-modeling/process-models/components/tab-bpmn-editor.adoc[Modeling business processes in BPMN editor] ******* xref:registry-develop:registry-admin/admin-portal/registry-modeling/process-models/components/edit-groovy-scripts.adoc[Editing business process scripts in a visual code editor] ***** xref:registry-develop:registry-admin/admin-portal/registry-modeling/ui-forms/ui-forms-overview.adoc[Managing UI forms] -****** xref:registry-develop:registry-admin/admin-portal/registry-modeling/ui-forms/sorting-paginating-forms.adoc[Sorting UI forms] -****** xref:registry-develop:registry-admin/admin-portal/registry-modeling/ui-forms/json-code-view-edit.adoc[Viewing and editing a UI-form JSON representation] +****** xref:registry-develop:registry-admin/admin-portal/registry-modeling/ui-forms/create-forms.adoc[Creating UI-forms] +****** xref:registry-develop:registry-admin/admin-portal/registry-modeling/ui-forms/edit-forms.adoc[Editing UI forms] +****** xref:registry-develop:registry-admin/admin-portal/registry-modeling/ui-forms/search-forms.adoc[Searching registry UI forms] +****** xref:registry-develop:registry-admin/admin-portal/registry-modeling/ui-forms/copy-forms.adoc[Copying UI forms] +****** xref:registry-develop:registry-admin/admin-portal/registry-modeling/ui-forms/download-forms.adoc[Downloading UI forms] +****** xref:registry-develop:registry-admin/admin-portal/registry-modeling/ui-forms/sorting-paginating-forms.adoc[Sorting and paginating UI forms] +****** xref:registry-develop:registry-admin/admin-portal/registry-modeling/ui-forms/delete-forms.adoc[Deleting UI forms] +****** xref:registry-develop:registry-admin/admin-portal/registry-modeling/ui-forms/json-code-view-edit.adoc[Viewing and editing a UI form JSON representation] +****** xref:registry-develop:registry-admin/admin-portal/registry-modeling/ui-forms/form-tabs.adoc[Form editing tabs] ***** xref:registry-develop:registry-admin/admin-portal/registry-modeling/tables/tables-overview.adoc[Tables] ****** xref:registry-develop:registry-admin/admin-portal/registry-modeling/tables/tables-data-structures.adoc[Registry data model tables and their structures] ****** xref:registry-develop:registry-admin/admin-portal/registry-modeling/tables/xml-editor.adoc[Modeling the structure of registry database tables in an XML code editor] @@ -96,8 +103,9 @@ ] + // ======================== GRAFANA MONITORING ========================== -*** Monitoring the Platform subsystems (Grafana) +*** xref:registry-develop:registry-admin/grafana-monitoring/overview.adoc[Monitoring Platform systems (Grafana)] **** xref:registry-develop:registry-admin/grafana-monitoring/grafana-camunda-metrics.adoc[Monitoring business process execution metrics] +**** xref:registry-develop:registry-admin/grafana-monitoring/public-api-kong-metrics.adoc[Monitoring metrics of public API] + // ====================== SETTINGS.YAML ================================= *** xref:registry-develop:registry-admin/regulation-settings.adoc[Managing registry settings (settings.yaml)] @@ -115,21 +123,22 @@ //**** xref:registry-develop:registry-admin/external-integration/registration-subsystem-trembita/registration-subsystem-trembita.adoc[] **** xref:registry-develop:registry-admin/external-integration/rest-api-no-trembita.adoc[Interacting via REST between Platform registries and with external systems] //**** Виклик зовнішніх реєстрів та систем -**** Calling external registries and systems +**** Your team consumes API //***** ШБО "Трембіта" //****** xref:registry-develop:registry-admin/external-integration/api-call/trembita/external-services-connection-config.adoc[] //****** xref:registry-develop:registry-admin/external-integration/cp-integrate-trembita.adoc[] //****** xref:registry-develop:registry-admin/external-integration/api-call/trembita/overview.adoc[Реєстри та системи ШБО "Трембіта"] -***** Other registries and systems -****** xref:registry-develop:bp-modeling/bp/rest-connector.adoc#regulations-configuration[Integrating with external services using the REST connector: configuring the regulations] -****** xref:registry-develop:registry-admin/external-integration/cp-integrate-ext-system.adoc[Configuring integrations with external systems in Control Plane] -**** xref:registry-develop:registry-admin/external-integration/api-publish/index.adoc[Providing registry API endpoints for integration] -***** xref:registry-develop:registry-admin/external-integration/api-publish/rest-soap-api-expose.adoc[Configuring the regulations to provide access to data via SOAP and REST APIs] +***** xref:registry-develop:bp-modeling/bp/rest-connector.adoc#regulations-configuration[Integrating with external services using the REST connector: configuring the regulations] +***** xref:registry-develop:registry-admin/external-integration/cp-integrate-ext-system.adoc[Configuring integrations with external systems in Control Plane] +**** xref:registry-develop:registry-admin/external-integration/api-publish/index.adoc[Your team exposes API] +***** Private data +****** xref:registry-develop:registry-admin/external-integration/api-publish/rest-soap-api-expose.adoc[Configuring the regulations to provide access to data via SOAP and REST APIs] //***** ШБО "Трембіта" //****** xref:registry-develop:registry-admin/external-integration/api-publish/trembita-bp-invoking.adoc[] //****** xref:registry-develop:registry-admin/external-integration/api-publish/trembita-data-invoking.adoc[] -***** Other registries and systems ****** xref:registry-develop:registry-admin/external-integration/api-publish/get-jwt-token-postman.adoc[Calling the registry from an external system: getting a JWT token from Keycloak] +***** Public data +****** xref:registry-develop:registry-admin/external-integration/api-publish/public-api/expose-public-api.adoc[Configuring access to registry’s public data] //========================= WIREMOCK ===================================== **** xref:registry-develop:registry-admin/external-integration/cp-mock-integrations.adoc[Emulating external integrations] + @@ -166,17 +175,17 @@ ** xref:registry-develop:bp-modeling/index.adoc[Business process modelers] + // Моделювання бізнес-процесів та бізнес-правил -*** xref:registry-develop:bp-modeling/bp/index.adoc[Business process modeling and decision tables] +*** xref:registry-develop:bp-modeling/bp/index.adoc[Modeling business processes and decision tables] +**** xref:registry-develop:bp-modeling/bp/what-is-bp.adoc[What are business processes: analysis, structure and operation types] //**** xref:registry-develop:bp-modeling/bp/bp-modeling-general-description.adoc[] //**** xref:registry-develop:bp-modeling/bp/bp-modeling-instruction.adoc[] -//**** xref:registry-develop:bp-modeling/bp/element-templates/element-templates-overview.adoc[] -//***** xref:registry-develop:bp-modeling/bp/element-templates/bp-element-templates-installation-configuration.adoc[] **** xref:registry-develop:bp-modeling/bp/element-templates/element-templates-overview.adoc[] +***** xref:registry-develop:bp-modeling/bp/element-templates/element-templates-install.adoc[Installing extensions to business processes (for local development)] ***** xref:registry-develop:bp-modeling/bp/element-templates/user-task-templates/user-task-overview.adoc[] ****** xref:registry-develop:bp-modeling/bp/element-templates/user-task-templates/user-form.adoc[] ****** xref:registry-develop:bp-modeling/bp/element-templates/user-task-templates/officer-sign-task.adoc[] ****** xref:registry-develop:bp-modeling/bp/element-templates/user-task-templates/citizen-sign-task.adoc[] -***** xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/service-task-overview.adoc[] +***** xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/service-task-overview.adoc[Service task extensions] ****** Managing users and roles ******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/add-role-to-keycloak-user.adoc[] ******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/save-user-roles.adoc[] diff --git a/docs/en/modules/registry-develop/partials/registry-admin/api-rate-limiting-authenticated-user.puml b/docs/en/modules/registry-develop/partials/registry-admin/api-rate-limiting-authenticated-user.puml index 13392d5233..c3825ed545 100644 --- a/docs/en/modules/registry-develop/partials/registry-admin/api-rate-limiting-authenticated-user.puml +++ b/docs/en/modules/registry-develop/partials/registry-admin/api-rate-limiting-authenticated-user.puml @@ -10,31 +10,31 @@ This is a multi- line comment '/ -actor "Користувач" as User +actor "User" as User box "Kong API Gateway" -entity "OIDC plug-in" as oidc -entity "Rate Limiting plug-in" as ratel +entity "OIDC plugin" as oidc +entity "Rate limiting plugin" as ratel end box participant "Upstream Service" as service note over User: Cookie: session=xxx -User -> oidc : Запит з ідентифікатором сесії +User -> oidc : Request with session ID -oidc -> oidc : Перевірка сесії користувача та додавання заголовків +oidc -> oidc : Check user session and add headers note over oidc X-Access-Token: aaa X-ID-Token: bbb -X-Userinfo: ccc   +X-Userinfo: ccc token-claim: 123 end note -oidc -> ratel : Передача запиту для обробки в наступний плагін -ratel -> ratel : Перевірка ліміту запитів для клієнта \n по ІР адресі або "token-claim" заголовку -alt Ліміту по кількості запитів не досягнуто -ratel -> service: Перенаправлення запиту до upstream сервісу -service --> User : Відповідь сервіса -else Ліміт по кількості запитів вичерпано +oidc -> ratel : Transfer request for processing to the next plugin +ratel -> ratel : Check rate limits for client \n by IP or "token claim" header +alt Rate limit is not reached +ratel -> service: Forward request to upstream service +service --> User : Service response +else API rate limit exceeded ratel --> User: HTTP 429: { "message": "API rate limit exceeded" } end diff --git a/docs/en/modules/registry-develop/partials/registry-admin/api-rate-limiting-unauthenticated-user.puml b/docs/en/modules/registry-develop/partials/registry-admin/api-rate-limiting-unauthenticated-user.puml index 9a42094e38..8022fde51b 100644 --- a/docs/en/modules/registry-develop/partials/registry-admin/api-rate-limiting-unauthenticated-user.puml +++ b/docs/en/modules/registry-develop/partials/registry-admin/api-rate-limiting-unauthenticated-user.puml @@ -1,7 +1,7 @@ @startuml autonumber skinparam ParticipantPadding 20 -title "API Rate Limiting - Unauthenticated User" +title "API rate limiting - Unauthenticated user" 'This is a single line comment @@ -10,19 +10,19 @@ This is a multi- line comment '/ -actor "Користувач" as User +actor "User" as User box "Kong API Gateway" -entity "Rate Limiting plug-in" as ratel +entity "Rate Limiting plugin" as ratel end box participant "Upstream Service" as service -User -> ratel : Запит до сервісу -ratel -> ratel : Перевірка ліміту запитів для клієнта за ІР адресою -alt Ліміту по кількості запитів не досягнуто -ratel -> service: Перенаправлення запиту до upstream сервісу -service --> User : Відповідь сервіса -else Ліміт по кількості запитів вичерпано +User -> ratel : Request to the service +ratel -> ratel : Check rate limit for a client by IP address +alt Rate limit not reached +ratel -> service: Forwarding request to the upstream service +service --> User : Service response +else Rate limit exceeded ratel --> User: HTTP 429: { "message": "API rate limit exceeded" } end -@enduml +@enduml \ No newline at end of file diff --git a/docs/en/modules/registry-develop/partials/snippets/demo-reg-reference-examples-en.adoc b/docs/en/modules/registry-develop/partials/snippets/demo-reg-reference-examples-en.adoc new file mode 100644 index 0000000000..562f20a5dd --- /dev/null +++ b/docs/en/modules/registry-develop/partials/snippets/demo-reg-reference-examples-en.adoc @@ -0,0 +1,3 @@ +The Platform administrator can deploy for you a _demo-registry_ -- a reference registry containing _reference and other example files for creating a digital registry regulations_. It includes various elements for developing data models, business processes, UI forms, analytical reporting, extracts, notifications, external integrations, and more. + +Detailed instructions on deploying the demo-registry and obtaining reference modeling examples can be found on page xref:registry-admin/cp-deploy-consent-data.adoc[]. \ No newline at end of file diff --git a/docs/en/modules/registry-develop/partials/snippets/study/local-environment-setup-en.adoc b/docs/en/modules/registry-develop/partials/snippets/study/local-environment-setup-en.adoc index 6e867740d7..fbca49fc68 100644 --- a/docs/en/modules/registry-develop/partials/snippets/study/local-environment-setup-en.adoc +++ b/docs/en/modules/registry-develop/partials/snippets/study/local-environment-setup-en.adoc @@ -1,6 +1,4 @@ //This snippet describes useful local tools needed for registry and regulations admins. -//Для повноцінної та зручної роботи із реєстром та його сутностями, вам необхідно налаштувати локальне середовище. Для цього встановіть на вашій локальній машині наступний перелік інструментів: -We recommend configuring your local environment to make working with the registry and its entities more convenient. Install the following tools on your machine: [cols="30%,70%"] |=== diff --git a/docs/en/modules/release-notes/images/wn-1-9-4/whats-new-1-9-4-14.png b/docs/en/modules/release-notes/images/wn-1-9-4/whats-new-1-9-4-14.png new file mode 100644 index 0000000000..cc51ed011a Binary files /dev/null and b/docs/en/modules/release-notes/images/wn-1-9-4/whats-new-1-9-4-14.png differ diff --git a/docs/en/modules/user/pages/citizen-officer-portal-auth.adoc b/docs/en/modules/user/pages/citizen-officer-portal-auth.adoc index 024443f34d..2e1ad12d5b 100644 --- a/docs/en/modules/user/pages/citizen-officer-portal-auth.adoc +++ b/docs/en/modules/user/pages/citizen-officer-portal-auth.adoc @@ -188,7 +188,7 @@ image:user:cp-auth-3.png[] + //* У полі `Особистий ключ` натисніть kbd:[Обрати]. * In the `Personal key` field, click kbd:[Select]. -//* Знайдіть особистий ключ (наприклад `Key-6.dat`) та натисніть kbd:[Open] для підтвердження. +//* Знайдіть особистий ключ (наприклад `key-6.dat`) та натисніть kbd:[Open] для підтвердження. * Find the personal key (e.g., ``Key-6.da``t) and click kbd:[Open] to confirm. + image:user:cp-auth-4.png[] diff --git a/docs/ua/antora.yml b/docs/ua/antora.yml index 82efbaab82..7bb156155f 100644 --- a/docs/ua/antora.yml +++ b/docs/ua/antora.yml @@ -1,5 +1,5 @@ name: platform title: Платформа Реєстрів -version: "1.9.6" +version: "1.9.7" nav: - modules/ROOT/nav.adoc \ No newline at end of file diff --git a/docs/ua/modules/ROOT/nav.adoc b/docs/ua/modules/ROOT/nav.adoc index b5d5ea09fd..850f2546df 100644 --- a/docs/ua/modules/ROOT/nav.adoc +++ b/docs/ua/modules/ROOT/nav.adoc @@ -1,9 +1,5 @@ -//Що нового? -* xref:release-notes:overview.adoc[] -** xref:release-notes:whats-new.adoc[] -** xref:release-notes:release-notes.adoc[] -** xref:release-notes:backward-incompatible-changes.adoc[] -** xref:release-notes:deprecated-functionality.adoc[] +//ЩО НОВОГО +include::release-notes:partial$nav.adoc[] // КОРИСТУВАЧАМ include::user:partial$nav.adoc[] // АДМІНІСТРАТОРАМ ПЛАТФОРМИ diff --git a/docs/ua/modules/ROOT/partials/templates/links/platform/administrative/control-plane.adoc b/docs/ua/modules/ROOT/partials/templates/links/platform/administrative/control-plane.adoc new file mode 100644 index 0000000000..aa9bace6bf --- /dev/null +++ b/docs/ua/modules/ROOT/partials/templates/links/platform/administrative/control-plane.adoc @@ -0,0 +1 @@ +https://control-plane-console-control-plane-platform-main.{{{dns-wildcard}}}[Control Plane] \ No newline at end of file diff --git a/docs/ua/modules/ROOT/partials/templates/links/platform/administrative/gerrit.adoc b/docs/ua/modules/ROOT/partials/templates/links/platform/administrative/gerrit.adoc new file mode 100644 index 0000000000..3a8eac0bc7 --- /dev/null +++ b/docs/ua/modules/ROOT/partials/templates/links/platform/administrative/gerrit.adoc @@ -0,0 +1 @@ +https://gerrit-control-plane-platform-main.{{{dns-wildcard}}}[Platform Gerrit] \ No newline at end of file diff --git a/docs/ua/modules/ROOT/partials/templates/links/platform/administrative/jenkins.adoc b/docs/ua/modules/ROOT/partials/templates/links/platform/administrative/jenkins.adoc new file mode 100644 index 0000000000..8fc21ddcef --- /dev/null +++ b/docs/ua/modules/ROOT/partials/templates/links/platform/administrative/jenkins.adoc @@ -0,0 +1 @@ +https://jenkins-control-plane-platform-main.{{{dns-wildcard}}}[Platform Jenkins] \ No newline at end of file diff --git a/docs/ua/modules/ROOT/partials/templates/links/platform/administrative/nexus.adoc b/docs/ua/modules/ROOT/partials/templates/links/platform/administrative/nexus.adoc new file mode 100644 index 0000000000..e31f688a76 --- /dev/null +++ b/docs/ua/modules/ROOT/partials/templates/links/platform/administrative/nexus.adoc @@ -0,0 +1 @@ +https://nexus-control-plane-platform-main.{{{dns-wildcard}}}[Platform Nexus] \ No newline at end of file diff --git a/docs/ua/modules/ROOT/partials/templates/links/platform/administrative/openshift.adoc b/docs/ua/modules/ROOT/partials/templates/links/platform/administrative/openshift.adoc new file mode 100644 index 0000000000..49f987149f --- /dev/null +++ b/docs/ua/modules/ROOT/partials/templates/links/platform/administrative/openshift.adoc @@ -0,0 +1 @@ +https://console-openshift-console.{{{dns-wildcard}}}[OpenShift] \ No newline at end of file diff --git a/docs/ua/modules/ROOT/partials/templates/links/platform/central/minio.adoc b/docs/ua/modules/ROOT/partials/templates/links/platform/central/minio.adoc new file mode 100644 index 0000000000..10b3ac4c85 --- /dev/null +++ b/docs/ua/modules/ROOT/partials/templates/links/platform/central/minio.adoc @@ -0,0 +1 @@ +https://platform-minio-ui.{{{dns-wildcard}}}[Minio] \ No newline at end of file diff --git a/docs/ua/modules/ROOT/partials/templates/links/platform/central/platform-vault.adoc b/docs/ua/modules/ROOT/partials/templates/links/platform/central/platform-vault.adoc new file mode 100644 index 0000000000..2733245df9 --- /dev/null +++ b/docs/ua/modules/ROOT/partials/templates/links/platform/central/platform-vault.adoc @@ -0,0 +1 @@ +https://platform-vault.{{{dns-wildcard}}}[Platform Vault] \ No newline at end of file diff --git a/docs/ua/modules/ROOT/partials/templates/links/platform/operational/grafana.adoc b/docs/ua/modules/ROOT/partials/templates/links/platform/operational/grafana.adoc new file mode 100644 index 0000000000..2969bb79e3 --- /dev/null +++ b/docs/ua/modules/ROOT/partials/templates/links/platform/operational/grafana.adoc @@ -0,0 +1 @@ +https://grafana-grafana-monitoring.{{{dns-wildcard}}}/login[Grafana] \ No newline at end of file diff --git a/docs/ua/modules/ROOT/partials/templates/links/platform/operational/hashicorp-vault.adoc b/docs/ua/modules/ROOT/partials/templates/links/platform/operational/hashicorp-vault.adoc new file mode 100644 index 0000000000..26dbab0404 --- /dev/null +++ b/docs/ua/modules/ROOT/partials/templates/links/platform/operational/hashicorp-vault.adoc @@ -0,0 +1 @@ +https://hashicorp-vault-user-management.{{{dns-wildcard}}}[Hashicorp Vault] \ No newline at end of file diff --git a/docs/ua/modules/ROOT/partials/templates/links/platform/operational/jaeger.adoc b/docs/ua/modules/ROOT/partials/templates/links/platform/operational/jaeger.adoc new file mode 100644 index 0000000000..ad8ad2418c --- /dev/null +++ b/docs/ua/modules/ROOT/partials/templates/links/platform/operational/jaeger.adoc @@ -0,0 +1 @@ +https://jaeger-istio-system.{{{dns-wildcard}}}[Jaeger] \ No newline at end of file diff --git a/docs/ua/modules/ROOT/partials/templates/links/platform/operational/keycloak.adoc b/docs/ua/modules/ROOT/partials/templates/links/platform/operational/keycloak.adoc new file mode 100644 index 0000000000..31aa16092d --- /dev/null +++ b/docs/ua/modules/ROOT/partials/templates/links/platform/operational/keycloak.adoc @@ -0,0 +1 @@ +https://platform-keycloak.{{{dns-wildcard}}}/auth/[Keycloak] \ No newline at end of file diff --git a/docs/ua/modules/ROOT/partials/templates/links/platform/operational/kiali.adoc b/docs/ua/modules/ROOT/partials/templates/links/platform/operational/kiali.adoc new file mode 100644 index 0000000000..b82c1ad5ec --- /dev/null +++ b/docs/ua/modules/ROOT/partials/templates/links/platform/operational/kiali.adoc @@ -0,0 +1 @@ +https://kiali-istio-system.{{{dns-wildcard}}}[Service Mesh (Kiali)] \ No newline at end of file diff --git a/docs/ua/modules/ROOT/partials/templates/links/platform/operational/kibana.adoc b/docs/ua/modules/ROOT/partials/templates/links/platform/operational/kibana.adoc new file mode 100644 index 0000000000..573549a41d --- /dev/null +++ b/docs/ua/modules/ROOT/partials/templates/links/platform/operational/kibana.adoc @@ -0,0 +1 @@ +https://kibana-openshift-logging.{{{dns-wildcard}}}[Kibana] \ No newline at end of file diff --git a/docs/ua/modules/ROOT/partials/templates/links/registry/administrative/admin-portal.adoc b/docs/ua/modules/ROOT/partials/templates/links/registry/administrative/admin-portal.adoc new file mode 100644 index 0000000000..207dfe762a --- /dev/null +++ b/docs/ua/modules/ROOT/partials/templates/links/registry/administrative/admin-portal.adoc @@ -0,0 +1 @@ +https://admin-tools-{{{registry-name}}}.{{{dns-wildcard}}}[Admin Portal] \ No newline at end of file diff --git a/docs/ua/modules/ROOT/partials/templates/links/registry/administrative/business-proc-admin-portal.adoc b/docs/ua/modules/ROOT/partials/templates/links/registry/administrative/business-proc-admin-portal.adoc new file mode 100644 index 0000000000..0975166b2c --- /dev/null +++ b/docs/ua/modules/ROOT/partials/templates/links/registry/administrative/business-proc-admin-portal.adoc @@ -0,0 +1 @@ +https://business-proc-admin-{{{registry-name}}}.{{{dns-wildcard}}}[Business Process Administration Portal] \ No newline at end of file diff --git a/docs/ua/modules/ROOT/partials/templates/links/registry/administrative/geoserver.adoc b/docs/ua/modules/ROOT/partials/templates/links/registry/administrative/geoserver.adoc new file mode 100644 index 0000000000..7d87351400 --- /dev/null +++ b/docs/ua/modules/ROOT/partials/templates/links/registry/administrative/geoserver.adoc @@ -0,0 +1 @@ +https://geo-server-{{{registry-name}}}.{{{dns-wildcard}}}/geoserver[Geo-server UI] \ No newline at end of file diff --git a/docs/ua/modules/ROOT/partials/templates/links/registry/administrative/gerrit.adoc b/docs/ua/modules/ROOT/partials/templates/links/registry/administrative/gerrit.adoc new file mode 100644 index 0000000000..56116751dc --- /dev/null +++ b/docs/ua/modules/ROOT/partials/templates/links/registry/administrative/gerrit.adoc @@ -0,0 +1 @@ +https://admin-tools-{{{registry-name}}}.{{{dns-wildcard}}}/gerrit[Registry Gerrit] \ No newline at end of file diff --git a/docs/ua/modules/ROOT/partials/templates/links/registry/administrative/jenkins.adoc b/docs/ua/modules/ROOT/partials/templates/links/registry/administrative/jenkins.adoc new file mode 100644 index 0000000000..867b8f6348 --- /dev/null +++ b/docs/ua/modules/ROOT/partials/templates/links/registry/administrative/jenkins.adoc @@ -0,0 +1 @@ +https://admin-tools-{{{registry-name}}}.{{{dns-wildcard}}}/cicd[Registry Jenkins] \ No newline at end of file diff --git a/docs/ua/modules/ROOT/partials/templates/links/registry/administrative/nexus.adoc b/docs/ua/modules/ROOT/partials/templates/links/registry/administrative/nexus.adoc new file mode 100644 index 0000000000..e576a68121 --- /dev/null +++ b/docs/ua/modules/ROOT/partials/templates/links/registry/administrative/nexus.adoc @@ -0,0 +1 @@ +https://admin-tools-{{{registry-name}}}.{{{dns-wildcard}}}/nexus[Registry Nexus] \ No newline at end of file diff --git a/docs/ua/modules/ROOT/partials/templates/links/registry/administrative/openapi-swagger.adoc b/docs/ua/modules/ROOT/partials/templates/links/registry/administrative/openapi-swagger.adoc new file mode 100644 index 0000000000..ba991bdce2 --- /dev/null +++ b/docs/ua/modules/ROOT/partials/templates/links/registry/administrative/openapi-swagger.adoc @@ -0,0 +1 @@ +https://registry-rest-api-{{{registry-name}}}.{{{dns-wildcard}}}/openapi[OpenAPI] \ No newline at end of file diff --git a/docs/ua/modules/ROOT/partials/templates/links/registry/administrative/pgadmin.adoc b/docs/ua/modules/ROOT/partials/templates/links/registry/administrative/pgadmin.adoc new file mode 100644 index 0000000000..b591aadc60 --- /dev/null +++ b/docs/ua/modules/ROOT/partials/templates/links/registry/administrative/pgadmin.adoc @@ -0,0 +1 @@ +https://pgadmin-{{{registry-name}}}.{{{dns-wildcard}}}[pgAdmin] \ No newline at end of file diff --git a/docs/ua/modules/ROOT/partials/templates/links/registry/administrative/redash-admin.adoc b/docs/ua/modules/ROOT/partials/templates/links/registry/administrative/redash-admin.adoc new file mode 100644 index 0000000000..60a6436af3 --- /dev/null +++ b/docs/ua/modules/ROOT/partials/templates/links/registry/administrative/redash-admin.adoc @@ -0,0 +1 @@ +https://admin-tools-{{{registry-name}}}-main.{{{dns-wildcard}}}/reports[Redash Admin] \ No newline at end of file diff --git a/docs/ua/modules/ROOT/partials/templates/links/registry/operational/citizen-portal.adoc b/docs/ua/modules/ROOT/partials/templates/links/registry/operational/citizen-portal.adoc new file mode 100644 index 0000000000..aa9e35267d --- /dev/null +++ b/docs/ua/modules/ROOT/partials/templates/links/registry/operational/citizen-portal.adoc @@ -0,0 +1 @@ +https://citizen-portal-{{{registry-name}}}.{{{dns-wildcard}}}[Citizen Portal] \ No newline at end of file diff --git a/docs/ua/modules/ROOT/partials/templates/links/registry/operational/officer-portal.adoc b/docs/ua/modules/ROOT/partials/templates/links/registry/operational/officer-portal.adoc new file mode 100644 index 0000000000..b49acf95bc --- /dev/null +++ b/docs/ua/modules/ROOT/partials/templates/links/registry/operational/officer-portal.adoc @@ -0,0 +1 @@ +https://officer-portal-{{{registry-name}}}.{{{dns-wildcard}}}[Officer Portal] \ No newline at end of file diff --git a/docs/ua/modules/ROOT/partials/templates/links/registry/operational/redash-viewer.adoc b/docs/ua/modules/ROOT/partials/templates/links/registry/operational/redash-viewer.adoc new file mode 100644 index 0000000000..20b808d0ce --- /dev/null +++ b/docs/ua/modules/ROOT/partials/templates/links/registry/operational/redash-viewer.adoc @@ -0,0 +1 @@ +https://officer-portal-{{{registry-name}}}-main.{{{dns-wildcard}}}/reports[Redash Viewer] \ No newline at end of file diff --git a/docs/ua/modules/admin/attachments/disaster-recovery/disaster-recovery.zip b/docs/ua/modules/admin/attachments/disaster-recovery/disaster-recovery.zip new file mode 100644 index 0000000000..3ef35c59d1 Binary files /dev/null and b/docs/ua/modules/admin/attachments/disaster-recovery/disaster-recovery.zip differ diff --git a/docs/ua/modules/admin/attachments/migrate-registry/registry-migration.zip b/docs/ua/modules/admin/attachments/migrate-registry/registry-migration.zip index 17fc0b8146..855ee470b3 100644 Binary files a/docs/ua/modules/admin/attachments/migrate-registry/registry-migration.zip and b/docs/ua/modules/admin/attachments/migrate-registry/registry-migration.zip differ diff --git a/docs/ua/modules/admin/attachments/special-steps/ccc6194.diff b/docs/ua/modules/admin/attachments/special-steps/ccc6194.diff new file mode 100644 index 0000000000..2d2efb5363 --- /dev/null +++ b/docs/ua/modules/admin/attachments/special-steps/ccc6194.diff @@ -0,0 +1,18230 @@ +From ccc61943bb0d0eed1724c0dc9858ce55260ded53 Mon Sep 17 00:00:00 2001 +From: Daniil Nedostup +Date: Tue, 14 Nov 2023 11:21:10 +0200 +Subject: [PATCH] all in one + +Change-Id: I9f760e02066915557566cc84cb8c931ce7016302 +--- + +diff --git a/deploy-templates/cert-manager/Chart.yaml b/deploy-templates/cert-manager/Chart.yaml +new file mode 100644 +index 0000000..ee4000b +--- /dev/null ++++ b/deploy-templates/cert-manager/Chart.yaml +@@ -0,0 +1,18 @@ ++apiVersion: v1 ++name: cert-manager ++# The version and appVersion fields are set automatically by the release tool ++version: v0.1.0 ++appVersion: v1.6.3 ++description: A Helm chart for cert-manager ++home: https://github.com/jetstack/cert-manager ++icon: https://raw.githubusercontent.com/jetstack/cert-manager/master/logo/logo.png ++keywords: ++ - cert-manager ++ - kube-lego ++ - letsencrypt ++ - tls ++sources: ++ - https://github.com/jetstack/cert-manager ++maintainers: ++ - name: cert-manager-maintainers ++ email: cert-manager-maintainers@googlegroups.com +diff --git a/deploy-templates/cert-manager/templates/NOTES.txt b/deploy-templates/cert-manager/templates/NOTES.txt +new file mode 100644 +index 0000000..1025354 +--- /dev/null ++++ b/deploy-templates/cert-manager/templates/NOTES.txt +@@ -0,0 +1,15 @@ ++cert-manager {{ .Chart.AppVersion }} has been deployed successfully! ++ ++In order to begin issuing certificates, you will need to set up a ClusterIssuer ++or Issuer resource (for example, by creating a 'letsencrypt-staging' issuer). ++ ++More information on the different types of issuers and how to configure them ++can be found in our documentation: ++ ++https://cert-manager.io/docs/configuration/ ++ ++For information on how to configure cert-manager to automatically provision ++Certificates for Ingress resources, take a look at the `ingress-shim` ++documentation: ++ ++https://cert-manager.io/docs/usage/ingress/ +diff --git a/deploy-templates/cert-manager/templates/_helpers.tpl b/deploy-templates/cert-manager/templates/_helpers.tpl +new file mode 100644 +index 0000000..dfebe53 +--- /dev/null ++++ b/deploy-templates/cert-manager/templates/_helpers.tpl +@@ -0,0 +1,159 @@ ++{{/* vim: set filetype=mustache: */}} ++{{/* ++Expand the name of the chart. ++*/}} ++{{- define "cert-manager.name" -}} ++{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} ++{{- end -}} ++ ++{{/* ++Create a default fully qualified app name. ++We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). ++*/}} ++{{- define "cert-manager.fullname" -}} ++{{- if .Values.fullnameOverride -}} ++{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} ++{{- else -}} ++{{- $name := default .Chart.Name .Values.nameOverride -}} ++{{- if contains $name .Release.Name -}} ++{{- .Release.Name | trunc 63 | trimSuffix "-" -}} ++{{- else -}} ++{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} ++{{- end -}} ++{{- end -}} ++{{- end -}} ++ ++{{/* ++Create the name of the service account to use ++*/}} ++{{- define "cert-manager.serviceAccountName" -}} ++{{- if .Values.serviceAccount.create -}} ++ {{ default (include "cert-manager.fullname" .) .Values.serviceAccount.name }} ++{{- else -}} ++ {{ default "default" .Values.serviceAccount.name }} ++{{- end -}} ++{{- end -}} ++ ++{{/* ++Webhook templates ++*/}} ++ ++{{/* ++Expand the name of the chart. ++Manually fix the 'app' and 'name' labels to 'webhook' to maintain ++compatibility with the v0.9 deployment selector. ++*/}} ++{{- define "webhook.name" -}} ++{{- printf "webhook" -}} ++{{- end -}} ++ ++{{/* ++Create a default fully qualified app name. ++We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). ++If release name contains chart name it will be used as a full name. ++*/}} ++{{- define "webhook.fullname" -}} ++{{- $trimmedName := printf "%s" (include "cert-manager.fullname" .) | trunc 55 | trimSuffix "-" -}} ++{{- printf "%s-webhook" $trimmedName | trunc 63 | trimSuffix "-" -}} ++{{- end -}} ++ ++{{- define "webhook.caRef" -}} ++{{ .Release.Namespace}}/{{ template "webhook.fullname" . }}-ca ++{{- end -}} ++ ++{{/* ++Create the name of the service account to use ++*/}} ++{{- define "webhook.serviceAccountName" -}} ++{{- if .Values.webhook.serviceAccount.create -}} ++ {{ default (include "webhook.fullname" .) .Values.webhook.serviceAccount.name }} ++{{- else -}} ++ {{ default "default" .Values.webhook.serviceAccount.name }} ++{{- end -}} ++{{- end -}} ++ ++{{/* ++cainjector templates ++*/}} ++ ++{{/* ++Expand the name of the chart. ++Manually fix the 'app' and 'name' labels to 'cainjector' to maintain ++compatibility with the v0.9 deployment selector. ++*/}} ++{{- define "cainjector.name" -}} ++{{- printf "cainjector" -}} ++{{- end -}} ++ ++{{/* ++Create a default fully qualified app name. ++We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). ++If release name contains chart name it will be used as a full name. ++*/}} ++{{- define "cainjector.fullname" -}} ++{{- $trimmedName := printf "%s" (include "cert-manager.fullname" .) | trunc 52 | trimSuffix "-" -}} ++{{- printf "%s-cainjector" $trimmedName | trunc 63 | trimSuffix "-" -}} ++{{- end -}} ++ ++{{/* ++Create the name of the service account to use ++*/}} ++{{- define "cainjector.serviceAccountName" -}} ++{{- if .Values.cainjector.serviceAccount.create -}} ++ {{ default (include "cainjector.fullname" .) .Values.cainjector.serviceAccount.name }} ++{{- else -}} ++ {{ default "default" .Values.cainjector.serviceAccount.name }} ++{{- end -}} ++{{- end -}} ++ ++{{/* ++startupapicheck templates ++*/}} ++ ++{{/* ++Expand the name of the chart. ++Manually fix the 'app' and 'name' labels to 'startupapicheck' to maintain ++compatibility with the v0.9 deployment selector. ++*/}} ++{{- define "startupapicheck.name" -}} ++{{- printf "startupapicheck" -}} ++{{- end -}} ++ ++{{/* ++Create a default fully qualified app name. ++We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). ++If release name contains chart name it will be used as a full name. ++*/}} ++{{- define "startupapicheck.fullname" -}} ++{{- $trimmedName := printf "%s" (include "cert-manager.fullname" .) | trunc 52 | trimSuffix "-" -}} ++{{- printf "%s-startupapicheck" $trimmedName | trunc 63 | trimSuffix "-" -}} ++{{- end -}} ++ ++{{/* ++Create the name of the service account to use ++*/}} ++{{- define "startupapicheck.serviceAccountName" -}} ++{{- if .Values.startupapicheck.serviceAccount.create -}} ++ {{ default (include "startupapicheck.fullname" .) .Values.startupapicheck.serviceAccount.name }} ++{{- else -}} ++ {{ default "default" .Values.startupapicheck.serviceAccount.name }} ++{{- end -}} ++{{- end -}} ++ ++{{/* ++Create chart name and version as used by the chart label. ++*/}} ++{{- define "chartName" -}} ++{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} ++{{- end -}} ++ ++{{/* ++Labels that should be added on each resource ++*/}} ++{{- define "labels" -}} ++app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} ++{{- if eq (default "helm" .Values.creator) "helm" }} ++app.kubernetes.io/managed-by: {{ .Release.Service }} ++helm.sh/chart: {{ include "chartName" . }} ++{{- end -}} ++{{- end -}} +diff --git a/deploy-templates/cert-manager/templates/cainjector-deployment.yaml b/deploy-templates/cert-manager/templates/cainjector-deployment.yaml +new file mode 100644 +index 0000000..c57c232 +--- /dev/null ++++ b/deploy-templates/cert-manager/templates/cainjector-deployment.yaml +@@ -0,0 +1,100 @@ ++{{- if .Values.cainjector.enabled -}} ++apiVersion: apps/v1 ++kind: Deployment ++metadata: ++ name: {{ include "cainjector.fullname" . }} ++ namespace: {{ .Release.Namespace | quote }} ++ labels: ++ app: {{ include "cainjector.name" . }} ++ app.kubernetes.io/name: {{ include "cainjector.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "cainjector" ++ {{- include "labels" . | nindent 4 }} ++ {{- if .Values.cainjector.deploymentAnnotations }} ++ annotations: ++{{ toYaml .Values.cainjector.deploymentAnnotations | indent 4 }} ++ {{- end }} ++spec: ++ replicas: {{ .Values.cainjector.replicaCount }} ++ selector: ++ matchLabels: ++ app.kubernetes.io/name: {{ include "cainjector.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "cainjector" ++ {{- with .Values.cainjector.strategy }} ++ strategy: ++ {{- . | toYaml | nindent 4 }} ++ {{- end }} ++ template: ++ metadata: ++ labels: ++ app: {{ include "cainjector.name" . }} ++ app.kubernetes.io/name: {{ include "cainjector.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "cainjector" ++ {{- include "labels" . | nindent 8 }} ++{{- if .Values.cainjector.podLabels }} ++{{ toYaml .Values.cainjector.podLabels | indent 8 }} ++{{- end }} ++ {{- if .Values.cainjector.podAnnotations }} ++ annotations: ++{{ toYaml .Values.cainjector.podAnnotations | indent 8 }} ++ {{- end }} ++ spec: ++ serviceAccountName: {{ template "cainjector.serviceAccountName" . }} ++ {{- if .Values.global.priorityClassName }} ++ priorityClassName: {{ .Values.global.priorityClassName | quote }} ++ {{- end }} ++ {{- if .Values.cainjector.securityContext}} ++ securityContext: ++{{ toYaml .Values.cainjector.securityContext | indent 8 }} ++ {{- end }} ++ containers: ++ - name: {{ .Chart.Name }} ++ {{- with .Values.cainjector.image }} ++ image: "{{- if .registry -}}{{ .registry }}/{{- end -}}{{ .repository }}{{- if (.digest) -}} @{{.digest}}{{- else -}}:{{ default $.Chart.AppVersion .tag }} {{- end -}}" ++ {{- end }} ++ imagePullPolicy: {{ .Values.cainjector.image.pullPolicy }} ++ args: ++ {{- if .Values.global.logLevel }} ++ - --v={{ .Values.global.logLevel }} ++ {{- end }} ++ {{- with .Values.global.leaderElection }} ++ - --leader-election-namespace={{ .namespace }} ++ {{- if .leaseDuration }} ++ - --leader-election-lease-duration={{ .leaseDuration }} ++ {{- end }} ++ {{- if .renewDeadline }} ++ - --leader-election-renew-deadline={{ .renewDeadline }} ++ {{- end }} ++ {{- if .retryPeriod }} ++ - --leader-election-retry-period={{ .retryPeriod }} ++ {{- end }} ++ {{- end }} ++ {{- if .Values.cainjector.extraArgs }} ++{{ toYaml .Values.cainjector.extraArgs | indent 10 }} ++ {{- end }} ++ env: ++ - name: POD_NAMESPACE ++ valueFrom: ++ fieldRef: ++ fieldPath: metadata.namespace ++ {{- if .Values.cainjector.containerSecurityContext }} ++ securityContext: ++ {{- toYaml .Values.cainjector.containerSecurityContext | nindent 12 }} ++ {{- end }} ++ resources: ++{{ toYaml .Values.cainjector.resources | indent 12 }} ++ {{- with .Values.cainjector.nodeSelector }} ++ nodeSelector: ++{{ toYaml . | indent 8 }} ++ {{- end }} ++ {{- with .Values.cainjector.affinity }} ++ affinity: ++{{ toYaml . | indent 8 }} ++ {{- end }} ++ {{- with .Values.cainjector.tolerations }} ++ tolerations: ++{{ toYaml . | indent 8 }} ++ {{- end }} ++{{- end -}} +diff --git a/deploy-templates/cert-manager/templates/cainjector-psp-clusterrole.yaml b/deploy-templates/cert-manager/templates/cainjector-psp-clusterrole.yaml +new file mode 100644 +index 0000000..3200e8b +--- /dev/null ++++ b/deploy-templates/cert-manager/templates/cainjector-psp-clusterrole.yaml +@@ -0,0 +1,20 @@ ++{{- if .Values.cainjector.enabled -}} ++{{- if .Values.global.podSecurityPolicy.enabled }} ++kind: ClusterRole ++apiVersion: rbac.authorization.k8s.io/v1 ++metadata: ++ name: {{ template "cainjector.fullname" . }}-psp ++ labels: ++ app: {{ include "cainjector.name" . }} ++ app.kubernetes.io/name: {{ include "cainjector.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "cainjector" ++ {{- include "labels" . | nindent 4 }} ++rules: ++- apiGroups: ['policy'] ++ resources: ['podsecuritypolicies'] ++ verbs: ['use'] ++ resourceNames: ++ - {{ template "cainjector.fullname" . }} ++{{- end }} ++{{- end }} +diff --git a/deploy-templates/cert-manager/templates/cainjector-psp-clusterrolebinding.yaml b/deploy-templates/cert-manager/templates/cainjector-psp-clusterrolebinding.yaml +new file mode 100644 +index 0000000..819d946 +--- /dev/null ++++ b/deploy-templates/cert-manager/templates/cainjector-psp-clusterrolebinding.yaml +@@ -0,0 +1,22 @@ ++{{- if .Values.cainjector.enabled -}} ++{{- if .Values.global.podSecurityPolicy.enabled }} ++apiVersion: rbac.authorization.k8s.io/v1 ++kind: ClusterRoleBinding ++metadata: ++ name: {{ template "cainjector.fullname" . }}-psp ++ labels: ++ app: {{ include "cainjector.name" . }} ++ app.kubernetes.io/name: {{ include "cainjector.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "cainjector" ++ {{- include "labels" . | nindent 4 }} ++roleRef: ++ apiGroup: rbac.authorization.k8s.io ++ kind: ClusterRole ++ name: {{ template "cainjector.fullname" . }}-psp ++subjects: ++ - kind: ServiceAccount ++ name: {{ template "cainjector.serviceAccountName" . }} ++ namespace: {{ .Release.Namespace }} ++{{- end }} ++{{- end }} +diff --git a/deploy-templates/cert-manager/templates/cainjector-psp.yaml b/deploy-templates/cert-manager/templates/cainjector-psp.yaml +new file mode 100644 +index 0000000..2583d97 +--- /dev/null ++++ b/deploy-templates/cert-manager/templates/cainjector-psp.yaml +@@ -0,0 +1,51 @@ ++{{- if .Values.cainjector.enabled -}} ++{{- if .Values.global.podSecurityPolicy.enabled }} ++apiVersion: policy/v1beta1 ++kind: PodSecurityPolicy ++metadata: ++ name: {{ template "cainjector.fullname" . }} ++ labels: ++ app: {{ include "cainjector.name" . }} ++ app.kubernetes.io/name: {{ include "cainjector.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "cainjector" ++ {{- include "labels" . | nindent 4 }} ++ annotations: ++ seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default' ++ seccomp.security.alpha.kubernetes.io/defaultProfileName: 'docker/default' ++ {{- if .Values.global.podSecurityPolicy.useAppArmor }} ++ apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default' ++ apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default' ++ {{- end }} ++spec: ++ privileged: false ++ allowPrivilegeEscalation: false ++ allowedCapabilities: [] # default set of capabilities are implicitly allowed ++ volumes: ++ - 'configMap' ++ - 'emptyDir' ++ - 'projected' ++ - 'secret' ++ - 'downwardAPI' ++ hostNetwork: false ++ hostIPC: false ++ hostPID: false ++ runAsUser: ++ rule: 'MustRunAs' ++ ranges: ++ - min: 1000 ++ max: 1000 ++ seLinux: ++ rule: 'RunAsAny' ++ supplementalGroups: ++ rule: 'MustRunAs' ++ ranges: ++ - min: 1000 ++ max: 1000 ++ fsGroup: ++ rule: 'MustRunAs' ++ ranges: ++ - min: 1000 ++ max: 1000 ++{{- end -}} ++{{- end -}} +diff --git a/deploy-templates/cert-manager/templates/cainjector-rbac.yaml b/deploy-templates/cert-manager/templates/cainjector-rbac.yaml +new file mode 100644 +index 0000000..5f1199c +--- /dev/null ++++ b/deploy-templates/cert-manager/templates/cainjector-rbac.yaml +@@ -0,0 +1,114 @@ ++{{- if .Values.cainjector.enabled -}} ++{{- if .Values.global.rbac.create -}} ++apiVersion: rbac.authorization.k8s.io/v1 ++kind: ClusterRole ++metadata: ++ name: {{ template "cainjector.fullname" . }} ++ labels: ++ app: {{ include "cainjector.name" . }} ++ app.kubernetes.io/name: {{ include "cainjector.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "cainjector" ++ {{- include "labels" . | nindent 4 }} ++rules: ++ - apiGroups: ["cert-manager.io"] ++ resources: ["certificates"] ++ verbs: ["get", "list", "watch"] ++ - apiGroups: [""] ++ resources: ["secrets"] ++ verbs: ["get", "list", "watch"] ++ - apiGroups: [""] ++ resources: ["events"] ++ verbs: ["get", "create", "update", "patch"] ++ - apiGroups: ["admissionregistration.k8s.io"] ++ resources: ["validatingwebhookconfigurations", "mutatingwebhookconfigurations"] ++ verbs: ["get", "list", "watch", "update"] ++ - apiGroups: ["apiregistration.k8s.io"] ++ resources: ["apiservices"] ++ verbs: ["get", "list", "watch", "update"] ++ - apiGroups: ["apiextensions.k8s.io"] ++ resources: ["customresourcedefinitions"] ++ verbs: ["get", "list", "watch", "update"] ++ - apiGroups: ["auditregistration.k8s.io"] ++ resources: ["auditsinks"] ++ verbs: ["get", "list", "watch", "update"] ++--- ++apiVersion: rbac.authorization.k8s.io/v1 ++kind: ClusterRoleBinding ++metadata: ++ name: {{ template "cainjector.fullname" . }} ++ labels: ++ app: {{ include "cainjector.name" . }} ++ app.kubernetes.io/name: {{ include "cainjector.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "cainjector" ++ {{- include "labels" . | nindent 4 }} ++roleRef: ++ apiGroup: rbac.authorization.k8s.io ++ kind: ClusterRole ++ name: {{ template "cainjector.fullname" . }} ++subjects: ++ - name: {{ template "cainjector.serviceAccountName" . }} ++ namespace: {{ .Release.Namespace | quote }} ++ kind: ServiceAccount ++ ++--- ++# leader election rules ++apiVersion: rbac.authorization.k8s.io/v1 ++kind: Role ++metadata: ++ name: {{ template "cainjector.fullname" . }}:leaderelection ++ namespace: {{ .Values.global.leaderElection.namespace }} ++ labels: ++ app: {{ include "cainjector.name" . }} ++ app.kubernetes.io/name: {{ include "cainjector.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "cainjector" ++ {{- include "labels" . | nindent 4 }} ++rules: ++ # Used for leader election by the controller ++ # cert-manager-cainjector-leader-election is used by the CertificateBased injector controller ++ # see cmd/cainjector/start.go#L113 ++ # cert-manager-cainjector-leader-election-core is used by the SecretBased injector controller ++ # see cmd/cainjector/start.go#L137 ++ # See also: https://github.com/kubernetes-sigs/controller-runtime/pull/1144#discussion_r480173688 ++ - apiGroups: [""] ++ resources: ["configmaps"] ++ resourceNames: ["cert-manager-cainjector-leader-election", "cert-manager-cainjector-leader-election-core"] ++ verbs: ["get", "update", "patch"] ++ - apiGroups: [""] ++ resources: ["configmaps"] ++ verbs: ["create"] ++ - apiGroups: ["coordination.k8s.io"] ++ resources: ["leases"] ++ resourceNames: ["cert-manager-cainjector-leader-election", "cert-manager-cainjector-leader-election-core"] ++ verbs: ["get", "update", "patch"] ++ - apiGroups: ["coordination.k8s.io"] ++ resources: ["leases"] ++ verbs: ["create"] ++ ++--- ++ ++# grant cert-manager permission to manage the leaderelection configmap in the ++# leader election namespace ++apiVersion: rbac.authorization.k8s.io/v1 ++kind: RoleBinding ++metadata: ++ name: {{ include "cainjector.fullname" . }}:leaderelection ++ namespace: {{ .Values.global.leaderElection.namespace }} ++ labels: ++ app: {{ include "cainjector.name" . }} ++ app.kubernetes.io/name: {{ include "cainjector.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "cainjector" ++ {{- include "labels" . | nindent 4 }} ++roleRef: ++ apiGroup: rbac.authorization.k8s.io ++ kind: Role ++ name: {{ template "cainjector.fullname" . }}:leaderelection ++subjects: ++ - kind: ServiceAccount ++ name: {{ template "cainjector.serviceAccountName" . }} ++ namespace: {{ .Release.Namespace }} ++{{- end -}} ++{{- end -}} +diff --git a/deploy-templates/cert-manager/templates/cainjector-serviceaccount.yaml b/deploy-templates/cert-manager/templates/cainjector-serviceaccount.yaml +new file mode 100644 +index 0000000..bd56468 +--- /dev/null ++++ b/deploy-templates/cert-manager/templates/cainjector-serviceaccount.yaml +@@ -0,0 +1,23 @@ ++{{- if .Values.cainjector.enabled -}} ++{{- if .Values.cainjector.serviceAccount.create -}} ++apiVersion: v1 ++kind: ServiceAccount ++automountServiceAccountToken: {{ .Values.cainjector.serviceAccount.automountServiceAccountToken }} ++metadata: ++ name: {{ template "cainjector.serviceAccountName" . }} ++ namespace: {{ .Release.Namespace | quote }} ++ {{- if .Values.cainjector.serviceAccount.annotations }} ++ annotations: ++{{ toYaml .Values.cainjector.serviceAccount.annotations | indent 4 }} ++ {{- end }} ++ labels: ++ app: {{ include "cainjector.name" . }} ++ app.kubernetes.io/name: {{ include "cainjector.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "cainjector" ++ {{- include "labels" . | nindent 4 }} ++{{- if .Values.global.imagePullSecrets }} ++imagePullSecrets: {{ toYaml .Values.global.imagePullSecrets | nindent 2 }} ++{{- end }} ++{{- end -}} ++{{- end -}} +diff --git a/deploy-templates/cert-manager/templates/deployment.yaml b/deploy-templates/cert-manager/templates/deployment.yaml +new file mode 100644 +index 0000000..7431771 +--- /dev/null ++++ b/deploy-templates/cert-manager/templates/deployment.yaml +@@ -0,0 +1,167 @@ ++apiVersion: apps/v1 ++kind: Deployment ++metadata: ++ name: {{ template "cert-manager.fullname" . }} ++ namespace: {{ .Release.Namespace | quote }} ++ labels: ++ app: {{ template "cert-manager.name" . }} ++ app.kubernetes.io/name: {{ template "cert-manager.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "controller" ++ {{- include "labels" . | nindent 4 }} ++ {{- if .Values.deploymentAnnotations }} ++ annotations: ++{{ toYaml .Values.deploymentAnnotations | indent 4 }} ++ {{- end }} ++spec: ++ replicas: {{ .Values.replicaCount }} ++ selector: ++ matchLabels: ++ app.kubernetes.io/name: {{ template "cert-manager.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "controller" ++ {{- with .Values.strategy }} ++ strategy: ++ {{- . | toYaml | nindent 4 }} ++ {{- end }} ++ template: ++ metadata: ++ labels: ++ app: {{ template "cert-manager.name" . }} ++ app.kubernetes.io/name: {{ template "cert-manager.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "controller" ++ {{- include "labels" . | nindent 8 }} ++{{- if .Values.podLabels }} ++{{ toYaml .Values.podLabels | indent 8 }} ++{{- end }} ++ {{- if .Values.podAnnotations }} ++ annotations: ++{{ toYaml .Values.podAnnotations | indent 8 }} ++ {{- end }} ++ {{- if and .Values.prometheus.enabled (not .Values.prometheus.servicemonitor.enabled) }} ++ {{- if not .Values.podAnnotations }} ++ annotations: ++ {{- end }} ++ prometheus.io/path: "/metrics" ++ prometheus.io/scrape: 'true' ++ prometheus.io/port: '9402' ++ {{- end }} ++ spec: ++ serviceAccountName: {{ template "cert-manager.serviceAccountName" . }} ++ {{- if .Values.global.priorityClassName }} ++ priorityClassName: {{ .Values.global.priorityClassName | quote }} ++ {{- end }} ++ {{- $enabledDefined := gt (len (keys (pick .Values.securityContext "enabled"))) 0 }} ++ {{- $legacyEnabledExplicitlyOff := and $enabledDefined (not .Values.securityContext.enabled) }} ++ {{- if and .Values.securityContext (not $legacyEnabledExplicitlyOff) }} ++ securityContext: ++ {{- if .Values.securityContext.enabled -}} ++ {{/* support legacy securityContext.enabled and its two parameters */}} ++ fsGroup: {{ default 1001 .Values.securityContext.fsGroup }} ++ runAsUser: {{ default 1001 .Values.securityContext.runAsUser }} ++ {{- else -}} ++ {{/* this is the way forward: support an arbitrary yaml block */}} ++{{ toYaml .Values.securityContext | indent 8 }} ++ {{- end }} ++ {{- end }} ++ {{- if .Values.volumes }} ++ volumes: ++{{ toYaml .Values.volumes | indent 8 }} ++ {{- end }} ++ containers: ++ - name: {{ .Chart.Name }} ++ {{- with .Values.image }} ++ image: "{{- if .registry -}}{{ .registry }}/{{- end -}}{{ .repository }}{{- if (.digest) -}} @{{.digest}}{{- else -}}:{{ default $.Chart.AppVersion .tag }} {{- end -}}" ++ {{- end }} ++ imagePullPolicy: {{ .Values.image.pullPolicy }} ++ args: ++ {{- if .Values.global.logLevel }} ++ - --v={{ .Values.global.logLevel }} ++ {{- end }} ++ {{- if .Values.clusterResourceNamespace }} ++ - --cluster-resource-namespace={{ .Values.clusterResourceNamespace }} ++ {{- else }} ++ - --cluster-resource-namespace=$(POD_NAMESPACE) ++ {{- end }} ++ {{- with .Values.global.leaderElection }} ++ - --leader-election-namespace={{ .namespace }} ++ {{- if .leaseDuration }} ++ - --leader-election-lease-duration={{ .leaseDuration }} ++ {{- end }} ++ {{- if .renewDeadline }} ++ - --leader-election-renew-deadline={{ .renewDeadline }} ++ {{- end }} ++ {{- if .retryPeriod }} ++ - --leader-election-retry-period={{ .retryPeriod }} ++ {{- end }} ++ {{- end }} ++ {{- if .Values.extraArgs }} ++{{ toYaml .Values.extraArgs | indent 10 }} ++ {{- end }} ++ {{- with .Values.ingressShim }} ++ {{- if .defaultIssuerName }} ++ - --default-issuer-name={{ .defaultIssuerName }} ++ {{- end }} ++ {{- if .defaultIssuerKind }} ++ - --default-issuer-kind={{ .defaultIssuerKind }} ++ {{- end }} ++ {{- if .defaultIssuerGroup }} ++ - --default-issuer-group={{ .defaultIssuerGroup }} ++ {{- end }} ++ {{- end }} ++ {{- if .Values.featureGates }} ++ - --feature-gates={{ .Values.featureGates }} ++ {{- end }} ++ ports: ++ - containerPort: 9402 ++ protocol: TCP ++ {{- if .Values.containerSecurityContext }} ++ securityContext: ++ {{- toYaml .Values.containerSecurityContext | nindent 12 }} ++ {{- end }} ++ {{- if .Values.volumeMounts }} ++ volumeMounts: ++{{ toYaml .Values.volumeMounts | indent 12 }} ++ {{- end }} ++ env: ++ - name: POD_NAMESPACE ++ valueFrom: ++ fieldRef: ++ fieldPath: metadata.namespace ++ {{- if .Values.extraEnv }} ++{{ toYaml .Values.extraEnv | indent 10 }} ++ {{- end }} ++ {{- if .Values.http_proxy }} ++ - name: HTTP_PROXY ++ value: {{ .Values.http_proxy }} ++ {{- end }} ++ {{- if .Values.https_proxy }} ++ - name: HTTPS_PROXY ++ value: {{ .Values.https_proxy }} ++ {{- end }} ++ {{- if .Values.no_proxy }} ++ - name: NO_PROXY ++ value: {{ .Values.no_proxy }} ++ {{- end }} ++ resources: ++{{ toYaml .Values.resources | indent 12 }} ++ {{- with .Values.nodeSelector }} ++ nodeSelector: ++{{ toYaml . | indent 8 }} ++ {{- end }} ++ {{- with .Values.affinity }} ++ affinity: ++{{ toYaml . | indent 8 }} ++ {{- end }} ++ {{- with .Values.tolerations }} ++ tolerations: ++{{ toYaml . | indent 8 }} ++ {{- end }} ++{{- if .Values.podDnsPolicy }} ++ dnsPolicy: {{ .Values.podDnsPolicy }} ++{{- end }} ++{{- if .Values.podDnsConfig }} ++ dnsConfig: ++{{ toYaml .Values.podDnsConfig | indent 8 }} ++{{- end }} +diff --git a/deploy-templates/cert-manager/templates/psp-clusterrole.yaml b/deploy-templates/cert-manager/templates/psp-clusterrole.yaml +new file mode 100644 +index 0000000..1d40a02 +--- /dev/null ++++ b/deploy-templates/cert-manager/templates/psp-clusterrole.yaml +@@ -0,0 +1,18 @@ ++{{- if .Values.global.podSecurityPolicy.enabled }} ++kind: ClusterRole ++apiVersion: rbac.authorization.k8s.io/v1 ++metadata: ++ name: {{ template "cert-manager.fullname" . }}-psp ++ labels: ++ app: {{ include "cert-manager.name" . }} ++ app.kubernetes.io/name: {{ include "cert-manager.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "controller" ++ {{- include "labels" . | nindent 4 }} ++rules: ++- apiGroups: ['policy'] ++ resources: ['podsecuritypolicies'] ++ verbs: ['use'] ++ resourceNames: ++ - {{ template "cert-manager.fullname" . }} ++{{- end }} +diff --git a/deploy-templates/cert-manager/templates/psp-clusterrolebinding.yaml b/deploy-templates/cert-manager/templates/psp-clusterrolebinding.yaml +new file mode 100644 +index 0000000..1da89c8 +--- /dev/null ++++ b/deploy-templates/cert-manager/templates/psp-clusterrolebinding.yaml +@@ -0,0 +1,20 @@ ++{{- if .Values.global.podSecurityPolicy.enabled }} ++apiVersion: rbac.authorization.k8s.io/v1 ++kind: ClusterRoleBinding ++metadata: ++ name: {{ template "cert-manager.fullname" . }}-psp ++ labels: ++ app: {{ include "cert-manager.name" . }} ++ app.kubernetes.io/name: {{ include "cert-manager.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "controller" ++ {{- include "labels" . | nindent 4 }} ++roleRef: ++ apiGroup: rbac.authorization.k8s.io ++ kind: ClusterRole ++ name: {{ template "cert-manager.fullname" . }}-psp ++subjects: ++ - kind: ServiceAccount ++ name: {{ template "cert-manager.serviceAccountName" . }} ++ namespace: {{ .Release.Namespace }} ++{{- end }} +diff --git a/deploy-templates/cert-manager/templates/psp.yaml b/deploy-templates/cert-manager/templates/psp.yaml +new file mode 100644 +index 0000000..9e99f5c +--- /dev/null ++++ b/deploy-templates/cert-manager/templates/psp.yaml +@@ -0,0 +1,49 @@ ++{{- if .Values.global.podSecurityPolicy.enabled }} ++apiVersion: policy/v1beta1 ++kind: PodSecurityPolicy ++metadata: ++ name: {{ template "cert-manager.fullname" . }} ++ labels: ++ app: {{ include "cert-manager.name" . }} ++ app.kubernetes.io/name: {{ include "cert-manager.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "controller" ++ {{- include "labels" . | nindent 4 }} ++ annotations: ++ seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default' ++ seccomp.security.alpha.kubernetes.io/defaultProfileName: 'docker/default' ++ {{- if .Values.global.podSecurityPolicy.useAppArmor }} ++ apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default' ++ apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default' ++ {{- end }} ++spec: ++ privileged: false ++ allowPrivilegeEscalation: false ++ allowedCapabilities: [] # default set of capabilities are implicitly allowed ++ volumes: ++ - 'configMap' ++ - 'emptyDir' ++ - 'projected' ++ - 'secret' ++ - 'downwardAPI' ++ hostNetwork: false ++ hostIPC: false ++ hostPID: false ++ runAsUser: ++ rule: 'MustRunAs' ++ ranges: ++ - min: 1000 ++ max: 1000 ++ seLinux: ++ rule: 'RunAsAny' ++ supplementalGroups: ++ rule: 'MustRunAs' ++ ranges: ++ - min: 1000 ++ max: 1000 ++ fsGroup: ++ rule: 'MustRunAs' ++ ranges: ++ - min: 1000 ++ max: 1000 ++{{- end }} +diff --git a/deploy-templates/cert-manager/templates/rbac.yaml b/deploy-templates/cert-manager/templates/rbac.yaml +new file mode 100644 +index 0000000..0b02648 +--- /dev/null ++++ b/deploy-templates/cert-manager/templates/rbac.yaml +@@ -0,0 +1,547 @@ ++{{- if .Values.global.rbac.create -}} ++apiVersion: rbac.authorization.k8s.io/v1 ++kind: Role ++metadata: ++ name: {{ template "cert-manager.fullname" . }}:leaderelection ++ namespace: {{ .Values.global.leaderElection.namespace }} ++ labels: ++ app: {{ include "cert-manager.name" . }} ++ app.kubernetes.io/name: {{ include "cert-manager.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "controller" ++ {{- include "labels" . | nindent 4 }} ++rules: ++ # Used for leader election by the controller ++ # See also: https://github.com/kubernetes-sigs/controller-runtime/pull/1144#discussion_r480173688 ++ - apiGroups: [""] ++ resources: ["configmaps"] ++ resourceNames: ["cert-manager-controller"] ++ verbs: ["get", "update", "patch"] ++ - apiGroups: [""] ++ resources: ["configmaps"] ++ verbs: ["create"] ++ - apiGroups: ["coordination.k8s.io"] ++ resources: ["leases"] ++ resourceNames: ["cert-manager-controller"] ++ verbs: ["get", "update", "patch"] ++ - apiGroups: ["coordination.k8s.io"] ++ resources: ["leases"] ++ verbs: ["create"] ++ ++--- ++ ++# grant cert-manager permission to manage the leaderelection configmap in the ++# leader election namespace ++apiVersion: rbac.authorization.k8s.io/v1 ++kind: RoleBinding ++metadata: ++ name: {{ include "cert-manager.fullname" . }}:leaderelection ++ namespace: {{ .Values.global.leaderElection.namespace }} ++ labels: ++ app: {{ include "cert-manager.name" . }} ++ app.kubernetes.io/name: {{ include "cert-manager.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "controller" ++ {{- include "labels" . | nindent 4 }} ++roleRef: ++ apiGroup: rbac.authorization.k8s.io ++ kind: Role ++ name: {{ template "cert-manager.fullname" . }}:leaderelection ++subjects: ++ - apiGroup: "" ++ kind: ServiceAccount ++ name: {{ template "cert-manager.serviceAccountName" . }} ++ namespace: {{ .Release.Namespace }} ++ ++--- ++ ++# Issuer controller role ++apiVersion: rbac.authorization.k8s.io/v1 ++kind: ClusterRole ++metadata: ++ name: {{ template "cert-manager.fullname" . }}-controller-issuers ++ labels: ++ app: {{ include "cert-manager.name" . }} ++ app.kubernetes.io/name: {{ include "cert-manager.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "controller" ++ {{- include "labels" . | nindent 4 }} ++rules: ++ - apiGroups: ["cert-manager.io"] ++ resources: ["issuers", "issuers/status"] ++ verbs: ["update"] ++ - apiGroups: ["cert-manager.io"] ++ resources: ["issuers"] ++ verbs: ["get", "list", "watch"] ++ - apiGroups: [""] ++ resources: ["secrets"] ++ verbs: ["get", "list", "watch", "create", "update", "delete"] ++ - apiGroups: [""] ++ resources: ["events"] ++ verbs: ["create", "patch"] ++ ++--- ++ ++# ClusterIssuer controller role ++apiVersion: rbac.authorization.k8s.io/v1 ++kind: ClusterRole ++metadata: ++ name: {{ template "cert-manager.fullname" . }}-controller-clusterissuers ++ labels: ++ app: {{ include "cert-manager.name" . }} ++ app.kubernetes.io/name: {{ include "cert-manager.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "controller" ++ {{- include "labels" . | nindent 4 }} ++rules: ++ - apiGroups: ["cert-manager.io"] ++ resources: ["clusterissuers", "clusterissuers/status"] ++ verbs: ["update"] ++ - apiGroups: ["cert-manager.io"] ++ resources: ["clusterissuers"] ++ verbs: ["get", "list", "watch"] ++ - apiGroups: [""] ++ resources: ["secrets"] ++ verbs: ["get", "list", "watch", "create", "update", "delete"] ++ - apiGroups: [""] ++ resources: ["events"] ++ verbs: ["create", "patch"] ++ ++--- ++ ++# Certificates controller role ++apiVersion: rbac.authorization.k8s.io/v1 ++kind: ClusterRole ++metadata: ++ name: {{ template "cert-manager.fullname" . }}-controller-certificates ++ labels: ++ app: {{ include "cert-manager.name" . }} ++ app.kubernetes.io/name: {{ include "cert-manager.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "controller" ++ {{- include "labels" . | nindent 4 }} ++rules: ++ - apiGroups: ["cert-manager.io"] ++ resources: ["certificates", "certificates/status", "certificaterequests", "certificaterequests/status"] ++ verbs: ["update"] ++ - apiGroups: ["cert-manager.io"] ++ resources: ["certificates", "certificaterequests", "clusterissuers", "issuers"] ++ verbs: ["get", "list", "watch"] ++ # We require these rules to support users with the OwnerReferencesPermissionEnforcement ++ # admission controller enabled: ++ # https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement ++ - apiGroups: ["cert-manager.io"] ++ resources: ["certificates/finalizers", "certificaterequests/finalizers"] ++ verbs: ["update"] ++ - apiGroups: ["acme.cert-manager.io"] ++ resources: ["orders"] ++ verbs: ["create", "delete", "get", "list", "watch"] ++ - apiGroups: [""] ++ resources: ["secrets"] ++ verbs: ["get", "list", "watch", "create", "update", "delete"] ++ - apiGroups: [""] ++ resources: ["events"] ++ verbs: ["create", "patch"] ++ ++--- ++ ++# Orders controller role ++apiVersion: rbac.authorization.k8s.io/v1 ++kind: ClusterRole ++metadata: ++ name: {{ template "cert-manager.fullname" . }}-controller-orders ++ labels: ++ app: {{ include "cert-manager.name" . }} ++ app.kubernetes.io/name: {{ include "cert-manager.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "controller" ++ {{- include "labels" . | nindent 4 }} ++rules: ++ - apiGroups: ["acme.cert-manager.io"] ++ resources: ["orders", "orders/status"] ++ verbs: ["update"] ++ - apiGroups: ["acme.cert-manager.io"] ++ resources: ["orders", "challenges"] ++ verbs: ["get", "list", "watch"] ++ - apiGroups: ["cert-manager.io"] ++ resources: ["clusterissuers", "issuers"] ++ verbs: ["get", "list", "watch"] ++ - apiGroups: ["acme.cert-manager.io"] ++ resources: ["challenges"] ++ verbs: ["create", "delete"] ++ # We require these rules to support users with the OwnerReferencesPermissionEnforcement ++ # admission controller enabled: ++ # https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement ++ - apiGroups: ["acme.cert-manager.io"] ++ resources: ["orders/finalizers"] ++ verbs: ["update"] ++ - apiGroups: [""] ++ resources: ["secrets"] ++ verbs: ["get", "list", "watch"] ++ - apiGroups: [""] ++ resources: ["events"] ++ verbs: ["create", "patch"] ++ ++--- ++ ++# Challenges controller role ++apiVersion: rbac.authorization.k8s.io/v1 ++kind: ClusterRole ++metadata: ++ name: {{ template "cert-manager.fullname" . }}-controller-challenges ++ labels: ++ app: {{ include "cert-manager.name" . }} ++ app.kubernetes.io/name: {{ include "cert-manager.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "controller" ++ {{- include "labels" . | nindent 4 }} ++rules: ++ # Use to update challenge resource status ++ - apiGroups: ["acme.cert-manager.io"] ++ resources: ["challenges", "challenges/status"] ++ verbs: ["update"] ++ # Used to watch challenge resources ++ - apiGroups: ["acme.cert-manager.io"] ++ resources: ["challenges"] ++ verbs: ["get", "list", "watch"] ++ # Used to watch challenges, issuer and clusterissuer resources ++ - apiGroups: ["cert-manager.io"] ++ resources: ["issuers", "clusterissuers"] ++ verbs: ["get", "list", "watch"] ++ # Need to be able to retrieve ACME account private key to complete challenges ++ - apiGroups: [""] ++ resources: ["secrets"] ++ verbs: ["get", "list", "watch"] ++ # Used to create events ++ - apiGroups: [""] ++ resources: ["events"] ++ verbs: ["create", "patch"] ++ # HTTP01 rules ++ - apiGroups: [""] ++ resources: ["pods", "services"] ++ verbs: ["get", "list", "watch", "create", "delete"] ++ - apiGroups: ["networking.k8s.io"] ++ resources: ["ingresses"] ++ verbs: ["get", "list", "watch", "create", "delete", "update"] ++ - apiGroups: [ "networking.x-k8s.io" ] ++ resources: [ "httproutes" ] ++ verbs: ["get", "list", "watch", "create", "delete", "update"] ++ # We require the ability to specify a custom hostname when we are creating ++ # new ingress resources. ++ # See: https://github.com/openshift/origin/blob/21f191775636f9acadb44fa42beeb4f75b255532/pkg/route/apiserver/admission/ingress_admission.go#L84-L148 ++ - apiGroups: ["route.openshift.io"] ++ resources: ["routes/custom-host"] ++ verbs: ["create"] ++ # We require these rules to support users with the OwnerReferencesPermissionEnforcement ++ # admission controller enabled: ++ # https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement ++ - apiGroups: ["acme.cert-manager.io"] ++ resources: ["challenges/finalizers"] ++ verbs: ["update"] ++ # DNS01 rules (duplicated above) ++ - apiGroups: [""] ++ resources: ["secrets"] ++ verbs: ["get", "list", "watch"] ++ ++--- ++ ++# ingress-shim controller role ++apiVersion: rbac.authorization.k8s.io/v1 ++kind: ClusterRole ++metadata: ++ name: {{ template "cert-manager.fullname" . }}-controller-ingress-shim ++ labels: ++ app: {{ include "cert-manager.name" . }} ++ app.kubernetes.io/name: {{ include "cert-manager.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "controller" ++ {{- include "labels" . | nindent 4 }} ++rules: ++ - apiGroups: ["cert-manager.io"] ++ resources: ["certificates", "certificaterequests"] ++ verbs: ["create", "update", "delete"] ++ - apiGroups: ["cert-manager.io"] ++ resources: ["certificates", "certificaterequests", "issuers", "clusterissuers"] ++ verbs: ["get", "list", "watch"] ++ - apiGroups: ["networking.k8s.io"] ++ resources: ["ingresses"] ++ verbs: ["get", "list", "watch"] ++ # We require these rules to support users with the OwnerReferencesPermissionEnforcement ++ # admission controller enabled: ++ # https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement ++ - apiGroups: ["networking.k8s.io"] ++ resources: ["ingresses/finalizers"] ++ verbs: ["update"] ++ - apiGroups: ["networking.x-k8s.io"] ++ resources: ["gateways", "httproutes"] ++ verbs: ["get", "list", "watch"] ++ - apiGroups: ["networking.x-k8s.io"] ++ resources: ["gateways/finalizers", "httproutes/finalizers"] ++ verbs: ["update"] ++ - apiGroups: [""] ++ resources: ["events"] ++ verbs: ["create", "patch"] ++ ++--- ++ ++apiVersion: rbac.authorization.k8s.io/v1 ++kind: ClusterRoleBinding ++metadata: ++ name: {{ template "cert-manager.fullname" . }}-controller-issuers ++ labels: ++ app: {{ include "cert-manager.name" . }} ++ app.kubernetes.io/name: {{ include "cert-manager.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "controller" ++ {{- include "labels" . | nindent 4 }} ++roleRef: ++ apiGroup: rbac.authorization.k8s.io ++ kind: ClusterRole ++ name: {{ template "cert-manager.fullname" . }}-controller-issuers ++subjects: ++ - name: {{ template "cert-manager.serviceAccountName" . }} ++ namespace: {{ .Release.Namespace | quote }} ++ kind: ServiceAccount ++ ++--- ++ ++apiVersion: rbac.authorization.k8s.io/v1 ++kind: ClusterRoleBinding ++metadata: ++ name: {{ template "cert-manager.fullname" . }}-controller-clusterissuers ++ labels: ++ app: {{ include "cert-manager.name" . }} ++ app.kubernetes.io/name: {{ include "cert-manager.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "controller" ++ {{- include "labels" . | nindent 4 }} ++roleRef: ++ apiGroup: rbac.authorization.k8s.io ++ kind: ClusterRole ++ name: {{ template "cert-manager.fullname" . }}-controller-clusterissuers ++subjects: ++ - name: {{ template "cert-manager.serviceAccountName" . }} ++ namespace: {{ .Release.Namespace | quote }} ++ kind: ServiceAccount ++ ++--- ++ ++apiVersion: rbac.authorization.k8s.io/v1 ++kind: ClusterRoleBinding ++metadata: ++ name: {{ template "cert-manager.fullname" . }}-controller-certificates ++ labels: ++ app: {{ include "cert-manager.name" . }} ++ app.kubernetes.io/name: {{ include "cert-manager.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "controller" ++ {{- include "labels" . | nindent 4 }} ++roleRef: ++ apiGroup: rbac.authorization.k8s.io ++ kind: ClusterRole ++ name: {{ template "cert-manager.fullname" . }}-controller-certificates ++subjects: ++ - name: {{ template "cert-manager.serviceAccountName" . }} ++ namespace: {{ .Release.Namespace | quote }} ++ kind: ServiceAccount ++ ++--- ++ ++apiVersion: rbac.authorization.k8s.io/v1 ++kind: ClusterRoleBinding ++metadata: ++ name: {{ template "cert-manager.fullname" . }}-controller-orders ++ labels: ++ app: {{ include "cert-manager.name" . }} ++ app.kubernetes.io/name: {{ include "cert-manager.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "controller" ++ {{- include "labels" . | nindent 4 }} ++roleRef: ++ apiGroup: rbac.authorization.k8s.io ++ kind: ClusterRole ++ name: {{ template "cert-manager.fullname" . }}-controller-orders ++subjects: ++ - name: {{ template "cert-manager.serviceAccountName" . }} ++ namespace: {{ .Release.Namespace | quote }} ++ kind: ServiceAccount ++ ++--- ++ ++apiVersion: rbac.authorization.k8s.io/v1 ++kind: ClusterRoleBinding ++metadata: ++ name: {{ template "cert-manager.fullname" . }}-controller-challenges ++ labels: ++ app: {{ include "cert-manager.name" . }} ++ app.kubernetes.io/name: {{ include "cert-manager.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "controller" ++ {{- include "labels" . | nindent 4 }} ++roleRef: ++ apiGroup: rbac.authorization.k8s.io ++ kind: ClusterRole ++ name: {{ template "cert-manager.fullname" . }}-controller-challenges ++subjects: ++ - name: {{ template "cert-manager.serviceAccountName" . }} ++ namespace: {{ .Release.Namespace | quote }} ++ kind: ServiceAccount ++ ++--- ++ ++apiVersion: rbac.authorization.k8s.io/v1 ++kind: ClusterRoleBinding ++metadata: ++ name: {{ template "cert-manager.fullname" . }}-controller-ingress-shim ++ labels: ++ app: {{ include "cert-manager.name" . }} ++ app.kubernetes.io/name: {{ include "cert-manager.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "controller" ++ {{- include "labels" . | nindent 4 }} ++roleRef: ++ apiGroup: rbac.authorization.k8s.io ++ kind: ClusterRole ++ name: {{ template "cert-manager.fullname" . }}-controller-ingress-shim ++subjects: ++ - name: {{ template "cert-manager.serviceAccountName" . }} ++ namespace: {{ .Release.Namespace | quote }} ++ kind: ServiceAccount ++ ++--- ++ ++apiVersion: rbac.authorization.k8s.io/v1 ++kind: ClusterRole ++metadata: ++ name: {{ template "cert-manager.fullname" . }}-view ++ labels: ++ app: {{ include "cert-manager.name" . }} ++ app.kubernetes.io/name: {{ include "cert-manager.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "controller" ++ {{- include "labels" . | nindent 4 }} ++ rbac.authorization.k8s.io/aggregate-to-view: "true" ++ rbac.authorization.k8s.io/aggregate-to-edit: "true" ++ rbac.authorization.k8s.io/aggregate-to-admin: "true" ++rules: ++ - apiGroups: ["cert-manager.io"] ++ resources: ["certificates", "certificaterequests", "issuers"] ++ verbs: ["get", "list", "watch"] ++ - apiGroups: ["acme.cert-manager.io"] ++ resources: ["challenges", "orders"] ++ verbs: ["get", "list", "watch"] ++ ++ ++--- ++ ++apiVersion: rbac.authorization.k8s.io/v1 ++kind: ClusterRole ++metadata: ++ name: {{ template "cert-manager.fullname" . }}-edit ++ labels: ++ app: {{ include "cert-manager.name" . }} ++ app.kubernetes.io/name: {{ include "cert-manager.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "controller" ++ {{- include "labels" . | nindent 4 }} ++ rbac.authorization.k8s.io/aggregate-to-edit: "true" ++ rbac.authorization.k8s.io/aggregate-to-admin: "true" ++rules: ++ - apiGroups: ["cert-manager.io"] ++ resources: ["certificates", "certificaterequests", "issuers"] ++ verbs: ["create", "delete", "deletecollection", "patch", "update"] ++ - apiGroups: ["acme.cert-manager.io"] ++ resources: ["challenges", "orders"] ++ verbs: ["create", "delete", "deletecollection", "patch", "update"] ++ ++--- ++ ++# Permission to approve CertificateRequests referencing cert-manager.io Issuers and ClusterIssuers ++apiVersion: rbac.authorization.k8s.io/v1 ++kind: ClusterRole ++metadata: ++ name: {{ template "cert-manager.fullname" . }}-controller-approve:cert-manager-io ++ labels: ++ app: {{ include "cert-manager.name" . }} ++ app.kubernetes.io/name: {{ include "cert-manager.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "cert-manager" ++ {{- include "labels" . | nindent 4 }} ++rules: ++ - apiGroups: ["cert-manager.io"] ++ resources: ["signers"] ++ verbs: ["approve"] ++ resourceNames: ["issuers.cert-manager.io/*", "clusterissuers.cert-manager.io/*"] ++ ++--- ++ ++apiVersion: rbac.authorization.k8s.io/v1 ++kind: ClusterRoleBinding ++metadata: ++ name: {{ template "cert-manager.fullname" . }}-controller-approve:cert-manager-io ++ labels: ++ app: {{ include "cert-manager.name" . }} ++ app.kubernetes.io/name: {{ include "cert-manager.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "cert-manager" ++ {{- include "labels" . | nindent 4 }} ++roleRef: ++ apiGroup: rbac.authorization.k8s.io ++ kind: ClusterRole ++ name: {{ template "cert-manager.fullname" . }}-controller-approve:cert-manager-io ++subjects: ++ - name: {{ template "cert-manager.serviceAccountName" . }} ++ namespace: {{ .Release.Namespace | quote }} ++ kind: ServiceAccount ++ ++--- ++ ++# Permission to: ++# - Update and sign CertificatSigningeRequests referencing cert-manager.io Issuers and ClusterIssuers ++# - Perform SubjectAccessReviews to test whether users are able to reference Namespaced Issuers ++apiVersion: rbac.authorization.k8s.io/v1 ++kind: ClusterRole ++metadata: ++ name: {{ template "cert-manager.fullname" . }}-controller-certificatesigningrequests ++ labels: ++ app: {{ include "cert-manager.name" . }} ++ app.kubernetes.io/name: {{ include "cert-manager.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "cert-manager" ++ {{- include "labels" . | nindent 4 }} ++rules: ++ - apiGroups: ["certificates.k8s.io"] ++ resources: ["certificatesigningrequests"] ++ verbs: ["get", "list", "watch", "update"] ++ - apiGroups: ["certificates.k8s.io"] ++ resources: ["certificatesigningrequests/status"] ++ verbs: ["update"] ++ - apiGroups: ["certificates.k8s.io"] ++ resources: ["signers"] ++ resourceNames: ["issuers.cert-manager.io/*", "clusterissuers.cert-manager.io/*"] ++ verbs: ["sign"] ++ - apiGroups: ["authorization.k8s.io"] ++ resources: ["subjectaccessreviews"] ++ verbs: ["create"] ++ ++--- ++ ++apiVersion: rbac.authorization.k8s.io/v1 ++kind: ClusterRoleBinding ++metadata: ++ name: {{ template "cert-manager.fullname" . }}-controller-certificatesigningrequests ++ labels: ++ app: {{ include "cert-manager.name" . }} ++ app.kubernetes.io/name: {{ include "cert-manager.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "cert-manager" ++ {{- include "labels" . | nindent 4 }} ++roleRef: ++ apiGroup: rbac.authorization.k8s.io ++ kind: ClusterRole ++ name: {{ template "cert-manager.fullname" . }}-controller-certificatesigningrequests ++subjects: ++ - name: {{ template "cert-manager.serviceAccountName" . }} ++ namespace: {{ .Release.Namespace | quote }} ++ kind: ServiceAccount ++{{- end }} +diff --git a/deploy-templates/cert-manager/templates/service.yaml b/deploy-templates/cert-manager/templates/service.yaml +new file mode 100644 +index 0000000..75b02fc +--- /dev/null ++++ b/deploy-templates/cert-manager/templates/service.yaml +@@ -0,0 +1,31 @@ ++{{- if .Values.prometheus.enabled }} ++apiVersion: v1 ++kind: Service ++metadata: ++ name: {{ template "cert-manager.fullname" . }} ++ namespace: {{ .Release.Namespace | quote }} ++ labels: ++ app: {{ include "cert-manager.name" . }} ++ app.kubernetes.io/name: {{ include "cert-manager.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "controller" ++ {{- include "labels" . | nindent 4 }} ++{{- if .Values.serviceLabels }} ++{{ toYaml .Values.serviceLabels | indent 4 }} ++{{- end }} ++{{- if .Values.serviceAnnotations }} ++ annotations: ++ {{ toYaml .Values.serviceAnnotations | indent 4 }} ++{{- end }} ++spec: ++ type: ClusterIP ++ ports: ++ - protocol: TCP ++ port: 9402 ++ name: tcp-prometheus-servicemonitor ++ targetPort: {{ .Values.prometheus.servicemonitor.targetPort }} ++ selector: ++ app.kubernetes.io/name: {{ include "cert-manager.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "controller" ++{{- end }} +diff --git a/deploy-templates/cert-manager/templates/serviceaccount.yaml b/deploy-templates/cert-manager/templates/serviceaccount.yaml +new file mode 100644 +index 0000000..bacff5a +--- /dev/null ++++ b/deploy-templates/cert-manager/templates/serviceaccount.yaml +@@ -0,0 +1,21 @@ ++{{- if .Values.serviceAccount.create -}} ++apiVersion: v1 ++kind: ServiceAccount ++{{- if .Values.global.imagePullSecrets }} ++imagePullSecrets: {{ toYaml .Values.global.imagePullSecrets | nindent 2 }} ++{{- end }} ++automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }} ++metadata: ++ name: {{ template "cert-manager.serviceAccountName" . }} ++ namespace: {{ .Release.Namespace | quote }} ++ {{- if .Values.serviceAccount.annotations }} ++ annotations: ++{{ toYaml .Values.serviceAccount.annotations | indent 4 }} ++ {{- end }} ++ labels: ++ app: {{ include "cert-manager.name" . }} ++ app.kubernetes.io/name: {{ include "cert-manager.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "controller" ++ {{- include "labels" . | nindent 4 }} ++{{- end }} +diff --git a/deploy-templates/cert-manager/templates/servicemonitor.yaml b/deploy-templates/cert-manager/templates/servicemonitor.yaml +new file mode 100644 +index 0000000..36584f3 +--- /dev/null ++++ b/deploy-templates/cert-manager/templates/servicemonitor.yaml +@@ -0,0 +1,36 @@ ++{{- if and .Values.prometheus.enabled .Values.prometheus.servicemonitor.enabled }} ++apiVersion: monitoring.coreos.com/v1 ++kind: ServiceMonitor ++metadata: ++ name: {{ template "cert-manager.fullname" . }} ++{{- if .Values.prometheus.servicemonitor.namespace }} ++ namespace: {{ .Values.prometheus.servicemonitor.namespace }} ++{{- else }} ++ namespace: {{ .Release.Namespace | quote }} ++{{- end }} ++ labels: ++ app: {{ include "cert-manager.name" . }} ++ app.kubernetes.io/name: {{ include "cert-manager.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "controller" ++ {{- include "labels" . | nindent 4 }} ++ prometheus: {{ .Values.prometheus.servicemonitor.prometheusInstance }} ++{{- if .Values.prometheus.servicemonitor.labels }} ++{{ toYaml .Values.prometheus.servicemonitor.labels | indent 4}} ++{{- end }} ++spec: ++ jobLabel: {{ template "cert-manager.fullname" . }} ++ selector: ++ matchLabels: ++ app.kubernetes.io/name: {{ template "cert-manager.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "controller" ++ namespaceSelector: ++ matchNames: ++ - {{ .Release.Namespace }} ++ endpoints: ++ - targetPort: {{ .Values.prometheus.servicemonitor.targetPort }} ++ path: {{ .Values.prometheus.servicemonitor.path }} ++ interval: {{ .Values.prometheus.servicemonitor.interval }} ++ scrapeTimeout: {{ .Values.prometheus.servicemonitor.scrapeTimeout }} ++{{- end }} +diff --git a/deploy-templates/cert-manager/templates/startupapicheck-job.yaml b/deploy-templates/cert-manager/templates/startupapicheck-job.yaml +new file mode 100644 +index 0000000..3c6e0a3 +--- /dev/null ++++ b/deploy-templates/cert-manager/templates/startupapicheck-job.yaml +@@ -0,0 +1,75 @@ ++{{- if .Values.startupapicheck.enabled -}} ++apiVersion: batch/v1 ++kind: Job ++metadata: ++ name: {{ include "startupapicheck.fullname" . }} ++ namespace: {{ .Release.Namespace | quote }} ++ labels: ++ app: {{ include "startupapicheck.name" . }} ++ app.kubernetes.io/name: {{ include "startupapicheck.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "startupapicheck" ++ {{- include "labels" . | nindent 4 }} ++ {{- if .Values.startupapicheck.jobAnnotations }} ++ annotations: ++{{ toYaml .Values.startupapicheck.jobAnnotations | indent 4 }} ++ {{- end }} ++spec: ++ backoffLimit: {{ .Values.startupapicheck.backoffLimit }} ++ template: ++ metadata: ++ labels: ++ app: {{ include "startupapicheck.name" . }} ++ app.kubernetes.io/name: {{ include "startupapicheck.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "startupapicheck" ++ {{- include "labels" . | nindent 8 }} ++{{- if .Values.startupapicheck.podLabels }} ++{{ toYaml .Values.startupapicheck.podLabels | indent 8 }} ++{{- end }} ++ {{- if .Values.startupapicheck.podAnnotations }} ++ annotations: ++{{ toYaml .Values.startupapicheck.podAnnotations | indent 8 }} ++ {{- end }} ++ spec: ++ restartPolicy: OnFailure ++ serviceAccountName: {{ template "startupapicheck.serviceAccountName" . }} ++ {{- if .Values.global.priorityClassName }} ++ priorityClassName: {{ .Values.global.priorityClassName | quote }} ++ {{- end }} ++ {{- if .Values.startupapicheck.securityContext}} ++ securityContext: ++{{ toYaml .Values.startupapicheck.securityContext | indent 8 }} ++ {{- end }} ++ containers: ++ - name: {{ .Chart.Name }} ++ {{- with .Values.startupapicheck.image }} ++ image: "{{- if .registry -}}{{ .registry }}/{{- end -}}{{ .repository }}{{- if (.digest) -}} @{{.digest}}{{- else -}}:{{ default $.Chart.AppVersion .tag }} {{- end -}}" ++ {{- end }} ++ imagePullPolicy: {{ .Values.startupapicheck.image.pullPolicy }} ++ args: ++ - check ++ - api ++ - --wait={{ .Values.startupapicheck.timeout }} ++ {{- if .Values.startupapicheck.extraArgs }} ++{{ toYaml .Values.startupapicheck.extraArgs | indent 10 }} ++ {{- end }} ++ {{- if .Values.startupapicheck.containerSecurityContext }} ++ securityContext: ++ {{- toYaml .Values.startupapicheck.containerSecurityContext | nindent 12 }} ++ {{- end }} ++ resources: ++{{ toYaml .Values.startupapicheck.resources | indent 12 }} ++ {{- with .Values.startupapicheck.nodeSelector }} ++ nodeSelector: ++{{ toYaml . | indent 8 }} ++ {{- end }} ++ {{- with .Values.startupapicheck.affinity }} ++ affinity: ++{{ toYaml . | indent 8 }} ++ {{- end }} ++ {{- with .Values.startupapicheck.tolerations }} ++ tolerations: ++{{ toYaml . | indent 8 }} ++ {{- end }} ++{{- end -}} +diff --git a/deploy-templates/cert-manager/templates/startupapicheck-psp-clusterrole.yaml b/deploy-templates/cert-manager/templates/startupapicheck-psp-clusterrole.yaml +new file mode 100644 +index 0000000..d22786f +--- /dev/null ++++ b/deploy-templates/cert-manager/templates/startupapicheck-psp-clusterrole.yaml +@@ -0,0 +1,24 @@ ++{{- if .Values.startupapicheck.enabled -}} ++{{- if .Values.global.podSecurityPolicy.enabled }} ++kind: ClusterRole ++apiVersion: rbac.authorization.k8s.io/v1 ++metadata: ++ name: {{ template "startupapicheck.fullname" . }}-psp ++ labels: ++ app: {{ include "startupapicheck.name" . }} ++ app.kubernetes.io/name: {{ include "startupapicheck.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "startupapicheck" ++ {{- include "labels" . | nindent 4 }} ++ {{- if .Values.startupapicheck.rbac.annotations }} ++ annotations: ++ {{ toYaml .Values.startupapicheck.rbac.annotations | nindent 4 }} ++ {{- end }} ++rules: ++- apiGroups: ['policy'] ++ resources: ['podsecuritypolicies'] ++ verbs: ['use'] ++ resourceNames: ++ - {{ template "startupapicheck.fullname" . }} ++{{- end }} ++{{- end }} +diff --git a/deploy-templates/cert-manager/templates/startupapicheck-psp-clusterrolebinding.yaml b/deploy-templates/cert-manager/templates/startupapicheck-psp-clusterrolebinding.yaml +new file mode 100644 +index 0000000..119a260 +--- /dev/null ++++ b/deploy-templates/cert-manager/templates/startupapicheck-psp-clusterrolebinding.yaml +@@ -0,0 +1,26 @@ ++{{- if .Values.startupapicheck.enabled -}} ++{{- if .Values.global.podSecurityPolicy.enabled }} ++apiVersion: rbac.authorization.k8s.io/v1 ++kind: ClusterRoleBinding ++metadata: ++ name: {{ template "startupapicheck.fullname" . }}-psp ++ labels: ++ app: {{ include "startupapicheck.name" . }} ++ app.kubernetes.io/name: {{ include "startupapicheck.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "startupapicheck" ++ {{- include "labels" . | nindent 4 }} ++ {{- if .Values.startupapicheck.rbac.annotations }} ++ annotations: ++ {{ toYaml .Values.startupapicheck.rbac.annotations | nindent 4 }} ++ {{- end }} ++roleRef: ++ apiGroup: rbac.authorization.k8s.io ++ kind: ClusterRole ++ name: {{ template "startupapicheck.fullname" . }}-psp ++subjects: ++ - kind: ServiceAccount ++ name: {{ template "startupapicheck.serviceAccountName" . }} ++ namespace: {{ .Release.Namespace }} ++{{- end }} ++{{- end }} +diff --git a/deploy-templates/cert-manager/templates/startupapicheck-psp.yaml b/deploy-templates/cert-manager/templates/startupapicheck-psp.yaml +new file mode 100644 +index 0000000..c87e7ec +--- /dev/null ++++ b/deploy-templates/cert-manager/templates/startupapicheck-psp.yaml +@@ -0,0 +1,51 @@ ++{{- if .Values.startupapicheck.enabled -}} ++{{- if .Values.global.podSecurityPolicy.enabled }} ++apiVersion: policy/v1beta1 ++kind: PodSecurityPolicy ++metadata: ++ name: {{ template "startupapicheck.fullname" . }} ++ labels: ++ app: {{ include "startupapicheck.name" . }} ++ app.kubernetes.io/name: {{ include "startupapicheck.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "startupapicheck" ++ {{- include "labels" . | nindent 4 }} ++ annotations: ++ seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default' ++ seccomp.security.alpha.kubernetes.io/defaultProfileName: 'docker/default' ++ {{- if .Values.global.podSecurityPolicy.useAppArmor }} ++ apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default' ++ apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default' ++ {{- end }} ++ {{- if .Values.startupapicheck.rbac.annotations }} ++ {{ toYaml .Values.startupapicheck.rbac.annotations | nindent 4 }} ++ {{- end }} ++spec: ++ privileged: false ++ allowPrivilegeEscalation: false ++ allowedCapabilities: [] # default set of capabilities are implicitly allowed ++ volumes: ++ - 'projected' ++ - 'secret' ++ hostNetwork: false ++ hostIPC: false ++ hostPID: false ++ runAsUser: ++ rule: 'MustRunAs' ++ ranges: ++ - min: 1000 ++ max: 1000 ++ seLinux: ++ rule: 'RunAsAny' ++ supplementalGroups: ++ rule: 'MustRunAs' ++ ranges: ++ - min: 1000 ++ max: 1000 ++ fsGroup: ++ rule: 'MustRunAs' ++ ranges: ++ - min: 1000 ++ max: 1000 ++{{- end -}} ++{{- end -}} +diff --git a/deploy-templates/cert-manager/templates/startupapicheck-rbac.yaml b/deploy-templates/cert-manager/templates/startupapicheck-rbac.yaml +new file mode 100644 +index 0000000..0c08e49 +--- /dev/null ++++ b/deploy-templates/cert-manager/templates/startupapicheck-rbac.yaml +@@ -0,0 +1,49 @@ ++{{- if .Values.startupapicheck.enabled -}} ++{{- if .Values.global.rbac.create -}} ++# create certificate role ++apiVersion: rbac.authorization.k8s.io/v1 ++kind: Role ++metadata: ++ name: {{ template "startupapicheck.fullname" . }}:create-cert ++ namespace: {{ .Release.Namespace | quote }} ++ labels: ++ app: {{ include "startupapicheck.name" . }} ++ app.kubernetes.io/name: {{ include "startupapicheck.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "startupapicheck" ++ {{- include "labels" . | nindent 4 }} ++ {{- if .Values.startupapicheck.rbac.annotations }} ++ annotations: ++{{ toYaml .Values.startupapicheck.rbac.annotations | indent 4 }} ++ {{- end }} ++rules: ++ - apiGroups: ["cert-manager.io"] ++ resources: ["certificates"] ++ verbs: ["create"] ++ ++--- ++apiVersion: rbac.authorization.k8s.io/v1 ++kind: RoleBinding ++metadata: ++ name: {{ include "startupapicheck.fullname" . }}:create-cert ++ namespace: {{ .Release.Namespace | quote }} ++ labels: ++ app: {{ include "startupapicheck.name" . }} ++ app.kubernetes.io/name: {{ include "startupapicheck.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "startupapicheck" ++ {{- include "labels" . | nindent 4 }} ++ {{- if .Values.startupapicheck.rbac.annotations }} ++ annotations: ++{{ toYaml .Values.startupapicheck.rbac.annotations | indent 4 }} ++ {{- end }} ++roleRef: ++ apiGroup: rbac.authorization.k8s.io ++ kind: Role ++ name: {{ template "startupapicheck.fullname" . }}:create-cert ++subjects: ++ - kind: ServiceAccount ++ name: {{ template "startupapicheck.serviceAccountName" . }} ++ namespace: {{ .Release.Namespace }} ++{{- end -}} ++{{- end -}} +diff --git a/deploy-templates/cert-manager/templates/startupapicheck-serviceaccount.yaml b/deploy-templates/cert-manager/templates/startupapicheck-serviceaccount.yaml +new file mode 100644 +index 0000000..dd51c8d +--- /dev/null ++++ b/deploy-templates/cert-manager/templates/startupapicheck-serviceaccount.yaml +@@ -0,0 +1,23 @@ ++{{- if .Values.startupapicheck.enabled -}} ++{{- if .Values.startupapicheck.serviceAccount.create -}} ++apiVersion: v1 ++kind: ServiceAccount ++automountServiceAccountToken: {{ .Values.startupapicheck.serviceAccount.automountServiceAccountToken }} ++metadata: ++ name: {{ template "startupapicheck.serviceAccountName" . }} ++ namespace: {{ .Release.Namespace | quote }} ++ {{- if .Values.startupapicheck.serviceAccount.annotations }} ++ annotations: ++{{ toYaml .Values.startupapicheck.serviceAccount.annotations | indent 4 }} ++ {{- end }} ++ labels: ++ app: {{ include "startupapicheck.name" . }} ++ app.kubernetes.io/name: {{ include "startupapicheck.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "startupapicheck" ++ {{- include "labels" . | nindent 4 }} ++{{- if .Values.global.imagePullSecrets }} ++imagePullSecrets: {{ toYaml .Values.global.imagePullSecrets | nindent 2 }} ++{{- end }} ++{{- end -}} ++{{- end -}} +diff --git a/deploy-templates/cert-manager/templates/webhook-deployment.yaml b/deploy-templates/cert-manager/templates/webhook-deployment.yaml +new file mode 100644 +index 0000000..ef9ed02 +--- /dev/null ++++ b/deploy-templates/cert-manager/templates/webhook-deployment.yaml +@@ -0,0 +1,117 @@ ++apiVersion: apps/v1 ++kind: Deployment ++metadata: ++ name: {{ include "webhook.fullname" . }} ++ namespace: {{ .Release.Namespace | quote }} ++ labels: ++ app: {{ include "webhook.name" . }} ++ app.kubernetes.io/name: {{ include "webhook.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "webhook" ++ {{- include "labels" . | nindent 4 }} ++ {{- if .Values.webhook.deploymentAnnotations }} ++ annotations: ++{{ toYaml .Values.webhook.deploymentAnnotations | indent 4 }} ++ {{- end }} ++spec: ++ replicas: {{ .Values.webhook.replicaCount }} ++ selector: ++ matchLabels: ++ app.kubernetes.io/name: {{ include "webhook.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "webhook" ++ {{- with .Values.webhook.strategy }} ++ strategy: ++ {{- . | toYaml | nindent 4 }} ++ {{- end }} ++ template: ++ metadata: ++ labels: ++ app: {{ include "webhook.name" . }} ++ app.kubernetes.io/name: {{ include "webhook.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "webhook" ++ {{- include "labels" . | nindent 8 }} ++{{- if .Values.webhook.podLabels }} ++{{ toYaml .Values.webhook.podLabels | indent 8 }} ++{{- end }} ++ {{- if .Values.webhook.podAnnotations }} ++ annotations: ++{{ toYaml .Values.webhook.podAnnotations | indent 8 }} ++ {{- end }} ++ spec: ++ serviceAccountName: {{ template "webhook.serviceAccountName" . }} ++ {{- if .Values.global.priorityClassName }} ++ priorityClassName: {{ .Values.global.priorityClassName | quote }} ++ {{- end }} ++ {{- if .Values.webhook.securityContext}} ++ securityContext: ++{{ toYaml .Values.webhook.securityContext | indent 8 }} ++ {{- end }} ++ {{- if .Values.webhook.hostNetwork }} ++ hostNetwork: true ++ {{- end }} ++ containers: ++ - name: {{ .Chart.Name }} ++ {{- with .Values.webhook.image }} ++ image: "{{- if .registry -}}{{ .registry }}/{{- end -}}{{ .repository }}{{- if (.digest) -}} @{{.digest}}{{- else -}}:{{ default $.Chart.AppVersion .tag }} {{- end -}}" ++ {{- end }} ++ imagePullPolicy: {{ .Values.webhook.image.pullPolicy }} ++ args: ++ {{- if .Values.global.logLevel }} ++ - --v={{ .Values.global.logLevel }} ++ {{- end }} ++ - --secure-port={{ .Values.webhook.securePort }} ++ - --dynamic-serving-ca-secret-namespace=$(POD_NAMESPACE) ++ - --dynamic-serving-ca-secret-name={{ template "webhook.fullname" . }}-ca ++ - --dynamic-serving-dns-names={{ template "webhook.fullname" . }},{{ template "webhook.fullname" . }}.{{ .Release.Namespace }},{{ template "webhook.fullname" . }}.{{ .Release.Namespace }}.svc{{ if .Values.webhook.url.host }},{{ .Values.webhook.url.host }}{{ end }} ++ {{- if .Values.webhook.extraArgs }} ++{{ toYaml .Values.webhook.extraArgs | indent 10 }} ++ {{- end }} ++ ports: ++ - name: https ++ protocol: TCP ++ containerPort: {{ .Values.webhook.securePort }} ++ livenessProbe: ++ httpGet: ++ path: /livez ++ port: 6080 ++ scheme: HTTP ++ initialDelaySeconds: {{ .Values.webhook.livenessProbe.initialDelaySeconds }} ++ periodSeconds: {{ .Values.webhook.livenessProbe.periodSeconds }} ++ timeoutSeconds: {{ .Values.webhook.livenessProbe.timeoutSeconds }} ++ successThreshold: {{ .Values.webhook.livenessProbe.successThreshold }} ++ failureThreshold: {{ .Values.webhook.livenessProbe.failureThreshold }} ++ readinessProbe: ++ httpGet: ++ path: /healthz ++ port: 6080 ++ scheme: HTTP ++ initialDelaySeconds: {{ .Values.webhook.readinessProbe.initialDelaySeconds }} ++ periodSeconds: {{ .Values.webhook.readinessProbe.periodSeconds }} ++ timeoutSeconds: {{ .Values.webhook.readinessProbe.timeoutSeconds }} ++ successThreshold: {{ .Values.webhook.readinessProbe.successThreshold }} ++ failureThreshold: {{ .Values.webhook.readinessProbe.failureThreshold }} ++ {{- if .Values.webhook.containerSecurityContext }} ++ securityContext: ++ {{- toYaml .Values.webhook.containerSecurityContext | nindent 12 }} ++ {{- end }} ++ env: ++ - name: POD_NAMESPACE ++ valueFrom: ++ fieldRef: ++ fieldPath: metadata.namespace ++ resources: ++{{ toYaml .Values.webhook.resources | indent 12 }} ++ {{- with .Values.webhook.nodeSelector }} ++ nodeSelector: ++{{ toYaml . | indent 8 }} ++ {{- end }} ++ {{- with .Values.webhook.affinity }} ++ affinity: ++{{ toYaml . | indent 8 }} ++ {{- end }} ++ {{- with .Values.webhook.tolerations }} ++ tolerations: ++{{ toYaml . | indent 8 }} ++ {{- end }} +diff --git a/deploy-templates/cert-manager/templates/webhook-mutating-webhook.yaml b/deploy-templates/cert-manager/templates/webhook-mutating-webhook.yaml +new file mode 100644 +index 0000000..5c5d6c6 +--- /dev/null ++++ b/deploy-templates/cert-manager/templates/webhook-mutating-webhook.yaml +@@ -0,0 +1,54 @@ ++apiVersion: admissionregistration.k8s.io/v1 ++kind: MutatingWebhookConfiguration ++metadata: ++ name: {{ include "webhook.fullname" . }} ++ labels: ++ app: {{ include "webhook.name" . }} ++ app.kubernetes.io/name: {{ include "webhook.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "webhook" ++ {{- include "labels" . | nindent 4 }} ++ annotations: ++ cert-manager.io/inject-ca-from-secret: "{{ .Release.Namespace }}/{{ template "webhook.fullname" . }}-ca" ++ {{- if .Values.webhook.mutatingWebhookConfigurationAnnotations }} ++{{ toYaml .Values.webhook.mutatingWebhookConfigurationAnnotations | indent 4 }} ++ {{- end }} ++webhooks: ++ - name: webhook.cert-manager.io ++ rules: ++ - apiGroups: ++ - "cert-manager.io" ++ - "acme.cert-manager.io" ++ apiVersions: ++ - "v1" ++ operations: ++ - CREATE ++ - UPDATE ++ resources: ++ - "*/*" ++ # We don't actually support `v1beta1` but is listed here as it is a ++ # required value for ++ # [Kubernetes v1.16](https://github.com/kubernetes/kubernetes/issues/82025). ++ # The API server reads the supported versions in order, so _should always_ ++ # attempt a `v1` request which is understood by the cert-manager webhook. ++ # Any `v1beta1` request will return an error and fail closed for that ++ # resource (the whole object request is rejected). When we no longer ++ # support v1.16 we can remove `v1beta1` from this list. ++ admissionReviewVersions: ["v1", "v1beta1"] ++ # This webhook only accepts v1 cert-manager resources. ++ # Equivalent matchPolicy ensures that non-v1 resource requests are sent to ++ # this webhook (after the resources have been converted to v1). ++ matchPolicy: Equivalent ++ timeoutSeconds: {{ .Values.webhook.timeoutSeconds }} ++ failurePolicy: Fail ++ # Only include 'sideEffects' field in Kubernetes 1.12+ ++ sideEffects: None ++ clientConfig: ++ {{- if .Values.webhook.url.host }} ++ url: https://{{ .Values.webhook.url.host }}/mutate ++ {{- else }} ++ service: ++ name: {{ template "webhook.fullname" . }} ++ namespace: {{ .Release.Namespace | quote }} ++ path: /mutate ++ {{- end }} +diff --git a/deploy-templates/cert-manager/templates/webhook-psp-clusterrole.yaml b/deploy-templates/cert-manager/templates/webhook-psp-clusterrole.yaml +new file mode 100644 +index 0000000..2a8808e +--- /dev/null ++++ b/deploy-templates/cert-manager/templates/webhook-psp-clusterrole.yaml +@@ -0,0 +1,18 @@ ++{{- if .Values.global.podSecurityPolicy.enabled }} ++kind: ClusterRole ++apiVersion: rbac.authorization.k8s.io/v1 ++metadata: ++ name: {{ template "webhook.fullname" . }}-psp ++ labels: ++ app: {{ include "webhook.name" . }} ++ app.kubernetes.io/name: {{ include "webhook.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "webhook" ++ {{- include "labels" . | nindent 4 }} ++rules: ++- apiGroups: ['policy'] ++ resources: ['podsecuritypolicies'] ++ verbs: ['use'] ++ resourceNames: ++ - {{ template "webhook.fullname" . }} ++{{- end }} +diff --git a/deploy-templates/cert-manager/templates/webhook-psp-clusterrolebinding.yaml b/deploy-templates/cert-manager/templates/webhook-psp-clusterrolebinding.yaml +new file mode 100644 +index 0000000..e8e1bb2 +--- /dev/null ++++ b/deploy-templates/cert-manager/templates/webhook-psp-clusterrolebinding.yaml +@@ -0,0 +1,20 @@ ++{{- if .Values.global.podSecurityPolicy.enabled }} ++apiVersion: rbac.authorization.k8s.io/v1 ++kind: ClusterRoleBinding ++metadata: ++ name: {{ template "webhook.fullname" . }}-psp ++ labels: ++ app: {{ include "webhook.name" . }} ++ app.kubernetes.io/name: {{ include "webhook.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "webhook" ++ {{- include "labels" . | nindent 4 }} ++roleRef: ++ apiGroup: rbac.authorization.k8s.io ++ kind: ClusterRole ++ name: {{ template "webhook.fullname" . }}-psp ++subjects: ++ - kind: ServiceAccount ++ name: {{ template "webhook.serviceAccountName" . }} ++ namespace: {{ .Release.Namespace }} ++{{- end }} +diff --git a/deploy-templates/cert-manager/templates/webhook-psp.yaml b/deploy-templates/cert-manager/templates/webhook-psp.yaml +new file mode 100644 +index 0000000..5a2bb6b +--- /dev/null ++++ b/deploy-templates/cert-manager/templates/webhook-psp.yaml +@@ -0,0 +1,54 @@ ++{{- if .Values.global.podSecurityPolicy.enabled }} ++apiVersion: policy/v1beta1 ++kind: PodSecurityPolicy ++metadata: ++ name: {{ template "webhook.fullname" . }} ++ labels: ++ app: {{ include "webhook.name" . }} ++ app.kubernetes.io/name: {{ include "webhook.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "webhook" ++ {{- include "labels" . | nindent 4 }} ++ annotations: ++ seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default' ++ seccomp.security.alpha.kubernetes.io/defaultProfileName: 'docker/default' ++ {{- if .Values.global.podSecurityPolicy.useAppArmor }} ++ apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default' ++ apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default' ++ {{- end }} ++spec: ++ privileged: false ++ allowPrivilegeEscalation: false ++ allowedCapabilities: [] # default set of capabilities are implicitly allowed ++ volumes: ++ - 'configMap' ++ - 'emptyDir' ++ - 'projected' ++ - 'secret' ++ - 'downwardAPI' ++ hostNetwork: {{ .Values.webhook.hostNetwork }} ++ {{ if .Values.webhook.hostNetwork }} ++ hostPorts: ++ - max: {{ .Values.webhook.securePort }} ++ min: {{ .Values.webhook.securePort }} ++ {{ end }} ++ hostIPC: false ++ hostPID: false ++ runAsUser: ++ rule: 'MustRunAs' ++ ranges: ++ - min: 1000 ++ max: 1000 ++ seLinux: ++ rule: 'RunAsAny' ++ supplementalGroups: ++ rule: 'MustRunAs' ++ ranges: ++ - min: 1000 ++ max: 1000 ++ fsGroup: ++ rule: 'MustRunAs' ++ ranges: ++ - min: 1000 ++ max: 1000 ++{{- end }} +diff --git a/deploy-templates/cert-manager/templates/webhook-rbac.yaml b/deploy-templates/cert-manager/templates/webhook-rbac.yaml +new file mode 100644 +index 0000000..66ecb4f +--- /dev/null ++++ b/deploy-templates/cert-manager/templates/webhook-rbac.yaml +@@ -0,0 +1,83 @@ ++{{- if .Values.global.rbac.create -}} ++apiVersion: rbac.authorization.k8s.io/v1 ++kind: Role ++metadata: ++ name: {{ template "webhook.fullname" . }}:dynamic-serving ++ namespace: {{ .Release.Namespace | quote }} ++ labels: ++ app: {{ include "webhook.name" . }} ++ app.kubernetes.io/name: {{ include "webhook.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "webhook" ++ {{- include "labels" . | nindent 4 }} ++rules: ++- apiGroups: [""] ++ resources: ["secrets"] ++ resourceNames: ++ - '{{ template "webhook.fullname" . }}-ca' ++ verbs: ["get", "list", "watch", "update"] ++# It's not possible to grant CREATE permission on a single resourceName. ++- apiGroups: [""] ++ resources: ["secrets"] ++ verbs: ["create"] ++--- ++ ++apiVersion: rbac.authorization.k8s.io/v1 ++kind: RoleBinding ++metadata: ++ name: {{ template "webhook.fullname" . }}:dynamic-serving ++ namespace: {{ .Release.Namespace | quote }} ++ labels: ++ app: {{ include "webhook.name" . }} ++ app.kubernetes.io/name: {{ include "webhook.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "webhook" ++ {{- include "labels" . | nindent 4 }} ++roleRef: ++ apiGroup: rbac.authorization.k8s.io ++ kind: Role ++ name: {{ template "webhook.fullname" . }}:dynamic-serving ++subjects: ++- apiGroup: "" ++ kind: ServiceAccount ++ name: {{ template "webhook.serviceAccountName" . }} ++ namespace: {{ .Release.Namespace }} ++ ++--- ++ ++apiVersion: rbac.authorization.k8s.io/v1 ++kind: ClusterRole ++metadata: ++ name: {{ template "webhook.fullname" . }}:subjectaccessreviews ++ labels: ++ app: {{ include "webhook.name" . }} ++ app.kubernetes.io/name: {{ include "webhook.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "webhook" ++ {{- include "labels" . | nindent 4 }} ++rules: ++- apiGroups: ["authorization.k8s.io"] ++ resources: ["subjectaccessreviews"] ++ verbs: ["create"] ++--- ++ ++apiVersion: rbac.authorization.k8s.io/v1 ++kind: ClusterRoleBinding ++metadata: ++ name: {{ template "webhook.fullname" . }}:subjectaccessreviews ++ labels: ++ app: {{ include "webhook.name" . }} ++ app.kubernetes.io/name: {{ include "webhook.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "webhook" ++ {{- include "labels" . | nindent 4 }} ++roleRef: ++ apiGroup: rbac.authorization.k8s.io ++ kind: ClusterRole ++ name: {{ template "webhook.fullname" . }}:subjectaccessreviews ++subjects: ++- apiGroup: "" ++ kind: ServiceAccount ++ name: {{ template "webhook.serviceAccountName" . }} ++ namespace: {{ .Release.Namespace }} ++{{- end -}} +diff --git a/deploy-templates/cert-manager/templates/webhook-service.yaml b/deploy-templates/cert-manager/templates/webhook-service.yaml +new file mode 100644 +index 0000000..b14ff9e +--- /dev/null ++++ b/deploy-templates/cert-manager/templates/webhook-service.yaml +@@ -0,0 +1,32 @@ ++apiVersion: v1 ++kind: Service ++metadata: ++ name: {{ template "webhook.fullname" . }} ++ namespace: {{ .Release.Namespace | quote }} ++ labels: ++ app: {{ include "webhook.name" . }} ++ app.kubernetes.io/name: {{ include "webhook.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "webhook" ++ {{- include "labels" . | nindent 4 }} ++{{- if .Values.webhook.serviceLabels }} ++{{ toYaml .Values.webhook.serviceLabels | indent 4 }} ++{{- end }} ++{{- if .Values.webhook.serviceAnnotations }} ++ annotations: ++ {{ toYaml .Values.webhook.serviceAnnotations | indent 4 }} ++{{- end }} ++spec: ++ type: {{ .Values.webhook.serviceType }} ++ {{- if .Values.webhook.loadBalancerIP }} ++ loadBalancerIP: {{ .Values.webhook.loadBalancerIP }} ++ {{- end }} ++ ports: ++ - name: https ++ port: 443 ++ protocol: TCP ++ targetPort: {{ .Values.webhook.securePort }} ++ selector: ++ app.kubernetes.io/name: {{ include "webhook.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "webhook" +diff --git a/deploy-templates/cert-manager/templates/webhook-serviceaccount.yaml b/deploy-templates/cert-manager/templates/webhook-serviceaccount.yaml +new file mode 100644 +index 0000000..f5db521 +--- /dev/null ++++ b/deploy-templates/cert-manager/templates/webhook-serviceaccount.yaml +@@ -0,0 +1,21 @@ ++{{- if .Values.webhook.serviceAccount.create -}} ++apiVersion: v1 ++kind: ServiceAccount ++automountServiceAccountToken: {{ .Values.webhook.serviceAccount.automountServiceAccountToken }} ++metadata: ++ name: {{ template "webhook.serviceAccountName" . }} ++ namespace: {{ .Release.Namespace | quote }} ++ {{- if .Values.webhook.serviceAccount.annotations }} ++ annotations: ++{{ toYaml .Values.webhook.serviceAccount.annotations | indent 4 }} ++ {{- end }} ++ labels: ++ app: {{ include "webhook.name" . }} ++ app.kubernetes.io/name: {{ include "webhook.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "webhook" ++ {{- include "labels" . | nindent 4 }} ++{{- if .Values.global.imagePullSecrets }} ++imagePullSecrets: {{ toYaml .Values.global.imagePullSecrets | nindent 2 }} ++{{- end -}} ++{{- end -}} +diff --git a/deploy-templates/cert-manager/templates/webhook-validating-webhook.yaml b/deploy-templates/cert-manager/templates/webhook-validating-webhook.yaml +new file mode 100644 +index 0000000..a5c14ae +--- /dev/null ++++ b/deploy-templates/cert-manager/templates/webhook-validating-webhook.yaml +@@ -0,0 +1,63 @@ ++apiVersion: admissionregistration.k8s.io/v1 ++kind: ValidatingWebhookConfiguration ++metadata: ++ name: {{ include "webhook.fullname" . }} ++ labels: ++ app: {{ include "webhook.name" . }} ++ app.kubernetes.io/name: {{ include "webhook.name" . }} ++ app.kubernetes.io/instance: {{ .Release.Name }} ++ app.kubernetes.io/component: "webhook" ++ {{- include "labels" . | nindent 4 }} ++ annotations: ++ cert-manager.io/inject-ca-from-secret: "{{ .Release.Namespace }}/{{ template "webhook.fullname" . }}-ca" ++ {{- if .Values.webhook.validatingWebhookConfigurationAnnotations }} ++{{ toYaml .Values.webhook.validatingWebhookConfigurationAnnotations | indent 4 }} ++ {{- end }} ++webhooks: ++ - name: webhook.cert-manager.io ++ namespaceSelector: ++ matchExpressions: ++ - key: "cert-manager.io/disable-validation" ++ operator: "NotIn" ++ values: ++ - "true" ++ - key: "name" ++ operator: "NotIn" ++ values: ++ - {{ .Release.Namespace }} ++ rules: ++ - apiGroups: ++ - "cert-manager.io" ++ - "acme.cert-manager.io" ++ apiVersions: ++ - "v1" ++ operations: ++ - CREATE ++ - UPDATE ++ resources: ++ - "*/*" ++ # We don't actually support `v1beta1` but is listed here as it is a ++ # required value for ++ # [Kubernetes v1.16](https://github.com/kubernetes/kubernetes/issues/82025). ++ # The API server reads the supported versions in order, so _should always_ ++ # attempt a `v1` request which is understood by the cert-manager webhook. ++ # Any `v1beta1` request will return an error and fail closed for that ++ # resource (the whole object request is rejected). When we no longer ++ # support v1.16 we can remove `v1beta1` from this list. ++ admissionReviewVersions: ["v1", "v1beta1"] ++ # This webhook only accepts v1 cert-manager resources. ++ # Equivalent matchPolicy ensures that non-v1 resource requests are sent to ++ # this webhook (after the resources have been converted to v1). ++ matchPolicy: Equivalent ++ timeoutSeconds: {{ .Values.webhook.timeoutSeconds }} ++ failurePolicy: Fail ++ sideEffects: None ++ clientConfig: ++ {{- if .Values.webhook.url.host }} ++ url: https://{{ .Values.webhook.url.host }}/validate ++ {{- else }} ++ service: ++ name: {{ template "webhook.fullname" . }} ++ namespace: {{ .Release.Namespace | quote }} ++ path: /validate ++ {{- end }} +diff --git a/deploy-templates/cert-manager/values.yaml b/deploy-templates/cert-manager/values.yaml +new file mode 100644 +index 0000000..d800d48 +--- /dev/null ++++ b/deploy-templates/cert-manager/values.yaml +@@ -0,0 +1,493 @@ ++# Default values for cert-manager. ++# This is a YAML-formatted file. ++# Declare variables to be passed into your templates. ++global: ++ ## Reference to one or more secrets to be used when pulling images ++ ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ ++ ## ++ imagePullSecrets: [] ++ # - name: "image-pull-secret" ++ ++ # Optional priority class to be used for the cert-manager pods ++ priorityClassName: "" ++ rbac: ++ create: true ++ ++ podSecurityPolicy: ++ enabled: false ++ useAppArmor: true ++ ++ # Set the verbosity of cert-manager. Range of 0 - 6 with 6 being the most verbose. ++ logLevel: 2 ++ ++ leaderElection: ++ # Override the namespace used to store the ConfigMap for leader election ++ namespace: "kube-system" ++ ++ # The duration that non-leader candidates will wait after observing a ++ # leadership renewal until attempting to acquire leadership of a led but ++ # unrenewed leader slot. This is effectively the maximum duration that a ++ # leader can be stopped before it is replaced by another candidate. ++ # leaseDuration: 60s ++ ++ # The interval between attempts by the acting master to renew a leadership ++ # slot before it stops leading. This must be less than or equal to the ++ # lease duration. ++ # renewDeadline: 40s ++ ++ # The duration the clients should wait between attempting acquisition and ++ # renewal of a leadership. ++ # retryPeriod: 15s ++ ++installCRDs: false ++ ++replicaCount: 1 ++ ++strategy: {} ++ # type: RollingUpdate ++ # rollingUpdate: ++ # maxSurge: 0 ++ # maxUnavailable: 1 ++ ++# Comma separated list of feature gates that should be enabled on the ++# controller pod. ++featureGates: "" ++ ++image: ++ repository: quay.io/jetstack/cert-manager-controller ++ # You can manage a registry with ++ # registry: quay.io ++ # repository: jetstack/cert-manager-controller ++ ++ # Override the image tag to deploy by setting this variable. ++ # If no value is set, the chart's appVersion will be used. ++ # tag: canary ++ ++ # Setting a digest will override any tag ++ # digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20 ++ pullPolicy: IfNotPresent ++ ++# Override the namespace used to store DNS provider credentials etc. for ClusterIssuer ++# resources. By default, the same namespace as cert-manager is deployed within is ++# used. This namespace will not be automatically created by the Helm chart. ++clusterResourceNamespace: "" ++ ++serviceAccount: ++ # Specifies whether a service account should be created ++ create: true ++ # The name of the service account to use. ++ # If not set and create is true, a name is generated using the fullname template ++ # name: "" ++ # Optional additional annotations to add to the controller's ServiceAccount ++ # annotations: {} ++ # Automount API credentials for a Service Account. ++ automountServiceAccountToken: true ++ ++# Optional additional arguments ++extraArgs: [] ++ # Use this flag to set a namespace that cert-manager will use to store ++ # supporting resources required for each ClusterIssuer (default is kube-system) ++ # - --cluster-resource-namespace=kube-system ++ # When this flag is enabled, secrets will be automatically removed when the certificate resource is deleted ++ # - --enable-certificate-owner-ref=true ++ # Use this flag to enabled or disable arbitrary controllers, for example, disable the CertificiateRequests approver ++ # - --controllers=*,-certificaterequests-approver ++ ++extraEnv: [] ++# - name: SOME_VAR ++# value: 'some value' ++ ++resources: {} ++ # requests: ++ # cpu: 10m ++ # memory: 32Mi ++ ++# Pod Security Context ++# ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ ++securityContext: ++ runAsNonRoot: true ++# legacy securityContext parameter format: if enabled is set to true, only fsGroup and runAsUser are supported ++# securityContext: ++# enabled: false ++# fsGroup: 1001 ++# runAsUser: 1001 ++# to support additional securityContext parameters, omit the `enabled` parameter and simply specify the parameters ++# you want to set, e.g. ++# securityContext: ++# fsGroup: 1000 ++# runAsUser: 1000 ++# runAsNonRoot: true ++ ++# Container Security Context to be set on the controller component container ++# ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ ++containerSecurityContext: {} ++ # capabilities: ++ # drop: ++ # - ALL ++ # readOnlyRootFilesystem: true ++ # runAsNonRoot: true ++ ++ ++volumes: [] ++ ++volumeMounts: [] ++ ++# Optional additional annotations to add to the controller Deployment ++# deploymentAnnotations: {} ++ ++# Optional additional annotations to add to the controller Pods ++# podAnnotations: {} ++ ++podLabels: {} ++ ++# Optional additional labels to add to the controller Service ++# serviceLabels: {} ++ ++# Optional additional annotations to add to the controller service ++# serviceAnnotations: {} ++ ++# Optional DNS settings, useful if you have a public and private DNS zone for ++# the same domain on Route 53. What follows is an example of ensuring ++# cert-manager can access an ingress or DNS TXT records at all times. ++# NOTE: This requires Kubernetes 1.10 or `CustomPodDNS` feature gate enabled for ++# the cluster to work. ++# podDnsPolicy: "None" ++# podDnsConfig: ++# nameservers: ++# - "1.1.1.1" ++# - "8.8.8.8" ++ ++nodeSelector: {} ++ ++ingressShim: {} ++ # defaultIssuerName: "" ++ # defaultIssuerKind: "" ++ # defaultIssuerGroup: "" ++ ++prometheus: ++ enabled: true ++ servicemonitor: ++ enabled: false ++ prometheusInstance: default ++ targetPort: 9402 ++ path: /metrics ++ interval: 60s ++ scrapeTimeout: 30s ++ labels: {} ++ ++# Use these variables to configure the HTTP_PROXY environment variables ++# http_proxy: "http://proxy:8080" ++# https_proxy: "https://proxy:8080" ++# no_proxy: 127.0.0.1,localhost ++ ++# expects input structure as per specification https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.11/#affinity-v1-core ++# for example: ++# affinity: ++# nodeAffinity: ++# requiredDuringSchedulingIgnoredDuringExecution: ++# nodeSelectorTerms: ++# - matchExpressions: ++# - key: foo.bar.com/role ++# operator: In ++# values: ++# - master ++affinity: {} ++ ++# expects input structure as per specification https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.11/#toleration-v1-core ++# for example: ++# tolerations: ++# - key: foo.bar.com/role ++# operator: Equal ++# value: master ++# effect: NoSchedule ++tolerations: [] ++ ++webhook: ++ replicaCount: 1 ++ timeoutSeconds: 10 ++ ++ strategy: {} ++ # type: RollingUpdate ++ # rollingUpdate: ++ # maxSurge: 0 ++ # maxUnavailable: 1 ++ ++ # Pod Security Context to be set on the webhook component Pod ++ # ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ ++ securityContext: ++ runAsNonRoot: true ++ ++ # Container Security Context to be set on the webhook component container ++ # ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ ++ containerSecurityContext: {} ++ # capabilities: ++ # drop: ++ # - ALL ++ # readOnlyRootFilesystem: true ++ # runAsNonRoot: true ++ ++ # Optional additional annotations to add to the webhook Deployment ++ # deploymentAnnotations: {} ++ ++ # Optional additional annotations to add to the webhook Pods ++ # podAnnotations: {} ++ ++ # Optional additional annotations to add to the webhook MutatingWebhookConfiguration ++ # mutatingWebhookConfigurationAnnotations: {} ++ ++ # Optional additional annotations to add to the webhook ValidatingWebhookConfiguration ++ # validatingWebhookConfigurationAnnotations: {} ++ ++ # Optional additional annotations to add to the webhook service ++ # serviceAnnotations: {} ++ ++ # Optional additional arguments for webhook ++ extraArgs: [] ++ ++ resources: {} ++ # requests: ++ # cpu: 10m ++ # memory: 32Mi ++ ++ ## Liveness and readiness probe values ++ ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes ++ ## ++ livenessProbe: ++ failureThreshold: 3 ++ initialDelaySeconds: 60 ++ periodSeconds: 10 ++ successThreshold: 1 ++ timeoutSeconds: 1 ++ readinessProbe: ++ failureThreshold: 3 ++ initialDelaySeconds: 5 ++ periodSeconds: 5 ++ successThreshold: 1 ++ timeoutSeconds: 1 ++ ++ nodeSelector: {} ++ ++ affinity: {} ++ ++ tolerations: [] ++ ++ # Optional additional labels to add to the Webhook Pods ++ podLabels: {} ++ ++ # Optional additional labels to add to the Webhook Service ++ serviceLabels: {} ++ ++ image: ++ repository: quay.io/jetstack/cert-manager-webhook ++ # You can manage a registry with ++ # registry: quay.io ++ # repository: jetstack/cert-manager-webhook ++ ++ # Override the image tag to deploy by setting this variable. ++ # If no value is set, the chart's appVersion will be used. ++ # tag: canary ++ ++ # Setting a digest will override any tag ++ # digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20 ++ ++ pullPolicy: IfNotPresent ++ ++ serviceAccount: ++ # Specifies whether a service account should be created ++ create: true ++ # The name of the service account to use. ++ # If not set and create is true, a name is generated using the fullname template ++ # name: "" ++ # Optional additional annotations to add to the controller's ServiceAccount ++ # annotations: {} ++ # Automount API credentials for a Service Account. ++ automountServiceAccountToken: true ++ ++ # The port that the webhook should listen on for requests. ++ # In GKE private clusters, by default kubernetes apiservers are allowed to ++ # talk to the cluster nodes only on 443 and 10250. so configuring ++ # securePort: 10250, will work out of the box without needing to add firewall ++ # rules or requiring NET_BIND_SERVICE capabilities to bind port numbers <1000 ++ securePort: 10250 ++ ++ # Specifies if the webhook should be started in hostNetwork mode. ++ # ++ # Required for use in some managed kubernetes clusters (such as AWS EKS) with custom ++ # CNI (such as calico), because control-plane managed by AWS cannot communicate ++ # with pods' IP CIDR and admission webhooks are not working ++ # ++ # Since the default port for the webhook conflicts with kubelet on the host ++ # network, `webhook.securePort` should be changed to an available port if ++ # running in hostNetwork mode. ++ hostNetwork: false ++ ++ # Specifies how the service should be handled. Useful if you want to expose the ++ # webhook to outside of the cluster. In some cases, the control plane cannot ++ # reach internal services. ++ serviceType: ClusterIP ++ # loadBalancerIP: ++ ++ # Overrides the mutating webhook and validating webhook so they reach the webhook ++ # service using the `url` field instead of a service. ++ url: {} ++ # host: ++ ++cainjector: ++ enabled: true ++ replicaCount: 1 ++ ++ strategy: {} ++ # type: RollingUpdate ++ # rollingUpdate: ++ # maxSurge: 0 ++ # maxUnavailable: 1 ++ ++ # Pod Security Context to be set on the cainjector component Pod ++ # ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ ++ securityContext: ++ runAsNonRoot: true ++ ++ # Container Security Context to be set on the cainjector component container ++ # ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ ++ containerSecurityContext: {} ++ # capabilities: ++ # drop: ++ # - ALL ++ # readOnlyRootFilesystem: true ++ # runAsNonRoot: true ++ ++ ++ # Optional additional annotations to add to the cainjector Deployment ++ # deploymentAnnotations: {} ++ ++ # Optional additional annotations to add to the cainjector Pods ++ # podAnnotations: {} ++ ++ # Optional additional arguments for cainjector ++ extraArgs: [] ++ ++ resources: {} ++ # requests: ++ # cpu: 10m ++ # memory: 32Mi ++ ++ nodeSelector: {} ++ ++ affinity: {} ++ ++ tolerations: [] ++ ++ # Optional additional labels to add to the CA Injector Pods ++ podLabels: {} ++ ++ image: ++ repository: quay.io/jetstack/cert-manager-cainjector ++ # You can manage a registry with ++ # registry: quay.io ++ # repository: jetstack/cert-manager-cainjector ++ ++ # Override the image tag to deploy by setting this variable. ++ # If no value is set, the chart's appVersion will be used. ++ # tag: canary ++ ++ # Setting a digest will override any tag ++ # digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20 ++ ++ pullPolicy: IfNotPresent ++ ++ serviceAccount: ++ # Specifies whether a service account should be created ++ create: true ++ # The name of the service account to use. ++ # If not set and create is true, a name is generated using the fullname template ++ # name: "" ++ # Optional additional annotations to add to the controller's ServiceAccount ++ # annotations: {} ++ # Automount API credentials for a Service Account. ++ automountServiceAccountToken: true ++ ++# This startupapicheck is a Helm post-install hook that waits for the webhook ++# endpoints to become available. ++# The check is implemented using a Kubernetes Job- if you are injecting mesh ++# sidecar proxies into cert-manager pods, you probably want to ensure that they ++# are not injected into this Job's pod. Otherwise the installation may time out ++# due to the Job never being completed because the sidecar proxy does not exit. ++# See https://github.com/jetstack/cert-manager/pull/4414 for context. ++startupapicheck: ++ enabled: true ++ ++ # Pod Security Context to be set on the startupapicheck component Pod ++ # ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ ++ securityContext: ++ runAsNonRoot: true ++ ++ # Timeout for 'kubectl check api' command ++ timeout: 1m ++ ++ # Job backoffLimit ++ backoffLimit: 4 ++ ++ # Optional additional annotations to add to the startupapicheck Job ++ jobAnnotations: ++ helm.sh/hook: post-install ++ helm.sh/hook-weight: "1" ++ helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded ++ ++ # Optional additional annotations to add to the startupapicheck Pods ++ # podAnnotations: {} ++ ++ # Optional additional arguments for startupapicheck ++ extraArgs: [] ++ ++ resources: {} ++ # requests: ++ # cpu: 10m ++ # memory: 32Mi ++ ++ nodeSelector: {} ++ ++ affinity: {} ++ ++ tolerations: [] ++ ++ # Optional additional labels to add to the startupapicheck Pods ++ podLabels: {} ++ ++ image: ++ repository: quay.io/jetstack/cert-manager-ctl ++ # You can manage a registry with ++ # registry: quay.io ++ # repository: jetstack/cert-manager-ctl ++ ++ # Override the image tag to deploy by setting this variable. ++ # If no value is set, the chart's appVersion will be used. ++ # tag: canary ++ ++ # Setting a digest will override any tag ++ # digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20 ++ ++ pullPolicy: IfNotPresent ++ ++ rbac: ++ # annotations for the startup API Check job RBAC and PSP resources ++ annotations: ++ helm.sh/hook: post-install ++ helm.sh/hook-weight: "-5" ++ helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded ++ ++ serviceAccount: ++ # Specifies whether a service account should be created ++ create: true ++ ++ # The name of the service account to use. ++ # If not set and create is true, a name is generated using the fullname template ++ # name: "" ++ ++ # Optional additional annotations to add to the Job's ServiceAccount ++ annotations: ++ helm.sh/hook: post-install ++ helm.sh/hook-weight: "-5" ++ helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded ++ ++ # Automount API credentials for a Service Account. ++ automountServiceAccountToken: true +diff --git a/deploy-templates/helmfile.yaml b/deploy-templates/helmfile.yaml +index 91d9a98..0b5656b 100644 +--- a/deploy-templates/helmfile.yaml ++++ b/deploy-templates/helmfile.yaml +@@ -37,6 +37,14 @@ + command: "oc" + args: [ "adm", "policy", "remove-scc-from-user", "anyuid", "system:serviceaccount:{{`{{ .Release.Namespace }}`}}:kiali-operator" ] + ++ - name: cert-manager ++ namespace: cert-manager ++ missingFileHandler: Warn ++ chart: cert-manager ++ values: ++ - "values.yaml" ++ - "values.gotmpl" ++ + - name: jaeger-operator + namespace: istio-system + missingFileHandler: Warn +@@ -47,6 +55,7 @@ + needs: + - istio-operator/istio-operator + - istio-system/kiali-operator ++ - cert-manager/cert-manager + + - name: istio-cni-cp + namespace: '{{ requiredEnv "globalEDPProject" }}' +diff --git a/deploy-templates/jaeger-operator/COMPATIBILITY.md b/deploy-templates/jaeger-operator/COMPATIBILITY.md +new file mode 100644 +index 0000000..18ea6b8 +--- /dev/null ++++ b/deploy-templates/jaeger-operator/COMPATIBILITY.md +@@ -0,0 +1,25 @@ ++The following table shows the compatibility of `Jaeger Operator helm chart` with different components, in this particular case we shows Jaeger Operator, Kubernetes and Strimzi operator compatibility. Cert-manager installed or certificate for webhook service in a secret is required in version 2.29.0+ of the helm chart. ++ ++| Chart version | Jaeger Operator | Kubernetes | Strimzi Operator | Cert-Manager | ++|---------------------------|-----------------|-----------------|--------------------|--------------| ++| 2.37.0 | v1.39.x | v1.19 to v1.24 | v0.23 | v1.6.1+ | ++| 2.36.0 | v1.38.x | v1.19 to v1.24 | v0.23 | v1.6.1+ | ++| 2.35.0 | v1.37.x | v1.19 to v1.24 | v0.23 | v1.6.1+ | ++| 2.34.0 | v1.36.x | v1.19 to v1.24 | v0.23 | v1.6.1+ | ++| 2.33.0 | v1.35.x | v1.19 to v1.24 | v0.23 | v1.6.1+ | ++| 2.32.0(C), 2.32.1, 2.32.2 | v1.34.x | v1.19 to v1.24 | v0.23 | v1.6.1+ | ++| (Missing) | v1.33.x | v1.19 to v1.23 | v0.23 | v1.6.1+ | ++| 2.30.0(C), 2.31.0(C) | v1.32.x | v1.19 to v1.21 | v0.23 | v1.6.1+ | ++| 2.29.0(C) | v1.31.x | v1.19 to v1.21 | v0.23 | v1.6.1+ | ++| 2.28.0 | v1.30.x | v1.19 to v1.21 | v0.23 | | ++| 2.27.1 | v1.29.x | v1.19 to v1.21 | v0.23 | | ++| 2.27.0 | v1.28.x | v1.19 to v1.21 | v0.23 | | ++| 2.26.0 | v1.27.x | v1.19 to v1.21 | v0.23 | | ++| (Missing) | v1.26.x | v1.19 to v1.21 | v0.23 | | ++| (Missing) | v1.25.x | v1.19 to v1.21 | v0.23 | | ++| 2.23.0, 2.24.0, 2.25.0 | v1.24.x | v1.19 to v1.21 | v0.23 | | ++| (Missing) | v1.23.x | v1.19 to v1.21 | v0.19, v0.20 | | ++| 2.21.* | v1.22.x | v1.18 to v1.20 | v0.19 | | ++Legend: ++- `(C)` Chart is corrupted. Please do not use it, see [link](https://github.com/jaegertracing/helm-charts/issues/351) and [link](https://github.com/jaegertracing/helm-charts/issues/373) ++- `(Missing)` Missing chart version for specified Jaeger Operator version +\ No newline at end of file +diff --git a/deploy-templates/jaeger-operator/Chart.yaml b/deploy-templates/jaeger-operator/Chart.yaml +index 49d55e8..b440df6 100644 +--- a/deploy-templates/jaeger-operator/Chart.yaml ++++ b/deploy-templates/jaeger-operator/Chart.yaml +@@ -1,5 +1,5 @@ + apiVersion: v1 +-appVersion: 1.24.0 ++appVersion: 1.39.0 + description: jaeger-operator Helm chart for Kubernetes + home: https://www.jaegertracing.io/ + icon: https://www.jaegertracing.io/img/jaeger-icon-reverse-color.svg +@@ -11,4 +11,4 @@ + name: jaeger-operator + sources: + - https://github.com/jaegertracing/jaeger-operator +-version: 2.23.0 ++version: 2.40.0 +diff --git a/deploy-templates/jaeger-operator/README.md b/deploy-templates/jaeger-operator/README.md +index 6966b6b..af0098b 100644 +--- a/deploy-templates/jaeger-operator/README.md ++++ b/deploy-templates/jaeger-operator/README.md +@@ -15,6 +15,11 @@ + ## Prerequisites + + - Kubernetes 1.19+ ++- Helm 3 ++- cert-manager 1.6.1+ installed, or certificate for webhook service in a secret ++ ++## Check compability matrix ++See the compatibility matrix [here](./COMPATIBILITY.md). + + ## Installing the Chart + +@@ -24,10 +29,10 @@ + $ helm repo add jaegertracing https://jaegertracing.github.io/helm-charts + ``` + +-To install the chart with the release name `my-release`: ++To install the chart with the release name `my-release` in `observability` namespace: + + ```console +-$ helm install --name my-release jaegertracing/jaeger-operator ++$ helm install my-release jaegertracing/jaeger-operator -n observability + ``` + + The command deploys jaeger-operator on the Kubernetes cluster in the default configuration. The [configuration](#configuration) section lists the parameters that can be configured during installation. +@@ -50,12 +55,13 @@ + + | Parameter | Description | Default | + | :---------------------- | :---------------------------------------------------------------------------------------------------------- | :------------------------------ | ++| `serviceExtraLabels` | Additional labels to jaeger-operator service | `{}` ++| `extraLabels` | Additional labels to jaeger-operator deployment | `{}` + | `image.repository` | Controller container image repository | `jaegertracing/jaeger-operator` | +-| `image.tag` | Controller container image tag | `1.24.0` | ++| `image.tag` | Controller container image tag | `1.39.0` | + | `image.pullPolicy` | Controller container image pull policy | `IfNotPresent` | + | `jaeger.create` | Jaeger instance will be created | `false` | + | `jaeger.spec` | Jaeger instance specification | `{}` | +-| `crd.install` | CustomResourceDefinition will be installed | `true` | + | `rbac.create` | All required roles and rolebindings will be created | `true` | + | `serviceAccount.create` | Service account to use | `true` | + | `rbac.pspEnabled` | Pod security policy for pod will be created and included in rbac role | `false` | +@@ -78,6 +84,13 @@ + --set rbac.create=false + ``` + ++To install the chart without creating the CRDs (any files under `chart/crds`) make use of the `--skip-crds` flag. For example, ++ ++```console ++$ helm install jaegertracing/jaeger-operator --name my-release \ ++ --skip-crds ++``` ++ + ## After the Helm Installation + + ### Creating a new Jaeger instance +diff --git a/deploy-templates/jaeger-operator/crds/crd.yaml b/deploy-templates/jaeger-operator/crds/crd.yaml +index 6376100..9d966e1 100644 +--- a/deploy-templates/jaeger-operator/crds/crd.yaml ++++ b/deploy-templates/jaeger-operator/crds/crd.yaml +@@ -6,7 +6,8 @@ + "helm.sh/hook": crd-install + "helm.sh/hook-delete-policy": "before-hook-creation" + labels: +- app: jaeger-operator ++ app.kubernetes.io/name: jaeger-operator ++ app.kubernetes.io/instance: jaeger-operator + spec: + group: jaegertracing.io + names: +@@ -16,19 +17,14562 @@ + singular: jaeger + scope: Namespaced + versions: +- - name: v1 +- served: true +- storage: true +- schema: +- openAPIV3Schema: +- type: object +- x-kubernetes-preserve-unknown-fields: true +- additionalPrinterColumns: +- - jsonPath: .status.phase +- description: Jaeger instance's status +- name: Status +- type: string +- - jsonPath: .status.version +- description: Jaeger Version +- name: Version +- type: string ++ - additionalPrinterColumns: ++ - description: Jaeger instance's status ++ jsonPath: .status.phase ++ name: Status ++ type: string ++ - description: Jaeger Version ++ jsonPath: .status.version ++ name: Version ++ type: string ++ - description: Jaeger deployment strategy ++ jsonPath: .spec.strategy ++ name: Strategy ++ type: string ++ - description: Jaeger storage type ++ jsonPath: .spec.storage.type ++ name: Storage ++ type: string ++ - jsonPath: .metadata.creationTimestamp ++ name: Age ++ type: date ++ name: v1 ++ schema: ++ openAPIV3Schema: ++ properties: ++ apiVersion: ++ type: string ++ kind: ++ type: string ++ metadata: ++ type: object ++ spec: ++ properties: ++ affinity: ++ properties: ++ nodeAffinity: ++ properties: ++ preferredDuringSchedulingIgnoredDuringExecution: ++ items: ++ properties: ++ preference: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchFields: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ type: object ++ x-kubernetes-map-type: atomic ++ weight: ++ format: int32 ++ type: integer ++ required: ++ - preference ++ - weight ++ type: object ++ type: array ++ requiredDuringSchedulingIgnoredDuringExecution: ++ properties: ++ nodeSelectorTerms: ++ items: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchFields: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ type: object ++ x-kubernetes-map-type: atomic ++ type: array ++ required: ++ - nodeSelectorTerms ++ type: object ++ x-kubernetes-map-type: atomic ++ type: object ++ podAffinity: ++ properties: ++ preferredDuringSchedulingIgnoredDuringExecution: ++ items: ++ properties: ++ podAffinityTerm: ++ properties: ++ labelSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaceSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaces: ++ items: ++ type: string ++ type: array ++ topologyKey: ++ type: string ++ required: ++ - topologyKey ++ type: object ++ weight: ++ format: int32 ++ type: integer ++ required: ++ - podAffinityTerm ++ - weight ++ type: object ++ type: array ++ requiredDuringSchedulingIgnoredDuringExecution: ++ items: ++ properties: ++ labelSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaceSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaces: ++ items: ++ type: string ++ type: array ++ topologyKey: ++ type: string ++ required: ++ - topologyKey ++ type: object ++ type: array ++ type: object ++ podAntiAffinity: ++ properties: ++ preferredDuringSchedulingIgnoredDuringExecution: ++ items: ++ properties: ++ podAffinityTerm: ++ properties: ++ labelSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaceSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaces: ++ items: ++ type: string ++ type: array ++ topologyKey: ++ type: string ++ required: ++ - topologyKey ++ type: object ++ weight: ++ format: int32 ++ type: integer ++ required: ++ - podAffinityTerm ++ - weight ++ type: object ++ type: array ++ requiredDuringSchedulingIgnoredDuringExecution: ++ items: ++ properties: ++ labelSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaceSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaces: ++ items: ++ type: string ++ type: array ++ topologyKey: ++ type: string ++ required: ++ - topologyKey ++ type: object ++ type: array ++ type: object ++ type: object ++ agent: ++ nullable: true ++ properties: ++ affinity: ++ properties: ++ nodeAffinity: ++ properties: ++ preferredDuringSchedulingIgnoredDuringExecution: ++ items: ++ properties: ++ preference: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchFields: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ type: object ++ x-kubernetes-map-type: atomic ++ weight: ++ format: int32 ++ type: integer ++ required: ++ - preference ++ - weight ++ type: object ++ type: array ++ requiredDuringSchedulingIgnoredDuringExecution: ++ properties: ++ nodeSelectorTerms: ++ items: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchFields: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ type: object ++ x-kubernetes-map-type: atomic ++ type: array ++ required: ++ - nodeSelectorTerms ++ type: object ++ x-kubernetes-map-type: atomic ++ type: object ++ podAffinity: ++ properties: ++ preferredDuringSchedulingIgnoredDuringExecution: ++ items: ++ properties: ++ podAffinityTerm: ++ properties: ++ labelSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaceSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaces: ++ items: ++ type: string ++ type: array ++ topologyKey: ++ type: string ++ required: ++ - topologyKey ++ type: object ++ weight: ++ format: int32 ++ type: integer ++ required: ++ - podAffinityTerm ++ - weight ++ type: object ++ type: array ++ requiredDuringSchedulingIgnoredDuringExecution: ++ items: ++ properties: ++ labelSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaceSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaces: ++ items: ++ type: string ++ type: array ++ topologyKey: ++ type: string ++ required: ++ - topologyKey ++ type: object ++ type: array ++ type: object ++ podAntiAffinity: ++ properties: ++ preferredDuringSchedulingIgnoredDuringExecution: ++ items: ++ properties: ++ podAffinityTerm: ++ properties: ++ labelSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaceSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaces: ++ items: ++ type: string ++ type: array ++ topologyKey: ++ type: string ++ required: ++ - topologyKey ++ type: object ++ weight: ++ format: int32 ++ type: integer ++ required: ++ - podAffinityTerm ++ - weight ++ type: object ++ type: array ++ requiredDuringSchedulingIgnoredDuringExecution: ++ items: ++ properties: ++ labelSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaceSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaces: ++ items: ++ type: string ++ type: array ++ topologyKey: ++ type: string ++ required: ++ - topologyKey ++ type: object ++ type: array ++ type: object ++ type: object ++ annotations: ++ additionalProperties: ++ type: string ++ nullable: true ++ type: object ++ config: ++ type: object ++ x-kubernetes-preserve-unknown-fields: true ++ containerSecurityContext: ++ properties: ++ allowPrivilegeEscalation: ++ type: boolean ++ capabilities: ++ properties: ++ add: ++ items: ++ type: string ++ type: array ++ drop: ++ items: ++ type: string ++ type: array ++ type: object ++ privileged: ++ type: boolean ++ procMount: ++ type: string ++ readOnlyRootFilesystem: ++ type: boolean ++ runAsGroup: ++ format: int64 ++ type: integer ++ runAsNonRoot: ++ type: boolean ++ runAsUser: ++ format: int64 ++ type: integer ++ seLinuxOptions: ++ properties: ++ level: ++ type: string ++ role: ++ type: string ++ type: ++ type: string ++ user: ++ type: string ++ type: object ++ seccompProfile: ++ properties: ++ localhostProfile: ++ type: string ++ type: ++ type: string ++ required: ++ - type ++ type: object ++ windowsOptions: ++ properties: ++ gmsaCredentialSpec: ++ type: string ++ gmsaCredentialSpecName: ++ type: string ++ hostProcess: ++ type: boolean ++ runAsUserName: ++ type: string ++ type: object ++ type: object ++ dnsPolicy: ++ type: string ++ hostNetwork: ++ type: boolean ++ image: ++ type: string ++ imagePullPolicy: ++ type: string ++ imagePullSecrets: ++ items: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ type: array ++ x-kubernetes-list-type: atomic ++ labels: ++ additionalProperties: ++ type: string ++ type: object ++ livenessProbe: ++ properties: ++ exec: ++ properties: ++ command: ++ items: ++ type: string ++ type: array ++ type: object ++ failureThreshold: ++ format: int32 ++ type: integer ++ grpc: ++ properties: ++ port: ++ format: int32 ++ type: integer ++ service: ++ type: string ++ required: ++ - port ++ type: object ++ httpGet: ++ properties: ++ host: ++ type: string ++ httpHeaders: ++ items: ++ properties: ++ name: ++ type: string ++ value: ++ type: string ++ required: ++ - name ++ - value ++ type: object ++ type: array ++ path: ++ type: string ++ port: ++ anyOf: ++ - type: integer ++ - type: string ++ x-kubernetes-int-or-string: true ++ scheme: ++ type: string ++ required: ++ - port ++ type: object ++ initialDelaySeconds: ++ format: int32 ++ type: integer ++ periodSeconds: ++ format: int32 ++ type: integer ++ successThreshold: ++ format: int32 ++ type: integer ++ tcpSocket: ++ properties: ++ host: ++ type: string ++ port: ++ anyOf: ++ - type: integer ++ - type: string ++ x-kubernetes-int-or-string: true ++ required: ++ - port ++ type: object ++ terminationGracePeriodSeconds: ++ format: int64 ++ type: integer ++ timeoutSeconds: ++ format: int32 ++ type: integer ++ type: object ++ options: ++ type: object ++ x-kubernetes-preserve-unknown-fields: true ++ priorityClassName: ++ type: string ++ resources: ++ nullable: true ++ properties: ++ limits: ++ additionalProperties: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ type: object ++ requests: ++ additionalProperties: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ type: object ++ type: object ++ securityContext: ++ properties: ++ fsGroup: ++ format: int64 ++ type: integer ++ fsGroupChangePolicy: ++ type: string ++ runAsGroup: ++ format: int64 ++ type: integer ++ runAsNonRoot: ++ type: boolean ++ runAsUser: ++ format: int64 ++ type: integer ++ seLinuxOptions: ++ properties: ++ level: ++ type: string ++ role: ++ type: string ++ type: ++ type: string ++ user: ++ type: string ++ type: object ++ seccompProfile: ++ properties: ++ localhostProfile: ++ type: string ++ type: ++ type: string ++ required: ++ - type ++ type: object ++ supplementalGroups: ++ items: ++ format: int64 ++ type: integer ++ type: array ++ sysctls: ++ items: ++ properties: ++ name: ++ type: string ++ value: ++ type: string ++ required: ++ - name ++ - value ++ type: object ++ type: array ++ windowsOptions: ++ properties: ++ gmsaCredentialSpec: ++ type: string ++ gmsaCredentialSpecName: ++ type: string ++ hostProcess: ++ type: boolean ++ runAsUserName: ++ type: string ++ type: object ++ type: object ++ serviceAccount: ++ type: string ++ sidecarSecurityContext: ++ properties: ++ allowPrivilegeEscalation: ++ type: boolean ++ capabilities: ++ properties: ++ add: ++ items: ++ type: string ++ type: array ++ drop: ++ items: ++ type: string ++ type: array ++ type: object ++ privileged: ++ type: boolean ++ procMount: ++ type: string ++ readOnlyRootFilesystem: ++ type: boolean ++ runAsGroup: ++ format: int64 ++ type: integer ++ runAsNonRoot: ++ type: boolean ++ runAsUser: ++ format: int64 ++ type: integer ++ seLinuxOptions: ++ properties: ++ level: ++ type: string ++ role: ++ type: string ++ type: ++ type: string ++ user: ++ type: string ++ type: object ++ seccompProfile: ++ properties: ++ localhostProfile: ++ type: string ++ type: ++ type: string ++ required: ++ - type ++ type: object ++ windowsOptions: ++ properties: ++ gmsaCredentialSpec: ++ type: string ++ gmsaCredentialSpecName: ++ type: string ++ hostProcess: ++ type: boolean ++ runAsUserName: ++ type: string ++ type: object ++ type: object ++ strategy: ++ type: string ++ tolerations: ++ items: ++ properties: ++ effect: ++ type: string ++ key: ++ type: string ++ operator: ++ type: string ++ tolerationSeconds: ++ format: int64 ++ type: integer ++ value: ++ type: string ++ type: object ++ type: array ++ x-kubernetes-list-type: atomic ++ volumeMounts: ++ items: ++ properties: ++ mountPath: ++ type: string ++ mountPropagation: ++ type: string ++ name: ++ type: string ++ readOnly: ++ type: boolean ++ subPath: ++ type: string ++ subPathExpr: ++ type: string ++ required: ++ - mountPath ++ - name ++ type: object ++ type: array ++ x-kubernetes-list-type: atomic ++ volumes: ++ items: ++ properties: ++ awsElasticBlockStore: ++ properties: ++ fsType: ++ type: string ++ partition: ++ format: int32 ++ type: integer ++ readOnly: ++ type: boolean ++ volumeID: ++ type: string ++ required: ++ - volumeID ++ type: object ++ azureDisk: ++ properties: ++ cachingMode: ++ type: string ++ diskName: ++ type: string ++ diskURI: ++ type: string ++ fsType: ++ type: string ++ kind: ++ type: string ++ readOnly: ++ type: boolean ++ required: ++ - diskName ++ - diskURI ++ type: object ++ azureFile: ++ properties: ++ readOnly: ++ type: boolean ++ secretName: ++ type: string ++ shareName: ++ type: string ++ required: ++ - secretName ++ - shareName ++ type: object ++ cephfs: ++ properties: ++ monitors: ++ items: ++ type: string ++ type: array ++ path: ++ type: string ++ readOnly: ++ type: boolean ++ secretFile: ++ type: string ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ user: ++ type: string ++ required: ++ - monitors ++ type: object ++ cinder: ++ properties: ++ fsType: ++ type: string ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ volumeID: ++ type: string ++ required: ++ - volumeID ++ type: object ++ configMap: ++ properties: ++ defaultMode: ++ format: int32 ++ type: integer ++ items: ++ items: ++ properties: ++ key: ++ type: string ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ required: ++ - key ++ - path ++ type: object ++ type: array ++ name: ++ type: string ++ optional: ++ type: boolean ++ type: object ++ x-kubernetes-map-type: atomic ++ csi: ++ properties: ++ driver: ++ type: string ++ fsType: ++ type: string ++ nodePublishSecretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ readOnly: ++ type: boolean ++ volumeAttributes: ++ additionalProperties: ++ type: string ++ type: object ++ required: ++ - driver ++ type: object ++ downwardAPI: ++ properties: ++ defaultMode: ++ format: int32 ++ type: integer ++ items: ++ items: ++ properties: ++ fieldRef: ++ properties: ++ apiVersion: ++ type: string ++ fieldPath: ++ type: string ++ required: ++ - fieldPath ++ type: object ++ x-kubernetes-map-type: atomic ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ resourceFieldRef: ++ properties: ++ containerName: ++ type: string ++ divisor: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ resource: ++ type: string ++ required: ++ - resource ++ type: object ++ x-kubernetes-map-type: atomic ++ required: ++ - path ++ type: object ++ type: array ++ type: object ++ emptyDir: ++ properties: ++ medium: ++ type: string ++ sizeLimit: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ type: object ++ ephemeral: ++ properties: ++ volumeClaimTemplate: ++ properties: ++ metadata: ++ properties: ++ annotations: ++ additionalProperties: ++ type: string ++ type: object ++ finalizers: ++ items: ++ type: string ++ type: array ++ labels: ++ additionalProperties: ++ type: string ++ type: object ++ name: ++ type: string ++ namespace: ++ type: string ++ type: object ++ spec: ++ properties: ++ accessModes: ++ items: ++ type: string ++ type: array ++ dataSource: ++ properties: ++ apiGroup: ++ type: string ++ kind: ++ type: string ++ name: ++ type: string ++ required: ++ - kind ++ - name ++ type: object ++ x-kubernetes-map-type: atomic ++ dataSourceRef: ++ properties: ++ apiGroup: ++ type: string ++ kind: ++ type: string ++ name: ++ type: string ++ required: ++ - kind ++ - name ++ type: object ++ x-kubernetes-map-type: atomic ++ resources: ++ properties: ++ limits: ++ additionalProperties: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ type: object ++ requests: ++ additionalProperties: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ type: object ++ type: object ++ selector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ storageClassName: ++ type: string ++ volumeMode: ++ type: string ++ volumeName: ++ type: string ++ type: object ++ required: ++ - spec ++ type: object ++ type: object ++ fc: ++ properties: ++ fsType: ++ type: string ++ lun: ++ format: int32 ++ type: integer ++ readOnly: ++ type: boolean ++ targetWWNs: ++ items: ++ type: string ++ type: array ++ wwids: ++ items: ++ type: string ++ type: array ++ type: object ++ flexVolume: ++ properties: ++ driver: ++ type: string ++ fsType: ++ type: string ++ options: ++ additionalProperties: ++ type: string ++ type: object ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ required: ++ - driver ++ type: object ++ flocker: ++ properties: ++ datasetName: ++ type: string ++ datasetUUID: ++ type: string ++ type: object ++ gcePersistentDisk: ++ properties: ++ fsType: ++ type: string ++ partition: ++ format: int32 ++ type: integer ++ pdName: ++ type: string ++ readOnly: ++ type: boolean ++ required: ++ - pdName ++ type: object ++ gitRepo: ++ properties: ++ directory: ++ type: string ++ repository: ++ type: string ++ revision: ++ type: string ++ required: ++ - repository ++ type: object ++ glusterfs: ++ properties: ++ endpoints: ++ type: string ++ path: ++ type: string ++ readOnly: ++ type: boolean ++ required: ++ - endpoints ++ - path ++ type: object ++ hostPath: ++ properties: ++ path: ++ type: string ++ type: ++ type: string ++ required: ++ - path ++ type: object ++ iscsi: ++ properties: ++ chapAuthDiscovery: ++ type: boolean ++ chapAuthSession: ++ type: boolean ++ fsType: ++ type: string ++ initiatorName: ++ type: string ++ iqn: ++ type: string ++ iscsiInterface: ++ type: string ++ lun: ++ format: int32 ++ type: integer ++ portals: ++ items: ++ type: string ++ type: array ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ targetPortal: ++ type: string ++ required: ++ - iqn ++ - lun ++ - targetPortal ++ type: object ++ name: ++ type: string ++ nfs: ++ properties: ++ path: ++ type: string ++ readOnly: ++ type: boolean ++ server: ++ type: string ++ required: ++ - path ++ - server ++ type: object ++ persistentVolumeClaim: ++ properties: ++ claimName: ++ type: string ++ readOnly: ++ type: boolean ++ required: ++ - claimName ++ type: object ++ photonPersistentDisk: ++ properties: ++ fsType: ++ type: string ++ pdID: ++ type: string ++ required: ++ - pdID ++ type: object ++ portworxVolume: ++ properties: ++ fsType: ++ type: string ++ readOnly: ++ type: boolean ++ volumeID: ++ type: string ++ required: ++ - volumeID ++ type: object ++ projected: ++ properties: ++ defaultMode: ++ format: int32 ++ type: integer ++ sources: ++ items: ++ properties: ++ configMap: ++ properties: ++ items: ++ items: ++ properties: ++ key: ++ type: string ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ required: ++ - key ++ - path ++ type: object ++ type: array ++ name: ++ type: string ++ optional: ++ type: boolean ++ type: object ++ x-kubernetes-map-type: atomic ++ downwardAPI: ++ properties: ++ items: ++ items: ++ properties: ++ fieldRef: ++ properties: ++ apiVersion: ++ type: string ++ fieldPath: ++ type: string ++ required: ++ - fieldPath ++ type: object ++ x-kubernetes-map-type: atomic ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ resourceFieldRef: ++ properties: ++ containerName: ++ type: string ++ divisor: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ resource: ++ type: string ++ required: ++ - resource ++ type: object ++ x-kubernetes-map-type: atomic ++ required: ++ - path ++ type: object ++ type: array ++ type: object ++ secret: ++ properties: ++ items: ++ items: ++ properties: ++ key: ++ type: string ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ required: ++ - key ++ - path ++ type: object ++ type: array ++ name: ++ type: string ++ optional: ++ type: boolean ++ type: object ++ x-kubernetes-map-type: atomic ++ serviceAccountToken: ++ properties: ++ audience: ++ type: string ++ expirationSeconds: ++ format: int64 ++ type: integer ++ path: ++ type: string ++ required: ++ - path ++ type: object ++ type: object ++ type: array ++ type: object ++ quobyte: ++ properties: ++ group: ++ type: string ++ readOnly: ++ type: boolean ++ registry: ++ type: string ++ tenant: ++ type: string ++ user: ++ type: string ++ volume: ++ type: string ++ required: ++ - registry ++ - volume ++ type: object ++ rbd: ++ properties: ++ fsType: ++ type: string ++ image: ++ type: string ++ keyring: ++ type: string ++ monitors: ++ items: ++ type: string ++ type: array ++ pool: ++ type: string ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ user: ++ type: string ++ required: ++ - image ++ - monitors ++ type: object ++ scaleIO: ++ properties: ++ fsType: ++ type: string ++ gateway: ++ type: string ++ protectionDomain: ++ type: string ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ sslEnabled: ++ type: boolean ++ storageMode: ++ type: string ++ storagePool: ++ type: string ++ system: ++ type: string ++ volumeName: ++ type: string ++ required: ++ - gateway ++ - secretRef ++ - system ++ type: object ++ secret: ++ properties: ++ defaultMode: ++ format: int32 ++ type: integer ++ items: ++ items: ++ properties: ++ key: ++ type: string ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ required: ++ - key ++ - path ++ type: object ++ type: array ++ optional: ++ type: boolean ++ secretName: ++ type: string ++ type: object ++ storageos: ++ properties: ++ fsType: ++ type: string ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ volumeName: ++ type: string ++ volumeNamespace: ++ type: string ++ type: object ++ vsphereVolume: ++ properties: ++ fsType: ++ type: string ++ storagePolicyID: ++ type: string ++ storagePolicyName: ++ type: string ++ volumePath: ++ type: string ++ required: ++ - volumePath ++ type: object ++ required: ++ - name ++ type: object ++ type: array ++ x-kubernetes-list-type: atomic ++ type: object ++ allInOne: ++ properties: ++ affinity: ++ properties: ++ nodeAffinity: ++ properties: ++ preferredDuringSchedulingIgnoredDuringExecution: ++ items: ++ properties: ++ preference: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchFields: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ type: object ++ x-kubernetes-map-type: atomic ++ weight: ++ format: int32 ++ type: integer ++ required: ++ - preference ++ - weight ++ type: object ++ type: array ++ requiredDuringSchedulingIgnoredDuringExecution: ++ properties: ++ nodeSelectorTerms: ++ items: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchFields: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ type: object ++ x-kubernetes-map-type: atomic ++ type: array ++ required: ++ - nodeSelectorTerms ++ type: object ++ x-kubernetes-map-type: atomic ++ type: object ++ podAffinity: ++ properties: ++ preferredDuringSchedulingIgnoredDuringExecution: ++ items: ++ properties: ++ podAffinityTerm: ++ properties: ++ labelSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaceSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaces: ++ items: ++ type: string ++ type: array ++ topologyKey: ++ type: string ++ required: ++ - topologyKey ++ type: object ++ weight: ++ format: int32 ++ type: integer ++ required: ++ - podAffinityTerm ++ - weight ++ type: object ++ type: array ++ requiredDuringSchedulingIgnoredDuringExecution: ++ items: ++ properties: ++ labelSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaceSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaces: ++ items: ++ type: string ++ type: array ++ topologyKey: ++ type: string ++ required: ++ - topologyKey ++ type: object ++ type: array ++ type: object ++ podAntiAffinity: ++ properties: ++ preferredDuringSchedulingIgnoredDuringExecution: ++ items: ++ properties: ++ podAffinityTerm: ++ properties: ++ labelSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaceSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaces: ++ items: ++ type: string ++ type: array ++ topologyKey: ++ type: string ++ required: ++ - topologyKey ++ type: object ++ weight: ++ format: int32 ++ type: integer ++ required: ++ - podAffinityTerm ++ - weight ++ type: object ++ type: array ++ requiredDuringSchedulingIgnoredDuringExecution: ++ items: ++ properties: ++ labelSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaceSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaces: ++ items: ++ type: string ++ type: array ++ topologyKey: ++ type: string ++ required: ++ - topologyKey ++ type: object ++ type: array ++ type: object ++ type: object ++ annotations: ++ additionalProperties: ++ type: string ++ nullable: true ++ type: object ++ config: ++ type: object ++ x-kubernetes-preserve-unknown-fields: true ++ containerSecurityContext: ++ properties: ++ allowPrivilegeEscalation: ++ type: boolean ++ capabilities: ++ properties: ++ add: ++ items: ++ type: string ++ type: array ++ drop: ++ items: ++ type: string ++ type: array ++ type: object ++ privileged: ++ type: boolean ++ procMount: ++ type: string ++ readOnlyRootFilesystem: ++ type: boolean ++ runAsGroup: ++ format: int64 ++ type: integer ++ runAsNonRoot: ++ type: boolean ++ runAsUser: ++ format: int64 ++ type: integer ++ seLinuxOptions: ++ properties: ++ level: ++ type: string ++ role: ++ type: string ++ type: ++ type: string ++ user: ++ type: string ++ type: object ++ seccompProfile: ++ properties: ++ localhostProfile: ++ type: string ++ type: ++ type: string ++ required: ++ - type ++ type: object ++ windowsOptions: ++ properties: ++ gmsaCredentialSpec: ++ type: string ++ gmsaCredentialSpecName: ++ type: string ++ hostProcess: ++ type: boolean ++ runAsUserName: ++ type: string ++ type: object ++ type: object ++ image: ++ type: string ++ imagePullPolicy: ++ type: string ++ imagePullSecrets: ++ items: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ type: array ++ x-kubernetes-list-type: atomic ++ labels: ++ additionalProperties: ++ type: string ++ type: object ++ livenessProbe: ++ properties: ++ exec: ++ properties: ++ command: ++ items: ++ type: string ++ type: array ++ type: object ++ failureThreshold: ++ format: int32 ++ type: integer ++ grpc: ++ properties: ++ port: ++ format: int32 ++ type: integer ++ service: ++ type: string ++ required: ++ - port ++ type: object ++ httpGet: ++ properties: ++ host: ++ type: string ++ httpHeaders: ++ items: ++ properties: ++ name: ++ type: string ++ value: ++ type: string ++ required: ++ - name ++ - value ++ type: object ++ type: array ++ path: ++ type: string ++ port: ++ anyOf: ++ - type: integer ++ - type: string ++ x-kubernetes-int-or-string: true ++ scheme: ++ type: string ++ required: ++ - port ++ type: object ++ initialDelaySeconds: ++ format: int32 ++ type: integer ++ periodSeconds: ++ format: int32 ++ type: integer ++ successThreshold: ++ format: int32 ++ type: integer ++ tcpSocket: ++ properties: ++ host: ++ type: string ++ port: ++ anyOf: ++ - type: integer ++ - type: string ++ x-kubernetes-int-or-string: true ++ required: ++ - port ++ type: object ++ terminationGracePeriodSeconds: ++ format: int64 ++ type: integer ++ timeoutSeconds: ++ format: int32 ++ type: integer ++ type: object ++ metricsStorage: ++ properties: ++ type: ++ type: string ++ type: object ++ options: ++ type: object ++ x-kubernetes-preserve-unknown-fields: true ++ resources: ++ nullable: true ++ properties: ++ limits: ++ additionalProperties: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ type: object ++ requests: ++ additionalProperties: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ type: object ++ type: object ++ securityContext: ++ properties: ++ fsGroup: ++ format: int64 ++ type: integer ++ fsGroupChangePolicy: ++ type: string ++ runAsGroup: ++ format: int64 ++ type: integer ++ runAsNonRoot: ++ type: boolean ++ runAsUser: ++ format: int64 ++ type: integer ++ seLinuxOptions: ++ properties: ++ level: ++ type: string ++ role: ++ type: string ++ type: ++ type: string ++ user: ++ type: string ++ type: object ++ seccompProfile: ++ properties: ++ localhostProfile: ++ type: string ++ type: ++ type: string ++ required: ++ - type ++ type: object ++ supplementalGroups: ++ items: ++ format: int64 ++ type: integer ++ type: array ++ sysctls: ++ items: ++ properties: ++ name: ++ type: string ++ value: ++ type: string ++ required: ++ - name ++ - value ++ type: object ++ type: array ++ windowsOptions: ++ properties: ++ gmsaCredentialSpec: ++ type: string ++ gmsaCredentialSpecName: ++ type: string ++ hostProcess: ++ type: boolean ++ runAsUserName: ++ type: string ++ type: object ++ type: object ++ serviceAccount: ++ type: string ++ strategy: ++ properties: ++ rollingUpdate: ++ properties: ++ maxSurge: ++ anyOf: ++ - type: integer ++ - type: string ++ x-kubernetes-int-or-string: true ++ maxUnavailable: ++ anyOf: ++ - type: integer ++ - type: string ++ x-kubernetes-int-or-string: true ++ type: object ++ type: ++ type: string ++ type: object ++ tolerations: ++ items: ++ properties: ++ effect: ++ type: string ++ key: ++ type: string ++ operator: ++ type: string ++ tolerationSeconds: ++ format: int64 ++ type: integer ++ value: ++ type: string ++ type: object ++ type: array ++ x-kubernetes-list-type: atomic ++ tracingEnabled: ++ type: boolean ++ volumeMounts: ++ items: ++ properties: ++ mountPath: ++ type: string ++ mountPropagation: ++ type: string ++ name: ++ type: string ++ readOnly: ++ type: boolean ++ subPath: ++ type: string ++ subPathExpr: ++ type: string ++ required: ++ - mountPath ++ - name ++ type: object ++ type: array ++ x-kubernetes-list-type: atomic ++ volumes: ++ items: ++ properties: ++ awsElasticBlockStore: ++ properties: ++ fsType: ++ type: string ++ partition: ++ format: int32 ++ type: integer ++ readOnly: ++ type: boolean ++ volumeID: ++ type: string ++ required: ++ - volumeID ++ type: object ++ azureDisk: ++ properties: ++ cachingMode: ++ type: string ++ diskName: ++ type: string ++ diskURI: ++ type: string ++ fsType: ++ type: string ++ kind: ++ type: string ++ readOnly: ++ type: boolean ++ required: ++ - diskName ++ - diskURI ++ type: object ++ azureFile: ++ properties: ++ readOnly: ++ type: boolean ++ secretName: ++ type: string ++ shareName: ++ type: string ++ required: ++ - secretName ++ - shareName ++ type: object ++ cephfs: ++ properties: ++ monitors: ++ items: ++ type: string ++ type: array ++ path: ++ type: string ++ readOnly: ++ type: boolean ++ secretFile: ++ type: string ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ user: ++ type: string ++ required: ++ - monitors ++ type: object ++ cinder: ++ properties: ++ fsType: ++ type: string ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ volumeID: ++ type: string ++ required: ++ - volumeID ++ type: object ++ configMap: ++ properties: ++ defaultMode: ++ format: int32 ++ type: integer ++ items: ++ items: ++ properties: ++ key: ++ type: string ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ required: ++ - key ++ - path ++ type: object ++ type: array ++ name: ++ type: string ++ optional: ++ type: boolean ++ type: object ++ x-kubernetes-map-type: atomic ++ csi: ++ properties: ++ driver: ++ type: string ++ fsType: ++ type: string ++ nodePublishSecretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ readOnly: ++ type: boolean ++ volumeAttributes: ++ additionalProperties: ++ type: string ++ type: object ++ required: ++ - driver ++ type: object ++ downwardAPI: ++ properties: ++ defaultMode: ++ format: int32 ++ type: integer ++ items: ++ items: ++ properties: ++ fieldRef: ++ properties: ++ apiVersion: ++ type: string ++ fieldPath: ++ type: string ++ required: ++ - fieldPath ++ type: object ++ x-kubernetes-map-type: atomic ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ resourceFieldRef: ++ properties: ++ containerName: ++ type: string ++ divisor: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ resource: ++ type: string ++ required: ++ - resource ++ type: object ++ x-kubernetes-map-type: atomic ++ required: ++ - path ++ type: object ++ type: array ++ type: object ++ emptyDir: ++ properties: ++ medium: ++ type: string ++ sizeLimit: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ type: object ++ ephemeral: ++ properties: ++ volumeClaimTemplate: ++ properties: ++ metadata: ++ properties: ++ annotations: ++ additionalProperties: ++ type: string ++ type: object ++ finalizers: ++ items: ++ type: string ++ type: array ++ labels: ++ additionalProperties: ++ type: string ++ type: object ++ name: ++ type: string ++ namespace: ++ type: string ++ type: object ++ spec: ++ properties: ++ accessModes: ++ items: ++ type: string ++ type: array ++ dataSource: ++ properties: ++ apiGroup: ++ type: string ++ kind: ++ type: string ++ name: ++ type: string ++ required: ++ - kind ++ - name ++ type: object ++ x-kubernetes-map-type: atomic ++ dataSourceRef: ++ properties: ++ apiGroup: ++ type: string ++ kind: ++ type: string ++ name: ++ type: string ++ required: ++ - kind ++ - name ++ type: object ++ x-kubernetes-map-type: atomic ++ resources: ++ properties: ++ limits: ++ additionalProperties: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ type: object ++ requests: ++ additionalProperties: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ type: object ++ type: object ++ selector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ storageClassName: ++ type: string ++ volumeMode: ++ type: string ++ volumeName: ++ type: string ++ type: object ++ required: ++ - spec ++ type: object ++ type: object ++ fc: ++ properties: ++ fsType: ++ type: string ++ lun: ++ format: int32 ++ type: integer ++ readOnly: ++ type: boolean ++ targetWWNs: ++ items: ++ type: string ++ type: array ++ wwids: ++ items: ++ type: string ++ type: array ++ type: object ++ flexVolume: ++ properties: ++ driver: ++ type: string ++ fsType: ++ type: string ++ options: ++ additionalProperties: ++ type: string ++ type: object ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ required: ++ - driver ++ type: object ++ flocker: ++ properties: ++ datasetName: ++ type: string ++ datasetUUID: ++ type: string ++ type: object ++ gcePersistentDisk: ++ properties: ++ fsType: ++ type: string ++ partition: ++ format: int32 ++ type: integer ++ pdName: ++ type: string ++ readOnly: ++ type: boolean ++ required: ++ - pdName ++ type: object ++ gitRepo: ++ properties: ++ directory: ++ type: string ++ repository: ++ type: string ++ revision: ++ type: string ++ required: ++ - repository ++ type: object ++ glusterfs: ++ properties: ++ endpoints: ++ type: string ++ path: ++ type: string ++ readOnly: ++ type: boolean ++ required: ++ - endpoints ++ - path ++ type: object ++ hostPath: ++ properties: ++ path: ++ type: string ++ type: ++ type: string ++ required: ++ - path ++ type: object ++ iscsi: ++ properties: ++ chapAuthDiscovery: ++ type: boolean ++ chapAuthSession: ++ type: boolean ++ fsType: ++ type: string ++ initiatorName: ++ type: string ++ iqn: ++ type: string ++ iscsiInterface: ++ type: string ++ lun: ++ format: int32 ++ type: integer ++ portals: ++ items: ++ type: string ++ type: array ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ targetPortal: ++ type: string ++ required: ++ - iqn ++ - lun ++ - targetPortal ++ type: object ++ name: ++ type: string ++ nfs: ++ properties: ++ path: ++ type: string ++ readOnly: ++ type: boolean ++ server: ++ type: string ++ required: ++ - path ++ - server ++ type: object ++ persistentVolumeClaim: ++ properties: ++ claimName: ++ type: string ++ readOnly: ++ type: boolean ++ required: ++ - claimName ++ type: object ++ photonPersistentDisk: ++ properties: ++ fsType: ++ type: string ++ pdID: ++ type: string ++ required: ++ - pdID ++ type: object ++ portworxVolume: ++ properties: ++ fsType: ++ type: string ++ readOnly: ++ type: boolean ++ volumeID: ++ type: string ++ required: ++ - volumeID ++ type: object ++ projected: ++ properties: ++ defaultMode: ++ format: int32 ++ type: integer ++ sources: ++ items: ++ properties: ++ configMap: ++ properties: ++ items: ++ items: ++ properties: ++ key: ++ type: string ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ required: ++ - key ++ - path ++ type: object ++ type: array ++ name: ++ type: string ++ optional: ++ type: boolean ++ type: object ++ x-kubernetes-map-type: atomic ++ downwardAPI: ++ properties: ++ items: ++ items: ++ properties: ++ fieldRef: ++ properties: ++ apiVersion: ++ type: string ++ fieldPath: ++ type: string ++ required: ++ - fieldPath ++ type: object ++ x-kubernetes-map-type: atomic ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ resourceFieldRef: ++ properties: ++ containerName: ++ type: string ++ divisor: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ resource: ++ type: string ++ required: ++ - resource ++ type: object ++ x-kubernetes-map-type: atomic ++ required: ++ - path ++ type: object ++ type: array ++ type: object ++ secret: ++ properties: ++ items: ++ items: ++ properties: ++ key: ++ type: string ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ required: ++ - key ++ - path ++ type: object ++ type: array ++ name: ++ type: string ++ optional: ++ type: boolean ++ type: object ++ x-kubernetes-map-type: atomic ++ serviceAccountToken: ++ properties: ++ audience: ++ type: string ++ expirationSeconds: ++ format: int64 ++ type: integer ++ path: ++ type: string ++ required: ++ - path ++ type: object ++ type: object ++ type: array ++ type: object ++ quobyte: ++ properties: ++ group: ++ type: string ++ readOnly: ++ type: boolean ++ registry: ++ type: string ++ tenant: ++ type: string ++ user: ++ type: string ++ volume: ++ type: string ++ required: ++ - registry ++ - volume ++ type: object ++ rbd: ++ properties: ++ fsType: ++ type: string ++ image: ++ type: string ++ keyring: ++ type: string ++ monitors: ++ items: ++ type: string ++ type: array ++ pool: ++ type: string ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ user: ++ type: string ++ required: ++ - image ++ - monitors ++ type: object ++ scaleIO: ++ properties: ++ fsType: ++ type: string ++ gateway: ++ type: string ++ protectionDomain: ++ type: string ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ sslEnabled: ++ type: boolean ++ storageMode: ++ type: string ++ storagePool: ++ type: string ++ system: ++ type: string ++ volumeName: ++ type: string ++ required: ++ - gateway ++ - secretRef ++ - system ++ type: object ++ secret: ++ properties: ++ defaultMode: ++ format: int32 ++ type: integer ++ items: ++ items: ++ properties: ++ key: ++ type: string ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ required: ++ - key ++ - path ++ type: object ++ type: array ++ optional: ++ type: boolean ++ secretName: ++ type: string ++ type: object ++ storageos: ++ properties: ++ fsType: ++ type: string ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ volumeName: ++ type: string ++ volumeNamespace: ++ type: string ++ type: object ++ vsphereVolume: ++ properties: ++ fsType: ++ type: string ++ storagePolicyID: ++ type: string ++ storagePolicyName: ++ type: string ++ volumePath: ++ type: string ++ required: ++ - volumePath ++ type: object ++ required: ++ - name ++ type: object ++ type: array ++ x-kubernetes-list-type: atomic ++ type: object ++ annotations: ++ additionalProperties: ++ type: string ++ nullable: true ++ type: object ++ collector: ++ properties: ++ affinity: ++ properties: ++ nodeAffinity: ++ properties: ++ preferredDuringSchedulingIgnoredDuringExecution: ++ items: ++ properties: ++ preference: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchFields: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ type: object ++ x-kubernetes-map-type: atomic ++ weight: ++ format: int32 ++ type: integer ++ required: ++ - preference ++ - weight ++ type: object ++ type: array ++ requiredDuringSchedulingIgnoredDuringExecution: ++ properties: ++ nodeSelectorTerms: ++ items: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchFields: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ type: object ++ x-kubernetes-map-type: atomic ++ type: array ++ required: ++ - nodeSelectorTerms ++ type: object ++ x-kubernetes-map-type: atomic ++ type: object ++ podAffinity: ++ properties: ++ preferredDuringSchedulingIgnoredDuringExecution: ++ items: ++ properties: ++ podAffinityTerm: ++ properties: ++ labelSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaceSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaces: ++ items: ++ type: string ++ type: array ++ topologyKey: ++ type: string ++ required: ++ - topologyKey ++ type: object ++ weight: ++ format: int32 ++ type: integer ++ required: ++ - podAffinityTerm ++ - weight ++ type: object ++ type: array ++ requiredDuringSchedulingIgnoredDuringExecution: ++ items: ++ properties: ++ labelSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaceSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaces: ++ items: ++ type: string ++ type: array ++ topologyKey: ++ type: string ++ required: ++ - topologyKey ++ type: object ++ type: array ++ type: object ++ podAntiAffinity: ++ properties: ++ preferredDuringSchedulingIgnoredDuringExecution: ++ items: ++ properties: ++ podAffinityTerm: ++ properties: ++ labelSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaceSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaces: ++ items: ++ type: string ++ type: array ++ topologyKey: ++ type: string ++ required: ++ - topologyKey ++ type: object ++ weight: ++ format: int32 ++ type: integer ++ required: ++ - podAffinityTerm ++ - weight ++ type: object ++ type: array ++ requiredDuringSchedulingIgnoredDuringExecution: ++ items: ++ properties: ++ labelSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaceSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaces: ++ items: ++ type: string ++ type: array ++ topologyKey: ++ type: string ++ required: ++ - topologyKey ++ type: object ++ type: array ++ type: object ++ type: object ++ annotations: ++ additionalProperties: ++ type: string ++ nullable: true ++ type: object ++ autoscale: ++ type: boolean ++ config: ++ type: object ++ x-kubernetes-preserve-unknown-fields: true ++ containerSecurityContext: ++ properties: ++ allowPrivilegeEscalation: ++ type: boolean ++ capabilities: ++ properties: ++ add: ++ items: ++ type: string ++ type: array ++ drop: ++ items: ++ type: string ++ type: array ++ type: object ++ privileged: ++ type: boolean ++ procMount: ++ type: string ++ readOnlyRootFilesystem: ++ type: boolean ++ runAsGroup: ++ format: int64 ++ type: integer ++ runAsNonRoot: ++ type: boolean ++ runAsUser: ++ format: int64 ++ type: integer ++ seLinuxOptions: ++ properties: ++ level: ++ type: string ++ role: ++ type: string ++ type: ++ type: string ++ user: ++ type: string ++ type: object ++ seccompProfile: ++ properties: ++ localhostProfile: ++ type: string ++ type: ++ type: string ++ required: ++ - type ++ type: object ++ windowsOptions: ++ properties: ++ gmsaCredentialSpec: ++ type: string ++ gmsaCredentialSpecName: ++ type: string ++ hostProcess: ++ type: boolean ++ runAsUserName: ++ type: string ++ type: object ++ type: object ++ image: ++ type: string ++ imagePullPolicy: ++ type: string ++ imagePullSecrets: ++ items: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ type: array ++ x-kubernetes-list-type: atomic ++ kafkaSecretName: ++ type: string ++ labels: ++ additionalProperties: ++ type: string ++ type: object ++ livenessProbe: ++ properties: ++ exec: ++ properties: ++ command: ++ items: ++ type: string ++ type: array ++ type: object ++ failureThreshold: ++ format: int32 ++ type: integer ++ grpc: ++ properties: ++ port: ++ format: int32 ++ type: integer ++ service: ++ type: string ++ required: ++ - port ++ type: object ++ httpGet: ++ properties: ++ host: ++ type: string ++ httpHeaders: ++ items: ++ properties: ++ name: ++ type: string ++ value: ++ type: string ++ required: ++ - name ++ - value ++ type: object ++ type: array ++ path: ++ type: string ++ port: ++ anyOf: ++ - type: integer ++ - type: string ++ x-kubernetes-int-or-string: true ++ scheme: ++ type: string ++ required: ++ - port ++ type: object ++ initialDelaySeconds: ++ format: int32 ++ type: integer ++ periodSeconds: ++ format: int32 ++ type: integer ++ successThreshold: ++ format: int32 ++ type: integer ++ tcpSocket: ++ properties: ++ host: ++ type: string ++ port: ++ anyOf: ++ - type: integer ++ - type: string ++ x-kubernetes-int-or-string: true ++ required: ++ - port ++ type: object ++ terminationGracePeriodSeconds: ++ format: int64 ++ type: integer ++ timeoutSeconds: ++ format: int32 ++ type: integer ++ type: object ++ maxReplicas: ++ format: int32 ++ type: integer ++ minReplicas: ++ format: int32 ++ type: integer ++ options: ++ type: object ++ x-kubernetes-preserve-unknown-fields: true ++ priorityClassName: ++ type: string ++ replicas: ++ format: int32 ++ type: integer ++ resources: ++ nullable: true ++ properties: ++ limits: ++ additionalProperties: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ type: object ++ requests: ++ additionalProperties: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ type: object ++ type: object ++ securityContext: ++ properties: ++ fsGroup: ++ format: int64 ++ type: integer ++ fsGroupChangePolicy: ++ type: string ++ runAsGroup: ++ format: int64 ++ type: integer ++ runAsNonRoot: ++ type: boolean ++ runAsUser: ++ format: int64 ++ type: integer ++ seLinuxOptions: ++ properties: ++ level: ++ type: string ++ role: ++ type: string ++ type: ++ type: string ++ user: ++ type: string ++ type: object ++ seccompProfile: ++ properties: ++ localhostProfile: ++ type: string ++ type: ++ type: string ++ required: ++ - type ++ type: object ++ supplementalGroups: ++ items: ++ format: int64 ++ type: integer ++ type: array ++ sysctls: ++ items: ++ properties: ++ name: ++ type: string ++ value: ++ type: string ++ required: ++ - name ++ - value ++ type: object ++ type: array ++ windowsOptions: ++ properties: ++ gmsaCredentialSpec: ++ type: string ++ gmsaCredentialSpecName: ++ type: string ++ hostProcess: ++ type: boolean ++ runAsUserName: ++ type: string ++ type: object ++ type: object ++ serviceAccount: ++ type: string ++ serviceType: ++ type: string ++ strategy: ++ properties: ++ rollingUpdate: ++ properties: ++ maxSurge: ++ anyOf: ++ - type: integer ++ - type: string ++ x-kubernetes-int-or-string: true ++ maxUnavailable: ++ anyOf: ++ - type: integer ++ - type: string ++ x-kubernetes-int-or-string: true ++ type: object ++ type: ++ type: string ++ type: object ++ tolerations: ++ items: ++ properties: ++ effect: ++ type: string ++ key: ++ type: string ++ operator: ++ type: string ++ tolerationSeconds: ++ format: int64 ++ type: integer ++ value: ++ type: string ++ type: object ++ type: array ++ x-kubernetes-list-type: atomic ++ volumeMounts: ++ items: ++ properties: ++ mountPath: ++ type: string ++ mountPropagation: ++ type: string ++ name: ++ type: string ++ readOnly: ++ type: boolean ++ subPath: ++ type: string ++ subPathExpr: ++ type: string ++ required: ++ - mountPath ++ - name ++ type: object ++ type: array ++ x-kubernetes-list-type: atomic ++ volumes: ++ items: ++ properties: ++ awsElasticBlockStore: ++ properties: ++ fsType: ++ type: string ++ partition: ++ format: int32 ++ type: integer ++ readOnly: ++ type: boolean ++ volumeID: ++ type: string ++ required: ++ - volumeID ++ type: object ++ azureDisk: ++ properties: ++ cachingMode: ++ type: string ++ diskName: ++ type: string ++ diskURI: ++ type: string ++ fsType: ++ type: string ++ kind: ++ type: string ++ readOnly: ++ type: boolean ++ required: ++ - diskName ++ - diskURI ++ type: object ++ azureFile: ++ properties: ++ readOnly: ++ type: boolean ++ secretName: ++ type: string ++ shareName: ++ type: string ++ required: ++ - secretName ++ - shareName ++ type: object ++ cephfs: ++ properties: ++ monitors: ++ items: ++ type: string ++ type: array ++ path: ++ type: string ++ readOnly: ++ type: boolean ++ secretFile: ++ type: string ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ user: ++ type: string ++ required: ++ - monitors ++ type: object ++ cinder: ++ properties: ++ fsType: ++ type: string ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ volumeID: ++ type: string ++ required: ++ - volumeID ++ type: object ++ configMap: ++ properties: ++ defaultMode: ++ format: int32 ++ type: integer ++ items: ++ items: ++ properties: ++ key: ++ type: string ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ required: ++ - key ++ - path ++ type: object ++ type: array ++ name: ++ type: string ++ optional: ++ type: boolean ++ type: object ++ x-kubernetes-map-type: atomic ++ csi: ++ properties: ++ driver: ++ type: string ++ fsType: ++ type: string ++ nodePublishSecretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ readOnly: ++ type: boolean ++ volumeAttributes: ++ additionalProperties: ++ type: string ++ type: object ++ required: ++ - driver ++ type: object ++ downwardAPI: ++ properties: ++ defaultMode: ++ format: int32 ++ type: integer ++ items: ++ items: ++ properties: ++ fieldRef: ++ properties: ++ apiVersion: ++ type: string ++ fieldPath: ++ type: string ++ required: ++ - fieldPath ++ type: object ++ x-kubernetes-map-type: atomic ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ resourceFieldRef: ++ properties: ++ containerName: ++ type: string ++ divisor: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ resource: ++ type: string ++ required: ++ - resource ++ type: object ++ x-kubernetes-map-type: atomic ++ required: ++ - path ++ type: object ++ type: array ++ type: object ++ emptyDir: ++ properties: ++ medium: ++ type: string ++ sizeLimit: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ type: object ++ ephemeral: ++ properties: ++ volumeClaimTemplate: ++ properties: ++ metadata: ++ properties: ++ annotations: ++ additionalProperties: ++ type: string ++ type: object ++ finalizers: ++ items: ++ type: string ++ type: array ++ labels: ++ additionalProperties: ++ type: string ++ type: object ++ name: ++ type: string ++ namespace: ++ type: string ++ type: object ++ spec: ++ properties: ++ accessModes: ++ items: ++ type: string ++ type: array ++ dataSource: ++ properties: ++ apiGroup: ++ type: string ++ kind: ++ type: string ++ name: ++ type: string ++ required: ++ - kind ++ - name ++ type: object ++ x-kubernetes-map-type: atomic ++ dataSourceRef: ++ properties: ++ apiGroup: ++ type: string ++ kind: ++ type: string ++ name: ++ type: string ++ required: ++ - kind ++ - name ++ type: object ++ x-kubernetes-map-type: atomic ++ resources: ++ properties: ++ limits: ++ additionalProperties: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ type: object ++ requests: ++ additionalProperties: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ type: object ++ type: object ++ selector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ storageClassName: ++ type: string ++ volumeMode: ++ type: string ++ volumeName: ++ type: string ++ type: object ++ required: ++ - spec ++ type: object ++ type: object ++ fc: ++ properties: ++ fsType: ++ type: string ++ lun: ++ format: int32 ++ type: integer ++ readOnly: ++ type: boolean ++ targetWWNs: ++ items: ++ type: string ++ type: array ++ wwids: ++ items: ++ type: string ++ type: array ++ type: object ++ flexVolume: ++ properties: ++ driver: ++ type: string ++ fsType: ++ type: string ++ options: ++ additionalProperties: ++ type: string ++ type: object ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ required: ++ - driver ++ type: object ++ flocker: ++ properties: ++ datasetName: ++ type: string ++ datasetUUID: ++ type: string ++ type: object ++ gcePersistentDisk: ++ properties: ++ fsType: ++ type: string ++ partition: ++ format: int32 ++ type: integer ++ pdName: ++ type: string ++ readOnly: ++ type: boolean ++ required: ++ - pdName ++ type: object ++ gitRepo: ++ properties: ++ directory: ++ type: string ++ repository: ++ type: string ++ revision: ++ type: string ++ required: ++ - repository ++ type: object ++ glusterfs: ++ properties: ++ endpoints: ++ type: string ++ path: ++ type: string ++ readOnly: ++ type: boolean ++ required: ++ - endpoints ++ - path ++ type: object ++ hostPath: ++ properties: ++ path: ++ type: string ++ type: ++ type: string ++ required: ++ - path ++ type: object ++ iscsi: ++ properties: ++ chapAuthDiscovery: ++ type: boolean ++ chapAuthSession: ++ type: boolean ++ fsType: ++ type: string ++ initiatorName: ++ type: string ++ iqn: ++ type: string ++ iscsiInterface: ++ type: string ++ lun: ++ format: int32 ++ type: integer ++ portals: ++ items: ++ type: string ++ type: array ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ targetPortal: ++ type: string ++ required: ++ - iqn ++ - lun ++ - targetPortal ++ type: object ++ name: ++ type: string ++ nfs: ++ properties: ++ path: ++ type: string ++ readOnly: ++ type: boolean ++ server: ++ type: string ++ required: ++ - path ++ - server ++ type: object ++ persistentVolumeClaim: ++ properties: ++ claimName: ++ type: string ++ readOnly: ++ type: boolean ++ required: ++ - claimName ++ type: object ++ photonPersistentDisk: ++ properties: ++ fsType: ++ type: string ++ pdID: ++ type: string ++ required: ++ - pdID ++ type: object ++ portworxVolume: ++ properties: ++ fsType: ++ type: string ++ readOnly: ++ type: boolean ++ volumeID: ++ type: string ++ required: ++ - volumeID ++ type: object ++ projected: ++ properties: ++ defaultMode: ++ format: int32 ++ type: integer ++ sources: ++ items: ++ properties: ++ configMap: ++ properties: ++ items: ++ items: ++ properties: ++ key: ++ type: string ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ required: ++ - key ++ - path ++ type: object ++ type: array ++ name: ++ type: string ++ optional: ++ type: boolean ++ type: object ++ x-kubernetes-map-type: atomic ++ downwardAPI: ++ properties: ++ items: ++ items: ++ properties: ++ fieldRef: ++ properties: ++ apiVersion: ++ type: string ++ fieldPath: ++ type: string ++ required: ++ - fieldPath ++ type: object ++ x-kubernetes-map-type: atomic ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ resourceFieldRef: ++ properties: ++ containerName: ++ type: string ++ divisor: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ resource: ++ type: string ++ required: ++ - resource ++ type: object ++ x-kubernetes-map-type: atomic ++ required: ++ - path ++ type: object ++ type: array ++ type: object ++ secret: ++ properties: ++ items: ++ items: ++ properties: ++ key: ++ type: string ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ required: ++ - key ++ - path ++ type: object ++ type: array ++ name: ++ type: string ++ optional: ++ type: boolean ++ type: object ++ x-kubernetes-map-type: atomic ++ serviceAccountToken: ++ properties: ++ audience: ++ type: string ++ expirationSeconds: ++ format: int64 ++ type: integer ++ path: ++ type: string ++ required: ++ - path ++ type: object ++ type: object ++ type: array ++ type: object ++ quobyte: ++ properties: ++ group: ++ type: string ++ readOnly: ++ type: boolean ++ registry: ++ type: string ++ tenant: ++ type: string ++ user: ++ type: string ++ volume: ++ type: string ++ required: ++ - registry ++ - volume ++ type: object ++ rbd: ++ properties: ++ fsType: ++ type: string ++ image: ++ type: string ++ keyring: ++ type: string ++ monitors: ++ items: ++ type: string ++ type: array ++ pool: ++ type: string ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ user: ++ type: string ++ required: ++ - image ++ - monitors ++ type: object ++ scaleIO: ++ properties: ++ fsType: ++ type: string ++ gateway: ++ type: string ++ protectionDomain: ++ type: string ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ sslEnabled: ++ type: boolean ++ storageMode: ++ type: string ++ storagePool: ++ type: string ++ system: ++ type: string ++ volumeName: ++ type: string ++ required: ++ - gateway ++ - secretRef ++ - system ++ type: object ++ secret: ++ properties: ++ defaultMode: ++ format: int32 ++ type: integer ++ items: ++ items: ++ properties: ++ key: ++ type: string ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ required: ++ - key ++ - path ++ type: object ++ type: array ++ optional: ++ type: boolean ++ secretName: ++ type: string ++ type: object ++ storageos: ++ properties: ++ fsType: ++ type: string ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ volumeName: ++ type: string ++ volumeNamespace: ++ type: string ++ type: object ++ vsphereVolume: ++ properties: ++ fsType: ++ type: string ++ storagePolicyID: ++ type: string ++ storagePolicyName: ++ type: string ++ volumePath: ++ type: string ++ required: ++ - volumePath ++ type: object ++ required: ++ - name ++ type: object ++ type: array ++ x-kubernetes-list-type: atomic ++ type: object ++ containerSecurityContext: ++ properties: ++ allowPrivilegeEscalation: ++ type: boolean ++ capabilities: ++ properties: ++ add: ++ items: ++ type: string ++ type: array ++ drop: ++ items: ++ type: string ++ type: array ++ type: object ++ privileged: ++ type: boolean ++ procMount: ++ type: string ++ readOnlyRootFilesystem: ++ type: boolean ++ runAsGroup: ++ format: int64 ++ type: integer ++ runAsNonRoot: ++ type: boolean ++ runAsUser: ++ format: int64 ++ type: integer ++ seLinuxOptions: ++ properties: ++ level: ++ type: string ++ role: ++ type: string ++ type: ++ type: string ++ user: ++ type: string ++ type: object ++ seccompProfile: ++ properties: ++ localhostProfile: ++ type: string ++ type: ++ type: string ++ required: ++ - type ++ type: object ++ windowsOptions: ++ properties: ++ gmsaCredentialSpec: ++ type: string ++ gmsaCredentialSpecName: ++ type: string ++ hostProcess: ++ type: boolean ++ runAsUserName: ++ type: string ++ type: object ++ type: object ++ imagePullPolicy: ++ type: string ++ imagePullSecrets: ++ items: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ type: array ++ x-kubernetes-list-type: atomic ++ ingester: ++ properties: ++ affinity: ++ properties: ++ nodeAffinity: ++ properties: ++ preferredDuringSchedulingIgnoredDuringExecution: ++ items: ++ properties: ++ preference: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchFields: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ type: object ++ x-kubernetes-map-type: atomic ++ weight: ++ format: int32 ++ type: integer ++ required: ++ - preference ++ - weight ++ type: object ++ type: array ++ requiredDuringSchedulingIgnoredDuringExecution: ++ properties: ++ nodeSelectorTerms: ++ items: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchFields: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ type: object ++ x-kubernetes-map-type: atomic ++ type: array ++ required: ++ - nodeSelectorTerms ++ type: object ++ x-kubernetes-map-type: atomic ++ type: object ++ podAffinity: ++ properties: ++ preferredDuringSchedulingIgnoredDuringExecution: ++ items: ++ properties: ++ podAffinityTerm: ++ properties: ++ labelSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaceSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaces: ++ items: ++ type: string ++ type: array ++ topologyKey: ++ type: string ++ required: ++ - topologyKey ++ type: object ++ weight: ++ format: int32 ++ type: integer ++ required: ++ - podAffinityTerm ++ - weight ++ type: object ++ type: array ++ requiredDuringSchedulingIgnoredDuringExecution: ++ items: ++ properties: ++ labelSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaceSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaces: ++ items: ++ type: string ++ type: array ++ topologyKey: ++ type: string ++ required: ++ - topologyKey ++ type: object ++ type: array ++ type: object ++ podAntiAffinity: ++ properties: ++ preferredDuringSchedulingIgnoredDuringExecution: ++ items: ++ properties: ++ podAffinityTerm: ++ properties: ++ labelSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaceSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaces: ++ items: ++ type: string ++ type: array ++ topologyKey: ++ type: string ++ required: ++ - topologyKey ++ type: object ++ weight: ++ format: int32 ++ type: integer ++ required: ++ - podAffinityTerm ++ - weight ++ type: object ++ type: array ++ requiredDuringSchedulingIgnoredDuringExecution: ++ items: ++ properties: ++ labelSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaceSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaces: ++ items: ++ type: string ++ type: array ++ topologyKey: ++ type: string ++ required: ++ - topologyKey ++ type: object ++ type: array ++ type: object ++ type: object ++ annotations: ++ additionalProperties: ++ type: string ++ nullable: true ++ type: object ++ autoscale: ++ type: boolean ++ config: ++ type: object ++ x-kubernetes-preserve-unknown-fields: true ++ containerSecurityContext: ++ properties: ++ allowPrivilegeEscalation: ++ type: boolean ++ capabilities: ++ properties: ++ add: ++ items: ++ type: string ++ type: array ++ drop: ++ items: ++ type: string ++ type: array ++ type: object ++ privileged: ++ type: boolean ++ procMount: ++ type: string ++ readOnlyRootFilesystem: ++ type: boolean ++ runAsGroup: ++ format: int64 ++ type: integer ++ runAsNonRoot: ++ type: boolean ++ runAsUser: ++ format: int64 ++ type: integer ++ seLinuxOptions: ++ properties: ++ level: ++ type: string ++ role: ++ type: string ++ type: ++ type: string ++ user: ++ type: string ++ type: object ++ seccompProfile: ++ properties: ++ localhostProfile: ++ type: string ++ type: ++ type: string ++ required: ++ - type ++ type: object ++ windowsOptions: ++ properties: ++ gmsaCredentialSpec: ++ type: string ++ gmsaCredentialSpecName: ++ type: string ++ hostProcess: ++ type: boolean ++ runAsUserName: ++ type: string ++ type: object ++ type: object ++ image: ++ type: string ++ imagePullPolicy: ++ type: string ++ imagePullSecrets: ++ items: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ type: array ++ x-kubernetes-list-type: atomic ++ kafkaSecretName: ++ type: string ++ labels: ++ additionalProperties: ++ type: string ++ type: object ++ livenessProbe: ++ properties: ++ exec: ++ properties: ++ command: ++ items: ++ type: string ++ type: array ++ type: object ++ failureThreshold: ++ format: int32 ++ type: integer ++ grpc: ++ properties: ++ port: ++ format: int32 ++ type: integer ++ service: ++ type: string ++ required: ++ - port ++ type: object ++ httpGet: ++ properties: ++ host: ++ type: string ++ httpHeaders: ++ items: ++ properties: ++ name: ++ type: string ++ value: ++ type: string ++ required: ++ - name ++ - value ++ type: object ++ type: array ++ path: ++ type: string ++ port: ++ anyOf: ++ - type: integer ++ - type: string ++ x-kubernetes-int-or-string: true ++ scheme: ++ type: string ++ required: ++ - port ++ type: object ++ initialDelaySeconds: ++ format: int32 ++ type: integer ++ periodSeconds: ++ format: int32 ++ type: integer ++ successThreshold: ++ format: int32 ++ type: integer ++ tcpSocket: ++ properties: ++ host: ++ type: string ++ port: ++ anyOf: ++ - type: integer ++ - type: string ++ x-kubernetes-int-or-string: true ++ required: ++ - port ++ type: object ++ terminationGracePeriodSeconds: ++ format: int64 ++ type: integer ++ timeoutSeconds: ++ format: int32 ++ type: integer ++ type: object ++ maxReplicas: ++ format: int32 ++ type: integer ++ minReplicas: ++ format: int32 ++ type: integer ++ options: ++ type: object ++ x-kubernetes-preserve-unknown-fields: true ++ replicas: ++ format: int32 ++ type: integer ++ resources: ++ nullable: true ++ properties: ++ limits: ++ additionalProperties: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ type: object ++ requests: ++ additionalProperties: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ type: object ++ type: object ++ securityContext: ++ properties: ++ fsGroup: ++ format: int64 ++ type: integer ++ fsGroupChangePolicy: ++ type: string ++ runAsGroup: ++ format: int64 ++ type: integer ++ runAsNonRoot: ++ type: boolean ++ runAsUser: ++ format: int64 ++ type: integer ++ seLinuxOptions: ++ properties: ++ level: ++ type: string ++ role: ++ type: string ++ type: ++ type: string ++ user: ++ type: string ++ type: object ++ seccompProfile: ++ properties: ++ localhostProfile: ++ type: string ++ type: ++ type: string ++ required: ++ - type ++ type: object ++ supplementalGroups: ++ items: ++ format: int64 ++ type: integer ++ type: array ++ sysctls: ++ items: ++ properties: ++ name: ++ type: string ++ value: ++ type: string ++ required: ++ - name ++ - value ++ type: object ++ type: array ++ windowsOptions: ++ properties: ++ gmsaCredentialSpec: ++ type: string ++ gmsaCredentialSpecName: ++ type: string ++ hostProcess: ++ type: boolean ++ runAsUserName: ++ type: string ++ type: object ++ type: object ++ serviceAccount: ++ type: string ++ strategy: ++ properties: ++ rollingUpdate: ++ properties: ++ maxSurge: ++ anyOf: ++ - type: integer ++ - type: string ++ x-kubernetes-int-or-string: true ++ maxUnavailable: ++ anyOf: ++ - type: integer ++ - type: string ++ x-kubernetes-int-or-string: true ++ type: object ++ type: ++ type: string ++ type: object ++ tolerations: ++ items: ++ properties: ++ effect: ++ type: string ++ key: ++ type: string ++ operator: ++ type: string ++ tolerationSeconds: ++ format: int64 ++ type: integer ++ value: ++ type: string ++ type: object ++ type: array ++ x-kubernetes-list-type: atomic ++ volumeMounts: ++ items: ++ properties: ++ mountPath: ++ type: string ++ mountPropagation: ++ type: string ++ name: ++ type: string ++ readOnly: ++ type: boolean ++ subPath: ++ type: string ++ subPathExpr: ++ type: string ++ required: ++ - mountPath ++ - name ++ type: object ++ type: array ++ x-kubernetes-list-type: atomic ++ volumes: ++ items: ++ properties: ++ awsElasticBlockStore: ++ properties: ++ fsType: ++ type: string ++ partition: ++ format: int32 ++ type: integer ++ readOnly: ++ type: boolean ++ volumeID: ++ type: string ++ required: ++ - volumeID ++ type: object ++ azureDisk: ++ properties: ++ cachingMode: ++ type: string ++ diskName: ++ type: string ++ diskURI: ++ type: string ++ fsType: ++ type: string ++ kind: ++ type: string ++ readOnly: ++ type: boolean ++ required: ++ - diskName ++ - diskURI ++ type: object ++ azureFile: ++ properties: ++ readOnly: ++ type: boolean ++ secretName: ++ type: string ++ shareName: ++ type: string ++ required: ++ - secretName ++ - shareName ++ type: object ++ cephfs: ++ properties: ++ monitors: ++ items: ++ type: string ++ type: array ++ path: ++ type: string ++ readOnly: ++ type: boolean ++ secretFile: ++ type: string ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ user: ++ type: string ++ required: ++ - monitors ++ type: object ++ cinder: ++ properties: ++ fsType: ++ type: string ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ volumeID: ++ type: string ++ required: ++ - volumeID ++ type: object ++ configMap: ++ properties: ++ defaultMode: ++ format: int32 ++ type: integer ++ items: ++ items: ++ properties: ++ key: ++ type: string ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ required: ++ - key ++ - path ++ type: object ++ type: array ++ name: ++ type: string ++ optional: ++ type: boolean ++ type: object ++ x-kubernetes-map-type: atomic ++ csi: ++ properties: ++ driver: ++ type: string ++ fsType: ++ type: string ++ nodePublishSecretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ readOnly: ++ type: boolean ++ volumeAttributes: ++ additionalProperties: ++ type: string ++ type: object ++ required: ++ - driver ++ type: object ++ downwardAPI: ++ properties: ++ defaultMode: ++ format: int32 ++ type: integer ++ items: ++ items: ++ properties: ++ fieldRef: ++ properties: ++ apiVersion: ++ type: string ++ fieldPath: ++ type: string ++ required: ++ - fieldPath ++ type: object ++ x-kubernetes-map-type: atomic ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ resourceFieldRef: ++ properties: ++ containerName: ++ type: string ++ divisor: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ resource: ++ type: string ++ required: ++ - resource ++ type: object ++ x-kubernetes-map-type: atomic ++ required: ++ - path ++ type: object ++ type: array ++ type: object ++ emptyDir: ++ properties: ++ medium: ++ type: string ++ sizeLimit: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ type: object ++ ephemeral: ++ properties: ++ volumeClaimTemplate: ++ properties: ++ metadata: ++ properties: ++ annotations: ++ additionalProperties: ++ type: string ++ type: object ++ finalizers: ++ items: ++ type: string ++ type: array ++ labels: ++ additionalProperties: ++ type: string ++ type: object ++ name: ++ type: string ++ namespace: ++ type: string ++ type: object ++ spec: ++ properties: ++ accessModes: ++ items: ++ type: string ++ type: array ++ dataSource: ++ properties: ++ apiGroup: ++ type: string ++ kind: ++ type: string ++ name: ++ type: string ++ required: ++ - kind ++ - name ++ type: object ++ x-kubernetes-map-type: atomic ++ dataSourceRef: ++ properties: ++ apiGroup: ++ type: string ++ kind: ++ type: string ++ name: ++ type: string ++ required: ++ - kind ++ - name ++ type: object ++ x-kubernetes-map-type: atomic ++ resources: ++ properties: ++ limits: ++ additionalProperties: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ type: object ++ requests: ++ additionalProperties: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ type: object ++ type: object ++ selector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ storageClassName: ++ type: string ++ volumeMode: ++ type: string ++ volumeName: ++ type: string ++ type: object ++ required: ++ - spec ++ type: object ++ type: object ++ fc: ++ properties: ++ fsType: ++ type: string ++ lun: ++ format: int32 ++ type: integer ++ readOnly: ++ type: boolean ++ targetWWNs: ++ items: ++ type: string ++ type: array ++ wwids: ++ items: ++ type: string ++ type: array ++ type: object ++ flexVolume: ++ properties: ++ driver: ++ type: string ++ fsType: ++ type: string ++ options: ++ additionalProperties: ++ type: string ++ type: object ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ required: ++ - driver ++ type: object ++ flocker: ++ properties: ++ datasetName: ++ type: string ++ datasetUUID: ++ type: string ++ type: object ++ gcePersistentDisk: ++ properties: ++ fsType: ++ type: string ++ partition: ++ format: int32 ++ type: integer ++ pdName: ++ type: string ++ readOnly: ++ type: boolean ++ required: ++ - pdName ++ type: object ++ gitRepo: ++ properties: ++ directory: ++ type: string ++ repository: ++ type: string ++ revision: ++ type: string ++ required: ++ - repository ++ type: object ++ glusterfs: ++ properties: ++ endpoints: ++ type: string ++ path: ++ type: string ++ readOnly: ++ type: boolean ++ required: ++ - endpoints ++ - path ++ type: object ++ hostPath: ++ properties: ++ path: ++ type: string ++ type: ++ type: string ++ required: ++ - path ++ type: object ++ iscsi: ++ properties: ++ chapAuthDiscovery: ++ type: boolean ++ chapAuthSession: ++ type: boolean ++ fsType: ++ type: string ++ initiatorName: ++ type: string ++ iqn: ++ type: string ++ iscsiInterface: ++ type: string ++ lun: ++ format: int32 ++ type: integer ++ portals: ++ items: ++ type: string ++ type: array ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ targetPortal: ++ type: string ++ required: ++ - iqn ++ - lun ++ - targetPortal ++ type: object ++ name: ++ type: string ++ nfs: ++ properties: ++ path: ++ type: string ++ readOnly: ++ type: boolean ++ server: ++ type: string ++ required: ++ - path ++ - server ++ type: object ++ persistentVolumeClaim: ++ properties: ++ claimName: ++ type: string ++ readOnly: ++ type: boolean ++ required: ++ - claimName ++ type: object ++ photonPersistentDisk: ++ properties: ++ fsType: ++ type: string ++ pdID: ++ type: string ++ required: ++ - pdID ++ type: object ++ portworxVolume: ++ properties: ++ fsType: ++ type: string ++ readOnly: ++ type: boolean ++ volumeID: ++ type: string ++ required: ++ - volumeID ++ type: object ++ projected: ++ properties: ++ defaultMode: ++ format: int32 ++ type: integer ++ sources: ++ items: ++ properties: ++ configMap: ++ properties: ++ items: ++ items: ++ properties: ++ key: ++ type: string ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ required: ++ - key ++ - path ++ type: object ++ type: array ++ name: ++ type: string ++ optional: ++ type: boolean ++ type: object ++ x-kubernetes-map-type: atomic ++ downwardAPI: ++ properties: ++ items: ++ items: ++ properties: ++ fieldRef: ++ properties: ++ apiVersion: ++ type: string ++ fieldPath: ++ type: string ++ required: ++ - fieldPath ++ type: object ++ x-kubernetes-map-type: atomic ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ resourceFieldRef: ++ properties: ++ containerName: ++ type: string ++ divisor: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ resource: ++ type: string ++ required: ++ - resource ++ type: object ++ x-kubernetes-map-type: atomic ++ required: ++ - path ++ type: object ++ type: array ++ type: object ++ secret: ++ properties: ++ items: ++ items: ++ properties: ++ key: ++ type: string ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ required: ++ - key ++ - path ++ type: object ++ type: array ++ name: ++ type: string ++ optional: ++ type: boolean ++ type: object ++ x-kubernetes-map-type: atomic ++ serviceAccountToken: ++ properties: ++ audience: ++ type: string ++ expirationSeconds: ++ format: int64 ++ type: integer ++ path: ++ type: string ++ required: ++ - path ++ type: object ++ type: object ++ type: array ++ type: object ++ quobyte: ++ properties: ++ group: ++ type: string ++ readOnly: ++ type: boolean ++ registry: ++ type: string ++ tenant: ++ type: string ++ user: ++ type: string ++ volume: ++ type: string ++ required: ++ - registry ++ - volume ++ type: object ++ rbd: ++ properties: ++ fsType: ++ type: string ++ image: ++ type: string ++ keyring: ++ type: string ++ monitors: ++ items: ++ type: string ++ type: array ++ pool: ++ type: string ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ user: ++ type: string ++ required: ++ - image ++ - monitors ++ type: object ++ scaleIO: ++ properties: ++ fsType: ++ type: string ++ gateway: ++ type: string ++ protectionDomain: ++ type: string ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ sslEnabled: ++ type: boolean ++ storageMode: ++ type: string ++ storagePool: ++ type: string ++ system: ++ type: string ++ volumeName: ++ type: string ++ required: ++ - gateway ++ - secretRef ++ - system ++ type: object ++ secret: ++ properties: ++ defaultMode: ++ format: int32 ++ type: integer ++ items: ++ items: ++ properties: ++ key: ++ type: string ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ required: ++ - key ++ - path ++ type: object ++ type: array ++ optional: ++ type: boolean ++ secretName: ++ type: string ++ type: object ++ storageos: ++ properties: ++ fsType: ++ type: string ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ volumeName: ++ type: string ++ volumeNamespace: ++ type: string ++ type: object ++ vsphereVolume: ++ properties: ++ fsType: ++ type: string ++ storagePolicyID: ++ type: string ++ storagePolicyName: ++ type: string ++ volumePath: ++ type: string ++ required: ++ - volumePath ++ type: object ++ required: ++ - name ++ type: object ++ type: array ++ x-kubernetes-list-type: atomic ++ type: object ++ ingress: ++ properties: ++ affinity: ++ properties: ++ nodeAffinity: ++ properties: ++ preferredDuringSchedulingIgnoredDuringExecution: ++ items: ++ properties: ++ preference: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchFields: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ type: object ++ x-kubernetes-map-type: atomic ++ weight: ++ format: int32 ++ type: integer ++ required: ++ - preference ++ - weight ++ type: object ++ type: array ++ requiredDuringSchedulingIgnoredDuringExecution: ++ properties: ++ nodeSelectorTerms: ++ items: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchFields: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ type: object ++ x-kubernetes-map-type: atomic ++ type: array ++ required: ++ - nodeSelectorTerms ++ type: object ++ x-kubernetes-map-type: atomic ++ type: object ++ podAffinity: ++ properties: ++ preferredDuringSchedulingIgnoredDuringExecution: ++ items: ++ properties: ++ podAffinityTerm: ++ properties: ++ labelSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaceSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaces: ++ items: ++ type: string ++ type: array ++ topologyKey: ++ type: string ++ required: ++ - topologyKey ++ type: object ++ weight: ++ format: int32 ++ type: integer ++ required: ++ - podAffinityTerm ++ - weight ++ type: object ++ type: array ++ requiredDuringSchedulingIgnoredDuringExecution: ++ items: ++ properties: ++ labelSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaceSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaces: ++ items: ++ type: string ++ type: array ++ topologyKey: ++ type: string ++ required: ++ - topologyKey ++ type: object ++ type: array ++ type: object ++ podAntiAffinity: ++ properties: ++ preferredDuringSchedulingIgnoredDuringExecution: ++ items: ++ properties: ++ podAffinityTerm: ++ properties: ++ labelSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaceSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaces: ++ items: ++ type: string ++ type: array ++ topologyKey: ++ type: string ++ required: ++ - topologyKey ++ type: object ++ weight: ++ format: int32 ++ type: integer ++ required: ++ - podAffinityTerm ++ - weight ++ type: object ++ type: array ++ requiredDuringSchedulingIgnoredDuringExecution: ++ items: ++ properties: ++ labelSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaceSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaces: ++ items: ++ type: string ++ type: array ++ topologyKey: ++ type: string ++ required: ++ - topologyKey ++ type: object ++ type: array ++ type: object ++ type: object ++ annotations: ++ additionalProperties: ++ type: string ++ nullable: true ++ type: object ++ containerSecurityContext: ++ properties: ++ allowPrivilegeEscalation: ++ type: boolean ++ capabilities: ++ properties: ++ add: ++ items: ++ type: string ++ type: array ++ drop: ++ items: ++ type: string ++ type: array ++ type: object ++ privileged: ++ type: boolean ++ procMount: ++ type: string ++ readOnlyRootFilesystem: ++ type: boolean ++ runAsGroup: ++ format: int64 ++ type: integer ++ runAsNonRoot: ++ type: boolean ++ runAsUser: ++ format: int64 ++ type: integer ++ seLinuxOptions: ++ properties: ++ level: ++ type: string ++ role: ++ type: string ++ type: ++ type: string ++ user: ++ type: string ++ type: object ++ seccompProfile: ++ properties: ++ localhostProfile: ++ type: string ++ type: ++ type: string ++ required: ++ - type ++ type: object ++ windowsOptions: ++ properties: ++ gmsaCredentialSpec: ++ type: string ++ gmsaCredentialSpecName: ++ type: string ++ hostProcess: ++ type: boolean ++ runAsUserName: ++ type: string ++ type: object ++ type: object ++ enabled: ++ type: boolean ++ hosts: ++ items: ++ type: string ++ type: array ++ x-kubernetes-list-type: atomic ++ imagePullPolicy: ++ type: string ++ imagePullSecrets: ++ items: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ type: array ++ x-kubernetes-list-type: atomic ++ ingressClassName: ++ type: string ++ labels: ++ additionalProperties: ++ type: string ++ type: object ++ livenessProbe: ++ properties: ++ exec: ++ properties: ++ command: ++ items: ++ type: string ++ type: array ++ type: object ++ failureThreshold: ++ format: int32 ++ type: integer ++ grpc: ++ properties: ++ port: ++ format: int32 ++ type: integer ++ service: ++ type: string ++ required: ++ - port ++ type: object ++ httpGet: ++ properties: ++ host: ++ type: string ++ httpHeaders: ++ items: ++ properties: ++ name: ++ type: string ++ value: ++ type: string ++ required: ++ - name ++ - value ++ type: object ++ type: array ++ path: ++ type: string ++ port: ++ anyOf: ++ - type: integer ++ - type: string ++ x-kubernetes-int-or-string: true ++ scheme: ++ type: string ++ required: ++ - port ++ type: object ++ initialDelaySeconds: ++ format: int32 ++ type: integer ++ periodSeconds: ++ format: int32 ++ type: integer ++ successThreshold: ++ format: int32 ++ type: integer ++ tcpSocket: ++ properties: ++ host: ++ type: string ++ port: ++ anyOf: ++ - type: integer ++ - type: string ++ x-kubernetes-int-or-string: true ++ required: ++ - port ++ type: object ++ terminationGracePeriodSeconds: ++ format: int64 ++ type: integer ++ timeoutSeconds: ++ format: int32 ++ type: integer ++ type: object ++ openshift: ++ properties: ++ delegateUrls: ++ type: string ++ htpasswdFile: ++ type: string ++ sar: ++ type: string ++ skipLogout: ++ type: boolean ++ type: object ++ options: ++ type: object ++ x-kubernetes-preserve-unknown-fields: true ++ pathType: ++ type: string ++ resources: ++ nullable: true ++ properties: ++ limits: ++ additionalProperties: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ type: object ++ requests: ++ additionalProperties: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ type: object ++ type: object ++ secretName: ++ type: string ++ security: ++ type: string ++ securityContext: ++ properties: ++ fsGroup: ++ format: int64 ++ type: integer ++ fsGroupChangePolicy: ++ type: string ++ runAsGroup: ++ format: int64 ++ type: integer ++ runAsNonRoot: ++ type: boolean ++ runAsUser: ++ format: int64 ++ type: integer ++ seLinuxOptions: ++ properties: ++ level: ++ type: string ++ role: ++ type: string ++ type: ++ type: string ++ user: ++ type: string ++ type: object ++ seccompProfile: ++ properties: ++ localhostProfile: ++ type: string ++ type: ++ type: string ++ required: ++ - type ++ type: object ++ supplementalGroups: ++ items: ++ format: int64 ++ type: integer ++ type: array ++ sysctls: ++ items: ++ properties: ++ name: ++ type: string ++ value: ++ type: string ++ required: ++ - name ++ - value ++ type: object ++ type: array ++ windowsOptions: ++ properties: ++ gmsaCredentialSpec: ++ type: string ++ gmsaCredentialSpecName: ++ type: string ++ hostProcess: ++ type: boolean ++ runAsUserName: ++ type: string ++ type: object ++ type: object ++ serviceAccount: ++ type: string ++ tls: ++ items: ++ properties: ++ hosts: ++ items: ++ type: string ++ type: array ++ x-kubernetes-list-type: atomic ++ secretName: ++ type: string ++ type: object ++ type: array ++ x-kubernetes-list-type: atomic ++ tolerations: ++ items: ++ properties: ++ effect: ++ type: string ++ key: ++ type: string ++ operator: ++ type: string ++ tolerationSeconds: ++ format: int64 ++ type: integer ++ value: ++ type: string ++ type: object ++ type: array ++ x-kubernetes-list-type: atomic ++ volumeMounts: ++ items: ++ properties: ++ mountPath: ++ type: string ++ mountPropagation: ++ type: string ++ name: ++ type: string ++ readOnly: ++ type: boolean ++ subPath: ++ type: string ++ subPathExpr: ++ type: string ++ required: ++ - mountPath ++ - name ++ type: object ++ type: array ++ x-kubernetes-list-type: atomic ++ volumes: ++ items: ++ properties: ++ awsElasticBlockStore: ++ properties: ++ fsType: ++ type: string ++ partition: ++ format: int32 ++ type: integer ++ readOnly: ++ type: boolean ++ volumeID: ++ type: string ++ required: ++ - volumeID ++ type: object ++ azureDisk: ++ properties: ++ cachingMode: ++ type: string ++ diskName: ++ type: string ++ diskURI: ++ type: string ++ fsType: ++ type: string ++ kind: ++ type: string ++ readOnly: ++ type: boolean ++ required: ++ - diskName ++ - diskURI ++ type: object ++ azureFile: ++ properties: ++ readOnly: ++ type: boolean ++ secretName: ++ type: string ++ shareName: ++ type: string ++ required: ++ - secretName ++ - shareName ++ type: object ++ cephfs: ++ properties: ++ monitors: ++ items: ++ type: string ++ type: array ++ path: ++ type: string ++ readOnly: ++ type: boolean ++ secretFile: ++ type: string ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ user: ++ type: string ++ required: ++ - monitors ++ type: object ++ cinder: ++ properties: ++ fsType: ++ type: string ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ volumeID: ++ type: string ++ required: ++ - volumeID ++ type: object ++ configMap: ++ properties: ++ defaultMode: ++ format: int32 ++ type: integer ++ items: ++ items: ++ properties: ++ key: ++ type: string ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ required: ++ - key ++ - path ++ type: object ++ type: array ++ name: ++ type: string ++ optional: ++ type: boolean ++ type: object ++ x-kubernetes-map-type: atomic ++ csi: ++ properties: ++ driver: ++ type: string ++ fsType: ++ type: string ++ nodePublishSecretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ readOnly: ++ type: boolean ++ volumeAttributes: ++ additionalProperties: ++ type: string ++ type: object ++ required: ++ - driver ++ type: object ++ downwardAPI: ++ properties: ++ defaultMode: ++ format: int32 ++ type: integer ++ items: ++ items: ++ properties: ++ fieldRef: ++ properties: ++ apiVersion: ++ type: string ++ fieldPath: ++ type: string ++ required: ++ - fieldPath ++ type: object ++ x-kubernetes-map-type: atomic ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ resourceFieldRef: ++ properties: ++ containerName: ++ type: string ++ divisor: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ resource: ++ type: string ++ required: ++ - resource ++ type: object ++ x-kubernetes-map-type: atomic ++ required: ++ - path ++ type: object ++ type: array ++ type: object ++ emptyDir: ++ properties: ++ medium: ++ type: string ++ sizeLimit: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ type: object ++ ephemeral: ++ properties: ++ volumeClaimTemplate: ++ properties: ++ metadata: ++ properties: ++ annotations: ++ additionalProperties: ++ type: string ++ type: object ++ finalizers: ++ items: ++ type: string ++ type: array ++ labels: ++ additionalProperties: ++ type: string ++ type: object ++ name: ++ type: string ++ namespace: ++ type: string ++ type: object ++ spec: ++ properties: ++ accessModes: ++ items: ++ type: string ++ type: array ++ dataSource: ++ properties: ++ apiGroup: ++ type: string ++ kind: ++ type: string ++ name: ++ type: string ++ required: ++ - kind ++ - name ++ type: object ++ x-kubernetes-map-type: atomic ++ dataSourceRef: ++ properties: ++ apiGroup: ++ type: string ++ kind: ++ type: string ++ name: ++ type: string ++ required: ++ - kind ++ - name ++ type: object ++ x-kubernetes-map-type: atomic ++ resources: ++ properties: ++ limits: ++ additionalProperties: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ type: object ++ requests: ++ additionalProperties: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ type: object ++ type: object ++ selector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ storageClassName: ++ type: string ++ volumeMode: ++ type: string ++ volumeName: ++ type: string ++ type: object ++ required: ++ - spec ++ type: object ++ type: object ++ fc: ++ properties: ++ fsType: ++ type: string ++ lun: ++ format: int32 ++ type: integer ++ readOnly: ++ type: boolean ++ targetWWNs: ++ items: ++ type: string ++ type: array ++ wwids: ++ items: ++ type: string ++ type: array ++ type: object ++ flexVolume: ++ properties: ++ driver: ++ type: string ++ fsType: ++ type: string ++ options: ++ additionalProperties: ++ type: string ++ type: object ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ required: ++ - driver ++ type: object ++ flocker: ++ properties: ++ datasetName: ++ type: string ++ datasetUUID: ++ type: string ++ type: object ++ gcePersistentDisk: ++ properties: ++ fsType: ++ type: string ++ partition: ++ format: int32 ++ type: integer ++ pdName: ++ type: string ++ readOnly: ++ type: boolean ++ required: ++ - pdName ++ type: object ++ gitRepo: ++ properties: ++ directory: ++ type: string ++ repository: ++ type: string ++ revision: ++ type: string ++ required: ++ - repository ++ type: object ++ glusterfs: ++ properties: ++ endpoints: ++ type: string ++ path: ++ type: string ++ readOnly: ++ type: boolean ++ required: ++ - endpoints ++ - path ++ type: object ++ hostPath: ++ properties: ++ path: ++ type: string ++ type: ++ type: string ++ required: ++ - path ++ type: object ++ iscsi: ++ properties: ++ chapAuthDiscovery: ++ type: boolean ++ chapAuthSession: ++ type: boolean ++ fsType: ++ type: string ++ initiatorName: ++ type: string ++ iqn: ++ type: string ++ iscsiInterface: ++ type: string ++ lun: ++ format: int32 ++ type: integer ++ portals: ++ items: ++ type: string ++ type: array ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ targetPortal: ++ type: string ++ required: ++ - iqn ++ - lun ++ - targetPortal ++ type: object ++ name: ++ type: string ++ nfs: ++ properties: ++ path: ++ type: string ++ readOnly: ++ type: boolean ++ server: ++ type: string ++ required: ++ - path ++ - server ++ type: object ++ persistentVolumeClaim: ++ properties: ++ claimName: ++ type: string ++ readOnly: ++ type: boolean ++ required: ++ - claimName ++ type: object ++ photonPersistentDisk: ++ properties: ++ fsType: ++ type: string ++ pdID: ++ type: string ++ required: ++ - pdID ++ type: object ++ portworxVolume: ++ properties: ++ fsType: ++ type: string ++ readOnly: ++ type: boolean ++ volumeID: ++ type: string ++ required: ++ - volumeID ++ type: object ++ projected: ++ properties: ++ defaultMode: ++ format: int32 ++ type: integer ++ sources: ++ items: ++ properties: ++ configMap: ++ properties: ++ items: ++ items: ++ properties: ++ key: ++ type: string ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ required: ++ - key ++ - path ++ type: object ++ type: array ++ name: ++ type: string ++ optional: ++ type: boolean ++ type: object ++ x-kubernetes-map-type: atomic ++ downwardAPI: ++ properties: ++ items: ++ items: ++ properties: ++ fieldRef: ++ properties: ++ apiVersion: ++ type: string ++ fieldPath: ++ type: string ++ required: ++ - fieldPath ++ type: object ++ x-kubernetes-map-type: atomic ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ resourceFieldRef: ++ properties: ++ containerName: ++ type: string ++ divisor: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ resource: ++ type: string ++ required: ++ - resource ++ type: object ++ x-kubernetes-map-type: atomic ++ required: ++ - path ++ type: object ++ type: array ++ type: object ++ secret: ++ properties: ++ items: ++ items: ++ properties: ++ key: ++ type: string ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ required: ++ - key ++ - path ++ type: object ++ type: array ++ name: ++ type: string ++ optional: ++ type: boolean ++ type: object ++ x-kubernetes-map-type: atomic ++ serviceAccountToken: ++ properties: ++ audience: ++ type: string ++ expirationSeconds: ++ format: int64 ++ type: integer ++ path: ++ type: string ++ required: ++ - path ++ type: object ++ type: object ++ type: array ++ type: object ++ quobyte: ++ properties: ++ group: ++ type: string ++ readOnly: ++ type: boolean ++ registry: ++ type: string ++ tenant: ++ type: string ++ user: ++ type: string ++ volume: ++ type: string ++ required: ++ - registry ++ - volume ++ type: object ++ rbd: ++ properties: ++ fsType: ++ type: string ++ image: ++ type: string ++ keyring: ++ type: string ++ monitors: ++ items: ++ type: string ++ type: array ++ pool: ++ type: string ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ user: ++ type: string ++ required: ++ - image ++ - monitors ++ type: object ++ scaleIO: ++ properties: ++ fsType: ++ type: string ++ gateway: ++ type: string ++ protectionDomain: ++ type: string ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ sslEnabled: ++ type: boolean ++ storageMode: ++ type: string ++ storagePool: ++ type: string ++ system: ++ type: string ++ volumeName: ++ type: string ++ required: ++ - gateway ++ - secretRef ++ - system ++ type: object ++ secret: ++ properties: ++ defaultMode: ++ format: int32 ++ type: integer ++ items: ++ items: ++ properties: ++ key: ++ type: string ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ required: ++ - key ++ - path ++ type: object ++ type: array ++ optional: ++ type: boolean ++ secretName: ++ type: string ++ type: object ++ storageos: ++ properties: ++ fsType: ++ type: string ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ volumeName: ++ type: string ++ volumeNamespace: ++ type: string ++ type: object ++ vsphereVolume: ++ properties: ++ fsType: ++ type: string ++ storagePolicyID: ++ type: string ++ storagePolicyName: ++ type: string ++ volumePath: ++ type: string ++ required: ++ - volumePath ++ type: object ++ required: ++ - name ++ type: object ++ type: array ++ x-kubernetes-list-type: atomic ++ type: object ++ labels: ++ additionalProperties: ++ type: string ++ type: object ++ livenessProbe: ++ properties: ++ exec: ++ properties: ++ command: ++ items: ++ type: string ++ type: array ++ type: object ++ failureThreshold: ++ format: int32 ++ type: integer ++ grpc: ++ properties: ++ port: ++ format: int32 ++ type: integer ++ service: ++ type: string ++ required: ++ - port ++ type: object ++ httpGet: ++ properties: ++ host: ++ type: string ++ httpHeaders: ++ items: ++ properties: ++ name: ++ type: string ++ value: ++ type: string ++ required: ++ - name ++ - value ++ type: object ++ type: array ++ path: ++ type: string ++ port: ++ anyOf: ++ - type: integer ++ - type: string ++ x-kubernetes-int-or-string: true ++ scheme: ++ type: string ++ required: ++ - port ++ type: object ++ initialDelaySeconds: ++ format: int32 ++ type: integer ++ periodSeconds: ++ format: int32 ++ type: integer ++ successThreshold: ++ format: int32 ++ type: integer ++ tcpSocket: ++ properties: ++ host: ++ type: string ++ port: ++ anyOf: ++ - type: integer ++ - type: string ++ x-kubernetes-int-or-string: true ++ required: ++ - port ++ type: object ++ terminationGracePeriodSeconds: ++ format: int64 ++ type: integer ++ timeoutSeconds: ++ format: int32 ++ type: integer ++ type: object ++ query: ++ properties: ++ affinity: ++ properties: ++ nodeAffinity: ++ properties: ++ preferredDuringSchedulingIgnoredDuringExecution: ++ items: ++ properties: ++ preference: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchFields: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ type: object ++ x-kubernetes-map-type: atomic ++ weight: ++ format: int32 ++ type: integer ++ required: ++ - preference ++ - weight ++ type: object ++ type: array ++ requiredDuringSchedulingIgnoredDuringExecution: ++ properties: ++ nodeSelectorTerms: ++ items: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchFields: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ type: object ++ x-kubernetes-map-type: atomic ++ type: array ++ required: ++ - nodeSelectorTerms ++ type: object ++ x-kubernetes-map-type: atomic ++ type: object ++ podAffinity: ++ properties: ++ preferredDuringSchedulingIgnoredDuringExecution: ++ items: ++ properties: ++ podAffinityTerm: ++ properties: ++ labelSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaceSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaces: ++ items: ++ type: string ++ type: array ++ topologyKey: ++ type: string ++ required: ++ - topologyKey ++ type: object ++ weight: ++ format: int32 ++ type: integer ++ required: ++ - podAffinityTerm ++ - weight ++ type: object ++ type: array ++ requiredDuringSchedulingIgnoredDuringExecution: ++ items: ++ properties: ++ labelSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaceSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaces: ++ items: ++ type: string ++ type: array ++ topologyKey: ++ type: string ++ required: ++ - topologyKey ++ type: object ++ type: array ++ type: object ++ podAntiAffinity: ++ properties: ++ preferredDuringSchedulingIgnoredDuringExecution: ++ items: ++ properties: ++ podAffinityTerm: ++ properties: ++ labelSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaceSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaces: ++ items: ++ type: string ++ type: array ++ topologyKey: ++ type: string ++ required: ++ - topologyKey ++ type: object ++ weight: ++ format: int32 ++ type: integer ++ required: ++ - podAffinityTerm ++ - weight ++ type: object ++ type: array ++ requiredDuringSchedulingIgnoredDuringExecution: ++ items: ++ properties: ++ labelSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaceSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaces: ++ items: ++ type: string ++ type: array ++ topologyKey: ++ type: string ++ required: ++ - topologyKey ++ type: object ++ type: array ++ type: object ++ type: object ++ annotations: ++ additionalProperties: ++ type: string ++ nullable: true ++ type: object ++ containerSecurityContext: ++ properties: ++ allowPrivilegeEscalation: ++ type: boolean ++ capabilities: ++ properties: ++ add: ++ items: ++ type: string ++ type: array ++ drop: ++ items: ++ type: string ++ type: array ++ type: object ++ privileged: ++ type: boolean ++ procMount: ++ type: string ++ readOnlyRootFilesystem: ++ type: boolean ++ runAsGroup: ++ format: int64 ++ type: integer ++ runAsNonRoot: ++ type: boolean ++ runAsUser: ++ format: int64 ++ type: integer ++ seLinuxOptions: ++ properties: ++ level: ++ type: string ++ role: ++ type: string ++ type: ++ type: string ++ user: ++ type: string ++ type: object ++ seccompProfile: ++ properties: ++ localhostProfile: ++ type: string ++ type: ++ type: string ++ required: ++ - type ++ type: object ++ windowsOptions: ++ properties: ++ gmsaCredentialSpec: ++ type: string ++ gmsaCredentialSpecName: ++ type: string ++ hostProcess: ++ type: boolean ++ runAsUserName: ++ type: string ++ type: object ++ type: object ++ grpcNodePort: ++ format: int32 ++ type: integer ++ image: ++ type: string ++ imagePullPolicy: ++ type: string ++ imagePullSecrets: ++ items: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ type: array ++ x-kubernetes-list-type: atomic ++ labels: ++ additionalProperties: ++ type: string ++ type: object ++ livenessProbe: ++ properties: ++ exec: ++ properties: ++ command: ++ items: ++ type: string ++ type: array ++ type: object ++ failureThreshold: ++ format: int32 ++ type: integer ++ grpc: ++ properties: ++ port: ++ format: int32 ++ type: integer ++ service: ++ type: string ++ required: ++ - port ++ type: object ++ httpGet: ++ properties: ++ host: ++ type: string ++ httpHeaders: ++ items: ++ properties: ++ name: ++ type: string ++ value: ++ type: string ++ required: ++ - name ++ - value ++ type: object ++ type: array ++ path: ++ type: string ++ port: ++ anyOf: ++ - type: integer ++ - type: string ++ x-kubernetes-int-or-string: true ++ scheme: ++ type: string ++ required: ++ - port ++ type: object ++ initialDelaySeconds: ++ format: int32 ++ type: integer ++ periodSeconds: ++ format: int32 ++ type: integer ++ successThreshold: ++ format: int32 ++ type: integer ++ tcpSocket: ++ properties: ++ host: ++ type: string ++ port: ++ anyOf: ++ - type: integer ++ - type: string ++ x-kubernetes-int-or-string: true ++ required: ++ - port ++ type: object ++ terminationGracePeriodSeconds: ++ format: int64 ++ type: integer ++ timeoutSeconds: ++ format: int32 ++ type: integer ++ type: object ++ metricsStorage: ++ properties: ++ type: ++ type: string ++ type: object ++ nodePort: ++ format: int32 ++ type: integer ++ options: ++ type: object ++ x-kubernetes-preserve-unknown-fields: true ++ priorityClassName: ++ type: string ++ replicas: ++ format: int32 ++ type: integer ++ resources: ++ nullable: true ++ properties: ++ limits: ++ additionalProperties: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ type: object ++ requests: ++ additionalProperties: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ type: object ++ type: object ++ securityContext: ++ properties: ++ fsGroup: ++ format: int64 ++ type: integer ++ fsGroupChangePolicy: ++ type: string ++ runAsGroup: ++ format: int64 ++ type: integer ++ runAsNonRoot: ++ type: boolean ++ runAsUser: ++ format: int64 ++ type: integer ++ seLinuxOptions: ++ properties: ++ level: ++ type: string ++ role: ++ type: string ++ type: ++ type: string ++ user: ++ type: string ++ type: object ++ seccompProfile: ++ properties: ++ localhostProfile: ++ type: string ++ type: ++ type: string ++ required: ++ - type ++ type: object ++ supplementalGroups: ++ items: ++ format: int64 ++ type: integer ++ type: array ++ sysctls: ++ items: ++ properties: ++ name: ++ type: string ++ value: ++ type: string ++ required: ++ - name ++ - value ++ type: object ++ type: array ++ windowsOptions: ++ properties: ++ gmsaCredentialSpec: ++ type: string ++ gmsaCredentialSpecName: ++ type: string ++ hostProcess: ++ type: boolean ++ runAsUserName: ++ type: string ++ type: object ++ type: object ++ serviceAccount: ++ type: string ++ serviceType: ++ type: string ++ strategy: ++ properties: ++ rollingUpdate: ++ properties: ++ maxSurge: ++ anyOf: ++ - type: integer ++ - type: string ++ x-kubernetes-int-or-string: true ++ maxUnavailable: ++ anyOf: ++ - type: integer ++ - type: string ++ x-kubernetes-int-or-string: true ++ type: object ++ type: ++ type: string ++ type: object ++ tolerations: ++ items: ++ properties: ++ effect: ++ type: string ++ key: ++ type: string ++ operator: ++ type: string ++ tolerationSeconds: ++ format: int64 ++ type: integer ++ value: ++ type: string ++ type: object ++ type: array ++ x-kubernetes-list-type: atomic ++ tracingEnabled: ++ type: boolean ++ volumeMounts: ++ items: ++ properties: ++ mountPath: ++ type: string ++ mountPropagation: ++ type: string ++ name: ++ type: string ++ readOnly: ++ type: boolean ++ subPath: ++ type: string ++ subPathExpr: ++ type: string ++ required: ++ - mountPath ++ - name ++ type: object ++ type: array ++ x-kubernetes-list-type: atomic ++ volumes: ++ items: ++ properties: ++ awsElasticBlockStore: ++ properties: ++ fsType: ++ type: string ++ partition: ++ format: int32 ++ type: integer ++ readOnly: ++ type: boolean ++ volumeID: ++ type: string ++ required: ++ - volumeID ++ type: object ++ azureDisk: ++ properties: ++ cachingMode: ++ type: string ++ diskName: ++ type: string ++ diskURI: ++ type: string ++ fsType: ++ type: string ++ kind: ++ type: string ++ readOnly: ++ type: boolean ++ required: ++ - diskName ++ - diskURI ++ type: object ++ azureFile: ++ properties: ++ readOnly: ++ type: boolean ++ secretName: ++ type: string ++ shareName: ++ type: string ++ required: ++ - secretName ++ - shareName ++ type: object ++ cephfs: ++ properties: ++ monitors: ++ items: ++ type: string ++ type: array ++ path: ++ type: string ++ readOnly: ++ type: boolean ++ secretFile: ++ type: string ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ user: ++ type: string ++ required: ++ - monitors ++ type: object ++ cinder: ++ properties: ++ fsType: ++ type: string ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ volumeID: ++ type: string ++ required: ++ - volumeID ++ type: object ++ configMap: ++ properties: ++ defaultMode: ++ format: int32 ++ type: integer ++ items: ++ items: ++ properties: ++ key: ++ type: string ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ required: ++ - key ++ - path ++ type: object ++ type: array ++ name: ++ type: string ++ optional: ++ type: boolean ++ type: object ++ x-kubernetes-map-type: atomic ++ csi: ++ properties: ++ driver: ++ type: string ++ fsType: ++ type: string ++ nodePublishSecretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ readOnly: ++ type: boolean ++ volumeAttributes: ++ additionalProperties: ++ type: string ++ type: object ++ required: ++ - driver ++ type: object ++ downwardAPI: ++ properties: ++ defaultMode: ++ format: int32 ++ type: integer ++ items: ++ items: ++ properties: ++ fieldRef: ++ properties: ++ apiVersion: ++ type: string ++ fieldPath: ++ type: string ++ required: ++ - fieldPath ++ type: object ++ x-kubernetes-map-type: atomic ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ resourceFieldRef: ++ properties: ++ containerName: ++ type: string ++ divisor: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ resource: ++ type: string ++ required: ++ - resource ++ type: object ++ x-kubernetes-map-type: atomic ++ required: ++ - path ++ type: object ++ type: array ++ type: object ++ emptyDir: ++ properties: ++ medium: ++ type: string ++ sizeLimit: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ type: object ++ ephemeral: ++ properties: ++ volumeClaimTemplate: ++ properties: ++ metadata: ++ properties: ++ annotations: ++ additionalProperties: ++ type: string ++ type: object ++ finalizers: ++ items: ++ type: string ++ type: array ++ labels: ++ additionalProperties: ++ type: string ++ type: object ++ name: ++ type: string ++ namespace: ++ type: string ++ type: object ++ spec: ++ properties: ++ accessModes: ++ items: ++ type: string ++ type: array ++ dataSource: ++ properties: ++ apiGroup: ++ type: string ++ kind: ++ type: string ++ name: ++ type: string ++ required: ++ - kind ++ - name ++ type: object ++ x-kubernetes-map-type: atomic ++ dataSourceRef: ++ properties: ++ apiGroup: ++ type: string ++ kind: ++ type: string ++ name: ++ type: string ++ required: ++ - kind ++ - name ++ type: object ++ x-kubernetes-map-type: atomic ++ resources: ++ properties: ++ limits: ++ additionalProperties: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ type: object ++ requests: ++ additionalProperties: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ type: object ++ type: object ++ selector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ storageClassName: ++ type: string ++ volumeMode: ++ type: string ++ volumeName: ++ type: string ++ type: object ++ required: ++ - spec ++ type: object ++ type: object ++ fc: ++ properties: ++ fsType: ++ type: string ++ lun: ++ format: int32 ++ type: integer ++ readOnly: ++ type: boolean ++ targetWWNs: ++ items: ++ type: string ++ type: array ++ wwids: ++ items: ++ type: string ++ type: array ++ type: object ++ flexVolume: ++ properties: ++ driver: ++ type: string ++ fsType: ++ type: string ++ options: ++ additionalProperties: ++ type: string ++ type: object ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ required: ++ - driver ++ type: object ++ flocker: ++ properties: ++ datasetName: ++ type: string ++ datasetUUID: ++ type: string ++ type: object ++ gcePersistentDisk: ++ properties: ++ fsType: ++ type: string ++ partition: ++ format: int32 ++ type: integer ++ pdName: ++ type: string ++ readOnly: ++ type: boolean ++ required: ++ - pdName ++ type: object ++ gitRepo: ++ properties: ++ directory: ++ type: string ++ repository: ++ type: string ++ revision: ++ type: string ++ required: ++ - repository ++ type: object ++ glusterfs: ++ properties: ++ endpoints: ++ type: string ++ path: ++ type: string ++ readOnly: ++ type: boolean ++ required: ++ - endpoints ++ - path ++ type: object ++ hostPath: ++ properties: ++ path: ++ type: string ++ type: ++ type: string ++ required: ++ - path ++ type: object ++ iscsi: ++ properties: ++ chapAuthDiscovery: ++ type: boolean ++ chapAuthSession: ++ type: boolean ++ fsType: ++ type: string ++ initiatorName: ++ type: string ++ iqn: ++ type: string ++ iscsiInterface: ++ type: string ++ lun: ++ format: int32 ++ type: integer ++ portals: ++ items: ++ type: string ++ type: array ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ targetPortal: ++ type: string ++ required: ++ - iqn ++ - lun ++ - targetPortal ++ type: object ++ name: ++ type: string ++ nfs: ++ properties: ++ path: ++ type: string ++ readOnly: ++ type: boolean ++ server: ++ type: string ++ required: ++ - path ++ - server ++ type: object ++ persistentVolumeClaim: ++ properties: ++ claimName: ++ type: string ++ readOnly: ++ type: boolean ++ required: ++ - claimName ++ type: object ++ photonPersistentDisk: ++ properties: ++ fsType: ++ type: string ++ pdID: ++ type: string ++ required: ++ - pdID ++ type: object ++ portworxVolume: ++ properties: ++ fsType: ++ type: string ++ readOnly: ++ type: boolean ++ volumeID: ++ type: string ++ required: ++ - volumeID ++ type: object ++ projected: ++ properties: ++ defaultMode: ++ format: int32 ++ type: integer ++ sources: ++ items: ++ properties: ++ configMap: ++ properties: ++ items: ++ items: ++ properties: ++ key: ++ type: string ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ required: ++ - key ++ - path ++ type: object ++ type: array ++ name: ++ type: string ++ optional: ++ type: boolean ++ type: object ++ x-kubernetes-map-type: atomic ++ downwardAPI: ++ properties: ++ items: ++ items: ++ properties: ++ fieldRef: ++ properties: ++ apiVersion: ++ type: string ++ fieldPath: ++ type: string ++ required: ++ - fieldPath ++ type: object ++ x-kubernetes-map-type: atomic ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ resourceFieldRef: ++ properties: ++ containerName: ++ type: string ++ divisor: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ resource: ++ type: string ++ required: ++ - resource ++ type: object ++ x-kubernetes-map-type: atomic ++ required: ++ - path ++ type: object ++ type: array ++ type: object ++ secret: ++ properties: ++ items: ++ items: ++ properties: ++ key: ++ type: string ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ required: ++ - key ++ - path ++ type: object ++ type: array ++ name: ++ type: string ++ optional: ++ type: boolean ++ type: object ++ x-kubernetes-map-type: atomic ++ serviceAccountToken: ++ properties: ++ audience: ++ type: string ++ expirationSeconds: ++ format: int64 ++ type: integer ++ path: ++ type: string ++ required: ++ - path ++ type: object ++ type: object ++ type: array ++ type: object ++ quobyte: ++ properties: ++ group: ++ type: string ++ readOnly: ++ type: boolean ++ registry: ++ type: string ++ tenant: ++ type: string ++ user: ++ type: string ++ volume: ++ type: string ++ required: ++ - registry ++ - volume ++ type: object ++ rbd: ++ properties: ++ fsType: ++ type: string ++ image: ++ type: string ++ keyring: ++ type: string ++ monitors: ++ items: ++ type: string ++ type: array ++ pool: ++ type: string ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ user: ++ type: string ++ required: ++ - image ++ - monitors ++ type: object ++ scaleIO: ++ properties: ++ fsType: ++ type: string ++ gateway: ++ type: string ++ protectionDomain: ++ type: string ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ sslEnabled: ++ type: boolean ++ storageMode: ++ type: string ++ storagePool: ++ type: string ++ system: ++ type: string ++ volumeName: ++ type: string ++ required: ++ - gateway ++ - secretRef ++ - system ++ type: object ++ secret: ++ properties: ++ defaultMode: ++ format: int32 ++ type: integer ++ items: ++ items: ++ properties: ++ key: ++ type: string ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ required: ++ - key ++ - path ++ type: object ++ type: array ++ optional: ++ type: boolean ++ secretName: ++ type: string ++ type: object ++ storageos: ++ properties: ++ fsType: ++ type: string ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ volumeName: ++ type: string ++ volumeNamespace: ++ type: string ++ type: object ++ vsphereVolume: ++ properties: ++ fsType: ++ type: string ++ storagePolicyID: ++ type: string ++ storagePolicyName: ++ type: string ++ volumePath: ++ type: string ++ required: ++ - volumePath ++ type: object ++ required: ++ - name ++ type: object ++ type: array ++ x-kubernetes-list-type: atomic ++ type: object ++ resources: ++ nullable: true ++ properties: ++ limits: ++ additionalProperties: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ type: object ++ requests: ++ additionalProperties: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ type: object ++ type: object ++ sampling: ++ properties: ++ options: ++ type: object ++ x-kubernetes-preserve-unknown-fields: true ++ type: object ++ securityContext: ++ properties: ++ fsGroup: ++ format: int64 ++ type: integer ++ fsGroupChangePolicy: ++ type: string ++ runAsGroup: ++ format: int64 ++ type: integer ++ runAsNonRoot: ++ type: boolean ++ runAsUser: ++ format: int64 ++ type: integer ++ seLinuxOptions: ++ properties: ++ level: ++ type: string ++ role: ++ type: string ++ type: ++ type: string ++ user: ++ type: string ++ type: object ++ seccompProfile: ++ properties: ++ localhostProfile: ++ type: string ++ type: ++ type: string ++ required: ++ - type ++ type: object ++ supplementalGroups: ++ items: ++ format: int64 ++ type: integer ++ type: array ++ sysctls: ++ items: ++ properties: ++ name: ++ type: string ++ value: ++ type: string ++ required: ++ - name ++ - value ++ type: object ++ type: array ++ windowsOptions: ++ properties: ++ gmsaCredentialSpec: ++ type: string ++ gmsaCredentialSpecName: ++ type: string ++ hostProcess: ++ type: boolean ++ runAsUserName: ++ type: string ++ type: object ++ type: object ++ serviceAccount: ++ type: string ++ storage: ++ properties: ++ cassandraCreateSchema: ++ properties: ++ affinity: ++ properties: ++ nodeAffinity: ++ properties: ++ preferredDuringSchedulingIgnoredDuringExecution: ++ items: ++ properties: ++ preference: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchFields: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ type: object ++ x-kubernetes-map-type: atomic ++ weight: ++ format: int32 ++ type: integer ++ required: ++ - preference ++ - weight ++ type: object ++ type: array ++ requiredDuringSchedulingIgnoredDuringExecution: ++ properties: ++ nodeSelectorTerms: ++ items: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchFields: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ type: object ++ x-kubernetes-map-type: atomic ++ type: array ++ required: ++ - nodeSelectorTerms ++ type: object ++ x-kubernetes-map-type: atomic ++ type: object ++ podAffinity: ++ properties: ++ preferredDuringSchedulingIgnoredDuringExecution: ++ items: ++ properties: ++ podAffinityTerm: ++ properties: ++ labelSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaceSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaces: ++ items: ++ type: string ++ type: array ++ topologyKey: ++ type: string ++ required: ++ - topologyKey ++ type: object ++ weight: ++ format: int32 ++ type: integer ++ required: ++ - podAffinityTerm ++ - weight ++ type: object ++ type: array ++ requiredDuringSchedulingIgnoredDuringExecution: ++ items: ++ properties: ++ labelSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaceSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaces: ++ items: ++ type: string ++ type: array ++ topologyKey: ++ type: string ++ required: ++ - topologyKey ++ type: object ++ type: array ++ type: object ++ podAntiAffinity: ++ properties: ++ preferredDuringSchedulingIgnoredDuringExecution: ++ items: ++ properties: ++ podAffinityTerm: ++ properties: ++ labelSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaceSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaces: ++ items: ++ type: string ++ type: array ++ topologyKey: ++ type: string ++ required: ++ - topologyKey ++ type: object ++ weight: ++ format: int32 ++ type: integer ++ required: ++ - podAffinityTerm ++ - weight ++ type: object ++ type: array ++ requiredDuringSchedulingIgnoredDuringExecution: ++ items: ++ properties: ++ labelSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaceSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaces: ++ items: ++ type: string ++ type: array ++ topologyKey: ++ type: string ++ required: ++ - topologyKey ++ type: object ++ type: array ++ type: object ++ type: object ++ datacenter: ++ type: string ++ enabled: ++ type: boolean ++ image: ++ type: string ++ mode: ++ type: string ++ timeout: ++ type: string ++ traceTTL: ++ type: string ++ ttlSecondsAfterFinished: ++ format: int32 ++ type: integer ++ type: object ++ dependencies: ++ properties: ++ affinity: ++ properties: ++ nodeAffinity: ++ properties: ++ preferredDuringSchedulingIgnoredDuringExecution: ++ items: ++ properties: ++ preference: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchFields: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ type: object ++ x-kubernetes-map-type: atomic ++ weight: ++ format: int32 ++ type: integer ++ required: ++ - preference ++ - weight ++ type: object ++ type: array ++ requiredDuringSchedulingIgnoredDuringExecution: ++ properties: ++ nodeSelectorTerms: ++ items: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchFields: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ type: object ++ x-kubernetes-map-type: atomic ++ type: array ++ required: ++ - nodeSelectorTerms ++ type: object ++ x-kubernetes-map-type: atomic ++ type: object ++ podAffinity: ++ properties: ++ preferredDuringSchedulingIgnoredDuringExecution: ++ items: ++ properties: ++ podAffinityTerm: ++ properties: ++ labelSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaceSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaces: ++ items: ++ type: string ++ type: array ++ topologyKey: ++ type: string ++ required: ++ - topologyKey ++ type: object ++ weight: ++ format: int32 ++ type: integer ++ required: ++ - podAffinityTerm ++ - weight ++ type: object ++ type: array ++ requiredDuringSchedulingIgnoredDuringExecution: ++ items: ++ properties: ++ labelSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaceSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaces: ++ items: ++ type: string ++ type: array ++ topologyKey: ++ type: string ++ required: ++ - topologyKey ++ type: object ++ type: array ++ type: object ++ podAntiAffinity: ++ properties: ++ preferredDuringSchedulingIgnoredDuringExecution: ++ items: ++ properties: ++ podAffinityTerm: ++ properties: ++ labelSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaceSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaces: ++ items: ++ type: string ++ type: array ++ topologyKey: ++ type: string ++ required: ++ - topologyKey ++ type: object ++ weight: ++ format: int32 ++ type: integer ++ required: ++ - podAffinityTerm ++ - weight ++ type: object ++ type: array ++ requiredDuringSchedulingIgnoredDuringExecution: ++ items: ++ properties: ++ labelSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaceSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaces: ++ items: ++ type: string ++ type: array ++ topologyKey: ++ type: string ++ required: ++ - topologyKey ++ type: object ++ type: array ++ type: object ++ type: object ++ annotations: ++ additionalProperties: ++ type: string ++ nullable: true ++ type: object ++ backoffLimit: ++ format: int32 ++ type: integer ++ cassandraClientAuthEnabled: ++ type: boolean ++ containerSecurityContext: ++ properties: ++ allowPrivilegeEscalation: ++ type: boolean ++ capabilities: ++ properties: ++ add: ++ items: ++ type: string ++ type: array ++ drop: ++ items: ++ type: string ++ type: array ++ type: object ++ privileged: ++ type: boolean ++ procMount: ++ type: string ++ readOnlyRootFilesystem: ++ type: boolean ++ runAsGroup: ++ format: int64 ++ type: integer ++ runAsNonRoot: ++ type: boolean ++ runAsUser: ++ format: int64 ++ type: integer ++ seLinuxOptions: ++ properties: ++ level: ++ type: string ++ role: ++ type: string ++ type: ++ type: string ++ user: ++ type: string ++ type: object ++ seccompProfile: ++ properties: ++ localhostProfile: ++ type: string ++ type: ++ type: string ++ required: ++ - type ++ type: object ++ windowsOptions: ++ properties: ++ gmsaCredentialSpec: ++ type: string ++ gmsaCredentialSpecName: ++ type: string ++ hostProcess: ++ type: boolean ++ runAsUserName: ++ type: string ++ type: object ++ type: object ++ elasticsearchClientNodeOnly: ++ type: boolean ++ elasticsearchNodesWanOnly: ++ type: boolean ++ elasticsearchTimeRange: ++ type: string ++ enabled: ++ type: boolean ++ image: ++ type: string ++ imagePullPolicy: ++ type: string ++ imagePullSecrets: ++ items: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ type: array ++ x-kubernetes-list-type: atomic ++ javaOpts: ++ type: string ++ labels: ++ additionalProperties: ++ type: string ++ type: object ++ livenessProbe: ++ properties: ++ exec: ++ properties: ++ command: ++ items: ++ type: string ++ type: array ++ type: object ++ failureThreshold: ++ format: int32 ++ type: integer ++ grpc: ++ properties: ++ port: ++ format: int32 ++ type: integer ++ service: ++ type: string ++ required: ++ - port ++ type: object ++ httpGet: ++ properties: ++ host: ++ type: string ++ httpHeaders: ++ items: ++ properties: ++ name: ++ type: string ++ value: ++ type: string ++ required: ++ - name ++ - value ++ type: object ++ type: array ++ path: ++ type: string ++ port: ++ anyOf: ++ - type: integer ++ - type: string ++ x-kubernetes-int-or-string: true ++ scheme: ++ type: string ++ required: ++ - port ++ type: object ++ initialDelaySeconds: ++ format: int32 ++ type: integer ++ periodSeconds: ++ format: int32 ++ type: integer ++ successThreshold: ++ format: int32 ++ type: integer ++ tcpSocket: ++ properties: ++ host: ++ type: string ++ port: ++ anyOf: ++ - type: integer ++ - type: string ++ x-kubernetes-int-or-string: true ++ required: ++ - port ++ type: object ++ terminationGracePeriodSeconds: ++ format: int64 ++ type: integer ++ timeoutSeconds: ++ format: int32 ++ type: integer ++ type: object ++ resources: ++ nullable: true ++ properties: ++ limits: ++ additionalProperties: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ type: object ++ requests: ++ additionalProperties: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ type: object ++ type: object ++ schedule: ++ type: string ++ securityContext: ++ properties: ++ fsGroup: ++ format: int64 ++ type: integer ++ fsGroupChangePolicy: ++ type: string ++ runAsGroup: ++ format: int64 ++ type: integer ++ runAsNonRoot: ++ type: boolean ++ runAsUser: ++ format: int64 ++ type: integer ++ seLinuxOptions: ++ properties: ++ level: ++ type: string ++ role: ++ type: string ++ type: ++ type: string ++ user: ++ type: string ++ type: object ++ seccompProfile: ++ properties: ++ localhostProfile: ++ type: string ++ type: ++ type: string ++ required: ++ - type ++ type: object ++ supplementalGroups: ++ items: ++ format: int64 ++ type: integer ++ type: array ++ sysctls: ++ items: ++ properties: ++ name: ++ type: string ++ value: ++ type: string ++ required: ++ - name ++ - value ++ type: object ++ type: array ++ windowsOptions: ++ properties: ++ gmsaCredentialSpec: ++ type: string ++ gmsaCredentialSpecName: ++ type: string ++ hostProcess: ++ type: boolean ++ runAsUserName: ++ type: string ++ type: object ++ type: object ++ serviceAccount: ++ type: string ++ sparkMaster: ++ type: string ++ successfulJobsHistoryLimit: ++ format: int32 ++ type: integer ++ tolerations: ++ items: ++ properties: ++ effect: ++ type: string ++ key: ++ type: string ++ operator: ++ type: string ++ tolerationSeconds: ++ format: int64 ++ type: integer ++ value: ++ type: string ++ type: object ++ type: array ++ x-kubernetes-list-type: atomic ++ ttlSecondsAfterFinished: ++ format: int32 ++ type: integer ++ volumeMounts: ++ items: ++ properties: ++ mountPath: ++ type: string ++ mountPropagation: ++ type: string ++ name: ++ type: string ++ readOnly: ++ type: boolean ++ subPath: ++ type: string ++ subPathExpr: ++ type: string ++ required: ++ - mountPath ++ - name ++ type: object ++ type: array ++ x-kubernetes-list-type: atomic ++ volumes: ++ items: ++ properties: ++ awsElasticBlockStore: ++ properties: ++ fsType: ++ type: string ++ partition: ++ format: int32 ++ type: integer ++ readOnly: ++ type: boolean ++ volumeID: ++ type: string ++ required: ++ - volumeID ++ type: object ++ azureDisk: ++ properties: ++ cachingMode: ++ type: string ++ diskName: ++ type: string ++ diskURI: ++ type: string ++ fsType: ++ type: string ++ kind: ++ type: string ++ readOnly: ++ type: boolean ++ required: ++ - diskName ++ - diskURI ++ type: object ++ azureFile: ++ properties: ++ readOnly: ++ type: boolean ++ secretName: ++ type: string ++ shareName: ++ type: string ++ required: ++ - secretName ++ - shareName ++ type: object ++ cephfs: ++ properties: ++ monitors: ++ items: ++ type: string ++ type: array ++ path: ++ type: string ++ readOnly: ++ type: boolean ++ secretFile: ++ type: string ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ user: ++ type: string ++ required: ++ - monitors ++ type: object ++ cinder: ++ properties: ++ fsType: ++ type: string ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ volumeID: ++ type: string ++ required: ++ - volumeID ++ type: object ++ configMap: ++ properties: ++ defaultMode: ++ format: int32 ++ type: integer ++ items: ++ items: ++ properties: ++ key: ++ type: string ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ required: ++ - key ++ - path ++ type: object ++ type: array ++ name: ++ type: string ++ optional: ++ type: boolean ++ type: object ++ x-kubernetes-map-type: atomic ++ csi: ++ properties: ++ driver: ++ type: string ++ fsType: ++ type: string ++ nodePublishSecretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ readOnly: ++ type: boolean ++ volumeAttributes: ++ additionalProperties: ++ type: string ++ type: object ++ required: ++ - driver ++ type: object ++ downwardAPI: ++ properties: ++ defaultMode: ++ format: int32 ++ type: integer ++ items: ++ items: ++ properties: ++ fieldRef: ++ properties: ++ apiVersion: ++ type: string ++ fieldPath: ++ type: string ++ required: ++ - fieldPath ++ type: object ++ x-kubernetes-map-type: atomic ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ resourceFieldRef: ++ properties: ++ containerName: ++ type: string ++ divisor: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ resource: ++ type: string ++ required: ++ - resource ++ type: object ++ x-kubernetes-map-type: atomic ++ required: ++ - path ++ type: object ++ type: array ++ type: object ++ emptyDir: ++ properties: ++ medium: ++ type: string ++ sizeLimit: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ type: object ++ ephemeral: ++ properties: ++ volumeClaimTemplate: ++ properties: ++ metadata: ++ properties: ++ annotations: ++ additionalProperties: ++ type: string ++ type: object ++ finalizers: ++ items: ++ type: string ++ type: array ++ labels: ++ additionalProperties: ++ type: string ++ type: object ++ name: ++ type: string ++ namespace: ++ type: string ++ type: object ++ spec: ++ properties: ++ accessModes: ++ items: ++ type: string ++ type: array ++ dataSource: ++ properties: ++ apiGroup: ++ type: string ++ kind: ++ type: string ++ name: ++ type: string ++ required: ++ - kind ++ - name ++ type: object ++ x-kubernetes-map-type: atomic ++ dataSourceRef: ++ properties: ++ apiGroup: ++ type: string ++ kind: ++ type: string ++ name: ++ type: string ++ required: ++ - kind ++ - name ++ type: object ++ x-kubernetes-map-type: atomic ++ resources: ++ properties: ++ limits: ++ additionalProperties: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ type: object ++ requests: ++ additionalProperties: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ type: object ++ type: object ++ selector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ storageClassName: ++ type: string ++ volumeMode: ++ type: string ++ volumeName: ++ type: string ++ type: object ++ required: ++ - spec ++ type: object ++ type: object ++ fc: ++ properties: ++ fsType: ++ type: string ++ lun: ++ format: int32 ++ type: integer ++ readOnly: ++ type: boolean ++ targetWWNs: ++ items: ++ type: string ++ type: array ++ wwids: ++ items: ++ type: string ++ type: array ++ type: object ++ flexVolume: ++ properties: ++ driver: ++ type: string ++ fsType: ++ type: string ++ options: ++ additionalProperties: ++ type: string ++ type: object ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ required: ++ - driver ++ type: object ++ flocker: ++ properties: ++ datasetName: ++ type: string ++ datasetUUID: ++ type: string ++ type: object ++ gcePersistentDisk: ++ properties: ++ fsType: ++ type: string ++ partition: ++ format: int32 ++ type: integer ++ pdName: ++ type: string ++ readOnly: ++ type: boolean ++ required: ++ - pdName ++ type: object ++ gitRepo: ++ properties: ++ directory: ++ type: string ++ repository: ++ type: string ++ revision: ++ type: string ++ required: ++ - repository ++ type: object ++ glusterfs: ++ properties: ++ endpoints: ++ type: string ++ path: ++ type: string ++ readOnly: ++ type: boolean ++ required: ++ - endpoints ++ - path ++ type: object ++ hostPath: ++ properties: ++ path: ++ type: string ++ type: ++ type: string ++ required: ++ - path ++ type: object ++ iscsi: ++ properties: ++ chapAuthDiscovery: ++ type: boolean ++ chapAuthSession: ++ type: boolean ++ fsType: ++ type: string ++ initiatorName: ++ type: string ++ iqn: ++ type: string ++ iscsiInterface: ++ type: string ++ lun: ++ format: int32 ++ type: integer ++ portals: ++ items: ++ type: string ++ type: array ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ targetPortal: ++ type: string ++ required: ++ - iqn ++ - lun ++ - targetPortal ++ type: object ++ name: ++ type: string ++ nfs: ++ properties: ++ path: ++ type: string ++ readOnly: ++ type: boolean ++ server: ++ type: string ++ required: ++ - path ++ - server ++ type: object ++ persistentVolumeClaim: ++ properties: ++ claimName: ++ type: string ++ readOnly: ++ type: boolean ++ required: ++ - claimName ++ type: object ++ photonPersistentDisk: ++ properties: ++ fsType: ++ type: string ++ pdID: ++ type: string ++ required: ++ - pdID ++ type: object ++ portworxVolume: ++ properties: ++ fsType: ++ type: string ++ readOnly: ++ type: boolean ++ volumeID: ++ type: string ++ required: ++ - volumeID ++ type: object ++ projected: ++ properties: ++ defaultMode: ++ format: int32 ++ type: integer ++ sources: ++ items: ++ properties: ++ configMap: ++ properties: ++ items: ++ items: ++ properties: ++ key: ++ type: string ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ required: ++ - key ++ - path ++ type: object ++ type: array ++ name: ++ type: string ++ optional: ++ type: boolean ++ type: object ++ x-kubernetes-map-type: atomic ++ downwardAPI: ++ properties: ++ items: ++ items: ++ properties: ++ fieldRef: ++ properties: ++ apiVersion: ++ type: string ++ fieldPath: ++ type: string ++ required: ++ - fieldPath ++ type: object ++ x-kubernetes-map-type: atomic ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ resourceFieldRef: ++ properties: ++ containerName: ++ type: string ++ divisor: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ resource: ++ type: string ++ required: ++ - resource ++ type: object ++ x-kubernetes-map-type: atomic ++ required: ++ - path ++ type: object ++ type: array ++ type: object ++ secret: ++ properties: ++ items: ++ items: ++ properties: ++ key: ++ type: string ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ required: ++ - key ++ - path ++ type: object ++ type: array ++ name: ++ type: string ++ optional: ++ type: boolean ++ type: object ++ x-kubernetes-map-type: atomic ++ serviceAccountToken: ++ properties: ++ audience: ++ type: string ++ expirationSeconds: ++ format: int64 ++ type: integer ++ path: ++ type: string ++ required: ++ - path ++ type: object ++ type: object ++ type: array ++ type: object ++ quobyte: ++ properties: ++ group: ++ type: string ++ readOnly: ++ type: boolean ++ registry: ++ type: string ++ tenant: ++ type: string ++ user: ++ type: string ++ volume: ++ type: string ++ required: ++ - registry ++ - volume ++ type: object ++ rbd: ++ properties: ++ fsType: ++ type: string ++ image: ++ type: string ++ keyring: ++ type: string ++ monitors: ++ items: ++ type: string ++ type: array ++ pool: ++ type: string ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ user: ++ type: string ++ required: ++ - image ++ - monitors ++ type: object ++ scaleIO: ++ properties: ++ fsType: ++ type: string ++ gateway: ++ type: string ++ protectionDomain: ++ type: string ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ sslEnabled: ++ type: boolean ++ storageMode: ++ type: string ++ storagePool: ++ type: string ++ system: ++ type: string ++ volumeName: ++ type: string ++ required: ++ - gateway ++ - secretRef ++ - system ++ type: object ++ secret: ++ properties: ++ defaultMode: ++ format: int32 ++ type: integer ++ items: ++ items: ++ properties: ++ key: ++ type: string ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ required: ++ - key ++ - path ++ type: object ++ type: array ++ optional: ++ type: boolean ++ secretName: ++ type: string ++ type: object ++ storageos: ++ properties: ++ fsType: ++ type: string ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ volumeName: ++ type: string ++ volumeNamespace: ++ type: string ++ type: object ++ vsphereVolume: ++ properties: ++ fsType: ++ type: string ++ storagePolicyID: ++ type: string ++ storagePolicyName: ++ type: string ++ volumePath: ++ type: string ++ required: ++ - volumePath ++ type: object ++ required: ++ - name ++ type: object ++ type: array ++ x-kubernetes-list-type: atomic ++ type: object ++ elasticsearch: ++ properties: ++ doNotProvision: ++ type: boolean ++ image: ++ type: string ++ name: ++ type: string ++ nodeCount: ++ format: int32 ++ type: integer ++ nodeSelector: ++ additionalProperties: ++ type: string ++ type: object ++ proxyResources: ++ properties: ++ limits: ++ additionalProperties: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ type: object ++ requests: ++ additionalProperties: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ type: object ++ type: object ++ redundancyPolicy: ++ enum: ++ - FullRedundancy ++ - MultipleRedundancy ++ - SingleRedundancy ++ - ZeroRedundancy ++ type: string ++ resources: ++ properties: ++ limits: ++ additionalProperties: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ type: object ++ requests: ++ additionalProperties: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ type: object ++ type: object ++ storage: ++ properties: ++ size: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ storageClassName: ++ type: string ++ type: object ++ tolerations: ++ items: ++ properties: ++ effect: ++ type: string ++ key: ++ type: string ++ operator: ++ type: string ++ tolerationSeconds: ++ format: int64 ++ type: integer ++ value: ++ type: string ++ type: object ++ type: array ++ x-kubernetes-list-type: atomic ++ useCertManagement: ++ type: boolean ++ type: object ++ esIndexCleaner: ++ properties: ++ affinity: ++ properties: ++ nodeAffinity: ++ properties: ++ preferredDuringSchedulingIgnoredDuringExecution: ++ items: ++ properties: ++ preference: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchFields: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ type: object ++ x-kubernetes-map-type: atomic ++ weight: ++ format: int32 ++ type: integer ++ required: ++ - preference ++ - weight ++ type: object ++ type: array ++ requiredDuringSchedulingIgnoredDuringExecution: ++ properties: ++ nodeSelectorTerms: ++ items: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchFields: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ type: object ++ x-kubernetes-map-type: atomic ++ type: array ++ required: ++ - nodeSelectorTerms ++ type: object ++ x-kubernetes-map-type: atomic ++ type: object ++ podAffinity: ++ properties: ++ preferredDuringSchedulingIgnoredDuringExecution: ++ items: ++ properties: ++ podAffinityTerm: ++ properties: ++ labelSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaceSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaces: ++ items: ++ type: string ++ type: array ++ topologyKey: ++ type: string ++ required: ++ - topologyKey ++ type: object ++ weight: ++ format: int32 ++ type: integer ++ required: ++ - podAffinityTerm ++ - weight ++ type: object ++ type: array ++ requiredDuringSchedulingIgnoredDuringExecution: ++ items: ++ properties: ++ labelSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaceSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaces: ++ items: ++ type: string ++ type: array ++ topologyKey: ++ type: string ++ required: ++ - topologyKey ++ type: object ++ type: array ++ type: object ++ podAntiAffinity: ++ properties: ++ preferredDuringSchedulingIgnoredDuringExecution: ++ items: ++ properties: ++ podAffinityTerm: ++ properties: ++ labelSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaceSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaces: ++ items: ++ type: string ++ type: array ++ topologyKey: ++ type: string ++ required: ++ - topologyKey ++ type: object ++ weight: ++ format: int32 ++ type: integer ++ required: ++ - podAffinityTerm ++ - weight ++ type: object ++ type: array ++ requiredDuringSchedulingIgnoredDuringExecution: ++ items: ++ properties: ++ labelSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaceSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaces: ++ items: ++ type: string ++ type: array ++ topologyKey: ++ type: string ++ required: ++ - topologyKey ++ type: object ++ type: array ++ type: object ++ type: object ++ annotations: ++ additionalProperties: ++ type: string ++ nullable: true ++ type: object ++ backoffLimit: ++ format: int32 ++ type: integer ++ containerSecurityContext: ++ properties: ++ allowPrivilegeEscalation: ++ type: boolean ++ capabilities: ++ properties: ++ add: ++ items: ++ type: string ++ type: array ++ drop: ++ items: ++ type: string ++ type: array ++ type: object ++ privileged: ++ type: boolean ++ procMount: ++ type: string ++ readOnlyRootFilesystem: ++ type: boolean ++ runAsGroup: ++ format: int64 ++ type: integer ++ runAsNonRoot: ++ type: boolean ++ runAsUser: ++ format: int64 ++ type: integer ++ seLinuxOptions: ++ properties: ++ level: ++ type: string ++ role: ++ type: string ++ type: ++ type: string ++ user: ++ type: string ++ type: object ++ seccompProfile: ++ properties: ++ localhostProfile: ++ type: string ++ type: ++ type: string ++ required: ++ - type ++ type: object ++ windowsOptions: ++ properties: ++ gmsaCredentialSpec: ++ type: string ++ gmsaCredentialSpecName: ++ type: string ++ hostProcess: ++ type: boolean ++ runAsUserName: ++ type: string ++ type: object ++ type: object ++ enabled: ++ type: boolean ++ image: ++ type: string ++ imagePullPolicy: ++ type: string ++ imagePullSecrets: ++ items: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ type: array ++ x-kubernetes-list-type: atomic ++ labels: ++ additionalProperties: ++ type: string ++ type: object ++ livenessProbe: ++ properties: ++ exec: ++ properties: ++ command: ++ items: ++ type: string ++ type: array ++ type: object ++ failureThreshold: ++ format: int32 ++ type: integer ++ grpc: ++ properties: ++ port: ++ format: int32 ++ type: integer ++ service: ++ type: string ++ required: ++ - port ++ type: object ++ httpGet: ++ properties: ++ host: ++ type: string ++ httpHeaders: ++ items: ++ properties: ++ name: ++ type: string ++ value: ++ type: string ++ required: ++ - name ++ - value ++ type: object ++ type: array ++ path: ++ type: string ++ port: ++ anyOf: ++ - type: integer ++ - type: string ++ x-kubernetes-int-or-string: true ++ scheme: ++ type: string ++ required: ++ - port ++ type: object ++ initialDelaySeconds: ++ format: int32 ++ type: integer ++ periodSeconds: ++ format: int32 ++ type: integer ++ successThreshold: ++ format: int32 ++ type: integer ++ tcpSocket: ++ properties: ++ host: ++ type: string ++ port: ++ anyOf: ++ - type: integer ++ - type: string ++ x-kubernetes-int-or-string: true ++ required: ++ - port ++ type: object ++ terminationGracePeriodSeconds: ++ format: int64 ++ type: integer ++ timeoutSeconds: ++ format: int32 ++ type: integer ++ type: object ++ numberOfDays: ++ type: integer ++ priorityClassName: ++ type: string ++ resources: ++ nullable: true ++ properties: ++ limits: ++ additionalProperties: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ type: object ++ requests: ++ additionalProperties: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ type: object ++ type: object ++ schedule: ++ type: string ++ securityContext: ++ properties: ++ fsGroup: ++ format: int64 ++ type: integer ++ fsGroupChangePolicy: ++ type: string ++ runAsGroup: ++ format: int64 ++ type: integer ++ runAsNonRoot: ++ type: boolean ++ runAsUser: ++ format: int64 ++ type: integer ++ seLinuxOptions: ++ properties: ++ level: ++ type: string ++ role: ++ type: string ++ type: ++ type: string ++ user: ++ type: string ++ type: object ++ seccompProfile: ++ properties: ++ localhostProfile: ++ type: string ++ type: ++ type: string ++ required: ++ - type ++ type: object ++ supplementalGroups: ++ items: ++ format: int64 ++ type: integer ++ type: array ++ sysctls: ++ items: ++ properties: ++ name: ++ type: string ++ value: ++ type: string ++ required: ++ - name ++ - value ++ type: object ++ type: array ++ windowsOptions: ++ properties: ++ gmsaCredentialSpec: ++ type: string ++ gmsaCredentialSpecName: ++ type: string ++ hostProcess: ++ type: boolean ++ runAsUserName: ++ type: string ++ type: object ++ type: object ++ serviceAccount: ++ type: string ++ successfulJobsHistoryLimit: ++ format: int32 ++ type: integer ++ tolerations: ++ items: ++ properties: ++ effect: ++ type: string ++ key: ++ type: string ++ operator: ++ type: string ++ tolerationSeconds: ++ format: int64 ++ type: integer ++ value: ++ type: string ++ type: object ++ type: array ++ x-kubernetes-list-type: atomic ++ ttlSecondsAfterFinished: ++ format: int32 ++ type: integer ++ volumeMounts: ++ items: ++ properties: ++ mountPath: ++ type: string ++ mountPropagation: ++ type: string ++ name: ++ type: string ++ readOnly: ++ type: boolean ++ subPath: ++ type: string ++ subPathExpr: ++ type: string ++ required: ++ - mountPath ++ - name ++ type: object ++ type: array ++ x-kubernetes-list-type: atomic ++ volumes: ++ items: ++ properties: ++ awsElasticBlockStore: ++ properties: ++ fsType: ++ type: string ++ partition: ++ format: int32 ++ type: integer ++ readOnly: ++ type: boolean ++ volumeID: ++ type: string ++ required: ++ - volumeID ++ type: object ++ azureDisk: ++ properties: ++ cachingMode: ++ type: string ++ diskName: ++ type: string ++ diskURI: ++ type: string ++ fsType: ++ type: string ++ kind: ++ type: string ++ readOnly: ++ type: boolean ++ required: ++ - diskName ++ - diskURI ++ type: object ++ azureFile: ++ properties: ++ readOnly: ++ type: boolean ++ secretName: ++ type: string ++ shareName: ++ type: string ++ required: ++ - secretName ++ - shareName ++ type: object ++ cephfs: ++ properties: ++ monitors: ++ items: ++ type: string ++ type: array ++ path: ++ type: string ++ readOnly: ++ type: boolean ++ secretFile: ++ type: string ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ user: ++ type: string ++ required: ++ - monitors ++ type: object ++ cinder: ++ properties: ++ fsType: ++ type: string ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ volumeID: ++ type: string ++ required: ++ - volumeID ++ type: object ++ configMap: ++ properties: ++ defaultMode: ++ format: int32 ++ type: integer ++ items: ++ items: ++ properties: ++ key: ++ type: string ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ required: ++ - key ++ - path ++ type: object ++ type: array ++ name: ++ type: string ++ optional: ++ type: boolean ++ type: object ++ x-kubernetes-map-type: atomic ++ csi: ++ properties: ++ driver: ++ type: string ++ fsType: ++ type: string ++ nodePublishSecretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ readOnly: ++ type: boolean ++ volumeAttributes: ++ additionalProperties: ++ type: string ++ type: object ++ required: ++ - driver ++ type: object ++ downwardAPI: ++ properties: ++ defaultMode: ++ format: int32 ++ type: integer ++ items: ++ items: ++ properties: ++ fieldRef: ++ properties: ++ apiVersion: ++ type: string ++ fieldPath: ++ type: string ++ required: ++ - fieldPath ++ type: object ++ x-kubernetes-map-type: atomic ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ resourceFieldRef: ++ properties: ++ containerName: ++ type: string ++ divisor: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ resource: ++ type: string ++ required: ++ - resource ++ type: object ++ x-kubernetes-map-type: atomic ++ required: ++ - path ++ type: object ++ type: array ++ type: object ++ emptyDir: ++ properties: ++ medium: ++ type: string ++ sizeLimit: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ type: object ++ ephemeral: ++ properties: ++ volumeClaimTemplate: ++ properties: ++ metadata: ++ properties: ++ annotations: ++ additionalProperties: ++ type: string ++ type: object ++ finalizers: ++ items: ++ type: string ++ type: array ++ labels: ++ additionalProperties: ++ type: string ++ type: object ++ name: ++ type: string ++ namespace: ++ type: string ++ type: object ++ spec: ++ properties: ++ accessModes: ++ items: ++ type: string ++ type: array ++ dataSource: ++ properties: ++ apiGroup: ++ type: string ++ kind: ++ type: string ++ name: ++ type: string ++ required: ++ - kind ++ - name ++ type: object ++ x-kubernetes-map-type: atomic ++ dataSourceRef: ++ properties: ++ apiGroup: ++ type: string ++ kind: ++ type: string ++ name: ++ type: string ++ required: ++ - kind ++ - name ++ type: object ++ x-kubernetes-map-type: atomic ++ resources: ++ properties: ++ limits: ++ additionalProperties: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ type: object ++ requests: ++ additionalProperties: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ type: object ++ type: object ++ selector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ storageClassName: ++ type: string ++ volumeMode: ++ type: string ++ volumeName: ++ type: string ++ type: object ++ required: ++ - spec ++ type: object ++ type: object ++ fc: ++ properties: ++ fsType: ++ type: string ++ lun: ++ format: int32 ++ type: integer ++ readOnly: ++ type: boolean ++ targetWWNs: ++ items: ++ type: string ++ type: array ++ wwids: ++ items: ++ type: string ++ type: array ++ type: object ++ flexVolume: ++ properties: ++ driver: ++ type: string ++ fsType: ++ type: string ++ options: ++ additionalProperties: ++ type: string ++ type: object ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ required: ++ - driver ++ type: object ++ flocker: ++ properties: ++ datasetName: ++ type: string ++ datasetUUID: ++ type: string ++ type: object ++ gcePersistentDisk: ++ properties: ++ fsType: ++ type: string ++ partition: ++ format: int32 ++ type: integer ++ pdName: ++ type: string ++ readOnly: ++ type: boolean ++ required: ++ - pdName ++ type: object ++ gitRepo: ++ properties: ++ directory: ++ type: string ++ repository: ++ type: string ++ revision: ++ type: string ++ required: ++ - repository ++ type: object ++ glusterfs: ++ properties: ++ endpoints: ++ type: string ++ path: ++ type: string ++ readOnly: ++ type: boolean ++ required: ++ - endpoints ++ - path ++ type: object ++ hostPath: ++ properties: ++ path: ++ type: string ++ type: ++ type: string ++ required: ++ - path ++ type: object ++ iscsi: ++ properties: ++ chapAuthDiscovery: ++ type: boolean ++ chapAuthSession: ++ type: boolean ++ fsType: ++ type: string ++ initiatorName: ++ type: string ++ iqn: ++ type: string ++ iscsiInterface: ++ type: string ++ lun: ++ format: int32 ++ type: integer ++ portals: ++ items: ++ type: string ++ type: array ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ targetPortal: ++ type: string ++ required: ++ - iqn ++ - lun ++ - targetPortal ++ type: object ++ name: ++ type: string ++ nfs: ++ properties: ++ path: ++ type: string ++ readOnly: ++ type: boolean ++ server: ++ type: string ++ required: ++ - path ++ - server ++ type: object ++ persistentVolumeClaim: ++ properties: ++ claimName: ++ type: string ++ readOnly: ++ type: boolean ++ required: ++ - claimName ++ type: object ++ photonPersistentDisk: ++ properties: ++ fsType: ++ type: string ++ pdID: ++ type: string ++ required: ++ - pdID ++ type: object ++ portworxVolume: ++ properties: ++ fsType: ++ type: string ++ readOnly: ++ type: boolean ++ volumeID: ++ type: string ++ required: ++ - volumeID ++ type: object ++ projected: ++ properties: ++ defaultMode: ++ format: int32 ++ type: integer ++ sources: ++ items: ++ properties: ++ configMap: ++ properties: ++ items: ++ items: ++ properties: ++ key: ++ type: string ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ required: ++ - key ++ - path ++ type: object ++ type: array ++ name: ++ type: string ++ optional: ++ type: boolean ++ type: object ++ x-kubernetes-map-type: atomic ++ downwardAPI: ++ properties: ++ items: ++ items: ++ properties: ++ fieldRef: ++ properties: ++ apiVersion: ++ type: string ++ fieldPath: ++ type: string ++ required: ++ - fieldPath ++ type: object ++ x-kubernetes-map-type: atomic ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ resourceFieldRef: ++ properties: ++ containerName: ++ type: string ++ divisor: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ resource: ++ type: string ++ required: ++ - resource ++ type: object ++ x-kubernetes-map-type: atomic ++ required: ++ - path ++ type: object ++ type: array ++ type: object ++ secret: ++ properties: ++ items: ++ items: ++ properties: ++ key: ++ type: string ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ required: ++ - key ++ - path ++ type: object ++ type: array ++ name: ++ type: string ++ optional: ++ type: boolean ++ type: object ++ x-kubernetes-map-type: atomic ++ serviceAccountToken: ++ properties: ++ audience: ++ type: string ++ expirationSeconds: ++ format: int64 ++ type: integer ++ path: ++ type: string ++ required: ++ - path ++ type: object ++ type: object ++ type: array ++ type: object ++ quobyte: ++ properties: ++ group: ++ type: string ++ readOnly: ++ type: boolean ++ registry: ++ type: string ++ tenant: ++ type: string ++ user: ++ type: string ++ volume: ++ type: string ++ required: ++ - registry ++ - volume ++ type: object ++ rbd: ++ properties: ++ fsType: ++ type: string ++ image: ++ type: string ++ keyring: ++ type: string ++ monitors: ++ items: ++ type: string ++ type: array ++ pool: ++ type: string ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ user: ++ type: string ++ required: ++ - image ++ - monitors ++ type: object ++ scaleIO: ++ properties: ++ fsType: ++ type: string ++ gateway: ++ type: string ++ protectionDomain: ++ type: string ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ sslEnabled: ++ type: boolean ++ storageMode: ++ type: string ++ storagePool: ++ type: string ++ system: ++ type: string ++ volumeName: ++ type: string ++ required: ++ - gateway ++ - secretRef ++ - system ++ type: object ++ secret: ++ properties: ++ defaultMode: ++ format: int32 ++ type: integer ++ items: ++ items: ++ properties: ++ key: ++ type: string ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ required: ++ - key ++ - path ++ type: object ++ type: array ++ optional: ++ type: boolean ++ secretName: ++ type: string ++ type: object ++ storageos: ++ properties: ++ fsType: ++ type: string ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ volumeName: ++ type: string ++ volumeNamespace: ++ type: string ++ type: object ++ vsphereVolume: ++ properties: ++ fsType: ++ type: string ++ storagePolicyID: ++ type: string ++ storagePolicyName: ++ type: string ++ volumePath: ++ type: string ++ required: ++ - volumePath ++ type: object ++ required: ++ - name ++ type: object ++ type: array ++ x-kubernetes-list-type: atomic ++ type: object ++ esRollover: ++ properties: ++ affinity: ++ properties: ++ nodeAffinity: ++ properties: ++ preferredDuringSchedulingIgnoredDuringExecution: ++ items: ++ properties: ++ preference: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchFields: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ type: object ++ x-kubernetes-map-type: atomic ++ weight: ++ format: int32 ++ type: integer ++ required: ++ - preference ++ - weight ++ type: object ++ type: array ++ requiredDuringSchedulingIgnoredDuringExecution: ++ properties: ++ nodeSelectorTerms: ++ items: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchFields: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ type: object ++ x-kubernetes-map-type: atomic ++ type: array ++ required: ++ - nodeSelectorTerms ++ type: object ++ x-kubernetes-map-type: atomic ++ type: object ++ podAffinity: ++ properties: ++ preferredDuringSchedulingIgnoredDuringExecution: ++ items: ++ properties: ++ podAffinityTerm: ++ properties: ++ labelSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaceSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaces: ++ items: ++ type: string ++ type: array ++ topologyKey: ++ type: string ++ required: ++ - topologyKey ++ type: object ++ weight: ++ format: int32 ++ type: integer ++ required: ++ - podAffinityTerm ++ - weight ++ type: object ++ type: array ++ requiredDuringSchedulingIgnoredDuringExecution: ++ items: ++ properties: ++ labelSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaceSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaces: ++ items: ++ type: string ++ type: array ++ topologyKey: ++ type: string ++ required: ++ - topologyKey ++ type: object ++ type: array ++ type: object ++ podAntiAffinity: ++ properties: ++ preferredDuringSchedulingIgnoredDuringExecution: ++ items: ++ properties: ++ podAffinityTerm: ++ properties: ++ labelSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaceSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaces: ++ items: ++ type: string ++ type: array ++ topologyKey: ++ type: string ++ required: ++ - topologyKey ++ type: object ++ weight: ++ format: int32 ++ type: integer ++ required: ++ - podAffinityTerm ++ - weight ++ type: object ++ type: array ++ requiredDuringSchedulingIgnoredDuringExecution: ++ items: ++ properties: ++ labelSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaceSelector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ namespaces: ++ items: ++ type: string ++ type: array ++ topologyKey: ++ type: string ++ required: ++ - topologyKey ++ type: object ++ type: array ++ type: object ++ type: object ++ annotations: ++ additionalProperties: ++ type: string ++ nullable: true ++ type: object ++ backoffLimit: ++ format: int32 ++ type: integer ++ conditions: ++ type: string ++ containerSecurityContext: ++ properties: ++ allowPrivilegeEscalation: ++ type: boolean ++ capabilities: ++ properties: ++ add: ++ items: ++ type: string ++ type: array ++ drop: ++ items: ++ type: string ++ type: array ++ type: object ++ privileged: ++ type: boolean ++ procMount: ++ type: string ++ readOnlyRootFilesystem: ++ type: boolean ++ runAsGroup: ++ format: int64 ++ type: integer ++ runAsNonRoot: ++ type: boolean ++ runAsUser: ++ format: int64 ++ type: integer ++ seLinuxOptions: ++ properties: ++ level: ++ type: string ++ role: ++ type: string ++ type: ++ type: string ++ user: ++ type: string ++ type: object ++ seccompProfile: ++ properties: ++ localhostProfile: ++ type: string ++ type: ++ type: string ++ required: ++ - type ++ type: object ++ windowsOptions: ++ properties: ++ gmsaCredentialSpec: ++ type: string ++ gmsaCredentialSpecName: ++ type: string ++ hostProcess: ++ type: boolean ++ runAsUserName: ++ type: string ++ type: object ++ type: object ++ image: ++ type: string ++ imagePullPolicy: ++ type: string ++ imagePullSecrets: ++ items: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ type: array ++ x-kubernetes-list-type: atomic ++ labels: ++ additionalProperties: ++ type: string ++ type: object ++ livenessProbe: ++ properties: ++ exec: ++ properties: ++ command: ++ items: ++ type: string ++ type: array ++ type: object ++ failureThreshold: ++ format: int32 ++ type: integer ++ grpc: ++ properties: ++ port: ++ format: int32 ++ type: integer ++ service: ++ type: string ++ required: ++ - port ++ type: object ++ httpGet: ++ properties: ++ host: ++ type: string ++ httpHeaders: ++ items: ++ properties: ++ name: ++ type: string ++ value: ++ type: string ++ required: ++ - name ++ - value ++ type: object ++ type: array ++ path: ++ type: string ++ port: ++ anyOf: ++ - type: integer ++ - type: string ++ x-kubernetes-int-or-string: true ++ scheme: ++ type: string ++ required: ++ - port ++ type: object ++ initialDelaySeconds: ++ format: int32 ++ type: integer ++ periodSeconds: ++ format: int32 ++ type: integer ++ successThreshold: ++ format: int32 ++ type: integer ++ tcpSocket: ++ properties: ++ host: ++ type: string ++ port: ++ anyOf: ++ - type: integer ++ - type: string ++ x-kubernetes-int-or-string: true ++ required: ++ - port ++ type: object ++ terminationGracePeriodSeconds: ++ format: int64 ++ type: integer ++ timeoutSeconds: ++ format: int32 ++ type: integer ++ type: object ++ readTTL: ++ type: string ++ resources: ++ nullable: true ++ properties: ++ limits: ++ additionalProperties: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ type: object ++ requests: ++ additionalProperties: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ type: object ++ type: object ++ schedule: ++ type: string ++ securityContext: ++ properties: ++ fsGroup: ++ format: int64 ++ type: integer ++ fsGroupChangePolicy: ++ type: string ++ runAsGroup: ++ format: int64 ++ type: integer ++ runAsNonRoot: ++ type: boolean ++ runAsUser: ++ format: int64 ++ type: integer ++ seLinuxOptions: ++ properties: ++ level: ++ type: string ++ role: ++ type: string ++ type: ++ type: string ++ user: ++ type: string ++ type: object ++ seccompProfile: ++ properties: ++ localhostProfile: ++ type: string ++ type: ++ type: string ++ required: ++ - type ++ type: object ++ supplementalGroups: ++ items: ++ format: int64 ++ type: integer ++ type: array ++ sysctls: ++ items: ++ properties: ++ name: ++ type: string ++ value: ++ type: string ++ required: ++ - name ++ - value ++ type: object ++ type: array ++ windowsOptions: ++ properties: ++ gmsaCredentialSpec: ++ type: string ++ gmsaCredentialSpecName: ++ type: string ++ hostProcess: ++ type: boolean ++ runAsUserName: ++ type: string ++ type: object ++ type: object ++ serviceAccount: ++ type: string ++ successfulJobsHistoryLimit: ++ format: int32 ++ type: integer ++ tolerations: ++ items: ++ properties: ++ effect: ++ type: string ++ key: ++ type: string ++ operator: ++ type: string ++ tolerationSeconds: ++ format: int64 ++ type: integer ++ value: ++ type: string ++ type: object ++ type: array ++ x-kubernetes-list-type: atomic ++ ttlSecondsAfterFinished: ++ format: int32 ++ type: integer ++ volumeMounts: ++ items: ++ properties: ++ mountPath: ++ type: string ++ mountPropagation: ++ type: string ++ name: ++ type: string ++ readOnly: ++ type: boolean ++ subPath: ++ type: string ++ subPathExpr: ++ type: string ++ required: ++ - mountPath ++ - name ++ type: object ++ type: array ++ x-kubernetes-list-type: atomic ++ volumes: ++ items: ++ properties: ++ awsElasticBlockStore: ++ properties: ++ fsType: ++ type: string ++ partition: ++ format: int32 ++ type: integer ++ readOnly: ++ type: boolean ++ volumeID: ++ type: string ++ required: ++ - volumeID ++ type: object ++ azureDisk: ++ properties: ++ cachingMode: ++ type: string ++ diskName: ++ type: string ++ diskURI: ++ type: string ++ fsType: ++ type: string ++ kind: ++ type: string ++ readOnly: ++ type: boolean ++ required: ++ - diskName ++ - diskURI ++ type: object ++ azureFile: ++ properties: ++ readOnly: ++ type: boolean ++ secretName: ++ type: string ++ shareName: ++ type: string ++ required: ++ - secretName ++ - shareName ++ type: object ++ cephfs: ++ properties: ++ monitors: ++ items: ++ type: string ++ type: array ++ path: ++ type: string ++ readOnly: ++ type: boolean ++ secretFile: ++ type: string ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ user: ++ type: string ++ required: ++ - monitors ++ type: object ++ cinder: ++ properties: ++ fsType: ++ type: string ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ volumeID: ++ type: string ++ required: ++ - volumeID ++ type: object ++ configMap: ++ properties: ++ defaultMode: ++ format: int32 ++ type: integer ++ items: ++ items: ++ properties: ++ key: ++ type: string ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ required: ++ - key ++ - path ++ type: object ++ type: array ++ name: ++ type: string ++ optional: ++ type: boolean ++ type: object ++ x-kubernetes-map-type: atomic ++ csi: ++ properties: ++ driver: ++ type: string ++ fsType: ++ type: string ++ nodePublishSecretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ readOnly: ++ type: boolean ++ volumeAttributes: ++ additionalProperties: ++ type: string ++ type: object ++ required: ++ - driver ++ type: object ++ downwardAPI: ++ properties: ++ defaultMode: ++ format: int32 ++ type: integer ++ items: ++ items: ++ properties: ++ fieldRef: ++ properties: ++ apiVersion: ++ type: string ++ fieldPath: ++ type: string ++ required: ++ - fieldPath ++ type: object ++ x-kubernetes-map-type: atomic ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ resourceFieldRef: ++ properties: ++ containerName: ++ type: string ++ divisor: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ resource: ++ type: string ++ required: ++ - resource ++ type: object ++ x-kubernetes-map-type: atomic ++ required: ++ - path ++ type: object ++ type: array ++ type: object ++ emptyDir: ++ properties: ++ medium: ++ type: string ++ sizeLimit: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ type: object ++ ephemeral: ++ properties: ++ volumeClaimTemplate: ++ properties: ++ metadata: ++ properties: ++ annotations: ++ additionalProperties: ++ type: string ++ type: object ++ finalizers: ++ items: ++ type: string ++ type: array ++ labels: ++ additionalProperties: ++ type: string ++ type: object ++ name: ++ type: string ++ namespace: ++ type: string ++ type: object ++ spec: ++ properties: ++ accessModes: ++ items: ++ type: string ++ type: array ++ dataSource: ++ properties: ++ apiGroup: ++ type: string ++ kind: ++ type: string ++ name: ++ type: string ++ required: ++ - kind ++ - name ++ type: object ++ x-kubernetes-map-type: atomic ++ dataSourceRef: ++ properties: ++ apiGroup: ++ type: string ++ kind: ++ type: string ++ name: ++ type: string ++ required: ++ - kind ++ - name ++ type: object ++ x-kubernetes-map-type: atomic ++ resources: ++ properties: ++ limits: ++ additionalProperties: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ type: object ++ requests: ++ additionalProperties: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ type: object ++ type: object ++ selector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ storageClassName: ++ type: string ++ volumeMode: ++ type: string ++ volumeName: ++ type: string ++ type: object ++ required: ++ - spec ++ type: object ++ type: object ++ fc: ++ properties: ++ fsType: ++ type: string ++ lun: ++ format: int32 ++ type: integer ++ readOnly: ++ type: boolean ++ targetWWNs: ++ items: ++ type: string ++ type: array ++ wwids: ++ items: ++ type: string ++ type: array ++ type: object ++ flexVolume: ++ properties: ++ driver: ++ type: string ++ fsType: ++ type: string ++ options: ++ additionalProperties: ++ type: string ++ type: object ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ required: ++ - driver ++ type: object ++ flocker: ++ properties: ++ datasetName: ++ type: string ++ datasetUUID: ++ type: string ++ type: object ++ gcePersistentDisk: ++ properties: ++ fsType: ++ type: string ++ partition: ++ format: int32 ++ type: integer ++ pdName: ++ type: string ++ readOnly: ++ type: boolean ++ required: ++ - pdName ++ type: object ++ gitRepo: ++ properties: ++ directory: ++ type: string ++ repository: ++ type: string ++ revision: ++ type: string ++ required: ++ - repository ++ type: object ++ glusterfs: ++ properties: ++ endpoints: ++ type: string ++ path: ++ type: string ++ readOnly: ++ type: boolean ++ required: ++ - endpoints ++ - path ++ type: object ++ hostPath: ++ properties: ++ path: ++ type: string ++ type: ++ type: string ++ required: ++ - path ++ type: object ++ iscsi: ++ properties: ++ chapAuthDiscovery: ++ type: boolean ++ chapAuthSession: ++ type: boolean ++ fsType: ++ type: string ++ initiatorName: ++ type: string ++ iqn: ++ type: string ++ iscsiInterface: ++ type: string ++ lun: ++ format: int32 ++ type: integer ++ portals: ++ items: ++ type: string ++ type: array ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ targetPortal: ++ type: string ++ required: ++ - iqn ++ - lun ++ - targetPortal ++ type: object ++ name: ++ type: string ++ nfs: ++ properties: ++ path: ++ type: string ++ readOnly: ++ type: boolean ++ server: ++ type: string ++ required: ++ - path ++ - server ++ type: object ++ persistentVolumeClaim: ++ properties: ++ claimName: ++ type: string ++ readOnly: ++ type: boolean ++ required: ++ - claimName ++ type: object ++ photonPersistentDisk: ++ properties: ++ fsType: ++ type: string ++ pdID: ++ type: string ++ required: ++ - pdID ++ type: object ++ portworxVolume: ++ properties: ++ fsType: ++ type: string ++ readOnly: ++ type: boolean ++ volumeID: ++ type: string ++ required: ++ - volumeID ++ type: object ++ projected: ++ properties: ++ defaultMode: ++ format: int32 ++ type: integer ++ sources: ++ items: ++ properties: ++ configMap: ++ properties: ++ items: ++ items: ++ properties: ++ key: ++ type: string ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ required: ++ - key ++ - path ++ type: object ++ type: array ++ name: ++ type: string ++ optional: ++ type: boolean ++ type: object ++ x-kubernetes-map-type: atomic ++ downwardAPI: ++ properties: ++ items: ++ items: ++ properties: ++ fieldRef: ++ properties: ++ apiVersion: ++ type: string ++ fieldPath: ++ type: string ++ required: ++ - fieldPath ++ type: object ++ x-kubernetes-map-type: atomic ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ resourceFieldRef: ++ properties: ++ containerName: ++ type: string ++ divisor: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ resource: ++ type: string ++ required: ++ - resource ++ type: object ++ x-kubernetes-map-type: atomic ++ required: ++ - path ++ type: object ++ type: array ++ type: object ++ secret: ++ properties: ++ items: ++ items: ++ properties: ++ key: ++ type: string ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ required: ++ - key ++ - path ++ type: object ++ type: array ++ name: ++ type: string ++ optional: ++ type: boolean ++ type: object ++ x-kubernetes-map-type: atomic ++ serviceAccountToken: ++ properties: ++ audience: ++ type: string ++ expirationSeconds: ++ format: int64 ++ type: integer ++ path: ++ type: string ++ required: ++ - path ++ type: object ++ type: object ++ type: array ++ type: object ++ quobyte: ++ properties: ++ group: ++ type: string ++ readOnly: ++ type: boolean ++ registry: ++ type: string ++ tenant: ++ type: string ++ user: ++ type: string ++ volume: ++ type: string ++ required: ++ - registry ++ - volume ++ type: object ++ rbd: ++ properties: ++ fsType: ++ type: string ++ image: ++ type: string ++ keyring: ++ type: string ++ monitors: ++ items: ++ type: string ++ type: array ++ pool: ++ type: string ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ user: ++ type: string ++ required: ++ - image ++ - monitors ++ type: object ++ scaleIO: ++ properties: ++ fsType: ++ type: string ++ gateway: ++ type: string ++ protectionDomain: ++ type: string ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ sslEnabled: ++ type: boolean ++ storageMode: ++ type: string ++ storagePool: ++ type: string ++ system: ++ type: string ++ volumeName: ++ type: string ++ required: ++ - gateway ++ - secretRef ++ - system ++ type: object ++ secret: ++ properties: ++ defaultMode: ++ format: int32 ++ type: integer ++ items: ++ items: ++ properties: ++ key: ++ type: string ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ required: ++ - key ++ - path ++ type: object ++ type: array ++ optional: ++ type: boolean ++ secretName: ++ type: string ++ type: object ++ storageos: ++ properties: ++ fsType: ++ type: string ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ volumeName: ++ type: string ++ volumeNamespace: ++ type: string ++ type: object ++ vsphereVolume: ++ properties: ++ fsType: ++ type: string ++ storagePolicyID: ++ type: string ++ storagePolicyName: ++ type: string ++ volumePath: ++ type: string ++ required: ++ - volumePath ++ type: object ++ required: ++ - name ++ type: object ++ type: array ++ x-kubernetes-list-type: atomic ++ type: object ++ grpcPlugin: ++ properties: ++ image: ++ type: string ++ type: object ++ options: ++ type: object ++ x-kubernetes-preserve-unknown-fields: true ++ secretName: ++ type: string ++ type: ++ type: string ++ type: object ++ strategy: ++ type: string ++ tolerations: ++ items: ++ properties: ++ effect: ++ type: string ++ key: ++ type: string ++ operator: ++ type: string ++ tolerationSeconds: ++ format: int64 ++ type: integer ++ value: ++ type: string ++ type: object ++ type: array ++ x-kubernetes-list-type: atomic ++ ui: ++ properties: ++ options: ++ type: object ++ x-kubernetes-preserve-unknown-fields: true ++ type: object ++ volumeMounts: ++ items: ++ properties: ++ mountPath: ++ type: string ++ mountPropagation: ++ type: string ++ name: ++ type: string ++ readOnly: ++ type: boolean ++ subPath: ++ type: string ++ subPathExpr: ++ type: string ++ required: ++ - mountPath ++ - name ++ type: object ++ type: array ++ x-kubernetes-list-type: atomic ++ volumes: ++ items: ++ properties: ++ awsElasticBlockStore: ++ properties: ++ fsType: ++ type: string ++ partition: ++ format: int32 ++ type: integer ++ readOnly: ++ type: boolean ++ volumeID: ++ type: string ++ required: ++ - volumeID ++ type: object ++ azureDisk: ++ properties: ++ cachingMode: ++ type: string ++ diskName: ++ type: string ++ diskURI: ++ type: string ++ fsType: ++ type: string ++ kind: ++ type: string ++ readOnly: ++ type: boolean ++ required: ++ - diskName ++ - diskURI ++ type: object ++ azureFile: ++ properties: ++ readOnly: ++ type: boolean ++ secretName: ++ type: string ++ shareName: ++ type: string ++ required: ++ - secretName ++ - shareName ++ type: object ++ cephfs: ++ properties: ++ monitors: ++ items: ++ type: string ++ type: array ++ path: ++ type: string ++ readOnly: ++ type: boolean ++ secretFile: ++ type: string ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ user: ++ type: string ++ required: ++ - monitors ++ type: object ++ cinder: ++ properties: ++ fsType: ++ type: string ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ volumeID: ++ type: string ++ required: ++ - volumeID ++ type: object ++ configMap: ++ properties: ++ defaultMode: ++ format: int32 ++ type: integer ++ items: ++ items: ++ properties: ++ key: ++ type: string ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ required: ++ - key ++ - path ++ type: object ++ type: array ++ name: ++ type: string ++ optional: ++ type: boolean ++ type: object ++ x-kubernetes-map-type: atomic ++ csi: ++ properties: ++ driver: ++ type: string ++ fsType: ++ type: string ++ nodePublishSecretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ readOnly: ++ type: boolean ++ volumeAttributes: ++ additionalProperties: ++ type: string ++ type: object ++ required: ++ - driver ++ type: object ++ downwardAPI: ++ properties: ++ defaultMode: ++ format: int32 ++ type: integer ++ items: ++ items: ++ properties: ++ fieldRef: ++ properties: ++ apiVersion: ++ type: string ++ fieldPath: ++ type: string ++ required: ++ - fieldPath ++ type: object ++ x-kubernetes-map-type: atomic ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ resourceFieldRef: ++ properties: ++ containerName: ++ type: string ++ divisor: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ resource: ++ type: string ++ required: ++ - resource ++ type: object ++ x-kubernetes-map-type: atomic ++ required: ++ - path ++ type: object ++ type: array ++ type: object ++ emptyDir: ++ properties: ++ medium: ++ type: string ++ sizeLimit: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ type: object ++ ephemeral: ++ properties: ++ volumeClaimTemplate: ++ properties: ++ metadata: ++ properties: ++ annotations: ++ additionalProperties: ++ type: string ++ type: object ++ finalizers: ++ items: ++ type: string ++ type: array ++ labels: ++ additionalProperties: ++ type: string ++ type: object ++ name: ++ type: string ++ namespace: ++ type: string ++ type: object ++ spec: ++ properties: ++ accessModes: ++ items: ++ type: string ++ type: array ++ dataSource: ++ properties: ++ apiGroup: ++ type: string ++ kind: ++ type: string ++ name: ++ type: string ++ required: ++ - kind ++ - name ++ type: object ++ x-kubernetes-map-type: atomic ++ dataSourceRef: ++ properties: ++ apiGroup: ++ type: string ++ kind: ++ type: string ++ name: ++ type: string ++ required: ++ - kind ++ - name ++ type: object ++ x-kubernetes-map-type: atomic ++ resources: ++ properties: ++ limits: ++ additionalProperties: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ type: object ++ requests: ++ additionalProperties: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ type: object ++ type: object ++ selector: ++ properties: ++ matchExpressions: ++ items: ++ properties: ++ key: ++ type: string ++ operator: ++ type: string ++ values: ++ items: ++ type: string ++ type: array ++ required: ++ - key ++ - operator ++ type: object ++ type: array ++ matchLabels: ++ additionalProperties: ++ type: string ++ type: object ++ type: object ++ x-kubernetes-map-type: atomic ++ storageClassName: ++ type: string ++ volumeMode: ++ type: string ++ volumeName: ++ type: string ++ type: object ++ required: ++ - spec ++ type: object ++ type: object ++ fc: ++ properties: ++ fsType: ++ type: string ++ lun: ++ format: int32 ++ type: integer ++ readOnly: ++ type: boolean ++ targetWWNs: ++ items: ++ type: string ++ type: array ++ wwids: ++ items: ++ type: string ++ type: array ++ type: object ++ flexVolume: ++ properties: ++ driver: ++ type: string ++ fsType: ++ type: string ++ options: ++ additionalProperties: ++ type: string ++ type: object ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ required: ++ - driver ++ type: object ++ flocker: ++ properties: ++ datasetName: ++ type: string ++ datasetUUID: ++ type: string ++ type: object ++ gcePersistentDisk: ++ properties: ++ fsType: ++ type: string ++ partition: ++ format: int32 ++ type: integer ++ pdName: ++ type: string ++ readOnly: ++ type: boolean ++ required: ++ - pdName ++ type: object ++ gitRepo: ++ properties: ++ directory: ++ type: string ++ repository: ++ type: string ++ revision: ++ type: string ++ required: ++ - repository ++ type: object ++ glusterfs: ++ properties: ++ endpoints: ++ type: string ++ path: ++ type: string ++ readOnly: ++ type: boolean ++ required: ++ - endpoints ++ - path ++ type: object ++ hostPath: ++ properties: ++ path: ++ type: string ++ type: ++ type: string ++ required: ++ - path ++ type: object ++ iscsi: ++ properties: ++ chapAuthDiscovery: ++ type: boolean ++ chapAuthSession: ++ type: boolean ++ fsType: ++ type: string ++ initiatorName: ++ type: string ++ iqn: ++ type: string ++ iscsiInterface: ++ type: string ++ lun: ++ format: int32 ++ type: integer ++ portals: ++ items: ++ type: string ++ type: array ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ targetPortal: ++ type: string ++ required: ++ - iqn ++ - lun ++ - targetPortal ++ type: object ++ name: ++ type: string ++ nfs: ++ properties: ++ path: ++ type: string ++ readOnly: ++ type: boolean ++ server: ++ type: string ++ required: ++ - path ++ - server ++ type: object ++ persistentVolumeClaim: ++ properties: ++ claimName: ++ type: string ++ readOnly: ++ type: boolean ++ required: ++ - claimName ++ type: object ++ photonPersistentDisk: ++ properties: ++ fsType: ++ type: string ++ pdID: ++ type: string ++ required: ++ - pdID ++ type: object ++ portworxVolume: ++ properties: ++ fsType: ++ type: string ++ readOnly: ++ type: boolean ++ volumeID: ++ type: string ++ required: ++ - volumeID ++ type: object ++ projected: ++ properties: ++ defaultMode: ++ format: int32 ++ type: integer ++ sources: ++ items: ++ properties: ++ configMap: ++ properties: ++ items: ++ items: ++ properties: ++ key: ++ type: string ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ required: ++ - key ++ - path ++ type: object ++ type: array ++ name: ++ type: string ++ optional: ++ type: boolean ++ type: object ++ x-kubernetes-map-type: atomic ++ downwardAPI: ++ properties: ++ items: ++ items: ++ properties: ++ fieldRef: ++ properties: ++ apiVersion: ++ type: string ++ fieldPath: ++ type: string ++ required: ++ - fieldPath ++ type: object ++ x-kubernetes-map-type: atomic ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ resourceFieldRef: ++ properties: ++ containerName: ++ type: string ++ divisor: ++ anyOf: ++ - type: integer ++ - type: string ++ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ ++ x-kubernetes-int-or-string: true ++ resource: ++ type: string ++ required: ++ - resource ++ type: object ++ x-kubernetes-map-type: atomic ++ required: ++ - path ++ type: object ++ type: array ++ type: object ++ secret: ++ properties: ++ items: ++ items: ++ properties: ++ key: ++ type: string ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ required: ++ - key ++ - path ++ type: object ++ type: array ++ name: ++ type: string ++ optional: ++ type: boolean ++ type: object ++ x-kubernetes-map-type: atomic ++ serviceAccountToken: ++ properties: ++ audience: ++ type: string ++ expirationSeconds: ++ format: int64 ++ type: integer ++ path: ++ type: string ++ required: ++ - path ++ type: object ++ type: object ++ type: array ++ type: object ++ quobyte: ++ properties: ++ group: ++ type: string ++ readOnly: ++ type: boolean ++ registry: ++ type: string ++ tenant: ++ type: string ++ user: ++ type: string ++ volume: ++ type: string ++ required: ++ - registry ++ - volume ++ type: object ++ rbd: ++ properties: ++ fsType: ++ type: string ++ image: ++ type: string ++ keyring: ++ type: string ++ monitors: ++ items: ++ type: string ++ type: array ++ pool: ++ type: string ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ user: ++ type: string ++ required: ++ - image ++ - monitors ++ type: object ++ scaleIO: ++ properties: ++ fsType: ++ type: string ++ gateway: ++ type: string ++ protectionDomain: ++ type: string ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ sslEnabled: ++ type: boolean ++ storageMode: ++ type: string ++ storagePool: ++ type: string ++ system: ++ type: string ++ volumeName: ++ type: string ++ required: ++ - gateway ++ - secretRef ++ - system ++ type: object ++ secret: ++ properties: ++ defaultMode: ++ format: int32 ++ type: integer ++ items: ++ items: ++ properties: ++ key: ++ type: string ++ mode: ++ format: int32 ++ type: integer ++ path: ++ type: string ++ required: ++ - key ++ - path ++ type: object ++ type: array ++ optional: ++ type: boolean ++ secretName: ++ type: string ++ type: object ++ storageos: ++ properties: ++ fsType: ++ type: string ++ readOnly: ++ type: boolean ++ secretRef: ++ properties: ++ name: ++ type: string ++ type: object ++ x-kubernetes-map-type: atomic ++ volumeName: ++ type: string ++ volumeNamespace: ++ type: string ++ type: object ++ vsphereVolume: ++ properties: ++ fsType: ++ type: string ++ storagePolicyID: ++ type: string ++ storagePolicyName: ++ type: string ++ volumePath: ++ type: string ++ required: ++ - volumePath ++ type: object ++ required: ++ - name ++ type: object ++ type: array ++ x-kubernetes-list-type: atomic ++ type: object ++ status: ++ properties: ++ phase: ++ type: string ++ version: ++ type: string ++ required: ++ - phase ++ - version ++ type: object ++ type: object ++ served: true ++ storage: true ++ subresources: ++ status: {} +diff --git a/deploy-templates/jaeger-operator/templates/NOTES.txt b/deploy-templates/jaeger-operator/templates/NOTES.txt +index 64da5f5..23c62a9 100644 +--- a/deploy-templates/jaeger-operator/templates/NOTES.txt ++++ b/deploy-templates/jaeger-operator/templates/NOTES.txt +@@ -2,7 +2,7 @@ + + + Check the jaeger-operator logs +- export POD=$(kubectl get pods -l app.kubernetes.io/instance={{ .Release.Name }} -lapp.kubernetes.io/name=jaeger-operator --namespace {{ .Release.Namespace }} --output name) ++ export POD=$(kubectl get pods -l app.kubernetes.io/instance={{ .Release.Name }} -l app.kubernetes.io/name=jaeger-operator --namespace {{ .Release.Namespace }} --output name) + kubectl logs $POD --namespace={{ .Release.Namespace }} + + +diff --git a/deploy-templates/jaeger-operator/templates/certificate.yaml b/deploy-templates/jaeger-operator/templates/certificate.yaml +new file mode 100644 +index 0000000..67871f2 +--- /dev/null ++++ b/deploy-templates/jaeger-operator/templates/certificate.yaml +@@ -0,0 +1,22 @@ ++{{- if .Values.certs.certificate.create }} ++apiVersion: cert-manager.io/v1 ++kind: Certificate ++metadata: ++ name: {{ default "jaeger-operator-service-cert" .Values.certs.certificate.secretName }} ++ namespace: {{ .Release.Namespace }} ++spec: ++ dnsNames: ++ - "{{ default "jaeger-operator-webhook-service" .Values.webhooks.service.name }}.{{ .Release.Namespace }}.svc" ++ - "{{ default "jaeger-operator-webhook-service" .Values.webhooks.service.name }}.{{ .Release.Namespace }}.svc.cluster.local" ++ issuerRef: ++ {{- if .Values.certs.issuer.create }} ++ kind: Issuer ++ {{- else }} ++ kind: {{ .Values.certs.certificate.issuerKind }} ++ {{- end }} ++ name: {{ default "selfsigned-issuer" .Values.certs.issuer.name }} ++ secretName: {{ default "jaeger-operator-service-cert" .Values.certs.certificate.secretName }} ++ subject: ++ organizationalUnits: ++ - "{{ include "jaeger-operator.name" . }}" ++{{- end }} +diff --git a/deploy-templates/jaeger-operator/templates/deployment.yaml b/deploy-templates/jaeger-operator/templates/deployment.yaml +index 91af07a..f246180 100644 +--- a/deploy-templates/jaeger-operator/templates/deployment.yaml ++++ b/deploy-templates/jaeger-operator/templates/deployment.yaml +@@ -5,6 +5,9 @@ + namespace: {{ .Release.Namespace }} + labels: + {{ include "jaeger-operator.labels" . | indent 4 }} ++{{- with .Values.extraLabels }} ++{{ . | toYaml | indent 4 }} ++{{- end }} + spec: + replicas: 1 + selector: +@@ -15,6 +18,9 @@ + name: {{ include "jaeger-operator.fullname" . }} + labels: + {{ include "jaeger-operator.labels" . | indent 8 }} ++{{- with .Values.extraLabels }} ++{{ . | toYaml | indent 8 }} ++{{- end }} + spec: + {{- if .Values.serviceAccount.create }} + serviceAccountName: {{ include "jaeger-operator.serviceAccountName" . }} +@@ -32,14 +38,24 @@ + - name: {{ . }} + {{- end }} + {{- end }} ++ {{- if .Values.hostNetwork }} ++ hostNetwork: {{ .Values.hostNetwork }} ++ {{- end }} + containers: + - name: {{ include "jaeger-operator.fullname" . }} + image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + ports: +- - containerPort: 8383 ++ - containerPort: {{ .Values.metricsPort }} + name: metrics +- args: ["start","--kafka-provision=no","--openshift-oauth-proxy-image=quay.io/openshift/origin-oauth-proxy:4.12.0"] ++ - containerPort: {{ .Values.webhooks.port }} ++ name: webhook-server ++ protocol: TCP ++ volumeMounts: ++ - mountPath: /tmp/k8s-webhook-server/serving-certs ++ name: cert ++ readOnly: true ++ args: ["start"] + env: + - name: WATCH_NAMESPACE + {{- if .Values.rbac.clusterRole }} +@@ -64,6 +80,11 @@ + {{- end }} + resources: + {{ toYaml .Values.resources | indent 12 }} ++ volumes: ++ - name: cert ++ secret: ++ defaultMode: 420 ++ secretName: {{ default "jaeger-operator-service-cert" .Values.certs.certificate.secretName }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{ toYaml . | indent 8 }} +diff --git a/deploy-templates/jaeger-operator/templates/issuer.yaml b/deploy-templates/jaeger-operator/templates/issuer.yaml +new file mode 100644 +index 0000000..19b2382 +--- /dev/null ++++ b/deploy-templates/jaeger-operator/templates/issuer.yaml +@@ -0,0 +1,9 @@ ++{{- if .Values.certs.issuer.create }} ++apiVersion: cert-manager.io/v1 ++kind: Issuer ++metadata: ++ name: {{ default "selfsigned-issuer" .Values.certs.issuer.name }} ++ namespace: {{ .Release.Namespace }} ++spec: ++ selfSigned: {} ++{{- end }} +diff --git a/deploy-templates/jaeger-operator/templates/mutating-webhook.yaml b/deploy-templates/jaeger-operator/templates/mutating-webhook.yaml +new file mode 100644 +index 0000000..9ae6462 +--- /dev/null ++++ b/deploy-templates/jaeger-operator/templates/mutating-webhook.yaml +@@ -0,0 +1,57 @@ ++{{- if and (.Values.webhooks.mutatingWebhook.create) (.Values.webhooks.service.create) }} ++apiVersion: admissionregistration.k8s.io/v1 ++kind: MutatingWebhookConfiguration ++metadata: ++ annotations: ++ cert-manager.io/inject-ca-from: {{ default .Release.Namespace .Values.certs.certificate.namespace }}/{{ default "jaeger-operator-service-cert" .Values.certs.certificate.secretName }} ++ labels: ++{{ include "jaeger-operator.labels" . | indent 4 }} ++ name: jaeger-operator-mutating-webhook-configuration ++webhooks: ++- admissionReviewVersions: ++ - v1 ++ clientConfig: ++ service: ++ name: {{ default "jaeger-operator-webhook-service" .Values.webhooks.service.name }} ++ namespace: {{ .Release.Namespace }} ++ path: /mutate-v1-deployment ++ failurePolicy: Ignore ++ name: deployment.sidecar-injector.jaegertracing.io ++ objectSelector: ++ matchExpressions: ++ - key: app.kubernetes.io/name ++ operator: NotIn ++ values: ++ - {{ include "jaeger-operator.name" . }} ++ rules: ++ - apiGroups: ++ - apps ++ apiVersions: ++ - v1 ++ operations: ++ - CREATE ++ - UPDATE ++ resources: ++ - deployments ++ sideEffects: None ++- admissionReviewVersions: ++ - v1 ++ clientConfig: ++ service: ++ name: {{ default "jaeger-operator-webhook-service" .Values.webhooks.service.name }} ++ namespace: {{ .Release.Namespace }} ++ path: /mutate-jaegertracing-io-v1-jaeger ++ failurePolicy: Fail ++ name: mjaeger.kb.io ++ rules: ++ - apiGroups: ++ - jaegertracing.io ++ apiVersions: ++ - v1 ++ operations: ++ - CREATE ++ - UPDATE ++ resources: ++ - jaegers ++ sideEffects: None ++{{- end }} +diff --git a/deploy-templates/jaeger-operator/templates/role.yaml b/deploy-templates/jaeger-operator/templates/role.yaml +index 321a23c..ccc308d 100644 +--- a/deploy-templates/jaeger-operator/templates/role.yaml ++++ b/deploy-templates/jaeger-operator/templates/role.yaml +@@ -7,41 +7,13 @@ + labels: + {{ include "jaeger-operator.labels" . | indent 4 }} + rules: +-## our own custom resources +-- apiGroups: +- - jaegertracing.io +- resources: +- - '*' +- verbs: +- - create +- - delete +- - get +- - list +- - patch +- - update +- - watch +- +-## for the operator's own deployment + - apiGroups: + - apps +- resourceNames: +- - jaeger-operator + resources: +- - deployments/finalizers +- verbs: +- - update +- +-## regular things the operator manages for an instance, as the result of processing CRs +-- apiGroups: +- - "" +- resources: +- - configmaps +- - persistentvolumeclaims +- - pods +- - secrets +- - serviceaccounts +- - services +- - services/finalizers ++ - daemonsets ++ - deployments ++ - replicasets ++ - statefulsets + verbs: + - create + - delete +@@ -54,9 +26,6 @@ + - apps + resources: + - deployments +- - daemonsets +- - replicasets +- - statefulsets + verbs: + - create + - delete +@@ -66,22 +35,17 @@ + - update + - watch + - apiGroups: +- - extensions ++ - apps + resources: +- - ingresses ++ - deployments/status + verbs: +- - create +- - delete + - get +- - list + - patch + - update +- - watch +-# Ingress for kubernetes 1.14 or higher + - apiGroups: +- - networking.k8s.io ++ - autoscaling + resources: +- - ingresses ++ - horizontalpodautoscalers + verbs: + - create + - delete +@@ -93,20 +57,8 @@ + - apiGroups: + - batch + resources: +- - jobs + - cronjobs +- verbs: +- - create +- - delete +- - get +- - list +- - patch +- - update +- - watch +-- apiGroups: +- - route.openshift.io +- resources: +- - routes ++ - jobs + verbs: + - create + - delete +@@ -128,23 +80,24 @@ + - update + - watch + - apiGroups: +- - autoscaling ++ - coordination.k8s.io + resources: +- - horizontalpodautoscalers ++ - leases + verbs: + - create +- - delete + - get + - list +- - patch + - update +- - watch +- +-## needed if you want the operator to create service monitors for the Jaeger instances + - apiGroups: +- - monitoring.coreos.com ++ - "" + resources: +- - servicemonitors ++ - configmaps ++ - persistentvolumeclaims ++ - pods ++ - secrets ++ - serviceaccounts ++ - services ++ - services/finalizers + verbs: + - create + - delete +@@ -153,12 +106,10 @@ + - patch + - update + - watch +- +-## for the Elasticsearch auto-provisioning + - apiGroups: +- - logging.openshift.io ++ - "" + resources: +- - elasticsearches ++ - namespaces + verbs: + - create + - delete +@@ -167,8 +118,60 @@ + - patch + - update + - watch +- +-## for the Kafka auto-provisioning ++- apiGroups: ++ - "" ++ resources: ++ - namespaces/status ++ verbs: ++ - get ++ - patch ++ - update ++- apiGroups: ++ - extensions ++ resources: ++ - ingresses ++ verbs: ++ - create ++ - delete ++ - get ++ - list ++ - patch ++ - update ++ - watch ++- apiGroups: ++ - image.openshift.io ++ resources: ++ - imagestreams ++ verbs: ++ - get ++ - list ++ - watch ++- apiGroups: ++ - jaegertracing.io ++ resources: ++ - jaegers ++ verbs: ++ - create ++ - delete ++ - get ++ - list ++ - patch ++ - update ++ - watch ++- apiGroups: ++ - jaegertracing.io ++ resources: ++ - jaegers/finalizers ++ verbs: ++ - update ++- apiGroups: ++ - jaegertracing.io ++ resources: ++ - jaegers/status ++ verbs: ++ - get ++ - patch ++ - update + - apiGroups: + - kafka.strimzi.io + resources: +@@ -182,33 +185,54 @@ + - patch + - update + - watch +- +-## Extra permissions +-## This is an extra set of permissions that the Jaeger Operator might make use of if granted +- +-## needed if support for injecting sidecars based on namespace annotation is required + - apiGroups: +- - "" ++ - logging.openshift.io + resources: +- - namespaces ++ - elasticsearch + verbs: +- - 'get' +- - 'list' +- - 'watch' +- +-## needed if support for injecting sidecars based on deployment annotation is required, across all namespaces +-- apiGroups: +- - apps +- resources: +- - deployments +- verbs: ++ - create ++ - delete + - get + - list + - patch + - update + - watch +- +-## needed only when .Spec.Ingress.Openshift.DelegateUrls is used ++- apiGroups: ++ - logging.openshift.io ++ resources: ++ - elasticsearches ++ verbs: ++ - create ++ - delete ++ - get ++ - list ++ - patch ++ - update ++ - watch ++- apiGroups: ++ - monitoring.coreos.com ++ resources: ++ - servicemonitors ++ verbs: ++ - create ++ - delete ++ - get ++ - list ++ - patch ++ - update ++ - watch ++- apiGroups: ++ - networking.k8s.io ++ resources: ++ - ingresses ++ verbs: ++ - create ++ - delete ++ - get ++ - list ++ - patch ++ - update ++ - watch + - apiGroups: + - rbac.authorization.k8s.io + resources: +@@ -221,6 +245,18 @@ + - patch + - update + - watch ++- apiGroups: ++ - route.openshift.io ++ resources: ++ - routes ++ verbs: ++ - create ++ - delete ++ - get ++ - list ++ - patch ++ - update ++ - watch + {{- if .Values.rbac.pspEnabled }} + - apiGroups: ['policy'] + resources: ['podsecuritypolicies'] +diff --git a/deploy-templates/jaeger-operator/templates/service-account.yaml b/deploy-templates/jaeger-operator/templates/service-account.yaml +index 6d36c14..dc8eea6 100644 +--- a/deploy-templates/jaeger-operator/templates/service-account.yaml ++++ b/deploy-templates/jaeger-operator/templates/service-account.yaml +@@ -6,6 +6,10 @@ + namespace: {{ .Release.Namespace }} + labels: + {{ include "jaeger-operator.labels" . | indent 4 }} ++{{- if .Values.serviceAccount.annotations }} ++ annotations: ++{{ toYaml .Values.serviceAccount.annotations | indent 4 }} ++{{- end }} + {{- if .Values.image.imagePullSecrets }} + imagePullSecrets: + {{- range .Values.image.imagePullSecrets }} +diff --git a/deploy-templates/jaeger-operator/templates/service.yaml b/deploy-templates/jaeger-operator/templates/service.yaml +index cf91ec3..46705f8 100644 +--- a/deploy-templates/jaeger-operator/templates/service.yaml ++++ b/deploy-templates/jaeger-operator/templates/service.yaml +@@ -5,12 +5,19 @@ + namespace: {{ .Release.Namespace }} + labels: + {{ include "jaeger-operator.labels" . | indent 4 }} ++{{- with .Values.serviceExtraLabels }} ++{{ . | toYaml | indent 4 }} ++{{- end }} ++{{- if .Values.service.annotations }} ++ annotations: ++{{ toYaml .Values.service.annotations | indent 4 }} ++{{- end }} + spec: + ports: + - name: metrics +- port: 8383 ++ port: {{ .Values.metricsPort }} + protocol: TCP +- targetPort: 8383 ++ targetPort: {{ .Values.metricsPort }} + {{- if and (eq .Values.service.type "NodePort") (.Values.service.nodePort) }} + nodePort: {{ .Values.service.nodePort }} + {{- end }} +@@ -18,3 +25,24 @@ + app.kubernetes.io/name: {{ include "jaeger-operator.name" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + type: {{ .Values.service.type }} ++--- ++{{- if .Values.webhooks.service.create }} ++apiVersion: v1 ++kind: Service ++metadata: ++ labels: ++{{ include "jaeger-operator.labels" . | indent 4 }} ++ name: {{ default "jaeger-operator-webhook-service" .Values.webhooks.service.name }} ++ namespace: {{ .Release.Namespace }} ++{{- if .Values.webhooks.service.annotations }} ++ annotations: ++{{ toYaml .Values.webhooks.service.annotations | indent 4 }} ++{{- end }} ++spec: ++ ports: ++ - port: 443 ++ protocol: TCP ++ targetPort: {{ .Values.webhooks.port }} ++ selector: ++{{ include "jaeger-operator.labels" . | indent 4 }} ++{{- end }} +diff --git a/deploy-templates/jaeger-operator/templates/validating-webhook.yaml b/deploy-templates/jaeger-operator/templates/validating-webhook.yaml +new file mode 100644 +index 0000000..eb0c318 +--- /dev/null ++++ b/deploy-templates/jaeger-operator/templates/validating-webhook.yaml +@@ -0,0 +1,29 @@ ++{{- if and (.Values.webhooks.validatingWebhook.create) (.Values.webhooks.service.create) }} ++apiVersion: admissionregistration.k8s.io/v1 ++kind: ValidatingWebhookConfiguration ++metadata: ++ annotations: ++ cert-manager.io/inject-ca-from: {{ default .Release.Namespace .Values.certs.certificate.namespace }}/{{ default "jaeger-operator-service-cert" .Values.certs.certificate.secretName }} ++ name: jaeger-operator-validating-webhook-configuration ++webhooks: ++- admissionReviewVersions: ++ - v1 ++ clientConfig: ++ service: ++ name: {{ default "jaeger-operator-webhook-service" .Values.webhooks.service.name }} ++ namespace: {{ .Release.Namespace }} ++ path: /validate-jaegertracing-io-v1-jaeger ++ failurePolicy: Fail ++ name: vjaeger.kb.io ++ rules: ++ - apiGroups: ++ - jaegertracing.io ++ apiVersions: ++ - v1 ++ operations: ++ - CREATE ++ - UPDATE ++ resources: ++ - jaegers ++ sideEffects: None ++{{- end }} +diff --git a/deploy-templates/jaeger-operator/values.yaml b/deploy-templates/jaeger-operator/values.yaml +index b160787..41e29cc 100644 +--- a/deploy-templates/jaeger-operator/values.yaml ++++ b/deploy-templates/jaeger-operator/values.yaml +@@ -4,12 +4,36 @@ + + image: + repository: jaegertracing/jaeger-operator +- tag: 1.24.0 ++ tag: 1.39.0 + pullPolicy: IfNotPresent + imagePullSecrets: [] + + crd: +- install: true ++ install: false ++ ++certs: ++ issuer: ++ create: true ++ name: "" ++ certificate: ++ create: true ++ namespace: "" ++ secretName: "" ++ # Specify the cert-manager issuer kind to use an existing cert-manager ++ # issuer; typically Issuer or ClusterIssuer ++ # This field will be ignored if issuer.create is true ++ issuerKind: Issuer ++ ++webhooks: ++ mutatingWebhook: ++ create: true ++ validatingWebhook: ++ create: true ++ port: 9443 ++ service: ++ annotations: {} ++ create: true ++ name: "" + + jaeger: + # Specifies whether Jaeger instance should be created +@@ -28,6 +52,8 @@ + type: ClusterIP + # Specify a specific node port when type is NodePort + # nodePort: 32500 ++ # Annotations for service ++ annotations: {} + + serviceAccount: + # Specifies whether a ServiceAccount should be created +@@ -35,6 +61,8 @@ + # The name of the ServiceAccount to use. + # If not set and create is true, a name is generated using the fullname template + name: ++ # Annotations for serviceAccount ++ annotations: {} + + # Specifies extra environment variables passed to the operator: + extraEnv: [] +@@ -42,6 +70,14 @@ + # - name: LOG-LEVEL + # value: debug + ++serviceExtraLabels: {} ++ # Specifies extra labels for the operator-metric service: ++ # foo: bar ++ ++extraLabels: {} ++ # Specifies extra labels for the operator deployment: ++ # foo: bar ++ + resources: {} + # limits: + # cpu: 100m +@@ -59,3 +95,8 @@ + securityContext: {} + + priorityClassName: ++ ++# Specifies weather host network should be used ++hostNetwork: false ++ ++metricsPort: 8383 diff --git a/docs/ua/modules/admin/attachments/special-steps/cert-manager-crds.yaml b/docs/ua/modules/admin/attachments/special-steps/cert-manager-crds.yaml new file mode 100644 index 0000000000..49803e7beb --- /dev/null +++ b/docs/ua/modules/admin/attachments/special-steps/cert-manager-crds.yaml @@ -0,0 +1,16233 @@ +# Copyright 2022 The cert-manager Authors. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +--- +# Source: cert-manager/templates/templates.out +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: certificaterequests.cert-manager.io + annotations: + cert-manager.io/inject-ca-from-secret: 'cert-manager/cert-manager-webhook-ca' + labels: + app: 'cert-manager' + app.kubernetes.io/name: 'cert-manager' + app.kubernetes.io/instance: 'cert-manager' + # Generated labels + app.kubernetes.io/version: "v1.6.3" +spec: + group: cert-manager.io + names: + kind: CertificateRequest + listKind: CertificateRequestList + plural: certificaterequests + shortNames: + - cr + - crs + singular: certificaterequest + categories: + - cert-manager + scope: Namespaced + conversion: + # a Webhook strategy instruct API server to call an external webhook for any conversion between custom resources. + strategy: Webhook + # webhookClientConfig is required when strategy is `Webhook` and it configures the webhook endpoint to be called by API server. + webhook: + # We don't actually support `v1beta1` but is listed here as it is a + # required value for [Kubernetes v1.16](kubernetes/kubernetes#82023). The + # API server reads the supported versions in order, so _should always_ + # attempt a `v1` request which is understood by the cert-manager webhook. + # Any `v1beta1` request will return an error and fail closed for that + # resource (the whole object request is rejected). + # When we no longer support v1.16 we can remove `v1beta1` from this list. + conversionReviewVersions: ["v1", "v1beta1"] + clientConfig: + # + service: + name: 'cert-manager-webhook' + namespace: "cert-manager" + path: /convert + # + versions: + - name: v1alpha2 + subresources: + status: {} + additionalPrinterColumns: + - jsonPath: .status.conditions[?(@.type=="Approved")].status + name: Approved + type: string + - jsonPath: .status.conditions[?(@.type=="Denied")].status + name: Denied + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .spec.issuerRef.name + name: Issuer + type: string + - jsonPath: .spec.username + name: Requestor + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + priority: 1 + type: string + - jsonPath: .metadata.creationTimestamp + description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + name: Age + type: date + schema: + openAPIV3Schema: + description: "A CertificateRequest is used to request a signed certificate from one of the configured issuers. \n All fields within the CertificateRequest's `spec` are immutable after creation. A CertificateRequest will either succeed or fail, as denoted by its `status.state` field. \n A CertificateRequest is a one-shot resource, meaning it represents a single point in time request for a certificate and cannot be re-used." + type: object + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: Desired state of the CertificateRequest resource. + type: object + required: + - csr + - issuerRef + properties: + csr: + description: The PEM-encoded x509 certificate signing request to be submitted to the CA for signing. + type: string + format: byte + duration: + description: The requested 'duration' (i.e. lifetime) of the Certificate. This option may be ignored/overridden by some issuer types. + type: string + extra: + description: Extra contains extra attributes of the user that created the CertificateRequest. Populated by the cert-manager webhook on creation and immutable. + type: object + additionalProperties: + type: array + items: + type: string + groups: + description: Groups contains group membership of the user that created the CertificateRequest. Populated by the cert-manager webhook on creation and immutable. + type: array + items: + type: string + x-kubernetes-list-type: atomic + isCA: + description: IsCA will request to mark the certificate as valid for certificate signing when submitting to the issuer. This will automatically add the `cert sign` usage to the list of `usages`. + type: boolean + issuerRef: + description: IssuerRef is a reference to the issuer for this CertificateRequest. If the `kind` field is not set, or set to `Issuer`, an Issuer resource with the given name in the same namespace as the CertificateRequest will be used. If the `kind` field is set to `ClusterIssuer`, a ClusterIssuer with the provided name will be used. The `name` field in this stanza is required at all times. The group field refers to the API group of the issuer which defaults to `cert-manager.io` if empty. + type: object + required: + - name + properties: + group: + description: Group of the resource being referred to. + type: string + kind: + description: Kind of the resource being referred to. + type: string + name: + description: Name of the resource being referred to. + type: string + uid: + description: UID contains the uid of the user that created the CertificateRequest. Populated by the cert-manager webhook on creation and immutable. + type: string + usages: + description: Usages is the set of x509 usages that are requested for the certificate. Defaults to `digital signature` and `key encipherment` if not specified. + type: array + items: + description: 'KeyUsage specifies valid usage contexts for keys. See: https://tools.ietf.org/html/rfc5280#section-4.2.1.3 https://tools.ietf.org/html/rfc5280#section-4.2.1.12 Valid KeyUsage values are as follows: "signing", "digital signature", "content commitment", "key encipherment", "key agreement", "data encipherment", "cert sign", "crl sign", "encipher only", "decipher only", "any", "server auth", "client auth", "code signing", "email protection", "s/mime", "ipsec end system", "ipsec tunnel", "ipsec user", "timestamping", "ocsp signing", "microsoft sgc", "netscape sgc"' + type: string + enum: + - signing + - digital signature + - content commitment + - key encipherment + - key agreement + - data encipherment + - cert sign + - crl sign + - encipher only + - decipher only + - any + - server auth + - client auth + - code signing + - email protection + - s/mime + - ipsec end system + - ipsec tunnel + - ipsec user + - timestamping + - ocsp signing + - microsoft sgc + - netscape sgc + username: + description: Username contains the name of the user that created the CertificateRequest. Populated by the cert-manager webhook on creation and immutable. + type: string + status: + description: Status of the CertificateRequest. This is set and managed automatically. + type: object + properties: + ca: + description: The PEM encoded x509 certificate of the signer, also known as the CA (Certificate Authority). This is set on a best-effort basis by different issuers. If not set, the CA is assumed to be unknown/not available. + type: string + format: byte + certificate: + description: The PEM encoded x509 certificate resulting from the certificate signing request. If not set, the CertificateRequest has either not been completed or has failed. More information on failure can be found by checking the `conditions` field. + type: string + format: byte + conditions: + description: List of status conditions to indicate the status of a CertificateRequest. Known condition types are `Ready` and `InvalidRequest`. + type: array + items: + description: CertificateRequestCondition contains condition information for a CertificateRequest. + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: LastTransitionTime is the timestamp corresponding to the last status change of this condition. + type: string + format: date-time + message: + description: Message is a human readable description of the details of the last transition, complementing reason. + type: string + reason: + description: Reason is a brief machine readable explanation for the condition's last transition. + type: string + status: + description: Status of the condition, one of (`True`, `False`, `Unknown`). + type: string + enum: + - "True" + - "False" + - Unknown + type: + description: Type of the condition, known values are (`Ready`, `InvalidRequest`, `Approved`, `Denied`). + type: string + failureTime: + description: FailureTime stores the time that this CertificateRequest failed. This is used to influence garbage collection and back-off. + type: string + format: date-time + served: false + storage: false + - name: v1alpha3 + subresources: + status: {} + additionalPrinterColumns: + - jsonPath: .status.conditions[?(@.type=="Approved")].status + name: Approved + type: string + - jsonPath: .status.conditions[?(@.type=="Denied")].status + name: Denied + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .spec.issuerRef.name + name: Issuer + type: string + - jsonPath: .spec.username + name: Requestor + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + priority: 1 + type: string + - jsonPath: .metadata.creationTimestamp + description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + name: Age + type: date + schema: + openAPIV3Schema: + description: "A CertificateRequest is used to request a signed certificate from one of the configured issuers. \n All fields within the CertificateRequest's `spec` are immutable after creation. A CertificateRequest will either succeed or fail, as denoted by its `status.state` field. \n A CertificateRequest is a one-shot resource, meaning it represents a single point in time request for a certificate and cannot be re-used." + type: object + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: Desired state of the CertificateRequest resource. + type: object + required: + - csr + - issuerRef + properties: + csr: + description: The PEM-encoded x509 certificate signing request to be submitted to the CA for signing. + type: string + format: byte + duration: + description: The requested 'duration' (i.e. lifetime) of the Certificate. This option may be ignored/overridden by some issuer types. + type: string + extra: + description: Extra contains extra attributes of the user that created the CertificateRequest. Populated by the cert-manager webhook on creation and immutable. + type: object + additionalProperties: + type: array + items: + type: string + groups: + description: Groups contains group membership of the user that created the CertificateRequest. Populated by the cert-manager webhook on creation and immutable. + type: array + items: + type: string + x-kubernetes-list-type: atomic + isCA: + description: IsCA will request to mark the certificate as valid for certificate signing when submitting to the issuer. This will automatically add the `cert sign` usage to the list of `usages`. + type: boolean + issuerRef: + description: IssuerRef is a reference to the issuer for this CertificateRequest. If the `kind` field is not set, or set to `Issuer`, an Issuer resource with the given name in the same namespace as the CertificateRequest will be used. If the `kind` field is set to `ClusterIssuer`, a ClusterIssuer with the provided name will be used. The `name` field in this stanza is required at all times. The group field refers to the API group of the issuer which defaults to `cert-manager.io` if empty. + type: object + required: + - name + properties: + group: + description: Group of the resource being referred to. + type: string + kind: + description: Kind of the resource being referred to. + type: string + name: + description: Name of the resource being referred to. + type: string + uid: + description: UID contains the uid of the user that created the CertificateRequest. Populated by the cert-manager webhook on creation and immutable. + type: string + usages: + description: Usages is the set of x509 usages that are requested for the certificate. Defaults to `digital signature` and `key encipherment` if not specified. + type: array + items: + description: 'KeyUsage specifies valid usage contexts for keys. See: https://tools.ietf.org/html/rfc5280#section-4.2.1.3 https://tools.ietf.org/html/rfc5280#section-4.2.1.12 Valid KeyUsage values are as follows: "signing", "digital signature", "content commitment", "key encipherment", "key agreement", "data encipherment", "cert sign", "crl sign", "encipher only", "decipher only", "any", "server auth", "client auth", "code signing", "email protection", "s/mime", "ipsec end system", "ipsec tunnel", "ipsec user", "timestamping", "ocsp signing", "microsoft sgc", "netscape sgc"' + type: string + enum: + - signing + - digital signature + - content commitment + - key encipherment + - key agreement + - data encipherment + - cert sign + - crl sign + - encipher only + - decipher only + - any + - server auth + - client auth + - code signing + - email protection + - s/mime + - ipsec end system + - ipsec tunnel + - ipsec user + - timestamping + - ocsp signing + - microsoft sgc + - netscape sgc + username: + description: Username contains the name of the user that created the CertificateRequest. Populated by the cert-manager webhook on creation and immutable. + type: string + status: + description: Status of the CertificateRequest. This is set and managed automatically. + type: object + properties: + ca: + description: The PEM encoded x509 certificate of the signer, also known as the CA (Certificate Authority). This is set on a best-effort basis by different issuers. If not set, the CA is assumed to be unknown/not available. + type: string + format: byte + certificate: + description: The PEM encoded x509 certificate resulting from the certificate signing request. If not set, the CertificateRequest has either not been completed or has failed. More information on failure can be found by checking the `conditions` field. + type: string + format: byte + conditions: + description: List of status conditions to indicate the status of a CertificateRequest. Known condition types are `Ready` and `InvalidRequest`. + type: array + items: + description: CertificateRequestCondition contains condition information for a CertificateRequest. + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: LastTransitionTime is the timestamp corresponding to the last status change of this condition. + type: string + format: date-time + message: + description: Message is a human readable description of the details of the last transition, complementing reason. + type: string + reason: + description: Reason is a brief machine readable explanation for the condition's last transition. + type: string + status: + description: Status of the condition, one of (`True`, `False`, `Unknown`). + type: string + enum: + - "True" + - "False" + - Unknown + type: + description: Type of the condition, known values are (`Ready`, `InvalidRequest`, `Approved`, `Denied`). + type: string + failureTime: + description: FailureTime stores the time that this CertificateRequest failed. This is used to influence garbage collection and back-off. + type: string + format: date-time + served: false + storage: false + - name: v1beta1 + subresources: + status: {} + additionalPrinterColumns: + - jsonPath: .status.conditions[?(@.type=="Approved")].status + name: Approved + type: string + - jsonPath: .status.conditions[?(@.type=="Denied")].status + name: Denied + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .spec.issuerRef.name + name: Issuer + type: string + - jsonPath: .spec.username + name: Requestor + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + priority: 1 + type: string + - jsonPath: .metadata.creationTimestamp + description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + name: Age + type: date + schema: + openAPIV3Schema: + description: "A CertificateRequest is used to request a signed certificate from one of the configured issuers. \n All fields within the CertificateRequest's `spec` are immutable after creation. A CertificateRequest will either succeed or fail, as denoted by its `status.state` field. \n A CertificateRequest is a one-shot resource, meaning it represents a single point in time request for a certificate and cannot be re-used." + type: object + required: + - spec + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: Desired state of the CertificateRequest resource. + type: object + required: + - issuerRef + - request + properties: + duration: + description: The requested 'duration' (i.e. lifetime) of the Certificate. This option may be ignored/overridden by some issuer types. + type: string + extra: + description: Extra contains extra attributes of the user that created the CertificateRequest. Populated by the cert-manager webhook on creation and immutable. + type: object + additionalProperties: + type: array + items: + type: string + groups: + description: Groups contains group membership of the user that created the CertificateRequest. Populated by the cert-manager webhook on creation and immutable. + type: array + items: + type: string + x-kubernetes-list-type: atomic + isCA: + description: IsCA will request to mark the certificate as valid for certificate signing when submitting to the issuer. This will automatically add the `cert sign` usage to the list of `usages`. + type: boolean + issuerRef: + description: IssuerRef is a reference to the issuer for this CertificateRequest. If the `kind` field is not set, or set to `Issuer`, an Issuer resource with the given name in the same namespace as the CertificateRequest will be used. If the `kind` field is set to `ClusterIssuer`, a ClusterIssuer with the provided name will be used. The `name` field in this stanza is required at all times. The group field refers to the API group of the issuer which defaults to `cert-manager.io` if empty. + type: object + required: + - name + properties: + group: + description: Group of the resource being referred to. + type: string + kind: + description: Kind of the resource being referred to. + type: string + name: + description: Name of the resource being referred to. + type: string + request: + description: The PEM-encoded x509 certificate signing request to be submitted to the CA for signing. + type: string + format: byte + uid: + description: UID contains the uid of the user that created the CertificateRequest. Populated by the cert-manager webhook on creation and immutable. + type: string + usages: + description: Usages is the set of x509 usages that are requested for the certificate. Defaults to `digital signature` and `key encipherment` if not specified. + type: array + items: + description: 'KeyUsage specifies valid usage contexts for keys. See: https://tools.ietf.org/html/rfc5280#section-4.2.1.3 https://tools.ietf.org/html/rfc5280#section-4.2.1.12 Valid KeyUsage values are as follows: "signing", "digital signature", "content commitment", "key encipherment", "key agreement", "data encipherment", "cert sign", "crl sign", "encipher only", "decipher only", "any", "server auth", "client auth", "code signing", "email protection", "s/mime", "ipsec end system", "ipsec tunnel", "ipsec user", "timestamping", "ocsp signing", "microsoft sgc", "netscape sgc"' + type: string + enum: + - signing + - digital signature + - content commitment + - key encipherment + - key agreement + - data encipherment + - cert sign + - crl sign + - encipher only + - decipher only + - any + - server auth + - client auth + - code signing + - email protection + - s/mime + - ipsec end system + - ipsec tunnel + - ipsec user + - timestamping + - ocsp signing + - microsoft sgc + - netscape sgc + username: + description: Username contains the name of the user that created the CertificateRequest. Populated by the cert-manager webhook on creation and immutable. + type: string + status: + description: Status of the CertificateRequest. This is set and managed automatically. + type: object + properties: + ca: + description: The PEM encoded x509 certificate of the signer, also known as the CA (Certificate Authority). This is set on a best-effort basis by different issuers. If not set, the CA is assumed to be unknown/not available. + type: string + format: byte + certificate: + description: The PEM encoded x509 certificate resulting from the certificate signing request. If not set, the CertificateRequest has either not been completed or has failed. More information on failure can be found by checking the `conditions` field. + type: string + format: byte + conditions: + description: List of status conditions to indicate the status of a CertificateRequest. Known condition types are `Ready` and `InvalidRequest`. + type: array + items: + description: CertificateRequestCondition contains condition information for a CertificateRequest. + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: LastTransitionTime is the timestamp corresponding to the last status change of this condition. + type: string + format: date-time + message: + description: Message is a human readable description of the details of the last transition, complementing reason. + type: string + reason: + description: Reason is a brief machine readable explanation for the condition's last transition. + type: string + status: + description: Status of the condition, one of (`True`, `False`, `Unknown`). + type: string + enum: + - "True" + - "False" + - Unknown + type: + description: Type of the condition, known values are (`Ready`, `InvalidRequest`, `Approved`, `Denied`). + type: string + failureTime: + description: FailureTime stores the time that this CertificateRequest failed. This is used to influence garbage collection and back-off. + type: string + format: date-time + served: false + storage: false + - name: v1 + subresources: + status: {} + additionalPrinterColumns: + - jsonPath: .status.conditions[?(@.type=="Approved")].status + name: Approved + type: string + - jsonPath: .status.conditions[?(@.type=="Denied")].status + name: Denied + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .spec.issuerRef.name + name: Issuer + type: string + - jsonPath: .spec.username + name: Requestor + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + priority: 1 + type: string + - jsonPath: .metadata.creationTimestamp + description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + name: Age + type: date + schema: + openAPIV3Schema: + description: "A CertificateRequest is used to request a signed certificate from one of the configured issuers. \n All fields within the CertificateRequest's `spec` are immutable after creation. A CertificateRequest will either succeed or fail, as denoted by its `status.state` field. \n A CertificateRequest is a one-shot resource, meaning it represents a single point in time request for a certificate and cannot be re-used." + type: object + required: + - spec + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: Desired state of the CertificateRequest resource. + type: object + required: + - issuerRef + - request + properties: + duration: + description: The requested 'duration' (i.e. lifetime) of the Certificate. This option may be ignored/overridden by some issuer types. + type: string + extra: + description: Extra contains extra attributes of the user that created the CertificateRequest. Populated by the cert-manager webhook on creation and immutable. + type: object + additionalProperties: + type: array + items: + type: string + groups: + description: Groups contains group membership of the user that created the CertificateRequest. Populated by the cert-manager webhook on creation and immutable. + type: array + items: + type: string + x-kubernetes-list-type: atomic + isCA: + description: IsCA will request to mark the certificate as valid for certificate signing when submitting to the issuer. This will automatically add the `cert sign` usage to the list of `usages`. + type: boolean + issuerRef: + description: IssuerRef is a reference to the issuer for this CertificateRequest. If the `kind` field is not set, or set to `Issuer`, an Issuer resource with the given name in the same namespace as the CertificateRequest will be used. If the `kind` field is set to `ClusterIssuer`, a ClusterIssuer with the provided name will be used. The `name` field in this stanza is required at all times. The group field refers to the API group of the issuer which defaults to `cert-manager.io` if empty. + type: object + required: + - name + properties: + group: + description: Group of the resource being referred to. + type: string + kind: + description: Kind of the resource being referred to. + type: string + name: + description: Name of the resource being referred to. + type: string + request: + description: The PEM-encoded x509 certificate signing request to be submitted to the CA for signing. + type: string + format: byte + uid: + description: UID contains the uid of the user that created the CertificateRequest. Populated by the cert-manager webhook on creation and immutable. + type: string + usages: + description: Usages is the set of x509 usages that are requested for the certificate. If usages are set they SHOULD be encoded inside the CSR spec Defaults to `digital signature` and `key encipherment` if not specified. + type: array + items: + description: 'KeyUsage specifies valid usage contexts for keys. See: https://tools.ietf.org/html/rfc5280#section-4.2.1.3 https://tools.ietf.org/html/rfc5280#section-4.2.1.12 Valid KeyUsage values are as follows: "signing", "digital signature", "content commitment", "key encipherment", "key agreement", "data encipherment", "cert sign", "crl sign", "encipher only", "decipher only", "any", "server auth", "client auth", "code signing", "email protection", "s/mime", "ipsec end system", "ipsec tunnel", "ipsec user", "timestamping", "ocsp signing", "microsoft sgc", "netscape sgc"' + type: string + enum: + - signing + - digital signature + - content commitment + - key encipherment + - key agreement + - data encipherment + - cert sign + - crl sign + - encipher only + - decipher only + - any + - server auth + - client auth + - code signing + - email protection + - s/mime + - ipsec end system + - ipsec tunnel + - ipsec user + - timestamping + - ocsp signing + - microsoft sgc + - netscape sgc + username: + description: Username contains the name of the user that created the CertificateRequest. Populated by the cert-manager webhook on creation and immutable. + type: string + status: + description: Status of the CertificateRequest. This is set and managed automatically. + type: object + properties: + ca: + description: The PEM encoded x509 certificate of the signer, also known as the CA (Certificate Authority). This is set on a best-effort basis by different issuers. If not set, the CA is assumed to be unknown/not available. + type: string + format: byte + certificate: + description: The PEM encoded x509 certificate resulting from the certificate signing request. If not set, the CertificateRequest has either not been completed or has failed. More information on failure can be found by checking the `conditions` field. + type: string + format: byte + conditions: + description: List of status conditions to indicate the status of a CertificateRequest. Known condition types are `Ready` and `InvalidRequest`. + type: array + items: + description: CertificateRequestCondition contains condition information for a CertificateRequest. + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: LastTransitionTime is the timestamp corresponding to the last status change of this condition. + type: string + format: date-time + message: + description: Message is a human readable description of the details of the last transition, complementing reason. + type: string + reason: + description: Reason is a brief machine readable explanation for the condition's last transition. + type: string + status: + description: Status of the condition, one of (`True`, `False`, `Unknown`). + type: string + enum: + - "True" + - "False" + - Unknown + type: + description: Type of the condition, known values are (`Ready`, `InvalidRequest`, `Approved`, `Denied`). + type: string + failureTime: + description: FailureTime stores the time that this CertificateRequest failed. This is used to influence garbage collection and back-off. + type: string + format: date-time + served: true + storage: true +--- +# Source: cert-manager/templates/templates.out +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: certificates.cert-manager.io + annotations: + cert-manager.io/inject-ca-from-secret: 'cert-manager/cert-manager-webhook-ca' + labels: + app: 'cert-manager' + app.kubernetes.io/name: 'cert-manager' + app.kubernetes.io/instance: 'cert-manager' + # Generated labels + app.kubernetes.io/version: "v1.6.3" +spec: + group: cert-manager.io + names: + kind: Certificate + listKind: CertificateList + plural: certificates + shortNames: + - cert + - certs + singular: certificate + categories: + - cert-manager + scope: Namespaced + conversion: + # a Webhook strategy instruct API server to call an external webhook for any conversion between custom resources. + strategy: Webhook + # webhookClientConfig is required when strategy is `Webhook` and it configures the webhook endpoint to be called by API server. + webhook: + # We don't actually support `v1beta1` but is listed here as it is a + # required value for [Kubernetes v1.16](kubernetes/kubernetes#82023). The + # API server reads the supported versions in order, so _should always_ + # attempt a `v1` request which is understood by the cert-manager webhook. + # Any `v1beta1` request will return an error and fail closed for that + # resource (the whole object request is rejected). + # When we no longer support v1.16 we can remove `v1beta1` from this list. + conversionReviewVersions: ["v1", "v1beta1"] + clientConfig: + # + service: + name: 'cert-manager-webhook' + namespace: "cert-manager" + path: /convert + # + versions: + - name: v1alpha2 + subresources: + status: {} + additionalPrinterColumns: + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .spec.secretName + name: Secret + type: string + - jsonPath: .spec.issuerRef.name + name: Issuer + priority: 1 + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + priority: 1 + type: string + - jsonPath: .metadata.creationTimestamp + description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + name: Age + type: date + schema: + openAPIV3Schema: + description: "A Certificate resource should be created to ensure an up to date and signed x509 certificate is stored in the Kubernetes Secret resource named in `spec.secretName`. \n The stored certificate will be renewed before it expires (as configured by `spec.renewBefore`)." + type: object + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: Desired state of the Certificate resource. + type: object + required: + - issuerRef + - secretName + properties: + commonName: + description: 'CommonName is a common name to be used on the Certificate. The CommonName should have a length of 64 characters or fewer to avoid generating invalid CSRs. This value is ignored by TLS clients when any subject alt name is set. This is x509 behaviour: https://tools.ietf.org/html/rfc6125#section-6.4.4' + type: string + dnsNames: + description: DNSNames is a list of DNS subjectAltNames to be set on the Certificate. + type: array + items: + type: string + duration: + description: The requested 'duration' (i.e. lifetime) of the Certificate. This option may be ignored/overridden by some issuer types. If unset this defaults to 90 days. Certificate will be renewed either 2/3 through its duration or `renewBefore` period before its expiry, whichever is later. Minimum accepted duration is 1 hour. Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration + type: string + emailSANs: + description: EmailSANs is a list of email subjectAltNames to be set on the Certificate. + type: array + items: + type: string + encodeUsagesInRequest: + description: EncodeUsagesInRequest controls whether key usages should be present in the CertificateRequest + type: boolean + ipAddresses: + description: IPAddresses is a list of IP address subjectAltNames to be set on the Certificate. + type: array + items: + type: string + isCA: + description: IsCA will mark this Certificate as valid for certificate signing. This will automatically add the `cert sign` usage to the list of `usages`. + type: boolean + issuerRef: + description: IssuerRef is a reference to the issuer for this certificate. If the `kind` field is not set, or set to `Issuer`, an Issuer resource with the given name in the same namespace as the Certificate will be used. If the `kind` field is set to `ClusterIssuer`, a ClusterIssuer with the provided name will be used. The `name` field in this stanza is required at all times. + type: object + required: + - name + properties: + group: + description: Group of the resource being referred to. + type: string + kind: + description: Kind of the resource being referred to. + type: string + name: + description: Name of the resource being referred to. + type: string + keyAlgorithm: + description: KeyAlgorithm is the private key algorithm of the corresponding private key for this certificate. If provided, allowed values are either `rsa` or `ecdsa` If `keyAlgorithm` is specified and `keySize` is not provided, key size of 256 will be used for `ecdsa` key algorithm and key size of 2048 will be used for `rsa` key algorithm. + type: string + enum: + - rsa + - ecdsa + keyEncoding: + description: KeyEncoding is the private key cryptography standards (PKCS) for this certificate's private key to be encoded in. If provided, allowed values are `pkcs1` and `pkcs8` standing for PKCS#1 and PKCS#8, respectively. If KeyEncoding is not specified, then `pkcs1` will be used by default. + type: string + enum: + - pkcs1 + - pkcs8 + keySize: + description: KeySize is the key bit size of the corresponding private key for this certificate. If `keyAlgorithm` is set to `rsa`, valid values are `2048`, `4096` or `8192`, and will default to `2048` if not specified. If `keyAlgorithm` is set to `ecdsa`, valid values are `256`, `384` or `521`, and will default to `256` if not specified. No other values are allowed. + type: integer + keystores: + description: Keystores configures additional keystore output formats stored in the `secretName` Secret resource. + type: object + properties: + jks: + description: JKS configures options for storing a JKS keystore in the `spec.secretName` Secret resource. + type: object + required: + - create + - passwordSecretRef + properties: + create: + description: Create enables JKS keystore creation for the Certificate. If true, a file named `keystore.jks` will be created in the target Secret resource, encrypted using the password stored in `passwordSecretRef`. The keystore file will only be updated upon re-issuance. + type: boolean + passwordSecretRef: + description: PasswordSecretRef is a reference to a key in a Secret resource containing the password used to encrypt the JKS keystore. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + pkcs12: + description: PKCS12 configures options for storing a PKCS12 keystore in the `spec.secretName` Secret resource. + type: object + required: + - create + - passwordSecretRef + properties: + create: + description: Create enables PKCS12 keystore creation for the Certificate. If true, a file named `keystore.p12` will be created in the target Secret resource, encrypted using the password stored in `passwordSecretRef`. The keystore file will only be updated upon re-issuance. + type: boolean + passwordSecretRef: + description: PasswordSecretRef is a reference to a key in a Secret resource containing the password used to encrypt the PKCS12 keystore. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + organization: + description: Organization is a list of organizations to be used on the Certificate. + type: array + items: + type: string + privateKey: + description: Options to control private keys used for the Certificate. + type: object + properties: + rotationPolicy: + description: RotationPolicy controls how private keys should be regenerated when a re-issuance is being processed. If set to Never, a private key will only be generated if one does not already exist in the target `spec.secretName`. If one does exists but it does not have the correct algorithm or size, a warning will be raised to await user intervention. If set to Always, a private key matching the specified requirements will be generated whenever a re-issuance occurs. Default is 'Never' for backward compatibility. + type: string + renewBefore: + description: How long before the currently issued certificate's expiry cert-manager should renew the certificate. The default is 2/3 of the issued certificate's duration. Minimum accepted value is 5 minutes. Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration + type: string + revisionHistoryLimit: + description: revisionHistoryLimit is the maximum number of CertificateRequest revisions that are maintained in the Certificate's history. Each revision represents a single `CertificateRequest` created by this Certificate, either when it was created, renewed, or Spec was changed. Revisions will be removed by oldest first if the number of revisions exceeds this number. If set, revisionHistoryLimit must be a value of `1` or greater. If unset (`nil`), revisions will not be garbage collected. Default value is `nil`. + type: integer + format: int32 + secretName: + description: SecretName is the name of the secret resource that will be automatically created and managed by this Certificate resource. It will be populated with a private key and certificate, signed by the denoted issuer. + type: string + secretTemplate: + description: SecretTemplate defines annotations and labels to be propagated to the Kubernetes Secret when it is created or updated. Once created, labels and annotations are not yet removed from the Secret when they are removed from the template. See https://github.com/jetstack/cert-manager/issues/4292 + type: object + properties: + annotations: + description: Annotations is a key value map to be copied to the target Kubernetes Secret. + type: object + additionalProperties: + type: string + labels: + description: Labels is a key value map to be copied to the target Kubernetes Secret. + type: object + additionalProperties: + type: string + subject: + description: Full X509 name specification (https://golang.org/pkg/crypto/x509/pkix/#Name). + type: object + properties: + countries: + description: Countries to be used on the Certificate. + type: array + items: + type: string + localities: + description: Cities to be used on the Certificate. + type: array + items: + type: string + organizationalUnits: + description: Organizational Units to be used on the Certificate. + type: array + items: + type: string + postalCodes: + description: Postal codes to be used on the Certificate. + type: array + items: + type: string + provinces: + description: State/Provinces to be used on the Certificate. + type: array + items: + type: string + serialNumber: + description: Serial number to be used on the Certificate. + type: string + streetAddresses: + description: Street addresses to be used on the Certificate. + type: array + items: + type: string + uriSANs: + description: URISANs is a list of URI subjectAltNames to be set on the Certificate. + type: array + items: + type: string + usages: + description: Usages is the set of x509 usages that are requested for the certificate. Defaults to `digital signature` and `key encipherment` if not specified. + type: array + items: + description: 'KeyUsage specifies valid usage contexts for keys. See: https://tools.ietf.org/html/rfc5280#section-4.2.1.3 https://tools.ietf.org/html/rfc5280#section-4.2.1.12 Valid KeyUsage values are as follows: "signing", "digital signature", "content commitment", "key encipherment", "key agreement", "data encipherment", "cert sign", "crl sign", "encipher only", "decipher only", "any", "server auth", "client auth", "code signing", "email protection", "s/mime", "ipsec end system", "ipsec tunnel", "ipsec user", "timestamping", "ocsp signing", "microsoft sgc", "netscape sgc"' + type: string + enum: + - signing + - digital signature + - content commitment + - key encipherment + - key agreement + - data encipherment + - cert sign + - crl sign + - encipher only + - decipher only + - any + - server auth + - client auth + - code signing + - email protection + - s/mime + - ipsec end system + - ipsec tunnel + - ipsec user + - timestamping + - ocsp signing + - microsoft sgc + - netscape sgc + status: + description: Status of the Certificate. This is set and managed automatically. + type: object + properties: + conditions: + description: List of status conditions to indicate the status of certificates. Known condition types are `Ready` and `Issuing`. + type: array + items: + description: CertificateCondition contains condition information for an Certificate. + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: LastTransitionTime is the timestamp corresponding to the last status change of this condition. + type: string + format: date-time + message: + description: Message is a human readable description of the details of the last transition, complementing reason. + type: string + observedGeneration: + description: If set, this represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.condition[x].observedGeneration is 9, the condition is out of date with respect to the current state of the Certificate. + type: integer + format: int64 + reason: + description: Reason is a brief machine readable explanation for the condition's last transition. + type: string + status: + description: Status of the condition, one of (`True`, `False`, `Unknown`). + type: string + enum: + - "True" + - "False" + - Unknown + type: + description: Type of the condition, known values are (`Ready`, `Issuing`). + type: string + lastFailureTime: + description: LastFailureTime is the time as recorded by the Certificate controller of the most recent failure to complete a CertificateRequest for this Certificate resource. If set, cert-manager will not re-request another Certificate until 1 hour has elapsed from this time. + type: string + format: date-time + nextPrivateKeySecretName: + description: The name of the Secret resource containing the private key to be used for the next certificate iteration. The keymanager controller will automatically set this field if the `Issuing` condition is set to `True`. It will automatically unset this field when the Issuing condition is not set or False. + type: string + notAfter: + description: The expiration time of the certificate stored in the secret named by this resource in `spec.secretName`. + type: string + format: date-time + notBefore: + description: The time after which the certificate stored in the secret named by this resource in spec.secretName is valid. + type: string + format: date-time + renewalTime: + description: RenewalTime is the time at which the certificate will be next renewed. If not set, no upcoming renewal is scheduled. + type: string + format: date-time + revision: + description: "The current 'revision' of the certificate as issued. \n When a CertificateRequest resource is created, it will have the `cert-manager.io/certificate-revision` set to one greater than the current value of this field. \n Upon issuance, this field will be set to the value of the annotation on the CertificateRequest resource used to issue the certificate. \n Persisting the value on the CertificateRequest resource allows the certificates controller to know whether a request is part of an old issuance or if it is part of the ongoing revision's issuance by checking if the revision value in the annotation is greater than this field." + type: integer + served: false + storage: false + - name: v1alpha3 + subresources: + status: {} + additionalPrinterColumns: + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .spec.secretName + name: Secret + type: string + - jsonPath: .spec.issuerRef.name + name: Issuer + priority: 1 + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + priority: 1 + type: string + - jsonPath: .metadata.creationTimestamp + description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + name: Age + type: date + schema: + openAPIV3Schema: + description: "A Certificate resource should be created to ensure an up to date and signed x509 certificate is stored in the Kubernetes Secret resource named in `spec.secretName`. \n The stored certificate will be renewed before it expires (as configured by `spec.renewBefore`)." + type: object + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: Desired state of the Certificate resource. + type: object + required: + - issuerRef + - secretName + properties: + commonName: + description: 'CommonName is a common name to be used on the Certificate. The CommonName should have a length of 64 characters or fewer to avoid generating invalid CSRs. This value is ignored by TLS clients when any subject alt name is set. This is x509 behaviour: https://tools.ietf.org/html/rfc6125#section-6.4.4' + type: string + dnsNames: + description: DNSNames is a list of DNS subjectAltNames to be set on the Certificate. + type: array + items: + type: string + duration: + description: The requested 'duration' (i.e. lifetime) of the Certificate. This option may be ignored/overridden by some issuer types. If unset this defaults to 90 days. Certificate will be renewed either 2/3 through its duration or `renewBefore` period before its expiry, whichever is later. Minimum accepted duration is 1 hour. Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration + type: string + emailSANs: + description: EmailSANs is a list of email subjectAltNames to be set on the Certificate. + type: array + items: + type: string + encodeUsagesInRequest: + description: EncodeUsagesInRequest controls whether key usages should be present in the CertificateRequest + type: boolean + ipAddresses: + description: IPAddresses is a list of IP address subjectAltNames to be set on the Certificate. + type: array + items: + type: string + isCA: + description: IsCA will mark this Certificate as valid for certificate signing. This will automatically add the `cert sign` usage to the list of `usages`. + type: boolean + issuerRef: + description: IssuerRef is a reference to the issuer for this certificate. If the `kind` field is not set, or set to `Issuer`, an Issuer resource with the given name in the same namespace as the Certificate will be used. If the `kind` field is set to `ClusterIssuer`, a ClusterIssuer with the provided name will be used. The `name` field in this stanza is required at all times. + type: object + required: + - name + properties: + group: + description: Group of the resource being referred to. + type: string + kind: + description: Kind of the resource being referred to. + type: string + name: + description: Name of the resource being referred to. + type: string + keyAlgorithm: + description: KeyAlgorithm is the private key algorithm of the corresponding private key for this certificate. If provided, allowed values are either `rsa` or `ecdsa` If `keyAlgorithm` is specified and `keySize` is not provided, key size of 256 will be used for `ecdsa` key algorithm and key size of 2048 will be used for `rsa` key algorithm. + type: string + enum: + - rsa + - ecdsa + keyEncoding: + description: KeyEncoding is the private key cryptography standards (PKCS) for this certificate's private key to be encoded in. If provided, allowed values are `pkcs1` and `pkcs8` standing for PKCS#1 and PKCS#8, respectively. If KeyEncoding is not specified, then `pkcs1` will be used by default. + type: string + enum: + - pkcs1 + - pkcs8 + keySize: + description: KeySize is the key bit size of the corresponding private key for this certificate. If `keyAlgorithm` is set to `rsa`, valid values are `2048`, `4096` or `8192`, and will default to `2048` if not specified. If `keyAlgorithm` is set to `ecdsa`, valid values are `256`, `384` or `521`, and will default to `256` if not specified. No other values are allowed. + type: integer + keystores: + description: Keystores configures additional keystore output formats stored in the `secretName` Secret resource. + type: object + properties: + jks: + description: JKS configures options for storing a JKS keystore in the `spec.secretName` Secret resource. + type: object + required: + - create + - passwordSecretRef + properties: + create: + description: Create enables JKS keystore creation for the Certificate. If true, a file named `keystore.jks` will be created in the target Secret resource, encrypted using the password stored in `passwordSecretRef`. The keystore file will only be updated upon re-issuance. A file named `truststore.jks` will also be created in the target Secret resource, encrypted using the password stored in `passwordSecretRef` containing the issuing Certificate Authority. + type: boolean + passwordSecretRef: + description: PasswordSecretRef is a reference to a key in a Secret resource containing the password used to encrypt the JKS keystore. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + pkcs12: + description: PKCS12 configures options for storing a PKCS12 keystore in the `spec.secretName` Secret resource. + type: object + required: + - create + - passwordSecretRef + properties: + create: + description: Create enables PKCS12 keystore creation for the Certificate. If true, a file named `keystore.p12` will be created in the target Secret resource, encrypted using the password stored in `passwordSecretRef`. The keystore file will only be updated upon re-issuance. A file named `truststore.p12` will also be created in the target Secret resource, encrypted using the password stored in `passwordSecretRef` containing the issuing Certificate Authority. + type: boolean + passwordSecretRef: + description: PasswordSecretRef is a reference to a key in a Secret resource containing the password used to encrypt the PKCS12 keystore. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + privateKey: + description: Options to control private keys used for the Certificate. + type: object + properties: + rotationPolicy: + description: RotationPolicy controls how private keys should be regenerated when a re-issuance is being processed. If set to Never, a private key will only be generated if one does not already exist in the target `spec.secretName`. If one does exists but it does not have the correct algorithm or size, a warning will be raised to await user intervention. If set to Always, a private key matching the specified requirements will be generated whenever a re-issuance occurs. Default is 'Never' for backward compatibility. + type: string + renewBefore: + description: How long before the currently issued certificate's expiry cert-manager should renew the certificate. The default is 2/3 of the issued certificate's duration. Minimum accepted value is 5 minutes. Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration + type: string + revisionHistoryLimit: + description: revisionHistoryLimit is the maximum number of CertificateRequest revisions that are maintained in the Certificate's history. Each revision represents a single `CertificateRequest` created by this Certificate, either when it was created, renewed, or Spec was changed. Revisions will be removed by oldest first if the number of revisions exceeds this number. If set, revisionHistoryLimit must be a value of `1` or greater. If unset (`nil`), revisions will not be garbage collected. Default value is `nil`. + type: integer + format: int32 + secretName: + description: SecretName is the name of the secret resource that will be automatically created and managed by this Certificate resource. It will be populated with a private key and certificate, signed by the denoted issuer. + type: string + secretTemplate: + description: SecretTemplate defines annotations and labels to be propagated to the Kubernetes Secret when it is created or updated. Once created, labels and annotations are not yet removed from the Secret when they are removed from the template. See https://github.com/jetstack/cert-manager/issues/4292 + type: object + properties: + annotations: + description: Annotations is a key value map to be copied to the target Kubernetes Secret. + type: object + additionalProperties: + type: string + labels: + description: Labels is a key value map to be copied to the target Kubernetes Secret. + type: object + additionalProperties: + type: string + subject: + description: Full X509 name specification (https://golang.org/pkg/crypto/x509/pkix/#Name). + type: object + properties: + countries: + description: Countries to be used on the Certificate. + type: array + items: + type: string + localities: + description: Cities to be used on the Certificate. + type: array + items: + type: string + organizationalUnits: + description: Organizational Units to be used on the Certificate. + type: array + items: + type: string + organizations: + description: Organizations to be used on the Certificate. + type: array + items: + type: string + postalCodes: + description: Postal codes to be used on the Certificate. + type: array + items: + type: string + provinces: + description: State/Provinces to be used on the Certificate. + type: array + items: + type: string + serialNumber: + description: Serial number to be used on the Certificate. + type: string + streetAddresses: + description: Street addresses to be used on the Certificate. + type: array + items: + type: string + uriSANs: + description: URISANs is a list of URI subjectAltNames to be set on the Certificate. + type: array + items: + type: string + usages: + description: Usages is the set of x509 usages that are requested for the certificate. Defaults to `digital signature` and `key encipherment` if not specified. + type: array + items: + description: 'KeyUsage specifies valid usage contexts for keys. See: https://tools.ietf.org/html/rfc5280#section-4.2.1.3 https://tools.ietf.org/html/rfc5280#section-4.2.1.12 Valid KeyUsage values are as follows: "signing", "digital signature", "content commitment", "key encipherment", "key agreement", "data encipherment", "cert sign", "crl sign", "encipher only", "decipher only", "any", "server auth", "client auth", "code signing", "email protection", "s/mime", "ipsec end system", "ipsec tunnel", "ipsec user", "timestamping", "ocsp signing", "microsoft sgc", "netscape sgc"' + type: string + enum: + - signing + - digital signature + - content commitment + - key encipherment + - key agreement + - data encipherment + - cert sign + - crl sign + - encipher only + - decipher only + - any + - server auth + - client auth + - code signing + - email protection + - s/mime + - ipsec end system + - ipsec tunnel + - ipsec user + - timestamping + - ocsp signing + - microsoft sgc + - netscape sgc + status: + description: Status of the Certificate. This is set and managed automatically. + type: object + properties: + conditions: + description: List of status conditions to indicate the status of certificates. Known condition types are `Ready` and `Issuing`. + type: array + items: + description: CertificateCondition contains condition information for an Certificate. + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: LastTransitionTime is the timestamp corresponding to the last status change of this condition. + type: string + format: date-time + message: + description: Message is a human readable description of the details of the last transition, complementing reason. + type: string + observedGeneration: + description: If set, this represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.condition[x].observedGeneration is 9, the condition is out of date with respect to the current state of the Certificate. + type: integer + format: int64 + reason: + description: Reason is a brief machine readable explanation for the condition's last transition. + type: string + status: + description: Status of the condition, one of (`True`, `False`, `Unknown`). + type: string + enum: + - "True" + - "False" + - Unknown + type: + description: Type of the condition, known values are (`Ready`, `Issuing`). + type: string + lastFailureTime: + description: LastFailureTime is the time as recorded by the Certificate controller of the most recent failure to complete a CertificateRequest for this Certificate resource. If set, cert-manager will not re-request another Certificate until 1 hour has elapsed from this time. + type: string + format: date-time + nextPrivateKeySecretName: + description: The name of the Secret resource containing the private key to be used for the next certificate iteration. The keymanager controller will automatically set this field if the `Issuing` condition is set to `True`. It will automatically unset this field when the Issuing condition is not set or False. + type: string + notAfter: + description: The expiration time of the certificate stored in the secret named by this resource in `spec.secretName`. + type: string + format: date-time + notBefore: + description: The time after which the certificate stored in the secret named by this resource in spec.secretName is valid. + type: string + format: date-time + renewalTime: + description: RenewalTime is the time at which the certificate will be next renewed. If not set, no upcoming renewal is scheduled. + type: string + format: date-time + revision: + description: "The current 'revision' of the certificate as issued. \n When a CertificateRequest resource is created, it will have the `cert-manager.io/certificate-revision` set to one greater than the current value of this field. \n Upon issuance, this field will be set to the value of the annotation on the CertificateRequest resource used to issue the certificate. \n Persisting the value on the CertificateRequest resource allows the certificates controller to know whether a request is part of an old issuance or if it is part of the ongoing revision's issuance by checking if the revision value in the annotation is greater than this field." + type: integer + served: false + storage: false + - name: v1beta1 + subresources: + status: {} + additionalPrinterColumns: + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .spec.secretName + name: Secret + type: string + - jsonPath: .spec.issuerRef.name + name: Issuer + priority: 1 + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + priority: 1 + type: string + - jsonPath: .metadata.creationTimestamp + description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + name: Age + type: date + schema: + openAPIV3Schema: + description: "A Certificate resource should be created to ensure an up to date and signed x509 certificate is stored in the Kubernetes Secret resource named in `spec.secretName`. \n The stored certificate will be renewed before it expires (as configured by `spec.renewBefore`)." + type: object + required: + - spec + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: Desired state of the Certificate resource. + type: object + required: + - issuerRef + - secretName + properties: + commonName: + description: 'CommonName is a common name to be used on the Certificate. The CommonName should have a length of 64 characters or fewer to avoid generating invalid CSRs. This value is ignored by TLS clients when any subject alt name is set. This is x509 behaviour: https://tools.ietf.org/html/rfc6125#section-6.4.4' + type: string + dnsNames: + description: DNSNames is a list of DNS subjectAltNames to be set on the Certificate. + type: array + items: + type: string + duration: + description: The requested 'duration' (i.e. lifetime) of the Certificate. This option may be ignored/overridden by some issuer types. If unset this defaults to 90 days. Certificate will be renewed either 2/3 through its duration or `renewBefore` period before its expiry, whichever is later. Minimum accepted duration is 1 hour. Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration + type: string + emailSANs: + description: EmailSANs is a list of email subjectAltNames to be set on the Certificate. + type: array + items: + type: string + encodeUsagesInRequest: + description: EncodeUsagesInRequest controls whether key usages should be present in the CertificateRequest + type: boolean + ipAddresses: + description: IPAddresses is a list of IP address subjectAltNames to be set on the Certificate. + type: array + items: + type: string + isCA: + description: IsCA will mark this Certificate as valid for certificate signing. This will automatically add the `cert sign` usage to the list of `usages`. + type: boolean + issuerRef: + description: IssuerRef is a reference to the issuer for this certificate. If the `kind` field is not set, or set to `Issuer`, an Issuer resource with the given name in the same namespace as the Certificate will be used. If the `kind` field is set to `ClusterIssuer`, a ClusterIssuer with the provided name will be used. The `name` field in this stanza is required at all times. + type: object + required: + - name + properties: + group: + description: Group of the resource being referred to. + type: string + kind: + description: Kind of the resource being referred to. + type: string + name: + description: Name of the resource being referred to. + type: string + keystores: + description: Keystores configures additional keystore output formats stored in the `secretName` Secret resource. + type: object + properties: + jks: + description: JKS configures options for storing a JKS keystore in the `spec.secretName` Secret resource. + type: object + required: + - create + - passwordSecretRef + properties: + create: + description: Create enables JKS keystore creation for the Certificate. If true, a file named `keystore.jks` will be created in the target Secret resource, encrypted using the password stored in `passwordSecretRef`. The keystore file will only be updated upon re-issuance. + type: boolean + passwordSecretRef: + description: PasswordSecretRef is a reference to a key in a Secret resource containing the password used to encrypt the JKS keystore. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + pkcs12: + description: PKCS12 configures options for storing a PKCS12 keystore in the `spec.secretName` Secret resource. + type: object + required: + - create + - passwordSecretRef + properties: + create: + description: Create enables PKCS12 keystore creation for the Certificate. If true, a file named `keystore.p12` will be created in the target Secret resource, encrypted using the password stored in `passwordSecretRef`. The keystore file will only be updated upon re-issuance. + type: boolean + passwordSecretRef: + description: PasswordSecretRef is a reference to a key in a Secret resource containing the password used to encrypt the PKCS12 keystore. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + privateKey: + description: Options to control private keys used for the Certificate. + type: object + properties: + algorithm: + description: Algorithm is the private key algorithm of the corresponding private key for this certificate. If provided, allowed values are either `RSA` or `ECDSA` If `algorithm` is specified and `size` is not provided, key size of 256 will be used for `ECDSA` key algorithm and key size of 2048 will be used for `RSA` key algorithm. + type: string + enum: + - RSA + - ECDSA + encoding: + description: The private key cryptography standards (PKCS) encoding for this certificate's private key to be encoded in. If provided, allowed values are `PKCS1` and `PKCS8` standing for PKCS#1 and PKCS#8, respectively. Defaults to `PKCS1` if not specified. + type: string + enum: + - PKCS1 + - PKCS8 + rotationPolicy: + description: RotationPolicy controls how private keys should be regenerated when a re-issuance is being processed. If set to Never, a private key will only be generated if one does not already exist in the target `spec.secretName`. If one does exists but it does not have the correct algorithm or size, a warning will be raised to await user intervention. If set to Always, a private key matching the specified requirements will be generated whenever a re-issuance occurs. Default is 'Never' for backward compatibility. + type: string + size: + description: Size is the key bit size of the corresponding private key for this certificate. If `algorithm` is set to `RSA`, valid values are `2048`, `4096` or `8192`, and will default to `2048` if not specified. If `algorithm` is set to `ECDSA`, valid values are `256`, `384` or `521`, and will default to `256` if not specified. No other values are allowed. + type: integer + renewBefore: + description: How long before the currently issued certificate's expiry cert-manager should renew the certificate. The default is 2/3 of the issued certificate's duration. Minimum accepted value is 5 minutes. Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration + type: string + revisionHistoryLimit: + description: revisionHistoryLimit is the maximum number of CertificateRequest revisions that are maintained in the Certificate's history. Each revision represents a single `CertificateRequest` created by this Certificate, either when it was created, renewed, or Spec was changed. Revisions will be removed by oldest first if the number of revisions exceeds this number. If set, revisionHistoryLimit must be a value of `1` or greater. If unset (`nil`), revisions will not be garbage collected. Default value is `nil`. + type: integer + format: int32 + secretName: + description: SecretName is the name of the secret resource that will be automatically created and managed by this Certificate resource. It will be populated with a private key and certificate, signed by the denoted issuer. + type: string + secretTemplate: + description: SecretTemplate defines annotations and labels to be propagated to the Kubernetes Secret when it is created or updated. Once created, labels and annotations are not yet removed from the Secret when they are removed from the template. See https://github.com/jetstack/cert-manager/issues/4292 + type: object + properties: + annotations: + description: Annotations is a key value map to be copied to the target Kubernetes Secret. + type: object + additionalProperties: + type: string + labels: + description: Labels is a key value map to be copied to the target Kubernetes Secret. + type: object + additionalProperties: + type: string + subject: + description: Full X509 name specification (https://golang.org/pkg/crypto/x509/pkix/#Name). + type: object + properties: + countries: + description: Countries to be used on the Certificate. + type: array + items: + type: string + localities: + description: Cities to be used on the Certificate. + type: array + items: + type: string + organizationalUnits: + description: Organizational Units to be used on the Certificate. + type: array + items: + type: string + organizations: + description: Organizations to be used on the Certificate. + type: array + items: + type: string + postalCodes: + description: Postal codes to be used on the Certificate. + type: array + items: + type: string + provinces: + description: State/Provinces to be used on the Certificate. + type: array + items: + type: string + serialNumber: + description: Serial number to be used on the Certificate. + type: string + streetAddresses: + description: Street addresses to be used on the Certificate. + type: array + items: + type: string + uriSANs: + description: URISANs is a list of URI subjectAltNames to be set on the Certificate. + type: array + items: + type: string + usages: + description: Usages is the set of x509 usages that are requested for the certificate. Defaults to `digital signature` and `key encipherment` if not specified. + type: array + items: + description: 'KeyUsage specifies valid usage contexts for keys. See: https://tools.ietf.org/html/rfc5280#section-4.2.1.3 https://tools.ietf.org/html/rfc5280#section-4.2.1.12 Valid KeyUsage values are as follows: "signing", "digital signature", "content commitment", "key encipherment", "key agreement", "data encipherment", "cert sign", "crl sign", "encipher only", "decipher only", "any", "server auth", "client auth", "code signing", "email protection", "s/mime", "ipsec end system", "ipsec tunnel", "ipsec user", "timestamping", "ocsp signing", "microsoft sgc", "netscape sgc"' + type: string + enum: + - signing + - digital signature + - content commitment + - key encipherment + - key agreement + - data encipherment + - cert sign + - crl sign + - encipher only + - decipher only + - any + - server auth + - client auth + - code signing + - email protection + - s/mime + - ipsec end system + - ipsec tunnel + - ipsec user + - timestamping + - ocsp signing + - microsoft sgc + - netscape sgc + status: + description: Status of the Certificate. This is set and managed automatically. + type: object + properties: + conditions: + description: List of status conditions to indicate the status of certificates. Known condition types are `Ready` and `Issuing`. + type: array + items: + description: CertificateCondition contains condition information for an Certificate. + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: LastTransitionTime is the timestamp corresponding to the last status change of this condition. + type: string + format: date-time + message: + description: Message is a human readable description of the details of the last transition, complementing reason. + type: string + observedGeneration: + description: If set, this represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.condition[x].observedGeneration is 9, the condition is out of date with respect to the current state of the Certificate. + type: integer + format: int64 + reason: + description: Reason is a brief machine readable explanation for the condition's last transition. + type: string + status: + description: Status of the condition, one of (`True`, `False`, `Unknown`). + type: string + enum: + - "True" + - "False" + - Unknown + type: + description: Type of the condition, known values are (`Ready`, `Issuing`). + type: string + lastFailureTime: + description: LastFailureTime is the time as recorded by the Certificate controller of the most recent failure to complete a CertificateRequest for this Certificate resource. If set, cert-manager will not re-request another Certificate until 1 hour has elapsed from this time. + type: string + format: date-time + nextPrivateKeySecretName: + description: The name of the Secret resource containing the private key to be used for the next certificate iteration. The keymanager controller will automatically set this field if the `Issuing` condition is set to `True`. It will automatically unset this field when the Issuing condition is not set or False. + type: string + notAfter: + description: The expiration time of the certificate stored in the secret named by this resource in `spec.secretName`. + type: string + format: date-time + notBefore: + description: The time after which the certificate stored in the secret named by this resource in spec.secretName is valid. + type: string + format: date-time + renewalTime: + description: RenewalTime is the time at which the certificate will be next renewed. If not set, no upcoming renewal is scheduled. + type: string + format: date-time + revision: + description: "The current 'revision' of the certificate as issued. \n When a CertificateRequest resource is created, it will have the `cert-manager.io/certificate-revision` set to one greater than the current value of this field. \n Upon issuance, this field will be set to the value of the annotation on the CertificateRequest resource used to issue the certificate. \n Persisting the value on the CertificateRequest resource allows the certificates controller to know whether a request is part of an old issuance or if it is part of the ongoing revision's issuance by checking if the revision value in the annotation is greater than this field." + type: integer + served: false + storage: false + - name: v1 + subresources: + status: {} + additionalPrinterColumns: + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .spec.secretName + name: Secret + type: string + - jsonPath: .spec.issuerRef.name + name: Issuer + priority: 1 + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + priority: 1 + type: string + - jsonPath: .metadata.creationTimestamp + description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + name: Age + type: date + schema: + openAPIV3Schema: + description: "A Certificate resource should be created to ensure an up to date and signed x509 certificate is stored in the Kubernetes Secret resource named in `spec.secretName`. \n The stored certificate will be renewed before it expires (as configured by `spec.renewBefore`)." + type: object + required: + - spec + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: Desired state of the Certificate resource. + type: object + required: + - issuerRef + - secretName + properties: + commonName: + description: 'CommonName is a common name to be used on the Certificate. The CommonName should have a length of 64 characters or fewer to avoid generating invalid CSRs. This value is ignored by TLS clients when any subject alt name is set. This is x509 behaviour: https://tools.ietf.org/html/rfc6125#section-6.4.4' + type: string + dnsNames: + description: DNSNames is a list of DNS subjectAltNames to be set on the Certificate. + type: array + items: + type: string + duration: + description: The requested 'duration' (i.e. lifetime) of the Certificate. This option may be ignored/overridden by some issuer types. If unset this defaults to 90 days. Certificate will be renewed either 2/3 through its duration or `renewBefore` period before its expiry, whichever is later. Minimum accepted duration is 1 hour. Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration + type: string + emailAddresses: + description: EmailAddresses is a list of email subjectAltNames to be set on the Certificate. + type: array + items: + type: string + encodeUsagesInRequest: + description: EncodeUsagesInRequest controls whether key usages should be present in the CertificateRequest + type: boolean + ipAddresses: + description: IPAddresses is a list of IP address subjectAltNames to be set on the Certificate. + type: array + items: + type: string + isCA: + description: IsCA will mark this Certificate as valid for certificate signing. This will automatically add the `cert sign` usage to the list of `usages`. + type: boolean + issuerRef: + description: IssuerRef is a reference to the issuer for this certificate. If the `kind` field is not set, or set to `Issuer`, an Issuer resource with the given name in the same namespace as the Certificate will be used. If the `kind` field is set to `ClusterIssuer`, a ClusterIssuer with the provided name will be used. The `name` field in this stanza is required at all times. + type: object + required: + - name + properties: + group: + description: Group of the resource being referred to. + type: string + kind: + description: Kind of the resource being referred to. + type: string + name: + description: Name of the resource being referred to. + type: string + keystores: + description: Keystores configures additional keystore output formats stored in the `secretName` Secret resource. + type: object + properties: + jks: + description: JKS configures options for storing a JKS keystore in the `spec.secretName` Secret resource. + type: object + required: + - create + - passwordSecretRef + properties: + create: + description: Create enables JKS keystore creation for the Certificate. If true, a file named `keystore.jks` will be created in the target Secret resource, encrypted using the password stored in `passwordSecretRef`. The keystore file will only be updated upon re-issuance. A file named `truststore.jks` will also be created in the target Secret resource, encrypted using the password stored in `passwordSecretRef` containing the issuing Certificate Authority + type: boolean + passwordSecretRef: + description: PasswordSecretRef is a reference to a key in a Secret resource containing the password used to encrypt the JKS keystore. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + pkcs12: + description: PKCS12 configures options for storing a PKCS12 keystore in the `spec.secretName` Secret resource. + type: object + required: + - create + - passwordSecretRef + properties: + create: + description: Create enables PKCS12 keystore creation for the Certificate. If true, a file named `keystore.p12` will be created in the target Secret resource, encrypted using the password stored in `passwordSecretRef`. The keystore file will only be updated upon re-issuance. A file named `truststore.p12` will also be created in the target Secret resource, encrypted using the password stored in `passwordSecretRef` containing the issuing Certificate Authority + type: boolean + passwordSecretRef: + description: PasswordSecretRef is a reference to a key in a Secret resource containing the password used to encrypt the PKCS12 keystore. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + privateKey: + description: Options to control private keys used for the Certificate. + type: object + properties: + algorithm: + description: Algorithm is the private key algorithm of the corresponding private key for this certificate. If provided, allowed values are either `RSA`,`Ed25519` or `ECDSA` If `algorithm` is specified and `size` is not provided, key size of 256 will be used for `ECDSA` key algorithm and key size of 2048 will be used for `RSA` key algorithm. key size is ignored when using the `Ed25519` key algorithm. + type: string + enum: + - RSA + - ECDSA + - Ed25519 + encoding: + description: The private key cryptography standards (PKCS) encoding for this certificate's private key to be encoded in. If provided, allowed values are `PKCS1` and `PKCS8` standing for PKCS#1 and PKCS#8, respectively. Defaults to `PKCS1` if not specified. + type: string + enum: + - PKCS1 + - PKCS8 + rotationPolicy: + description: RotationPolicy controls how private keys should be regenerated when a re-issuance is being processed. If set to Never, a private key will only be generated if one does not already exist in the target `spec.secretName`. If one does exists but it does not have the correct algorithm or size, a warning will be raised to await user intervention. If set to Always, a private key matching the specified requirements will be generated whenever a re-issuance occurs. Default is 'Never' for backward compatibility. + type: string + size: + description: Size is the key bit size of the corresponding private key for this certificate. If `algorithm` is set to `RSA`, valid values are `2048`, `4096` or `8192`, and will default to `2048` if not specified. If `algorithm` is set to `ECDSA`, valid values are `256`, `384` or `521`, and will default to `256` if not specified. If `algorithm` is set to `Ed25519`, Size is ignored. No other values are allowed. + type: integer + renewBefore: + description: How long before the currently issued certificate's expiry cert-manager should renew the certificate. The default is 2/3 of the issued certificate's duration. Minimum accepted value is 5 minutes. Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration + type: string + revisionHistoryLimit: + description: revisionHistoryLimit is the maximum number of CertificateRequest revisions that are maintained in the Certificate's history. Each revision represents a single `CertificateRequest` created by this Certificate, either when it was created, renewed, or Spec was changed. Revisions will be removed by oldest first if the number of revisions exceeds this number. If set, revisionHistoryLimit must be a value of `1` or greater. If unset (`nil`), revisions will not be garbage collected. Default value is `nil`. + type: integer + format: int32 + secretName: + description: SecretName is the name of the secret resource that will be automatically created and managed by this Certificate resource. It will be populated with a private key and certificate, signed by the denoted issuer. + type: string + secretTemplate: + description: SecretTemplate defines annotations and labels to be propagated to the Kubernetes Secret when it is created or updated. Once created, labels and annotations are not yet removed from the Secret when they are removed from the template. See https://github.com/jetstack/cert-manager/issues/4292 + type: object + properties: + annotations: + description: Annotations is a key value map to be copied to the target Kubernetes Secret. + type: object + additionalProperties: + type: string + labels: + description: Labels is a key value map to be copied to the target Kubernetes Secret. + type: object + additionalProperties: + type: string + subject: + description: Full X509 name specification (https://golang.org/pkg/crypto/x509/pkix/#Name). + type: object + properties: + countries: + description: Countries to be used on the Certificate. + type: array + items: + type: string + localities: + description: Cities to be used on the Certificate. + type: array + items: + type: string + organizationalUnits: + description: Organizational Units to be used on the Certificate. + type: array + items: + type: string + organizations: + description: Organizations to be used on the Certificate. + type: array + items: + type: string + postalCodes: + description: Postal codes to be used on the Certificate. + type: array + items: + type: string + provinces: + description: State/Provinces to be used on the Certificate. + type: array + items: + type: string + serialNumber: + description: Serial number to be used on the Certificate. + type: string + streetAddresses: + description: Street addresses to be used on the Certificate. + type: array + items: + type: string + uris: + description: URIs is a list of URI subjectAltNames to be set on the Certificate. + type: array + items: + type: string + usages: + description: Usages is the set of x509 usages that are requested for the certificate. Defaults to `digital signature` and `key encipherment` if not specified. + type: array + items: + description: 'KeyUsage specifies valid usage contexts for keys. See: https://tools.ietf.org/html/rfc5280#section-4.2.1.3 https://tools.ietf.org/html/rfc5280#section-4.2.1.12 Valid KeyUsage values are as follows: "signing", "digital signature", "content commitment", "key encipherment", "key agreement", "data encipherment", "cert sign", "crl sign", "encipher only", "decipher only", "any", "server auth", "client auth", "code signing", "email protection", "s/mime", "ipsec end system", "ipsec tunnel", "ipsec user", "timestamping", "ocsp signing", "microsoft sgc", "netscape sgc"' + type: string + enum: + - signing + - digital signature + - content commitment + - key encipherment + - key agreement + - data encipherment + - cert sign + - crl sign + - encipher only + - decipher only + - any + - server auth + - client auth + - code signing + - email protection + - s/mime + - ipsec end system + - ipsec tunnel + - ipsec user + - timestamping + - ocsp signing + - microsoft sgc + - netscape sgc + status: + description: Status of the Certificate. This is set and managed automatically. + type: object + properties: + conditions: + description: List of status conditions to indicate the status of certificates. Known condition types are `Ready` and `Issuing`. + type: array + items: + description: CertificateCondition contains condition information for an Certificate. + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: LastTransitionTime is the timestamp corresponding to the last status change of this condition. + type: string + format: date-time + message: + description: Message is a human readable description of the details of the last transition, complementing reason. + type: string + observedGeneration: + description: If set, this represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.condition[x].observedGeneration is 9, the condition is out of date with respect to the current state of the Certificate. + type: integer + format: int64 + reason: + description: Reason is a brief machine readable explanation for the condition's last transition. + type: string + status: + description: Status of the condition, one of (`True`, `False`, `Unknown`). + type: string + enum: + - "True" + - "False" + - Unknown + type: + description: Type of the condition, known values are (`Ready`, `Issuing`). + type: string + lastFailureTime: + description: LastFailureTime is the time as recorded by the Certificate controller of the most recent failure to complete a CertificateRequest for this Certificate resource. If set, cert-manager will not re-request another Certificate until 1 hour has elapsed from this time. + type: string + format: date-time + nextPrivateKeySecretName: + description: The name of the Secret resource containing the private key to be used for the next certificate iteration. The keymanager controller will automatically set this field if the `Issuing` condition is set to `True`. It will automatically unset this field when the Issuing condition is not set or False. + type: string + notAfter: + description: The expiration time of the certificate stored in the secret named by this resource in `spec.secretName`. + type: string + format: date-time + notBefore: + description: The time after which the certificate stored in the secret named by this resource in spec.secretName is valid. + type: string + format: date-time + renewalTime: + description: RenewalTime is the time at which the certificate will be next renewed. If not set, no upcoming renewal is scheduled. + type: string + format: date-time + revision: + description: "The current 'revision' of the certificate as issued. \n When a CertificateRequest resource is created, it will have the `cert-manager.io/certificate-revision` set to one greater than the current value of this field. \n Upon issuance, this field will be set to the value of the annotation on the CertificateRequest resource used to issue the certificate. \n Persisting the value on the CertificateRequest resource allows the certificates controller to know whether a request is part of an old issuance or if it is part of the ongoing revision's issuance by checking if the revision value in the annotation is greater than this field." + type: integer + served: true + storage: true +--- +# Source: cert-manager/templates/templates.out +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: challenges.acme.cert-manager.io + annotations: + cert-manager.io/inject-ca-from-secret: 'cert-manager/cert-manager-webhook-ca' + labels: + app: 'cert-manager' + app.kubernetes.io/name: 'cert-manager' + app.kubernetes.io/instance: 'cert-manager' + # Generated labels + app.kubernetes.io/version: "v1.6.3" +spec: + group: acme.cert-manager.io + names: + kind: Challenge + listKind: ChallengeList + plural: challenges + singular: challenge + categories: + - cert-manager + - cert-manager-acme + scope: Namespaced + conversion: + # a Webhook strategy instruct API server to call an external webhook for any conversion between custom resources. + strategy: Webhook + # webhookClientConfig is required when strategy is `Webhook` and it configures the webhook endpoint to be called by API server. + webhook: + # We don't actually support `v1beta1` but is listed here as it is a + # required value for [Kubernetes v1.16](kubernetes/kubernetes#82023). The + # API server reads the supported versions in order, so _should always_ + # attempt a `v1` request which is understood by the cert-manager webhook. + # Any `v1beta1` request will return an error and fail closed for that + # resource (the whole object request is rejected). + # When we no longer support v1.16 we can remove `v1beta1` from this list. + conversionReviewVersions: ["v1", "v1beta1"] + clientConfig: + # + service: + name: 'cert-manager-webhook' + namespace: "cert-manager" + path: /convert + # + versions: + - additionalPrinterColumns: + - jsonPath: .status.state + name: State + type: string + - jsonPath: .spec.dnsName + name: Domain + type: string + - jsonPath: .status.reason + name: Reason + priority: 1 + type: string + - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha2 + schema: + openAPIV3Schema: + description: Challenge is a type to represent a Challenge request with an ACME server + type: object + required: + - metadata + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + type: object + required: + - authzURL + - dnsName + - issuerRef + - key + - solver + - token + - type + - url + properties: + authzURL: + description: AuthzURL is the URL to the ACME Authorization resource that this challenge is a part of. + type: string + dnsName: + description: DNSName is the identifier that this challenge is for, e.g. example.com. If the requested DNSName is a 'wildcard', this field MUST be set to the non-wildcard domain, e.g. for `*.example.com`, it must be `example.com`. + type: string + issuerRef: + description: IssuerRef references a properly configured ACME-type Issuer which should be used to create this Challenge. If the Issuer does not exist, processing will be retried. If the Issuer is not an 'ACME' Issuer, an error will be returned and the Challenge will be marked as failed. + type: object + required: + - name + properties: + group: + description: Group of the resource being referred to. + type: string + kind: + description: Kind of the resource being referred to. + type: string + name: + description: Name of the resource being referred to. + type: string + key: + description: 'Key is the ACME challenge key for this challenge For HTTP01 challenges, this is the value that must be responded with to complete the HTTP01 challenge in the format: `.`. For DNS01 challenges, this is the base64 encoded SHA256 sum of the `.` text that must be set as the TXT record content.' + type: string + solver: + description: Solver contains the domain solving configuration that should be used to solve this challenge resource. + type: object + properties: + dns01: + description: Configures cert-manager to attempt to complete authorizations by performing the DNS01 challenge flow. + type: object + properties: + acmedns: + description: Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage DNS01 challenge records. + type: object + required: + - accountSecretRef + - host + properties: + accountSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + host: + type: string + akamai: + description: Use the Akamai DNS zone management API to manage DNS01 challenge records. + type: object + required: + - accessTokenSecretRef + - clientSecretSecretRef + - clientTokenSecretRef + - serviceConsumerDomain + properties: + accessTokenSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + clientSecretSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + clientTokenSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + serviceConsumerDomain: + type: string + azuredns: + description: Use the Microsoft Azure DNS API to manage DNS01 challenge records. + type: object + required: + - resourceGroupName + - subscriptionID + properties: + clientID: + description: if both this and ClientSecret are left unset MSI will be used + type: string + clientSecretSecretRef: + description: if both this and ClientID are left unset MSI will be used + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + environment: + description: name of the Azure environment (default AzurePublicCloud) + type: string + enum: + - AzurePublicCloud + - AzureChinaCloud + - AzureGermanCloud + - AzureUSGovernmentCloud + hostedZoneName: + description: name of the DNS zone that should be used + type: string + managedIdentity: + description: managed identity configuration, can not be used at the same time as clientID, clientSecretSecretRef or tenantID + type: object + properties: + clientID: + description: client ID of the managed identity, can not be used at the same time as resourceID + type: string + resourceID: + description: resource ID of the managed identity, can not be used at the same time as clientID + type: string + resourceGroupName: + description: resource group the DNS zone is located in + type: string + subscriptionID: + description: ID of the Azure subscription + type: string + tenantID: + description: when specifying ClientID and ClientSecret then this field is also needed + type: string + clouddns: + description: Use the Google Cloud DNS API to manage DNS01 challenge records. + type: object + required: + - project + properties: + hostedZoneName: + description: HostedZoneName is an optional field that tells cert-manager in which Cloud DNS zone the challenge record has to be created. If left empty cert-manager will automatically choose a zone. + type: string + project: + type: string + serviceAccountSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + cloudflare: + description: Use the Cloudflare API to manage DNS01 challenge records. + type: object + properties: + apiKeySecretRef: + description: 'API key to use to authenticate with Cloudflare. Note: using an API token to authenticate is now the recommended method as it allows greater control of permissions.' + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + apiTokenSecretRef: + description: API token used to authenticate with Cloudflare. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + email: + description: Email of the account, only required when using API key based authentication. + type: string + cnameStrategy: + description: CNAMEStrategy configures how the DNS01 provider should handle CNAME records when found in DNS zones. + type: string + enum: + - None + - Follow + digitalocean: + description: Use the DigitalOcean DNS API to manage DNS01 challenge records. + type: object + required: + - tokenSecretRef + properties: + tokenSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + rfc2136: + description: Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/) to manage DNS01 challenge records. + type: object + required: + - nameserver + properties: + nameserver: + description: The IP address or hostname of an authoritative DNS server supporting RFC2136 in the form host:port. If the host is an IPv6 address it must be enclosed in square brackets (e.g [2001:db8::1]) ; port is optional. This field is required. + type: string + tsigAlgorithm: + description: 'The TSIG Algorithm configured in the DNS supporting RFC2136. Used only when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined. Supported values are (case-insensitive): ``HMACMD5`` (default), ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``.' + type: string + tsigKeyName: + description: The TSIG Key name configured in the DNS. If ``tsigSecretSecretRef`` is defined, this field is required. + type: string + tsigSecretSecretRef: + description: The name of the secret containing the TSIG value. If ``tsigKeyName`` is defined, this field is required. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + route53: + description: Use the AWS Route53 API to manage DNS01 challenge records. + type: object + required: + - region + properties: + accessKeyID: + description: 'The AccessKeyID is used for authentication. If not set we fall-back to using env vars, shared credentials file or AWS Instance metadata see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials' + type: string + hostedZoneID: + description: If set, the provider will manage only this zone in Route53 and will not do an lookup using the route53:ListHostedZonesByName api call. + type: string + region: + description: Always set the region when using AccessKeyID and SecretAccessKey + type: string + role: + description: Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata + type: string + secretAccessKeySecretRef: + description: The SecretAccessKey is used for authentication. If not set we fall-back to using env vars, shared credentials file or AWS Instance metadata https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + webhook: + description: Configure an external webhook based DNS01 challenge solver to manage DNS01 challenge records. + type: object + required: + - groupName + - solverName + properties: + config: + description: Additional configuration that should be passed to the webhook apiserver when challenges are processed. This can contain arbitrary JSON data. Secret values should not be specified in this stanza. If secret values are needed (e.g. credentials for a DNS service), you should use a SecretKeySelector to reference a Secret resource. For details on the schema of this field, consult the webhook provider implementation's documentation. + x-kubernetes-preserve-unknown-fields: true + groupName: + description: The API group name that should be used when POSTing ChallengePayload resources to the webhook apiserver. This should be the same as the GroupName specified in the webhook provider implementation. + type: string + solverName: + description: The name of the solver to use, as defined in the webhook provider implementation. This will typically be the name of the provider, e.g. 'cloudflare'. + type: string + http01: + description: Configures cert-manager to attempt to complete authorizations by performing the HTTP01 challenge flow. It is not possible to obtain certificates for wildcard domain names (e.g. `*.example.com`) using the HTTP01 challenge mechanism. + type: object + properties: + gatewayHTTPRoute: + description: The Gateway API is a sig-network community API that models service networking in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will create HTTPRoutes with the specified labels in the same namespace as the challenge. This solver is experimental, and fields / behaviour may change in the future. + type: object + properties: + labels: + description: The labels that cert-manager will use when creating the temporary HTTPRoute needed for solving the HTTP-01 challenge. These labels must match the label selector of at least one Gateway. + type: object + additionalProperties: + type: string + serviceType: + description: Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort. + type: string + ingress: + description: The ingress based HTTP01 challenge solver will solve challenges by creating or modifying Ingress resources in order to route requests for '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are provisioned by cert-manager for each Challenge to be completed. + type: object + properties: + class: + description: The ingress class to use when creating Ingress resources to solve ACME challenges that use this challenge solver. Only one of 'class' or 'name' may be specified. + type: string + ingressTemplate: + description: Optional ingress template used to configure the ACME challenge solver ingress used for HTTP01 challenges + type: object + properties: + metadata: + description: ObjectMeta overrides for the ingress used to solve HTTP01 challenges. Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. + type: object + properties: + annotations: + description: Annotations that should be added to the created ACME HTTP01 solver ingress. + type: object + additionalProperties: + type: string + labels: + description: Labels that should be added to the created ACME HTTP01 solver ingress. + type: object + additionalProperties: + type: string + name: + description: The name of the ingress resource that should have ACME challenge solving routes inserted into it in order to solve HTTP01 challenges. This is typically used in conjunction with ingress controllers like ingress-gce, which maintains a 1:1 mapping between external IPs and ingress resources. + type: string + podTemplate: + description: Optional pod template used to configure the ACME challenge solver pods used for HTTP01 challenges. + type: object + properties: + metadata: + description: ObjectMeta overrides for the pod used to solve HTTP01 challenges. Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. + type: object + properties: + annotations: + description: Annotations that should be added to the create ACME HTTP01 solver pods. + type: object + additionalProperties: + type: string + labels: + description: Labels that should be added to the created ACME HTTP01 solver pods. + type: object + additionalProperties: + type: string + spec: + description: PodSpec defines overrides for the HTTP01 challenge solver pod. Only the 'priorityClassName', 'nodeSelector', 'affinity', 'serviceAccountName' and 'tolerations' fields are supported currently. All other fields will be ignored. + type: object + properties: + affinity: + description: If specified, the pod's scheduling constraints + type: object + properties: + nodeAffinity: + description: Describes node affinity scheduling rules for the pod. + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred. + type: array + items: + description: An empty preferred scheduling term matches all objects with implicit weight 0 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + type: object + required: + - preference + - weight + properties: + preference: + description: A node selector term, associated with the corresponding weight. + type: object + properties: + matchExpressions: + description: A list of node selector requirements by node's labels. + type: array + items: + description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchFields: + description: A list of node selector requirements by node's fields. + type: array + items: + description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array + items: + type: string + weight: + description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. + type: integer + format: int32 + requiredDuringSchedulingIgnoredDuringExecution: + description: If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node. + type: object + required: + - nodeSelectorTerms + properties: + nodeSelectorTerms: + description: Required. A list of node selector terms. The terms are ORed. + type: array + items: + description: A null or empty node selector term matches no objects. The requirements of them are ANDed. The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + type: object + properties: + matchExpressions: + description: A list of node selector requirements by node's labels. + type: array + items: + description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchFields: + description: A list of node selector requirements by node's fields. + type: array + items: + description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array + items: + type: string + podAffinity: + description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. + type: array + items: + description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + type: object + required: + - podAffinityTerm + - weight + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated with the corresponding weight. + type: object + required: + - topologyKey + properties: + labelSelector: + description: A label query over a set of resources, in this case pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaceSelector: + description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. This field is beta-level and is only honored when PodAffinityNamespaceSelector feature is enabled. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaces: + description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace" + type: array + items: + type: string + topologyKey: + description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + type: string + weight: + description: weight associated with matching the corresponding podAffinityTerm, in the range 1-100. + type: integer + format: int32 + requiredDuringSchedulingIgnoredDuringExecution: + description: If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. + type: array + items: + description: Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running + type: object + required: + - topologyKey + properties: + labelSelector: + description: A label query over a set of resources, in this case pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaceSelector: + description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. This field is beta-level and is only honored when PodAffinityNamespaceSelector feature is enabled. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaces: + description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace" + type: array + items: + type: string + topologyKey: + description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + type: string + podAntiAffinity: + description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods to nodes that satisfy the anti-affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. + type: array + items: + description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + type: object + required: + - podAffinityTerm + - weight + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated with the corresponding weight. + type: object + required: + - topologyKey + properties: + labelSelector: + description: A label query over a set of resources, in this case pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaceSelector: + description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. This field is beta-level and is only honored when PodAffinityNamespaceSelector feature is enabled. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaces: + description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace" + type: array + items: + type: string + topologyKey: + description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + type: string + weight: + description: weight associated with matching the corresponding podAffinityTerm, in the range 1-100. + type: integer + format: int32 + requiredDuringSchedulingIgnoredDuringExecution: + description: If the anti-affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the anti-affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. + type: array + items: + description: Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running + type: object + required: + - topologyKey + properties: + labelSelector: + description: A label query over a set of resources, in this case pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaceSelector: + description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. This field is beta-level and is only honored when PodAffinityNamespaceSelector feature is enabled. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaces: + description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace" + type: array + items: + type: string + topologyKey: + description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + type: string + nodeSelector: + description: 'NodeSelector is a selector which must be true for the pod to fit on a node. Selector which must match a node''s labels for the pod to be scheduled on that node. More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/' + type: object + additionalProperties: + type: string + priorityClassName: + description: If specified, the pod's priorityClassName. + type: string + serviceAccountName: + description: If specified, the pod's service account + type: string + tolerations: + description: If specified, the pod's tolerations. + type: array + items: + description: The pod this Toleration is attached to tolerates any taint that matches the triple using the matching operator . + type: object + properties: + effect: + description: Effect indicates the taint effect to match. Empty means match all taint effects. When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: Key is the taint key that the toleration applies to. Empty means match all taint keys. If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: Operator represents a key's relationship to the value. Valid operators are Exists and Equal. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: TolerationSeconds represents the period of time the toleration (which must be of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system. + type: integer + format: int64 + value: + description: Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + serviceType: + description: Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort. + type: string + selector: + description: Selector selects a set of DNSNames on the Certificate resource that should be solved using this challenge solver. If not specified, the solver will be treated as the 'default' solver with the lowest priority, i.e. if any other solver has a more specific match, it will be used instead. + type: object + properties: + dnsNames: + description: List of DNSNames that this solver will be used to solve. If specified and a match is found, a dnsNames selector will take precedence over a dnsZones selector. If multiple solvers match with the same dnsNames value, the solver with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected. + type: array + items: + type: string + dnsZones: + description: List of DNSZones that this solver will be used to solve. The most specific DNS zone match specified here will take precedence over other DNS zone matches, so a solver specifying sys.example.com will be selected over one specifying example.com for the domain www.sys.example.com. If multiple solvers match with the same dnsZones value, the solver with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected. + type: array + items: + type: string + matchLabels: + description: A label selector that is used to refine the set of certificate's that this challenge solver will apply to. + type: object + additionalProperties: + type: string + token: + description: Token is the ACME challenge token for this challenge. This is the raw value returned from the ACME server. + type: string + type: + description: Type is the type of ACME challenge this resource represents. One of "http-01" or "dns-01". + type: string + enum: + - http-01 + - dns-01 + url: + description: URL is the URL of the ACME Challenge resource for this challenge. This can be used to lookup details about the status of this challenge. + type: string + wildcard: + description: Wildcard will be true if this challenge is for a wildcard identifier, for example '*.example.com'. + type: boolean + status: + type: object + properties: + presented: + description: Presented will be set to true if the challenge values for this challenge are currently 'presented'. This *does not* imply the self check is passing. Only that the values have been 'submitted' for the appropriate challenge mechanism (i.e. the DNS01 TXT record has been presented, or the HTTP01 configuration has been configured). + type: boolean + processing: + description: Processing is used to denote whether this challenge should be processed or not. This field will only be set to true by the 'scheduling' component. It will only be set to false by the 'challenges' controller, after the challenge has reached a final state or timed out. If this field is set to false, the challenge controller will not take any more action. + type: boolean + reason: + description: Reason contains human readable information on why the Challenge is in the current state. + type: string + state: + description: State contains the current 'state' of the challenge. If not set, the state of the challenge is unknown. + type: string + enum: + - valid + - ready + - pending + - processing + - invalid + - expired + - errored + served: false + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .status.state + name: State + type: string + - jsonPath: .spec.dnsName + name: Domain + type: string + - jsonPath: .status.reason + name: Reason + priority: 1 + type: string + - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha3 + schema: + openAPIV3Schema: + description: Challenge is a type to represent a Challenge request with an ACME server + type: object + required: + - metadata + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + type: object + required: + - authzURL + - dnsName + - issuerRef + - key + - solver + - token + - type + - url + properties: + authzURL: + description: AuthzURL is the URL to the ACME Authorization resource that this challenge is a part of. + type: string + dnsName: + description: DNSName is the identifier that this challenge is for, e.g. example.com. If the requested DNSName is a 'wildcard', this field MUST be set to the non-wildcard domain, e.g. for `*.example.com`, it must be `example.com`. + type: string + issuerRef: + description: IssuerRef references a properly configured ACME-type Issuer which should be used to create this Challenge. If the Issuer does not exist, processing will be retried. If the Issuer is not an 'ACME' Issuer, an error will be returned and the Challenge will be marked as failed. + type: object + required: + - name + properties: + group: + description: Group of the resource being referred to. + type: string + kind: + description: Kind of the resource being referred to. + type: string + name: + description: Name of the resource being referred to. + type: string + key: + description: 'Key is the ACME challenge key for this challenge For HTTP01 challenges, this is the value that must be responded with to complete the HTTP01 challenge in the format: `.`. For DNS01 challenges, this is the base64 encoded SHA256 sum of the `.` text that must be set as the TXT record content.' + type: string + solver: + description: Solver contains the domain solving configuration that should be used to solve this challenge resource. + type: object + properties: + dns01: + description: Configures cert-manager to attempt to complete authorizations by performing the DNS01 challenge flow. + type: object + properties: + acmedns: + description: Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage DNS01 challenge records. + type: object + required: + - accountSecretRef + - host + properties: + accountSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + host: + type: string + akamai: + description: Use the Akamai DNS zone management API to manage DNS01 challenge records. + type: object + required: + - accessTokenSecretRef + - clientSecretSecretRef + - clientTokenSecretRef + - serviceConsumerDomain + properties: + accessTokenSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + clientSecretSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + clientTokenSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + serviceConsumerDomain: + type: string + azuredns: + description: Use the Microsoft Azure DNS API to manage DNS01 challenge records. + type: object + required: + - resourceGroupName + - subscriptionID + properties: + clientID: + description: if both this and ClientSecret are left unset MSI will be used + type: string + clientSecretSecretRef: + description: if both this and ClientID are left unset MSI will be used + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + environment: + description: name of the Azure environment (default AzurePublicCloud) + type: string + enum: + - AzurePublicCloud + - AzureChinaCloud + - AzureGermanCloud + - AzureUSGovernmentCloud + hostedZoneName: + description: name of the DNS zone that should be used + type: string + managedIdentity: + description: managed identity configuration, can not be used at the same time as clientID, clientSecretSecretRef or tenantID + type: object + properties: + clientID: + description: client ID of the managed identity, can not be used at the same time as resourceID + type: string + resourceID: + description: resource ID of the managed identity, can not be used at the same time as clientID + type: string + resourceGroupName: + description: resource group the DNS zone is located in + type: string + subscriptionID: + description: ID of the Azure subscription + type: string + tenantID: + description: when specifying ClientID and ClientSecret then this field is also needed + type: string + clouddns: + description: Use the Google Cloud DNS API to manage DNS01 challenge records. + type: object + required: + - project + properties: + hostedZoneName: + description: HostedZoneName is an optional field that tells cert-manager in which Cloud DNS zone the challenge record has to be created. If left empty cert-manager will automatically choose a zone. + type: string + project: + type: string + serviceAccountSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + cloudflare: + description: Use the Cloudflare API to manage DNS01 challenge records. + type: object + properties: + apiKeySecretRef: + description: 'API key to use to authenticate with Cloudflare. Note: using an API token to authenticate is now the recommended method as it allows greater control of permissions.' + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + apiTokenSecretRef: + description: API token used to authenticate with Cloudflare. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + email: + description: Email of the account, only required when using API key based authentication. + type: string + cnameStrategy: + description: CNAMEStrategy configures how the DNS01 provider should handle CNAME records when found in DNS zones. + type: string + enum: + - None + - Follow + digitalocean: + description: Use the DigitalOcean DNS API to manage DNS01 challenge records. + type: object + required: + - tokenSecretRef + properties: + tokenSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + rfc2136: + description: Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/) to manage DNS01 challenge records. + type: object + required: + - nameserver + properties: + nameserver: + description: The IP address or hostname of an authoritative DNS server supporting RFC2136 in the form host:port. If the host is an IPv6 address it must be enclosed in square brackets (e.g [2001:db8::1]) ; port is optional. This field is required. + type: string + tsigAlgorithm: + description: 'The TSIG Algorithm configured in the DNS supporting RFC2136. Used only when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined. Supported values are (case-insensitive): ``HMACMD5`` (default), ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``.' + type: string + tsigKeyName: + description: The TSIG Key name configured in the DNS. If ``tsigSecretSecretRef`` is defined, this field is required. + type: string + tsigSecretSecretRef: + description: The name of the secret containing the TSIG value. If ``tsigKeyName`` is defined, this field is required. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + route53: + description: Use the AWS Route53 API to manage DNS01 challenge records. + type: object + required: + - region + properties: + accessKeyID: + description: 'The AccessKeyID is used for authentication. If not set we fall-back to using env vars, shared credentials file or AWS Instance metadata see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials' + type: string + hostedZoneID: + description: If set, the provider will manage only this zone in Route53 and will not do an lookup using the route53:ListHostedZonesByName api call. + type: string + region: + description: Always set the region when using AccessKeyID and SecretAccessKey + type: string + role: + description: Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata + type: string + secretAccessKeySecretRef: + description: The SecretAccessKey is used for authentication. If not set we fall-back to using env vars, shared credentials file or AWS Instance metadata https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + webhook: + description: Configure an external webhook based DNS01 challenge solver to manage DNS01 challenge records. + type: object + required: + - groupName + - solverName + properties: + config: + description: Additional configuration that should be passed to the webhook apiserver when challenges are processed. This can contain arbitrary JSON data. Secret values should not be specified in this stanza. If secret values are needed (e.g. credentials for a DNS service), you should use a SecretKeySelector to reference a Secret resource. For details on the schema of this field, consult the webhook provider implementation's documentation. + x-kubernetes-preserve-unknown-fields: true + groupName: + description: The API group name that should be used when POSTing ChallengePayload resources to the webhook apiserver. This should be the same as the GroupName specified in the webhook provider implementation. + type: string + solverName: + description: The name of the solver to use, as defined in the webhook provider implementation. This will typically be the name of the provider, e.g. 'cloudflare'. + type: string + http01: + description: Configures cert-manager to attempt to complete authorizations by performing the HTTP01 challenge flow. It is not possible to obtain certificates for wildcard domain names (e.g. `*.example.com`) using the HTTP01 challenge mechanism. + type: object + properties: + gatewayHTTPRoute: + description: The Gateway API is a sig-network community API that models service networking in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will create HTTPRoutes with the specified labels in the same namespace as the challenge. This solver is experimental, and fields / behaviour may change in the future. + type: object + properties: + labels: + description: The labels that cert-manager will use when creating the temporary HTTPRoute needed for solving the HTTP-01 challenge. These labels must match the label selector of at least one Gateway. + type: object + additionalProperties: + type: string + serviceType: + description: Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort. + type: string + ingress: + description: The ingress based HTTP01 challenge solver will solve challenges by creating or modifying Ingress resources in order to route requests for '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are provisioned by cert-manager for each Challenge to be completed. + type: object + properties: + class: + description: The ingress class to use when creating Ingress resources to solve ACME challenges that use this challenge solver. Only one of 'class' or 'name' may be specified. + type: string + ingressTemplate: + description: Optional ingress template used to configure the ACME challenge solver ingress used for HTTP01 challenges + type: object + properties: + metadata: + description: ObjectMeta overrides for the ingress used to solve HTTP01 challenges. Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. + type: object + properties: + annotations: + description: Annotations that should be added to the created ACME HTTP01 solver ingress. + type: object + additionalProperties: + type: string + labels: + description: Labels that should be added to the created ACME HTTP01 solver ingress. + type: object + additionalProperties: + type: string + name: + description: The name of the ingress resource that should have ACME challenge solving routes inserted into it in order to solve HTTP01 challenges. This is typically used in conjunction with ingress controllers like ingress-gce, which maintains a 1:1 mapping between external IPs and ingress resources. + type: string + podTemplate: + description: Optional pod template used to configure the ACME challenge solver pods used for HTTP01 challenges. + type: object + properties: + metadata: + description: ObjectMeta overrides for the pod used to solve HTTP01 challenges. Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. + type: object + properties: + annotations: + description: Annotations that should be added to the create ACME HTTP01 solver pods. + type: object + additionalProperties: + type: string + labels: + description: Labels that should be added to the created ACME HTTP01 solver pods. + type: object + additionalProperties: + type: string + spec: + description: PodSpec defines overrides for the HTTP01 challenge solver pod. Only the 'priorityClassName', 'nodeSelector', 'affinity', 'serviceAccountName' and 'tolerations' fields are supported currently. All other fields will be ignored. + type: object + properties: + affinity: + description: If specified, the pod's scheduling constraints + type: object + properties: + nodeAffinity: + description: Describes node affinity scheduling rules for the pod. + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred. + type: array + items: + description: An empty preferred scheduling term matches all objects with implicit weight 0 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + type: object + required: + - preference + - weight + properties: + preference: + description: A node selector term, associated with the corresponding weight. + type: object + properties: + matchExpressions: + description: A list of node selector requirements by node's labels. + type: array + items: + description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchFields: + description: A list of node selector requirements by node's fields. + type: array + items: + description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array + items: + type: string + weight: + description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. + type: integer + format: int32 + requiredDuringSchedulingIgnoredDuringExecution: + description: If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node. + type: object + required: + - nodeSelectorTerms + properties: + nodeSelectorTerms: + description: Required. A list of node selector terms. The terms are ORed. + type: array + items: + description: A null or empty node selector term matches no objects. The requirements of them are ANDed. The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + type: object + properties: + matchExpressions: + description: A list of node selector requirements by node's labels. + type: array + items: + description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchFields: + description: A list of node selector requirements by node's fields. + type: array + items: + description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array + items: + type: string + podAffinity: + description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. + type: array + items: + description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + type: object + required: + - podAffinityTerm + - weight + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated with the corresponding weight. + type: object + required: + - topologyKey + properties: + labelSelector: + description: A label query over a set of resources, in this case pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaceSelector: + description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. This field is beta-level and is only honored when PodAffinityNamespaceSelector feature is enabled. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaces: + description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace" + type: array + items: + type: string + topologyKey: + description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + type: string + weight: + description: weight associated with matching the corresponding podAffinityTerm, in the range 1-100. + type: integer + format: int32 + requiredDuringSchedulingIgnoredDuringExecution: + description: If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. + type: array + items: + description: Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running + type: object + required: + - topologyKey + properties: + labelSelector: + description: A label query over a set of resources, in this case pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaceSelector: + description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. This field is beta-level and is only honored when PodAffinityNamespaceSelector feature is enabled. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaces: + description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace" + type: array + items: + type: string + topologyKey: + description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + type: string + podAntiAffinity: + description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods to nodes that satisfy the anti-affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. + type: array + items: + description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + type: object + required: + - podAffinityTerm + - weight + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated with the corresponding weight. + type: object + required: + - topologyKey + properties: + labelSelector: + description: A label query over a set of resources, in this case pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaceSelector: + description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. This field is beta-level and is only honored when PodAffinityNamespaceSelector feature is enabled. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaces: + description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace" + type: array + items: + type: string + topologyKey: + description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + type: string + weight: + description: weight associated with matching the corresponding podAffinityTerm, in the range 1-100. + type: integer + format: int32 + requiredDuringSchedulingIgnoredDuringExecution: + description: If the anti-affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the anti-affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. + type: array + items: + description: Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running + type: object + required: + - topologyKey + properties: + labelSelector: + description: A label query over a set of resources, in this case pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaceSelector: + description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. This field is beta-level and is only honored when PodAffinityNamespaceSelector feature is enabled. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaces: + description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace" + type: array + items: + type: string + topologyKey: + description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + type: string + nodeSelector: + description: 'NodeSelector is a selector which must be true for the pod to fit on a node. Selector which must match a node''s labels for the pod to be scheduled on that node. More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/' + type: object + additionalProperties: + type: string + priorityClassName: + description: If specified, the pod's priorityClassName. + type: string + serviceAccountName: + description: If specified, the pod's service account + type: string + tolerations: + description: If specified, the pod's tolerations. + type: array + items: + description: The pod this Toleration is attached to tolerates any taint that matches the triple using the matching operator . + type: object + properties: + effect: + description: Effect indicates the taint effect to match. Empty means match all taint effects. When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: Key is the taint key that the toleration applies to. Empty means match all taint keys. If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: Operator represents a key's relationship to the value. Valid operators are Exists and Equal. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: TolerationSeconds represents the period of time the toleration (which must be of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system. + type: integer + format: int64 + value: + description: Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + serviceType: + description: Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort. + type: string + selector: + description: Selector selects a set of DNSNames on the Certificate resource that should be solved using this challenge solver. If not specified, the solver will be treated as the 'default' solver with the lowest priority, i.e. if any other solver has a more specific match, it will be used instead. + type: object + properties: + dnsNames: + description: List of DNSNames that this solver will be used to solve. If specified and a match is found, a dnsNames selector will take precedence over a dnsZones selector. If multiple solvers match with the same dnsNames value, the solver with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected. + type: array + items: + type: string + dnsZones: + description: List of DNSZones that this solver will be used to solve. The most specific DNS zone match specified here will take precedence over other DNS zone matches, so a solver specifying sys.example.com will be selected over one specifying example.com for the domain www.sys.example.com. If multiple solvers match with the same dnsZones value, the solver with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected. + type: array + items: + type: string + matchLabels: + description: A label selector that is used to refine the set of certificate's that this challenge solver will apply to. + type: object + additionalProperties: + type: string + token: + description: Token is the ACME challenge token for this challenge. This is the raw value returned from the ACME server. + type: string + type: + description: Type is the type of ACME challenge this resource represents. One of "http-01" or "dns-01". + type: string + enum: + - http-01 + - dns-01 + url: + description: URL is the URL of the ACME Challenge resource for this challenge. This can be used to lookup details about the status of this challenge. + type: string + wildcard: + description: Wildcard will be true if this challenge is for a wildcard identifier, for example '*.example.com'. + type: boolean + status: + type: object + properties: + presented: + description: Presented will be set to true if the challenge values for this challenge are currently 'presented'. This *does not* imply the self check is passing. Only that the values have been 'submitted' for the appropriate challenge mechanism (i.e. the DNS01 TXT record has been presented, or the HTTP01 configuration has been configured). + type: boolean + processing: + description: Processing is used to denote whether this challenge should be processed or not. This field will only be set to true by the 'scheduling' component. It will only be set to false by the 'challenges' controller, after the challenge has reached a final state or timed out. If this field is set to false, the challenge controller will not take any more action. + type: boolean + reason: + description: Reason contains human readable information on why the Challenge is in the current state. + type: string + state: + description: State contains the current 'state' of the challenge. If not set, the state of the challenge is unknown. + type: string + enum: + - valid + - ready + - pending + - processing + - invalid + - expired + - errored + served: false + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .status.state + name: State + type: string + - jsonPath: .spec.dnsName + name: Domain + type: string + - jsonPath: .status.reason + name: Reason + priority: 1 + type: string + - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + description: Challenge is a type to represent a Challenge request with an ACME server + type: object + required: + - metadata + - spec + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + type: object + required: + - authorizationURL + - dnsName + - issuerRef + - key + - solver + - token + - type + - url + properties: + authorizationURL: + description: The URL to the ACME Authorization resource that this challenge is a part of. + type: string + dnsName: + description: dnsName is the identifier that this challenge is for, e.g. example.com. If the requested DNSName is a 'wildcard', this field MUST be set to the non-wildcard domain, e.g. for `*.example.com`, it must be `example.com`. + type: string + issuerRef: + description: References a properly configured ACME-type Issuer which should be used to create this Challenge. If the Issuer does not exist, processing will be retried. If the Issuer is not an 'ACME' Issuer, an error will be returned and the Challenge will be marked as failed. + type: object + required: + - name + properties: + group: + description: Group of the resource being referred to. + type: string + kind: + description: Kind of the resource being referred to. + type: string + name: + description: Name of the resource being referred to. + type: string + key: + description: 'The ACME challenge key for this challenge For HTTP01 challenges, this is the value that must be responded with to complete the HTTP01 challenge in the format: `.`. For DNS01 challenges, this is the base64 encoded SHA256 sum of the `.` text that must be set as the TXT record content.' + type: string + solver: + description: Contains the domain solving configuration that should be used to solve this challenge resource. + type: object + properties: + dns01: + description: Configures cert-manager to attempt to complete authorizations by performing the DNS01 challenge flow. + type: object + properties: + acmeDNS: + description: Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage DNS01 challenge records. + type: object + required: + - accountSecretRef + - host + properties: + accountSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + host: + type: string + akamai: + description: Use the Akamai DNS zone management API to manage DNS01 challenge records. + type: object + required: + - accessTokenSecretRef + - clientSecretSecretRef + - clientTokenSecretRef + - serviceConsumerDomain + properties: + accessTokenSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + clientSecretSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + clientTokenSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + serviceConsumerDomain: + type: string + azureDNS: + description: Use the Microsoft Azure DNS API to manage DNS01 challenge records. + type: object + required: + - resourceGroupName + - subscriptionID + properties: + clientID: + description: if both this and ClientSecret are left unset MSI will be used + type: string + clientSecretSecretRef: + description: if both this and ClientID are left unset MSI will be used + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + environment: + description: name of the Azure environment (default AzurePublicCloud) + type: string + enum: + - AzurePublicCloud + - AzureChinaCloud + - AzureGermanCloud + - AzureUSGovernmentCloud + hostedZoneName: + description: name of the DNS zone that should be used + type: string + managedIdentity: + description: managed identity configuration, can not be used at the same time as clientID, clientSecretSecretRef or tenantID + type: object + properties: + clientID: + description: client ID of the managed identity, can not be used at the same time as resourceID + type: string + resourceID: + description: resource ID of the managed identity, can not be used at the same time as clientID + type: string + resourceGroupName: + description: resource group the DNS zone is located in + type: string + subscriptionID: + description: ID of the Azure subscription + type: string + tenantID: + description: when specifying ClientID and ClientSecret then this field is also needed + type: string + cloudDNS: + description: Use the Google Cloud DNS API to manage DNS01 challenge records. + type: object + required: + - project + properties: + hostedZoneName: + description: HostedZoneName is an optional field that tells cert-manager in which Cloud DNS zone the challenge record has to be created. If left empty cert-manager will automatically choose a zone. + type: string + project: + type: string + serviceAccountSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + cloudflare: + description: Use the Cloudflare API to manage DNS01 challenge records. + type: object + properties: + apiKeySecretRef: + description: 'API key to use to authenticate with Cloudflare. Note: using an API token to authenticate is now the recommended method as it allows greater control of permissions.' + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + apiTokenSecretRef: + description: API token used to authenticate with Cloudflare. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + email: + description: Email of the account, only required when using API key based authentication. + type: string + cnameStrategy: + description: CNAMEStrategy configures how the DNS01 provider should handle CNAME records when found in DNS zones. + type: string + enum: + - None + - Follow + digitalocean: + description: Use the DigitalOcean DNS API to manage DNS01 challenge records. + type: object + required: + - tokenSecretRef + properties: + tokenSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + rfc2136: + description: Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/) to manage DNS01 challenge records. + type: object + required: + - nameserver + properties: + nameserver: + description: The IP address or hostname of an authoritative DNS server supporting RFC2136 in the form host:port. If the host is an IPv6 address it must be enclosed in square brackets (e.g [2001:db8::1]) ; port is optional. This field is required. + type: string + tsigAlgorithm: + description: 'The TSIG Algorithm configured in the DNS supporting RFC2136. Used only when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined. Supported values are (case-insensitive): ``HMACMD5`` (default), ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``.' + type: string + tsigKeyName: + description: The TSIG Key name configured in the DNS. If ``tsigSecretSecretRef`` is defined, this field is required. + type: string + tsigSecretSecretRef: + description: The name of the secret containing the TSIG value. If ``tsigKeyName`` is defined, this field is required. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + route53: + description: Use the AWS Route53 API to manage DNS01 challenge records. + type: object + required: + - region + properties: + accessKeyID: + description: 'The AccessKeyID is used for authentication. If not set we fall-back to using env vars, shared credentials file or AWS Instance metadata see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials' + type: string + hostedZoneID: + description: If set, the provider will manage only this zone in Route53 and will not do an lookup using the route53:ListHostedZonesByName api call. + type: string + region: + description: Always set the region when using AccessKeyID and SecretAccessKey + type: string + role: + description: Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata + type: string + secretAccessKeySecretRef: + description: The SecretAccessKey is used for authentication. If not set we fall-back to using env vars, shared credentials file or AWS Instance metadata https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + webhook: + description: Configure an external webhook based DNS01 challenge solver to manage DNS01 challenge records. + type: object + required: + - groupName + - solverName + properties: + config: + description: Additional configuration that should be passed to the webhook apiserver when challenges are processed. This can contain arbitrary JSON data. Secret values should not be specified in this stanza. If secret values are needed (e.g. credentials for a DNS service), you should use a SecretKeySelector to reference a Secret resource. For details on the schema of this field, consult the webhook provider implementation's documentation. + x-kubernetes-preserve-unknown-fields: true + groupName: + description: The API group name that should be used when POSTing ChallengePayload resources to the webhook apiserver. This should be the same as the GroupName specified in the webhook provider implementation. + type: string + solverName: + description: The name of the solver to use, as defined in the webhook provider implementation. This will typically be the name of the provider, e.g. 'cloudflare'. + type: string + http01: + description: Configures cert-manager to attempt to complete authorizations by performing the HTTP01 challenge flow. It is not possible to obtain certificates for wildcard domain names (e.g. `*.example.com`) using the HTTP01 challenge mechanism. + type: object + properties: + gatewayHTTPRoute: + description: The Gateway API is a sig-network community API that models service networking in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will create HTTPRoutes with the specified labels in the same namespace as the challenge. This solver is experimental, and fields / behaviour may change in the future. + type: object + properties: + labels: + description: The labels that cert-manager will use when creating the temporary HTTPRoute needed for solving the HTTP-01 challenge. These labels must match the label selector of at least one Gateway. + type: object + additionalProperties: + type: string + serviceType: + description: Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort. + type: string + ingress: + description: The ingress based HTTP01 challenge solver will solve challenges by creating or modifying Ingress resources in order to route requests for '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are provisioned by cert-manager for each Challenge to be completed. + type: object + properties: + class: + description: The ingress class to use when creating Ingress resources to solve ACME challenges that use this challenge solver. Only one of 'class' or 'name' may be specified. + type: string + ingressTemplate: + description: Optional ingress template used to configure the ACME challenge solver ingress used for HTTP01 challenges. + type: object + properties: + metadata: + description: ObjectMeta overrides for the ingress used to solve HTTP01 challenges. Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. + type: object + properties: + annotations: + description: Annotations that should be added to the created ACME HTTP01 solver ingress. + type: object + additionalProperties: + type: string + labels: + description: Labels that should be added to the created ACME HTTP01 solver ingress. + type: object + additionalProperties: + type: string + name: + description: The name of the ingress resource that should have ACME challenge solving routes inserted into it in order to solve HTTP01 challenges. This is typically used in conjunction with ingress controllers like ingress-gce, which maintains a 1:1 mapping between external IPs and ingress resources. + type: string + podTemplate: + description: Optional pod template used to configure the ACME challenge solver pods used for HTTP01 challenges + type: object + properties: + metadata: + description: ObjectMeta overrides for the pod used to solve HTTP01 challenges. Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. + type: object + properties: + annotations: + description: Annotations that should be added to the create ACME HTTP01 solver pods. + type: object + additionalProperties: + type: string + labels: + description: Labels that should be added to the created ACME HTTP01 solver pods. + type: object + additionalProperties: + type: string + spec: + description: PodSpec defines overrides for the HTTP01 challenge solver pod. Only the 'priorityClassName', 'nodeSelector', 'affinity', 'serviceAccountName' and 'tolerations' fields are supported currently. All other fields will be ignored. + type: object + properties: + affinity: + description: If specified, the pod's scheduling constraints + type: object + properties: + nodeAffinity: + description: Describes node affinity scheduling rules for the pod. + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred. + type: array + items: + description: An empty preferred scheduling term matches all objects with implicit weight 0 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + type: object + required: + - preference + - weight + properties: + preference: + description: A node selector term, associated with the corresponding weight. + type: object + properties: + matchExpressions: + description: A list of node selector requirements by node's labels. + type: array + items: + description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchFields: + description: A list of node selector requirements by node's fields. + type: array + items: + description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array + items: + type: string + weight: + description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. + type: integer + format: int32 + requiredDuringSchedulingIgnoredDuringExecution: + description: If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node. + type: object + required: + - nodeSelectorTerms + properties: + nodeSelectorTerms: + description: Required. A list of node selector terms. The terms are ORed. + type: array + items: + description: A null or empty node selector term matches no objects. The requirements of them are ANDed. The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + type: object + properties: + matchExpressions: + description: A list of node selector requirements by node's labels. + type: array + items: + description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchFields: + description: A list of node selector requirements by node's fields. + type: array + items: + description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array + items: + type: string + podAffinity: + description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. + type: array + items: + description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + type: object + required: + - podAffinityTerm + - weight + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated with the corresponding weight. + type: object + required: + - topologyKey + properties: + labelSelector: + description: A label query over a set of resources, in this case pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaceSelector: + description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. This field is beta-level and is only honored when PodAffinityNamespaceSelector feature is enabled. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaces: + description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace" + type: array + items: + type: string + topologyKey: + description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + type: string + weight: + description: weight associated with matching the corresponding podAffinityTerm, in the range 1-100. + type: integer + format: int32 + requiredDuringSchedulingIgnoredDuringExecution: + description: If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. + type: array + items: + description: Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running + type: object + required: + - topologyKey + properties: + labelSelector: + description: A label query over a set of resources, in this case pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaceSelector: + description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. This field is beta-level and is only honored when PodAffinityNamespaceSelector feature is enabled. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaces: + description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace" + type: array + items: + type: string + topologyKey: + description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + type: string + podAntiAffinity: + description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods to nodes that satisfy the anti-affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. + type: array + items: + description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + type: object + required: + - podAffinityTerm + - weight + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated with the corresponding weight. + type: object + required: + - topologyKey + properties: + labelSelector: + description: A label query over a set of resources, in this case pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaceSelector: + description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. This field is beta-level and is only honored when PodAffinityNamespaceSelector feature is enabled. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaces: + description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace" + type: array + items: + type: string + topologyKey: + description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + type: string + weight: + description: weight associated with matching the corresponding podAffinityTerm, in the range 1-100. + type: integer + format: int32 + requiredDuringSchedulingIgnoredDuringExecution: + description: If the anti-affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the anti-affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. + type: array + items: + description: Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running + type: object + required: + - topologyKey + properties: + labelSelector: + description: A label query over a set of resources, in this case pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaceSelector: + description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. This field is beta-level and is only honored when PodAffinityNamespaceSelector feature is enabled. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaces: + description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace" + type: array + items: + type: string + topologyKey: + description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + type: string + nodeSelector: + description: 'NodeSelector is a selector which must be true for the pod to fit on a node. Selector which must match a node''s labels for the pod to be scheduled on that node. More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/' + type: object + additionalProperties: + type: string + priorityClassName: + description: If specified, the pod's priorityClassName. + type: string + serviceAccountName: + description: If specified, the pod's service account + type: string + tolerations: + description: If specified, the pod's tolerations. + type: array + items: + description: The pod this Toleration is attached to tolerates any taint that matches the triple using the matching operator . + type: object + properties: + effect: + description: Effect indicates the taint effect to match. Empty means match all taint effects. When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: Key is the taint key that the toleration applies to. Empty means match all taint keys. If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: Operator represents a key's relationship to the value. Valid operators are Exists and Equal. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: TolerationSeconds represents the period of time the toleration (which must be of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system. + type: integer + format: int64 + value: + description: Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + serviceType: + description: Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort. + type: string + selector: + description: Selector selects a set of DNSNames on the Certificate resource that should be solved using this challenge solver. If not specified, the solver will be treated as the 'default' solver with the lowest priority, i.e. if any other solver has a more specific match, it will be used instead. + type: object + properties: + dnsNames: + description: List of DNSNames that this solver will be used to solve. If specified and a match is found, a dnsNames selector will take precedence over a dnsZones selector. If multiple solvers match with the same dnsNames value, the solver with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected. + type: array + items: + type: string + dnsZones: + description: List of DNSZones that this solver will be used to solve. The most specific DNS zone match specified here will take precedence over other DNS zone matches, so a solver specifying sys.example.com will be selected over one specifying example.com for the domain www.sys.example.com. If multiple solvers match with the same dnsZones value, the solver with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected. + type: array + items: + type: string + matchLabels: + description: A label selector that is used to refine the set of certificate's that this challenge solver will apply to. + type: object + additionalProperties: + type: string + token: + description: The ACME challenge token for this challenge. This is the raw value returned from the ACME server. + type: string + type: + description: The type of ACME challenge this resource represents. One of "HTTP-01" or "DNS-01". + type: string + enum: + - HTTP-01 + - DNS-01 + url: + description: The URL of the ACME Challenge resource for this challenge. This can be used to lookup details about the status of this challenge. + type: string + wildcard: + description: wildcard will be true if this challenge is for a wildcard identifier, for example '*.example.com'. + type: boolean + status: + type: object + properties: + presented: + description: presented will be set to true if the challenge values for this challenge are currently 'presented'. This *does not* imply the self check is passing. Only that the values have been 'submitted' for the appropriate challenge mechanism (i.e. the DNS01 TXT record has been presented, or the HTTP01 configuration has been configured). + type: boolean + processing: + description: Used to denote whether this challenge should be processed or not. This field will only be set to true by the 'scheduling' component. It will only be set to false by the 'challenges' controller, after the challenge has reached a final state or timed out. If this field is set to false, the challenge controller will not take any more action. + type: boolean + reason: + description: Contains human readable information on why the Challenge is in the current state. + type: string + state: + description: Contains the current 'state' of the challenge. If not set, the state of the challenge is unknown. + type: string + enum: + - valid + - ready + - pending + - processing + - invalid + - expired + - errored + served: false + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .status.state + name: State + type: string + - jsonPath: .spec.dnsName + name: Domain + type: string + - jsonPath: .status.reason + name: Reason + priority: 1 + type: string + - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1 + schema: + openAPIV3Schema: + description: Challenge is a type to represent a Challenge request with an ACME server + type: object + required: + - metadata + - spec + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + type: object + required: + - authorizationURL + - dnsName + - issuerRef + - key + - solver + - token + - type + - url + properties: + authorizationURL: + description: The URL to the ACME Authorization resource that this challenge is a part of. + type: string + dnsName: + description: dnsName is the identifier that this challenge is for, e.g. example.com. If the requested DNSName is a 'wildcard', this field MUST be set to the non-wildcard domain, e.g. for `*.example.com`, it must be `example.com`. + type: string + issuerRef: + description: References a properly configured ACME-type Issuer which should be used to create this Challenge. If the Issuer does not exist, processing will be retried. If the Issuer is not an 'ACME' Issuer, an error will be returned and the Challenge will be marked as failed. + type: object + required: + - name + properties: + group: + description: Group of the resource being referred to. + type: string + kind: + description: Kind of the resource being referred to. + type: string + name: + description: Name of the resource being referred to. + type: string + key: + description: 'The ACME challenge key for this challenge For HTTP01 challenges, this is the value that must be responded with to complete the HTTP01 challenge in the format: `.`. For DNS01 challenges, this is the base64 encoded SHA256 sum of the `.` text that must be set as the TXT record content.' + type: string + solver: + description: Contains the domain solving configuration that should be used to solve this challenge resource. + type: object + properties: + dns01: + description: Configures cert-manager to attempt to complete authorizations by performing the DNS01 challenge flow. + type: object + properties: + acmeDNS: + description: Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage DNS01 challenge records. + type: object + required: + - accountSecretRef + - host + properties: + accountSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + host: + type: string + akamai: + description: Use the Akamai DNS zone management API to manage DNS01 challenge records. + type: object + required: + - accessTokenSecretRef + - clientSecretSecretRef + - clientTokenSecretRef + - serviceConsumerDomain + properties: + accessTokenSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + clientSecretSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + clientTokenSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + serviceConsumerDomain: + type: string + azureDNS: + description: Use the Microsoft Azure DNS API to manage DNS01 challenge records. + type: object + required: + - resourceGroupName + - subscriptionID + properties: + clientID: + description: if both this and ClientSecret are left unset MSI will be used + type: string + clientSecretSecretRef: + description: if both this and ClientID are left unset MSI will be used + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + environment: + description: name of the Azure environment (default AzurePublicCloud) + type: string + enum: + - AzurePublicCloud + - AzureChinaCloud + - AzureGermanCloud + - AzureUSGovernmentCloud + hostedZoneName: + description: name of the DNS zone that should be used + type: string + managedIdentity: + description: managed identity configuration, can not be used at the same time as clientID, clientSecretSecretRef or tenantID + type: object + properties: + clientID: + description: client ID of the managed identity, can not be used at the same time as resourceID + type: string + resourceID: + description: resource ID of the managed identity, can not be used at the same time as clientID + type: string + resourceGroupName: + description: resource group the DNS zone is located in + type: string + subscriptionID: + description: ID of the Azure subscription + type: string + tenantID: + description: when specifying ClientID and ClientSecret then this field is also needed + type: string + cloudDNS: + description: Use the Google Cloud DNS API to manage DNS01 challenge records. + type: object + required: + - project + properties: + hostedZoneName: + description: HostedZoneName is an optional field that tells cert-manager in which Cloud DNS zone the challenge record has to be created. If left empty cert-manager will automatically choose a zone. + type: string + project: + type: string + serviceAccountSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + cloudflare: + description: Use the Cloudflare API to manage DNS01 challenge records. + type: object + properties: + apiKeySecretRef: + description: 'API key to use to authenticate with Cloudflare. Note: using an API token to authenticate is now the recommended method as it allows greater control of permissions.' + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + apiTokenSecretRef: + description: API token used to authenticate with Cloudflare. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + email: + description: Email of the account, only required when using API key based authentication. + type: string + cnameStrategy: + description: CNAMEStrategy configures how the DNS01 provider should handle CNAME records when found in DNS zones. + type: string + enum: + - None + - Follow + digitalocean: + description: Use the DigitalOcean DNS API to manage DNS01 challenge records. + type: object + required: + - tokenSecretRef + properties: + tokenSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + rfc2136: + description: Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/) to manage DNS01 challenge records. + type: object + required: + - nameserver + properties: + nameserver: + description: The IP address or hostname of an authoritative DNS server supporting RFC2136 in the form host:port. If the host is an IPv6 address it must be enclosed in square brackets (e.g [2001:db8::1]) ; port is optional. This field is required. + type: string + tsigAlgorithm: + description: 'The TSIG Algorithm configured in the DNS supporting RFC2136. Used only when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined. Supported values are (case-insensitive): ``HMACMD5`` (default), ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``.' + type: string + tsigKeyName: + description: The TSIG Key name configured in the DNS. If ``tsigSecretSecretRef`` is defined, this field is required. + type: string + tsigSecretSecretRef: + description: The name of the secret containing the TSIG value. If ``tsigKeyName`` is defined, this field is required. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + route53: + description: Use the AWS Route53 API to manage DNS01 challenge records. + type: object + required: + - region + properties: + accessKeyID: + description: 'The AccessKeyID is used for authentication. If not set we fall-back to using env vars, shared credentials file or AWS Instance metadata see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials' + type: string + hostedZoneID: + description: If set, the provider will manage only this zone in Route53 and will not do an lookup using the route53:ListHostedZonesByName api call. + type: string + region: + description: Always set the region when using AccessKeyID and SecretAccessKey + type: string + role: + description: Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata + type: string + secretAccessKeySecretRef: + description: The SecretAccessKey is used for authentication. If not set we fall-back to using env vars, shared credentials file or AWS Instance metadata https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + webhook: + description: Configure an external webhook based DNS01 challenge solver to manage DNS01 challenge records. + type: object + required: + - groupName + - solverName + properties: + config: + description: Additional configuration that should be passed to the webhook apiserver when challenges are processed. This can contain arbitrary JSON data. Secret values should not be specified in this stanza. If secret values are needed (e.g. credentials for a DNS service), you should use a SecretKeySelector to reference a Secret resource. For details on the schema of this field, consult the webhook provider implementation's documentation. + x-kubernetes-preserve-unknown-fields: true + groupName: + description: The API group name that should be used when POSTing ChallengePayload resources to the webhook apiserver. This should be the same as the GroupName specified in the webhook provider implementation. + type: string + solverName: + description: The name of the solver to use, as defined in the webhook provider implementation. This will typically be the name of the provider, e.g. 'cloudflare'. + type: string + http01: + description: Configures cert-manager to attempt to complete authorizations by performing the HTTP01 challenge flow. It is not possible to obtain certificates for wildcard domain names (e.g. `*.example.com`) using the HTTP01 challenge mechanism. + type: object + properties: + gatewayHTTPRoute: + description: The Gateway API is a sig-network community API that models service networking in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will create HTTPRoutes with the specified labels in the same namespace as the challenge. This solver is experimental, and fields / behaviour may change in the future. + type: object + properties: + labels: + description: The labels that cert-manager will use when creating the temporary HTTPRoute needed for solving the HTTP-01 challenge. These labels must match the label selector of at least one Gateway. + type: object + additionalProperties: + type: string + serviceType: + description: Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort. + type: string + ingress: + description: The ingress based HTTP01 challenge solver will solve challenges by creating or modifying Ingress resources in order to route requests for '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are provisioned by cert-manager for each Challenge to be completed. + type: object + properties: + class: + description: The ingress class to use when creating Ingress resources to solve ACME challenges that use this challenge solver. Only one of 'class' or 'name' may be specified. + type: string + ingressTemplate: + description: Optional ingress template used to configure the ACME challenge solver ingress used for HTTP01 challenges. + type: object + properties: + metadata: + description: ObjectMeta overrides for the ingress used to solve HTTP01 challenges. Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. + type: object + properties: + annotations: + description: Annotations that should be added to the created ACME HTTP01 solver ingress. + type: object + additionalProperties: + type: string + labels: + description: Labels that should be added to the created ACME HTTP01 solver ingress. + type: object + additionalProperties: + type: string + name: + description: The name of the ingress resource that should have ACME challenge solving routes inserted into it in order to solve HTTP01 challenges. This is typically used in conjunction with ingress controllers like ingress-gce, which maintains a 1:1 mapping between external IPs and ingress resources. + type: string + podTemplate: + description: Optional pod template used to configure the ACME challenge solver pods used for HTTP01 challenges. + type: object + properties: + metadata: + description: ObjectMeta overrides for the pod used to solve HTTP01 challenges. Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. + type: object + properties: + annotations: + description: Annotations that should be added to the create ACME HTTP01 solver pods. + type: object + additionalProperties: + type: string + labels: + description: Labels that should be added to the created ACME HTTP01 solver pods. + type: object + additionalProperties: + type: string + spec: + description: PodSpec defines overrides for the HTTP01 challenge solver pod. Only the 'priorityClassName', 'nodeSelector', 'affinity', 'serviceAccountName' and 'tolerations' fields are supported currently. All other fields will be ignored. + type: object + properties: + affinity: + description: If specified, the pod's scheduling constraints + type: object + properties: + nodeAffinity: + description: Describes node affinity scheduling rules for the pod. + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred. + type: array + items: + description: An empty preferred scheduling term matches all objects with implicit weight 0 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + type: object + required: + - preference + - weight + properties: + preference: + description: A node selector term, associated with the corresponding weight. + type: object + properties: + matchExpressions: + description: A list of node selector requirements by node's labels. + type: array + items: + description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchFields: + description: A list of node selector requirements by node's fields. + type: array + items: + description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array + items: + type: string + weight: + description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. + type: integer + format: int32 + requiredDuringSchedulingIgnoredDuringExecution: + description: If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node. + type: object + required: + - nodeSelectorTerms + properties: + nodeSelectorTerms: + description: Required. A list of node selector terms. The terms are ORed. + type: array + items: + description: A null or empty node selector term matches no objects. The requirements of them are ANDed. The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + type: object + properties: + matchExpressions: + description: A list of node selector requirements by node's labels. + type: array + items: + description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchFields: + description: A list of node selector requirements by node's fields. + type: array + items: + description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array + items: + type: string + podAffinity: + description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. + type: array + items: + description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + type: object + required: + - podAffinityTerm + - weight + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated with the corresponding weight. + type: object + required: + - topologyKey + properties: + labelSelector: + description: A label query over a set of resources, in this case pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaceSelector: + description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. This field is beta-level and is only honored when PodAffinityNamespaceSelector feature is enabled. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaces: + description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace" + type: array + items: + type: string + topologyKey: + description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + type: string + weight: + description: weight associated with matching the corresponding podAffinityTerm, in the range 1-100. + type: integer + format: int32 + requiredDuringSchedulingIgnoredDuringExecution: + description: If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. + type: array + items: + description: Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running + type: object + required: + - topologyKey + properties: + labelSelector: + description: A label query over a set of resources, in this case pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaceSelector: + description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. This field is beta-level and is only honored when PodAffinityNamespaceSelector feature is enabled. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaces: + description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace" + type: array + items: + type: string + topologyKey: + description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + type: string + podAntiAffinity: + description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods to nodes that satisfy the anti-affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. + type: array + items: + description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + type: object + required: + - podAffinityTerm + - weight + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated with the corresponding weight. + type: object + required: + - topologyKey + properties: + labelSelector: + description: A label query over a set of resources, in this case pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaceSelector: + description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. This field is beta-level and is only honored when PodAffinityNamespaceSelector feature is enabled. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaces: + description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace" + type: array + items: + type: string + topologyKey: + description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + type: string + weight: + description: weight associated with matching the corresponding podAffinityTerm, in the range 1-100. + type: integer + format: int32 + requiredDuringSchedulingIgnoredDuringExecution: + description: If the anti-affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the anti-affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. + type: array + items: + description: Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running + type: object + required: + - topologyKey + properties: + labelSelector: + description: A label query over a set of resources, in this case pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaceSelector: + description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. This field is beta-level and is only honored when PodAffinityNamespaceSelector feature is enabled. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaces: + description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace" + type: array + items: + type: string + topologyKey: + description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + type: string + nodeSelector: + description: 'NodeSelector is a selector which must be true for the pod to fit on a node. Selector which must match a node''s labels for the pod to be scheduled on that node. More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/' + type: object + additionalProperties: + type: string + priorityClassName: + description: If specified, the pod's priorityClassName. + type: string + serviceAccountName: + description: If specified, the pod's service account + type: string + tolerations: + description: If specified, the pod's tolerations. + type: array + items: + description: The pod this Toleration is attached to tolerates any taint that matches the triple using the matching operator . + type: object + properties: + effect: + description: Effect indicates the taint effect to match. Empty means match all taint effects. When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: Key is the taint key that the toleration applies to. Empty means match all taint keys. If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: Operator represents a key's relationship to the value. Valid operators are Exists and Equal. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: TolerationSeconds represents the period of time the toleration (which must be of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system. + type: integer + format: int64 + value: + description: Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + serviceType: + description: Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort. + type: string + selector: + description: Selector selects a set of DNSNames on the Certificate resource that should be solved using this challenge solver. If not specified, the solver will be treated as the 'default' solver with the lowest priority, i.e. if any other solver has a more specific match, it will be used instead. + type: object + properties: + dnsNames: + description: List of DNSNames that this solver will be used to solve. If specified and a match is found, a dnsNames selector will take precedence over a dnsZones selector. If multiple solvers match with the same dnsNames value, the solver with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected. + type: array + items: + type: string + dnsZones: + description: List of DNSZones that this solver will be used to solve. The most specific DNS zone match specified here will take precedence over other DNS zone matches, so a solver specifying sys.example.com will be selected over one specifying example.com for the domain www.sys.example.com. If multiple solvers match with the same dnsZones value, the solver with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected. + type: array + items: + type: string + matchLabels: + description: A label selector that is used to refine the set of certificate's that this challenge solver will apply to. + type: object + additionalProperties: + type: string + token: + description: The ACME challenge token for this challenge. This is the raw value returned from the ACME server. + type: string + type: + description: The type of ACME challenge this resource represents. One of "HTTP-01" or "DNS-01". + type: string + enum: + - HTTP-01 + - DNS-01 + url: + description: The URL of the ACME Challenge resource for this challenge. This can be used to lookup details about the status of this challenge. + type: string + wildcard: + description: wildcard will be true if this challenge is for a wildcard identifier, for example '*.example.com'. + type: boolean + status: + type: object + properties: + presented: + description: presented will be set to true if the challenge values for this challenge are currently 'presented'. This *does not* imply the self check is passing. Only that the values have been 'submitted' for the appropriate challenge mechanism (i.e. the DNS01 TXT record has been presented, or the HTTP01 configuration has been configured). + type: boolean + processing: + description: Used to denote whether this challenge should be processed or not. This field will only be set to true by the 'scheduling' component. It will only be set to false by the 'challenges' controller, after the challenge has reached a final state or timed out. If this field is set to false, the challenge controller will not take any more action. + type: boolean + reason: + description: Contains human readable information on why the Challenge is in the current state. + type: string + state: + description: Contains the current 'state' of the challenge. If not set, the state of the challenge is unknown. + type: string + enum: + - valid + - ready + - pending + - processing + - invalid + - expired + - errored + served: true + storage: true + subresources: + status: {} +--- +# Source: cert-manager/templates/templates.out +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: clusterissuers.cert-manager.io + annotations: + cert-manager.io/inject-ca-from-secret: 'cert-manager/cert-manager-webhook-ca' + labels: + app: 'cert-manager' + app.kubernetes.io/name: 'cert-manager' + app.kubernetes.io/instance: 'cert-manager' + # Generated labels + app.kubernetes.io/version: "v1.6.3" +spec: + group: cert-manager.io + names: + kind: ClusterIssuer + listKind: ClusterIssuerList + plural: clusterissuers + singular: clusterissuer + categories: + - cert-manager + scope: Cluster + conversion: + # a Webhook strategy instruct API server to call an external webhook for any conversion between custom resources. + strategy: Webhook + # webhookClientConfig is required when strategy is `Webhook` and it configures the webhook endpoint to be called by API server. + webhook: + # We don't actually support `v1beta1` but is listed here as it is a + # required value for [Kubernetes v1.16](kubernetes/kubernetes#82023). The + # API server reads the supported versions in order, so _should always_ + # attempt a `v1` request which is understood by the cert-manager webhook. + # Any `v1beta1` request will return an error and fail closed for that + # resource (the whole object request is rejected). + # When we no longer support v1.16 we can remove `v1beta1` from this list. + conversionReviewVersions: ["v1", "v1beta1"] + clientConfig: + # + service: + name: 'cert-manager-webhook' + namespace: "cert-manager" + path: /convert + # + versions: + - name: v1alpha2 + subresources: + status: {} + additionalPrinterColumns: + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + priority: 1 + type: string + - jsonPath: .metadata.creationTimestamp + description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + name: Age + type: date + schema: + openAPIV3Schema: + description: A ClusterIssuer represents a certificate issuing authority which can be referenced as part of `issuerRef` fields. It is similar to an Issuer, however it is cluster-scoped and therefore can be referenced by resources that exist in *any* namespace, not just the same namespace as the referent. + type: object + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: Desired state of the ClusterIssuer resource. + type: object + properties: + acme: + description: ACME configures this issuer to communicate with a RFC8555 (ACME) server to obtain signed x509 certificates. + type: object + required: + - privateKeySecretRef + - server + properties: + disableAccountKeyGeneration: + description: Enables or disables generating a new ACME account key. If true, the Issuer resource will *not* request a new account but will expect the account key to be supplied via an existing secret. If false, the cert-manager system will generate a new ACME account key for the Issuer. Defaults to false. + type: boolean + email: + description: Email is the email address to be associated with the ACME account. This field is optional, but it is strongly recommended to be set. It will be used to contact you in case of issues with your account or certificates, including expiry notification emails. This field may be updated after the account is initially registered. + type: string + enableDurationFeature: + description: Enables requesting a Not After date on certificates that matches the duration of the certificate. This is not supported by all ACME servers like Let's Encrypt. If set to true when the ACME server does not support it it will create an error on the Order. Defaults to false. + type: boolean + externalAccountBinding: + description: ExternalAccountBinding is a reference to a CA external account of the ACME server. If set, upon registration cert-manager will attempt to associate the given external account credentials with the registered ACME account. + type: object + required: + - keyID + - keySecretRef + properties: + keyAlgorithm: + description: 'Deprecated: keyAlgorithm field exists for historical compatibility reasons and should not be used. The algorithm is now hardcoded to HS256 in golang/x/crypto/acme.' + type: string + enum: + - HS256 + - HS384 + - HS512 + keyID: + description: keyID is the ID of the CA key that the External Account is bound to. + type: string + keySecretRef: + description: keySecretRef is a Secret Key Selector referencing a data item in a Kubernetes Secret which holds the symmetric MAC key of the External Account Binding. The `key` is the index string that is paired with the key data in the Secret and should not be confused with the key data itself, or indeed with the External Account Binding keyID above. The secret key stored in the Secret **must** be un-padded, base64 URL encoded data. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + preferredChain: + description: 'PreferredChain is the chain to use if the ACME server outputs multiple. PreferredChain is no guarantee that this one gets delivered by the ACME endpoint. For example, for Let''s Encrypt''s DST crosssign you would use: "DST Root CA X3" or "ISRG Root X1" for the newer Let''s Encrypt root CA. This value picks the first certificate bundle in the ACME alternative chains that has a certificate with this value as its issuer''s CN' + type: string + maxLength: 64 + privateKeySecretRef: + description: PrivateKey is the name of a Kubernetes Secret resource that will be used to store the automatically generated ACME account private key. Optionally, a `key` may be specified to select a specific entry within the named Secret resource. If `key` is not specified, a default of `tls.key` will be used. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + server: + description: 'Server is the URL used to access the ACME server''s ''directory'' endpoint. For example, for Let''s Encrypt''s staging endpoint, you would use: "https://acme-staging-v02.api.letsencrypt.org/directory". Only ACME v2 endpoints (i.e. RFC 8555) are supported.' + type: string + skipTLSVerify: + description: Enables or disables validation of the ACME server TLS certificate. If true, requests to the ACME server will not have their TLS certificate validated (i.e. insecure connections will be allowed). Only enable this option in development environments. The cert-manager system installed roots will be used to verify connections to the ACME server if this is false. Defaults to false. + type: boolean + solvers: + description: 'Solvers is a list of challenge solvers that will be used to solve ACME challenges for the matching domains. Solver configurations must be provided in order to obtain certificates from an ACME server. For more information, see: https://cert-manager.io/docs/configuration/acme/' + type: array + items: + description: Configures an issuer to solve challenges using the specified options. Only one of HTTP01 or DNS01 may be provided. + type: object + properties: + dns01: + description: Configures cert-manager to attempt to complete authorizations by performing the DNS01 challenge flow. + type: object + properties: + acmedns: + description: Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage DNS01 challenge records. + type: object + required: + - accountSecretRef + - host + properties: + accountSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + host: + type: string + akamai: + description: Use the Akamai DNS zone management API to manage DNS01 challenge records. + type: object + required: + - accessTokenSecretRef + - clientSecretSecretRef + - clientTokenSecretRef + - serviceConsumerDomain + properties: + accessTokenSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + clientSecretSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + clientTokenSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + serviceConsumerDomain: + type: string + azuredns: + description: Use the Microsoft Azure DNS API to manage DNS01 challenge records. + type: object + required: + - resourceGroupName + - subscriptionID + properties: + clientID: + description: if both this and ClientSecret are left unset MSI will be used + type: string + clientSecretSecretRef: + description: if both this and ClientID are left unset MSI will be used + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + environment: + description: name of the Azure environment (default AzurePublicCloud) + type: string + enum: + - AzurePublicCloud + - AzureChinaCloud + - AzureGermanCloud + - AzureUSGovernmentCloud + hostedZoneName: + description: name of the DNS zone that should be used + type: string + managedIdentity: + description: managed identity configuration, can not be used at the same time as clientID, clientSecretSecretRef or tenantID + type: object + properties: + clientID: + description: client ID of the managed identity, can not be used at the same time as resourceID + type: string + resourceID: + description: resource ID of the managed identity, can not be used at the same time as clientID + type: string + resourceGroupName: + description: resource group the DNS zone is located in + type: string + subscriptionID: + description: ID of the Azure subscription + type: string + tenantID: + description: when specifying ClientID and ClientSecret then this field is also needed + type: string + clouddns: + description: Use the Google Cloud DNS API to manage DNS01 challenge records. + type: object + required: + - project + properties: + hostedZoneName: + description: HostedZoneName is an optional field that tells cert-manager in which Cloud DNS zone the challenge record has to be created. If left empty cert-manager will automatically choose a zone. + type: string + project: + type: string + serviceAccountSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + cloudflare: + description: Use the Cloudflare API to manage DNS01 challenge records. + type: object + properties: + apiKeySecretRef: + description: 'API key to use to authenticate with Cloudflare. Note: using an API token to authenticate is now the recommended method as it allows greater control of permissions.' + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + apiTokenSecretRef: + description: API token used to authenticate with Cloudflare. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + email: + description: Email of the account, only required when using API key based authentication. + type: string + cnameStrategy: + description: CNAMEStrategy configures how the DNS01 provider should handle CNAME records when found in DNS zones. + type: string + enum: + - None + - Follow + digitalocean: + description: Use the DigitalOcean DNS API to manage DNS01 challenge records. + type: object + required: + - tokenSecretRef + properties: + tokenSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + rfc2136: + description: Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/) to manage DNS01 challenge records. + type: object + required: + - nameserver + properties: + nameserver: + description: The IP address or hostname of an authoritative DNS server supporting RFC2136 in the form host:port. If the host is an IPv6 address it must be enclosed in square brackets (e.g [2001:db8::1]) ; port is optional. This field is required. + type: string + tsigAlgorithm: + description: 'The TSIG Algorithm configured in the DNS supporting RFC2136. Used only when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined. Supported values are (case-insensitive): ``HMACMD5`` (default), ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``.' + type: string + tsigKeyName: + description: The TSIG Key name configured in the DNS. If ``tsigSecretSecretRef`` is defined, this field is required. + type: string + tsigSecretSecretRef: + description: The name of the secret containing the TSIG value. If ``tsigKeyName`` is defined, this field is required. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + route53: + description: Use the AWS Route53 API to manage DNS01 challenge records. + type: object + required: + - region + properties: + accessKeyID: + description: 'The AccessKeyID is used for authentication. If not set we fall-back to using env vars, shared credentials file or AWS Instance metadata see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials' + type: string + hostedZoneID: + description: If set, the provider will manage only this zone in Route53 and will not do an lookup using the route53:ListHostedZonesByName api call. + type: string + region: + description: Always set the region when using AccessKeyID and SecretAccessKey + type: string + role: + description: Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata + type: string + secretAccessKeySecretRef: + description: The SecretAccessKey is used for authentication. If not set we fall-back to using env vars, shared credentials file or AWS Instance metadata https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + webhook: + description: Configure an external webhook based DNS01 challenge solver to manage DNS01 challenge records. + type: object + required: + - groupName + - solverName + properties: + config: + description: Additional configuration that should be passed to the webhook apiserver when challenges are processed. This can contain arbitrary JSON data. Secret values should not be specified in this stanza. If secret values are needed (e.g. credentials for a DNS service), you should use a SecretKeySelector to reference a Secret resource. For details on the schema of this field, consult the webhook provider implementation's documentation. + x-kubernetes-preserve-unknown-fields: true + groupName: + description: The API group name that should be used when POSTing ChallengePayload resources to the webhook apiserver. This should be the same as the GroupName specified in the webhook provider implementation. + type: string + solverName: + description: The name of the solver to use, as defined in the webhook provider implementation. This will typically be the name of the provider, e.g. 'cloudflare'. + type: string + http01: + description: Configures cert-manager to attempt to complete authorizations by performing the HTTP01 challenge flow. It is not possible to obtain certificates for wildcard domain names (e.g. `*.example.com`) using the HTTP01 challenge mechanism. + type: object + properties: + gatewayHTTPRoute: + description: The Gateway API is a sig-network community API that models service networking in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will create HTTPRoutes with the specified labels in the same namespace as the challenge. This solver is experimental, and fields / behaviour may change in the future. + type: object + properties: + labels: + description: The labels that cert-manager will use when creating the temporary HTTPRoute needed for solving the HTTP-01 challenge. These labels must match the label selector of at least one Gateway. + type: object + additionalProperties: + type: string + serviceType: + description: Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort. + type: string + ingress: + description: The ingress based HTTP01 challenge solver will solve challenges by creating or modifying Ingress resources in order to route requests for '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are provisioned by cert-manager for each Challenge to be completed. + type: object + properties: + class: + description: The ingress class to use when creating Ingress resources to solve ACME challenges that use this challenge solver. Only one of 'class' or 'name' may be specified. + type: string + ingressTemplate: + description: Optional ingress template used to configure the ACME challenge solver ingress used for HTTP01 challenges + type: object + properties: + metadata: + description: ObjectMeta overrides for the ingress used to solve HTTP01 challenges. Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. + type: object + properties: + annotations: + description: Annotations that should be added to the created ACME HTTP01 solver ingress. + type: object + additionalProperties: + type: string + labels: + description: Labels that should be added to the created ACME HTTP01 solver ingress. + type: object + additionalProperties: + type: string + name: + description: The name of the ingress resource that should have ACME challenge solving routes inserted into it in order to solve HTTP01 challenges. This is typically used in conjunction with ingress controllers like ingress-gce, which maintains a 1:1 mapping between external IPs and ingress resources. + type: string + podTemplate: + description: Optional pod template used to configure the ACME challenge solver pods used for HTTP01 challenges. + type: object + properties: + metadata: + description: ObjectMeta overrides for the pod used to solve HTTP01 challenges. Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. + type: object + properties: + annotations: + description: Annotations that should be added to the create ACME HTTP01 solver pods. + type: object + additionalProperties: + type: string + labels: + description: Labels that should be added to the created ACME HTTP01 solver pods. + type: object + additionalProperties: + type: string + spec: + description: PodSpec defines overrides for the HTTP01 challenge solver pod. Only the 'priorityClassName', 'nodeSelector', 'affinity', 'serviceAccountName' and 'tolerations' fields are supported currently. All other fields will be ignored. + type: object + properties: + affinity: + description: If specified, the pod's scheduling constraints + type: object + properties: + nodeAffinity: + description: Describes node affinity scheduling rules for the pod. + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred. + type: array + items: + description: An empty preferred scheduling term matches all objects with implicit weight 0 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + type: object + required: + - preference + - weight + properties: + preference: + description: A node selector term, associated with the corresponding weight. + type: object + properties: + matchExpressions: + description: A list of node selector requirements by node's labels. + type: array + items: + description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchFields: + description: A list of node selector requirements by node's fields. + type: array + items: + description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array + items: + type: string + weight: + description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. + type: integer + format: int32 + requiredDuringSchedulingIgnoredDuringExecution: + description: If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node. + type: object + required: + - nodeSelectorTerms + properties: + nodeSelectorTerms: + description: Required. A list of node selector terms. The terms are ORed. + type: array + items: + description: A null or empty node selector term matches no objects. The requirements of them are ANDed. The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + type: object + properties: + matchExpressions: + description: A list of node selector requirements by node's labels. + type: array + items: + description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchFields: + description: A list of node selector requirements by node's fields. + type: array + items: + description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array + items: + type: string + podAffinity: + description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. + type: array + items: + description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + type: object + required: + - podAffinityTerm + - weight + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated with the corresponding weight. + type: object + required: + - topologyKey + properties: + labelSelector: + description: A label query over a set of resources, in this case pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaceSelector: + description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. This field is beta-level and is only honored when PodAffinityNamespaceSelector feature is enabled. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaces: + description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace" + type: array + items: + type: string + topologyKey: + description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + type: string + weight: + description: weight associated with matching the corresponding podAffinityTerm, in the range 1-100. + type: integer + format: int32 + requiredDuringSchedulingIgnoredDuringExecution: + description: If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. + type: array + items: + description: Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running + type: object + required: + - topologyKey + properties: + labelSelector: + description: A label query over a set of resources, in this case pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaceSelector: + description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. This field is beta-level and is only honored when PodAffinityNamespaceSelector feature is enabled. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaces: + description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace" + type: array + items: + type: string + topologyKey: + description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + type: string + podAntiAffinity: + description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods to nodes that satisfy the anti-affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. + type: array + items: + description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + type: object + required: + - podAffinityTerm + - weight + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated with the corresponding weight. + type: object + required: + - topologyKey + properties: + labelSelector: + description: A label query over a set of resources, in this case pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaceSelector: + description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. This field is beta-level and is only honored when PodAffinityNamespaceSelector feature is enabled. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaces: + description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace" + type: array + items: + type: string + topologyKey: + description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + type: string + weight: + description: weight associated with matching the corresponding podAffinityTerm, in the range 1-100. + type: integer + format: int32 + requiredDuringSchedulingIgnoredDuringExecution: + description: If the anti-affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the anti-affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. + type: array + items: + description: Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running + type: object + required: + - topologyKey + properties: + labelSelector: + description: A label query over a set of resources, in this case pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaceSelector: + description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. This field is beta-level and is only honored when PodAffinityNamespaceSelector feature is enabled. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaces: + description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace" + type: array + items: + type: string + topologyKey: + description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + type: string + nodeSelector: + description: 'NodeSelector is a selector which must be true for the pod to fit on a node. Selector which must match a node''s labels for the pod to be scheduled on that node. More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/' + type: object + additionalProperties: + type: string + priorityClassName: + description: If specified, the pod's priorityClassName. + type: string + serviceAccountName: + description: If specified, the pod's service account + type: string + tolerations: + description: If specified, the pod's tolerations. + type: array + items: + description: The pod this Toleration is attached to tolerates any taint that matches the triple using the matching operator . + type: object + properties: + effect: + description: Effect indicates the taint effect to match. Empty means match all taint effects. When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: Key is the taint key that the toleration applies to. Empty means match all taint keys. If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: Operator represents a key's relationship to the value. Valid operators are Exists and Equal. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: TolerationSeconds represents the period of time the toleration (which must be of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system. + type: integer + format: int64 + value: + description: Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + serviceType: + description: Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort. + type: string + selector: + description: Selector selects a set of DNSNames on the Certificate resource that should be solved using this challenge solver. If not specified, the solver will be treated as the 'default' solver with the lowest priority, i.e. if any other solver has a more specific match, it will be used instead. + type: object + properties: + dnsNames: + description: List of DNSNames that this solver will be used to solve. If specified and a match is found, a dnsNames selector will take precedence over a dnsZones selector. If multiple solvers match with the same dnsNames value, the solver with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected. + type: array + items: + type: string + dnsZones: + description: List of DNSZones that this solver will be used to solve. The most specific DNS zone match specified here will take precedence over other DNS zone matches, so a solver specifying sys.example.com will be selected over one specifying example.com for the domain www.sys.example.com. If multiple solvers match with the same dnsZones value, the solver with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected. + type: array + items: + type: string + matchLabels: + description: A label selector that is used to refine the set of certificate's that this challenge solver will apply to. + type: object + additionalProperties: + type: string + ca: + description: CA configures this issuer to sign certificates using a signing CA keypair stored in a Secret resource. This is used to build internal PKIs that are managed by cert-manager. + type: object + required: + - secretName + properties: + crlDistributionPoints: + description: The CRL distribution points is an X.509 v3 certificate extension which identifies the location of the CRL from which the revocation of this certificate can be checked. If not set, certificates will be issued without distribution points set. + type: array + items: + type: string + ocspServers: + description: The OCSP server list is an X.509 v3 extension that defines a list of URLs of OCSP responders. The OCSP responders can be queried for the revocation status of an issued certificate. If not set, the certificate will be issued with no OCSP servers set. For example, an OCSP server URL could be "http://ocsp.int-x3.letsencrypt.org". + type: array + items: + type: string + secretName: + description: SecretName is the name of the secret used to sign Certificates issued by this Issuer. + type: string + selfSigned: + description: SelfSigned configures this issuer to 'self sign' certificates using the private key used to create the CertificateRequest object. + type: object + properties: + crlDistributionPoints: + description: The CRL distribution points is an X.509 v3 certificate extension which identifies the location of the CRL from which the revocation of this certificate can be checked. If not set certificate will be issued without CDP. Values are strings. + type: array + items: + type: string + vault: + description: Vault configures this issuer to sign certificates using a HashiCorp Vault PKI backend. + type: object + required: + - auth + - path + - server + properties: + auth: + description: Auth configures how cert-manager authenticates with the Vault server. + type: object + properties: + appRole: + description: AppRole authenticates with Vault using the App Role auth mechanism, with the role and secret stored in a Kubernetes Secret resource. + type: object + required: + - path + - roleId + - secretRef + properties: + path: + description: 'Path where the App Role authentication backend is mounted in Vault, e.g: "approle"' + type: string + roleId: + description: RoleID configured in the App Role authentication backend when setting up the authentication backend in Vault. + type: string + secretRef: + description: Reference to a key in a Secret that contains the App Role secret used to authenticate with Vault. The `key` field must be specified and denotes which entry within the Secret resource is used as the app role secret. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + kubernetes: + description: Kubernetes authenticates with Vault by passing the ServiceAccount token stored in the named Secret resource to the Vault server. + type: object + required: + - role + - secretRef + properties: + mountPath: + description: The Vault mountPath here is the mount path to use when authenticating with Vault. For example, setting a value to `/v1/auth/foo`, will use the path `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the default value "/v1/auth/kubernetes" will be used. + type: string + role: + description: A required field containing the Vault Role to assume. A Role binds a Kubernetes ServiceAccount with a set of Vault policies. + type: string + secretRef: + description: The required Secret field containing a Kubernetes ServiceAccount JWT used for authenticating with Vault. Use of 'ambient credentials' is not supported. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + tokenSecretRef: + description: TokenSecretRef authenticates with Vault by presenting a token. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + caBundle: + description: PEM-encoded CA bundle (base64-encoded) used to validate Vault server certificate. Only used if the Server URL is using HTTPS protocol. This parameter is ignored for plain HTTP protocol connection. If not set the system root certificates are used to validate the TLS connection. + type: string + format: byte + namespace: + description: 'Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows Vault environments to support Secure Multi-tenancy. e.g: "ns1" More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces' + type: string + path: + description: 'Path is the mount path of the Vault PKI backend''s `sign` endpoint, e.g: "my_pki_mount/sign/my-role-name".' + type: string + server: + description: 'Server is the connection address for the Vault server, e.g: "https://vault.example.com:8200".' + type: string + venafi: + description: Venafi configures this issuer to sign certificates using a Venafi TPP or Venafi Cloud policy zone. + type: object + required: + - zone + properties: + cloud: + description: Cloud specifies the Venafi cloud configuration settings. Only one of TPP or Cloud may be specified. + type: object + required: + - apiTokenSecretRef + properties: + apiTokenSecretRef: + description: APITokenSecretRef is a secret key selector for the Venafi Cloud API token. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + url: + description: URL is the base URL for Venafi Cloud. Defaults to "https://api.venafi.cloud/v1". + type: string + tpp: + description: TPP specifies Trust Protection Platform configuration settings. Only one of TPP or Cloud may be specified. + type: object + required: + - credentialsRef + - url + properties: + caBundle: + description: CABundle is a PEM encoded TLS certificate to use to verify connections to the TPP instance. If specified, system roots will not be used and the issuing CA for the TPP instance must be verifiable using the provided root. If not specified, the connection will be verified using the cert-manager system root certificates. + type: string + format: byte + credentialsRef: + description: CredentialsRef is a reference to a Secret containing the username and password for the TPP server. The secret must contain two keys, 'username' and 'password'. + type: object + required: + - name + properties: + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + url: + description: 'URL is the base URL for the vedsdk endpoint of the Venafi TPP instance, for example: "https://tpp.example.com/vedsdk".' + type: string + zone: + description: Zone is the Venafi Policy Zone to use for this issuer. All requests made to the Venafi platform will be restricted by the named zone policy. This field is required. + type: string + status: + description: Status of the ClusterIssuer. This is set and managed automatically. + type: object + properties: + acme: + description: ACME specific status options. This field should only be set if the Issuer is configured to use an ACME server to issue certificates. + type: object + properties: + lastRegisteredEmail: + description: LastRegisteredEmail is the email associated with the latest registered ACME account, in order to track changes made to registered account associated with the Issuer + type: string + uri: + description: URI is the unique account identifier, which can also be used to retrieve account details from the CA + type: string + conditions: + description: List of status conditions to indicate the status of a CertificateRequest. Known condition types are `Ready`. + type: array + items: + description: IssuerCondition contains condition information for an Issuer. + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: LastTransitionTime is the timestamp corresponding to the last status change of this condition. + type: string + format: date-time + message: + description: Message is a human readable description of the details of the last transition, complementing reason. + type: string + observedGeneration: + description: If set, this represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.condition[x].observedGeneration is 9, the condition is out of date with respect to the current state of the Issuer. + type: integer + format: int64 + reason: + description: Reason is a brief machine readable explanation for the condition's last transition. + type: string + status: + description: Status of the condition, one of (`True`, `False`, `Unknown`). + type: string + enum: + - "True" + - "False" + - Unknown + type: + description: Type of the condition, known values are (`Ready`). + type: string + served: false + storage: false + - name: v1alpha3 + subresources: + status: {} + additionalPrinterColumns: + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + priority: 1 + type: string + - jsonPath: .metadata.creationTimestamp + description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + name: Age + type: date + schema: + openAPIV3Schema: + description: A ClusterIssuer represents a certificate issuing authority which can be referenced as part of `issuerRef` fields. It is similar to an Issuer, however it is cluster-scoped and therefore can be referenced by resources that exist in *any* namespace, not just the same namespace as the referent. + type: object + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: Desired state of the ClusterIssuer resource. + type: object + properties: + acme: + description: ACME configures this issuer to communicate with a RFC8555 (ACME) server to obtain signed x509 certificates. + type: object + required: + - privateKeySecretRef + - server + properties: + disableAccountKeyGeneration: + description: Enables or disables generating a new ACME account key. If true, the Issuer resource will *not* request a new account but will expect the account key to be supplied via an existing secret. If false, the cert-manager system will generate a new ACME account key for the Issuer. Defaults to false. + type: boolean + email: + description: Email is the email address to be associated with the ACME account. This field is optional, but it is strongly recommended to be set. It will be used to contact you in case of issues with your account or certificates, including expiry notification emails. This field may be updated after the account is initially registered. + type: string + enableDurationFeature: + description: Enables requesting a Not After date on certificates that matches the duration of the certificate. This is not supported by all ACME servers like Let's Encrypt. If set to true when the ACME server does not support it it will create an error on the Order. Defaults to false. + type: boolean + externalAccountBinding: + description: ExternalAccountBinding is a reference to a CA external account of the ACME server. If set, upon registration cert-manager will attempt to associate the given external account credentials with the registered ACME account. + type: object + required: + - keyID + - keySecretRef + properties: + keyAlgorithm: + description: 'Deprecated: keyAlgorithm field exists for historical compatibility reasons and should not be used. The algorithm is now hardcoded to HS256 in golang/x/crypto/acme.' + type: string + enum: + - HS256 + - HS384 + - HS512 + keyID: + description: keyID is the ID of the CA key that the External Account is bound to. + type: string + keySecretRef: + description: keySecretRef is a Secret Key Selector referencing a data item in a Kubernetes Secret which holds the symmetric MAC key of the External Account Binding. The `key` is the index string that is paired with the key data in the Secret and should not be confused with the key data itself, or indeed with the External Account Binding keyID above. The secret key stored in the Secret **must** be un-padded, base64 URL encoded data. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + preferredChain: + description: 'PreferredChain is the chain to use if the ACME server outputs multiple. PreferredChain is no guarantee that this one gets delivered by the ACME endpoint. For example, for Let''s Encrypt''s DST crosssign you would use: "DST Root CA X3" or "ISRG Root X1" for the newer Let''s Encrypt root CA. This value picks the first certificate bundle in the ACME alternative chains that has a certificate with this value as its issuer''s CN' + type: string + maxLength: 64 + privateKeySecretRef: + description: PrivateKey is the name of a Kubernetes Secret resource that will be used to store the automatically generated ACME account private key. Optionally, a `key` may be specified to select a specific entry within the named Secret resource. If `key` is not specified, a default of `tls.key` will be used. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + server: + description: 'Server is the URL used to access the ACME server''s ''directory'' endpoint. For example, for Let''s Encrypt''s staging endpoint, you would use: "https://acme-staging-v02.api.letsencrypt.org/directory". Only ACME v2 endpoints (i.e. RFC 8555) are supported.' + type: string + skipTLSVerify: + description: Enables or disables validation of the ACME server TLS certificate. If true, requests to the ACME server will not have their TLS certificate validated (i.e. insecure connections will be allowed). Only enable this option in development environments. The cert-manager system installed roots will be used to verify connections to the ACME server if this is false. Defaults to false. + type: boolean + solvers: + description: 'Solvers is a list of challenge solvers that will be used to solve ACME challenges for the matching domains. Solver configurations must be provided in order to obtain certificates from an ACME server. For more information, see: https://cert-manager.io/docs/configuration/acme/' + type: array + items: + description: Configures an issuer to solve challenges using the specified options. Only one of HTTP01 or DNS01 may be provided. + type: object + properties: + dns01: + description: Configures cert-manager to attempt to complete authorizations by performing the DNS01 challenge flow. + type: object + properties: + acmedns: + description: Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage DNS01 challenge records. + type: object + required: + - accountSecretRef + - host + properties: + accountSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + host: + type: string + akamai: + description: Use the Akamai DNS zone management API to manage DNS01 challenge records. + type: object + required: + - accessTokenSecretRef + - clientSecretSecretRef + - clientTokenSecretRef + - serviceConsumerDomain + properties: + accessTokenSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + clientSecretSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + clientTokenSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + serviceConsumerDomain: + type: string + azuredns: + description: Use the Microsoft Azure DNS API to manage DNS01 challenge records. + type: object + required: + - resourceGroupName + - subscriptionID + properties: + clientID: + description: if both this and ClientSecret are left unset MSI will be used + type: string + clientSecretSecretRef: + description: if both this and ClientID are left unset MSI will be used + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + environment: + description: name of the Azure environment (default AzurePublicCloud) + type: string + enum: + - AzurePublicCloud + - AzureChinaCloud + - AzureGermanCloud + - AzureUSGovernmentCloud + hostedZoneName: + description: name of the DNS zone that should be used + type: string + managedIdentity: + description: managed identity configuration, can not be used at the same time as clientID, clientSecretSecretRef or tenantID + type: object + properties: + clientID: + description: client ID of the managed identity, can not be used at the same time as resourceID + type: string + resourceID: + description: resource ID of the managed identity, can not be used at the same time as clientID + type: string + resourceGroupName: + description: resource group the DNS zone is located in + type: string + subscriptionID: + description: ID of the Azure subscription + type: string + tenantID: + description: when specifying ClientID and ClientSecret then this field is also needed + type: string + clouddns: + description: Use the Google Cloud DNS API to manage DNS01 challenge records. + type: object + required: + - project + properties: + hostedZoneName: + description: HostedZoneName is an optional field that tells cert-manager in which Cloud DNS zone the challenge record has to be created. If left empty cert-manager will automatically choose a zone. + type: string + project: + type: string + serviceAccountSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + cloudflare: + description: Use the Cloudflare API to manage DNS01 challenge records. + type: object + properties: + apiKeySecretRef: + description: 'API key to use to authenticate with Cloudflare. Note: using an API token to authenticate is now the recommended method as it allows greater control of permissions.' + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + apiTokenSecretRef: + description: API token used to authenticate with Cloudflare. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + email: + description: Email of the account, only required when using API key based authentication. + type: string + cnameStrategy: + description: CNAMEStrategy configures how the DNS01 provider should handle CNAME records when found in DNS zones. + type: string + enum: + - None + - Follow + digitalocean: + description: Use the DigitalOcean DNS API to manage DNS01 challenge records. + type: object + required: + - tokenSecretRef + properties: + tokenSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + rfc2136: + description: Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/) to manage DNS01 challenge records. + type: object + required: + - nameserver + properties: + nameserver: + description: The IP address or hostname of an authoritative DNS server supporting RFC2136 in the form host:port. If the host is an IPv6 address it must be enclosed in square brackets (e.g [2001:db8::1]) ; port is optional. This field is required. + type: string + tsigAlgorithm: + description: 'The TSIG Algorithm configured in the DNS supporting RFC2136. Used only when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined. Supported values are (case-insensitive): ``HMACMD5`` (default), ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``.' + type: string + tsigKeyName: + description: The TSIG Key name configured in the DNS. If ``tsigSecretSecretRef`` is defined, this field is required. + type: string + tsigSecretSecretRef: + description: The name of the secret containing the TSIG value. If ``tsigKeyName`` is defined, this field is required. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + route53: + description: Use the AWS Route53 API to manage DNS01 challenge records. + type: object + required: + - region + properties: + accessKeyID: + description: 'The AccessKeyID is used for authentication. If not set we fall-back to using env vars, shared credentials file or AWS Instance metadata see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials' + type: string + hostedZoneID: + description: If set, the provider will manage only this zone in Route53 and will not do an lookup using the route53:ListHostedZonesByName api call. + type: string + region: + description: Always set the region when using AccessKeyID and SecretAccessKey + type: string + role: + description: Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata + type: string + secretAccessKeySecretRef: + description: The SecretAccessKey is used for authentication. If not set we fall-back to using env vars, shared credentials file or AWS Instance metadata https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + webhook: + description: Configure an external webhook based DNS01 challenge solver to manage DNS01 challenge records. + type: object + required: + - groupName + - solverName + properties: + config: + description: Additional configuration that should be passed to the webhook apiserver when challenges are processed. This can contain arbitrary JSON data. Secret values should not be specified in this stanza. If secret values are needed (e.g. credentials for a DNS service), you should use a SecretKeySelector to reference a Secret resource. For details on the schema of this field, consult the webhook provider implementation's documentation. + x-kubernetes-preserve-unknown-fields: true + groupName: + description: The API group name that should be used when POSTing ChallengePayload resources to the webhook apiserver. This should be the same as the GroupName specified in the webhook provider implementation. + type: string + solverName: + description: The name of the solver to use, as defined in the webhook provider implementation. This will typically be the name of the provider, e.g. 'cloudflare'. + type: string + http01: + description: Configures cert-manager to attempt to complete authorizations by performing the HTTP01 challenge flow. It is not possible to obtain certificates for wildcard domain names (e.g. `*.example.com`) using the HTTP01 challenge mechanism. + type: object + properties: + gatewayHTTPRoute: + description: The Gateway API is a sig-network community API that models service networking in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will create HTTPRoutes with the specified labels in the same namespace as the challenge. This solver is experimental, and fields / behaviour may change in the future. + type: object + properties: + labels: + description: The labels that cert-manager will use when creating the temporary HTTPRoute needed for solving the HTTP-01 challenge. These labels must match the label selector of at least one Gateway. + type: object + additionalProperties: + type: string + serviceType: + description: Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort. + type: string + ingress: + description: The ingress based HTTP01 challenge solver will solve challenges by creating or modifying Ingress resources in order to route requests for '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are provisioned by cert-manager for each Challenge to be completed. + type: object + properties: + class: + description: The ingress class to use when creating Ingress resources to solve ACME challenges that use this challenge solver. Only one of 'class' or 'name' may be specified. + type: string + ingressTemplate: + description: Optional ingress template used to configure the ACME challenge solver ingress used for HTTP01 challenges + type: object + properties: + metadata: + description: ObjectMeta overrides for the ingress used to solve HTTP01 challenges. Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. + type: object + properties: + annotations: + description: Annotations that should be added to the created ACME HTTP01 solver ingress. + type: object + additionalProperties: + type: string + labels: + description: Labels that should be added to the created ACME HTTP01 solver ingress. + type: object + additionalProperties: + type: string + name: + description: The name of the ingress resource that should have ACME challenge solving routes inserted into it in order to solve HTTP01 challenges. This is typically used in conjunction with ingress controllers like ingress-gce, which maintains a 1:1 mapping between external IPs and ingress resources. + type: string + podTemplate: + description: Optional pod template used to configure the ACME challenge solver pods used for HTTP01 challenges. + type: object + properties: + metadata: + description: ObjectMeta overrides for the pod used to solve HTTP01 challenges. Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. + type: object + properties: + annotations: + description: Annotations that should be added to the create ACME HTTP01 solver pods. + type: object + additionalProperties: + type: string + labels: + description: Labels that should be added to the created ACME HTTP01 solver pods. + type: object + additionalProperties: + type: string + spec: + description: PodSpec defines overrides for the HTTP01 challenge solver pod. Only the 'priorityClassName', 'nodeSelector', 'affinity', 'serviceAccountName' and 'tolerations' fields are supported currently. All other fields will be ignored. + type: object + properties: + affinity: + description: If specified, the pod's scheduling constraints + type: object + properties: + nodeAffinity: + description: Describes node affinity scheduling rules for the pod. + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred. + type: array + items: + description: An empty preferred scheduling term matches all objects with implicit weight 0 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + type: object + required: + - preference + - weight + properties: + preference: + description: A node selector term, associated with the corresponding weight. + type: object + properties: + matchExpressions: + description: A list of node selector requirements by node's labels. + type: array + items: + description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchFields: + description: A list of node selector requirements by node's fields. + type: array + items: + description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array + items: + type: string + weight: + description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. + type: integer + format: int32 + requiredDuringSchedulingIgnoredDuringExecution: + description: If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node. + type: object + required: + - nodeSelectorTerms + properties: + nodeSelectorTerms: + description: Required. A list of node selector terms. The terms are ORed. + type: array + items: + description: A null or empty node selector term matches no objects. The requirements of them are ANDed. The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + type: object + properties: + matchExpressions: + description: A list of node selector requirements by node's labels. + type: array + items: + description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchFields: + description: A list of node selector requirements by node's fields. + type: array + items: + description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array + items: + type: string + podAffinity: + description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. + type: array + items: + description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + type: object + required: + - podAffinityTerm + - weight + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated with the corresponding weight. + type: object + required: + - topologyKey + properties: + labelSelector: + description: A label query over a set of resources, in this case pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaceSelector: + description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. This field is beta-level and is only honored when PodAffinityNamespaceSelector feature is enabled. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaces: + description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace" + type: array + items: + type: string + topologyKey: + description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + type: string + weight: + description: weight associated with matching the corresponding podAffinityTerm, in the range 1-100. + type: integer + format: int32 + requiredDuringSchedulingIgnoredDuringExecution: + description: If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. + type: array + items: + description: Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running + type: object + required: + - topologyKey + properties: + labelSelector: + description: A label query over a set of resources, in this case pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaceSelector: + description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. This field is beta-level and is only honored when PodAffinityNamespaceSelector feature is enabled. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaces: + description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace" + type: array + items: + type: string + topologyKey: + description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + type: string + podAntiAffinity: + description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods to nodes that satisfy the anti-affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. + type: array + items: + description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + type: object + required: + - podAffinityTerm + - weight + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated with the corresponding weight. + type: object + required: + - topologyKey + properties: + labelSelector: + description: A label query over a set of resources, in this case pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaceSelector: + description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. This field is beta-level and is only honored when PodAffinityNamespaceSelector feature is enabled. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaces: + description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace" + type: array + items: + type: string + topologyKey: + description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + type: string + weight: + description: weight associated with matching the corresponding podAffinityTerm, in the range 1-100. + type: integer + format: int32 + requiredDuringSchedulingIgnoredDuringExecution: + description: If the anti-affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the anti-affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. + type: array + items: + description: Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running + type: object + required: + - topologyKey + properties: + labelSelector: + description: A label query over a set of resources, in this case pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaceSelector: + description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. This field is beta-level and is only honored when PodAffinityNamespaceSelector feature is enabled. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaces: + description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace" + type: array + items: + type: string + topologyKey: + description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + type: string + nodeSelector: + description: 'NodeSelector is a selector which must be true for the pod to fit on a node. Selector which must match a node''s labels for the pod to be scheduled on that node. More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/' + type: object + additionalProperties: + type: string + priorityClassName: + description: If specified, the pod's priorityClassName. + type: string + serviceAccountName: + description: If specified, the pod's service account + type: string + tolerations: + description: If specified, the pod's tolerations. + type: array + items: + description: The pod this Toleration is attached to tolerates any taint that matches the triple using the matching operator . + type: object + properties: + effect: + description: Effect indicates the taint effect to match. Empty means match all taint effects. When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: Key is the taint key that the toleration applies to. Empty means match all taint keys. If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: Operator represents a key's relationship to the value. Valid operators are Exists and Equal. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: TolerationSeconds represents the period of time the toleration (which must be of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system. + type: integer + format: int64 + value: + description: Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + serviceType: + description: Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort. + type: string + selector: + description: Selector selects a set of DNSNames on the Certificate resource that should be solved using this challenge solver. If not specified, the solver will be treated as the 'default' solver with the lowest priority, i.e. if any other solver has a more specific match, it will be used instead. + type: object + properties: + dnsNames: + description: List of DNSNames that this solver will be used to solve. If specified and a match is found, a dnsNames selector will take precedence over a dnsZones selector. If multiple solvers match with the same dnsNames value, the solver with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected. + type: array + items: + type: string + dnsZones: + description: List of DNSZones that this solver will be used to solve. The most specific DNS zone match specified here will take precedence over other DNS zone matches, so a solver specifying sys.example.com will be selected over one specifying example.com for the domain www.sys.example.com. If multiple solvers match with the same dnsZones value, the solver with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected. + type: array + items: + type: string + matchLabels: + description: A label selector that is used to refine the set of certificate's that this challenge solver will apply to. + type: object + additionalProperties: + type: string + ca: + description: CA configures this issuer to sign certificates using a signing CA keypair stored in a Secret resource. This is used to build internal PKIs that are managed by cert-manager. + type: object + required: + - secretName + properties: + crlDistributionPoints: + description: The CRL distribution points is an X.509 v3 certificate extension which identifies the location of the CRL from which the revocation of this certificate can be checked. If not set, certificates will be issued without distribution points set. + type: array + items: + type: string + ocspServers: + description: The OCSP server list is an X.509 v3 extension that defines a list of URLs of OCSP responders. The OCSP responders can be queried for the revocation status of an issued certificate. If not set, the certificate will be issued with no OCSP servers set. For example, an OCSP server URL could be "http://ocsp.int-x3.letsencrypt.org". + type: array + items: + type: string + secretName: + description: SecretName is the name of the secret used to sign Certificates issued by this Issuer. + type: string + selfSigned: + description: SelfSigned configures this issuer to 'self sign' certificates using the private key used to create the CertificateRequest object. + type: object + properties: + crlDistributionPoints: + description: The CRL distribution points is an X.509 v3 certificate extension which identifies the location of the CRL from which the revocation of this certificate can be checked. If not set certificate will be issued without CDP. Values are strings. + type: array + items: + type: string + vault: + description: Vault configures this issuer to sign certificates using a HashiCorp Vault PKI backend. + type: object + required: + - auth + - path + - server + properties: + auth: + description: Auth configures how cert-manager authenticates with the Vault server. + type: object + properties: + appRole: + description: AppRole authenticates with Vault using the App Role auth mechanism, with the role and secret stored in a Kubernetes Secret resource. + type: object + required: + - path + - roleId + - secretRef + properties: + path: + description: 'Path where the App Role authentication backend is mounted in Vault, e.g: "approle"' + type: string + roleId: + description: RoleID configured in the App Role authentication backend when setting up the authentication backend in Vault. + type: string + secretRef: + description: Reference to a key in a Secret that contains the App Role secret used to authenticate with Vault. The `key` field must be specified and denotes which entry within the Secret resource is used as the app role secret. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + kubernetes: + description: Kubernetes authenticates with Vault by passing the ServiceAccount token stored in the named Secret resource to the Vault server. + type: object + required: + - role + - secretRef + properties: + mountPath: + description: The Vault mountPath here is the mount path to use when authenticating with Vault. For example, setting a value to `/v1/auth/foo`, will use the path `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the default value "/v1/auth/kubernetes" will be used. + type: string + role: + description: A required field containing the Vault Role to assume. A Role binds a Kubernetes ServiceAccount with a set of Vault policies. + type: string + secretRef: + description: The required Secret field containing a Kubernetes ServiceAccount JWT used for authenticating with Vault. Use of 'ambient credentials' is not supported. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + tokenSecretRef: + description: TokenSecretRef authenticates with Vault by presenting a token. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + caBundle: + description: PEM-encoded CA bundle (base64-encoded) used to validate Vault server certificate. Only used if the Server URL is using HTTPS protocol. This parameter is ignored for plain HTTP protocol connection. If not set the system root certificates are used to validate the TLS connection. + type: string + format: byte + namespace: + description: 'Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows Vault environments to support Secure Multi-tenancy. e.g: "ns1" More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces' + type: string + path: + description: 'Path is the mount path of the Vault PKI backend''s `sign` endpoint, e.g: "my_pki_mount/sign/my-role-name".' + type: string + server: + description: 'Server is the connection address for the Vault server, e.g: "https://vault.example.com:8200".' + type: string + venafi: + description: Venafi configures this issuer to sign certificates using a Venafi TPP or Venafi Cloud policy zone. + type: object + required: + - zone + properties: + cloud: + description: Cloud specifies the Venafi cloud configuration settings. Only one of TPP or Cloud may be specified. + type: object + required: + - apiTokenSecretRef + properties: + apiTokenSecretRef: + description: APITokenSecretRef is a secret key selector for the Venafi Cloud API token. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + url: + description: URL is the base URL for Venafi Cloud. Defaults to "https://api.venafi.cloud/v1". + type: string + tpp: + description: TPP specifies Trust Protection Platform configuration settings. Only one of TPP or Cloud may be specified. + type: object + required: + - credentialsRef + - url + properties: + caBundle: + description: CABundle is a PEM encoded TLS certificate to use to verify connections to the TPP instance. If specified, system roots will not be used and the issuing CA for the TPP instance must be verifiable using the provided root. If not specified, the connection will be verified using the cert-manager system root certificates. + type: string + format: byte + credentialsRef: + description: CredentialsRef is a reference to a Secret containing the username and password for the TPP server. The secret must contain two keys, 'username' and 'password'. + type: object + required: + - name + properties: + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + url: + description: 'URL is the base URL for the vedsdk endpoint of the Venafi TPP instance, for example: "https://tpp.example.com/vedsdk".' + type: string + zone: + description: Zone is the Venafi Policy Zone to use for this issuer. All requests made to the Venafi platform will be restricted by the named zone policy. This field is required. + type: string + status: + description: Status of the ClusterIssuer. This is set and managed automatically. + type: object + properties: + acme: + description: ACME specific status options. This field should only be set if the Issuer is configured to use an ACME server to issue certificates. + type: object + properties: + lastRegisteredEmail: + description: LastRegisteredEmail is the email associated with the latest registered ACME account, in order to track changes made to registered account associated with the Issuer + type: string + uri: + description: URI is the unique account identifier, which can also be used to retrieve account details from the CA + type: string + conditions: + description: List of status conditions to indicate the status of a CertificateRequest. Known condition types are `Ready`. + type: array + items: + description: IssuerCondition contains condition information for an Issuer. + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: LastTransitionTime is the timestamp corresponding to the last status change of this condition. + type: string + format: date-time + message: + description: Message is a human readable description of the details of the last transition, complementing reason. + type: string + observedGeneration: + description: If set, this represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.condition[x].observedGeneration is 9, the condition is out of date with respect to the current state of the Issuer. + type: integer + format: int64 + reason: + description: Reason is a brief machine readable explanation for the condition's last transition. + type: string + status: + description: Status of the condition, one of (`True`, `False`, `Unknown`). + type: string + enum: + - "True" + - "False" + - Unknown + type: + description: Type of the condition, known values are (`Ready`). + type: string + served: false + storage: false + - name: v1beta1 + subresources: + status: {} + additionalPrinterColumns: + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + priority: 1 + type: string + - jsonPath: .metadata.creationTimestamp + description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + name: Age + type: date + schema: + openAPIV3Schema: + description: A ClusterIssuer represents a certificate issuing authority which can be referenced as part of `issuerRef` fields. It is similar to an Issuer, however it is cluster-scoped and therefore can be referenced by resources that exist in *any* namespace, not just the same namespace as the referent. + type: object + required: + - spec + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: Desired state of the ClusterIssuer resource. + type: object + properties: + acme: + description: ACME configures this issuer to communicate with a RFC8555 (ACME) server to obtain signed x509 certificates. + type: object + required: + - privateKeySecretRef + - server + properties: + disableAccountKeyGeneration: + description: Enables or disables generating a new ACME account key. If true, the Issuer resource will *not* request a new account but will expect the account key to be supplied via an existing secret. If false, the cert-manager system will generate a new ACME account key for the Issuer. Defaults to false. + type: boolean + email: + description: Email is the email address to be associated with the ACME account. This field is optional, but it is strongly recommended to be set. It will be used to contact you in case of issues with your account or certificates, including expiry notification emails. This field may be updated after the account is initially registered. + type: string + enableDurationFeature: + description: Enables requesting a Not After date on certificates that matches the duration of the certificate. This is not supported by all ACME servers like Let's Encrypt. If set to true when the ACME server does not support it it will create an error on the Order. Defaults to false. + type: boolean + externalAccountBinding: + description: ExternalAccountBinding is a reference to a CA external account of the ACME server. If set, upon registration cert-manager will attempt to associate the given external account credentials with the registered ACME account. + type: object + required: + - keyID + - keySecretRef + properties: + keyAlgorithm: + description: 'Deprecated: keyAlgorithm field exists for historical compatibility reasons and should not be used. The algorithm is now hardcoded to HS256 in golang/x/crypto/acme.' + type: string + enum: + - HS256 + - HS384 + - HS512 + keyID: + description: keyID is the ID of the CA key that the External Account is bound to. + type: string + keySecretRef: + description: keySecretRef is a Secret Key Selector referencing a data item in a Kubernetes Secret which holds the symmetric MAC key of the External Account Binding. The `key` is the index string that is paired with the key data in the Secret and should not be confused with the key data itself, or indeed with the External Account Binding keyID above. The secret key stored in the Secret **must** be un-padded, base64 URL encoded data. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + preferredChain: + description: 'PreferredChain is the chain to use if the ACME server outputs multiple. PreferredChain is no guarantee that this one gets delivered by the ACME endpoint. For example, for Let''s Encrypt''s DST crosssign you would use: "DST Root CA X3" or "ISRG Root X1" for the newer Let''s Encrypt root CA. This value picks the first certificate bundle in the ACME alternative chains that has a certificate with this value as its issuer''s CN' + type: string + maxLength: 64 + privateKeySecretRef: + description: PrivateKey is the name of a Kubernetes Secret resource that will be used to store the automatically generated ACME account private key. Optionally, a `key` may be specified to select a specific entry within the named Secret resource. If `key` is not specified, a default of `tls.key` will be used. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + server: + description: 'Server is the URL used to access the ACME server''s ''directory'' endpoint. For example, for Let''s Encrypt''s staging endpoint, you would use: "https://acme-staging-v02.api.letsencrypt.org/directory". Only ACME v2 endpoints (i.e. RFC 8555) are supported.' + type: string + skipTLSVerify: + description: Enables or disables validation of the ACME server TLS certificate. If true, requests to the ACME server will not have their TLS certificate validated (i.e. insecure connections will be allowed). Only enable this option in development environments. The cert-manager system installed roots will be used to verify connections to the ACME server if this is false. Defaults to false. + type: boolean + solvers: + description: 'Solvers is a list of challenge solvers that will be used to solve ACME challenges for the matching domains. Solver configurations must be provided in order to obtain certificates from an ACME server. For more information, see: https://cert-manager.io/docs/configuration/acme/' + type: array + items: + description: Configures an issuer to solve challenges using the specified options. Only one of HTTP01 or DNS01 may be provided. + type: object + properties: + dns01: + description: Configures cert-manager to attempt to complete authorizations by performing the DNS01 challenge flow. + type: object + properties: + acmeDNS: + description: Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage DNS01 challenge records. + type: object + required: + - accountSecretRef + - host + properties: + accountSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + host: + type: string + akamai: + description: Use the Akamai DNS zone management API to manage DNS01 challenge records. + type: object + required: + - accessTokenSecretRef + - clientSecretSecretRef + - clientTokenSecretRef + - serviceConsumerDomain + properties: + accessTokenSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + clientSecretSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + clientTokenSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + serviceConsumerDomain: + type: string + azureDNS: + description: Use the Microsoft Azure DNS API to manage DNS01 challenge records. + type: object + required: + - resourceGroupName + - subscriptionID + properties: + clientID: + description: if both this and ClientSecret are left unset MSI will be used + type: string + clientSecretSecretRef: + description: if both this and ClientID are left unset MSI will be used + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + environment: + description: name of the Azure environment (default AzurePublicCloud) + type: string + enum: + - AzurePublicCloud + - AzureChinaCloud + - AzureGermanCloud + - AzureUSGovernmentCloud + hostedZoneName: + description: name of the DNS zone that should be used + type: string + managedIdentity: + description: managed identity configuration, can not be used at the same time as clientID, clientSecretSecretRef or tenantID + type: object + properties: + clientID: + description: client ID of the managed identity, can not be used at the same time as resourceID + type: string + resourceID: + description: resource ID of the managed identity, can not be used at the same time as clientID + type: string + resourceGroupName: + description: resource group the DNS zone is located in + type: string + subscriptionID: + description: ID of the Azure subscription + type: string + tenantID: + description: when specifying ClientID and ClientSecret then this field is also needed + type: string + cloudDNS: + description: Use the Google Cloud DNS API to manage DNS01 challenge records. + type: object + required: + - project + properties: + hostedZoneName: + description: HostedZoneName is an optional field that tells cert-manager in which Cloud DNS zone the challenge record has to be created. If left empty cert-manager will automatically choose a zone. + type: string + project: + type: string + serviceAccountSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + cloudflare: + description: Use the Cloudflare API to manage DNS01 challenge records. + type: object + properties: + apiKeySecretRef: + description: 'API key to use to authenticate with Cloudflare. Note: using an API token to authenticate is now the recommended method as it allows greater control of permissions.' + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + apiTokenSecretRef: + description: API token used to authenticate with Cloudflare. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + email: + description: Email of the account, only required when using API key based authentication. + type: string + cnameStrategy: + description: CNAMEStrategy configures how the DNS01 provider should handle CNAME records when found in DNS zones. + type: string + enum: + - None + - Follow + digitalocean: + description: Use the DigitalOcean DNS API to manage DNS01 challenge records. + type: object + required: + - tokenSecretRef + properties: + tokenSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + rfc2136: + description: Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/) to manage DNS01 challenge records. + type: object + required: + - nameserver + properties: + nameserver: + description: The IP address or hostname of an authoritative DNS server supporting RFC2136 in the form host:port. If the host is an IPv6 address it must be enclosed in square brackets (e.g [2001:db8::1]) ; port is optional. This field is required. + type: string + tsigAlgorithm: + description: 'The TSIG Algorithm configured in the DNS supporting RFC2136. Used only when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined. Supported values are (case-insensitive): ``HMACMD5`` (default), ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``.' + type: string + tsigKeyName: + description: The TSIG Key name configured in the DNS. If ``tsigSecretSecretRef`` is defined, this field is required. + type: string + tsigSecretSecretRef: + description: The name of the secret containing the TSIG value. If ``tsigKeyName`` is defined, this field is required. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + route53: + description: Use the AWS Route53 API to manage DNS01 challenge records. + type: object + required: + - region + properties: + accessKeyID: + description: 'The AccessKeyID is used for authentication. If not set we fall-back to using env vars, shared credentials file or AWS Instance metadata see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials' + type: string + hostedZoneID: + description: If set, the provider will manage only this zone in Route53 and will not do an lookup using the route53:ListHostedZonesByName api call. + type: string + region: + description: Always set the region when using AccessKeyID and SecretAccessKey + type: string + role: + description: Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata + type: string + secretAccessKeySecretRef: + description: The SecretAccessKey is used for authentication. If not set we fall-back to using env vars, shared credentials file or AWS Instance metadata https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + webhook: + description: Configure an external webhook based DNS01 challenge solver to manage DNS01 challenge records. + type: object + required: + - groupName + - solverName + properties: + config: + description: Additional configuration that should be passed to the webhook apiserver when challenges are processed. This can contain arbitrary JSON data. Secret values should not be specified in this stanza. If secret values are needed (e.g. credentials for a DNS service), you should use a SecretKeySelector to reference a Secret resource. For details on the schema of this field, consult the webhook provider implementation's documentation. + x-kubernetes-preserve-unknown-fields: true + groupName: + description: The API group name that should be used when POSTing ChallengePayload resources to the webhook apiserver. This should be the same as the GroupName specified in the webhook provider implementation. + type: string + solverName: + description: The name of the solver to use, as defined in the webhook provider implementation. This will typically be the name of the provider, e.g. 'cloudflare'. + type: string + http01: + description: Configures cert-manager to attempt to complete authorizations by performing the HTTP01 challenge flow. It is not possible to obtain certificates for wildcard domain names (e.g. `*.example.com`) using the HTTP01 challenge mechanism. + type: object + properties: + gatewayHTTPRoute: + description: The Gateway API is a sig-network community API that models service networking in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will create HTTPRoutes with the specified labels in the same namespace as the challenge. This solver is experimental, and fields / behaviour may change in the future. + type: object + properties: + labels: + description: The labels that cert-manager will use when creating the temporary HTTPRoute needed for solving the HTTP-01 challenge. These labels must match the label selector of at least one Gateway. + type: object + additionalProperties: + type: string + serviceType: + description: Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort. + type: string + ingress: + description: The ingress based HTTP01 challenge solver will solve challenges by creating or modifying Ingress resources in order to route requests for '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are provisioned by cert-manager for each Challenge to be completed. + type: object + properties: + class: + description: The ingress class to use when creating Ingress resources to solve ACME challenges that use this challenge solver. Only one of 'class' or 'name' may be specified. + type: string + ingressTemplate: + description: Optional ingress template used to configure the ACME challenge solver ingress used for HTTP01 challenges. + type: object + properties: + metadata: + description: ObjectMeta overrides for the ingress used to solve HTTP01 challenges. Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. + type: object + properties: + annotations: + description: Annotations that should be added to the created ACME HTTP01 solver ingress. + type: object + additionalProperties: + type: string + labels: + description: Labels that should be added to the created ACME HTTP01 solver ingress. + type: object + additionalProperties: + type: string + name: + description: The name of the ingress resource that should have ACME challenge solving routes inserted into it in order to solve HTTP01 challenges. This is typically used in conjunction with ingress controllers like ingress-gce, which maintains a 1:1 mapping between external IPs and ingress resources. + type: string + podTemplate: + description: Optional pod template used to configure the ACME challenge solver pods used for HTTP01 challenges + type: object + properties: + metadata: + description: ObjectMeta overrides for the pod used to solve HTTP01 challenges. Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. + type: object + properties: + annotations: + description: Annotations that should be added to the create ACME HTTP01 solver pods. + type: object + additionalProperties: + type: string + labels: + description: Labels that should be added to the created ACME HTTP01 solver pods. + type: object + additionalProperties: + type: string + spec: + description: PodSpec defines overrides for the HTTP01 challenge solver pod. Only the 'priorityClassName', 'nodeSelector', 'affinity', 'serviceAccountName' and 'tolerations' fields are supported currently. All other fields will be ignored. + type: object + properties: + affinity: + description: If specified, the pod's scheduling constraints + type: object + properties: + nodeAffinity: + description: Describes node affinity scheduling rules for the pod. + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred. + type: array + items: + description: An empty preferred scheduling term matches all objects with implicit weight 0 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + type: object + required: + - preference + - weight + properties: + preference: + description: A node selector term, associated with the corresponding weight. + type: object + properties: + matchExpressions: + description: A list of node selector requirements by node's labels. + type: array + items: + description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchFields: + description: A list of node selector requirements by node's fields. + type: array + items: + description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array + items: + type: string + weight: + description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. + type: integer + format: int32 + requiredDuringSchedulingIgnoredDuringExecution: + description: If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node. + type: object + required: + - nodeSelectorTerms + properties: + nodeSelectorTerms: + description: Required. A list of node selector terms. The terms are ORed. + type: array + items: + description: A null or empty node selector term matches no objects. The requirements of them are ANDed. The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + type: object + properties: + matchExpressions: + description: A list of node selector requirements by node's labels. + type: array + items: + description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchFields: + description: A list of node selector requirements by node's fields. + type: array + items: + description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array + items: + type: string + podAffinity: + description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. + type: array + items: + description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + type: object + required: + - podAffinityTerm + - weight + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated with the corresponding weight. + type: object + required: + - topologyKey + properties: + labelSelector: + description: A label query over a set of resources, in this case pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaceSelector: + description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. This field is beta-level and is only honored when PodAffinityNamespaceSelector feature is enabled. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaces: + description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace" + type: array + items: + type: string + topologyKey: + description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + type: string + weight: + description: weight associated with matching the corresponding podAffinityTerm, in the range 1-100. + type: integer + format: int32 + requiredDuringSchedulingIgnoredDuringExecution: + description: If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. + type: array + items: + description: Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running + type: object + required: + - topologyKey + properties: + labelSelector: + description: A label query over a set of resources, in this case pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaceSelector: + description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. This field is beta-level and is only honored when PodAffinityNamespaceSelector feature is enabled. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaces: + description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace" + type: array + items: + type: string + topologyKey: + description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + type: string + podAntiAffinity: + description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods to nodes that satisfy the anti-affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. + type: array + items: + description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + type: object + required: + - podAffinityTerm + - weight + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated with the corresponding weight. + type: object + required: + - topologyKey + properties: + labelSelector: + description: A label query over a set of resources, in this case pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaceSelector: + description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. This field is beta-level and is only honored when PodAffinityNamespaceSelector feature is enabled. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaces: + description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace" + type: array + items: + type: string + topologyKey: + description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + type: string + weight: + description: weight associated with matching the corresponding podAffinityTerm, in the range 1-100. + type: integer + format: int32 + requiredDuringSchedulingIgnoredDuringExecution: + description: If the anti-affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the anti-affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. + type: array + items: + description: Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running + type: object + required: + - topologyKey + properties: + labelSelector: + description: A label query over a set of resources, in this case pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaceSelector: + description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. This field is beta-level and is only honored when PodAffinityNamespaceSelector feature is enabled. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaces: + description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace" + type: array + items: + type: string + topologyKey: + description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + type: string + nodeSelector: + description: 'NodeSelector is a selector which must be true for the pod to fit on a node. Selector which must match a node''s labels for the pod to be scheduled on that node. More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/' + type: object + additionalProperties: + type: string + priorityClassName: + description: If specified, the pod's priorityClassName. + type: string + serviceAccountName: + description: If specified, the pod's service account + type: string + tolerations: + description: If specified, the pod's tolerations. + type: array + items: + description: The pod this Toleration is attached to tolerates any taint that matches the triple using the matching operator . + type: object + properties: + effect: + description: Effect indicates the taint effect to match. Empty means match all taint effects. When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: Key is the taint key that the toleration applies to. Empty means match all taint keys. If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: Operator represents a key's relationship to the value. Valid operators are Exists and Equal. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: TolerationSeconds represents the period of time the toleration (which must be of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system. + type: integer + format: int64 + value: + description: Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + serviceType: + description: Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort. + type: string + selector: + description: Selector selects a set of DNSNames on the Certificate resource that should be solved using this challenge solver. If not specified, the solver will be treated as the 'default' solver with the lowest priority, i.e. if any other solver has a more specific match, it will be used instead. + type: object + properties: + dnsNames: + description: List of DNSNames that this solver will be used to solve. If specified and a match is found, a dnsNames selector will take precedence over a dnsZones selector. If multiple solvers match with the same dnsNames value, the solver with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected. + type: array + items: + type: string + dnsZones: + description: List of DNSZones that this solver will be used to solve. The most specific DNS zone match specified here will take precedence over other DNS zone matches, so a solver specifying sys.example.com will be selected over one specifying example.com for the domain www.sys.example.com. If multiple solvers match with the same dnsZones value, the solver with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected. + type: array + items: + type: string + matchLabels: + description: A label selector that is used to refine the set of certificate's that this challenge solver will apply to. + type: object + additionalProperties: + type: string + ca: + description: CA configures this issuer to sign certificates using a signing CA keypair stored in a Secret resource. This is used to build internal PKIs that are managed by cert-manager. + type: object + required: + - secretName + properties: + crlDistributionPoints: + description: The CRL distribution points is an X.509 v3 certificate extension which identifies the location of the CRL from which the revocation of this certificate can be checked. If not set, certificates will be issued without distribution points set. + type: array + items: + type: string + ocspServers: + description: The OCSP server list is an X.509 v3 extension that defines a list of URLs of OCSP responders. The OCSP responders can be queried for the revocation status of an issued certificate. If not set, the certificate will be issued with no OCSP servers set. For example, an OCSP server URL could be "http://ocsp.int-x3.letsencrypt.org". + type: array + items: + type: string + secretName: + description: SecretName is the name of the secret used to sign Certificates issued by this Issuer. + type: string + selfSigned: + description: SelfSigned configures this issuer to 'self sign' certificates using the private key used to create the CertificateRequest object. + type: object + properties: + crlDistributionPoints: + description: The CRL distribution points is an X.509 v3 certificate extension which identifies the location of the CRL from which the revocation of this certificate can be checked. If not set certificate will be issued without CDP. Values are strings. + type: array + items: + type: string + vault: + description: Vault configures this issuer to sign certificates using a HashiCorp Vault PKI backend. + type: object + required: + - auth + - path + - server + properties: + auth: + description: Auth configures how cert-manager authenticates with the Vault server. + type: object + properties: + appRole: + description: AppRole authenticates with Vault using the App Role auth mechanism, with the role and secret stored in a Kubernetes Secret resource. + type: object + required: + - path + - roleId + - secretRef + properties: + path: + description: 'Path where the App Role authentication backend is mounted in Vault, e.g: "approle"' + type: string + roleId: + description: RoleID configured in the App Role authentication backend when setting up the authentication backend in Vault. + type: string + secretRef: + description: Reference to a key in a Secret that contains the App Role secret used to authenticate with Vault. The `key` field must be specified and denotes which entry within the Secret resource is used as the app role secret. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + kubernetes: + description: Kubernetes authenticates with Vault by passing the ServiceAccount token stored in the named Secret resource to the Vault server. + type: object + required: + - role + - secretRef + properties: + mountPath: + description: The Vault mountPath here is the mount path to use when authenticating with Vault. For example, setting a value to `/v1/auth/foo`, will use the path `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the default value "/v1/auth/kubernetes" will be used. + type: string + role: + description: A required field containing the Vault Role to assume. A Role binds a Kubernetes ServiceAccount with a set of Vault policies. + type: string + secretRef: + description: The required Secret field containing a Kubernetes ServiceAccount JWT used for authenticating with Vault. Use of 'ambient credentials' is not supported. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + tokenSecretRef: + description: TokenSecretRef authenticates with Vault by presenting a token. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + caBundle: + description: PEM-encoded CA bundle (base64-encoded) used to validate Vault server certificate. Only used if the Server URL is using HTTPS protocol. This parameter is ignored for plain HTTP protocol connection. If not set the system root certificates are used to validate the TLS connection. + type: string + format: byte + namespace: + description: 'Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows Vault environments to support Secure Multi-tenancy. e.g: "ns1" More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces' + type: string + path: + description: 'Path is the mount path of the Vault PKI backend''s `sign` endpoint, e.g: "my_pki_mount/sign/my-role-name".' + type: string + server: + description: 'Server is the connection address for the Vault server, e.g: "https://vault.example.com:8200".' + type: string + venafi: + description: Venafi configures this issuer to sign certificates using a Venafi TPP or Venafi Cloud policy zone. + type: object + required: + - zone + properties: + cloud: + description: Cloud specifies the Venafi cloud configuration settings. Only one of TPP or Cloud may be specified. + type: object + required: + - apiTokenSecretRef + properties: + apiTokenSecretRef: + description: APITokenSecretRef is a secret key selector for the Venafi Cloud API token. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + url: + description: URL is the base URL for Venafi Cloud. Defaults to "https://api.venafi.cloud/v1". + type: string + tpp: + description: TPP specifies Trust Protection Platform configuration settings. Only one of TPP or Cloud may be specified. + type: object + required: + - credentialsRef + - url + properties: + caBundle: + description: CABundle is a PEM encoded TLS certificate to use to verify connections to the TPP instance. If specified, system roots will not be used and the issuing CA for the TPP instance must be verifiable using the provided root. If not specified, the connection will be verified using the cert-manager system root certificates. + type: string + format: byte + credentialsRef: + description: CredentialsRef is a reference to a Secret containing the username and password for the TPP server. The secret must contain two keys, 'username' and 'password'. + type: object + required: + - name + properties: + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + url: + description: 'URL is the base URL for the vedsdk endpoint of the Venafi TPP instance, for example: "https://tpp.example.com/vedsdk".' + type: string + zone: + description: Zone is the Venafi Policy Zone to use for this issuer. All requests made to the Venafi platform will be restricted by the named zone policy. This field is required. + type: string + status: + description: Status of the ClusterIssuer. This is set and managed automatically. + type: object + properties: + acme: + description: ACME specific status options. This field should only be set if the Issuer is configured to use an ACME server to issue certificates. + type: object + properties: + lastRegisteredEmail: + description: LastRegisteredEmail is the email associated with the latest registered ACME account, in order to track changes made to registered account associated with the Issuer + type: string + uri: + description: URI is the unique account identifier, which can also be used to retrieve account details from the CA + type: string + conditions: + description: List of status conditions to indicate the status of a CertificateRequest. Known condition types are `Ready`. + type: array + items: + description: IssuerCondition contains condition information for an Issuer. + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: LastTransitionTime is the timestamp corresponding to the last status change of this condition. + type: string + format: date-time + message: + description: Message is a human readable description of the details of the last transition, complementing reason. + type: string + observedGeneration: + description: If set, this represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.condition[x].observedGeneration is 9, the condition is out of date with respect to the current state of the Issuer. + type: integer + format: int64 + reason: + description: Reason is a brief machine readable explanation for the condition's last transition. + type: string + status: + description: Status of the condition, one of (`True`, `False`, `Unknown`). + type: string + enum: + - "True" + - "False" + - Unknown + type: + description: Type of the condition, known values are (`Ready`). + type: string + served: false + storage: false + - name: v1 + subresources: + status: {} + additionalPrinterColumns: + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + priority: 1 + type: string + - jsonPath: .metadata.creationTimestamp + description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + name: Age + type: date + schema: + openAPIV3Schema: + description: A ClusterIssuer represents a certificate issuing authority which can be referenced as part of `issuerRef` fields. It is similar to an Issuer, however it is cluster-scoped and therefore can be referenced by resources that exist in *any* namespace, not just the same namespace as the referent. + type: object + required: + - spec + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: Desired state of the ClusterIssuer resource. + type: object + properties: + acme: + description: ACME configures this issuer to communicate with a RFC8555 (ACME) server to obtain signed x509 certificates. + type: object + required: + - privateKeySecretRef + - server + properties: + disableAccountKeyGeneration: + description: Enables or disables generating a new ACME account key. If true, the Issuer resource will *not* request a new account but will expect the account key to be supplied via an existing secret. If false, the cert-manager system will generate a new ACME account key for the Issuer. Defaults to false. + type: boolean + email: + description: Email is the email address to be associated with the ACME account. This field is optional, but it is strongly recommended to be set. It will be used to contact you in case of issues with your account or certificates, including expiry notification emails. This field may be updated after the account is initially registered. + type: string + enableDurationFeature: + description: Enables requesting a Not After date on certificates that matches the duration of the certificate. This is not supported by all ACME servers like Let's Encrypt. If set to true when the ACME server does not support it it will create an error on the Order. Defaults to false. + type: boolean + externalAccountBinding: + description: ExternalAccountBinding is a reference to a CA external account of the ACME server. If set, upon registration cert-manager will attempt to associate the given external account credentials with the registered ACME account. + type: object + required: + - keyID + - keySecretRef + properties: + keyAlgorithm: + description: 'Deprecated: keyAlgorithm field exists for historical compatibility reasons and should not be used. The algorithm is now hardcoded to HS256 in golang/x/crypto/acme.' + type: string + enum: + - HS256 + - HS384 + - HS512 + keyID: + description: keyID is the ID of the CA key that the External Account is bound to. + type: string + keySecretRef: + description: keySecretRef is a Secret Key Selector referencing a data item in a Kubernetes Secret which holds the symmetric MAC key of the External Account Binding. The `key` is the index string that is paired with the key data in the Secret and should not be confused with the key data itself, or indeed with the External Account Binding keyID above. The secret key stored in the Secret **must** be un-padded, base64 URL encoded data. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + preferredChain: + description: 'PreferredChain is the chain to use if the ACME server outputs multiple. PreferredChain is no guarantee that this one gets delivered by the ACME endpoint. For example, for Let''s Encrypt''s DST crosssign you would use: "DST Root CA X3" or "ISRG Root X1" for the newer Let''s Encrypt root CA. This value picks the first certificate bundle in the ACME alternative chains that has a certificate with this value as its issuer''s CN' + type: string + maxLength: 64 + privateKeySecretRef: + description: PrivateKey is the name of a Kubernetes Secret resource that will be used to store the automatically generated ACME account private key. Optionally, a `key` may be specified to select a specific entry within the named Secret resource. If `key` is not specified, a default of `tls.key` will be used. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + server: + description: 'Server is the URL used to access the ACME server''s ''directory'' endpoint. For example, for Let''s Encrypt''s staging endpoint, you would use: "https://acme-staging-v02.api.letsencrypt.org/directory". Only ACME v2 endpoints (i.e. RFC 8555) are supported.' + type: string + skipTLSVerify: + description: Enables or disables validation of the ACME server TLS certificate. If true, requests to the ACME server will not have their TLS certificate validated (i.e. insecure connections will be allowed). Only enable this option in development environments. The cert-manager system installed roots will be used to verify connections to the ACME server if this is false. Defaults to false. + type: boolean + solvers: + description: 'Solvers is a list of challenge solvers that will be used to solve ACME challenges for the matching domains. Solver configurations must be provided in order to obtain certificates from an ACME server. For more information, see: https://cert-manager.io/docs/configuration/acme/' + type: array + items: + description: An ACMEChallengeSolver describes how to solve ACME challenges for the issuer it is part of. A selector may be provided to use different solving strategies for different DNS names. Only one of HTTP01 or DNS01 must be provided. + type: object + properties: + dns01: + description: Configures cert-manager to attempt to complete authorizations by performing the DNS01 challenge flow. + type: object + properties: + acmeDNS: + description: Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage DNS01 challenge records. + type: object + required: + - accountSecretRef + - host + properties: + accountSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + host: + type: string + akamai: + description: Use the Akamai DNS zone management API to manage DNS01 challenge records. + type: object + required: + - accessTokenSecretRef + - clientSecretSecretRef + - clientTokenSecretRef + - serviceConsumerDomain + properties: + accessTokenSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + clientSecretSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + clientTokenSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + serviceConsumerDomain: + type: string + azureDNS: + description: Use the Microsoft Azure DNS API to manage DNS01 challenge records. + type: object + required: + - resourceGroupName + - subscriptionID + properties: + clientID: + description: if both this and ClientSecret are left unset MSI will be used + type: string + clientSecretSecretRef: + description: if both this and ClientID are left unset MSI will be used + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + environment: + description: name of the Azure environment (default AzurePublicCloud) + type: string + enum: + - AzurePublicCloud + - AzureChinaCloud + - AzureGermanCloud + - AzureUSGovernmentCloud + hostedZoneName: + description: name of the DNS zone that should be used + type: string + managedIdentity: + description: managed identity configuration, can not be used at the same time as clientID, clientSecretSecretRef or tenantID + type: object + properties: + clientID: + description: client ID of the managed identity, can not be used at the same time as resourceID + type: string + resourceID: + description: resource ID of the managed identity, can not be used at the same time as clientID + type: string + resourceGroupName: + description: resource group the DNS zone is located in + type: string + subscriptionID: + description: ID of the Azure subscription + type: string + tenantID: + description: when specifying ClientID and ClientSecret then this field is also needed + type: string + cloudDNS: + description: Use the Google Cloud DNS API to manage DNS01 challenge records. + type: object + required: + - project + properties: + hostedZoneName: + description: HostedZoneName is an optional field that tells cert-manager in which Cloud DNS zone the challenge record has to be created. If left empty cert-manager will automatically choose a zone. + type: string + project: + type: string + serviceAccountSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + cloudflare: + description: Use the Cloudflare API to manage DNS01 challenge records. + type: object + properties: + apiKeySecretRef: + description: 'API key to use to authenticate with Cloudflare. Note: using an API token to authenticate is now the recommended method as it allows greater control of permissions.' + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + apiTokenSecretRef: + description: API token used to authenticate with Cloudflare. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + email: + description: Email of the account, only required when using API key based authentication. + type: string + cnameStrategy: + description: CNAMEStrategy configures how the DNS01 provider should handle CNAME records when found in DNS zones. + type: string + enum: + - None + - Follow + digitalocean: + description: Use the DigitalOcean DNS API to manage DNS01 challenge records. + type: object + required: + - tokenSecretRef + properties: + tokenSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + rfc2136: + description: Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/) to manage DNS01 challenge records. + type: object + required: + - nameserver + properties: + nameserver: + description: The IP address or hostname of an authoritative DNS server supporting RFC2136 in the form host:port. If the host is an IPv6 address it must be enclosed in square brackets (e.g [2001:db8::1]) ; port is optional. This field is required. + type: string + tsigAlgorithm: + description: 'The TSIG Algorithm configured in the DNS supporting RFC2136. Used only when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined. Supported values are (case-insensitive): ``HMACMD5`` (default), ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``.' + type: string + tsigKeyName: + description: The TSIG Key name configured in the DNS. If ``tsigSecretSecretRef`` is defined, this field is required. + type: string + tsigSecretSecretRef: + description: The name of the secret containing the TSIG value. If ``tsigKeyName`` is defined, this field is required. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + route53: + description: Use the AWS Route53 API to manage DNS01 challenge records. + type: object + required: + - region + properties: + accessKeyID: + description: 'The AccessKeyID is used for authentication. If not set we fall-back to using env vars, shared credentials file or AWS Instance metadata see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials' + type: string + hostedZoneID: + description: If set, the provider will manage only this zone in Route53 and will not do an lookup using the route53:ListHostedZonesByName api call. + type: string + region: + description: Always set the region when using AccessKeyID and SecretAccessKey + type: string + role: + description: Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata + type: string + secretAccessKeySecretRef: + description: The SecretAccessKey is used for authentication. If not set we fall-back to using env vars, shared credentials file or AWS Instance metadata https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + webhook: + description: Configure an external webhook based DNS01 challenge solver to manage DNS01 challenge records. + type: object + required: + - groupName + - solverName + properties: + config: + description: Additional configuration that should be passed to the webhook apiserver when challenges are processed. This can contain arbitrary JSON data. Secret values should not be specified in this stanza. If secret values are needed (e.g. credentials for a DNS service), you should use a SecretKeySelector to reference a Secret resource. For details on the schema of this field, consult the webhook provider implementation's documentation. + x-kubernetes-preserve-unknown-fields: true + groupName: + description: The API group name that should be used when POSTing ChallengePayload resources to the webhook apiserver. This should be the same as the GroupName specified in the webhook provider implementation. + type: string + solverName: + description: The name of the solver to use, as defined in the webhook provider implementation. This will typically be the name of the provider, e.g. 'cloudflare'. + type: string + http01: + description: Configures cert-manager to attempt to complete authorizations by performing the HTTP01 challenge flow. It is not possible to obtain certificates for wildcard domain names (e.g. `*.example.com`) using the HTTP01 challenge mechanism. + type: object + properties: + gatewayHTTPRoute: + description: The Gateway API is a sig-network community API that models service networking in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will create HTTPRoutes with the specified labels in the same namespace as the challenge. This solver is experimental, and fields / behaviour may change in the future. + type: object + properties: + labels: + description: The labels that cert-manager will use when creating the temporary HTTPRoute needed for solving the HTTP-01 challenge. These labels must match the label selector of at least one Gateway. + type: object + additionalProperties: + type: string + serviceType: + description: Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort. + type: string + ingress: + description: The ingress based HTTP01 challenge solver will solve challenges by creating or modifying Ingress resources in order to route requests for '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are provisioned by cert-manager for each Challenge to be completed. + type: object + properties: + class: + description: The ingress class to use when creating Ingress resources to solve ACME challenges that use this challenge solver. Only one of 'class' or 'name' may be specified. + type: string + ingressTemplate: + description: Optional ingress template used to configure the ACME challenge solver ingress used for HTTP01 challenges. + type: object + properties: + metadata: + description: ObjectMeta overrides for the ingress used to solve HTTP01 challenges. Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. + type: object + properties: + annotations: + description: Annotations that should be added to the created ACME HTTP01 solver ingress. + type: object + additionalProperties: + type: string + labels: + description: Labels that should be added to the created ACME HTTP01 solver ingress. + type: object + additionalProperties: + type: string + name: + description: The name of the ingress resource that should have ACME challenge solving routes inserted into it in order to solve HTTP01 challenges. This is typically used in conjunction with ingress controllers like ingress-gce, which maintains a 1:1 mapping between external IPs and ingress resources. + type: string + podTemplate: + description: Optional pod template used to configure the ACME challenge solver pods used for HTTP01 challenges. + type: object + properties: + metadata: + description: ObjectMeta overrides for the pod used to solve HTTP01 challenges. Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. + type: object + properties: + annotations: + description: Annotations that should be added to the create ACME HTTP01 solver pods. + type: object + additionalProperties: + type: string + labels: + description: Labels that should be added to the created ACME HTTP01 solver pods. + type: object + additionalProperties: + type: string + spec: + description: PodSpec defines overrides for the HTTP01 challenge solver pod. Only the 'priorityClassName', 'nodeSelector', 'affinity', 'serviceAccountName' and 'tolerations' fields are supported currently. All other fields will be ignored. + type: object + properties: + affinity: + description: If specified, the pod's scheduling constraints + type: object + properties: + nodeAffinity: + description: Describes node affinity scheduling rules for the pod. + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred. + type: array + items: + description: An empty preferred scheduling term matches all objects with implicit weight 0 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + type: object + required: + - preference + - weight + properties: + preference: + description: A node selector term, associated with the corresponding weight. + type: object + properties: + matchExpressions: + description: A list of node selector requirements by node's labels. + type: array + items: + description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchFields: + description: A list of node selector requirements by node's fields. + type: array + items: + description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array + items: + type: string + weight: + description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. + type: integer + format: int32 + requiredDuringSchedulingIgnoredDuringExecution: + description: If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node. + type: object + required: + - nodeSelectorTerms + properties: + nodeSelectorTerms: + description: Required. A list of node selector terms. The terms are ORed. + type: array + items: + description: A null or empty node selector term matches no objects. The requirements of them are ANDed. The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + type: object + properties: + matchExpressions: + description: A list of node selector requirements by node's labels. + type: array + items: + description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchFields: + description: A list of node selector requirements by node's fields. + type: array + items: + description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array + items: + type: string + podAffinity: + description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. + type: array + items: + description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + type: object + required: + - podAffinityTerm + - weight + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated with the corresponding weight. + type: object + required: + - topologyKey + properties: + labelSelector: + description: A label query over a set of resources, in this case pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaceSelector: + description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. This field is beta-level and is only honored when PodAffinityNamespaceSelector feature is enabled. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaces: + description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace" + type: array + items: + type: string + topologyKey: + description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + type: string + weight: + description: weight associated with matching the corresponding podAffinityTerm, in the range 1-100. + type: integer + format: int32 + requiredDuringSchedulingIgnoredDuringExecution: + description: If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. + type: array + items: + description: Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running + type: object + required: + - topologyKey + properties: + labelSelector: + description: A label query over a set of resources, in this case pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaceSelector: + description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. This field is beta-level and is only honored when PodAffinityNamespaceSelector feature is enabled. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaces: + description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace" + type: array + items: + type: string + topologyKey: + description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + type: string + podAntiAffinity: + description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods to nodes that satisfy the anti-affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. + type: array + items: + description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + type: object + required: + - podAffinityTerm + - weight + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated with the corresponding weight. + type: object + required: + - topologyKey + properties: + labelSelector: + description: A label query over a set of resources, in this case pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaceSelector: + description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. This field is beta-level and is only honored when PodAffinityNamespaceSelector feature is enabled. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaces: + description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace" + type: array + items: + type: string + topologyKey: + description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + type: string + weight: + description: weight associated with matching the corresponding podAffinityTerm, in the range 1-100. + type: integer + format: int32 + requiredDuringSchedulingIgnoredDuringExecution: + description: If the anti-affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the anti-affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. + type: array + items: + description: Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running + type: object + required: + - topologyKey + properties: + labelSelector: + description: A label query over a set of resources, in this case pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaceSelector: + description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. This field is beta-level and is only honored when PodAffinityNamespaceSelector feature is enabled. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaces: + description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace" + type: array + items: + type: string + topologyKey: + description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + type: string + nodeSelector: + description: 'NodeSelector is a selector which must be true for the pod to fit on a node. Selector which must match a node''s labels for the pod to be scheduled on that node. More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/' + type: object + additionalProperties: + type: string + priorityClassName: + description: If specified, the pod's priorityClassName. + type: string + serviceAccountName: + description: If specified, the pod's service account + type: string + tolerations: + description: If specified, the pod's tolerations. + type: array + items: + description: The pod this Toleration is attached to tolerates any taint that matches the triple using the matching operator . + type: object + properties: + effect: + description: Effect indicates the taint effect to match. Empty means match all taint effects. When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: Key is the taint key that the toleration applies to. Empty means match all taint keys. If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: Operator represents a key's relationship to the value. Valid operators are Exists and Equal. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: TolerationSeconds represents the period of time the toleration (which must be of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system. + type: integer + format: int64 + value: + description: Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + serviceType: + description: Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort. + type: string + selector: + description: Selector selects a set of DNSNames on the Certificate resource that should be solved using this challenge solver. If not specified, the solver will be treated as the 'default' solver with the lowest priority, i.e. if any other solver has a more specific match, it will be used instead. + type: object + properties: + dnsNames: + description: List of DNSNames that this solver will be used to solve. If specified and a match is found, a dnsNames selector will take precedence over a dnsZones selector. If multiple solvers match with the same dnsNames value, the solver with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected. + type: array + items: + type: string + dnsZones: + description: List of DNSZones that this solver will be used to solve. The most specific DNS zone match specified here will take precedence over other DNS zone matches, so a solver specifying sys.example.com will be selected over one specifying example.com for the domain www.sys.example.com. If multiple solvers match with the same dnsZones value, the solver with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected. + type: array + items: + type: string + matchLabels: + description: A label selector that is used to refine the set of certificate's that this challenge solver will apply to. + type: object + additionalProperties: + type: string + ca: + description: CA configures this issuer to sign certificates using a signing CA keypair stored in a Secret resource. This is used to build internal PKIs that are managed by cert-manager. + type: object + required: + - secretName + properties: + crlDistributionPoints: + description: The CRL distribution points is an X.509 v3 certificate extension which identifies the location of the CRL from which the revocation of this certificate can be checked. If not set, certificates will be issued without distribution points set. + type: array + items: + type: string + ocspServers: + description: The OCSP server list is an X.509 v3 extension that defines a list of URLs of OCSP responders. The OCSP responders can be queried for the revocation status of an issued certificate. If not set, the certificate will be issued with no OCSP servers set. For example, an OCSP server URL could be "http://ocsp.int-x3.letsencrypt.org". + type: array + items: + type: string + secretName: + description: SecretName is the name of the secret used to sign Certificates issued by this Issuer. + type: string + selfSigned: + description: SelfSigned configures this issuer to 'self sign' certificates using the private key used to create the CertificateRequest object. + type: object + properties: + crlDistributionPoints: + description: The CRL distribution points is an X.509 v3 certificate extension which identifies the location of the CRL from which the revocation of this certificate can be checked. If not set certificate will be issued without CDP. Values are strings. + type: array + items: + type: string + vault: + description: Vault configures this issuer to sign certificates using a HashiCorp Vault PKI backend. + type: object + required: + - auth + - path + - server + properties: + auth: + description: Auth configures how cert-manager authenticates with the Vault server. + type: object + properties: + appRole: + description: AppRole authenticates with Vault using the App Role auth mechanism, with the role and secret stored in a Kubernetes Secret resource. + type: object + required: + - path + - roleId + - secretRef + properties: + path: + description: 'Path where the App Role authentication backend is mounted in Vault, e.g: "approle"' + type: string + roleId: + description: RoleID configured in the App Role authentication backend when setting up the authentication backend in Vault. + type: string + secretRef: + description: Reference to a key in a Secret that contains the App Role secret used to authenticate with Vault. The `key` field must be specified and denotes which entry within the Secret resource is used as the app role secret. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + kubernetes: + description: Kubernetes authenticates with Vault by passing the ServiceAccount token stored in the named Secret resource to the Vault server. + type: object + required: + - role + - secretRef + properties: + mountPath: + description: The Vault mountPath here is the mount path to use when authenticating with Vault. For example, setting a value to `/v1/auth/foo`, will use the path `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the default value "/v1/auth/kubernetes" will be used. + type: string + role: + description: A required field containing the Vault Role to assume. A Role binds a Kubernetes ServiceAccount with a set of Vault policies. + type: string + secretRef: + description: The required Secret field containing a Kubernetes ServiceAccount JWT used for authenticating with Vault. Use of 'ambient credentials' is not supported. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + tokenSecretRef: + description: TokenSecretRef authenticates with Vault by presenting a token. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + caBundle: + description: PEM-encoded CA bundle (base64-encoded) used to validate Vault server certificate. Only used if the Server URL is using HTTPS protocol. This parameter is ignored for plain HTTP protocol connection. If not set the system root certificates are used to validate the TLS connection. + type: string + format: byte + namespace: + description: 'Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows Vault environments to support Secure Multi-tenancy. e.g: "ns1" More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces' + type: string + path: + description: 'Path is the mount path of the Vault PKI backend''s `sign` endpoint, e.g: "my_pki_mount/sign/my-role-name".' + type: string + server: + description: 'Server is the connection address for the Vault server, e.g: "https://vault.example.com:8200".' + type: string + venafi: + description: Venafi configures this issuer to sign certificates using a Venafi TPP or Venafi Cloud policy zone. + type: object + required: + - zone + properties: + cloud: + description: Cloud specifies the Venafi cloud configuration settings. Only one of TPP or Cloud may be specified. + type: object + required: + - apiTokenSecretRef + properties: + apiTokenSecretRef: + description: APITokenSecretRef is a secret key selector for the Venafi Cloud API token. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + url: + description: URL is the base URL for Venafi Cloud. Defaults to "https://api.venafi.cloud/v1". + type: string + tpp: + description: TPP specifies Trust Protection Platform configuration settings. Only one of TPP or Cloud may be specified. + type: object + required: + - credentialsRef + - url + properties: + caBundle: + description: CABundle is a PEM encoded TLS certificate to use to verify connections to the TPP instance. If specified, system roots will not be used and the issuing CA for the TPP instance must be verifiable using the provided root. If not specified, the connection will be verified using the cert-manager system root certificates. + type: string + format: byte + credentialsRef: + description: CredentialsRef is a reference to a Secret containing the username and password for the TPP server. The secret must contain two keys, 'username' and 'password'. + type: object + required: + - name + properties: + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + url: + description: 'URL is the base URL for the vedsdk endpoint of the Venafi TPP instance, for example: "https://tpp.example.com/vedsdk".' + type: string + zone: + description: Zone is the Venafi Policy Zone to use for this issuer. All requests made to the Venafi platform will be restricted by the named zone policy. This field is required. + type: string + status: + description: Status of the ClusterIssuer. This is set and managed automatically. + type: object + properties: + acme: + description: ACME specific status options. This field should only be set if the Issuer is configured to use an ACME server to issue certificates. + type: object + properties: + lastRegisteredEmail: + description: LastRegisteredEmail is the email associated with the latest registered ACME account, in order to track changes made to registered account associated with the Issuer + type: string + uri: + description: URI is the unique account identifier, which can also be used to retrieve account details from the CA + type: string + conditions: + description: List of status conditions to indicate the status of a CertificateRequest. Known condition types are `Ready`. + type: array + items: + description: IssuerCondition contains condition information for an Issuer. + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: LastTransitionTime is the timestamp corresponding to the last status change of this condition. + type: string + format: date-time + message: + description: Message is a human readable description of the details of the last transition, complementing reason. + type: string + observedGeneration: + description: If set, this represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.condition[x].observedGeneration is 9, the condition is out of date with respect to the current state of the Issuer. + type: integer + format: int64 + reason: + description: Reason is a brief machine readable explanation for the condition's last transition. + type: string + status: + description: Status of the condition, one of (`True`, `False`, `Unknown`). + type: string + enum: + - "True" + - "False" + - Unknown + type: + description: Type of the condition, known values are (`Ready`). + type: string + served: true + storage: true +--- +# Source: cert-manager/templates/templates.out +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: issuers.cert-manager.io + annotations: + cert-manager.io/inject-ca-from-secret: 'cert-manager/cert-manager-webhook-ca' + labels: + app: 'cert-manager' + app.kubernetes.io/name: 'cert-manager' + app.kubernetes.io/instance: 'cert-manager' + # Generated labels + app.kubernetes.io/version: "v1.6.3" +spec: + group: cert-manager.io + names: + kind: Issuer + listKind: IssuerList + plural: issuers + singular: issuer + categories: + - cert-manager + scope: Namespaced + conversion: + # a Webhook strategy instruct API server to call an external webhook for any conversion between custom resources. + strategy: Webhook + # webhookClientConfig is required when strategy is `Webhook` and it configures the webhook endpoint to be called by API server. + webhook: + # We don't actually support `v1beta1` but is listed here as it is a + # required value for [Kubernetes v1.16](kubernetes/kubernetes#82023). The + # API server reads the supported versions in order, so _should always_ + # attempt a `v1` request which is understood by the cert-manager webhook. + # Any `v1beta1` request will return an error and fail closed for that + # resource (the whole object request is rejected). + # When we no longer support v1.16 we can remove `v1beta1` from this list. + conversionReviewVersions: ["v1", "v1beta1"] + clientConfig: + # + service: + name: 'cert-manager-webhook' + namespace: "cert-manager" + path: /convert + # + versions: + - name: v1alpha2 + subresources: + status: {} + additionalPrinterColumns: + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + priority: 1 + type: string + - jsonPath: .metadata.creationTimestamp + description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + name: Age + type: date + schema: + openAPIV3Schema: + description: An Issuer represents a certificate issuing authority which can be referenced as part of `issuerRef` fields. It is scoped to a single namespace and can therefore only be referenced by resources within the same namespace. + type: object + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: Desired state of the Issuer resource. + type: object + properties: + acme: + description: ACME configures this issuer to communicate with a RFC8555 (ACME) server to obtain signed x509 certificates. + type: object + required: + - privateKeySecretRef + - server + properties: + disableAccountKeyGeneration: + description: Enables or disables generating a new ACME account key. If true, the Issuer resource will *not* request a new account but will expect the account key to be supplied via an existing secret. If false, the cert-manager system will generate a new ACME account key for the Issuer. Defaults to false. + type: boolean + email: + description: Email is the email address to be associated with the ACME account. This field is optional, but it is strongly recommended to be set. It will be used to contact you in case of issues with your account or certificates, including expiry notification emails. This field may be updated after the account is initially registered. + type: string + enableDurationFeature: + description: Enables requesting a Not After date on certificates that matches the duration of the certificate. This is not supported by all ACME servers like Let's Encrypt. If set to true when the ACME server does not support it it will create an error on the Order. Defaults to false. + type: boolean + externalAccountBinding: + description: ExternalAccountBinding is a reference to a CA external account of the ACME server. If set, upon registration cert-manager will attempt to associate the given external account credentials with the registered ACME account. + type: object + required: + - keyID + - keySecretRef + properties: + keyAlgorithm: + description: 'Deprecated: keyAlgorithm field exists for historical compatibility reasons and should not be used. The algorithm is now hardcoded to HS256 in golang/x/crypto/acme.' + type: string + enum: + - HS256 + - HS384 + - HS512 + keyID: + description: keyID is the ID of the CA key that the External Account is bound to. + type: string + keySecretRef: + description: keySecretRef is a Secret Key Selector referencing a data item in a Kubernetes Secret which holds the symmetric MAC key of the External Account Binding. The `key` is the index string that is paired with the key data in the Secret and should not be confused with the key data itself, or indeed with the External Account Binding keyID above. The secret key stored in the Secret **must** be un-padded, base64 URL encoded data. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + preferredChain: + description: 'PreferredChain is the chain to use if the ACME server outputs multiple. PreferredChain is no guarantee that this one gets delivered by the ACME endpoint. For example, for Let''s Encrypt''s DST crosssign you would use: "DST Root CA X3" or "ISRG Root X1" for the newer Let''s Encrypt root CA. This value picks the first certificate bundle in the ACME alternative chains that has a certificate with this value as its issuer''s CN' + type: string + maxLength: 64 + privateKeySecretRef: + description: PrivateKey is the name of a Kubernetes Secret resource that will be used to store the automatically generated ACME account private key. Optionally, a `key` may be specified to select a specific entry within the named Secret resource. If `key` is not specified, a default of `tls.key` will be used. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + server: + description: 'Server is the URL used to access the ACME server''s ''directory'' endpoint. For example, for Let''s Encrypt''s staging endpoint, you would use: "https://acme-staging-v02.api.letsencrypt.org/directory". Only ACME v2 endpoints (i.e. RFC 8555) are supported.' + type: string + skipTLSVerify: + description: Enables or disables validation of the ACME server TLS certificate. If true, requests to the ACME server will not have their TLS certificate validated (i.e. insecure connections will be allowed). Only enable this option in development environments. The cert-manager system installed roots will be used to verify connections to the ACME server if this is false. Defaults to false. + type: boolean + solvers: + description: 'Solvers is a list of challenge solvers that will be used to solve ACME challenges for the matching domains. Solver configurations must be provided in order to obtain certificates from an ACME server. For more information, see: https://cert-manager.io/docs/configuration/acme/' + type: array + items: + description: Configures an issuer to solve challenges using the specified options. Only one of HTTP01 or DNS01 may be provided. + type: object + properties: + dns01: + description: Configures cert-manager to attempt to complete authorizations by performing the DNS01 challenge flow. + type: object + properties: + acmedns: + description: Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage DNS01 challenge records. + type: object + required: + - accountSecretRef + - host + properties: + accountSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + host: + type: string + akamai: + description: Use the Akamai DNS zone management API to manage DNS01 challenge records. + type: object + required: + - accessTokenSecretRef + - clientSecretSecretRef + - clientTokenSecretRef + - serviceConsumerDomain + properties: + accessTokenSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + clientSecretSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + clientTokenSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + serviceConsumerDomain: + type: string + azuredns: + description: Use the Microsoft Azure DNS API to manage DNS01 challenge records. + type: object + required: + - resourceGroupName + - subscriptionID + properties: + clientID: + description: if both this and ClientSecret are left unset MSI will be used + type: string + clientSecretSecretRef: + description: if both this and ClientID are left unset MSI will be used + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + environment: + description: name of the Azure environment (default AzurePublicCloud) + type: string + enum: + - AzurePublicCloud + - AzureChinaCloud + - AzureGermanCloud + - AzureUSGovernmentCloud + hostedZoneName: + description: name of the DNS zone that should be used + type: string + managedIdentity: + description: managed identity configuration, can not be used at the same time as clientID, clientSecretSecretRef or tenantID + type: object + properties: + clientID: + description: client ID of the managed identity, can not be used at the same time as resourceID + type: string + resourceID: + description: resource ID of the managed identity, can not be used at the same time as clientID + type: string + resourceGroupName: + description: resource group the DNS zone is located in + type: string + subscriptionID: + description: ID of the Azure subscription + type: string + tenantID: + description: when specifying ClientID and ClientSecret then this field is also needed + type: string + clouddns: + description: Use the Google Cloud DNS API to manage DNS01 challenge records. + type: object + required: + - project + properties: + hostedZoneName: + description: HostedZoneName is an optional field that tells cert-manager in which Cloud DNS zone the challenge record has to be created. If left empty cert-manager will automatically choose a zone. + type: string + project: + type: string + serviceAccountSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + cloudflare: + description: Use the Cloudflare API to manage DNS01 challenge records. + type: object + properties: + apiKeySecretRef: + description: 'API key to use to authenticate with Cloudflare. Note: using an API token to authenticate is now the recommended method as it allows greater control of permissions.' + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + apiTokenSecretRef: + description: API token used to authenticate with Cloudflare. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + email: + description: Email of the account, only required when using API key based authentication. + type: string + cnameStrategy: + description: CNAMEStrategy configures how the DNS01 provider should handle CNAME records when found in DNS zones. + type: string + enum: + - None + - Follow + digitalocean: + description: Use the DigitalOcean DNS API to manage DNS01 challenge records. + type: object + required: + - tokenSecretRef + properties: + tokenSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + rfc2136: + description: Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/) to manage DNS01 challenge records. + type: object + required: + - nameserver + properties: + nameserver: + description: The IP address or hostname of an authoritative DNS server supporting RFC2136 in the form host:port. If the host is an IPv6 address it must be enclosed in square brackets (e.g [2001:db8::1]) ; port is optional. This field is required. + type: string + tsigAlgorithm: + description: 'The TSIG Algorithm configured in the DNS supporting RFC2136. Used only when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined. Supported values are (case-insensitive): ``HMACMD5`` (default), ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``.' + type: string + tsigKeyName: + description: The TSIG Key name configured in the DNS. If ``tsigSecretSecretRef`` is defined, this field is required. + type: string + tsigSecretSecretRef: + description: The name of the secret containing the TSIG value. If ``tsigKeyName`` is defined, this field is required. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + route53: + description: Use the AWS Route53 API to manage DNS01 challenge records. + type: object + required: + - region + properties: + accessKeyID: + description: 'The AccessKeyID is used for authentication. If not set we fall-back to using env vars, shared credentials file or AWS Instance metadata see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials' + type: string + hostedZoneID: + description: If set, the provider will manage only this zone in Route53 and will not do an lookup using the route53:ListHostedZonesByName api call. + type: string + region: + description: Always set the region when using AccessKeyID and SecretAccessKey + type: string + role: + description: Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata + type: string + secretAccessKeySecretRef: + description: The SecretAccessKey is used for authentication. If not set we fall-back to using env vars, shared credentials file or AWS Instance metadata https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + webhook: + description: Configure an external webhook based DNS01 challenge solver to manage DNS01 challenge records. + type: object + required: + - groupName + - solverName + properties: + config: + description: Additional configuration that should be passed to the webhook apiserver when challenges are processed. This can contain arbitrary JSON data. Secret values should not be specified in this stanza. If secret values are needed (e.g. credentials for a DNS service), you should use a SecretKeySelector to reference a Secret resource. For details on the schema of this field, consult the webhook provider implementation's documentation. + x-kubernetes-preserve-unknown-fields: true + groupName: + description: The API group name that should be used when POSTing ChallengePayload resources to the webhook apiserver. This should be the same as the GroupName specified in the webhook provider implementation. + type: string + solverName: + description: The name of the solver to use, as defined in the webhook provider implementation. This will typically be the name of the provider, e.g. 'cloudflare'. + type: string + http01: + description: Configures cert-manager to attempt to complete authorizations by performing the HTTP01 challenge flow. It is not possible to obtain certificates for wildcard domain names (e.g. `*.example.com`) using the HTTP01 challenge mechanism. + type: object + properties: + gatewayHTTPRoute: + description: The Gateway API is a sig-network community API that models service networking in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will create HTTPRoutes with the specified labels in the same namespace as the challenge. This solver is experimental, and fields / behaviour may change in the future. + type: object + properties: + labels: + description: The labels that cert-manager will use when creating the temporary HTTPRoute needed for solving the HTTP-01 challenge. These labels must match the label selector of at least one Gateway. + type: object + additionalProperties: + type: string + serviceType: + description: Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort. + type: string + ingress: + description: The ingress based HTTP01 challenge solver will solve challenges by creating or modifying Ingress resources in order to route requests for '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are provisioned by cert-manager for each Challenge to be completed. + type: object + properties: + class: + description: The ingress class to use when creating Ingress resources to solve ACME challenges that use this challenge solver. Only one of 'class' or 'name' may be specified. + type: string + ingressTemplate: + description: Optional ingress template used to configure the ACME challenge solver ingress used for HTTP01 challenges + type: object + properties: + metadata: + description: ObjectMeta overrides for the ingress used to solve HTTP01 challenges. Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. + type: object + properties: + annotations: + description: Annotations that should be added to the created ACME HTTP01 solver ingress. + type: object + additionalProperties: + type: string + labels: + description: Labels that should be added to the created ACME HTTP01 solver ingress. + type: object + additionalProperties: + type: string + name: + description: The name of the ingress resource that should have ACME challenge solving routes inserted into it in order to solve HTTP01 challenges. This is typically used in conjunction with ingress controllers like ingress-gce, which maintains a 1:1 mapping between external IPs and ingress resources. + type: string + podTemplate: + description: Optional pod template used to configure the ACME challenge solver pods used for HTTP01 challenges. + type: object + properties: + metadata: + description: ObjectMeta overrides for the pod used to solve HTTP01 challenges. Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. + type: object + properties: + annotations: + description: Annotations that should be added to the create ACME HTTP01 solver pods. + type: object + additionalProperties: + type: string + labels: + description: Labels that should be added to the created ACME HTTP01 solver pods. + type: object + additionalProperties: + type: string + spec: + description: PodSpec defines overrides for the HTTP01 challenge solver pod. Only the 'priorityClassName', 'nodeSelector', 'affinity', 'serviceAccountName' and 'tolerations' fields are supported currently. All other fields will be ignored. + type: object + properties: + affinity: + description: If specified, the pod's scheduling constraints + type: object + properties: + nodeAffinity: + description: Describes node affinity scheduling rules for the pod. + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred. + type: array + items: + description: An empty preferred scheduling term matches all objects with implicit weight 0 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + type: object + required: + - preference + - weight + properties: + preference: + description: A node selector term, associated with the corresponding weight. + type: object + properties: + matchExpressions: + description: A list of node selector requirements by node's labels. + type: array + items: + description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchFields: + description: A list of node selector requirements by node's fields. + type: array + items: + description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array + items: + type: string + weight: + description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. + type: integer + format: int32 + requiredDuringSchedulingIgnoredDuringExecution: + description: If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node. + type: object + required: + - nodeSelectorTerms + properties: + nodeSelectorTerms: + description: Required. A list of node selector terms. The terms are ORed. + type: array + items: + description: A null or empty node selector term matches no objects. The requirements of them are ANDed. The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + type: object + properties: + matchExpressions: + description: A list of node selector requirements by node's labels. + type: array + items: + description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchFields: + description: A list of node selector requirements by node's fields. + type: array + items: + description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array + items: + type: string + podAffinity: + description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. + type: array + items: + description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + type: object + required: + - podAffinityTerm + - weight + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated with the corresponding weight. + type: object + required: + - topologyKey + properties: + labelSelector: + description: A label query over a set of resources, in this case pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaceSelector: + description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. This field is beta-level and is only honored when PodAffinityNamespaceSelector feature is enabled. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaces: + description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace" + type: array + items: + type: string + topologyKey: + description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + type: string + weight: + description: weight associated with matching the corresponding podAffinityTerm, in the range 1-100. + type: integer + format: int32 + requiredDuringSchedulingIgnoredDuringExecution: + description: If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. + type: array + items: + description: Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running + type: object + required: + - topologyKey + properties: + labelSelector: + description: A label query over a set of resources, in this case pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaceSelector: + description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. This field is beta-level and is only honored when PodAffinityNamespaceSelector feature is enabled. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaces: + description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace" + type: array + items: + type: string + topologyKey: + description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + type: string + podAntiAffinity: + description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods to nodes that satisfy the anti-affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. + type: array + items: + description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + type: object + required: + - podAffinityTerm + - weight + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated with the corresponding weight. + type: object + required: + - topologyKey + properties: + labelSelector: + description: A label query over a set of resources, in this case pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaceSelector: + description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. This field is beta-level and is only honored when PodAffinityNamespaceSelector feature is enabled. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaces: + description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace" + type: array + items: + type: string + topologyKey: + description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + type: string + weight: + description: weight associated with matching the corresponding podAffinityTerm, in the range 1-100. + type: integer + format: int32 + requiredDuringSchedulingIgnoredDuringExecution: + description: If the anti-affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the anti-affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. + type: array + items: + description: Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running + type: object + required: + - topologyKey + properties: + labelSelector: + description: A label query over a set of resources, in this case pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaceSelector: + description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. This field is beta-level and is only honored when PodAffinityNamespaceSelector feature is enabled. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaces: + description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace" + type: array + items: + type: string + topologyKey: + description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + type: string + nodeSelector: + description: 'NodeSelector is a selector which must be true for the pod to fit on a node. Selector which must match a node''s labels for the pod to be scheduled on that node. More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/' + type: object + additionalProperties: + type: string + priorityClassName: + description: If specified, the pod's priorityClassName. + type: string + serviceAccountName: + description: If specified, the pod's service account + type: string + tolerations: + description: If specified, the pod's tolerations. + type: array + items: + description: The pod this Toleration is attached to tolerates any taint that matches the triple using the matching operator . + type: object + properties: + effect: + description: Effect indicates the taint effect to match. Empty means match all taint effects. When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: Key is the taint key that the toleration applies to. Empty means match all taint keys. If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: Operator represents a key's relationship to the value. Valid operators are Exists and Equal. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: TolerationSeconds represents the period of time the toleration (which must be of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system. + type: integer + format: int64 + value: + description: Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + serviceType: + description: Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort. + type: string + selector: + description: Selector selects a set of DNSNames on the Certificate resource that should be solved using this challenge solver. If not specified, the solver will be treated as the 'default' solver with the lowest priority, i.e. if any other solver has a more specific match, it will be used instead. + type: object + properties: + dnsNames: + description: List of DNSNames that this solver will be used to solve. If specified and a match is found, a dnsNames selector will take precedence over a dnsZones selector. If multiple solvers match with the same dnsNames value, the solver with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected. + type: array + items: + type: string + dnsZones: + description: List of DNSZones that this solver will be used to solve. The most specific DNS zone match specified here will take precedence over other DNS zone matches, so a solver specifying sys.example.com will be selected over one specifying example.com for the domain www.sys.example.com. If multiple solvers match with the same dnsZones value, the solver with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected. + type: array + items: + type: string + matchLabels: + description: A label selector that is used to refine the set of certificate's that this challenge solver will apply to. + type: object + additionalProperties: + type: string + ca: + description: CA configures this issuer to sign certificates using a signing CA keypair stored in a Secret resource. This is used to build internal PKIs that are managed by cert-manager. + type: object + required: + - secretName + properties: + crlDistributionPoints: + description: The CRL distribution points is an X.509 v3 certificate extension which identifies the location of the CRL from which the revocation of this certificate can be checked. If not set, certificates will be issued without distribution points set. + type: array + items: + type: string + ocspServers: + description: The OCSP server list is an X.509 v3 extension that defines a list of URLs of OCSP responders. The OCSP responders can be queried for the revocation status of an issued certificate. If not set, the certificate will be issued with no OCSP servers set. For example, an OCSP server URL could be "http://ocsp.int-x3.letsencrypt.org". + type: array + items: + type: string + secretName: + description: SecretName is the name of the secret used to sign Certificates issued by this Issuer. + type: string + selfSigned: + description: SelfSigned configures this issuer to 'self sign' certificates using the private key used to create the CertificateRequest object. + type: object + properties: + crlDistributionPoints: + description: The CRL distribution points is an X.509 v3 certificate extension which identifies the location of the CRL from which the revocation of this certificate can be checked. If not set certificate will be issued without CDP. Values are strings. + type: array + items: + type: string + vault: + description: Vault configures this issuer to sign certificates using a HashiCorp Vault PKI backend. + type: object + required: + - auth + - path + - server + properties: + auth: + description: Auth configures how cert-manager authenticates with the Vault server. + type: object + properties: + appRole: + description: AppRole authenticates with Vault using the App Role auth mechanism, with the role and secret stored in a Kubernetes Secret resource. + type: object + required: + - path + - roleId + - secretRef + properties: + path: + description: 'Path where the App Role authentication backend is mounted in Vault, e.g: "approle"' + type: string + roleId: + description: RoleID configured in the App Role authentication backend when setting up the authentication backend in Vault. + type: string + secretRef: + description: Reference to a key in a Secret that contains the App Role secret used to authenticate with Vault. The `key` field must be specified and denotes which entry within the Secret resource is used as the app role secret. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + kubernetes: + description: Kubernetes authenticates with Vault by passing the ServiceAccount token stored in the named Secret resource to the Vault server. + type: object + required: + - role + - secretRef + properties: + mountPath: + description: The Vault mountPath here is the mount path to use when authenticating with Vault. For example, setting a value to `/v1/auth/foo`, will use the path `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the default value "/v1/auth/kubernetes" will be used. + type: string + role: + description: A required field containing the Vault Role to assume. A Role binds a Kubernetes ServiceAccount with a set of Vault policies. + type: string + secretRef: + description: The required Secret field containing a Kubernetes ServiceAccount JWT used for authenticating with Vault. Use of 'ambient credentials' is not supported. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + tokenSecretRef: + description: TokenSecretRef authenticates with Vault by presenting a token. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + caBundle: + description: PEM-encoded CA bundle (base64-encoded) used to validate Vault server certificate. Only used if the Server URL is using HTTPS protocol. This parameter is ignored for plain HTTP protocol connection. If not set the system root certificates are used to validate the TLS connection. + type: string + format: byte + namespace: + description: 'Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows Vault environments to support Secure Multi-tenancy. e.g: "ns1" More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces' + type: string + path: + description: 'Path is the mount path of the Vault PKI backend''s `sign` endpoint, e.g: "my_pki_mount/sign/my-role-name".' + type: string + server: + description: 'Server is the connection address for the Vault server, e.g: "https://vault.example.com:8200".' + type: string + venafi: + description: Venafi configures this issuer to sign certificates using a Venafi TPP or Venafi Cloud policy zone. + type: object + required: + - zone + properties: + cloud: + description: Cloud specifies the Venafi cloud configuration settings. Only one of TPP or Cloud may be specified. + type: object + required: + - apiTokenSecretRef + properties: + apiTokenSecretRef: + description: APITokenSecretRef is a secret key selector for the Venafi Cloud API token. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + url: + description: URL is the base URL for Venafi Cloud. Defaults to "https://api.venafi.cloud/v1". + type: string + tpp: + description: TPP specifies Trust Protection Platform configuration settings. Only one of TPP or Cloud may be specified. + type: object + required: + - credentialsRef + - url + properties: + caBundle: + description: CABundle is a PEM encoded TLS certificate to use to verify connections to the TPP instance. If specified, system roots will not be used and the issuing CA for the TPP instance must be verifiable using the provided root. If not specified, the connection will be verified using the cert-manager system root certificates. + type: string + format: byte + credentialsRef: + description: CredentialsRef is a reference to a Secret containing the username and password for the TPP server. The secret must contain two keys, 'username' and 'password'. + type: object + required: + - name + properties: + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + url: + description: 'URL is the base URL for the vedsdk endpoint of the Venafi TPP instance, for example: "https://tpp.example.com/vedsdk".' + type: string + zone: + description: Zone is the Venafi Policy Zone to use for this issuer. All requests made to the Venafi platform will be restricted by the named zone policy. This field is required. + type: string + status: + description: Status of the Issuer. This is set and managed automatically. + type: object + properties: + acme: + description: ACME specific status options. This field should only be set if the Issuer is configured to use an ACME server to issue certificates. + type: object + properties: + lastRegisteredEmail: + description: LastRegisteredEmail is the email associated with the latest registered ACME account, in order to track changes made to registered account associated with the Issuer + type: string + uri: + description: URI is the unique account identifier, which can also be used to retrieve account details from the CA + type: string + conditions: + description: List of status conditions to indicate the status of a CertificateRequest. Known condition types are `Ready`. + type: array + items: + description: IssuerCondition contains condition information for an Issuer. + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: LastTransitionTime is the timestamp corresponding to the last status change of this condition. + type: string + format: date-time + message: + description: Message is a human readable description of the details of the last transition, complementing reason. + type: string + observedGeneration: + description: If set, this represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.condition[x].observedGeneration is 9, the condition is out of date with respect to the current state of the Issuer. + type: integer + format: int64 + reason: + description: Reason is a brief machine readable explanation for the condition's last transition. + type: string + status: + description: Status of the condition, one of (`True`, `False`, `Unknown`). + type: string + enum: + - "True" + - "False" + - Unknown + type: + description: Type of the condition, known values are (`Ready`). + type: string + served: false + storage: false + - name: v1alpha3 + subresources: + status: {} + additionalPrinterColumns: + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + priority: 1 + type: string + - jsonPath: .metadata.creationTimestamp + description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + name: Age + type: date + schema: + openAPIV3Schema: + description: An Issuer represents a certificate issuing authority which can be referenced as part of `issuerRef` fields. It is scoped to a single namespace and can therefore only be referenced by resources within the same namespace. + type: object + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: Desired state of the Issuer resource. + type: object + properties: + acme: + description: ACME configures this issuer to communicate with a RFC8555 (ACME) server to obtain signed x509 certificates. + type: object + required: + - privateKeySecretRef + - server + properties: + disableAccountKeyGeneration: + description: Enables or disables generating a new ACME account key. If true, the Issuer resource will *not* request a new account but will expect the account key to be supplied via an existing secret. If false, the cert-manager system will generate a new ACME account key for the Issuer. Defaults to false. + type: boolean + email: + description: Email is the email address to be associated with the ACME account. This field is optional, but it is strongly recommended to be set. It will be used to contact you in case of issues with your account or certificates, including expiry notification emails. This field may be updated after the account is initially registered. + type: string + enableDurationFeature: + description: Enables requesting a Not After date on certificates that matches the duration of the certificate. This is not supported by all ACME servers like Let's Encrypt. If set to true when the ACME server does not support it it will create an error on the Order. Defaults to false. + type: boolean + externalAccountBinding: + description: ExternalAccountBinding is a reference to a CA external account of the ACME server. If set, upon registration cert-manager will attempt to associate the given external account credentials with the registered ACME account. + type: object + required: + - keyID + - keySecretRef + properties: + keyAlgorithm: + description: 'Deprecated: keyAlgorithm field exists for historical compatibility reasons and should not be used. The algorithm is now hardcoded to HS256 in golang/x/crypto/acme.' + type: string + enum: + - HS256 + - HS384 + - HS512 + keyID: + description: keyID is the ID of the CA key that the External Account is bound to. + type: string + keySecretRef: + description: keySecretRef is a Secret Key Selector referencing a data item in a Kubernetes Secret which holds the symmetric MAC key of the External Account Binding. The `key` is the index string that is paired with the key data in the Secret and should not be confused with the key data itself, or indeed with the External Account Binding keyID above. The secret key stored in the Secret **must** be un-padded, base64 URL encoded data. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + preferredChain: + description: 'PreferredChain is the chain to use if the ACME server outputs multiple. PreferredChain is no guarantee that this one gets delivered by the ACME endpoint. For example, for Let''s Encrypt''s DST crosssign you would use: "DST Root CA X3" or "ISRG Root X1" for the newer Let''s Encrypt root CA. This value picks the first certificate bundle in the ACME alternative chains that has a certificate with this value as its issuer''s CN' + type: string + maxLength: 64 + privateKeySecretRef: + description: PrivateKey is the name of a Kubernetes Secret resource that will be used to store the automatically generated ACME account private key. Optionally, a `key` may be specified to select a specific entry within the named Secret resource. If `key` is not specified, a default of `tls.key` will be used. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + server: + description: 'Server is the URL used to access the ACME server''s ''directory'' endpoint. For example, for Let''s Encrypt''s staging endpoint, you would use: "https://acme-staging-v02.api.letsencrypt.org/directory". Only ACME v2 endpoints (i.e. RFC 8555) are supported.' + type: string + skipTLSVerify: + description: Enables or disables validation of the ACME server TLS certificate. If true, requests to the ACME server will not have their TLS certificate validated (i.e. insecure connections will be allowed). Only enable this option in development environments. The cert-manager system installed roots will be used to verify connections to the ACME server if this is false. Defaults to false. + type: boolean + solvers: + description: 'Solvers is a list of challenge solvers that will be used to solve ACME challenges for the matching domains. Solver configurations must be provided in order to obtain certificates from an ACME server. For more information, see: https://cert-manager.io/docs/configuration/acme/' + type: array + items: + description: Configures an issuer to solve challenges using the specified options. Only one of HTTP01 or DNS01 may be provided. + type: object + properties: + dns01: + description: Configures cert-manager to attempt to complete authorizations by performing the DNS01 challenge flow. + type: object + properties: + acmedns: + description: Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage DNS01 challenge records. + type: object + required: + - accountSecretRef + - host + properties: + accountSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + host: + type: string + akamai: + description: Use the Akamai DNS zone management API to manage DNS01 challenge records. + type: object + required: + - accessTokenSecretRef + - clientSecretSecretRef + - clientTokenSecretRef + - serviceConsumerDomain + properties: + accessTokenSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + clientSecretSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + clientTokenSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + serviceConsumerDomain: + type: string + azuredns: + description: Use the Microsoft Azure DNS API to manage DNS01 challenge records. + type: object + required: + - resourceGroupName + - subscriptionID + properties: + clientID: + description: if both this and ClientSecret are left unset MSI will be used + type: string + clientSecretSecretRef: + description: if both this and ClientID are left unset MSI will be used + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + environment: + description: name of the Azure environment (default AzurePublicCloud) + type: string + enum: + - AzurePublicCloud + - AzureChinaCloud + - AzureGermanCloud + - AzureUSGovernmentCloud + hostedZoneName: + description: name of the DNS zone that should be used + type: string + managedIdentity: + description: managed identity configuration, can not be used at the same time as clientID, clientSecretSecretRef or tenantID + type: object + properties: + clientID: + description: client ID of the managed identity, can not be used at the same time as resourceID + type: string + resourceID: + description: resource ID of the managed identity, can not be used at the same time as clientID + type: string + resourceGroupName: + description: resource group the DNS zone is located in + type: string + subscriptionID: + description: ID of the Azure subscription + type: string + tenantID: + description: when specifying ClientID and ClientSecret then this field is also needed + type: string + clouddns: + description: Use the Google Cloud DNS API to manage DNS01 challenge records. + type: object + required: + - project + properties: + hostedZoneName: + description: HostedZoneName is an optional field that tells cert-manager in which Cloud DNS zone the challenge record has to be created. If left empty cert-manager will automatically choose a zone. + type: string + project: + type: string + serviceAccountSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + cloudflare: + description: Use the Cloudflare API to manage DNS01 challenge records. + type: object + properties: + apiKeySecretRef: + description: 'API key to use to authenticate with Cloudflare. Note: using an API token to authenticate is now the recommended method as it allows greater control of permissions.' + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + apiTokenSecretRef: + description: API token used to authenticate with Cloudflare. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + email: + description: Email of the account, only required when using API key based authentication. + type: string + cnameStrategy: + description: CNAMEStrategy configures how the DNS01 provider should handle CNAME records when found in DNS zones. + type: string + enum: + - None + - Follow + digitalocean: + description: Use the DigitalOcean DNS API to manage DNS01 challenge records. + type: object + required: + - tokenSecretRef + properties: + tokenSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + rfc2136: + description: Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/) to manage DNS01 challenge records. + type: object + required: + - nameserver + properties: + nameserver: + description: The IP address or hostname of an authoritative DNS server supporting RFC2136 in the form host:port. If the host is an IPv6 address it must be enclosed in square brackets (e.g [2001:db8::1]) ; port is optional. This field is required. + type: string + tsigAlgorithm: + description: 'The TSIG Algorithm configured in the DNS supporting RFC2136. Used only when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined. Supported values are (case-insensitive): ``HMACMD5`` (default), ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``.' + type: string + tsigKeyName: + description: The TSIG Key name configured in the DNS. If ``tsigSecretSecretRef`` is defined, this field is required. + type: string + tsigSecretSecretRef: + description: The name of the secret containing the TSIG value. If ``tsigKeyName`` is defined, this field is required. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + route53: + description: Use the AWS Route53 API to manage DNS01 challenge records. + type: object + required: + - region + properties: + accessKeyID: + description: 'The AccessKeyID is used for authentication. If not set we fall-back to using env vars, shared credentials file or AWS Instance metadata see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials' + type: string + hostedZoneID: + description: If set, the provider will manage only this zone in Route53 and will not do an lookup using the route53:ListHostedZonesByName api call. + type: string + region: + description: Always set the region when using AccessKeyID and SecretAccessKey + type: string + role: + description: Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata + type: string + secretAccessKeySecretRef: + description: The SecretAccessKey is used for authentication. If not set we fall-back to using env vars, shared credentials file or AWS Instance metadata https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + webhook: + description: Configure an external webhook based DNS01 challenge solver to manage DNS01 challenge records. + type: object + required: + - groupName + - solverName + properties: + config: + description: Additional configuration that should be passed to the webhook apiserver when challenges are processed. This can contain arbitrary JSON data. Secret values should not be specified in this stanza. If secret values are needed (e.g. credentials for a DNS service), you should use a SecretKeySelector to reference a Secret resource. For details on the schema of this field, consult the webhook provider implementation's documentation. + x-kubernetes-preserve-unknown-fields: true + groupName: + description: The API group name that should be used when POSTing ChallengePayload resources to the webhook apiserver. This should be the same as the GroupName specified in the webhook provider implementation. + type: string + solverName: + description: The name of the solver to use, as defined in the webhook provider implementation. This will typically be the name of the provider, e.g. 'cloudflare'. + type: string + http01: + description: Configures cert-manager to attempt to complete authorizations by performing the HTTP01 challenge flow. It is not possible to obtain certificates for wildcard domain names (e.g. `*.example.com`) using the HTTP01 challenge mechanism. + type: object + properties: + gatewayHTTPRoute: + description: The Gateway API is a sig-network community API that models service networking in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will create HTTPRoutes with the specified labels in the same namespace as the challenge. This solver is experimental, and fields / behaviour may change in the future. + type: object + properties: + labels: + description: The labels that cert-manager will use when creating the temporary HTTPRoute needed for solving the HTTP-01 challenge. These labels must match the label selector of at least one Gateway. + type: object + additionalProperties: + type: string + serviceType: + description: Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort. + type: string + ingress: + description: The ingress based HTTP01 challenge solver will solve challenges by creating or modifying Ingress resources in order to route requests for '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are provisioned by cert-manager for each Challenge to be completed. + type: object + properties: + class: + description: The ingress class to use when creating Ingress resources to solve ACME challenges that use this challenge solver. Only one of 'class' or 'name' may be specified. + type: string + ingressTemplate: + description: Optional ingress template used to configure the ACME challenge solver ingress used for HTTP01 challenges + type: object + properties: + metadata: + description: ObjectMeta overrides for the ingress used to solve HTTP01 challenges. Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. + type: object + properties: + annotations: + description: Annotations that should be added to the created ACME HTTP01 solver ingress. + type: object + additionalProperties: + type: string + labels: + description: Labels that should be added to the created ACME HTTP01 solver ingress. + type: object + additionalProperties: + type: string + name: + description: The name of the ingress resource that should have ACME challenge solving routes inserted into it in order to solve HTTP01 challenges. This is typically used in conjunction with ingress controllers like ingress-gce, which maintains a 1:1 mapping between external IPs and ingress resources. + type: string + podTemplate: + description: Optional pod template used to configure the ACME challenge solver pods used for HTTP01 challenges. + type: object + properties: + metadata: + description: ObjectMeta overrides for the pod used to solve HTTP01 challenges. Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. + type: object + properties: + annotations: + description: Annotations that should be added to the create ACME HTTP01 solver pods. + type: object + additionalProperties: + type: string + labels: + description: Labels that should be added to the created ACME HTTP01 solver pods. + type: object + additionalProperties: + type: string + spec: + description: PodSpec defines overrides for the HTTP01 challenge solver pod. Only the 'priorityClassName', 'nodeSelector', 'affinity', 'serviceAccountName' and 'tolerations' fields are supported currently. All other fields will be ignored. + type: object + properties: + affinity: + description: If specified, the pod's scheduling constraints + type: object + properties: + nodeAffinity: + description: Describes node affinity scheduling rules for the pod. + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred. + type: array + items: + description: An empty preferred scheduling term matches all objects with implicit weight 0 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + type: object + required: + - preference + - weight + properties: + preference: + description: A node selector term, associated with the corresponding weight. + type: object + properties: + matchExpressions: + description: A list of node selector requirements by node's labels. + type: array + items: + description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchFields: + description: A list of node selector requirements by node's fields. + type: array + items: + description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array + items: + type: string + weight: + description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. + type: integer + format: int32 + requiredDuringSchedulingIgnoredDuringExecution: + description: If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node. + type: object + required: + - nodeSelectorTerms + properties: + nodeSelectorTerms: + description: Required. A list of node selector terms. The terms are ORed. + type: array + items: + description: A null or empty node selector term matches no objects. The requirements of them are ANDed. The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + type: object + properties: + matchExpressions: + description: A list of node selector requirements by node's labels. + type: array + items: + description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchFields: + description: A list of node selector requirements by node's fields. + type: array + items: + description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array + items: + type: string + podAffinity: + description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. + type: array + items: + description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + type: object + required: + - podAffinityTerm + - weight + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated with the corresponding weight. + type: object + required: + - topologyKey + properties: + labelSelector: + description: A label query over a set of resources, in this case pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaceSelector: + description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. This field is beta-level and is only honored when PodAffinityNamespaceSelector feature is enabled. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaces: + description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace" + type: array + items: + type: string + topologyKey: + description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + type: string + weight: + description: weight associated with matching the corresponding podAffinityTerm, in the range 1-100. + type: integer + format: int32 + requiredDuringSchedulingIgnoredDuringExecution: + description: If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. + type: array + items: + description: Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running + type: object + required: + - topologyKey + properties: + labelSelector: + description: A label query over a set of resources, in this case pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaceSelector: + description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. This field is beta-level and is only honored when PodAffinityNamespaceSelector feature is enabled. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaces: + description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace" + type: array + items: + type: string + topologyKey: + description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + type: string + podAntiAffinity: + description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods to nodes that satisfy the anti-affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. + type: array + items: + description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + type: object + required: + - podAffinityTerm + - weight + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated with the corresponding weight. + type: object + required: + - topologyKey + properties: + labelSelector: + description: A label query over a set of resources, in this case pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaceSelector: + description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. This field is beta-level and is only honored when PodAffinityNamespaceSelector feature is enabled. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaces: + description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace" + type: array + items: + type: string + topologyKey: + description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + type: string + weight: + description: weight associated with matching the corresponding podAffinityTerm, in the range 1-100. + type: integer + format: int32 + requiredDuringSchedulingIgnoredDuringExecution: + description: If the anti-affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the anti-affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. + type: array + items: + description: Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running + type: object + required: + - topologyKey + properties: + labelSelector: + description: A label query over a set of resources, in this case pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaceSelector: + description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. This field is beta-level and is only honored when PodAffinityNamespaceSelector feature is enabled. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaces: + description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace" + type: array + items: + type: string + topologyKey: + description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + type: string + nodeSelector: + description: 'NodeSelector is a selector which must be true for the pod to fit on a node. Selector which must match a node''s labels for the pod to be scheduled on that node. More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/' + type: object + additionalProperties: + type: string + priorityClassName: + description: If specified, the pod's priorityClassName. + type: string + serviceAccountName: + description: If specified, the pod's service account + type: string + tolerations: + description: If specified, the pod's tolerations. + type: array + items: + description: The pod this Toleration is attached to tolerates any taint that matches the triple using the matching operator . + type: object + properties: + effect: + description: Effect indicates the taint effect to match. Empty means match all taint effects. When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: Key is the taint key that the toleration applies to. Empty means match all taint keys. If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: Operator represents a key's relationship to the value. Valid operators are Exists and Equal. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: TolerationSeconds represents the period of time the toleration (which must be of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system. + type: integer + format: int64 + value: + description: Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + serviceType: + description: Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort. + type: string + selector: + description: Selector selects a set of DNSNames on the Certificate resource that should be solved using this challenge solver. If not specified, the solver will be treated as the 'default' solver with the lowest priority, i.e. if any other solver has a more specific match, it will be used instead. + type: object + properties: + dnsNames: + description: List of DNSNames that this solver will be used to solve. If specified and a match is found, a dnsNames selector will take precedence over a dnsZones selector. If multiple solvers match with the same dnsNames value, the solver with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected. + type: array + items: + type: string + dnsZones: + description: List of DNSZones that this solver will be used to solve. The most specific DNS zone match specified here will take precedence over other DNS zone matches, so a solver specifying sys.example.com will be selected over one specifying example.com for the domain www.sys.example.com. If multiple solvers match with the same dnsZones value, the solver with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected. + type: array + items: + type: string + matchLabels: + description: A label selector that is used to refine the set of certificate's that this challenge solver will apply to. + type: object + additionalProperties: + type: string + ca: + description: CA configures this issuer to sign certificates using a signing CA keypair stored in a Secret resource. This is used to build internal PKIs that are managed by cert-manager. + type: object + required: + - secretName + properties: + crlDistributionPoints: + description: The CRL distribution points is an X.509 v3 certificate extension which identifies the location of the CRL from which the revocation of this certificate can be checked. If not set, certificates will be issued without distribution points set. + type: array + items: + type: string + ocspServers: + description: The OCSP server list is an X.509 v3 extension that defines a list of URLs of OCSP responders. The OCSP responders can be queried for the revocation status of an issued certificate. If not set, the certificate will be issued with no OCSP servers set. For example, an OCSP server URL could be "http://ocsp.int-x3.letsencrypt.org". + type: array + items: + type: string + secretName: + description: SecretName is the name of the secret used to sign Certificates issued by this Issuer. + type: string + selfSigned: + description: SelfSigned configures this issuer to 'self sign' certificates using the private key used to create the CertificateRequest object. + type: object + properties: + crlDistributionPoints: + description: The CRL distribution points is an X.509 v3 certificate extension which identifies the location of the CRL from which the revocation of this certificate can be checked. If not set certificate will be issued without CDP. Values are strings. + type: array + items: + type: string + vault: + description: Vault configures this issuer to sign certificates using a HashiCorp Vault PKI backend. + type: object + required: + - auth + - path + - server + properties: + auth: + description: Auth configures how cert-manager authenticates with the Vault server. + type: object + properties: + appRole: + description: AppRole authenticates with Vault using the App Role auth mechanism, with the role and secret stored in a Kubernetes Secret resource. + type: object + required: + - path + - roleId + - secretRef + properties: + path: + description: 'Path where the App Role authentication backend is mounted in Vault, e.g: "approle"' + type: string + roleId: + description: RoleID configured in the App Role authentication backend when setting up the authentication backend in Vault. + type: string + secretRef: + description: Reference to a key in a Secret that contains the App Role secret used to authenticate with Vault. The `key` field must be specified and denotes which entry within the Secret resource is used as the app role secret. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + kubernetes: + description: Kubernetes authenticates with Vault by passing the ServiceAccount token stored in the named Secret resource to the Vault server. + type: object + required: + - role + - secretRef + properties: + mountPath: + description: The Vault mountPath here is the mount path to use when authenticating with Vault. For example, setting a value to `/v1/auth/foo`, will use the path `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the default value "/v1/auth/kubernetes" will be used. + type: string + role: + description: A required field containing the Vault Role to assume. A Role binds a Kubernetes ServiceAccount with a set of Vault policies. + type: string + secretRef: + description: The required Secret field containing a Kubernetes ServiceAccount JWT used for authenticating with Vault. Use of 'ambient credentials' is not supported. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + tokenSecretRef: + description: TokenSecretRef authenticates with Vault by presenting a token. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + caBundle: + description: PEM-encoded CA bundle (base64-encoded) used to validate Vault server certificate. Only used if the Server URL is using HTTPS protocol. This parameter is ignored for plain HTTP protocol connection. If not set the system root certificates are used to validate the TLS connection. + type: string + format: byte + namespace: + description: 'Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows Vault environments to support Secure Multi-tenancy. e.g: "ns1" More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces' + type: string + path: + description: 'Path is the mount path of the Vault PKI backend''s `sign` endpoint, e.g: "my_pki_mount/sign/my-role-name".' + type: string + server: + description: 'Server is the connection address for the Vault server, e.g: "https://vault.example.com:8200".' + type: string + venafi: + description: Venafi configures this issuer to sign certificates using a Venafi TPP or Venafi Cloud policy zone. + type: object + required: + - zone + properties: + cloud: + description: Cloud specifies the Venafi cloud configuration settings. Only one of TPP or Cloud may be specified. + type: object + required: + - apiTokenSecretRef + properties: + apiTokenSecretRef: + description: APITokenSecretRef is a secret key selector for the Venafi Cloud API token. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + url: + description: URL is the base URL for Venafi Cloud. Defaults to "https://api.venafi.cloud/v1". + type: string + tpp: + description: TPP specifies Trust Protection Platform configuration settings. Only one of TPP or Cloud may be specified. + type: object + required: + - credentialsRef + - url + properties: + caBundle: + description: CABundle is a PEM encoded TLS certificate to use to verify connections to the TPP instance. If specified, system roots will not be used and the issuing CA for the TPP instance must be verifiable using the provided root. If not specified, the connection will be verified using the cert-manager system root certificates. + type: string + format: byte + credentialsRef: + description: CredentialsRef is a reference to a Secret containing the username and password for the TPP server. The secret must contain two keys, 'username' and 'password'. + type: object + required: + - name + properties: + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + url: + description: 'URL is the base URL for the vedsdk endpoint of the Venafi TPP instance, for example: "https://tpp.example.com/vedsdk".' + type: string + zone: + description: Zone is the Venafi Policy Zone to use for this issuer. All requests made to the Venafi platform will be restricted by the named zone policy. This field is required. + type: string + status: + description: Status of the Issuer. This is set and managed automatically. + type: object + properties: + acme: + description: ACME specific status options. This field should only be set if the Issuer is configured to use an ACME server to issue certificates. + type: object + properties: + lastRegisteredEmail: + description: LastRegisteredEmail is the email associated with the latest registered ACME account, in order to track changes made to registered account associated with the Issuer + type: string + uri: + description: URI is the unique account identifier, which can also be used to retrieve account details from the CA + type: string + conditions: + description: List of status conditions to indicate the status of a CertificateRequest. Known condition types are `Ready`. + type: array + items: + description: IssuerCondition contains condition information for an Issuer. + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: LastTransitionTime is the timestamp corresponding to the last status change of this condition. + type: string + format: date-time + message: + description: Message is a human readable description of the details of the last transition, complementing reason. + type: string + observedGeneration: + description: If set, this represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.condition[x].observedGeneration is 9, the condition is out of date with respect to the current state of the Issuer. + type: integer + format: int64 + reason: + description: Reason is a brief machine readable explanation for the condition's last transition. + type: string + status: + description: Status of the condition, one of (`True`, `False`, `Unknown`). + type: string + enum: + - "True" + - "False" + - Unknown + type: + description: Type of the condition, known values are (`Ready`). + type: string + served: false + storage: false + - name: v1beta1 + subresources: + status: {} + additionalPrinterColumns: + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + priority: 1 + type: string + - jsonPath: .metadata.creationTimestamp + description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + name: Age + type: date + schema: + openAPIV3Schema: + description: An Issuer represents a certificate issuing authority which can be referenced as part of `issuerRef` fields. It is scoped to a single namespace and can therefore only be referenced by resources within the same namespace. + type: object + required: + - spec + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: Desired state of the Issuer resource. + type: object + properties: + acme: + description: ACME configures this issuer to communicate with a RFC8555 (ACME) server to obtain signed x509 certificates. + type: object + required: + - privateKeySecretRef + - server + properties: + disableAccountKeyGeneration: + description: Enables or disables generating a new ACME account key. If true, the Issuer resource will *not* request a new account but will expect the account key to be supplied via an existing secret. If false, the cert-manager system will generate a new ACME account key for the Issuer. Defaults to false. + type: boolean + email: + description: Email is the email address to be associated with the ACME account. This field is optional, but it is strongly recommended to be set. It will be used to contact you in case of issues with your account or certificates, including expiry notification emails. This field may be updated after the account is initially registered. + type: string + enableDurationFeature: + description: Enables requesting a Not After date on certificates that matches the duration of the certificate. This is not supported by all ACME servers like Let's Encrypt. If set to true when the ACME server does not support it it will create an error on the Order. Defaults to false. + type: boolean + externalAccountBinding: + description: ExternalAccountBinding is a reference to a CA external account of the ACME server. If set, upon registration cert-manager will attempt to associate the given external account credentials with the registered ACME account. + type: object + required: + - keyID + - keySecretRef + properties: + keyAlgorithm: + description: 'Deprecated: keyAlgorithm field exists for historical compatibility reasons and should not be used. The algorithm is now hardcoded to HS256 in golang/x/crypto/acme.' + type: string + enum: + - HS256 + - HS384 + - HS512 + keyID: + description: keyID is the ID of the CA key that the External Account is bound to. + type: string + keySecretRef: + description: keySecretRef is a Secret Key Selector referencing a data item in a Kubernetes Secret which holds the symmetric MAC key of the External Account Binding. The `key` is the index string that is paired with the key data in the Secret and should not be confused with the key data itself, or indeed with the External Account Binding keyID above. The secret key stored in the Secret **must** be un-padded, base64 URL encoded data. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + preferredChain: + description: 'PreferredChain is the chain to use if the ACME server outputs multiple. PreferredChain is no guarantee that this one gets delivered by the ACME endpoint. For example, for Let''s Encrypt''s DST crosssign you would use: "DST Root CA X3" or "ISRG Root X1" for the newer Let''s Encrypt root CA. This value picks the first certificate bundle in the ACME alternative chains that has a certificate with this value as its issuer''s CN' + type: string + maxLength: 64 + privateKeySecretRef: + description: PrivateKey is the name of a Kubernetes Secret resource that will be used to store the automatically generated ACME account private key. Optionally, a `key` may be specified to select a specific entry within the named Secret resource. If `key` is not specified, a default of `tls.key` will be used. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + server: + description: 'Server is the URL used to access the ACME server''s ''directory'' endpoint. For example, for Let''s Encrypt''s staging endpoint, you would use: "https://acme-staging-v02.api.letsencrypt.org/directory". Only ACME v2 endpoints (i.e. RFC 8555) are supported.' + type: string + skipTLSVerify: + description: Enables or disables validation of the ACME server TLS certificate. If true, requests to the ACME server will not have their TLS certificate validated (i.e. insecure connections will be allowed). Only enable this option in development environments. The cert-manager system installed roots will be used to verify connections to the ACME server if this is false. Defaults to false. + type: boolean + solvers: + description: 'Solvers is a list of challenge solvers that will be used to solve ACME challenges for the matching domains. Solver configurations must be provided in order to obtain certificates from an ACME server. For more information, see: https://cert-manager.io/docs/configuration/acme/' + type: array + items: + description: Configures an issuer to solve challenges using the specified options. Only one of HTTP01 or DNS01 may be provided. + type: object + properties: + dns01: + description: Configures cert-manager to attempt to complete authorizations by performing the DNS01 challenge flow. + type: object + properties: + acmeDNS: + description: Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage DNS01 challenge records. + type: object + required: + - accountSecretRef + - host + properties: + accountSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + host: + type: string + akamai: + description: Use the Akamai DNS zone management API to manage DNS01 challenge records. + type: object + required: + - accessTokenSecretRef + - clientSecretSecretRef + - clientTokenSecretRef + - serviceConsumerDomain + properties: + accessTokenSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + clientSecretSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + clientTokenSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + serviceConsumerDomain: + type: string + azureDNS: + description: Use the Microsoft Azure DNS API to manage DNS01 challenge records. + type: object + required: + - resourceGroupName + - subscriptionID + properties: + clientID: + description: if both this and ClientSecret are left unset MSI will be used + type: string + clientSecretSecretRef: + description: if both this and ClientID are left unset MSI will be used + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + environment: + description: name of the Azure environment (default AzurePublicCloud) + type: string + enum: + - AzurePublicCloud + - AzureChinaCloud + - AzureGermanCloud + - AzureUSGovernmentCloud + hostedZoneName: + description: name of the DNS zone that should be used + type: string + managedIdentity: + description: managed identity configuration, can not be used at the same time as clientID, clientSecretSecretRef or tenantID + type: object + properties: + clientID: + description: client ID of the managed identity, can not be used at the same time as resourceID + type: string + resourceID: + description: resource ID of the managed identity, can not be used at the same time as clientID + type: string + resourceGroupName: + description: resource group the DNS zone is located in + type: string + subscriptionID: + description: ID of the Azure subscription + type: string + tenantID: + description: when specifying ClientID and ClientSecret then this field is also needed + type: string + cloudDNS: + description: Use the Google Cloud DNS API to manage DNS01 challenge records. + type: object + required: + - project + properties: + hostedZoneName: + description: HostedZoneName is an optional field that tells cert-manager in which Cloud DNS zone the challenge record has to be created. If left empty cert-manager will automatically choose a zone. + type: string + project: + type: string + serviceAccountSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + cloudflare: + description: Use the Cloudflare API to manage DNS01 challenge records. + type: object + properties: + apiKeySecretRef: + description: 'API key to use to authenticate with Cloudflare. Note: using an API token to authenticate is now the recommended method as it allows greater control of permissions.' + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + apiTokenSecretRef: + description: API token used to authenticate with Cloudflare. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + email: + description: Email of the account, only required when using API key based authentication. + type: string + cnameStrategy: + description: CNAMEStrategy configures how the DNS01 provider should handle CNAME records when found in DNS zones. + type: string + enum: + - None + - Follow + digitalocean: + description: Use the DigitalOcean DNS API to manage DNS01 challenge records. + type: object + required: + - tokenSecretRef + properties: + tokenSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + rfc2136: + description: Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/) to manage DNS01 challenge records. + type: object + required: + - nameserver + properties: + nameserver: + description: The IP address or hostname of an authoritative DNS server supporting RFC2136 in the form host:port. If the host is an IPv6 address it must be enclosed in square brackets (e.g [2001:db8::1]) ; port is optional. This field is required. + type: string + tsigAlgorithm: + description: 'The TSIG Algorithm configured in the DNS supporting RFC2136. Used only when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined. Supported values are (case-insensitive): ``HMACMD5`` (default), ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``.' + type: string + tsigKeyName: + description: The TSIG Key name configured in the DNS. If ``tsigSecretSecretRef`` is defined, this field is required. + type: string + tsigSecretSecretRef: + description: The name of the secret containing the TSIG value. If ``tsigKeyName`` is defined, this field is required. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + route53: + description: Use the AWS Route53 API to manage DNS01 challenge records. + type: object + required: + - region + properties: + accessKeyID: + description: 'The AccessKeyID is used for authentication. If not set we fall-back to using env vars, shared credentials file or AWS Instance metadata see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials' + type: string + hostedZoneID: + description: If set, the provider will manage only this zone in Route53 and will not do an lookup using the route53:ListHostedZonesByName api call. + type: string + region: + description: Always set the region when using AccessKeyID and SecretAccessKey + type: string + role: + description: Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata + type: string + secretAccessKeySecretRef: + description: The SecretAccessKey is used for authentication. If not set we fall-back to using env vars, shared credentials file or AWS Instance metadata https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + webhook: + description: Configure an external webhook based DNS01 challenge solver to manage DNS01 challenge records. + type: object + required: + - groupName + - solverName + properties: + config: + description: Additional configuration that should be passed to the webhook apiserver when challenges are processed. This can contain arbitrary JSON data. Secret values should not be specified in this stanza. If secret values are needed (e.g. credentials for a DNS service), you should use a SecretKeySelector to reference a Secret resource. For details on the schema of this field, consult the webhook provider implementation's documentation. + x-kubernetes-preserve-unknown-fields: true + groupName: + description: The API group name that should be used when POSTing ChallengePayload resources to the webhook apiserver. This should be the same as the GroupName specified in the webhook provider implementation. + type: string + solverName: + description: The name of the solver to use, as defined in the webhook provider implementation. This will typically be the name of the provider, e.g. 'cloudflare'. + type: string + http01: + description: Configures cert-manager to attempt to complete authorizations by performing the HTTP01 challenge flow. It is not possible to obtain certificates for wildcard domain names (e.g. `*.example.com`) using the HTTP01 challenge mechanism. + type: object + properties: + gatewayHTTPRoute: + description: The Gateway API is a sig-network community API that models service networking in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will create HTTPRoutes with the specified labels in the same namespace as the challenge. This solver is experimental, and fields / behaviour may change in the future. + type: object + properties: + labels: + description: The labels that cert-manager will use when creating the temporary HTTPRoute needed for solving the HTTP-01 challenge. These labels must match the label selector of at least one Gateway. + type: object + additionalProperties: + type: string + serviceType: + description: Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort. + type: string + ingress: + description: The ingress based HTTP01 challenge solver will solve challenges by creating or modifying Ingress resources in order to route requests for '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are provisioned by cert-manager for each Challenge to be completed. + type: object + properties: + class: + description: The ingress class to use when creating Ingress resources to solve ACME challenges that use this challenge solver. Only one of 'class' or 'name' may be specified. + type: string + ingressTemplate: + description: Optional ingress template used to configure the ACME challenge solver ingress used for HTTP01 challenges. + type: object + properties: + metadata: + description: ObjectMeta overrides for the ingress used to solve HTTP01 challenges. Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. + type: object + properties: + annotations: + description: Annotations that should be added to the created ACME HTTP01 solver ingress. + type: object + additionalProperties: + type: string + labels: + description: Labels that should be added to the created ACME HTTP01 solver ingress. + type: object + additionalProperties: + type: string + name: + description: The name of the ingress resource that should have ACME challenge solving routes inserted into it in order to solve HTTP01 challenges. This is typically used in conjunction with ingress controllers like ingress-gce, which maintains a 1:1 mapping between external IPs and ingress resources. + type: string + podTemplate: + description: Optional pod template used to configure the ACME challenge solver pods used for HTTP01 challenges + type: object + properties: + metadata: + description: ObjectMeta overrides for the pod used to solve HTTP01 challenges. Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. + type: object + properties: + annotations: + description: Annotations that should be added to the create ACME HTTP01 solver pods. + type: object + additionalProperties: + type: string + labels: + description: Labels that should be added to the created ACME HTTP01 solver pods. + type: object + additionalProperties: + type: string + spec: + description: PodSpec defines overrides for the HTTP01 challenge solver pod. Only the 'priorityClassName', 'nodeSelector', 'affinity', 'serviceAccountName' and 'tolerations' fields are supported currently. All other fields will be ignored. + type: object + properties: + affinity: + description: If specified, the pod's scheduling constraints + type: object + properties: + nodeAffinity: + description: Describes node affinity scheduling rules for the pod. + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred. + type: array + items: + description: An empty preferred scheduling term matches all objects with implicit weight 0 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + type: object + required: + - preference + - weight + properties: + preference: + description: A node selector term, associated with the corresponding weight. + type: object + properties: + matchExpressions: + description: A list of node selector requirements by node's labels. + type: array + items: + description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchFields: + description: A list of node selector requirements by node's fields. + type: array + items: + description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array + items: + type: string + weight: + description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. + type: integer + format: int32 + requiredDuringSchedulingIgnoredDuringExecution: + description: If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node. + type: object + required: + - nodeSelectorTerms + properties: + nodeSelectorTerms: + description: Required. A list of node selector terms. The terms are ORed. + type: array + items: + description: A null or empty node selector term matches no objects. The requirements of them are ANDed. The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + type: object + properties: + matchExpressions: + description: A list of node selector requirements by node's labels. + type: array + items: + description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchFields: + description: A list of node selector requirements by node's fields. + type: array + items: + description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array + items: + type: string + podAffinity: + description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. + type: array + items: + description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + type: object + required: + - podAffinityTerm + - weight + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated with the corresponding weight. + type: object + required: + - topologyKey + properties: + labelSelector: + description: A label query over a set of resources, in this case pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaceSelector: + description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. This field is beta-level and is only honored when PodAffinityNamespaceSelector feature is enabled. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaces: + description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace" + type: array + items: + type: string + topologyKey: + description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + type: string + weight: + description: weight associated with matching the corresponding podAffinityTerm, in the range 1-100. + type: integer + format: int32 + requiredDuringSchedulingIgnoredDuringExecution: + description: If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. + type: array + items: + description: Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running + type: object + required: + - topologyKey + properties: + labelSelector: + description: A label query over a set of resources, in this case pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaceSelector: + description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. This field is beta-level and is only honored when PodAffinityNamespaceSelector feature is enabled. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaces: + description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace" + type: array + items: + type: string + topologyKey: + description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + type: string + podAntiAffinity: + description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods to nodes that satisfy the anti-affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. + type: array + items: + description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + type: object + required: + - podAffinityTerm + - weight + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated with the corresponding weight. + type: object + required: + - topologyKey + properties: + labelSelector: + description: A label query over a set of resources, in this case pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaceSelector: + description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. This field is beta-level and is only honored when PodAffinityNamespaceSelector feature is enabled. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaces: + description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace" + type: array + items: + type: string + topologyKey: + description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + type: string + weight: + description: weight associated with matching the corresponding podAffinityTerm, in the range 1-100. + type: integer + format: int32 + requiredDuringSchedulingIgnoredDuringExecution: + description: If the anti-affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the anti-affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. + type: array + items: + description: Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running + type: object + required: + - topologyKey + properties: + labelSelector: + description: A label query over a set of resources, in this case pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaceSelector: + description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. This field is beta-level and is only honored when PodAffinityNamespaceSelector feature is enabled. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaces: + description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace" + type: array + items: + type: string + topologyKey: + description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + type: string + nodeSelector: + description: 'NodeSelector is a selector which must be true for the pod to fit on a node. Selector which must match a node''s labels for the pod to be scheduled on that node. More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/' + type: object + additionalProperties: + type: string + priorityClassName: + description: If specified, the pod's priorityClassName. + type: string + serviceAccountName: + description: If specified, the pod's service account + type: string + tolerations: + description: If specified, the pod's tolerations. + type: array + items: + description: The pod this Toleration is attached to tolerates any taint that matches the triple using the matching operator . + type: object + properties: + effect: + description: Effect indicates the taint effect to match. Empty means match all taint effects. When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: Key is the taint key that the toleration applies to. Empty means match all taint keys. If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: Operator represents a key's relationship to the value. Valid operators are Exists and Equal. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: TolerationSeconds represents the period of time the toleration (which must be of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system. + type: integer + format: int64 + value: + description: Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + serviceType: + description: Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort. + type: string + selector: + description: Selector selects a set of DNSNames on the Certificate resource that should be solved using this challenge solver. If not specified, the solver will be treated as the 'default' solver with the lowest priority, i.e. if any other solver has a more specific match, it will be used instead. + type: object + properties: + dnsNames: + description: List of DNSNames that this solver will be used to solve. If specified and a match is found, a dnsNames selector will take precedence over a dnsZones selector. If multiple solvers match with the same dnsNames value, the solver with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected. + type: array + items: + type: string + dnsZones: + description: List of DNSZones that this solver will be used to solve. The most specific DNS zone match specified here will take precedence over other DNS zone matches, so a solver specifying sys.example.com will be selected over one specifying example.com for the domain www.sys.example.com. If multiple solvers match with the same dnsZones value, the solver with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected. + type: array + items: + type: string + matchLabels: + description: A label selector that is used to refine the set of certificate's that this challenge solver will apply to. + type: object + additionalProperties: + type: string + ca: + description: CA configures this issuer to sign certificates using a signing CA keypair stored in a Secret resource. This is used to build internal PKIs that are managed by cert-manager. + type: object + required: + - secretName + properties: + crlDistributionPoints: + description: The CRL distribution points is an X.509 v3 certificate extension which identifies the location of the CRL from which the revocation of this certificate can be checked. If not set, certificates will be issued without distribution points set. + type: array + items: + type: string + ocspServers: + description: The OCSP server list is an X.509 v3 extension that defines a list of URLs of OCSP responders. The OCSP responders can be queried for the revocation status of an issued certificate. If not set, the certificate will be issued with no OCSP servers set. For example, an OCSP server URL could be "http://ocsp.int-x3.letsencrypt.org". + type: array + items: + type: string + secretName: + description: SecretName is the name of the secret used to sign Certificates issued by this Issuer. + type: string + selfSigned: + description: SelfSigned configures this issuer to 'self sign' certificates using the private key used to create the CertificateRequest object. + type: object + properties: + crlDistributionPoints: + description: The CRL distribution points is an X.509 v3 certificate extension which identifies the location of the CRL from which the revocation of this certificate can be checked. If not set certificate will be issued without CDP. Values are strings. + type: array + items: + type: string + vault: + description: Vault configures this issuer to sign certificates using a HashiCorp Vault PKI backend. + type: object + required: + - auth + - path + - server + properties: + auth: + description: Auth configures how cert-manager authenticates with the Vault server. + type: object + properties: + appRole: + description: AppRole authenticates with Vault using the App Role auth mechanism, with the role and secret stored in a Kubernetes Secret resource. + type: object + required: + - path + - roleId + - secretRef + properties: + path: + description: 'Path where the App Role authentication backend is mounted in Vault, e.g: "approle"' + type: string + roleId: + description: RoleID configured in the App Role authentication backend when setting up the authentication backend in Vault. + type: string + secretRef: + description: Reference to a key in a Secret that contains the App Role secret used to authenticate with Vault. The `key` field must be specified and denotes which entry within the Secret resource is used as the app role secret. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + kubernetes: + description: Kubernetes authenticates with Vault by passing the ServiceAccount token stored in the named Secret resource to the Vault server. + type: object + required: + - role + - secretRef + properties: + mountPath: + description: The Vault mountPath here is the mount path to use when authenticating with Vault. For example, setting a value to `/v1/auth/foo`, will use the path `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the default value "/v1/auth/kubernetes" will be used. + type: string + role: + description: A required field containing the Vault Role to assume. A Role binds a Kubernetes ServiceAccount with a set of Vault policies. + type: string + secretRef: + description: The required Secret field containing a Kubernetes ServiceAccount JWT used for authenticating with Vault. Use of 'ambient credentials' is not supported. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + tokenSecretRef: + description: TokenSecretRef authenticates with Vault by presenting a token. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + caBundle: + description: PEM-encoded CA bundle (base64-encoded) used to validate Vault server certificate. Only used if the Server URL is using HTTPS protocol. This parameter is ignored for plain HTTP protocol connection. If not set the system root certificates are used to validate the TLS connection. + type: string + format: byte + namespace: + description: 'Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows Vault environments to support Secure Multi-tenancy. e.g: "ns1" More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces' + type: string + path: + description: 'Path is the mount path of the Vault PKI backend''s `sign` endpoint, e.g: "my_pki_mount/sign/my-role-name".' + type: string + server: + description: 'Server is the connection address for the Vault server, e.g: "https://vault.example.com:8200".' + type: string + venafi: + description: Venafi configures this issuer to sign certificates using a Venafi TPP or Venafi Cloud policy zone. + type: object + required: + - zone + properties: + cloud: + description: Cloud specifies the Venafi cloud configuration settings. Only one of TPP or Cloud may be specified. + type: object + required: + - apiTokenSecretRef + properties: + apiTokenSecretRef: + description: APITokenSecretRef is a secret key selector for the Venafi Cloud API token. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + url: + description: URL is the base URL for Venafi Cloud. Defaults to "https://api.venafi.cloud/v1". + type: string + tpp: + description: TPP specifies Trust Protection Platform configuration settings. Only one of TPP or Cloud may be specified. + type: object + required: + - credentialsRef + - url + properties: + caBundle: + description: CABundle is a PEM encoded TLS certificate to use to verify connections to the TPP instance. If specified, system roots will not be used and the issuing CA for the TPP instance must be verifiable using the provided root. If not specified, the connection will be verified using the cert-manager system root certificates. + type: string + format: byte + credentialsRef: + description: CredentialsRef is a reference to a Secret containing the username and password for the TPP server. The secret must contain two keys, 'username' and 'password'. + type: object + required: + - name + properties: + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + url: + description: 'URL is the base URL for the vedsdk endpoint of the Venafi TPP instance, for example: "https://tpp.example.com/vedsdk".' + type: string + zone: + description: Zone is the Venafi Policy Zone to use for this issuer. All requests made to the Venafi platform will be restricted by the named zone policy. This field is required. + type: string + status: + description: Status of the Issuer. This is set and managed automatically. + type: object + properties: + acme: + description: ACME specific status options. This field should only be set if the Issuer is configured to use an ACME server to issue certificates. + type: object + properties: + lastRegisteredEmail: + description: LastRegisteredEmail is the email associated with the latest registered ACME account, in order to track changes made to registered account associated with the Issuer + type: string + uri: + description: URI is the unique account identifier, which can also be used to retrieve account details from the CA + type: string + conditions: + description: List of status conditions to indicate the status of a CertificateRequest. Known condition types are `Ready`. + type: array + items: + description: IssuerCondition contains condition information for an Issuer. + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: LastTransitionTime is the timestamp corresponding to the last status change of this condition. + type: string + format: date-time + message: + description: Message is a human readable description of the details of the last transition, complementing reason. + type: string + observedGeneration: + description: If set, this represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.condition[x].observedGeneration is 9, the condition is out of date with respect to the current state of the Issuer. + type: integer + format: int64 + reason: + description: Reason is a brief machine readable explanation for the condition's last transition. + type: string + status: + description: Status of the condition, one of (`True`, `False`, `Unknown`). + type: string + enum: + - "True" + - "False" + - Unknown + type: + description: Type of the condition, known values are (`Ready`). + type: string + served: false + storage: false + - name: v1 + subresources: + status: {} + additionalPrinterColumns: + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + priority: 1 + type: string + - jsonPath: .metadata.creationTimestamp + description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + name: Age + type: date + schema: + openAPIV3Schema: + description: An Issuer represents a certificate issuing authority which can be referenced as part of `issuerRef` fields. It is scoped to a single namespace and can therefore only be referenced by resources within the same namespace. + type: object + required: + - spec + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: Desired state of the Issuer resource. + type: object + properties: + acme: + description: ACME configures this issuer to communicate with a RFC8555 (ACME) server to obtain signed x509 certificates. + type: object + required: + - privateKeySecretRef + - server + properties: + disableAccountKeyGeneration: + description: Enables or disables generating a new ACME account key. If true, the Issuer resource will *not* request a new account but will expect the account key to be supplied via an existing secret. If false, the cert-manager system will generate a new ACME account key for the Issuer. Defaults to false. + type: boolean + email: + description: Email is the email address to be associated with the ACME account. This field is optional, but it is strongly recommended to be set. It will be used to contact you in case of issues with your account or certificates, including expiry notification emails. This field may be updated after the account is initially registered. + type: string + enableDurationFeature: + description: Enables requesting a Not After date on certificates that matches the duration of the certificate. This is not supported by all ACME servers like Let's Encrypt. If set to true when the ACME server does not support it it will create an error on the Order. Defaults to false. + type: boolean + externalAccountBinding: + description: ExternalAccountBinding is a reference to a CA external account of the ACME server. If set, upon registration cert-manager will attempt to associate the given external account credentials with the registered ACME account. + type: object + required: + - keyID + - keySecretRef + properties: + keyAlgorithm: + description: 'Deprecated: keyAlgorithm field exists for historical compatibility reasons and should not be used. The algorithm is now hardcoded to HS256 in golang/x/crypto/acme.' + type: string + enum: + - HS256 + - HS384 + - HS512 + keyID: + description: keyID is the ID of the CA key that the External Account is bound to. + type: string + keySecretRef: + description: keySecretRef is a Secret Key Selector referencing a data item in a Kubernetes Secret which holds the symmetric MAC key of the External Account Binding. The `key` is the index string that is paired with the key data in the Secret and should not be confused with the key data itself, or indeed with the External Account Binding keyID above. The secret key stored in the Secret **must** be un-padded, base64 URL encoded data. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + preferredChain: + description: 'PreferredChain is the chain to use if the ACME server outputs multiple. PreferredChain is no guarantee that this one gets delivered by the ACME endpoint. For example, for Let''s Encrypt''s DST crosssign you would use: "DST Root CA X3" or "ISRG Root X1" for the newer Let''s Encrypt root CA. This value picks the first certificate bundle in the ACME alternative chains that has a certificate with this value as its issuer''s CN' + type: string + maxLength: 64 + privateKeySecretRef: + description: PrivateKey is the name of a Kubernetes Secret resource that will be used to store the automatically generated ACME account private key. Optionally, a `key` may be specified to select a specific entry within the named Secret resource. If `key` is not specified, a default of `tls.key` will be used. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + server: + description: 'Server is the URL used to access the ACME server''s ''directory'' endpoint. For example, for Let''s Encrypt''s staging endpoint, you would use: "https://acme-staging-v02.api.letsencrypt.org/directory". Only ACME v2 endpoints (i.e. RFC 8555) are supported.' + type: string + skipTLSVerify: + description: Enables or disables validation of the ACME server TLS certificate. If true, requests to the ACME server will not have their TLS certificate validated (i.e. insecure connections will be allowed). Only enable this option in development environments. The cert-manager system installed roots will be used to verify connections to the ACME server if this is false. Defaults to false. + type: boolean + solvers: + description: 'Solvers is a list of challenge solvers that will be used to solve ACME challenges for the matching domains. Solver configurations must be provided in order to obtain certificates from an ACME server. For more information, see: https://cert-manager.io/docs/configuration/acme/' + type: array + items: + description: An ACMEChallengeSolver describes how to solve ACME challenges for the issuer it is part of. A selector may be provided to use different solving strategies for different DNS names. Only one of HTTP01 or DNS01 must be provided. + type: object + properties: + dns01: + description: Configures cert-manager to attempt to complete authorizations by performing the DNS01 challenge flow. + type: object + properties: + acmeDNS: + description: Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage DNS01 challenge records. + type: object + required: + - accountSecretRef + - host + properties: + accountSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + host: + type: string + akamai: + description: Use the Akamai DNS zone management API to manage DNS01 challenge records. + type: object + required: + - accessTokenSecretRef + - clientSecretSecretRef + - clientTokenSecretRef + - serviceConsumerDomain + properties: + accessTokenSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + clientSecretSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + clientTokenSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + serviceConsumerDomain: + type: string + azureDNS: + description: Use the Microsoft Azure DNS API to manage DNS01 challenge records. + type: object + required: + - resourceGroupName + - subscriptionID + properties: + clientID: + description: if both this and ClientSecret are left unset MSI will be used + type: string + clientSecretSecretRef: + description: if both this and ClientID are left unset MSI will be used + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + environment: + description: name of the Azure environment (default AzurePublicCloud) + type: string + enum: + - AzurePublicCloud + - AzureChinaCloud + - AzureGermanCloud + - AzureUSGovernmentCloud + hostedZoneName: + description: name of the DNS zone that should be used + type: string + managedIdentity: + description: managed identity configuration, can not be used at the same time as clientID, clientSecretSecretRef or tenantID + type: object + properties: + clientID: + description: client ID of the managed identity, can not be used at the same time as resourceID + type: string + resourceID: + description: resource ID of the managed identity, can not be used at the same time as clientID + type: string + resourceGroupName: + description: resource group the DNS zone is located in + type: string + subscriptionID: + description: ID of the Azure subscription + type: string + tenantID: + description: when specifying ClientID and ClientSecret then this field is also needed + type: string + cloudDNS: + description: Use the Google Cloud DNS API to manage DNS01 challenge records. + type: object + required: + - project + properties: + hostedZoneName: + description: HostedZoneName is an optional field that tells cert-manager in which Cloud DNS zone the challenge record has to be created. If left empty cert-manager will automatically choose a zone. + type: string + project: + type: string + serviceAccountSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + cloudflare: + description: Use the Cloudflare API to manage DNS01 challenge records. + type: object + properties: + apiKeySecretRef: + description: 'API key to use to authenticate with Cloudflare. Note: using an API token to authenticate is now the recommended method as it allows greater control of permissions.' + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + apiTokenSecretRef: + description: API token used to authenticate with Cloudflare. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + email: + description: Email of the account, only required when using API key based authentication. + type: string + cnameStrategy: + description: CNAMEStrategy configures how the DNS01 provider should handle CNAME records when found in DNS zones. + type: string + enum: + - None + - Follow + digitalocean: + description: Use the DigitalOcean DNS API to manage DNS01 challenge records. + type: object + required: + - tokenSecretRef + properties: + tokenSecretRef: + description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + rfc2136: + description: Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/) to manage DNS01 challenge records. + type: object + required: + - nameserver + properties: + nameserver: + description: The IP address or hostname of an authoritative DNS server supporting RFC2136 in the form host:port. If the host is an IPv6 address it must be enclosed in square brackets (e.g [2001:db8::1]) ; port is optional. This field is required. + type: string + tsigAlgorithm: + description: 'The TSIG Algorithm configured in the DNS supporting RFC2136. Used only when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined. Supported values are (case-insensitive): ``HMACMD5`` (default), ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``.' + type: string + tsigKeyName: + description: The TSIG Key name configured in the DNS. If ``tsigSecretSecretRef`` is defined, this field is required. + type: string + tsigSecretSecretRef: + description: The name of the secret containing the TSIG value. If ``tsigKeyName`` is defined, this field is required. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + route53: + description: Use the AWS Route53 API to manage DNS01 challenge records. + type: object + required: + - region + properties: + accessKeyID: + description: 'The AccessKeyID is used for authentication. If not set we fall-back to using env vars, shared credentials file or AWS Instance metadata see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials' + type: string + hostedZoneID: + description: If set, the provider will manage only this zone in Route53 and will not do an lookup using the route53:ListHostedZonesByName api call. + type: string + region: + description: Always set the region when using AccessKeyID and SecretAccessKey + type: string + role: + description: Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata + type: string + secretAccessKeySecretRef: + description: The SecretAccessKey is used for authentication. If not set we fall-back to using env vars, shared credentials file or AWS Instance metadata https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + webhook: + description: Configure an external webhook based DNS01 challenge solver to manage DNS01 challenge records. + type: object + required: + - groupName + - solverName + properties: + config: + description: Additional configuration that should be passed to the webhook apiserver when challenges are processed. This can contain arbitrary JSON data. Secret values should not be specified in this stanza. If secret values are needed (e.g. credentials for a DNS service), you should use a SecretKeySelector to reference a Secret resource. For details on the schema of this field, consult the webhook provider implementation's documentation. + x-kubernetes-preserve-unknown-fields: true + groupName: + description: The API group name that should be used when POSTing ChallengePayload resources to the webhook apiserver. This should be the same as the GroupName specified in the webhook provider implementation. + type: string + solverName: + description: The name of the solver to use, as defined in the webhook provider implementation. This will typically be the name of the provider, e.g. 'cloudflare'. + type: string + http01: + description: Configures cert-manager to attempt to complete authorizations by performing the HTTP01 challenge flow. It is not possible to obtain certificates for wildcard domain names (e.g. `*.example.com`) using the HTTP01 challenge mechanism. + type: object + properties: + gatewayHTTPRoute: + description: The Gateway API is a sig-network community API that models service networking in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will create HTTPRoutes with the specified labels in the same namespace as the challenge. This solver is experimental, and fields / behaviour may change in the future. + type: object + properties: + labels: + description: The labels that cert-manager will use when creating the temporary HTTPRoute needed for solving the HTTP-01 challenge. These labels must match the label selector of at least one Gateway. + type: object + additionalProperties: + type: string + serviceType: + description: Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort. + type: string + ingress: + description: The ingress based HTTP01 challenge solver will solve challenges by creating or modifying Ingress resources in order to route requests for '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are provisioned by cert-manager for each Challenge to be completed. + type: object + properties: + class: + description: The ingress class to use when creating Ingress resources to solve ACME challenges that use this challenge solver. Only one of 'class' or 'name' may be specified. + type: string + ingressTemplate: + description: Optional ingress template used to configure the ACME challenge solver ingress used for HTTP01 challenges. + type: object + properties: + metadata: + description: ObjectMeta overrides for the ingress used to solve HTTP01 challenges. Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. + type: object + properties: + annotations: + description: Annotations that should be added to the created ACME HTTP01 solver ingress. + type: object + additionalProperties: + type: string + labels: + description: Labels that should be added to the created ACME HTTP01 solver ingress. + type: object + additionalProperties: + type: string + name: + description: The name of the ingress resource that should have ACME challenge solving routes inserted into it in order to solve HTTP01 challenges. This is typically used in conjunction with ingress controllers like ingress-gce, which maintains a 1:1 mapping between external IPs and ingress resources. + type: string + podTemplate: + description: Optional pod template used to configure the ACME challenge solver pods used for HTTP01 challenges. + type: object + properties: + metadata: + description: ObjectMeta overrides for the pod used to solve HTTP01 challenges. Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. + type: object + properties: + annotations: + description: Annotations that should be added to the create ACME HTTP01 solver pods. + type: object + additionalProperties: + type: string + labels: + description: Labels that should be added to the created ACME HTTP01 solver pods. + type: object + additionalProperties: + type: string + spec: + description: PodSpec defines overrides for the HTTP01 challenge solver pod. Only the 'priorityClassName', 'nodeSelector', 'affinity', 'serviceAccountName' and 'tolerations' fields are supported currently. All other fields will be ignored. + type: object + properties: + affinity: + description: If specified, the pod's scheduling constraints + type: object + properties: + nodeAffinity: + description: Describes node affinity scheduling rules for the pod. + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred. + type: array + items: + description: An empty preferred scheduling term matches all objects with implicit weight 0 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + type: object + required: + - preference + - weight + properties: + preference: + description: A node selector term, associated with the corresponding weight. + type: object + properties: + matchExpressions: + description: A list of node selector requirements by node's labels. + type: array + items: + description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchFields: + description: A list of node selector requirements by node's fields. + type: array + items: + description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array + items: + type: string + weight: + description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. + type: integer + format: int32 + requiredDuringSchedulingIgnoredDuringExecution: + description: If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node. + type: object + required: + - nodeSelectorTerms + properties: + nodeSelectorTerms: + description: Required. A list of node selector terms. The terms are ORed. + type: array + items: + description: A null or empty node selector term matches no objects. The requirements of them are ANDed. The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + type: object + properties: + matchExpressions: + description: A list of node selector requirements by node's labels. + type: array + items: + description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchFields: + description: A list of node selector requirements by node's fields. + type: array + items: + description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array + items: + type: string + podAffinity: + description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. + type: array + items: + description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + type: object + required: + - podAffinityTerm + - weight + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated with the corresponding weight. + type: object + required: + - topologyKey + properties: + labelSelector: + description: A label query over a set of resources, in this case pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaceSelector: + description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. This field is beta-level and is only honored when PodAffinityNamespaceSelector feature is enabled. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaces: + description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace" + type: array + items: + type: string + topologyKey: + description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + type: string + weight: + description: weight associated with matching the corresponding podAffinityTerm, in the range 1-100. + type: integer + format: int32 + requiredDuringSchedulingIgnoredDuringExecution: + description: If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. + type: array + items: + description: Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running + type: object + required: + - topologyKey + properties: + labelSelector: + description: A label query over a set of resources, in this case pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaceSelector: + description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. This field is beta-level and is only honored when PodAffinityNamespaceSelector feature is enabled. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaces: + description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace" + type: array + items: + type: string + topologyKey: + description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + type: string + podAntiAffinity: + description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods to nodes that satisfy the anti-affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. + type: array + items: + description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + type: object + required: + - podAffinityTerm + - weight + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated with the corresponding weight. + type: object + required: + - topologyKey + properties: + labelSelector: + description: A label query over a set of resources, in this case pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaceSelector: + description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. This field is beta-level and is only honored when PodAffinityNamespaceSelector feature is enabled. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaces: + description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace" + type: array + items: + type: string + topologyKey: + description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + type: string + weight: + description: weight associated with matching the corresponding podAffinityTerm, in the range 1-100. + type: integer + format: int32 + requiredDuringSchedulingIgnoredDuringExecution: + description: If the anti-affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the anti-affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. + type: array + items: + description: Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running + type: object + required: + - topologyKey + properties: + labelSelector: + description: A label query over a set of resources, in this case pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaceSelector: + description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. This field is beta-level and is only honored when PodAffinityNamespaceSelector feature is enabled. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array + items: + type: string + matchLabels: + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + namespaces: + description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace" + type: array + items: + type: string + topologyKey: + description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + type: string + nodeSelector: + description: 'NodeSelector is a selector which must be true for the pod to fit on a node. Selector which must match a node''s labels for the pod to be scheduled on that node. More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/' + type: object + additionalProperties: + type: string + priorityClassName: + description: If specified, the pod's priorityClassName. + type: string + serviceAccountName: + description: If specified, the pod's service account + type: string + tolerations: + description: If specified, the pod's tolerations. + type: array + items: + description: The pod this Toleration is attached to tolerates any taint that matches the triple using the matching operator . + type: object + properties: + effect: + description: Effect indicates the taint effect to match. Empty means match all taint effects. When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: Key is the taint key that the toleration applies to. Empty means match all taint keys. If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: Operator represents a key's relationship to the value. Valid operators are Exists and Equal. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: TolerationSeconds represents the period of time the toleration (which must be of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system. + type: integer + format: int64 + value: + description: Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + serviceType: + description: Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort. + type: string + selector: + description: Selector selects a set of DNSNames on the Certificate resource that should be solved using this challenge solver. If not specified, the solver will be treated as the 'default' solver with the lowest priority, i.e. if any other solver has a more specific match, it will be used instead. + type: object + properties: + dnsNames: + description: List of DNSNames that this solver will be used to solve. If specified and a match is found, a dnsNames selector will take precedence over a dnsZones selector. If multiple solvers match with the same dnsNames value, the solver with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected. + type: array + items: + type: string + dnsZones: + description: List of DNSZones that this solver will be used to solve. The most specific DNS zone match specified here will take precedence over other DNS zone matches, so a solver specifying sys.example.com will be selected over one specifying example.com for the domain www.sys.example.com. If multiple solvers match with the same dnsZones value, the solver with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected. + type: array + items: + type: string + matchLabels: + description: A label selector that is used to refine the set of certificate's that this challenge solver will apply to. + type: object + additionalProperties: + type: string + ca: + description: CA configures this issuer to sign certificates using a signing CA keypair stored in a Secret resource. This is used to build internal PKIs that are managed by cert-manager. + type: object + required: + - secretName + properties: + crlDistributionPoints: + description: The CRL distribution points is an X.509 v3 certificate extension which identifies the location of the CRL from which the revocation of this certificate can be checked. If not set, certificates will be issued without distribution points set. + type: array + items: + type: string + ocspServers: + description: The OCSP server list is an X.509 v3 extension that defines a list of URLs of OCSP responders. The OCSP responders can be queried for the revocation status of an issued certificate. If not set, the certificate will be issued with no OCSP servers set. For example, an OCSP server URL could be "http://ocsp.int-x3.letsencrypt.org". + type: array + items: + type: string + secretName: + description: SecretName is the name of the secret used to sign Certificates issued by this Issuer. + type: string + selfSigned: + description: SelfSigned configures this issuer to 'self sign' certificates using the private key used to create the CertificateRequest object. + type: object + properties: + crlDistributionPoints: + description: The CRL distribution points is an X.509 v3 certificate extension which identifies the location of the CRL from which the revocation of this certificate can be checked. If not set certificate will be issued without CDP. Values are strings. + type: array + items: + type: string + vault: + description: Vault configures this issuer to sign certificates using a HashiCorp Vault PKI backend. + type: object + required: + - auth + - path + - server + properties: + auth: + description: Auth configures how cert-manager authenticates with the Vault server. + type: object + properties: + appRole: + description: AppRole authenticates with Vault using the App Role auth mechanism, with the role and secret stored in a Kubernetes Secret resource. + type: object + required: + - path + - roleId + - secretRef + properties: + path: + description: 'Path where the App Role authentication backend is mounted in Vault, e.g: "approle"' + type: string + roleId: + description: RoleID configured in the App Role authentication backend when setting up the authentication backend in Vault. + type: string + secretRef: + description: Reference to a key in a Secret that contains the App Role secret used to authenticate with Vault. The `key` field must be specified and denotes which entry within the Secret resource is used as the app role secret. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + kubernetes: + description: Kubernetes authenticates with Vault by passing the ServiceAccount token stored in the named Secret resource to the Vault server. + type: object + required: + - role + - secretRef + properties: + mountPath: + description: The Vault mountPath here is the mount path to use when authenticating with Vault. For example, setting a value to `/v1/auth/foo`, will use the path `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the default value "/v1/auth/kubernetes" will be used. + type: string + role: + description: A required field containing the Vault Role to assume. A Role binds a Kubernetes ServiceAccount with a set of Vault policies. + type: string + secretRef: + description: The required Secret field containing a Kubernetes ServiceAccount JWT used for authenticating with Vault. Use of 'ambient credentials' is not supported. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + tokenSecretRef: + description: TokenSecretRef authenticates with Vault by presenting a token. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + caBundle: + description: PEM-encoded CA bundle (base64-encoded) used to validate Vault server certificate. Only used if the Server URL is using HTTPS protocol. This parameter is ignored for plain HTTP protocol connection. If not set the system root certificates are used to validate the TLS connection. + type: string + format: byte + namespace: + description: 'Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows Vault environments to support Secure Multi-tenancy. e.g: "ns1" More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces' + type: string + path: + description: 'Path is the mount path of the Vault PKI backend''s `sign` endpoint, e.g: "my_pki_mount/sign/my-role-name".' + type: string + server: + description: 'Server is the connection address for the Vault server, e.g: "https://vault.example.com:8200".' + type: string + venafi: + description: Venafi configures this issuer to sign certificates using a Venafi TPP or Venafi Cloud policy zone. + type: object + required: + - zone + properties: + cloud: + description: Cloud specifies the Venafi cloud configuration settings. Only one of TPP or Cloud may be specified. + type: object + required: + - apiTokenSecretRef + properties: + apiTokenSecretRef: + description: APITokenSecretRef is a secret key selector for the Venafi Cloud API token. + type: object + required: + - name + properties: + key: + description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + type: string + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + url: + description: URL is the base URL for Venafi Cloud. Defaults to "https://api.venafi.cloud/v1". + type: string + tpp: + description: TPP specifies Trust Protection Platform configuration settings. Only one of TPP or Cloud may be specified. + type: object + required: + - credentialsRef + - url + properties: + caBundle: + description: CABundle is a PEM encoded TLS certificate to use to verify connections to the TPP instance. If specified, system roots will not be used and the issuing CA for the TPP instance must be verifiable using the provided root. If not specified, the connection will be verified using the cert-manager system root certificates. + type: string + format: byte + credentialsRef: + description: CredentialsRef is a reference to a Secret containing the username and password for the TPP server. The secret must contain two keys, 'username' and 'password'. + type: object + required: + - name + properties: + name: + description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + url: + description: 'URL is the base URL for the vedsdk endpoint of the Venafi TPP instance, for example: "https://tpp.example.com/vedsdk".' + type: string + zone: + description: Zone is the Venafi Policy Zone to use for this issuer. All requests made to the Venafi platform will be restricted by the named zone policy. This field is required. + type: string + status: + description: Status of the Issuer. This is set and managed automatically. + type: object + properties: + acme: + description: ACME specific status options. This field should only be set if the Issuer is configured to use an ACME server to issue certificates. + type: object + properties: + lastRegisteredEmail: + description: LastRegisteredEmail is the email associated with the latest registered ACME account, in order to track changes made to registered account associated with the Issuer + type: string + uri: + description: URI is the unique account identifier, which can also be used to retrieve account details from the CA + type: string + conditions: + description: List of status conditions to indicate the status of a CertificateRequest. Known condition types are `Ready`. + type: array + items: + description: IssuerCondition contains condition information for an Issuer. + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: LastTransitionTime is the timestamp corresponding to the last status change of this condition. + type: string + format: date-time + message: + description: Message is a human readable description of the details of the last transition, complementing reason. + type: string + observedGeneration: + description: If set, this represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.condition[x].observedGeneration is 9, the condition is out of date with respect to the current state of the Issuer. + type: integer + format: int64 + reason: + description: Reason is a brief machine readable explanation for the condition's last transition. + type: string + status: + description: Status of the condition, one of (`True`, `False`, `Unknown`). + type: string + enum: + - "True" + - "False" + - Unknown + type: + description: Type of the condition, known values are (`Ready`). + type: string + served: true + storage: true +--- +# Source: cert-manager/templates/templates.out +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: orders.acme.cert-manager.io + annotations: + cert-manager.io/inject-ca-from-secret: 'cert-manager/cert-manager-webhook-ca' + labels: + app: 'cert-manager' + app.kubernetes.io/name: 'cert-manager' + app.kubernetes.io/instance: 'cert-manager' + # Generated labels + app.kubernetes.io/version: "v1.6.3" +spec: + group: acme.cert-manager.io + names: + kind: Order + listKind: OrderList + plural: orders + singular: order + categories: + - cert-manager + - cert-manager-acme + scope: Namespaced + conversion: + # a Webhook strategy instruct API server to call an external webhook for any conversion between custom resources. + strategy: Webhook + # webhookClientConfig is required when strategy is `Webhook` and it configures the webhook endpoint to be called by API server. + webhook: + # We don't actually support `v1beta1` but is listed here as it is a + # required value for [Kubernetes v1.16](kubernetes/kubernetes#82023). The + # API server reads the supported versions in order, so _should always_ + # attempt a `v1` request which is understood by the cert-manager webhook. + # Any `v1beta1` request will return an error and fail closed for that + # resource (the whole object request is rejected). + # When we no longer support v1.16 we can remove `v1beta1` from this list. + conversionReviewVersions: ["v1", "v1beta1"] + clientConfig: + # + service: + name: 'cert-manager-webhook' + namespace: "cert-manager" + path: /convert + # + versions: + - name: v1alpha2 + subresources: + status: {} + additionalPrinterColumns: + - jsonPath: .status.state + name: State + type: string + - jsonPath: .spec.issuerRef.name + name: Issuer + priority: 1 + type: string + - jsonPath: .status.reason + name: Reason + priority: 1 + type: string + - jsonPath: .metadata.creationTimestamp + description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + name: Age + type: date + schema: + openAPIV3Schema: + description: Order is a type to represent an Order with an ACME server + type: object + required: + - metadata + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + type: object + required: + - csr + - issuerRef + properties: + commonName: + description: CommonName is the common name as specified on the DER encoded CSR. If specified, this value must also be present in `dnsNames` or `ipAddresses`. This field must match the corresponding field on the DER encoded CSR. + type: string + csr: + description: Certificate signing request bytes in DER encoding. This will be used when finalizing the order. This field must be set on the order. + type: string + format: byte + dnsNames: + description: DNSNames is a list of DNS names that should be included as part of the Order validation process. This field must match the corresponding field on the DER encoded CSR. + type: array + items: + type: string + duration: + description: Duration is the duration for the not after date for the requested certificate. this is set on order creation as pe the ACME spec. + type: string + ipAddresses: + description: IPAddresses is a list of IP addresses that should be included as part of the Order validation process. This field must match the corresponding field on the DER encoded CSR. + type: array + items: + type: string + issuerRef: + description: IssuerRef references a properly configured ACME-type Issuer which should be used to create this Order. If the Issuer does not exist, processing will be retried. If the Issuer is not an 'ACME' Issuer, an error will be returned and the Order will be marked as failed. + type: object + required: + - name + properties: + group: + description: Group of the resource being referred to. + type: string + kind: + description: Kind of the resource being referred to. + type: string + name: + description: Name of the resource being referred to. + type: string + status: + type: object + properties: + authorizations: + description: Authorizations contains data returned from the ACME server on what authorizations must be completed in order to validate the DNS names specified on the Order. + type: array + items: + description: ACMEAuthorization contains data returned from the ACME server on an authorization that must be completed in order validate a DNS name on an ACME Order resource. + type: object + required: + - url + properties: + challenges: + description: Challenges specifies the challenge types offered by the ACME server. One of these challenge types will be selected when validating the DNS name and an appropriate Challenge resource will be created to perform the ACME challenge process. + type: array + items: + description: Challenge specifies a challenge offered by the ACME server for an Order. An appropriate Challenge resource can be created to perform the ACME challenge process. + type: object + required: + - token + - type + - url + properties: + token: + description: Token is the token that must be presented for this challenge. This is used to compute the 'key' that must also be presented. + type: string + type: + description: Type is the type of challenge being offered, e.g. 'http-01', 'dns-01', 'tls-sni-01', etc. This is the raw value retrieved from the ACME server. Only 'http-01' and 'dns-01' are supported by cert-manager, other values will be ignored. + type: string + url: + description: URL is the URL of this challenge. It can be used to retrieve additional metadata about the Challenge from the ACME server. + type: string + identifier: + description: Identifier is the DNS name to be validated as part of this authorization + type: string + initialState: + description: InitialState is the initial state of the ACME authorization when first fetched from the ACME server. If an Authorization is already 'valid', the Order controller will not create a Challenge resource for the authorization. This will occur when working with an ACME server that enables 'authz reuse' (such as Let's Encrypt's production endpoint). If not set and 'identifier' is set, the state is assumed to be pending and a Challenge will be created. + type: string + enum: + - valid + - ready + - pending + - processing + - invalid + - expired + - errored + url: + description: URL is the URL of the Authorization that must be completed + type: string + wildcard: + description: Wildcard will be true if this authorization is for a wildcard DNS name. If this is true, the identifier will be the *non-wildcard* version of the DNS name. For example, if '*.example.com' is the DNS name being validated, this field will be 'true' and the 'identifier' field will be 'example.com'. + type: boolean + certificate: + description: Certificate is a copy of the PEM encoded certificate for this Order. This field will be populated after the order has been successfully finalized with the ACME server, and the order has transitioned to the 'valid' state. + type: string + format: byte + failureTime: + description: FailureTime stores the time that this order failed. This is used to influence garbage collection and back-off. + type: string + format: date-time + finalizeURL: + description: FinalizeURL of the Order. This is used to obtain certificates for this order once it has been completed. + type: string + reason: + description: Reason optionally provides more information about a why the order is in the current state. + type: string + state: + description: State contains the current state of this Order resource. States 'success' and 'expired' are 'final' + type: string + enum: + - valid + - ready + - pending + - processing + - invalid + - expired + - errored + url: + description: URL of the Order. This will initially be empty when the resource is first created. The Order controller will populate this field when the Order is first processed. This field will be immutable after it is initially set. + type: string + served: false + storage: false + - name: v1alpha3 + subresources: + status: {} + additionalPrinterColumns: + - jsonPath: .status.state + name: State + type: string + - jsonPath: .spec.issuerRef.name + name: Issuer + priority: 1 + type: string + - jsonPath: .status.reason + name: Reason + priority: 1 + type: string + - jsonPath: .metadata.creationTimestamp + description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + name: Age + type: date + schema: + openAPIV3Schema: + description: Order is a type to represent an Order with an ACME server + type: object + required: + - metadata + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + type: object + required: + - csr + - issuerRef + properties: + commonName: + description: CommonName is the common name as specified on the DER encoded CSR. If specified, this value must also be present in `dnsNames` or `ipAddresses`. This field must match the corresponding field on the DER encoded CSR. + type: string + csr: + description: Certificate signing request bytes in DER encoding. This will be used when finalizing the order. This field must be set on the order. + type: string + format: byte + dnsNames: + description: DNSNames is a list of DNS names that should be included as part of the Order validation process. This field must match the corresponding field on the DER encoded CSR. + type: array + items: + type: string + duration: + description: Duration is the duration for the not after date for the requested certificate. this is set on order creation as pe the ACME spec. + type: string + ipAddresses: + description: IPAddresses is a list of IP addresses that should be included as part of the Order validation process. This field must match the corresponding field on the DER encoded CSR. + type: array + items: + type: string + issuerRef: + description: IssuerRef references a properly configured ACME-type Issuer which should be used to create this Order. If the Issuer does not exist, processing will be retried. If the Issuer is not an 'ACME' Issuer, an error will be returned and the Order will be marked as failed. + type: object + required: + - name + properties: + group: + description: Group of the resource being referred to. + type: string + kind: + description: Kind of the resource being referred to. + type: string + name: + description: Name of the resource being referred to. + type: string + status: + type: object + properties: + authorizations: + description: Authorizations contains data returned from the ACME server on what authorizations must be completed in order to validate the DNS names specified on the Order. + type: array + items: + description: ACMEAuthorization contains data returned from the ACME server on an authorization that must be completed in order validate a DNS name on an ACME Order resource. + type: object + required: + - url + properties: + challenges: + description: Challenges specifies the challenge types offered by the ACME server. One of these challenge types will be selected when validating the DNS name and an appropriate Challenge resource will be created to perform the ACME challenge process. + type: array + items: + description: Challenge specifies a challenge offered by the ACME server for an Order. An appropriate Challenge resource can be created to perform the ACME challenge process. + type: object + required: + - token + - type + - url + properties: + token: + description: Token is the token that must be presented for this challenge. This is used to compute the 'key' that must also be presented. + type: string + type: + description: Type is the type of challenge being offered, e.g. 'http-01', 'dns-01', 'tls-sni-01', etc. This is the raw value retrieved from the ACME server. Only 'http-01' and 'dns-01' are supported by cert-manager, other values will be ignored. + type: string + url: + description: URL is the URL of this challenge. It can be used to retrieve additional metadata about the Challenge from the ACME server. + type: string + identifier: + description: Identifier is the DNS name to be validated as part of this authorization + type: string + initialState: + description: InitialState is the initial state of the ACME authorization when first fetched from the ACME server. If an Authorization is already 'valid', the Order controller will not create a Challenge resource for the authorization. This will occur when working with an ACME server that enables 'authz reuse' (such as Let's Encrypt's production endpoint). If not set and 'identifier' is set, the state is assumed to be pending and a Challenge will be created. + type: string + enum: + - valid + - ready + - pending + - processing + - invalid + - expired + - errored + url: + description: URL is the URL of the Authorization that must be completed + type: string + wildcard: + description: Wildcard will be true if this authorization is for a wildcard DNS name. If this is true, the identifier will be the *non-wildcard* version of the DNS name. For example, if '*.example.com' is the DNS name being validated, this field will be 'true' and the 'identifier' field will be 'example.com'. + type: boolean + certificate: + description: Certificate is a copy of the PEM encoded certificate for this Order. This field will be populated after the order has been successfully finalized with the ACME server, and the order has transitioned to the 'valid' state. + type: string + format: byte + failureTime: + description: FailureTime stores the time that this order failed. This is used to influence garbage collection and back-off. + type: string + format: date-time + finalizeURL: + description: FinalizeURL of the Order. This is used to obtain certificates for this order once it has been completed. + type: string + reason: + description: Reason optionally provides more information about a why the order is in the current state. + type: string + state: + description: State contains the current state of this Order resource. States 'success' and 'expired' are 'final' + type: string + enum: + - valid + - ready + - pending + - processing + - invalid + - expired + - errored + url: + description: URL of the Order. This will initially be empty when the resource is first created. The Order controller will populate this field when the Order is first processed. This field will be immutable after it is initially set. + type: string + served: false + storage: false + - name: v1beta1 + subresources: + status: {} + additionalPrinterColumns: + - jsonPath: .status.state + name: State + type: string + - jsonPath: .spec.issuerRef.name + name: Issuer + priority: 1 + type: string + - jsonPath: .status.reason + name: Reason + priority: 1 + type: string + - jsonPath: .metadata.creationTimestamp + description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + name: Age + type: date + schema: + openAPIV3Schema: + description: Order is a type to represent an Order with an ACME server + type: object + required: + - metadata + - spec + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + type: object + required: + - issuerRef + - request + properties: + commonName: + description: CommonName is the common name as specified on the DER encoded CSR. If specified, this value must also be present in `dnsNames` or `ipAddresses`. This field must match the corresponding field on the DER encoded CSR. + type: string + dnsNames: + description: DNSNames is a list of DNS names that should be included as part of the Order validation process. This field must match the corresponding field on the DER encoded CSR. + type: array + items: + type: string + duration: + description: Duration is the duration for the not after date for the requested certificate. this is set on order creation as pe the ACME spec. + type: string + ipAddresses: + description: IPAddresses is a list of IP addresses that should be included as part of the Order validation process. This field must match the corresponding field on the DER encoded CSR. + type: array + items: + type: string + issuerRef: + description: IssuerRef references a properly configured ACME-type Issuer which should be used to create this Order. If the Issuer does not exist, processing will be retried. If the Issuer is not an 'ACME' Issuer, an error will be returned and the Order will be marked as failed. + type: object + required: + - name + properties: + group: + description: Group of the resource being referred to. + type: string + kind: + description: Kind of the resource being referred to. + type: string + name: + description: Name of the resource being referred to. + type: string + request: + description: Certificate signing request bytes in DER encoding. This will be used when finalizing the order. This field must be set on the order. + type: string + format: byte + status: + type: object + properties: + authorizations: + description: Authorizations contains data returned from the ACME server on what authorizations must be completed in order to validate the DNS names specified on the Order. + type: array + items: + description: ACMEAuthorization contains data returned from the ACME server on an authorization that must be completed in order validate a DNS name on an ACME Order resource. + type: object + required: + - url + properties: + challenges: + description: Challenges specifies the challenge types offered by the ACME server. One of these challenge types will be selected when validating the DNS name and an appropriate Challenge resource will be created to perform the ACME challenge process. + type: array + items: + description: Challenge specifies a challenge offered by the ACME server for an Order. An appropriate Challenge resource can be created to perform the ACME challenge process. + type: object + required: + - token + - type + - url + properties: + token: + description: Token is the token that must be presented for this challenge. This is used to compute the 'key' that must also be presented. + type: string + type: + description: Type is the type of challenge being offered, e.g. 'http-01', 'dns-01', 'tls-sni-01', etc. This is the raw value retrieved from the ACME server. Only 'http-01' and 'dns-01' are supported by cert-manager, other values will be ignored. + type: string + url: + description: URL is the URL of this challenge. It can be used to retrieve additional metadata about the Challenge from the ACME server. + type: string + identifier: + description: Identifier is the DNS name to be validated as part of this authorization + type: string + initialState: + description: InitialState is the initial state of the ACME authorization when first fetched from the ACME server. If an Authorization is already 'valid', the Order controller will not create a Challenge resource for the authorization. This will occur when working with an ACME server that enables 'authz reuse' (such as Let's Encrypt's production endpoint). If not set and 'identifier' is set, the state is assumed to be pending and a Challenge will be created. + type: string + enum: + - valid + - ready + - pending + - processing + - invalid + - expired + - errored + url: + description: URL is the URL of the Authorization that must be completed + type: string + wildcard: + description: Wildcard will be true if this authorization is for a wildcard DNS name. If this is true, the identifier will be the *non-wildcard* version of the DNS name. For example, if '*.example.com' is the DNS name being validated, this field will be 'true' and the 'identifier' field will be 'example.com'. + type: boolean + certificate: + description: Certificate is a copy of the PEM encoded certificate for this Order. This field will be populated after the order has been successfully finalized with the ACME server, and the order has transitioned to the 'valid' state. + type: string + format: byte + failureTime: + description: FailureTime stores the time that this order failed. This is used to influence garbage collection and back-off. + type: string + format: date-time + finalizeURL: + description: FinalizeURL of the Order. This is used to obtain certificates for this order once it has been completed. + type: string + reason: + description: Reason optionally provides more information about a why the order is in the current state. + type: string + state: + description: State contains the current state of this Order resource. States 'success' and 'expired' are 'final' + type: string + enum: + - valid + - ready + - pending + - processing + - invalid + - expired + - errored + url: + description: URL of the Order. This will initially be empty when the resource is first created. The Order controller will populate this field when the Order is first processed. This field will be immutable after it is initially set. + type: string + served: false + storage: false + - name: v1 + subresources: + status: {} + additionalPrinterColumns: + - jsonPath: .status.state + name: State + type: string + - jsonPath: .spec.issuerRef.name + name: Issuer + priority: 1 + type: string + - jsonPath: .status.reason + name: Reason + priority: 1 + type: string + - jsonPath: .metadata.creationTimestamp + description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + name: Age + type: date + schema: + openAPIV3Schema: + description: Order is a type to represent an Order with an ACME server + type: object + required: + - metadata + - spec + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + type: object + required: + - issuerRef + - request + properties: + commonName: + description: CommonName is the common name as specified on the DER encoded CSR. If specified, this value must also be present in `dnsNames` or `ipAddresses`. This field must match the corresponding field on the DER encoded CSR. + type: string + dnsNames: + description: DNSNames is a list of DNS names that should be included as part of the Order validation process. This field must match the corresponding field on the DER encoded CSR. + type: array + items: + type: string + duration: + description: Duration is the duration for the not after date for the requested certificate. this is set on order creation as pe the ACME spec. + type: string + ipAddresses: + description: IPAddresses is a list of IP addresses that should be included as part of the Order validation process. This field must match the corresponding field on the DER encoded CSR. + type: array + items: + type: string + issuerRef: + description: IssuerRef references a properly configured ACME-type Issuer which should be used to create this Order. If the Issuer does not exist, processing will be retried. If the Issuer is not an 'ACME' Issuer, an error will be returned and the Order will be marked as failed. + type: object + required: + - name + properties: + group: + description: Group of the resource being referred to. + type: string + kind: + description: Kind of the resource being referred to. + type: string + name: + description: Name of the resource being referred to. + type: string + request: + description: Certificate signing request bytes in DER encoding. This will be used when finalizing the order. This field must be set on the order. + type: string + format: byte + status: + type: object + properties: + authorizations: + description: Authorizations contains data returned from the ACME server on what authorizations must be completed in order to validate the DNS names specified on the Order. + type: array + items: + description: ACMEAuthorization contains data returned from the ACME server on an authorization that must be completed in order validate a DNS name on an ACME Order resource. + type: object + required: + - url + properties: + challenges: + description: Challenges specifies the challenge types offered by the ACME server. One of these challenge types will be selected when validating the DNS name and an appropriate Challenge resource will be created to perform the ACME challenge process. + type: array + items: + description: Challenge specifies a challenge offered by the ACME server for an Order. An appropriate Challenge resource can be created to perform the ACME challenge process. + type: object + required: + - token + - type + - url + properties: + token: + description: Token is the token that must be presented for this challenge. This is used to compute the 'key' that must also be presented. + type: string + type: + description: Type is the type of challenge being offered, e.g. 'http-01', 'dns-01', 'tls-sni-01', etc. This is the raw value retrieved from the ACME server. Only 'http-01' and 'dns-01' are supported by cert-manager, other values will be ignored. + type: string + url: + description: URL is the URL of this challenge. It can be used to retrieve additional metadata about the Challenge from the ACME server. + type: string + identifier: + description: Identifier is the DNS name to be validated as part of this authorization + type: string + initialState: + description: InitialState is the initial state of the ACME authorization when first fetched from the ACME server. If an Authorization is already 'valid', the Order controller will not create a Challenge resource for the authorization. This will occur when working with an ACME server that enables 'authz reuse' (such as Let's Encrypt's production endpoint). If not set and 'identifier' is set, the state is assumed to be pending and a Challenge will be created. + type: string + enum: + - valid + - ready + - pending + - processing + - invalid + - expired + - errored + url: + description: URL is the URL of the Authorization that must be completed + type: string + wildcard: + description: Wildcard will be true if this authorization is for a wildcard DNS name. If this is true, the identifier will be the *non-wildcard* version of the DNS name. For example, if '*.example.com' is the DNS name being validated, this field will be 'true' and the 'identifier' field will be 'example.com'. + type: boolean + certificate: + description: Certificate is a copy of the PEM encoded certificate for this Order. This field will be populated after the order has been successfully finalized with the ACME server, and the order has transitioned to the 'valid' state. + type: string + format: byte + failureTime: + description: FailureTime stores the time that this order failed. This is used to influence garbage collection and back-off. + type: string + format: date-time + finalizeURL: + description: FinalizeURL of the Order. This is used to obtain certificates for this order once it has been completed. + type: string + reason: + description: Reason optionally provides more information about a why the order is in the current state. + type: string + state: + description: State contains the current state of this Order resource. States 'success' and 'expired' are 'final' + type: string + enum: + - valid + - ready + - pending + - processing + - invalid + - expired + - errored + url: + description: URL of the Order. This will initially be empty when the resource is first created. The Order controller will populate this field when the Order is first processed. This field will be immutable after it is initially set. + type: string + served: true + storage: true diff --git a/docs/ua/modules/admin/attachments/special-steps/jaeger-crd.yaml b/docs/ua/modules/admin/attachments/special-steps/jaeger-crd.yaml new file mode 100644 index 0000000000..3ca20ee2ab --- /dev/null +++ b/docs/ua/modules/admin/attachments/special-steps/jaeger-crd.yaml @@ -0,0 +1,14578 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: jaegers.jaegertracing.io + annotations: + "helm.sh/hook": crd-install + "helm.sh/hook-delete-policy": "before-hook-creation" + labels: + app.kubernetes.io/name: jaeger-operator + app.kubernetes.io/instance: jaeger-operator +spec: + group: jaegertracing.io + names: + kind: Jaeger + listKind: JaegerList + plural: jaegers + singular: jaeger + scope: Namespaced + versions: + - additionalPrinterColumns: + - description: Jaeger instance's status + jsonPath: .status.phase + name: Status + type: string + - description: Jaeger Version + jsonPath: .status.version + name: Version + type: string + - description: Jaeger deployment strategy + jsonPath: .spec.strategy + name: Strategy + type: string + - description: Jaeger storage type + jsonPath: .spec.storage.type + name: Storage + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + type: string + kind: + type: string + metadata: + type: object + spec: + properties: + affinity: + properties: + nodeAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + preference: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + weight: + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + properties: + nodeSelectorTerms: + items: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + type: array + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + podAffinityTerm: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + weight: + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + items: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + type: array + type: object + podAntiAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + podAffinityTerm: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + weight: + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + items: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + type: array + type: object + type: object + agent: + nullable: true + properties: + affinity: + properties: + nodeAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + preference: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + weight: + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + properties: + nodeSelectorTerms: + items: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + type: array + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + podAffinityTerm: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + weight: + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + items: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + type: array + type: object + podAntiAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + podAffinityTerm: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + weight: + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + items: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + type: array + type: object + type: object + annotations: + additionalProperties: + type: string + nullable: true + type: object + config: + type: object + x-kubernetes-preserve-unknown-fields: true + containerSecurityContext: + properties: + allowPrivilegeEscalation: + type: boolean + capabilities: + properties: + add: + items: + type: string + type: array + drop: + items: + type: string + type: array + type: object + privileged: + type: boolean + procMount: + type: string + readOnlyRootFilesystem: + type: boolean + runAsGroup: + format: int64 + type: integer + runAsNonRoot: + type: boolean + runAsUser: + format: int64 + type: integer + seLinuxOptions: + properties: + level: + type: string + role: + type: string + type: + type: string + user: + type: string + type: object + seccompProfile: + properties: + localhostProfile: + type: string + type: + type: string + required: + - type + type: object + windowsOptions: + properties: + gmsaCredentialSpec: + type: string + gmsaCredentialSpecName: + type: string + hostProcess: + type: boolean + runAsUserName: + type: string + type: object + type: object + dnsPolicy: + type: string + hostNetwork: + type: boolean + image: + type: string + imagePullPolicy: + type: string + imagePullSecrets: + items: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + labels: + additionalProperties: + type: string + type: object + livenessProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + options: + type: object + x-kubernetes-preserve-unknown-fields: true + priorityClassName: + type: string + resources: + nullable: true + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: object + securityContext: + properties: + fsGroup: + format: int64 + type: integer + fsGroupChangePolicy: + type: string + runAsGroup: + format: int64 + type: integer + runAsNonRoot: + type: boolean + runAsUser: + format: int64 + type: integer + seLinuxOptions: + properties: + level: + type: string + role: + type: string + type: + type: string + user: + type: string + type: object + seccompProfile: + properties: + localhostProfile: + type: string + type: + type: string + required: + - type + type: object + supplementalGroups: + items: + format: int64 + type: integer + type: array + sysctls: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + windowsOptions: + properties: + gmsaCredentialSpec: + type: string + gmsaCredentialSpecName: + type: string + hostProcess: + type: boolean + runAsUserName: + type: string + type: object + type: object + serviceAccount: + type: string + sidecarSecurityContext: + properties: + allowPrivilegeEscalation: + type: boolean + capabilities: + properties: + add: + items: + type: string + type: array + drop: + items: + type: string + type: array + type: object + privileged: + type: boolean + procMount: + type: string + readOnlyRootFilesystem: + type: boolean + runAsGroup: + format: int64 + type: integer + runAsNonRoot: + type: boolean + runAsUser: + format: int64 + type: integer + seLinuxOptions: + properties: + level: + type: string + role: + type: string + type: + type: string + user: + type: string + type: object + seccompProfile: + properties: + localhostProfile: + type: string + type: + type: string + required: + - type + type: object + windowsOptions: + properties: + gmsaCredentialSpec: + type: string + gmsaCredentialSpecName: + type: string + hostProcess: + type: boolean + runAsUserName: + type: string + type: object + type: object + strategy: + type: string + tolerations: + items: + properties: + effect: + type: string + key: + type: string + operator: + type: string + tolerationSeconds: + format: int64 + type: integer + value: + type: string + type: object + type: array + x-kubernetes-list-type: atomic + volumeMounts: + items: + properties: + mountPath: + type: string + mountPropagation: + type: string + name: + type: string + readOnly: + type: boolean + subPath: + type: string + subPathExpr: + type: string + required: + - mountPath + - name + type: object + type: array + x-kubernetes-list-type: atomic + volumes: + items: + properties: + awsElasticBlockStore: + properties: + fsType: + type: string + partition: + format: int32 + type: integer + readOnly: + type: boolean + volumeID: + type: string + required: + - volumeID + type: object + azureDisk: + properties: + cachingMode: + type: string + diskName: + type: string + diskURI: + type: string + fsType: + type: string + kind: + type: string + readOnly: + type: boolean + required: + - diskName + - diskURI + type: object + azureFile: + properties: + readOnly: + type: boolean + secretName: + type: string + shareName: + type: string + required: + - secretName + - shareName + type: object + cephfs: + properties: + monitors: + items: + type: string + type: array + path: + type: string + readOnly: + type: boolean + secretFile: + type: string + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + user: + type: string + required: + - monitors + type: object + cinder: + properties: + fsType: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + volumeID: + type: string + required: + - volumeID + type: object + configMap: + properties: + defaultMode: + format: int32 + type: integer + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + csi: + properties: + driver: + type: string + fsType: + type: string + nodePublishSecretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + readOnly: + type: boolean + volumeAttributes: + additionalProperties: + type: string + type: object + required: + - driver + type: object + downwardAPI: + properties: + defaultMode: + format: int32 + type: integer + items: + items: + properties: + fieldRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + mode: + format: int32 + type: integer + path: + type: string + resourceFieldRef: + properties: + containerName: + type: string + divisor: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + required: + - path + type: object + type: array + type: object + emptyDir: + properties: + medium: + type: string + sizeLimit: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + ephemeral: + properties: + volumeClaimTemplate: + properties: + metadata: + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + properties: + accessModes: + items: + type: string + type: array + dataSource: + properties: + apiGroup: + type: string + kind: + type: string + name: + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + dataSourceRef: + properties: + apiGroup: + type: string + kind: + type: string + name: + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + resources: + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: object + selector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + storageClassName: + type: string + volumeMode: + type: string + volumeName: + type: string + type: object + required: + - spec + type: object + type: object + fc: + properties: + fsType: + type: string + lun: + format: int32 + type: integer + readOnly: + type: boolean + targetWWNs: + items: + type: string + type: array + wwids: + items: + type: string + type: array + type: object + flexVolume: + properties: + driver: + type: string + fsType: + type: string + options: + additionalProperties: + type: string + type: object + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + required: + - driver + type: object + flocker: + properties: + datasetName: + type: string + datasetUUID: + type: string + type: object + gcePersistentDisk: + properties: + fsType: + type: string + partition: + format: int32 + type: integer + pdName: + type: string + readOnly: + type: boolean + required: + - pdName + type: object + gitRepo: + properties: + directory: + type: string + repository: + type: string + revision: + type: string + required: + - repository + type: object + glusterfs: + properties: + endpoints: + type: string + path: + type: string + readOnly: + type: boolean + required: + - endpoints + - path + type: object + hostPath: + properties: + path: + type: string + type: + type: string + required: + - path + type: object + iscsi: + properties: + chapAuthDiscovery: + type: boolean + chapAuthSession: + type: boolean + fsType: + type: string + initiatorName: + type: string + iqn: + type: string + iscsiInterface: + type: string + lun: + format: int32 + type: integer + portals: + items: + type: string + type: array + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + targetPortal: + type: string + required: + - iqn + - lun + - targetPortal + type: object + name: + type: string + nfs: + properties: + path: + type: string + readOnly: + type: boolean + server: + type: string + required: + - path + - server + type: object + persistentVolumeClaim: + properties: + claimName: + type: string + readOnly: + type: boolean + required: + - claimName + type: object + photonPersistentDisk: + properties: + fsType: + type: string + pdID: + type: string + required: + - pdID + type: object + portworxVolume: + properties: + fsType: + type: string + readOnly: + type: boolean + volumeID: + type: string + required: + - volumeID + type: object + projected: + properties: + defaultMode: + format: int32 + type: integer + sources: + items: + properties: + configMap: + properties: + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + downwardAPI: + properties: + items: + items: + properties: + fieldRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + mode: + format: int32 + type: integer + path: + type: string + resourceFieldRef: + properties: + containerName: + type: string + divisor: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + required: + - path + type: object + type: array + type: object + secret: + properties: + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + serviceAccountToken: + properties: + audience: + type: string + expirationSeconds: + format: int64 + type: integer + path: + type: string + required: + - path + type: object + type: object + type: array + type: object + quobyte: + properties: + group: + type: string + readOnly: + type: boolean + registry: + type: string + tenant: + type: string + user: + type: string + volume: + type: string + required: + - registry + - volume + type: object + rbd: + properties: + fsType: + type: string + image: + type: string + keyring: + type: string + monitors: + items: + type: string + type: array + pool: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + user: + type: string + required: + - image + - monitors + type: object + scaleIO: + properties: + fsType: + type: string + gateway: + type: string + protectionDomain: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + sslEnabled: + type: boolean + storageMode: + type: string + storagePool: + type: string + system: + type: string + volumeName: + type: string + required: + - gateway + - secretRef + - system + type: object + secret: + properties: + defaultMode: + format: int32 + type: integer + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + optional: + type: boolean + secretName: + type: string + type: object + storageos: + properties: + fsType: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + volumeName: + type: string + volumeNamespace: + type: string + type: object + vsphereVolume: + properties: + fsType: + type: string + storagePolicyID: + type: string + storagePolicyName: + type: string + volumePath: + type: string + required: + - volumePath + type: object + required: + - name + type: object + type: array + x-kubernetes-list-type: atomic + type: object + allInOne: + properties: + affinity: + properties: + nodeAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + preference: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + weight: + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + properties: + nodeSelectorTerms: + items: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + type: array + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + podAffinityTerm: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + weight: + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + items: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + type: array + type: object + podAntiAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + podAffinityTerm: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + weight: + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + items: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + type: array + type: object + type: object + annotations: + additionalProperties: + type: string + nullable: true + type: object + config: + type: object + x-kubernetes-preserve-unknown-fields: true + containerSecurityContext: + properties: + allowPrivilegeEscalation: + type: boolean + capabilities: + properties: + add: + items: + type: string + type: array + drop: + items: + type: string + type: array + type: object + privileged: + type: boolean + procMount: + type: string + readOnlyRootFilesystem: + type: boolean + runAsGroup: + format: int64 + type: integer + runAsNonRoot: + type: boolean + runAsUser: + format: int64 + type: integer + seLinuxOptions: + properties: + level: + type: string + role: + type: string + type: + type: string + user: + type: string + type: object + seccompProfile: + properties: + localhostProfile: + type: string + type: + type: string + required: + - type + type: object + windowsOptions: + properties: + gmsaCredentialSpec: + type: string + gmsaCredentialSpecName: + type: string + hostProcess: + type: boolean + runAsUserName: + type: string + type: object + type: object + image: + type: string + imagePullPolicy: + type: string + imagePullSecrets: + items: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + labels: + additionalProperties: + type: string + type: object + livenessProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + metricsStorage: + properties: + type: + type: string + type: object + options: + type: object + x-kubernetes-preserve-unknown-fields: true + resources: + nullable: true + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: object + securityContext: + properties: + fsGroup: + format: int64 + type: integer + fsGroupChangePolicy: + type: string + runAsGroup: + format: int64 + type: integer + runAsNonRoot: + type: boolean + runAsUser: + format: int64 + type: integer + seLinuxOptions: + properties: + level: + type: string + role: + type: string + type: + type: string + user: + type: string + type: object + seccompProfile: + properties: + localhostProfile: + type: string + type: + type: string + required: + - type + type: object + supplementalGroups: + items: + format: int64 + type: integer + type: array + sysctls: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + windowsOptions: + properties: + gmsaCredentialSpec: + type: string + gmsaCredentialSpecName: + type: string + hostProcess: + type: boolean + runAsUserName: + type: string + type: object + type: object + serviceAccount: + type: string + strategy: + properties: + rollingUpdate: + properties: + maxSurge: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + maxUnavailable: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + type: object + type: + type: string + type: object + tolerations: + items: + properties: + effect: + type: string + key: + type: string + operator: + type: string + tolerationSeconds: + format: int64 + type: integer + value: + type: string + type: object + type: array + x-kubernetes-list-type: atomic + tracingEnabled: + type: boolean + volumeMounts: + items: + properties: + mountPath: + type: string + mountPropagation: + type: string + name: + type: string + readOnly: + type: boolean + subPath: + type: string + subPathExpr: + type: string + required: + - mountPath + - name + type: object + type: array + x-kubernetes-list-type: atomic + volumes: + items: + properties: + awsElasticBlockStore: + properties: + fsType: + type: string + partition: + format: int32 + type: integer + readOnly: + type: boolean + volumeID: + type: string + required: + - volumeID + type: object + azureDisk: + properties: + cachingMode: + type: string + diskName: + type: string + diskURI: + type: string + fsType: + type: string + kind: + type: string + readOnly: + type: boolean + required: + - diskName + - diskURI + type: object + azureFile: + properties: + readOnly: + type: boolean + secretName: + type: string + shareName: + type: string + required: + - secretName + - shareName + type: object + cephfs: + properties: + monitors: + items: + type: string + type: array + path: + type: string + readOnly: + type: boolean + secretFile: + type: string + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + user: + type: string + required: + - monitors + type: object + cinder: + properties: + fsType: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + volumeID: + type: string + required: + - volumeID + type: object + configMap: + properties: + defaultMode: + format: int32 + type: integer + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + csi: + properties: + driver: + type: string + fsType: + type: string + nodePublishSecretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + readOnly: + type: boolean + volumeAttributes: + additionalProperties: + type: string + type: object + required: + - driver + type: object + downwardAPI: + properties: + defaultMode: + format: int32 + type: integer + items: + items: + properties: + fieldRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + mode: + format: int32 + type: integer + path: + type: string + resourceFieldRef: + properties: + containerName: + type: string + divisor: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + required: + - path + type: object + type: array + type: object + emptyDir: + properties: + medium: + type: string + sizeLimit: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + ephemeral: + properties: + volumeClaimTemplate: + properties: + metadata: + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + properties: + accessModes: + items: + type: string + type: array + dataSource: + properties: + apiGroup: + type: string + kind: + type: string + name: + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + dataSourceRef: + properties: + apiGroup: + type: string + kind: + type: string + name: + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + resources: + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: object + selector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + storageClassName: + type: string + volumeMode: + type: string + volumeName: + type: string + type: object + required: + - spec + type: object + type: object + fc: + properties: + fsType: + type: string + lun: + format: int32 + type: integer + readOnly: + type: boolean + targetWWNs: + items: + type: string + type: array + wwids: + items: + type: string + type: array + type: object + flexVolume: + properties: + driver: + type: string + fsType: + type: string + options: + additionalProperties: + type: string + type: object + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + required: + - driver + type: object + flocker: + properties: + datasetName: + type: string + datasetUUID: + type: string + type: object + gcePersistentDisk: + properties: + fsType: + type: string + partition: + format: int32 + type: integer + pdName: + type: string + readOnly: + type: boolean + required: + - pdName + type: object + gitRepo: + properties: + directory: + type: string + repository: + type: string + revision: + type: string + required: + - repository + type: object + glusterfs: + properties: + endpoints: + type: string + path: + type: string + readOnly: + type: boolean + required: + - endpoints + - path + type: object + hostPath: + properties: + path: + type: string + type: + type: string + required: + - path + type: object + iscsi: + properties: + chapAuthDiscovery: + type: boolean + chapAuthSession: + type: boolean + fsType: + type: string + initiatorName: + type: string + iqn: + type: string + iscsiInterface: + type: string + lun: + format: int32 + type: integer + portals: + items: + type: string + type: array + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + targetPortal: + type: string + required: + - iqn + - lun + - targetPortal + type: object + name: + type: string + nfs: + properties: + path: + type: string + readOnly: + type: boolean + server: + type: string + required: + - path + - server + type: object + persistentVolumeClaim: + properties: + claimName: + type: string + readOnly: + type: boolean + required: + - claimName + type: object + photonPersistentDisk: + properties: + fsType: + type: string + pdID: + type: string + required: + - pdID + type: object + portworxVolume: + properties: + fsType: + type: string + readOnly: + type: boolean + volumeID: + type: string + required: + - volumeID + type: object + projected: + properties: + defaultMode: + format: int32 + type: integer + sources: + items: + properties: + configMap: + properties: + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + downwardAPI: + properties: + items: + items: + properties: + fieldRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + mode: + format: int32 + type: integer + path: + type: string + resourceFieldRef: + properties: + containerName: + type: string + divisor: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + required: + - path + type: object + type: array + type: object + secret: + properties: + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + serviceAccountToken: + properties: + audience: + type: string + expirationSeconds: + format: int64 + type: integer + path: + type: string + required: + - path + type: object + type: object + type: array + type: object + quobyte: + properties: + group: + type: string + readOnly: + type: boolean + registry: + type: string + tenant: + type: string + user: + type: string + volume: + type: string + required: + - registry + - volume + type: object + rbd: + properties: + fsType: + type: string + image: + type: string + keyring: + type: string + monitors: + items: + type: string + type: array + pool: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + user: + type: string + required: + - image + - monitors + type: object + scaleIO: + properties: + fsType: + type: string + gateway: + type: string + protectionDomain: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + sslEnabled: + type: boolean + storageMode: + type: string + storagePool: + type: string + system: + type: string + volumeName: + type: string + required: + - gateway + - secretRef + - system + type: object + secret: + properties: + defaultMode: + format: int32 + type: integer + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + optional: + type: boolean + secretName: + type: string + type: object + storageos: + properties: + fsType: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + volumeName: + type: string + volumeNamespace: + type: string + type: object + vsphereVolume: + properties: + fsType: + type: string + storagePolicyID: + type: string + storagePolicyName: + type: string + volumePath: + type: string + required: + - volumePath + type: object + required: + - name + type: object + type: array + x-kubernetes-list-type: atomic + type: object + annotations: + additionalProperties: + type: string + nullable: true + type: object + collector: + properties: + affinity: + properties: + nodeAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + preference: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + weight: + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + properties: + nodeSelectorTerms: + items: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + type: array + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + podAffinityTerm: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + weight: + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + items: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + type: array + type: object + podAntiAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + podAffinityTerm: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + weight: + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + items: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + type: array + type: object + type: object + annotations: + additionalProperties: + type: string + nullable: true + type: object + autoscale: + type: boolean + config: + type: object + x-kubernetes-preserve-unknown-fields: true + containerSecurityContext: + properties: + allowPrivilegeEscalation: + type: boolean + capabilities: + properties: + add: + items: + type: string + type: array + drop: + items: + type: string + type: array + type: object + privileged: + type: boolean + procMount: + type: string + readOnlyRootFilesystem: + type: boolean + runAsGroup: + format: int64 + type: integer + runAsNonRoot: + type: boolean + runAsUser: + format: int64 + type: integer + seLinuxOptions: + properties: + level: + type: string + role: + type: string + type: + type: string + user: + type: string + type: object + seccompProfile: + properties: + localhostProfile: + type: string + type: + type: string + required: + - type + type: object + windowsOptions: + properties: + gmsaCredentialSpec: + type: string + gmsaCredentialSpecName: + type: string + hostProcess: + type: boolean + runAsUserName: + type: string + type: object + type: object + image: + type: string + imagePullPolicy: + type: string + imagePullSecrets: + items: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + kafkaSecretName: + type: string + labels: + additionalProperties: + type: string + type: object + livenessProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + maxReplicas: + format: int32 + type: integer + minReplicas: + format: int32 + type: integer + options: + type: object + x-kubernetes-preserve-unknown-fields: true + priorityClassName: + type: string + replicas: + format: int32 + type: integer + resources: + nullable: true + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: object + securityContext: + properties: + fsGroup: + format: int64 + type: integer + fsGroupChangePolicy: + type: string + runAsGroup: + format: int64 + type: integer + runAsNonRoot: + type: boolean + runAsUser: + format: int64 + type: integer + seLinuxOptions: + properties: + level: + type: string + role: + type: string + type: + type: string + user: + type: string + type: object + seccompProfile: + properties: + localhostProfile: + type: string + type: + type: string + required: + - type + type: object + supplementalGroups: + items: + format: int64 + type: integer + type: array + sysctls: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + windowsOptions: + properties: + gmsaCredentialSpec: + type: string + gmsaCredentialSpecName: + type: string + hostProcess: + type: boolean + runAsUserName: + type: string + type: object + type: object + serviceAccount: + type: string + serviceType: + type: string + strategy: + properties: + rollingUpdate: + properties: + maxSurge: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + maxUnavailable: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + type: object + type: + type: string + type: object + tolerations: + items: + properties: + effect: + type: string + key: + type: string + operator: + type: string + tolerationSeconds: + format: int64 + type: integer + value: + type: string + type: object + type: array + x-kubernetes-list-type: atomic + volumeMounts: + items: + properties: + mountPath: + type: string + mountPropagation: + type: string + name: + type: string + readOnly: + type: boolean + subPath: + type: string + subPathExpr: + type: string + required: + - mountPath + - name + type: object + type: array + x-kubernetes-list-type: atomic + volumes: + items: + properties: + awsElasticBlockStore: + properties: + fsType: + type: string + partition: + format: int32 + type: integer + readOnly: + type: boolean + volumeID: + type: string + required: + - volumeID + type: object + azureDisk: + properties: + cachingMode: + type: string + diskName: + type: string + diskURI: + type: string + fsType: + type: string + kind: + type: string + readOnly: + type: boolean + required: + - diskName + - diskURI + type: object + azureFile: + properties: + readOnly: + type: boolean + secretName: + type: string + shareName: + type: string + required: + - secretName + - shareName + type: object + cephfs: + properties: + monitors: + items: + type: string + type: array + path: + type: string + readOnly: + type: boolean + secretFile: + type: string + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + user: + type: string + required: + - monitors + type: object + cinder: + properties: + fsType: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + volumeID: + type: string + required: + - volumeID + type: object + configMap: + properties: + defaultMode: + format: int32 + type: integer + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + csi: + properties: + driver: + type: string + fsType: + type: string + nodePublishSecretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + readOnly: + type: boolean + volumeAttributes: + additionalProperties: + type: string + type: object + required: + - driver + type: object + downwardAPI: + properties: + defaultMode: + format: int32 + type: integer + items: + items: + properties: + fieldRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + mode: + format: int32 + type: integer + path: + type: string + resourceFieldRef: + properties: + containerName: + type: string + divisor: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + required: + - path + type: object + type: array + type: object + emptyDir: + properties: + medium: + type: string + sizeLimit: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + ephemeral: + properties: + volumeClaimTemplate: + properties: + metadata: + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + properties: + accessModes: + items: + type: string + type: array + dataSource: + properties: + apiGroup: + type: string + kind: + type: string + name: + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + dataSourceRef: + properties: + apiGroup: + type: string + kind: + type: string + name: + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + resources: + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: object + selector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + storageClassName: + type: string + volumeMode: + type: string + volumeName: + type: string + type: object + required: + - spec + type: object + type: object + fc: + properties: + fsType: + type: string + lun: + format: int32 + type: integer + readOnly: + type: boolean + targetWWNs: + items: + type: string + type: array + wwids: + items: + type: string + type: array + type: object + flexVolume: + properties: + driver: + type: string + fsType: + type: string + options: + additionalProperties: + type: string + type: object + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + required: + - driver + type: object + flocker: + properties: + datasetName: + type: string + datasetUUID: + type: string + type: object + gcePersistentDisk: + properties: + fsType: + type: string + partition: + format: int32 + type: integer + pdName: + type: string + readOnly: + type: boolean + required: + - pdName + type: object + gitRepo: + properties: + directory: + type: string + repository: + type: string + revision: + type: string + required: + - repository + type: object + glusterfs: + properties: + endpoints: + type: string + path: + type: string + readOnly: + type: boolean + required: + - endpoints + - path + type: object + hostPath: + properties: + path: + type: string + type: + type: string + required: + - path + type: object + iscsi: + properties: + chapAuthDiscovery: + type: boolean + chapAuthSession: + type: boolean + fsType: + type: string + initiatorName: + type: string + iqn: + type: string + iscsiInterface: + type: string + lun: + format: int32 + type: integer + portals: + items: + type: string + type: array + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + targetPortal: + type: string + required: + - iqn + - lun + - targetPortal + type: object + name: + type: string + nfs: + properties: + path: + type: string + readOnly: + type: boolean + server: + type: string + required: + - path + - server + type: object + persistentVolumeClaim: + properties: + claimName: + type: string + readOnly: + type: boolean + required: + - claimName + type: object + photonPersistentDisk: + properties: + fsType: + type: string + pdID: + type: string + required: + - pdID + type: object + portworxVolume: + properties: + fsType: + type: string + readOnly: + type: boolean + volumeID: + type: string + required: + - volumeID + type: object + projected: + properties: + defaultMode: + format: int32 + type: integer + sources: + items: + properties: + configMap: + properties: + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + downwardAPI: + properties: + items: + items: + properties: + fieldRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + mode: + format: int32 + type: integer + path: + type: string + resourceFieldRef: + properties: + containerName: + type: string + divisor: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + required: + - path + type: object + type: array + type: object + secret: + properties: + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + serviceAccountToken: + properties: + audience: + type: string + expirationSeconds: + format: int64 + type: integer + path: + type: string + required: + - path + type: object + type: object + type: array + type: object + quobyte: + properties: + group: + type: string + readOnly: + type: boolean + registry: + type: string + tenant: + type: string + user: + type: string + volume: + type: string + required: + - registry + - volume + type: object + rbd: + properties: + fsType: + type: string + image: + type: string + keyring: + type: string + monitors: + items: + type: string + type: array + pool: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + user: + type: string + required: + - image + - monitors + type: object + scaleIO: + properties: + fsType: + type: string + gateway: + type: string + protectionDomain: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + sslEnabled: + type: boolean + storageMode: + type: string + storagePool: + type: string + system: + type: string + volumeName: + type: string + required: + - gateway + - secretRef + - system + type: object + secret: + properties: + defaultMode: + format: int32 + type: integer + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + optional: + type: boolean + secretName: + type: string + type: object + storageos: + properties: + fsType: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + volumeName: + type: string + volumeNamespace: + type: string + type: object + vsphereVolume: + properties: + fsType: + type: string + storagePolicyID: + type: string + storagePolicyName: + type: string + volumePath: + type: string + required: + - volumePath + type: object + required: + - name + type: object + type: array + x-kubernetes-list-type: atomic + type: object + containerSecurityContext: + properties: + allowPrivilegeEscalation: + type: boolean + capabilities: + properties: + add: + items: + type: string + type: array + drop: + items: + type: string + type: array + type: object + privileged: + type: boolean + procMount: + type: string + readOnlyRootFilesystem: + type: boolean + runAsGroup: + format: int64 + type: integer + runAsNonRoot: + type: boolean + runAsUser: + format: int64 + type: integer + seLinuxOptions: + properties: + level: + type: string + role: + type: string + type: + type: string + user: + type: string + type: object + seccompProfile: + properties: + localhostProfile: + type: string + type: + type: string + required: + - type + type: object + windowsOptions: + properties: + gmsaCredentialSpec: + type: string + gmsaCredentialSpecName: + type: string + hostProcess: + type: boolean + runAsUserName: + type: string + type: object + type: object + imagePullPolicy: + type: string + imagePullSecrets: + items: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + ingester: + properties: + affinity: + properties: + nodeAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + preference: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + weight: + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + properties: + nodeSelectorTerms: + items: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + type: array + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + podAffinityTerm: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + weight: + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + items: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + type: array + type: object + podAntiAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + podAffinityTerm: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + weight: + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + items: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + type: array + type: object + type: object + annotations: + additionalProperties: + type: string + nullable: true + type: object + autoscale: + type: boolean + config: + type: object + x-kubernetes-preserve-unknown-fields: true + containerSecurityContext: + properties: + allowPrivilegeEscalation: + type: boolean + capabilities: + properties: + add: + items: + type: string + type: array + drop: + items: + type: string + type: array + type: object + privileged: + type: boolean + procMount: + type: string + readOnlyRootFilesystem: + type: boolean + runAsGroup: + format: int64 + type: integer + runAsNonRoot: + type: boolean + runAsUser: + format: int64 + type: integer + seLinuxOptions: + properties: + level: + type: string + role: + type: string + type: + type: string + user: + type: string + type: object + seccompProfile: + properties: + localhostProfile: + type: string + type: + type: string + required: + - type + type: object + windowsOptions: + properties: + gmsaCredentialSpec: + type: string + gmsaCredentialSpecName: + type: string + hostProcess: + type: boolean + runAsUserName: + type: string + type: object + type: object + image: + type: string + imagePullPolicy: + type: string + imagePullSecrets: + items: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + kafkaSecretName: + type: string + labels: + additionalProperties: + type: string + type: object + livenessProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + maxReplicas: + format: int32 + type: integer + minReplicas: + format: int32 + type: integer + options: + type: object + x-kubernetes-preserve-unknown-fields: true + replicas: + format: int32 + type: integer + resources: + nullable: true + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: object + securityContext: + properties: + fsGroup: + format: int64 + type: integer + fsGroupChangePolicy: + type: string + runAsGroup: + format: int64 + type: integer + runAsNonRoot: + type: boolean + runAsUser: + format: int64 + type: integer + seLinuxOptions: + properties: + level: + type: string + role: + type: string + type: + type: string + user: + type: string + type: object + seccompProfile: + properties: + localhostProfile: + type: string + type: + type: string + required: + - type + type: object + supplementalGroups: + items: + format: int64 + type: integer + type: array + sysctls: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + windowsOptions: + properties: + gmsaCredentialSpec: + type: string + gmsaCredentialSpecName: + type: string + hostProcess: + type: boolean + runAsUserName: + type: string + type: object + type: object + serviceAccount: + type: string + strategy: + properties: + rollingUpdate: + properties: + maxSurge: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + maxUnavailable: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + type: object + type: + type: string + type: object + tolerations: + items: + properties: + effect: + type: string + key: + type: string + operator: + type: string + tolerationSeconds: + format: int64 + type: integer + value: + type: string + type: object + type: array + x-kubernetes-list-type: atomic + volumeMounts: + items: + properties: + mountPath: + type: string + mountPropagation: + type: string + name: + type: string + readOnly: + type: boolean + subPath: + type: string + subPathExpr: + type: string + required: + - mountPath + - name + type: object + type: array + x-kubernetes-list-type: atomic + volumes: + items: + properties: + awsElasticBlockStore: + properties: + fsType: + type: string + partition: + format: int32 + type: integer + readOnly: + type: boolean + volumeID: + type: string + required: + - volumeID + type: object + azureDisk: + properties: + cachingMode: + type: string + diskName: + type: string + diskURI: + type: string + fsType: + type: string + kind: + type: string + readOnly: + type: boolean + required: + - diskName + - diskURI + type: object + azureFile: + properties: + readOnly: + type: boolean + secretName: + type: string + shareName: + type: string + required: + - secretName + - shareName + type: object + cephfs: + properties: + monitors: + items: + type: string + type: array + path: + type: string + readOnly: + type: boolean + secretFile: + type: string + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + user: + type: string + required: + - monitors + type: object + cinder: + properties: + fsType: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + volumeID: + type: string + required: + - volumeID + type: object + configMap: + properties: + defaultMode: + format: int32 + type: integer + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + csi: + properties: + driver: + type: string + fsType: + type: string + nodePublishSecretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + readOnly: + type: boolean + volumeAttributes: + additionalProperties: + type: string + type: object + required: + - driver + type: object + downwardAPI: + properties: + defaultMode: + format: int32 + type: integer + items: + items: + properties: + fieldRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + mode: + format: int32 + type: integer + path: + type: string + resourceFieldRef: + properties: + containerName: + type: string + divisor: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + required: + - path + type: object + type: array + type: object + emptyDir: + properties: + medium: + type: string + sizeLimit: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + ephemeral: + properties: + volumeClaimTemplate: + properties: + metadata: + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + properties: + accessModes: + items: + type: string + type: array + dataSource: + properties: + apiGroup: + type: string + kind: + type: string + name: + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + dataSourceRef: + properties: + apiGroup: + type: string + kind: + type: string + name: + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + resources: + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: object + selector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + storageClassName: + type: string + volumeMode: + type: string + volumeName: + type: string + type: object + required: + - spec + type: object + type: object + fc: + properties: + fsType: + type: string + lun: + format: int32 + type: integer + readOnly: + type: boolean + targetWWNs: + items: + type: string + type: array + wwids: + items: + type: string + type: array + type: object + flexVolume: + properties: + driver: + type: string + fsType: + type: string + options: + additionalProperties: + type: string + type: object + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + required: + - driver + type: object + flocker: + properties: + datasetName: + type: string + datasetUUID: + type: string + type: object + gcePersistentDisk: + properties: + fsType: + type: string + partition: + format: int32 + type: integer + pdName: + type: string + readOnly: + type: boolean + required: + - pdName + type: object + gitRepo: + properties: + directory: + type: string + repository: + type: string + revision: + type: string + required: + - repository + type: object + glusterfs: + properties: + endpoints: + type: string + path: + type: string + readOnly: + type: boolean + required: + - endpoints + - path + type: object + hostPath: + properties: + path: + type: string + type: + type: string + required: + - path + type: object + iscsi: + properties: + chapAuthDiscovery: + type: boolean + chapAuthSession: + type: boolean + fsType: + type: string + initiatorName: + type: string + iqn: + type: string + iscsiInterface: + type: string + lun: + format: int32 + type: integer + portals: + items: + type: string + type: array + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + targetPortal: + type: string + required: + - iqn + - lun + - targetPortal + type: object + name: + type: string + nfs: + properties: + path: + type: string + readOnly: + type: boolean + server: + type: string + required: + - path + - server + type: object + persistentVolumeClaim: + properties: + claimName: + type: string + readOnly: + type: boolean + required: + - claimName + type: object + photonPersistentDisk: + properties: + fsType: + type: string + pdID: + type: string + required: + - pdID + type: object + portworxVolume: + properties: + fsType: + type: string + readOnly: + type: boolean + volumeID: + type: string + required: + - volumeID + type: object + projected: + properties: + defaultMode: + format: int32 + type: integer + sources: + items: + properties: + configMap: + properties: + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + downwardAPI: + properties: + items: + items: + properties: + fieldRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + mode: + format: int32 + type: integer + path: + type: string + resourceFieldRef: + properties: + containerName: + type: string + divisor: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + required: + - path + type: object + type: array + type: object + secret: + properties: + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + serviceAccountToken: + properties: + audience: + type: string + expirationSeconds: + format: int64 + type: integer + path: + type: string + required: + - path + type: object + type: object + type: array + type: object + quobyte: + properties: + group: + type: string + readOnly: + type: boolean + registry: + type: string + tenant: + type: string + user: + type: string + volume: + type: string + required: + - registry + - volume + type: object + rbd: + properties: + fsType: + type: string + image: + type: string + keyring: + type: string + monitors: + items: + type: string + type: array + pool: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + user: + type: string + required: + - image + - monitors + type: object + scaleIO: + properties: + fsType: + type: string + gateway: + type: string + protectionDomain: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + sslEnabled: + type: boolean + storageMode: + type: string + storagePool: + type: string + system: + type: string + volumeName: + type: string + required: + - gateway + - secretRef + - system + type: object + secret: + properties: + defaultMode: + format: int32 + type: integer + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + optional: + type: boolean + secretName: + type: string + type: object + storageos: + properties: + fsType: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + volumeName: + type: string + volumeNamespace: + type: string + type: object + vsphereVolume: + properties: + fsType: + type: string + storagePolicyID: + type: string + storagePolicyName: + type: string + volumePath: + type: string + required: + - volumePath + type: object + required: + - name + type: object + type: array + x-kubernetes-list-type: atomic + type: object + ingress: + properties: + affinity: + properties: + nodeAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + preference: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + weight: + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + properties: + nodeSelectorTerms: + items: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + type: array + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + podAffinityTerm: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + weight: + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + items: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + type: array + type: object + podAntiAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + podAffinityTerm: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + weight: + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + items: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + type: array + type: object + type: object + annotations: + additionalProperties: + type: string + nullable: true + type: object + containerSecurityContext: + properties: + allowPrivilegeEscalation: + type: boolean + capabilities: + properties: + add: + items: + type: string + type: array + drop: + items: + type: string + type: array + type: object + privileged: + type: boolean + procMount: + type: string + readOnlyRootFilesystem: + type: boolean + runAsGroup: + format: int64 + type: integer + runAsNonRoot: + type: boolean + runAsUser: + format: int64 + type: integer + seLinuxOptions: + properties: + level: + type: string + role: + type: string + type: + type: string + user: + type: string + type: object + seccompProfile: + properties: + localhostProfile: + type: string + type: + type: string + required: + - type + type: object + windowsOptions: + properties: + gmsaCredentialSpec: + type: string + gmsaCredentialSpecName: + type: string + hostProcess: + type: boolean + runAsUserName: + type: string + type: object + type: object + enabled: + type: boolean + hosts: + items: + type: string + type: array + x-kubernetes-list-type: atomic + imagePullPolicy: + type: string + imagePullSecrets: + items: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + ingressClassName: + type: string + labels: + additionalProperties: + type: string + type: object + livenessProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + openshift: + properties: + delegateUrls: + type: string + htpasswdFile: + type: string + sar: + type: string + skipLogout: + type: boolean + type: object + options: + type: object + x-kubernetes-preserve-unknown-fields: true + pathType: + type: string + resources: + nullable: true + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: object + secretName: + type: string + security: + type: string + securityContext: + properties: + fsGroup: + format: int64 + type: integer + fsGroupChangePolicy: + type: string + runAsGroup: + format: int64 + type: integer + runAsNonRoot: + type: boolean + runAsUser: + format: int64 + type: integer + seLinuxOptions: + properties: + level: + type: string + role: + type: string + type: + type: string + user: + type: string + type: object + seccompProfile: + properties: + localhostProfile: + type: string + type: + type: string + required: + - type + type: object + supplementalGroups: + items: + format: int64 + type: integer + type: array + sysctls: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + windowsOptions: + properties: + gmsaCredentialSpec: + type: string + gmsaCredentialSpecName: + type: string + hostProcess: + type: boolean + runAsUserName: + type: string + type: object + type: object + serviceAccount: + type: string + tls: + items: + properties: + hosts: + items: + type: string + type: array + x-kubernetes-list-type: atomic + secretName: + type: string + type: object + type: array + x-kubernetes-list-type: atomic + tolerations: + items: + properties: + effect: + type: string + key: + type: string + operator: + type: string + tolerationSeconds: + format: int64 + type: integer + value: + type: string + type: object + type: array + x-kubernetes-list-type: atomic + volumeMounts: + items: + properties: + mountPath: + type: string + mountPropagation: + type: string + name: + type: string + readOnly: + type: boolean + subPath: + type: string + subPathExpr: + type: string + required: + - mountPath + - name + type: object + type: array + x-kubernetes-list-type: atomic + volumes: + items: + properties: + awsElasticBlockStore: + properties: + fsType: + type: string + partition: + format: int32 + type: integer + readOnly: + type: boolean + volumeID: + type: string + required: + - volumeID + type: object + azureDisk: + properties: + cachingMode: + type: string + diskName: + type: string + diskURI: + type: string + fsType: + type: string + kind: + type: string + readOnly: + type: boolean + required: + - diskName + - diskURI + type: object + azureFile: + properties: + readOnly: + type: boolean + secretName: + type: string + shareName: + type: string + required: + - secretName + - shareName + type: object + cephfs: + properties: + monitors: + items: + type: string + type: array + path: + type: string + readOnly: + type: boolean + secretFile: + type: string + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + user: + type: string + required: + - monitors + type: object + cinder: + properties: + fsType: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + volumeID: + type: string + required: + - volumeID + type: object + configMap: + properties: + defaultMode: + format: int32 + type: integer + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + csi: + properties: + driver: + type: string + fsType: + type: string + nodePublishSecretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + readOnly: + type: boolean + volumeAttributes: + additionalProperties: + type: string + type: object + required: + - driver + type: object + downwardAPI: + properties: + defaultMode: + format: int32 + type: integer + items: + items: + properties: + fieldRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + mode: + format: int32 + type: integer + path: + type: string + resourceFieldRef: + properties: + containerName: + type: string + divisor: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + required: + - path + type: object + type: array + type: object + emptyDir: + properties: + medium: + type: string + sizeLimit: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + ephemeral: + properties: + volumeClaimTemplate: + properties: + metadata: + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + properties: + accessModes: + items: + type: string + type: array + dataSource: + properties: + apiGroup: + type: string + kind: + type: string + name: + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + dataSourceRef: + properties: + apiGroup: + type: string + kind: + type: string + name: + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + resources: + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: object + selector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + storageClassName: + type: string + volumeMode: + type: string + volumeName: + type: string + type: object + required: + - spec + type: object + type: object + fc: + properties: + fsType: + type: string + lun: + format: int32 + type: integer + readOnly: + type: boolean + targetWWNs: + items: + type: string + type: array + wwids: + items: + type: string + type: array + type: object + flexVolume: + properties: + driver: + type: string + fsType: + type: string + options: + additionalProperties: + type: string + type: object + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + required: + - driver + type: object + flocker: + properties: + datasetName: + type: string + datasetUUID: + type: string + type: object + gcePersistentDisk: + properties: + fsType: + type: string + partition: + format: int32 + type: integer + pdName: + type: string + readOnly: + type: boolean + required: + - pdName + type: object + gitRepo: + properties: + directory: + type: string + repository: + type: string + revision: + type: string + required: + - repository + type: object + glusterfs: + properties: + endpoints: + type: string + path: + type: string + readOnly: + type: boolean + required: + - endpoints + - path + type: object + hostPath: + properties: + path: + type: string + type: + type: string + required: + - path + type: object + iscsi: + properties: + chapAuthDiscovery: + type: boolean + chapAuthSession: + type: boolean + fsType: + type: string + initiatorName: + type: string + iqn: + type: string + iscsiInterface: + type: string + lun: + format: int32 + type: integer + portals: + items: + type: string + type: array + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + targetPortal: + type: string + required: + - iqn + - lun + - targetPortal + type: object + name: + type: string + nfs: + properties: + path: + type: string + readOnly: + type: boolean + server: + type: string + required: + - path + - server + type: object + persistentVolumeClaim: + properties: + claimName: + type: string + readOnly: + type: boolean + required: + - claimName + type: object + photonPersistentDisk: + properties: + fsType: + type: string + pdID: + type: string + required: + - pdID + type: object + portworxVolume: + properties: + fsType: + type: string + readOnly: + type: boolean + volumeID: + type: string + required: + - volumeID + type: object + projected: + properties: + defaultMode: + format: int32 + type: integer + sources: + items: + properties: + configMap: + properties: + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + downwardAPI: + properties: + items: + items: + properties: + fieldRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + mode: + format: int32 + type: integer + path: + type: string + resourceFieldRef: + properties: + containerName: + type: string + divisor: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + required: + - path + type: object + type: array + type: object + secret: + properties: + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + serviceAccountToken: + properties: + audience: + type: string + expirationSeconds: + format: int64 + type: integer + path: + type: string + required: + - path + type: object + type: object + type: array + type: object + quobyte: + properties: + group: + type: string + readOnly: + type: boolean + registry: + type: string + tenant: + type: string + user: + type: string + volume: + type: string + required: + - registry + - volume + type: object + rbd: + properties: + fsType: + type: string + image: + type: string + keyring: + type: string + monitors: + items: + type: string + type: array + pool: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + user: + type: string + required: + - image + - monitors + type: object + scaleIO: + properties: + fsType: + type: string + gateway: + type: string + protectionDomain: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + sslEnabled: + type: boolean + storageMode: + type: string + storagePool: + type: string + system: + type: string + volumeName: + type: string + required: + - gateway + - secretRef + - system + type: object + secret: + properties: + defaultMode: + format: int32 + type: integer + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + optional: + type: boolean + secretName: + type: string + type: object + storageos: + properties: + fsType: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + volumeName: + type: string + volumeNamespace: + type: string + type: object + vsphereVolume: + properties: + fsType: + type: string + storagePolicyID: + type: string + storagePolicyName: + type: string + volumePath: + type: string + required: + - volumePath + type: object + required: + - name + type: object + type: array + x-kubernetes-list-type: atomic + type: object + labels: + additionalProperties: + type: string + type: object + livenessProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + query: + properties: + affinity: + properties: + nodeAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + preference: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + weight: + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + properties: + nodeSelectorTerms: + items: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + type: array + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + podAffinityTerm: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + weight: + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + items: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + type: array + type: object + podAntiAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + podAffinityTerm: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + weight: + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + items: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + type: array + type: object + type: object + annotations: + additionalProperties: + type: string + nullable: true + type: object + containerSecurityContext: + properties: + allowPrivilegeEscalation: + type: boolean + capabilities: + properties: + add: + items: + type: string + type: array + drop: + items: + type: string + type: array + type: object + privileged: + type: boolean + procMount: + type: string + readOnlyRootFilesystem: + type: boolean + runAsGroup: + format: int64 + type: integer + runAsNonRoot: + type: boolean + runAsUser: + format: int64 + type: integer + seLinuxOptions: + properties: + level: + type: string + role: + type: string + type: + type: string + user: + type: string + type: object + seccompProfile: + properties: + localhostProfile: + type: string + type: + type: string + required: + - type + type: object + windowsOptions: + properties: + gmsaCredentialSpec: + type: string + gmsaCredentialSpecName: + type: string + hostProcess: + type: boolean + runAsUserName: + type: string + type: object + type: object + grpcNodePort: + format: int32 + type: integer + image: + type: string + imagePullPolicy: + type: string + imagePullSecrets: + items: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + labels: + additionalProperties: + type: string + type: object + livenessProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + metricsStorage: + properties: + type: + type: string + type: object + nodePort: + format: int32 + type: integer + options: + type: object + x-kubernetes-preserve-unknown-fields: true + priorityClassName: + type: string + replicas: + format: int32 + type: integer + resources: + nullable: true + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: object + securityContext: + properties: + fsGroup: + format: int64 + type: integer + fsGroupChangePolicy: + type: string + runAsGroup: + format: int64 + type: integer + runAsNonRoot: + type: boolean + runAsUser: + format: int64 + type: integer + seLinuxOptions: + properties: + level: + type: string + role: + type: string + type: + type: string + user: + type: string + type: object + seccompProfile: + properties: + localhostProfile: + type: string + type: + type: string + required: + - type + type: object + supplementalGroups: + items: + format: int64 + type: integer + type: array + sysctls: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + windowsOptions: + properties: + gmsaCredentialSpec: + type: string + gmsaCredentialSpecName: + type: string + hostProcess: + type: boolean + runAsUserName: + type: string + type: object + type: object + serviceAccount: + type: string + serviceType: + type: string + strategy: + properties: + rollingUpdate: + properties: + maxSurge: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + maxUnavailable: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + type: object + type: + type: string + type: object + tolerations: + items: + properties: + effect: + type: string + key: + type: string + operator: + type: string + tolerationSeconds: + format: int64 + type: integer + value: + type: string + type: object + type: array + x-kubernetes-list-type: atomic + tracingEnabled: + type: boolean + volumeMounts: + items: + properties: + mountPath: + type: string + mountPropagation: + type: string + name: + type: string + readOnly: + type: boolean + subPath: + type: string + subPathExpr: + type: string + required: + - mountPath + - name + type: object + type: array + x-kubernetes-list-type: atomic + volumes: + items: + properties: + awsElasticBlockStore: + properties: + fsType: + type: string + partition: + format: int32 + type: integer + readOnly: + type: boolean + volumeID: + type: string + required: + - volumeID + type: object + azureDisk: + properties: + cachingMode: + type: string + diskName: + type: string + diskURI: + type: string + fsType: + type: string + kind: + type: string + readOnly: + type: boolean + required: + - diskName + - diskURI + type: object + azureFile: + properties: + readOnly: + type: boolean + secretName: + type: string + shareName: + type: string + required: + - secretName + - shareName + type: object + cephfs: + properties: + monitors: + items: + type: string + type: array + path: + type: string + readOnly: + type: boolean + secretFile: + type: string + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + user: + type: string + required: + - monitors + type: object + cinder: + properties: + fsType: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + volumeID: + type: string + required: + - volumeID + type: object + configMap: + properties: + defaultMode: + format: int32 + type: integer + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + csi: + properties: + driver: + type: string + fsType: + type: string + nodePublishSecretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + readOnly: + type: boolean + volumeAttributes: + additionalProperties: + type: string + type: object + required: + - driver + type: object + downwardAPI: + properties: + defaultMode: + format: int32 + type: integer + items: + items: + properties: + fieldRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + mode: + format: int32 + type: integer + path: + type: string + resourceFieldRef: + properties: + containerName: + type: string + divisor: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + required: + - path + type: object + type: array + type: object + emptyDir: + properties: + medium: + type: string + sizeLimit: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + ephemeral: + properties: + volumeClaimTemplate: + properties: + metadata: + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + properties: + accessModes: + items: + type: string + type: array + dataSource: + properties: + apiGroup: + type: string + kind: + type: string + name: + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + dataSourceRef: + properties: + apiGroup: + type: string + kind: + type: string + name: + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + resources: + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: object + selector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + storageClassName: + type: string + volumeMode: + type: string + volumeName: + type: string + type: object + required: + - spec + type: object + type: object + fc: + properties: + fsType: + type: string + lun: + format: int32 + type: integer + readOnly: + type: boolean + targetWWNs: + items: + type: string + type: array + wwids: + items: + type: string + type: array + type: object + flexVolume: + properties: + driver: + type: string + fsType: + type: string + options: + additionalProperties: + type: string + type: object + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + required: + - driver + type: object + flocker: + properties: + datasetName: + type: string + datasetUUID: + type: string + type: object + gcePersistentDisk: + properties: + fsType: + type: string + partition: + format: int32 + type: integer + pdName: + type: string + readOnly: + type: boolean + required: + - pdName + type: object + gitRepo: + properties: + directory: + type: string + repository: + type: string + revision: + type: string + required: + - repository + type: object + glusterfs: + properties: + endpoints: + type: string + path: + type: string + readOnly: + type: boolean + required: + - endpoints + - path + type: object + hostPath: + properties: + path: + type: string + type: + type: string + required: + - path + type: object + iscsi: + properties: + chapAuthDiscovery: + type: boolean + chapAuthSession: + type: boolean + fsType: + type: string + initiatorName: + type: string + iqn: + type: string + iscsiInterface: + type: string + lun: + format: int32 + type: integer + portals: + items: + type: string + type: array + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + targetPortal: + type: string + required: + - iqn + - lun + - targetPortal + type: object + name: + type: string + nfs: + properties: + path: + type: string + readOnly: + type: boolean + server: + type: string + required: + - path + - server + type: object + persistentVolumeClaim: + properties: + claimName: + type: string + readOnly: + type: boolean + required: + - claimName + type: object + photonPersistentDisk: + properties: + fsType: + type: string + pdID: + type: string + required: + - pdID + type: object + portworxVolume: + properties: + fsType: + type: string + readOnly: + type: boolean + volumeID: + type: string + required: + - volumeID + type: object + projected: + properties: + defaultMode: + format: int32 + type: integer + sources: + items: + properties: + configMap: + properties: + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + downwardAPI: + properties: + items: + items: + properties: + fieldRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + mode: + format: int32 + type: integer + path: + type: string + resourceFieldRef: + properties: + containerName: + type: string + divisor: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + required: + - path + type: object + type: array + type: object + secret: + properties: + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + serviceAccountToken: + properties: + audience: + type: string + expirationSeconds: + format: int64 + type: integer + path: + type: string + required: + - path + type: object + type: object + type: array + type: object + quobyte: + properties: + group: + type: string + readOnly: + type: boolean + registry: + type: string + tenant: + type: string + user: + type: string + volume: + type: string + required: + - registry + - volume + type: object + rbd: + properties: + fsType: + type: string + image: + type: string + keyring: + type: string + monitors: + items: + type: string + type: array + pool: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + user: + type: string + required: + - image + - monitors + type: object + scaleIO: + properties: + fsType: + type: string + gateway: + type: string + protectionDomain: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + sslEnabled: + type: boolean + storageMode: + type: string + storagePool: + type: string + system: + type: string + volumeName: + type: string + required: + - gateway + - secretRef + - system + type: object + secret: + properties: + defaultMode: + format: int32 + type: integer + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + optional: + type: boolean + secretName: + type: string + type: object + storageos: + properties: + fsType: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + volumeName: + type: string + volumeNamespace: + type: string + type: object + vsphereVolume: + properties: + fsType: + type: string + storagePolicyID: + type: string + storagePolicyName: + type: string + volumePath: + type: string + required: + - volumePath + type: object + required: + - name + type: object + type: array + x-kubernetes-list-type: atomic + type: object + resources: + nullable: true + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: object + sampling: + properties: + options: + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + securityContext: + properties: + fsGroup: + format: int64 + type: integer + fsGroupChangePolicy: + type: string + runAsGroup: + format: int64 + type: integer + runAsNonRoot: + type: boolean + runAsUser: + format: int64 + type: integer + seLinuxOptions: + properties: + level: + type: string + role: + type: string + type: + type: string + user: + type: string + type: object + seccompProfile: + properties: + localhostProfile: + type: string + type: + type: string + required: + - type + type: object + supplementalGroups: + items: + format: int64 + type: integer + type: array + sysctls: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + windowsOptions: + properties: + gmsaCredentialSpec: + type: string + gmsaCredentialSpecName: + type: string + hostProcess: + type: boolean + runAsUserName: + type: string + type: object + type: object + serviceAccount: + type: string + storage: + properties: + cassandraCreateSchema: + properties: + affinity: + properties: + nodeAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + preference: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + weight: + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + properties: + nodeSelectorTerms: + items: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + type: array + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + podAffinityTerm: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + weight: + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + items: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + type: array + type: object + podAntiAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + podAffinityTerm: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + weight: + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + items: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + type: array + type: object + type: object + datacenter: + type: string + enabled: + type: boolean + image: + type: string + mode: + type: string + timeout: + type: string + traceTTL: + type: string + ttlSecondsAfterFinished: + format: int32 + type: integer + type: object + dependencies: + properties: + affinity: + properties: + nodeAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + preference: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + weight: + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + properties: + nodeSelectorTerms: + items: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + type: array + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + podAffinityTerm: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + weight: + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + items: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + type: array + type: object + podAntiAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + podAffinityTerm: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + weight: + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + items: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + type: array + type: object + type: object + annotations: + additionalProperties: + type: string + nullable: true + type: object + backoffLimit: + format: int32 + type: integer + cassandraClientAuthEnabled: + type: boolean + containerSecurityContext: + properties: + allowPrivilegeEscalation: + type: boolean + capabilities: + properties: + add: + items: + type: string + type: array + drop: + items: + type: string + type: array + type: object + privileged: + type: boolean + procMount: + type: string + readOnlyRootFilesystem: + type: boolean + runAsGroup: + format: int64 + type: integer + runAsNonRoot: + type: boolean + runAsUser: + format: int64 + type: integer + seLinuxOptions: + properties: + level: + type: string + role: + type: string + type: + type: string + user: + type: string + type: object + seccompProfile: + properties: + localhostProfile: + type: string + type: + type: string + required: + - type + type: object + windowsOptions: + properties: + gmsaCredentialSpec: + type: string + gmsaCredentialSpecName: + type: string + hostProcess: + type: boolean + runAsUserName: + type: string + type: object + type: object + elasticsearchClientNodeOnly: + type: boolean + elasticsearchNodesWanOnly: + type: boolean + elasticsearchTimeRange: + type: string + enabled: + type: boolean + image: + type: string + imagePullPolicy: + type: string + imagePullSecrets: + items: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + javaOpts: + type: string + labels: + additionalProperties: + type: string + type: object + livenessProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + resources: + nullable: true + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: object + schedule: + type: string + securityContext: + properties: + fsGroup: + format: int64 + type: integer + fsGroupChangePolicy: + type: string + runAsGroup: + format: int64 + type: integer + runAsNonRoot: + type: boolean + runAsUser: + format: int64 + type: integer + seLinuxOptions: + properties: + level: + type: string + role: + type: string + type: + type: string + user: + type: string + type: object + seccompProfile: + properties: + localhostProfile: + type: string + type: + type: string + required: + - type + type: object + supplementalGroups: + items: + format: int64 + type: integer + type: array + sysctls: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + windowsOptions: + properties: + gmsaCredentialSpec: + type: string + gmsaCredentialSpecName: + type: string + hostProcess: + type: boolean + runAsUserName: + type: string + type: object + type: object + serviceAccount: + type: string + sparkMaster: + type: string + successfulJobsHistoryLimit: + format: int32 + type: integer + tolerations: + items: + properties: + effect: + type: string + key: + type: string + operator: + type: string + tolerationSeconds: + format: int64 + type: integer + value: + type: string + type: object + type: array + x-kubernetes-list-type: atomic + ttlSecondsAfterFinished: + format: int32 + type: integer + volumeMounts: + items: + properties: + mountPath: + type: string + mountPropagation: + type: string + name: + type: string + readOnly: + type: boolean + subPath: + type: string + subPathExpr: + type: string + required: + - mountPath + - name + type: object + type: array + x-kubernetes-list-type: atomic + volumes: + items: + properties: + awsElasticBlockStore: + properties: + fsType: + type: string + partition: + format: int32 + type: integer + readOnly: + type: boolean + volumeID: + type: string + required: + - volumeID + type: object + azureDisk: + properties: + cachingMode: + type: string + diskName: + type: string + diskURI: + type: string + fsType: + type: string + kind: + type: string + readOnly: + type: boolean + required: + - diskName + - diskURI + type: object + azureFile: + properties: + readOnly: + type: boolean + secretName: + type: string + shareName: + type: string + required: + - secretName + - shareName + type: object + cephfs: + properties: + monitors: + items: + type: string + type: array + path: + type: string + readOnly: + type: boolean + secretFile: + type: string + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + user: + type: string + required: + - monitors + type: object + cinder: + properties: + fsType: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + volumeID: + type: string + required: + - volumeID + type: object + configMap: + properties: + defaultMode: + format: int32 + type: integer + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + csi: + properties: + driver: + type: string + fsType: + type: string + nodePublishSecretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + readOnly: + type: boolean + volumeAttributes: + additionalProperties: + type: string + type: object + required: + - driver + type: object + downwardAPI: + properties: + defaultMode: + format: int32 + type: integer + items: + items: + properties: + fieldRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + mode: + format: int32 + type: integer + path: + type: string + resourceFieldRef: + properties: + containerName: + type: string + divisor: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + required: + - path + type: object + type: array + type: object + emptyDir: + properties: + medium: + type: string + sizeLimit: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + ephemeral: + properties: + volumeClaimTemplate: + properties: + metadata: + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + properties: + accessModes: + items: + type: string + type: array + dataSource: + properties: + apiGroup: + type: string + kind: + type: string + name: + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + dataSourceRef: + properties: + apiGroup: + type: string + kind: + type: string + name: + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + resources: + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: object + selector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + storageClassName: + type: string + volumeMode: + type: string + volumeName: + type: string + type: object + required: + - spec + type: object + type: object + fc: + properties: + fsType: + type: string + lun: + format: int32 + type: integer + readOnly: + type: boolean + targetWWNs: + items: + type: string + type: array + wwids: + items: + type: string + type: array + type: object + flexVolume: + properties: + driver: + type: string + fsType: + type: string + options: + additionalProperties: + type: string + type: object + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + required: + - driver + type: object + flocker: + properties: + datasetName: + type: string + datasetUUID: + type: string + type: object + gcePersistentDisk: + properties: + fsType: + type: string + partition: + format: int32 + type: integer + pdName: + type: string + readOnly: + type: boolean + required: + - pdName + type: object + gitRepo: + properties: + directory: + type: string + repository: + type: string + revision: + type: string + required: + - repository + type: object + glusterfs: + properties: + endpoints: + type: string + path: + type: string + readOnly: + type: boolean + required: + - endpoints + - path + type: object + hostPath: + properties: + path: + type: string + type: + type: string + required: + - path + type: object + iscsi: + properties: + chapAuthDiscovery: + type: boolean + chapAuthSession: + type: boolean + fsType: + type: string + initiatorName: + type: string + iqn: + type: string + iscsiInterface: + type: string + lun: + format: int32 + type: integer + portals: + items: + type: string + type: array + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + targetPortal: + type: string + required: + - iqn + - lun + - targetPortal + type: object + name: + type: string + nfs: + properties: + path: + type: string + readOnly: + type: boolean + server: + type: string + required: + - path + - server + type: object + persistentVolumeClaim: + properties: + claimName: + type: string + readOnly: + type: boolean + required: + - claimName + type: object + photonPersistentDisk: + properties: + fsType: + type: string + pdID: + type: string + required: + - pdID + type: object + portworxVolume: + properties: + fsType: + type: string + readOnly: + type: boolean + volumeID: + type: string + required: + - volumeID + type: object + projected: + properties: + defaultMode: + format: int32 + type: integer + sources: + items: + properties: + configMap: + properties: + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + downwardAPI: + properties: + items: + items: + properties: + fieldRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + mode: + format: int32 + type: integer + path: + type: string + resourceFieldRef: + properties: + containerName: + type: string + divisor: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + required: + - path + type: object + type: array + type: object + secret: + properties: + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + serviceAccountToken: + properties: + audience: + type: string + expirationSeconds: + format: int64 + type: integer + path: + type: string + required: + - path + type: object + type: object + type: array + type: object + quobyte: + properties: + group: + type: string + readOnly: + type: boolean + registry: + type: string + tenant: + type: string + user: + type: string + volume: + type: string + required: + - registry + - volume + type: object + rbd: + properties: + fsType: + type: string + image: + type: string + keyring: + type: string + monitors: + items: + type: string + type: array + pool: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + user: + type: string + required: + - image + - monitors + type: object + scaleIO: + properties: + fsType: + type: string + gateway: + type: string + protectionDomain: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + sslEnabled: + type: boolean + storageMode: + type: string + storagePool: + type: string + system: + type: string + volumeName: + type: string + required: + - gateway + - secretRef + - system + type: object + secret: + properties: + defaultMode: + format: int32 + type: integer + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + optional: + type: boolean + secretName: + type: string + type: object + storageos: + properties: + fsType: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + volumeName: + type: string + volumeNamespace: + type: string + type: object + vsphereVolume: + properties: + fsType: + type: string + storagePolicyID: + type: string + storagePolicyName: + type: string + volumePath: + type: string + required: + - volumePath + type: object + required: + - name + type: object + type: array + x-kubernetes-list-type: atomic + type: object + elasticsearch: + properties: + doNotProvision: + type: boolean + image: + type: string + name: + type: string + nodeCount: + format: int32 + type: integer + nodeSelector: + additionalProperties: + type: string + type: object + proxyResources: + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: object + redundancyPolicy: + enum: + - FullRedundancy + - MultipleRedundancy + - SingleRedundancy + - ZeroRedundancy + type: string + resources: + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: object + storage: + properties: + size: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + storageClassName: + type: string + type: object + tolerations: + items: + properties: + effect: + type: string + key: + type: string + operator: + type: string + tolerationSeconds: + format: int64 + type: integer + value: + type: string + type: object + type: array + x-kubernetes-list-type: atomic + useCertManagement: + type: boolean + type: object + esIndexCleaner: + properties: + affinity: + properties: + nodeAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + preference: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + weight: + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + properties: + nodeSelectorTerms: + items: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + type: array + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + podAffinityTerm: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + weight: + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + items: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + type: array + type: object + podAntiAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + podAffinityTerm: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + weight: + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + items: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + type: array + type: object + type: object + annotations: + additionalProperties: + type: string + nullable: true + type: object + backoffLimit: + format: int32 + type: integer + containerSecurityContext: + properties: + allowPrivilegeEscalation: + type: boolean + capabilities: + properties: + add: + items: + type: string + type: array + drop: + items: + type: string + type: array + type: object + privileged: + type: boolean + procMount: + type: string + readOnlyRootFilesystem: + type: boolean + runAsGroup: + format: int64 + type: integer + runAsNonRoot: + type: boolean + runAsUser: + format: int64 + type: integer + seLinuxOptions: + properties: + level: + type: string + role: + type: string + type: + type: string + user: + type: string + type: object + seccompProfile: + properties: + localhostProfile: + type: string + type: + type: string + required: + - type + type: object + windowsOptions: + properties: + gmsaCredentialSpec: + type: string + gmsaCredentialSpecName: + type: string + hostProcess: + type: boolean + runAsUserName: + type: string + type: object + type: object + enabled: + type: boolean + image: + type: string + imagePullPolicy: + type: string + imagePullSecrets: + items: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + labels: + additionalProperties: + type: string + type: object + livenessProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + numberOfDays: + type: integer + priorityClassName: + type: string + resources: + nullable: true + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: object + schedule: + type: string + securityContext: + properties: + fsGroup: + format: int64 + type: integer + fsGroupChangePolicy: + type: string + runAsGroup: + format: int64 + type: integer + runAsNonRoot: + type: boolean + runAsUser: + format: int64 + type: integer + seLinuxOptions: + properties: + level: + type: string + role: + type: string + type: + type: string + user: + type: string + type: object + seccompProfile: + properties: + localhostProfile: + type: string + type: + type: string + required: + - type + type: object + supplementalGroups: + items: + format: int64 + type: integer + type: array + sysctls: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + windowsOptions: + properties: + gmsaCredentialSpec: + type: string + gmsaCredentialSpecName: + type: string + hostProcess: + type: boolean + runAsUserName: + type: string + type: object + type: object + serviceAccount: + type: string + successfulJobsHistoryLimit: + format: int32 + type: integer + tolerations: + items: + properties: + effect: + type: string + key: + type: string + operator: + type: string + tolerationSeconds: + format: int64 + type: integer + value: + type: string + type: object + type: array + x-kubernetes-list-type: atomic + ttlSecondsAfterFinished: + format: int32 + type: integer + volumeMounts: + items: + properties: + mountPath: + type: string + mountPropagation: + type: string + name: + type: string + readOnly: + type: boolean + subPath: + type: string + subPathExpr: + type: string + required: + - mountPath + - name + type: object + type: array + x-kubernetes-list-type: atomic + volumes: + items: + properties: + awsElasticBlockStore: + properties: + fsType: + type: string + partition: + format: int32 + type: integer + readOnly: + type: boolean + volumeID: + type: string + required: + - volumeID + type: object + azureDisk: + properties: + cachingMode: + type: string + diskName: + type: string + diskURI: + type: string + fsType: + type: string + kind: + type: string + readOnly: + type: boolean + required: + - diskName + - diskURI + type: object + azureFile: + properties: + readOnly: + type: boolean + secretName: + type: string + shareName: + type: string + required: + - secretName + - shareName + type: object + cephfs: + properties: + monitors: + items: + type: string + type: array + path: + type: string + readOnly: + type: boolean + secretFile: + type: string + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + user: + type: string + required: + - monitors + type: object + cinder: + properties: + fsType: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + volumeID: + type: string + required: + - volumeID + type: object + configMap: + properties: + defaultMode: + format: int32 + type: integer + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + csi: + properties: + driver: + type: string + fsType: + type: string + nodePublishSecretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + readOnly: + type: boolean + volumeAttributes: + additionalProperties: + type: string + type: object + required: + - driver + type: object + downwardAPI: + properties: + defaultMode: + format: int32 + type: integer + items: + items: + properties: + fieldRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + mode: + format: int32 + type: integer + path: + type: string + resourceFieldRef: + properties: + containerName: + type: string + divisor: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + required: + - path + type: object + type: array + type: object + emptyDir: + properties: + medium: + type: string + sizeLimit: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + ephemeral: + properties: + volumeClaimTemplate: + properties: + metadata: + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + properties: + accessModes: + items: + type: string + type: array + dataSource: + properties: + apiGroup: + type: string + kind: + type: string + name: + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + dataSourceRef: + properties: + apiGroup: + type: string + kind: + type: string + name: + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + resources: + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: object + selector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + storageClassName: + type: string + volumeMode: + type: string + volumeName: + type: string + type: object + required: + - spec + type: object + type: object + fc: + properties: + fsType: + type: string + lun: + format: int32 + type: integer + readOnly: + type: boolean + targetWWNs: + items: + type: string + type: array + wwids: + items: + type: string + type: array + type: object + flexVolume: + properties: + driver: + type: string + fsType: + type: string + options: + additionalProperties: + type: string + type: object + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + required: + - driver + type: object + flocker: + properties: + datasetName: + type: string + datasetUUID: + type: string + type: object + gcePersistentDisk: + properties: + fsType: + type: string + partition: + format: int32 + type: integer + pdName: + type: string + readOnly: + type: boolean + required: + - pdName + type: object + gitRepo: + properties: + directory: + type: string + repository: + type: string + revision: + type: string + required: + - repository + type: object + glusterfs: + properties: + endpoints: + type: string + path: + type: string + readOnly: + type: boolean + required: + - endpoints + - path + type: object + hostPath: + properties: + path: + type: string + type: + type: string + required: + - path + type: object + iscsi: + properties: + chapAuthDiscovery: + type: boolean + chapAuthSession: + type: boolean + fsType: + type: string + initiatorName: + type: string + iqn: + type: string + iscsiInterface: + type: string + lun: + format: int32 + type: integer + portals: + items: + type: string + type: array + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + targetPortal: + type: string + required: + - iqn + - lun + - targetPortal + type: object + name: + type: string + nfs: + properties: + path: + type: string + readOnly: + type: boolean + server: + type: string + required: + - path + - server + type: object + persistentVolumeClaim: + properties: + claimName: + type: string + readOnly: + type: boolean + required: + - claimName + type: object + photonPersistentDisk: + properties: + fsType: + type: string + pdID: + type: string + required: + - pdID + type: object + portworxVolume: + properties: + fsType: + type: string + readOnly: + type: boolean + volumeID: + type: string + required: + - volumeID + type: object + projected: + properties: + defaultMode: + format: int32 + type: integer + sources: + items: + properties: + configMap: + properties: + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + downwardAPI: + properties: + items: + items: + properties: + fieldRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + mode: + format: int32 + type: integer + path: + type: string + resourceFieldRef: + properties: + containerName: + type: string + divisor: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + required: + - path + type: object + type: array + type: object + secret: + properties: + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + serviceAccountToken: + properties: + audience: + type: string + expirationSeconds: + format: int64 + type: integer + path: + type: string + required: + - path + type: object + type: object + type: array + type: object + quobyte: + properties: + group: + type: string + readOnly: + type: boolean + registry: + type: string + tenant: + type: string + user: + type: string + volume: + type: string + required: + - registry + - volume + type: object + rbd: + properties: + fsType: + type: string + image: + type: string + keyring: + type: string + monitors: + items: + type: string + type: array + pool: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + user: + type: string + required: + - image + - monitors + type: object + scaleIO: + properties: + fsType: + type: string + gateway: + type: string + protectionDomain: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + sslEnabled: + type: boolean + storageMode: + type: string + storagePool: + type: string + system: + type: string + volumeName: + type: string + required: + - gateway + - secretRef + - system + type: object + secret: + properties: + defaultMode: + format: int32 + type: integer + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + optional: + type: boolean + secretName: + type: string + type: object + storageos: + properties: + fsType: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + volumeName: + type: string + volumeNamespace: + type: string + type: object + vsphereVolume: + properties: + fsType: + type: string + storagePolicyID: + type: string + storagePolicyName: + type: string + volumePath: + type: string + required: + - volumePath + type: object + required: + - name + type: object + type: array + x-kubernetes-list-type: atomic + type: object + esRollover: + properties: + affinity: + properties: + nodeAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + preference: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + weight: + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + properties: + nodeSelectorTerms: + items: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + type: array + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + podAffinityTerm: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + weight: + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + items: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + type: array + type: object + podAntiAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + podAffinityTerm: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + weight: + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + items: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + type: array + type: object + type: object + annotations: + additionalProperties: + type: string + nullable: true + type: object + backoffLimit: + format: int32 + type: integer + conditions: + type: string + containerSecurityContext: + properties: + allowPrivilegeEscalation: + type: boolean + capabilities: + properties: + add: + items: + type: string + type: array + drop: + items: + type: string + type: array + type: object + privileged: + type: boolean + procMount: + type: string + readOnlyRootFilesystem: + type: boolean + runAsGroup: + format: int64 + type: integer + runAsNonRoot: + type: boolean + runAsUser: + format: int64 + type: integer + seLinuxOptions: + properties: + level: + type: string + role: + type: string + type: + type: string + user: + type: string + type: object + seccompProfile: + properties: + localhostProfile: + type: string + type: + type: string + required: + - type + type: object + windowsOptions: + properties: + gmsaCredentialSpec: + type: string + gmsaCredentialSpecName: + type: string + hostProcess: + type: boolean + runAsUserName: + type: string + type: object + type: object + image: + type: string + imagePullPolicy: + type: string + imagePullSecrets: + items: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + labels: + additionalProperties: + type: string + type: object + livenessProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + readTTL: + type: string + resources: + nullable: true + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: object + schedule: + type: string + securityContext: + properties: + fsGroup: + format: int64 + type: integer + fsGroupChangePolicy: + type: string + runAsGroup: + format: int64 + type: integer + runAsNonRoot: + type: boolean + runAsUser: + format: int64 + type: integer + seLinuxOptions: + properties: + level: + type: string + role: + type: string + type: + type: string + user: + type: string + type: object + seccompProfile: + properties: + localhostProfile: + type: string + type: + type: string + required: + - type + type: object + supplementalGroups: + items: + format: int64 + type: integer + type: array + sysctls: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + windowsOptions: + properties: + gmsaCredentialSpec: + type: string + gmsaCredentialSpecName: + type: string + hostProcess: + type: boolean + runAsUserName: + type: string + type: object + type: object + serviceAccount: + type: string + successfulJobsHistoryLimit: + format: int32 + type: integer + tolerations: + items: + properties: + effect: + type: string + key: + type: string + operator: + type: string + tolerationSeconds: + format: int64 + type: integer + value: + type: string + type: object + type: array + x-kubernetes-list-type: atomic + ttlSecondsAfterFinished: + format: int32 + type: integer + volumeMounts: + items: + properties: + mountPath: + type: string + mountPropagation: + type: string + name: + type: string + readOnly: + type: boolean + subPath: + type: string + subPathExpr: + type: string + required: + - mountPath + - name + type: object + type: array + x-kubernetes-list-type: atomic + volumes: + items: + properties: + awsElasticBlockStore: + properties: + fsType: + type: string + partition: + format: int32 + type: integer + readOnly: + type: boolean + volumeID: + type: string + required: + - volumeID + type: object + azureDisk: + properties: + cachingMode: + type: string + diskName: + type: string + diskURI: + type: string + fsType: + type: string + kind: + type: string + readOnly: + type: boolean + required: + - diskName + - diskURI + type: object + azureFile: + properties: + readOnly: + type: boolean + secretName: + type: string + shareName: + type: string + required: + - secretName + - shareName + type: object + cephfs: + properties: + monitors: + items: + type: string + type: array + path: + type: string + readOnly: + type: boolean + secretFile: + type: string + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + user: + type: string + required: + - monitors + type: object + cinder: + properties: + fsType: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + volumeID: + type: string + required: + - volumeID + type: object + configMap: + properties: + defaultMode: + format: int32 + type: integer + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + csi: + properties: + driver: + type: string + fsType: + type: string + nodePublishSecretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + readOnly: + type: boolean + volumeAttributes: + additionalProperties: + type: string + type: object + required: + - driver + type: object + downwardAPI: + properties: + defaultMode: + format: int32 + type: integer + items: + items: + properties: + fieldRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + mode: + format: int32 + type: integer + path: + type: string + resourceFieldRef: + properties: + containerName: + type: string + divisor: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + required: + - path + type: object + type: array + type: object + emptyDir: + properties: + medium: + type: string + sizeLimit: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + ephemeral: + properties: + volumeClaimTemplate: + properties: + metadata: + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + properties: + accessModes: + items: + type: string + type: array + dataSource: + properties: + apiGroup: + type: string + kind: + type: string + name: + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + dataSourceRef: + properties: + apiGroup: + type: string + kind: + type: string + name: + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + resources: + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: object + selector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + storageClassName: + type: string + volumeMode: + type: string + volumeName: + type: string + type: object + required: + - spec + type: object + type: object + fc: + properties: + fsType: + type: string + lun: + format: int32 + type: integer + readOnly: + type: boolean + targetWWNs: + items: + type: string + type: array + wwids: + items: + type: string + type: array + type: object + flexVolume: + properties: + driver: + type: string + fsType: + type: string + options: + additionalProperties: + type: string + type: object + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + required: + - driver + type: object + flocker: + properties: + datasetName: + type: string + datasetUUID: + type: string + type: object + gcePersistentDisk: + properties: + fsType: + type: string + partition: + format: int32 + type: integer + pdName: + type: string + readOnly: + type: boolean + required: + - pdName + type: object + gitRepo: + properties: + directory: + type: string + repository: + type: string + revision: + type: string + required: + - repository + type: object + glusterfs: + properties: + endpoints: + type: string + path: + type: string + readOnly: + type: boolean + required: + - endpoints + - path + type: object + hostPath: + properties: + path: + type: string + type: + type: string + required: + - path + type: object + iscsi: + properties: + chapAuthDiscovery: + type: boolean + chapAuthSession: + type: boolean + fsType: + type: string + initiatorName: + type: string + iqn: + type: string + iscsiInterface: + type: string + lun: + format: int32 + type: integer + portals: + items: + type: string + type: array + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + targetPortal: + type: string + required: + - iqn + - lun + - targetPortal + type: object + name: + type: string + nfs: + properties: + path: + type: string + readOnly: + type: boolean + server: + type: string + required: + - path + - server + type: object + persistentVolumeClaim: + properties: + claimName: + type: string + readOnly: + type: boolean + required: + - claimName + type: object + photonPersistentDisk: + properties: + fsType: + type: string + pdID: + type: string + required: + - pdID + type: object + portworxVolume: + properties: + fsType: + type: string + readOnly: + type: boolean + volumeID: + type: string + required: + - volumeID + type: object + projected: + properties: + defaultMode: + format: int32 + type: integer + sources: + items: + properties: + configMap: + properties: + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + downwardAPI: + properties: + items: + items: + properties: + fieldRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + mode: + format: int32 + type: integer + path: + type: string + resourceFieldRef: + properties: + containerName: + type: string + divisor: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + required: + - path + type: object + type: array + type: object + secret: + properties: + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + serviceAccountToken: + properties: + audience: + type: string + expirationSeconds: + format: int64 + type: integer + path: + type: string + required: + - path + type: object + type: object + type: array + type: object + quobyte: + properties: + group: + type: string + readOnly: + type: boolean + registry: + type: string + tenant: + type: string + user: + type: string + volume: + type: string + required: + - registry + - volume + type: object + rbd: + properties: + fsType: + type: string + image: + type: string + keyring: + type: string + monitors: + items: + type: string + type: array + pool: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + user: + type: string + required: + - image + - monitors + type: object + scaleIO: + properties: + fsType: + type: string + gateway: + type: string + protectionDomain: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + sslEnabled: + type: boolean + storageMode: + type: string + storagePool: + type: string + system: + type: string + volumeName: + type: string + required: + - gateway + - secretRef + - system + type: object + secret: + properties: + defaultMode: + format: int32 + type: integer + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + optional: + type: boolean + secretName: + type: string + type: object + storageos: + properties: + fsType: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + volumeName: + type: string + volumeNamespace: + type: string + type: object + vsphereVolume: + properties: + fsType: + type: string + storagePolicyID: + type: string + storagePolicyName: + type: string + volumePath: + type: string + required: + - volumePath + type: object + required: + - name + type: object + type: array + x-kubernetes-list-type: atomic + type: object + grpcPlugin: + properties: + image: + type: string + type: object + options: + type: object + x-kubernetes-preserve-unknown-fields: true + secretName: + type: string + type: + type: string + type: object + strategy: + type: string + tolerations: + items: + properties: + effect: + type: string + key: + type: string + operator: + type: string + tolerationSeconds: + format: int64 + type: integer + value: + type: string + type: object + type: array + x-kubernetes-list-type: atomic + ui: + properties: + options: + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + volumeMounts: + items: + properties: + mountPath: + type: string + mountPropagation: + type: string + name: + type: string + readOnly: + type: boolean + subPath: + type: string + subPathExpr: + type: string + required: + - mountPath + - name + type: object + type: array + x-kubernetes-list-type: atomic + volumes: + items: + properties: + awsElasticBlockStore: + properties: + fsType: + type: string + partition: + format: int32 + type: integer + readOnly: + type: boolean + volumeID: + type: string + required: + - volumeID + type: object + azureDisk: + properties: + cachingMode: + type: string + diskName: + type: string + diskURI: + type: string + fsType: + type: string + kind: + type: string + readOnly: + type: boolean + required: + - diskName + - diskURI + type: object + azureFile: + properties: + readOnly: + type: boolean + secretName: + type: string + shareName: + type: string + required: + - secretName + - shareName + type: object + cephfs: + properties: + monitors: + items: + type: string + type: array + path: + type: string + readOnly: + type: boolean + secretFile: + type: string + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + user: + type: string + required: + - monitors + type: object + cinder: + properties: + fsType: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + volumeID: + type: string + required: + - volumeID + type: object + configMap: + properties: + defaultMode: + format: int32 + type: integer + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + csi: + properties: + driver: + type: string + fsType: + type: string + nodePublishSecretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + readOnly: + type: boolean + volumeAttributes: + additionalProperties: + type: string + type: object + required: + - driver + type: object + downwardAPI: + properties: + defaultMode: + format: int32 + type: integer + items: + items: + properties: + fieldRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + mode: + format: int32 + type: integer + path: + type: string + resourceFieldRef: + properties: + containerName: + type: string + divisor: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + required: + - path + type: object + type: array + type: object + emptyDir: + properties: + medium: + type: string + sizeLimit: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + ephemeral: + properties: + volumeClaimTemplate: + properties: + metadata: + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + properties: + accessModes: + items: + type: string + type: array + dataSource: + properties: + apiGroup: + type: string + kind: + type: string + name: + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + dataSourceRef: + properties: + apiGroup: + type: string + kind: + type: string + name: + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + resources: + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: object + selector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + storageClassName: + type: string + volumeMode: + type: string + volumeName: + type: string + type: object + required: + - spec + type: object + type: object + fc: + properties: + fsType: + type: string + lun: + format: int32 + type: integer + readOnly: + type: boolean + targetWWNs: + items: + type: string + type: array + wwids: + items: + type: string + type: array + type: object + flexVolume: + properties: + driver: + type: string + fsType: + type: string + options: + additionalProperties: + type: string + type: object + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + required: + - driver + type: object + flocker: + properties: + datasetName: + type: string + datasetUUID: + type: string + type: object + gcePersistentDisk: + properties: + fsType: + type: string + partition: + format: int32 + type: integer + pdName: + type: string + readOnly: + type: boolean + required: + - pdName + type: object + gitRepo: + properties: + directory: + type: string + repository: + type: string + revision: + type: string + required: + - repository + type: object + glusterfs: + properties: + endpoints: + type: string + path: + type: string + readOnly: + type: boolean + required: + - endpoints + - path + type: object + hostPath: + properties: + path: + type: string + type: + type: string + required: + - path + type: object + iscsi: + properties: + chapAuthDiscovery: + type: boolean + chapAuthSession: + type: boolean + fsType: + type: string + initiatorName: + type: string + iqn: + type: string + iscsiInterface: + type: string + lun: + format: int32 + type: integer + portals: + items: + type: string + type: array + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + targetPortal: + type: string + required: + - iqn + - lun + - targetPortal + type: object + name: + type: string + nfs: + properties: + path: + type: string + readOnly: + type: boolean + server: + type: string + required: + - path + - server + type: object + persistentVolumeClaim: + properties: + claimName: + type: string + readOnly: + type: boolean + required: + - claimName + type: object + photonPersistentDisk: + properties: + fsType: + type: string + pdID: + type: string + required: + - pdID + type: object + portworxVolume: + properties: + fsType: + type: string + readOnly: + type: boolean + volumeID: + type: string + required: + - volumeID + type: object + projected: + properties: + defaultMode: + format: int32 + type: integer + sources: + items: + properties: + configMap: + properties: + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + downwardAPI: + properties: + items: + items: + properties: + fieldRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + mode: + format: int32 + type: integer + path: + type: string + resourceFieldRef: + properties: + containerName: + type: string + divisor: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + required: + - path + type: object + type: array + type: object + secret: + properties: + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + serviceAccountToken: + properties: + audience: + type: string + expirationSeconds: + format: int64 + type: integer + path: + type: string + required: + - path + type: object + type: object + type: array + type: object + quobyte: + properties: + group: + type: string + readOnly: + type: boolean + registry: + type: string + tenant: + type: string + user: + type: string + volume: + type: string + required: + - registry + - volume + type: object + rbd: + properties: + fsType: + type: string + image: + type: string + keyring: + type: string + monitors: + items: + type: string + type: array + pool: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + user: + type: string + required: + - image + - monitors + type: object + scaleIO: + properties: + fsType: + type: string + gateway: + type: string + protectionDomain: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + sslEnabled: + type: boolean + storageMode: + type: string + storagePool: + type: string + system: + type: string + volumeName: + type: string + required: + - gateway + - secretRef + - system + type: object + secret: + properties: + defaultMode: + format: int32 + type: integer + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + optional: + type: boolean + secretName: + type: string + type: object + storageos: + properties: + fsType: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + volumeName: + type: string + volumeNamespace: + type: string + type: object + vsphereVolume: + properties: + fsType: + type: string + storagePolicyID: + type: string + storagePolicyName: + type: string + volumePath: + type: string + required: + - volumePath + type: object + required: + - name + type: object + type: array + x-kubernetes-list-type: atomic + type: object + status: + properties: + phase: + type: string + version: + type: string + required: + - phase + - version + type: object + type: object + served: true + storage: true + subresources: + status: {} diff --git a/docs/ua/modules/admin/images/admins-security/2fa.png b/docs/ua/modules/admin/images/admins-security/2fa.png new file mode 100644 index 0000000000..3629c1db30 Binary files /dev/null and b/docs/ua/modules/admin/images/admins-security/2fa.png differ diff --git a/docs/ua/modules/admin/images/admins-security/authenticator.png b/docs/ua/modules/admin/images/admins-security/authenticator.png new file mode 100644 index 0000000000..63f76d36ac Binary files /dev/null and b/docs/ua/modules/admin/images/admins-security/authenticator.png differ diff --git a/docs/ua/modules/admin/images/admins-security/authenticator_added.png b/docs/ua/modules/admin/images/admins-security/authenticator_added.png new file mode 100644 index 0000000000..c5d42ee715 Binary files /dev/null and b/docs/ua/modules/admin/images/admins-security/authenticator_added.png differ diff --git a/docs/ua/modules/admin/images/admins-security/bruteforce_protection.png b/docs/ua/modules/admin/images/admins-security/bruteforce_protection.png new file mode 100644 index 0000000000..c3ceb4dee0 Binary files /dev/null and b/docs/ua/modules/admin/images/admins-security/bruteforce_protection.png differ diff --git a/docs/ua/modules/admin/images/admins-security/not-recently-used.png b/docs/ua/modules/admin/images/admins-security/not-recently-used.png new file mode 100644 index 0000000000..1b18c349c6 Binary files /dev/null and b/docs/ua/modules/admin/images/admins-security/not-recently-used.png differ diff --git a/docs/ua/modules/admin/images/admins-security/otp_policy.png b/docs/ua/modules/admin/images/admins-security/otp_policy.png new file mode 100644 index 0000000000..2b2dc1d48d Binary files /dev/null and b/docs/ua/modules/admin/images/admins-security/otp_policy.png differ diff --git a/docs/ua/modules/admin/images/admins-security/password_policy_advanced.png b/docs/ua/modules/admin/images/admins-security/password_policy_advanced.png new file mode 100644 index 0000000000..44e7d7f388 Binary files /dev/null and b/docs/ua/modules/admin/images/admins-security/password_policy_advanced.png differ diff --git a/docs/ua/modules/admin/images/admins-security/password_policy_general.png b/docs/ua/modules/admin/images/admins-security/password_policy_general.png new file mode 100644 index 0000000000..51287d0097 Binary files /dev/null and b/docs/ua/modules/admin/images/admins-security/password_policy_general.png differ diff --git a/docs/ua/modules/admin/images/admins-security/password_reset.png b/docs/ua/modules/admin/images/admins-security/password_reset.png new file mode 100644 index 0000000000..9e68eae632 Binary files /dev/null and b/docs/ua/modules/admin/images/admins-security/password_reset.png differ diff --git a/docs/ua/modules/admin/images/admins-security/qr_scan.png b/docs/ua/modules/admin/images/admins-security/qr_scan.png new file mode 100644 index 0000000000..931a96a1d4 Binary files /dev/null and b/docs/ua/modules/admin/images/admins-security/qr_scan.png differ diff --git a/docs/ua/modules/admin/images/admins-security/required_actions_otp.png b/docs/ua/modules/admin/images/admins-security/required_actions_otp.png new file mode 100644 index 0000000000..9d0e32a628 Binary files /dev/null and b/docs/ua/modules/admin/images/admins-security/required_actions_otp.png differ diff --git a/docs/ua/modules/admin/images/backup-restore/registry/control-plane-create-backup-01.png b/docs/ua/modules/admin/images/backup-restore/registry/control-plane-create-backup-01.png index 30754f3758..e086bf6877 100644 Binary files a/docs/ua/modules/admin/images/backup-restore/registry/control-plane-create-backup-01.png and b/docs/ua/modules/admin/images/backup-restore/registry/control-plane-create-backup-01.png differ diff --git a/docs/ua/modules/admin/images/backup-restore/registry/control-plane-create-backup-02.png b/docs/ua/modules/admin/images/backup-restore/registry/control-plane-create-backup-02.png index eb033f078f..e174d884e4 100644 Binary files a/docs/ua/modules/admin/images/backup-restore/registry/control-plane-create-backup-02.png and b/docs/ua/modules/admin/images/backup-restore/registry/control-plane-create-backup-02.png differ diff --git a/docs/ua/modules/admin/images/backup-restore/registry/control-plane-create-backup-03.png b/docs/ua/modules/admin/images/backup-restore/registry/control-plane-create-backup-03.png index d1d4b1ae80..bea00faf23 100644 Binary files a/docs/ua/modules/admin/images/backup-restore/registry/control-plane-create-backup-03.png and b/docs/ua/modules/admin/images/backup-restore/registry/control-plane-create-backup-03.png differ diff --git a/docs/ua/modules/admin/images/backup-restore/registry/control-plane-create-backup-job.png b/docs/ua/modules/admin/images/backup-restore/registry/control-plane-create-backup-job.png index eaa89e4ea2..06d40c647a 100644 Binary files a/docs/ua/modules/admin/images/backup-restore/registry/control-plane-create-backup-job.png and b/docs/ua/modules/admin/images/backup-restore/registry/control-plane-create-backup-job.png differ diff --git a/docs/ua/modules/admin/images/backup-restore/registry/control-plane-create-restore-01.png b/docs/ua/modules/admin/images/backup-restore/registry/control-plane-create-restore-01.png index 853047b90f..9ffcc45403 100644 Binary files a/docs/ua/modules/admin/images/backup-restore/registry/control-plane-create-restore-01.png and b/docs/ua/modules/admin/images/backup-restore/registry/control-plane-create-restore-01.png differ diff --git a/docs/ua/modules/admin/images/backup-restore/registry/control-plane-create-restore-02.png b/docs/ua/modules/admin/images/backup-restore/registry/control-plane-create-restore-02.png index 8778fa162b..216515ab90 100644 Binary files a/docs/ua/modules/admin/images/backup-restore/registry/control-plane-create-restore-02.png and b/docs/ua/modules/admin/images/backup-restore/registry/control-plane-create-restore-02.png differ diff --git a/docs/ua/modules/admin/images/backup-restore/registry/control-plane-create-restore-05.png b/docs/ua/modules/admin/images/backup-restore/registry/control-plane-create-restore-05.png index 2ee5a36112..8da92ff7d6 100644 Binary files a/docs/ua/modules/admin/images/backup-restore/registry/control-plane-create-restore-05.png and b/docs/ua/modules/admin/images/backup-restore/registry/control-plane-create-restore-05.png differ diff --git a/docs/ua/modules/admin/images/backup-restore/registry/control-plane-create-restore.png b/docs/ua/modules/admin/images/backup-restore/registry/control-plane-create-restore.png index bc962e94a4..a0693339b5 100644 Binary files a/docs/ua/modules/admin/images/backup-restore/registry/control-plane-create-restore.png and b/docs/ua/modules/admin/images/backup-restore/registry/control-plane-create-restore.png differ diff --git a/docs/ua/modules/admin/images/disaster-recovery/ebs-snapshot-common-view.png b/docs/ua/modules/admin/images/disaster-recovery/ebs-snapshot-common-view.png new file mode 100644 index 0000000000..0bf77e89c2 Binary files /dev/null and b/docs/ua/modules/admin/images/disaster-recovery/ebs-snapshot-common-view.png differ diff --git a/docs/ua/modules/admin/images/disaster-recovery/ebs-snapshot-delete-tag.png b/docs/ua/modules/admin/images/disaster-recovery/ebs-snapshot-delete-tag.png new file mode 100644 index 0000000000..b1820d5009 Binary files /dev/null and b/docs/ua/modules/admin/images/disaster-recovery/ebs-snapshot-delete-tag.png differ diff --git a/docs/ua/modules/admin/images/disaster-recovery/ebs-snapshot-tag-deleted.png b/docs/ua/modules/admin/images/disaster-recovery/ebs-snapshot-tag-deleted.png new file mode 100644 index 0000000000..c36e5bdcb4 Binary files /dev/null and b/docs/ua/modules/admin/images/disaster-recovery/ebs-snapshot-tag-deleted.png differ diff --git a/docs/ua/modules/admin/images/disaster-recovery/ebs-snapshot-tag-view.png b/docs/ua/modules/admin/images/disaster-recovery/ebs-snapshot-tag-view.png new file mode 100644 index 0000000000..467f8c7b71 Binary files /dev/null and b/docs/ua/modules/admin/images/disaster-recovery/ebs-snapshot-tag-view.png differ diff --git a/docs/ua/modules/admin/images/disaster-recovery/filtered-snapshot-by-name-view.png b/docs/ua/modules/admin/images/disaster-recovery/filtered-snapshot-by-name-view.png new file mode 100644 index 0000000000..acc0bbf960 Binary files /dev/null and b/docs/ua/modules/admin/images/disaster-recovery/filtered-snapshot-by-name-view.png differ diff --git a/docs/ua/modules/admin/images/id-gov-ua-setup/id-gov-ua-setup-3.png b/docs/ua/modules/admin/images/id-gov-ua-setup/id-gov-ua-setup-3.png index c0b44010d2..f49c67fafb 100644 Binary files a/docs/ua/modules/admin/images/id-gov-ua-setup/id-gov-ua-setup-3.png and b/docs/ua/modules/admin/images/id-gov-ua-setup/id-gov-ua-setup-3.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/change-key/change-key-03.png b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/change-key/change-key-03.png index 5bf0d17bcd..5513c8b51b 100644 Binary files a/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/change-key/change-key-03.png and b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/change-key/change-key-03.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/change-key/change-key-16.png b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/change-key/change-key-16.png index e48845b5a6..2646493225 100644 Binary files a/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/change-key/change-key-16.png and b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/change-key/change-key-16.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/change-key/change-key-20.png b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/change-key/change-key-20.png index 31e25af84c..796ea19cdd 100644 Binary files a/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/change-key/change-key-20.png and b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/change-key/change-key-20.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/change-key/change-key-37.png b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/change-key/change-key-37.png index 9203caedbf..ae83b5d91f 100644 Binary files a/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/change-key/change-key-37.png and b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/change-key/change-key-37.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/change-key/change-key-40.png b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/change-key/change-key-40.png index 90cc2dff92..8da9a14669 100644 Binary files a/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/change-key/change-key-40.png and b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/change-key/change-key-40.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/change-key/change-key-41.png b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/change-key/change-key-41.png index 687d1abd1f..44f87086a7 100644 Binary files a/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/change-key/change-key-41.png and b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/change-key/change-key-41.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/cp-platform-certificates/01-platform-certificates.png b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/cp-platform-certificates/01-platform-certificates.png new file mode 100644 index 0000000000..0e7093efc3 Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/cp-platform-certificates/01-platform-certificates.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/cp-platform-certificates/02-platform-certificates.png b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/cp-platform-certificates/02-platform-certificates.png new file mode 100644 index 0000000000..280c0bb0f3 Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/cp-platform-certificates/02-platform-certificates.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/cp-platform-certificates/03-platform-certificates.png b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/cp-platform-certificates/03-platform-certificates.png new file mode 100644 index 0000000000..70b5e24ff7 Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/cp-platform-certificates/03-platform-certificates.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/cp-registry-certificates/01-registry-certificates.png b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/cp-registry-certificates/01-registry-certificates.png new file mode 100644 index 0000000000..7f3feaf6ce Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/cp-registry-certificates/01-registry-certificates.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/cp-registry-certificates/02-registry-certificates.png b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/cp-registry-certificates/02-registry-certificates.png new file mode 100644 index 0000000000..95d51c0abf Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/cp-registry-certificates/02-registry-certificates.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/cp-registry-certificates/03-registry-certificates.png b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/cp-registry-certificates/03-registry-certificates.png new file mode 100644 index 0000000000..0786e8656f Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/cp-registry-certificates/03-registry-certificates.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/cp-registry-certificates/04-registry-certificates.png b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/cp-registry-certificates/04-registry-certificates.png new file mode 100644 index 0000000000..018d0b1d42 Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/cp-registry-certificates/04-registry-certificates.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/cp-registry-deploy-1.png b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/cp-registry-deploy-1.png deleted file mode 100644 index dbbf9b40f5..0000000000 Binary files a/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/cp-registry-deploy-1.png and /dev/null differ diff --git a/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/cp-registry-deploy-ua-1.png b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/cp-registry-deploy-ua-1.png new file mode 100644 index 0000000000..963598bcb5 Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/cp-registry-deploy-ua-1.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/quick-links/logos/gerrit-logo.svg b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/quick-links/logos/gerrit-logo.svg new file mode 100644 index 0000000000..fab865261b --- /dev/null +++ b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/quick-links/logos/gerrit-logo.svg @@ -0,0 +1,8 @@ + + + + + + + + \ No newline at end of file diff --git a/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/quick-links/logos/grafana-logo.svg b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/quick-links/logos/grafana-logo.svg new file mode 100644 index 0000000000..e91f3abdb4 --- /dev/null +++ b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/quick-links/logos/grafana-logo.svg @@ -0,0 +1,57 @@ + + + + + + + + + + + + diff --git a/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/quick-links/logos/jaeger-logo.svg b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/quick-links/logos/jaeger-logo.svg new file mode 100644 index 0000000000..b1cca56c3b --- /dev/null +++ b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/quick-links/logos/jaeger-logo.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/quick-links/logos/jenkins-logo.svg b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/quick-links/logos/jenkins-logo.svg new file mode 100644 index 0000000000..fa0a5eb2eb --- /dev/null +++ b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/quick-links/logos/jenkins-logo.svg @@ -0,0 +1,57 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/quick-links/logos/keycloak-logo.svg b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/quick-links/logos/keycloak-logo.svg new file mode 100644 index 0000000000..d8baf12419 --- /dev/null +++ b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/quick-links/logos/keycloak-logo.svg @@ -0,0 +1 @@ +keycloak_deliverables \ No newline at end of file diff --git a/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/quick-links/logos/kiali-logo.svg b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/quick-links/logos/kiali-logo.svg new file mode 100644 index 0000000000..7c917aa198 --- /dev/null +++ b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/quick-links/logos/kiali-logo.svg @@ -0,0 +1,4 @@ + + + kiali_logo_1color_013144_1024px + diff --git a/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/quick-links/logos/kibana-logo.svg b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/quick-links/logos/kibana-logo.svg new file mode 100644 index 0000000000..bfcf1c6452 --- /dev/null +++ b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/quick-links/logos/kibana-logo.svg @@ -0,0 +1,18 @@ + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/quick-links/logos/minio-logo.svg b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/quick-links/logos/minio-logo.svg new file mode 100644 index 0000000000..cf8d8cb5a9 --- /dev/null +++ b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/quick-links/logos/minio-logo.svg @@ -0,0 +1,4 @@ + + + + diff --git a/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/quick-links/logos/nexus-logo.svg b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/quick-links/logos/nexus-logo.svg new file mode 100644 index 0000000000..943eb70515 --- /dev/null +++ b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/quick-links/logos/nexus-logo.svg @@ -0,0 +1,5 @@ + + + + + \ No newline at end of file diff --git a/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/quick-links/logos/openshift-logo.svg b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/quick-links/logos/openshift-logo.svg new file mode 100644 index 0000000000..7265f22926 --- /dev/null +++ b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/quick-links/logos/openshift-logo.svg @@ -0,0 +1,43 @@ + + + + + + + + + + + + + + diff --git a/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/quick-links/logos/vault-logo.svg b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/quick-links/logos/vault-logo.svg new file mode 100644 index 0000000000..dfeea64011 --- /dev/null +++ b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/quick-links/logos/vault-logo.svg @@ -0,0 +1,3 @@ + + + \ No newline at end of file diff --git a/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/quick-links/platform-management-quick-links-1.png b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/quick-links/platform-management-quick-links-1.png new file mode 100644 index 0000000000..aeb6b8f643 Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/quick-links/platform-management-quick-links-1.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/quick-links/platform-management-quick-links-2-1.png b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/quick-links/platform-management-quick-links-2-1.png new file mode 100644 index 0000000000..d2e60ff23b Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/quick-links/platform-management-quick-links-2-1.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/quick-links/platform-management-quick-links-2.png b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/quick-links/platform-management-quick-links-2.png new file mode 100644 index 0000000000..458b6a2a20 Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/quick-links/platform-management-quick-links-2.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/quick-links/platform-management-quick-links-3-1.png b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/quick-links/platform-management-quick-links-3-1.png new file mode 100644 index 0000000000..1206933a49 Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/quick-links/platform-management-quick-links-3-1.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/quick-links/platform-management-quick-links-3.png b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/quick-links/platform-management-quick-links-3.png new file mode 100644 index 0000000000..9c6cbbc9d6 Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/quick-links/platform-management-quick-links-3.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/quick-links/platform-management-quick-links-4.png b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/quick-links/platform-management-quick-links-4.png new file mode 100644 index 0000000000..8dec17bd6e Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/quick-links/platform-management-quick-links-4.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/update-cluster-mgmt-01.png b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/update-cluster-mgmt-01.png deleted file mode 100644 index 0841a226a1..0000000000 Binary files a/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/update-cluster-mgmt-01.png and /dev/null differ diff --git a/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/update-cluster-mgmt-ua-01.png b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/update-cluster-mgmt-ua-01.png new file mode 100644 index 0000000000..00b1165a22 Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/cluster-mgmt/update-cluster-mgmt-ua-01.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-1.png b/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-1.png new file mode 100644 index 0000000000..b72fdeb3f0 Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-1.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-10.png b/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-10.png new file mode 100644 index 0000000000..1488a0ea13 Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-10.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-11.png b/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-11.png new file mode 100644 index 0000000000..e1d1be2ed4 Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-11.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-12.png b/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-12.png new file mode 100644 index 0000000000..8673150c89 Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-12.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-13.png b/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-13.png new file mode 100644 index 0000000000..add5e2c8d6 Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-13.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-14.png b/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-14.png new file mode 100644 index 0000000000..927036d240 Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-14.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-15.png b/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-15.png new file mode 100644 index 0000000000..1f4f506453 Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-15.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-16.png b/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-16.png new file mode 100644 index 0000000000..0388c5eba7 Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-16.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-17.png b/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-17.png new file mode 100644 index 0000000000..217aad003e Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-17.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-18.png b/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-18.png new file mode 100644 index 0000000000..e8760c1bbf Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-18.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-19.png b/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-19.png new file mode 100644 index 0000000000..5b72af80c6 Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-19.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-2.png b/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-2.png new file mode 100644 index 0000000000..1fb463ce77 Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-2.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-20.png b/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-20.png new file mode 100644 index 0000000000..827bc10af7 Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-20.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-21.png b/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-21.png new file mode 100644 index 0000000000..53a5c74853 Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-21.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-22.png b/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-22.png new file mode 100644 index 0000000000..bed7b5d58b Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-22.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-23.png b/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-23.png new file mode 100644 index 0000000000..7ed7a2561e Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-23.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-24.png b/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-24.png new file mode 100644 index 0000000000..66d63eb377 Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-24.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-25.png b/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-25.png new file mode 100644 index 0000000000..5ef12bfb1d Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-25.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-26.png b/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-26.png new file mode 100644 index 0000000000..2048783390 Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-26.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-27.png b/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-27.png new file mode 100644 index 0000000000..88797963e0 Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-27.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-3.png b/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-3.png new file mode 100644 index 0000000000..641681b52d Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-3.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-4.png b/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-4.png new file mode 100644 index 0000000000..f7cae31a00 Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-4.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-5.png b/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-5.png new file mode 100644 index 0000000000..e3298cdc3f Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-5.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-6.png b/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-6.png new file mode 100644 index 0000000000..3ae800e4af Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-6.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-7.png b/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-7.png new file mode 100644 index 0000000000..56d0651613 Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-7.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-8.png b/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-8.png new file mode 100644 index 0000000000..7a2291fbfb Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-8.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-9.png b/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-9.png new file mode 100644 index 0000000000..031ffda999 Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/special-steps/special-steps-1-9-7-9.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-1.png b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-1.png new file mode 100644 index 0000000000..a934172088 Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-1.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-10.png b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-10.png new file mode 100644 index 0000000000..7fcdd4ecdf Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-10.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-11.png b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-11.png new file mode 100644 index 0000000000..ef36aacd38 Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-11.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-12.png b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-12.png new file mode 100644 index 0000000000..5d92b05e8b Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-12.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-13.png b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-13.png new file mode 100644 index 0000000000..129211645c Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-13.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-14.png b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-14.png new file mode 100644 index 0000000000..1b94e6752a Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-14.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-15.png b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-15.png new file mode 100644 index 0000000000..e8dabb422e Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-15.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-16.png b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-16.png new file mode 100644 index 0000000000..2db8f7e389 Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-16.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-17.png b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-17.png new file mode 100644 index 0000000000..84e7eef365 Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-17.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-18.png b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-18.png new file mode 100644 index 0000000000..69039c89b4 Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-18.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-19.png b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-19.png new file mode 100644 index 0000000000..2a48ae2806 Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-19.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-2.png b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-2.png new file mode 100644 index 0000000000..66d4a160f7 Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-2.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-20.png b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-20.png new file mode 100644 index 0000000000..9022a623dc Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-20.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-21.png b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-21.png new file mode 100644 index 0000000000..0dafb34fcb Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-21.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-22.png b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-22.png new file mode 100644 index 0000000000..318d951283 Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-22.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-23.png b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-23.png new file mode 100644 index 0000000000..7d0c5712db Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-23.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-24.png b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-24.png new file mode 100644 index 0000000000..2d5bbb26a6 Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-24.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-25.png b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-25.png new file mode 100644 index 0000000000..64ac1cfa02 Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-25.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-26.png b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-26.png new file mode 100644 index 0000000000..370cb5758d Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-26.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-27.png b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-27.png new file mode 100644 index 0000000000..5bbd83a47f Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-27.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-28.png b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-28.png new file mode 100644 index 0000000000..c921c9f967 Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-28.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-29.png b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-29.png new file mode 100644 index 0000000000..b9494290fa Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-29.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-3.png b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-3.png new file mode 100644 index 0000000000..5deb854e42 Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-3.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-30.png b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-30.png new file mode 100644 index 0000000000..0ffb56a085 Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-30.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-31.png b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-31.png new file mode 100644 index 0000000000..b0d757076b Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-31.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-32.png b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-32.png new file mode 100644 index 0000000000..4c4cd3a58b Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-32.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-33.png b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-33.png new file mode 100644 index 0000000000..3719833e6a Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-33.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-34.png b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-34.png new file mode 100644 index 0000000000..04bec189df Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-34.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-35.png b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-35.png new file mode 100644 index 0000000000..4db0281bba Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-35.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-36.png b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-36.png new file mode 100644 index 0000000000..983d17997b Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-36.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-37.png b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-37.png new file mode 100644 index 0000000000..4b625b4bf3 Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-37.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-38.png b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-38.png new file mode 100644 index 0000000000..8d2e4f3bd9 Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-38.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-39.png b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-39.png new file mode 100644 index 0000000000..1a44476b48 Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-39.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-4.png b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-4.png new file mode 100644 index 0000000000..fd117f2c35 Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-4.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-40.png b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-40.png new file mode 100644 index 0000000000..7781d8ac90 Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-40.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-41.png b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-41.png new file mode 100644 index 0000000000..6f9b20cc43 Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-41.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-42.png b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-42.png new file mode 100644 index 0000000000..c8da163f8b Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-42.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-43.png b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-43.png new file mode 100644 index 0000000000..eae6208817 Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-43.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-44.png b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-44.png new file mode 100644 index 0000000000..b0463a529d Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-44.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-5.png b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-5.png new file mode 100644 index 0000000000..37fe0f017a Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-5.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-6.png b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-6.png new file mode 100644 index 0000000000..11140424bf Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-6.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-7.png b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-7.png new file mode 100644 index 0000000000..bcfff5304a Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-7.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-8.png b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-8.png new file mode 100644 index 0000000000..f7c5fb8731 Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-8.png differ diff --git a/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-9.png b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-9.png new file mode 100644 index 0000000000..532346e5f3 Binary files /dev/null and b/docs/ua/modules/admin/images/infrastructure/update-okd/update-okd-9.png differ diff --git a/docs/ua/modules/admin/images/installation/aws/installation-aws-1.png b/docs/ua/modules/admin/images/installation/aws/installation-aws-1.png deleted file mode 100644 index 5a5cb14e67..0000000000 Binary files a/docs/ua/modules/admin/images/installation/aws/installation-aws-1.png and /dev/null differ diff --git a/docs/ua/modules/admin/images/installation/aws/installation-aws-1.svg b/docs/ua/modules/admin/images/installation/aws/installation-aws-1.svg new file mode 100644 index 0000000000..67564feb1c --- /dev/null +++ b/docs/ua/modules/admin/images/installation/aws/installation-aws-1.svg @@ -0,0 +1,4 @@ + + + +
Private subnet
Private subnet
Public subnet
Public subnet
NAT Gateway
NAT Gateway
IGW-1
IGW-1
Route tables
Route tables
10.0.0.0/16
10.0.0.0/16
10.0.101.0/24
10.0.101.0/24
Internet
Internet
Bastion
Bastion
deployer-node
deployer-node
10.0.1.0/24
10.0.1.0/24Public security group
22 port
22 port
public sec group
public sec groupPrivate security group
(Elastic IP)
(Elastic I...
(Elastic IP)
(Elastic I...
S3
S3
Locking
Lock...
DynamoDB
DynamoDBText is not SVG - cannot display \ No newline at end of file diff --git a/docs/ua/modules/admin/images/installation/push-docker-images/push-docker-image-1.png b/docs/ua/modules/admin/images/installation/push-docker-images/push-docker-image-1.png new file mode 100644 index 0000000000..4d2e1a26c9 Binary files /dev/null and b/docs/ua/modules/admin/images/installation/push-docker-images/push-docker-image-1.png differ diff --git a/docs/ua/modules/admin/images/installation/push-docker-images/push-docker-image-2.png b/docs/ua/modules/admin/images/installation/push-docker-images/push-docker-image-2.png new file mode 100644 index 0000000000..5e7c1b6b93 Binary files /dev/null and b/docs/ua/modules/admin/images/installation/push-docker-images/push-docker-image-2.png differ diff --git a/docs/ua/modules/admin/images/migrate-registry/migrate-registry-01.png b/docs/ua/modules/admin/images/migrate-registry/migrate-registry-01.png new file mode 100644 index 0000000000..0629430331 Binary files /dev/null and b/docs/ua/modules/admin/images/migrate-registry/migrate-registry-01.png differ diff --git a/docs/ua/modules/admin/images/migrate-registry/migrate-registry-02.png b/docs/ua/modules/admin/images/migrate-registry/migrate-registry-02.png new file mode 100644 index 0000000000..9411057197 Binary files /dev/null and b/docs/ua/modules/admin/images/migrate-registry/migrate-registry-02.png differ diff --git a/docs/ua/modules/admin/images/migrate-registry/migrate-registry-03.png b/docs/ua/modules/admin/images/migrate-registry/migrate-registry-03.png new file mode 100644 index 0000000000..db8b586b8c Binary files /dev/null and b/docs/ua/modules/admin/images/migrate-registry/migrate-registry-03.png differ diff --git a/docs/ua/modules/admin/images/migrate-registry/migrate-registry-04.png b/docs/ua/modules/admin/images/migrate-registry/migrate-registry-04.png new file mode 100644 index 0000000000..40d34924db Binary files /dev/null and b/docs/ua/modules/admin/images/migrate-registry/migrate-registry-04.png differ diff --git a/docs/ua/modules/admin/images/registry-management/cp-digital-docs-restrictions/cp-digital-docs-restrictions-1.png b/docs/ua/modules/admin/images/registry-management/cp-digital-docs-restrictions/cp-digital-docs-restrictions-1.png deleted file mode 100644 index 866d763dec..0000000000 Binary files a/docs/ua/modules/admin/images/registry-management/cp-digital-docs-restrictions/cp-digital-docs-restrictions-1.png and /dev/null differ diff --git a/docs/ua/modules/admin/images/registry-management/cp-digital-docs-restrictions/cp-digital-docs-restrictions-2.png b/docs/ua/modules/admin/images/registry-management/cp-digital-docs-restrictions/cp-digital-docs-restrictions-2.png deleted file mode 100644 index 035b438b36..0000000000 Binary files a/docs/ua/modules/admin/images/registry-management/cp-digital-docs-restrictions/cp-digital-docs-restrictions-2.png and /dev/null differ diff --git a/docs/ua/modules/admin/images/registry-management/cp-digital-docs-restrictions/cp-digital-docs-restrictions-ua-1.png b/docs/ua/modules/admin/images/registry-management/cp-digital-docs-restrictions/cp-digital-docs-restrictions-ua-1.png new file mode 100644 index 0000000000..7b03d6e8ca Binary files /dev/null and b/docs/ua/modules/admin/images/registry-management/cp-digital-docs-restrictions/cp-digital-docs-restrictions-ua-1.png differ diff --git a/docs/ua/modules/admin/images/registry-management/quick-links/logos/admin-portal-logo.svg b/docs/ua/modules/admin/images/registry-management/quick-links/logos/admin-portal-logo.svg new file mode 100644 index 0000000000..51f67672f6 --- /dev/null +++ b/docs/ua/modules/admin/images/registry-management/quick-links/logos/admin-portal-logo.svg @@ -0,0 +1,17 @@ + + + + + + + + + + + + + + + + + diff --git a/docs/ua/modules/admin/images/registry-management/quick-links/logos/business-proc-admin-logo.svg b/docs/ua/modules/admin/images/registry-management/quick-links/logos/business-proc-admin-logo.svg new file mode 100644 index 0000000000..e707079326 --- /dev/null +++ b/docs/ua/modules/admin/images/registry-management/quick-links/logos/business-proc-admin-logo.svg @@ -0,0 +1,24 @@ + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/docs/ua/modules/admin/images/registry-management/quick-links/logos/citizen-portal-logo.svg b/docs/ua/modules/admin/images/registry-management/quick-links/logos/citizen-portal-logo.svg new file mode 100644 index 0000000000..28ac1fef26 --- /dev/null +++ b/docs/ua/modules/admin/images/registry-management/quick-links/logos/citizen-portal-logo.svg @@ -0,0 +1,22 @@ + + + + diff --git a/docs/ua/modules/admin/images/registry-management/quick-links/logos/geo-server-logo.svg b/docs/ua/modules/admin/images/registry-management/quick-links/logos/geo-server-logo.svg new file mode 100644 index 0000000000..bcead49059 --- /dev/null +++ b/docs/ua/modules/admin/images/registry-management/quick-links/logos/geo-server-logo.svg @@ -0,0 +1,46 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/docs/ua/modules/admin/images/registry-management/quick-links/logos/officer-portal-logo.svg b/docs/ua/modules/admin/images/registry-management/quick-links/logos/officer-portal-logo.svg new file mode 100644 index 0000000000..7b9b84a675 --- /dev/null +++ b/docs/ua/modules/admin/images/registry-management/quick-links/logos/officer-portal-logo.svg @@ -0,0 +1,16 @@ + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/docs/ua/modules/admin/images/registry-management/quick-links/logos/pgadmin-logo.svg b/docs/ua/modules/admin/images/registry-management/quick-links/logos/pgadmin-logo.svg new file mode 100644 index 0000000000..9fa5c4d5d2 --- /dev/null +++ b/docs/ua/modules/admin/images/registry-management/quick-links/logos/pgadmin-logo.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/docs/ua/modules/admin/images/registry-management/quick-links/logos/redash-logo.svg b/docs/ua/modules/admin/images/registry-management/quick-links/logos/redash-logo.svg new file mode 100644 index 0000000000..815a9801b7 --- /dev/null +++ b/docs/ua/modules/admin/images/registry-management/quick-links/logos/redash-logo.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/docs/ua/modules/admin/images/registry-management/quick-links/logos/swagger-logo.svg b/docs/ua/modules/admin/images/registry-management/quick-links/logos/swagger-logo.svg new file mode 100644 index 0000000000..cb06ec4bb8 --- /dev/null +++ b/docs/ua/modules/admin/images/registry-management/quick-links/logos/swagger-logo.svg @@ -0,0 +1,2 @@ + +file_type_swagger \ No newline at end of file diff --git a/docs/ua/modules/admin/images/registry-management/quick-links/quick-links-1.png b/docs/ua/modules/admin/images/registry-management/quick-links/quick-links-1.png index b7874a9ce9..e2f71f4d7e 100644 Binary files a/docs/ua/modules/admin/images/registry-management/quick-links/quick-links-1.png and b/docs/ua/modules/admin/images/registry-management/quick-links/quick-links-1.png differ diff --git a/docs/ua/modules/admin/images/registry-management/quick-links/quick-links-3.png b/docs/ua/modules/admin/images/registry-management/quick-links/quick-links-3.png new file mode 100644 index 0000000000..dcfcfb011f Binary files /dev/null and b/docs/ua/modules/admin/images/registry-management/quick-links/quick-links-3.png differ diff --git a/docs/ua/modules/admin/images/registry-management/quick-links/quick-links-4.png b/docs/ua/modules/admin/images/registry-management/quick-links/quick-links-4.png new file mode 100644 index 0000000000..7f4fd3bbac Binary files /dev/null and b/docs/ua/modules/admin/images/registry-management/quick-links/quick-links-4.png differ diff --git a/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-1.png b/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-1.png deleted file mode 100644 index f436d7dfec..0000000000 Binary files a/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-1.png and /dev/null differ diff --git a/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-10.png b/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-10.png deleted file mode 100644 index 933fe76d58..0000000000 Binary files a/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-10.png and /dev/null differ diff --git a/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-11.png b/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-11.png deleted file mode 100644 index 951d1cf2f5..0000000000 Binary files a/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-11.png and /dev/null differ diff --git a/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-12.png b/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-12.png deleted file mode 100644 index 150c63ee96..0000000000 Binary files a/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-12.png and /dev/null differ diff --git a/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-2-1.png b/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-2-1.png deleted file mode 100644 index bfdc246631..0000000000 Binary files a/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-2-1.png and /dev/null differ diff --git a/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-2-2.png b/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-2-2.png deleted file mode 100644 index 654b4e1532..0000000000 Binary files a/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-2-2.png and /dev/null differ diff --git a/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-2.png b/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-2.png deleted file mode 100644 index 65a659c3a1..0000000000 Binary files a/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-2.png and /dev/null differ diff --git a/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-3-1.png b/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-3-1.png deleted file mode 100644 index 97f8c81d4d..0000000000 Binary files a/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-3-1.png and /dev/null differ diff --git a/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-3-2.png b/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-3-2.png deleted file mode 100644 index cf584a6749..0000000000 Binary files a/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-3-2.png and /dev/null differ diff --git a/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-3-3.png b/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-3-3.png deleted file mode 100644 index 71a4f9a594..0000000000 Binary files a/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-3-3.png and /dev/null differ diff --git a/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-3.png b/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-3.png deleted file mode 100644 index d06a618274..0000000000 Binary files a/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-3.png and /dev/null differ diff --git a/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-4.png b/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-4.png deleted file mode 100644 index 1ed4959aa0..0000000000 Binary files a/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-4.png and /dev/null differ diff --git a/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-5.png b/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-5.png deleted file mode 100644 index 9f8aefc3df..0000000000 Binary files a/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-5.png and /dev/null differ diff --git a/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-6.png b/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-6.png deleted file mode 100644 index 4925f62fbe..0000000000 Binary files a/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-6.png and /dev/null differ diff --git a/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-7-1.png b/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-7-1.png deleted file mode 100644 index 1cdc830dfc..0000000000 Binary files a/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-7-1.png and /dev/null differ diff --git a/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-7-2.png b/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-7-2.png deleted file mode 100644 index 43beb0e8dd..0000000000 Binary files a/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-7-2.png and /dev/null differ diff --git a/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-7.png b/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-7.png deleted file mode 100644 index e0e4675682..0000000000 Binary files a/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-7.png and /dev/null differ diff --git a/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-8.png b/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-8.png deleted file mode 100644 index 49950f302c..0000000000 Binary files a/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-8.png and /dev/null differ diff --git a/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-9.png b/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-9.png deleted file mode 100644 index de001d85a5..0000000000 Binary files a/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-9.png and /dev/null differ diff --git a/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-ua-01.png b/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-ua-01.png new file mode 100644 index 0000000000..e5b9b432d8 Binary files /dev/null and b/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-ua-01.png differ diff --git a/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-ua-02.png b/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-ua-02.png new file mode 100644 index 0000000000..6fd46eb1e3 Binary files /dev/null and b/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-ua-02.png differ diff --git a/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-ua-03.png b/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-ua-03.png new file mode 100644 index 0000000000..4c27659eeb Binary files /dev/null and b/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-ua-03.png differ diff --git a/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-ua-04.png b/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-ua-04.png new file mode 100644 index 0000000000..e8ee41b931 Binary files /dev/null and b/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-ua-04.png differ diff --git a/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-ua-05.png b/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-ua-05.png new file mode 100644 index 0000000000..9b237a41db Binary files /dev/null and b/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-ua-05.png differ diff --git a/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-ua-06.png b/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-ua-06.png new file mode 100644 index 0000000000..3013a7314d Binary files /dev/null and b/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-ua-06.png differ diff --git a/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-ua-1.png b/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-ua-1.png new file mode 100644 index 0000000000..295cfacbf6 Binary files /dev/null and b/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-ua-1.png differ diff --git a/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-ua-10.png b/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-ua-10.png new file mode 100644 index 0000000000..1d92d9e3ee Binary files /dev/null and b/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-ua-10.png differ diff --git a/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-ua-2-1.png b/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-ua-2-1.png new file mode 100644 index 0000000000..41d86a8f94 Binary files /dev/null and b/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-ua-2-1.png differ diff --git a/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-ua-2-2.png b/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-ua-2-2.png new file mode 100644 index 0000000000..1c6eb1081e Binary files /dev/null and b/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-ua-2-2.png differ diff --git a/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-ua-2.png b/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-ua-2.png new file mode 100644 index 0000000000..f906464538 Binary files /dev/null and b/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-ua-2.png differ diff --git a/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-ua-4.png b/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-ua-4.png new file mode 100644 index 0000000000..0022d081ff Binary files /dev/null and b/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-ua-4.png differ diff --git a/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-ua-5-1.png b/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-ua-5-1.png new file mode 100644 index 0000000000..184fecf52d Binary files /dev/null and b/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-ua-5-1.png differ diff --git a/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-ua-5.png b/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-ua-5.png new file mode 100644 index 0000000000..b3531f4f05 Binary files /dev/null and b/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-ua-5.png differ diff --git a/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-ua-6.png b/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-ua-6.png new file mode 100644 index 0000000000..a003e9f942 Binary files /dev/null and b/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-ua-6.png differ diff --git a/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-ua-8.png b/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-ua-8.png new file mode 100644 index 0000000000..bee557f808 Binary files /dev/null and b/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-ua-8.png differ diff --git a/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-ua-9-1.png b/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-ua-9-1.png new file mode 100644 index 0000000000..7e75646a96 Binary files /dev/null and b/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-ua-9-1.png differ diff --git a/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-ua-9.png b/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-ua-9.png new file mode 100644 index 0000000000..a8437d54b9 Binary files /dev/null and b/docs/ua/modules/admin/images/registry-management/registry-create/cp-create-registry-ua-9.png differ diff --git a/docs/ua/modules/admin/images/registry-management/registry-resources/registry-resources-1.png b/docs/ua/modules/admin/images/registry-management/registry-resources/registry-resources-1.png new file mode 100644 index 0000000000..e6a4f49cfe Binary files /dev/null and b/docs/ua/modules/admin/images/registry-management/registry-resources/registry-resources-1.png differ diff --git a/docs/ua/modules/admin/images/registry-management/registry-resources/registry-resources-2.png b/docs/ua/modules/admin/images/registry-management/registry-resources/registry-resources-2.png new file mode 100644 index 0000000000..cddcefd995 Binary files /dev/null and b/docs/ua/modules/admin/images/registry-management/registry-resources/registry-resources-2.png differ diff --git a/docs/ua/modules/admin/images/registry-management/registry-resources/registry-resources-3.png b/docs/ua/modules/admin/images/registry-management/registry-resources/registry-resources-3.png new file mode 100644 index 0000000000..089d5f0b0b Binary files /dev/null and b/docs/ua/modules/admin/images/registry-management/registry-resources/registry-resources-3.png differ diff --git a/docs/ua/modules/admin/images/registry-management/registry-resources/registry-resources-4.png b/docs/ua/modules/admin/images/registry-management/registry-resources/registry-resources-4.png new file mode 100644 index 0000000000..719b492a71 Binary files /dev/null and b/docs/ua/modules/admin/images/registry-management/registry-resources/registry-resources-4.png differ diff --git a/docs/ua/modules/admin/images/registry-management/registry-resources/registry-resources-5.png b/docs/ua/modules/admin/images/registry-management/registry-resources/registry-resources-5.png new file mode 100644 index 0000000000..9f09d1f25f Binary files /dev/null and b/docs/ua/modules/admin/images/registry-management/registry-resources/registry-resources-5.png differ diff --git a/docs/ua/modules/admin/images/registry-management/registry-resources/registry-resources-6.png b/docs/ua/modules/admin/images/registry-management/registry-resources/registry-resources-6.png new file mode 100644 index 0000000000..fd0170c011 Binary files /dev/null and b/docs/ua/modules/admin/images/registry-management/registry-resources/registry-resources-6.png differ diff --git a/docs/ua/modules/admin/images/registry-management/registry-resources/registry-resources-7.png b/docs/ua/modules/admin/images/registry-management/registry-resources/registry-resources-7.png new file mode 100644 index 0000000000..ff012b9299 Binary files /dev/null and b/docs/ua/modules/admin/images/registry-management/registry-resources/registry-resources-7.png differ diff --git a/docs/ua/modules/admin/images/registry-management/registry-resources/registry-resources-8.png b/docs/ua/modules/admin/images/registry-management/registry-resources/registry-resources-8.png new file mode 100644 index 0000000000..21a158b0cf Binary files /dev/null and b/docs/ua/modules/admin/images/registry-management/registry-resources/registry-resources-8.png differ diff --git a/docs/ua/modules/admin/images/registry-management/registry-resources/registry-resources-9.png b/docs/ua/modules/admin/images/registry-management/registry-resources/registry-resources-9.png new file mode 100644 index 0000000000..eead835b42 Binary files /dev/null and b/docs/ua/modules/admin/images/registry-management/registry-resources/registry-resources-9.png differ diff --git a/docs/ua/modules/admin/pages/.crypto-service-id-gov-ua.adoc b/docs/ua/modules/admin/pages/.crypto-service-id-gov-ua.adoc index 74faea756c..9c909d5f70 100644 --- a/docs/ua/modules/admin/pages/.crypto-service-id-gov-ua.adoc +++ b/docs/ua/modules/admin/pages/.crypto-service-id-gov-ua.adoc @@ -55,7 +55,7 @@ image:admin:crypto-service-id-gov-ua/crypto-service-id-gov-ua-12.png[] * `CACertificates.p7b` - список сертифікатів сумісних ЦСК (link:https://iit.com.ua/download/productfiles/CACertificates.p7b[CACertificates.p7b]), який можна отримати на сайті АТ "ІІТ" за посиланням https://iit.com.ua/downloads. * `CAs.json` - параметри взаємодії із сумісними ЦСК (link:https://iit.com.ua/download/productfiles/CAs.json[CAs.json]), який можна отримати на сайті АТ "ІІТ" за посиланням https://iit.com.ua/downloads. -* `Key-6.dat` - сам файл ключа. +* `key-6.dat` - сам файл ключа. * `allowed-keys.yml` - файл з даними дозволених ключів (використовується при роботі реєстрів). Необхідно зазначити два параметри для кожного ключа: ** `issuer` - реквізити ЦСК. + @@ -156,7 +156,7 @@ oc project user-management + [source, bash] ---- -oc create secret generic digital-signature-data --from-file=./CACertificates.p7b --from-file=./CAs.json --from-file=./osplm.ini --from-file=./Key-6.dat --from-file=./allowed-keys.yml --dry-run=client -o yaml | oc replace -f - +oc create secret generic digital-signature-data --from-file=./CACertificates.p7b --from-file=./CAs.json --from-file=./osplm.ini --from-file=./key-6.dat --from-file=./allowed-keys.yml --dry-run=client -o yaml | oc replace -f - ---- + image:admin:crypto-service-id-gov-ua/crypto-service-id-gov-ua-05.png[] diff --git a/docs/ua/modules/admin/pages/admin-overview.adoc b/docs/ua/modules/admin/pages/admin-overview.adoc index 9528d01c53..4c19cc926c 100644 --- a/docs/ua/modules/admin/pages/admin-overview.adoc +++ b/docs/ua/modules/admin/pages/admin-overview.adoc @@ -12,7 +12,7 @@ == Огляд секції * xref:admin:installation/overview.adoc[Встановлення та налаштування] -* xref:admin:registry-management/overview.adoc[Керування Платформою та реєстрами в Control Plane] +* xref:admin:registry-management/overview.adoc[Control Plane: керування Платформою та реєстрами] * xref:admin:migration/migration-overview.adoc[Міграція] * xref:admin:update/overview.adoc[Оновлення] * xref:admin:backup-restore/overview.adoc[Резервне копіювання та відновлення] diff --git a/docs/ua/modules/admin/pages/admin-study/platform-admin-tools.adoc b/docs/ua/modules/admin/pages/admin-study/platform-admin-tools.adoc index a405af28d8..1f17826edf 100644 --- a/docs/ua/modules/admin/pages/admin-study/platform-admin-tools.adoc +++ b/docs/ua/modules/admin/pages/admin-study/platform-admin-tools.adoc @@ -20,4 +20,5 @@ include::registry-develop:partial$snippets/study/local-environment-setup-ua.adoc include::registry-develop:partial$snippets/study/platform-tools-ua.adoc[] Адміністратор Платформи має вміти використовувати інструменти xref:admin:registry-management/control-plane-quick-links.adoc#platform-admin-zone[адміністративної зони Платформи] та xref:admin:registry-management/control-plane-quick-links.adoc#platform-operational-zone[операційної зони Платформи]. + Ми також рекомендуємо ознайомитися з інструментами адміністративної та операційної зон реєстру, оскільки адміністраторам Платформи інколи доводиться брати участь у реєстрових процесах. \ No newline at end of file diff --git a/docs/ua/modules/admin/pages/backup-restore/backup-schedule-cluster-mgmt.adoc b/docs/ua/modules/admin/pages/backup-restore/backup-schedule-cluster-mgmt.adoc index 2b0bf00553..8d8c0b81c6 100644 --- a/docs/ua/modules/admin/pages/backup-restore/backup-schedule-cluster-mgmt.adoc +++ b/docs/ua/modules/admin/pages/backup-restore/backup-schedule-cluster-mgmt.adoc @@ -1,23 +1,7 @@ -:toc-title: ЗМІСТ -:toc: auto -:toclevels: 5 -:experimental: -:important-caption: ВАЖЛИВО -:note-caption: ПРИМІТКА -:tip-caption: ПІДКАЗКА -:warning-caption: ПОПЕРЕДЖЕННЯ -:caution-caption: УВАГА -:example-caption: Приклад -:figure-caption: Зображення -:table-caption: Таблиця -:appendix-caption: Додаток -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Керування розкладом створення резервних копій центральних компонентів та часом їх зберігання +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Загальний опис @@ -46,6 +30,8 @@ [#schedule-setup] == Налаштування розкладу +include::partial$templates/snippets/backup-restore-planning-ua.adoc[] + . Увійдіть до консолі *Control Plane* як адміністратор Платформи. + image:admin:infrastructure/cluster-mgmt/update-cluster-mgmt-01.png[] diff --git a/docs/ua/modules/admin/pages/backup-restore/backup-schedule-registry-components.adoc b/docs/ua/modules/admin/pages/backup-restore/backup-schedule-registry-components.adoc index c66521b85f..d67169c90b 100644 --- a/docs/ua/modules/admin/pages/backup-restore/backup-schedule-registry-components.adoc +++ b/docs/ua/modules/admin/pages/backup-restore/backup-schedule-registry-components.adoc @@ -1,23 +1,7 @@ -:toc-title: ЗМІСТ -:toc: auto -:toclevels: 5 -:experimental: -:important-caption: ВАЖЛИВО -:note-caption: ПРИМІТКА -:tip-caption: ПІДКАЗКА -:warning-caption: ПОПЕРЕДЖЕННЯ -:caution-caption: УВАГА -:example-caption: Приклад -:figure-caption: Зображення -:table-caption: Таблиця -:appendix-caption: Додаток -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Керування розкладом резервного копіювання реєстру +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Загальний опис @@ -35,7 +19,6 @@ ==== //// -TODO: Need this section? Перелік компонентів реєстру, для яких налаштовується резервне копіювання за розкладом та час зберігання резервних копій: :: * [*] [.underline]#Портал управління бізнес-процесами реєстру# -- компонент `*bp-admin-portal*`. @@ -56,6 +39,8 @@ TODO: Need this section? [#schedule-setup] == Налаштування розкладу резервного копіювання +include::partial$templates/snippets/backup-restore-planning-ua.adoc[] + [#registry-components-backup-schedule] === Налаштування розкладу створення резервних копій реєстру та періоду їх зберігання diff --git a/docs/ua/modules/admin/pages/backup-restore/control-plane-backup-restore.adoc b/docs/ua/modules/admin/pages/backup-restore/control-plane-backup-restore.adoc index fd069dcb6d..d3f3647717 100644 --- a/docs/ua/modules/admin/pages/backup-restore/control-plane-backup-restore.adoc +++ b/docs/ua/modules/admin/pages/backup-restore/control-plane-backup-restore.adoc @@ -6,25 +6,28 @@ include::platform:ROOT:partial$admonitions/language-ua.adoc[] [#create-registry-backup] == Створення резервної копії реєстру (backup) -Після успішного розгортання реєстру та регламентів адміністратор Платформи має можливість створити резервну копію реєстру, що буде збережена до захищеного сховища бекапів (для прикладу, Minio). +include::partial$templates/snippets/backup-restore-planning-ua.adoc[] -Для цього необхідно виконати наступні кроки: +Після успішного розгортання реєстру та регламентів адміністратор Платформи має можливість створити резервну копію реєстру, яка зберігатиметься у захищеному сховищі бекапів -- *MinIO*. + +Виконайте наступні кроки, щоб створити бекап реєстру: :: . Увійдіть до *Control Plane*, використовуючи створені попередньо створені логін та пароль. . Перейдіть до розділу _Реєстри_ та оберіть реєстр для резервного копіювання. -. Відкрийте секцію _Конфігурація_ на сторінці xref:admin:registry-management/control-plane-edit-registry.adoc#sections[Перегляд конфігурації створеного реєстру], натисніть на посилання до Jenkins (**CI**) Платформи та у вкладці **Всі** (**All**) знайдіть job із назвою `Create-registry-backup-backup-test` (див. зображення нижче). +. Відкрийте секцію _Конфігурація_ на сторінці xref:admin:registry-management/control-plane-edit-registry.adoc#sections[Перегляд конфігурації створеного реєстру], натисніть посилання до Jenkins (**CI**) Платформи та на вкладці *All* знайдіть пайплайн із назвою *Create-registry-backup-``*, де `` назва реєстру (_див. зображення нижче)_. + -TIP: Детальніше -- див. xref:admin:registry-management/control-plane-edit-registry.adoc#registry-deploy-status[Перевірка відомостей про розгортання реєстру]. +TIP: Детальніше про пайплайни -- див. xref:admin:registry-management/control-plane-edit-registry.adoc#registry-deploy-status[Перевірка відомостей про розгортання реєстру]. + image:backup-restore/registry/control-plane-create-backup-job.png[] -. Відкрийте job та натисніть `Зібрати з параметрами`, щоб запустити `Create-registry-backup-backup-test` job. +. Відкрийте папку та натисніть *`Build with parameters`*, щоб запустити пайплайн *Create-registry-backup*. + image:backup-restore/registry/control-plane-create-backup-01.png[] -. Натисніть `Зібрати`. +. Натисніть *`Build`*. + image:backup-restore/registry/control-plane-create-backup-02.png[] ++ image:backup-restore/registry/control-plane-create-backup-03.png[] + У разі успішного виконання job, створюється резервна копія реєстру з регламентом та завантажується до відповідної директорії сховища бекапів. @@ -33,7 +36,7 @@ image:backup-restore/registry/control-plane-create-backup-03.png[] ==== Резервне копіювання реплікацій S3-бакетів:: -Після того, як пайплайн створення резервної копії відпрацював, він створює джоби реплікацій бакетів. Час запуску таких джоб за замовчуванням стоїть 19:30 (UTC). Тому якщо потрібно запустити пайплайн раніше, можна змінити цей розклад вручну: +Після того, як пайплайн створення резервної копії відпрацював, він створює пайплайни реплікацій бакетів. Час запуску таких пайплайнів за замовчуванням стоїть 19:30 (UTC). Тому якщо потрібно запустити пайплайн раніше, можна змінити цей розклад вручну: . Виконайте вхід в OKD. . У верхньому правому куті натисніть Copy login command > Display Token. @@ -62,35 +65,33 @@ NOTE: Замініть значення `namespace="abc-02"` назвою ваш TIP: Ознайомтеся також із налаштуванням автоматичного налаштування реплікацій S3-бакетів на сторінці xref:admin:backup-restore/backup-schedule-registry-components.adoc[]. ==== - - -// image:admin:backup-restore-minio1.png[] - [#restore-registry] == Відновлення реєстру (Restore) -* Увійдіть до **Control Plane**, використовуючи створені попередньо логін та пароль. -* Перейдіть до розділу **Реєстри** та оберіть реєстр, який необхідно відновити. -* Перейдіть до Jenkins (CI) платформи та у вкладці **Всі** (**All**) знайдіть `Restore-registry-backup-test` job (див. зображення нижче). +Виконайте наступні кроки, щоб відновити реєстр зі створеної резервної копії: :: +. Увійдіть до **Control Plane**, використовуючи створені попередньо логін та пароль. +. Перейдіть до розділу _Реєстри_ та оберіть реєстр, який необхідно відновити. +. Перейдіть до Jenkins (*CI*) Платформи та на вкладці *All* знайдіть пайплайн *Restore-registry-``*, де `` -- назва реєстру (_див. зображення нижче_). ++ image:backup-restore/registry/control-plane-create-restore.png[] -* Відкрийте job та натисніть `Зібрати з параметрами`, щоб запустити `Restore-registry-backup-backup-test` job. - +. Відкрийте папку та натисніть *`Build with parameters`*, щоб запустити пайплайн *Restore-registry*. ++ image:backup-restore/registry/control-plane-create-restore-01.png[] -* Натисніть `Зібрати`. - +. Натисніть *`Build`*. ++ image:backup-restore/registry/control-plane-create-restore-02.png[] -* Далі, на кроці введення параметрів, оберіть версію резервної копії для відновлення. Для цього перейдіть до виводу консолі (Секція **Console Output** на панелі зліва) та натисніть `Input Requested`. - +. Далі, на кроці введення параметрів, оберіть версію резервної копії для відновлення. Для цього перейдіть до виводу консолі (Секція *Console Output* на панелі зліва) та натисніть *`Input Requested`*. ++ image:backup-restore/registry/control-plane-create-restore-03.png[] -* Оберіть версію резервної копії зі списку та натисніть `Proceed`. - +. Оберіть версію резервної копії зі списку та натисніть *`Proceed`*. ++ image:backup-restore/registry/control-plane-create-restore-04.png[] - -* У разі успішного виконання job `Restore-registry-backup-test`, реєстр буде відновлено до стану обраної версії резервної копії. - ++ +У разі успішного виконання job `Restore-registry-backup-test`, реєстр буде відновлено до стану обраної версії резервної копії. ++ image:backup-restore/registry/control-plane-create-restore-05.png[] \ No newline at end of file diff --git a/docs/ua/modules/admin/pages/backup-restore/control-plane-components-backup-restore.adoc b/docs/ua/modules/admin/pages/backup-restore/control-plane-components-backup-restore.adoc index 04e5482c5f..82cc093cde 100644 --- a/docs/ua/modules/admin/pages/backup-restore/control-plane-components-backup-restore.adoc +++ b/docs/ua/modules/admin/pages/backup-restore/control-plane-components-backup-restore.adoc @@ -1,100 +1,76 @@ = Резервне копіювання та відновлення центральних компонентів -:toc-title: ЗМІСТ -:toc: auto -:toclevels: 5 -:experimental: -:important-caption: ВАЖЛИВО -:note-caption: ПРИМІТКА -:tip-caption: ПІДКАЗКА -:warning-caption: ПОПЕРЕДЖЕННЯ -:caution-caption: УВАГА -:example-caption: Приклад -:figure-caption: Зображення -:table-caption: Таблиця -:appendix-caption: Додаток -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] -//// - -NOT APPLICABLE FOR THE TARGET CLUSTER - -== Передумови -* Перейдіть за посиланням https://github.com/vmware-tanzu/velero/releases/tag/v1.6.0 та завантажте відповідну версію `velero CLI` -* Відкрийте Git Bash та створіть у директорії користувача папку `bin` - -[source,bash] ----- -$ ls -la | grep bin ----- -* Покладіть завантажений velero CLI в папку bin -* Перевірте що velero встановлений вірно за допомогою команди ----- -$ velero ----- - -//// +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Бекап центральних компонентів (резервне копіювання) -Адміністратор Платформи має можливість створити резервну копію центральних компонентів, що буде збережена до захищеного сховища бекапів (для прикладу, Minio). +include::partial$templates/snippets/backup-restore-planning-ua.adoc[] -*Для цього необхідно виконати наступні кроки:* +Адміністратор Платформи має можливість створити резервну копію центральних компонентів, що буде збережена до захищеного сховища бекапів -- *MinIO*. -* Виконайте логін до OpenShift відповідного кластера. -* Скопіюйте команду для логіна – на вкладці профайлу користувача натисніть кнопку `Copy Login Command`: +Виконайте наступні кроки, щоб створити резервну копію: :: +. Виконайте вхід до OpenShift-консолі відповідного кластера. +. Скопіюйте команду для логіна через `oc cli` -- на вкладці профілю користувача натисніть кнопку *`Copy Login Command`*. ++ image:admin:backup-restore/central/backup-restore-central-copy-login-command.png[] -* Після переадресації на сторінку показу токена, натисніть на посилання `Display Token`: - +. Натисніть *`Display Token`*. ++ image:admin:backup-restore/central/backup-restore-oauth-display-token.png[] -* Скопіюйте токен доступу до **OpenShift** відповідного кластера, куди буде виконане резервне копіювання: - +. Скопіюйте токен доступу до **OpenShift** відповідного кластера, куди буде виконане резервне копіювання: ++ image:admin:backup-restore/central/backup-restore-openshift-token.png[] -* Відкрийте **Git Bash**, вставте скопійований токен та натисніть `Enter`: - +. Відкрийте **Git Bash**, вставте скопійований токен та натисніть `Enter`. ++ [source,bash] ---- $ oc login --token=sha256~NyHYErh_JwJQаааааyIfmbbE-UY_Y3s_diQG422v9Rw --server=https://api.backup.mdtu-ddm.projects.epam.com:6443 ---- -* Для перевірки наявних резервних копій, виконайте наступну команду: - +. Для перевірки наявних резервних копій, виконайте наступну команду: ++ [source,bash] ---- $ velero get backups ---- -* Для створення нової резервної копії, виконайте наступну команду: - +. Для створення нової резервної копії, виконайте наступну команду: ++ [source,bash] ---- $ velero backup create control-plane-nexus-release1-4-backup-28-10 --include-namespaces control-plane-nexus --ttl 120h ---- ++ +[TIP] +==== +де: -TIP: де: + -- `control-plane-nexus-release1-4-backup-28-10` -- назва папки у сховищі, де зберігатиметься резервна копія (для зручності вказана назва кластера та дата створення бекапу); + -- `control-plane-nexus` -- назва центрального компонента, для якого буде виконане резервне копіювання; + -- `--ttl 120h` -- час зберігання резервної копії. - -* Для перевірки того, що резервна копія успішно створена, виконайте таку команду: +* `control-plane-nexus-release1-4-backup-28-10` -- назва папки у сховищі, де зберігатиметься резервна копія (для зручності вказана назва кластера та дата створення бекапу); +* `control-plane-nexus` -- назва центрального компонента, для якого буде виконане резервне копіювання; +* `--ttl 120h` -- час зберігання резервної копії. +==== +. Перевірте, що резервна копія успішно створена за допомогою наступної команди: ++ [source,bash] ---- $ velero backup get ---- ++ image:admin:backup-restore/central/backup-restore-central-get.png[] ++ +[TIP] +==== +де: -TIP: де: + -- Status `New` -- запит на створення копії новий і знаходиться в черзі. + -- Status `InProgress` -- копія в процесі створення. + -- Status `Completed` -- копія створена. +* Status `New` -- запит на створення копії новий і знаходиться в черзі. + +* Status `InProgress` -- копія в процесі створення. + +* Status `Completed` -- копія створена. +==== //// Створені резервні копії центральних компонентів можна також перевірити у *Minio Console* у розділі *Buckets* @@ -125,6 +101,9 @@ CAUTION: Перед виконанням процесу відновлення $ velero restore control-plane-nexus --from-backup control-plane-nexus-backup-25-10 ---- -TIP: де: + -- `control-plane-nexus` -- назва центрального компонента, який буде відновлюватись; + -- `backup control-plane-nexus-backup-25-10` -- назва папки у сховищі, де зберігається резервна копія, і з якої буде відновлюватися центральний компонент. \ No newline at end of file +[TIP] +==== +де: + +* `control-plane-nexus` -- назва центрального компонента, який буде відновлюватись; +* `backup control-plane-nexus-backup-25-10` -- назва папки у сховищі, де зберігається резервна копія, і з якої буде відновлюватися центральний компонент. \ No newline at end of file diff --git a/docs/ua/modules/admin/pages/backup-restore/master_ip_repair.adoc b/docs/ua/modules/admin/pages/backup-restore/master_ip_repair.adoc index 3a49bd755f..1567a9528d 100644 --- a/docs/ua/modules/admin/pages/backup-restore/master_ip_repair.adoc +++ b/docs/ua/modules/admin/pages/backup-restore/master_ip_repair.adoc @@ -17,7 +17,7 @@ :sectlinks: :partnums: -= Відновлення кластера після зміни IP-адрес master-нод += Відновлення master-нод кластера == Опис проблеми diff --git a/docs/ua/modules/admin/pages/backup-restore/overview.adoc b/docs/ua/modules/admin/pages/backup-restore/overview.adoc index 05e2820f16..53d364b02a 100644 --- a/docs/ua/modules/admin/pages/backup-restore/overview.adoc +++ b/docs/ua/modules/admin/pages/backup-restore/overview.adoc @@ -4,28 +4,34 @@ include::platform:ROOT:partial$admonitions/language-ua.adoc[] -Цей розділ містить важливу інформацію про можливості резервного копіювання та відновлення наступних компонентів: -//This section contains essential information about manual and scheduled backing up and restoration of the following components: +Цей розділ надає всебічну інформацію про стратегії аварійного відновлення для забезпечення стійкості кластера в умовах збоїв. Основний акцент зроблено на відновленні кластера після збоїв, також надаються деталі щодо процедур відновлення мастер-нод кластера Openshift. -* Центральні компоненти Платформи +Далі, розділ розкриває методи резервного копіювання та відновлення центральних компонентів Платформи, забезпечуючи розуміння критичних аспектів безпеки та надійності. -* Середовище реєстру +Також включено інформацію про резервне копіювання та відновлення середовища реєстру, з урахуванням додаткового механізму створення резервних копій та відновлення баз даних реєстру. -В ньому також докладно описується як створювати резервні копії та відновлювати бази даних реєстру. -//It also contains the guidance on how to back up and restore registry databases. - -Ви також можете дізнатись про те, як розв'язати проблему відновлення кластеру у разі зміни IP-адрес у всіх мастер-нод кластера Openshift. -//You can also learn how to restore the cluster if you face the situation where the IP addresses change for all master nodes of the Openshift cluster. +Цей розділ є важливим ресурсом для розуміння повного спектра опцій відновлення, доступних для підтримки безперебійної роботи вашої системи. == Огляд секції -* Центральні компоненти -** xref:backup-restore/control-plane-components-backup-restore.adoc[Резервне копіювання та відновлення центральних компонентів] -** xref:backup-restore/backup-schedule-cluster-mgmt.adoc[Керування розкладом створення резервних копій центральних компонентів та часом їх зберігання] - -* Середовище реєстру -** xref:backup-restore/control-plane-backup-restore.adoc[Резервне копіювання та відновлення екземпляра реєстру] -** xref:backup-restore/backup-schedule-registry-components.adoc[Керування розкладом резервного копіювання реєстру] - +.*Відновлення кластера* +[%collapsible] +==== +* xref:admin:disaster-recovery/cluster-disaster-recovery.adoc[Аварійне відновлення роботи кластера у випадку збоїв] +* xref:backup-restore/master_ip_repair.adoc[Відновлення master-нод кластера] +==== + +.*Центральні компоненти* +[%collapsible] +==== +* xref:backup-restore/control-plane-components-backup-restore.adoc[Резервне копіювання та відновлення центральних компонентів] +* xref:backup-restore/backup-schedule-cluster-mgmt.adoc[Керування розкладом створення резервних копій центральних компонентів та часом їх зберігання] +==== + +.*Середовище реєстру* +[%collapsible] +==== +* xref:backup-restore/control-plane-backup-restore.adoc[Резервне копіювання та відновлення екземпляра реєстру] +* xref:backup-restore/backup-schedule-registry-components.adoc[Керування розкладом резервного копіювання реєстру] * xref:backup-restore/postgres-backup-restore.adoc[Резервне копіювання та відновлення БД реєстру] -* xref:backup-restore/master_ip_repair.adoc[Відновлення кластера після зміни IP-адрес master-нод] +==== diff --git a/docs/ua/modules/admin/pages/backup-restore/postgres-backup-restore.adoc b/docs/ua/modules/admin/pages/backup-restore/postgres-backup-restore.adoc index e7fcaf9fd6..601806a7d8 100644 --- a/docs/ua/modules/admin/pages/backup-restore/postgres-backup-restore.adoc +++ b/docs/ua/modules/admin/pages/backup-restore/postgres-backup-restore.adoc @@ -29,8 +29,6 @@ Postgres Operator від Crunchy Data (PGO), який використовуєт * Виконання «відновлення на певний момент часу» (PITR) * Клонування даних у новий екземпляр БД -* та інше. - == Налаштування резервного копіювання За замовчанням операційний та аналітичний кластери Postgres налаштовані таким чином, що вони постійно архівують журнал попереднього запису (WAL) та роблять повну резеврну копію раз на добу. Політикою збереження налаштовано зберігання однієї повної копії, таким чином після створення нової копії pgBackRest очистить попередню копію та пов’язані з нею файли WAL. @@ -109,9 +107,12 @@ spec: Наприклад, для operational кластера ми можемо виконати таку команду, щоб запустити одноразове резервне копіювання: [source,bash] ---- -kubectl annotate -n postgres-operator postgrescluster operational \ +kubectl annotate -n postgrescluster operational \ postgres-operator.crunchydata.com/pgbackrest-backup="$(date)" ---- + +TIP: де `` -- назва вашого реєстру/namespace. + PGO виявить цю анотацію та створить нове одноразове завдання резервного копіювання! Якщо ви збираєтеся робити одноразові резервні копії з подібними параметрами в майбутньому, ви можете залишити їх у специфікації; просто оновіть анотацію до іншого значення під час наступного резервного копіювання. @@ -119,13 +120,18 @@ PGO виявить цю анотацію та створить нове одно Щоб повторно запустити наведену вище команду, вам потрібно буде додати помітку `--overwrite`, щоб можна було оновити значення анотації, тобто. [source,bash] ---- -kubectl annotate -n postgres-operator postgrescluster operational --overwrite \ +kubectl annotate -n postgrescluster operational --overwrite \ postgres-operator.crunchydata.com/pgbackrest-backup="$(date)" ---- + +TIP: де `` -- назва вашого реєстру/namespace. + == Відновлення === Відновлення на момент часу чи на конкретну резервну копію -Для того щоб відновити стан БД на потрібну дату і час в першу чергу в секцію `spec.backups.pgbackrest` потрібно додати наступне: + +Щоб відновити стан БД на потрібну дату і час, найперше, потрібно у секцію `spec.backups.pgbackrest` додати наступне: + [source,yaml] ---- spec: @@ -136,9 +142,11 @@ spec: repoName: repo1 options: - --type=time - - --target="2022-06-09 14:15:11-04" + - --target="2022-06-09 14:15:11" ---- -де `--target` цільовий час відновлення PITR. Прикладом цілі відновлення є `2022-06-09 14:15:11-04`. +де `--target` цільовий час відновлення PITR. Прикладом часу відновлення є `2022-06-09 14:15:11`. + +NOTE: Час відновлення вказується за UTC. Щоб відновити базу на конкретну резервну копію, в секцію `spec.backups.pgbackrest` треба додати наступне: [source,yaml] @@ -153,14 +161,20 @@ spec: - --type=immediate - --set=20220602-073427F_20220602-073507I ---- -де `--set` назва цільової резервної копії. Список доступних резервних копій можно переглянути в бакеті s3 резервного сховища, або виконавши команду pgbackrest info --stanza=db в консолі пода БД. +де `--set` назва цільової резервної копії. Список доступних резервних копій можно переглянути в бакеті s3 резервного сховища, або виконавши команду `pgbackrest info --stanza=db` в консолі поду БД. + +IMPORTANT: Усі дані, створені після цільової дати відновлення (`--target="2022-06-09 14:15:11"`) і до моменту початку процесу відновлення, будуть втрачені. Тому обов'язково потрібно врахувати це перед початком відновлення. + +Щоб ініціювати відновлення, ви повинні додати анотацію `postgres-operator.crunchydata.com/pgbackrest-restore` наступним чином: -Тепер, щоб ініціювати відновлення, ви повинні додати анотацію `postgres-operator.crunchydata.com/pgbackrest-restore` наступним чином: [source,bash] ---- -kubectl annotate -n postgres-operator postgrescluster operational --overwrite \ - postgres-operator.crunchydata.com/pgbackrest-restore=id1 +kubectl annotate -n postgrescluster operational --overwrite \ + postgres-operator.crunchydata.com/pgbackrest-restore="$(date)" ---- + +TIP: де `` -- назва вашого реєстру/namespace. + Після завершення відновлення додане налаштування можна вимкнути: [source,yaml] @@ -174,9 +188,9 @@ spec: [IMPORTANT] ==== -Всі ці операції потрібно провести як на операційній так і на аналітичній базі данних. +Всі ці операції потрібно провести як на операційній, так і на аналітичній базі даних. -Для відновлення відповідності данних між операційною та аналітичною БД виконайте <<Узгодження данних на аналітичному кластері>> +Для відновлення відповідності даних між операційною та аналітичною БД виконайте <<Узгодження данних на аналітичному кластері>> ==== === Клонування з резервної копії diff --git a/docs/ua/modules/admin/pages/disaster-recovery/cluster-disaster-recovery.adoc b/docs/ua/modules/admin/pages/disaster-recovery/cluster-disaster-recovery.adoc new file mode 100644 index 0000000000..159137b312 --- /dev/null +++ b/docs/ua/modules/admin/pages/disaster-recovery/cluster-disaster-recovery.adoc @@ -0,0 +1,183 @@ += Аварійне відновлення роботи кластера у випадку збоїв +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +Ця сторінка надає практичне керівництво з відновлення кластера, який знаходиться в аварійному стані. + +== Загальна інформація + +Для процедури відновлення кластера використовуйте наступну документацію Платформи: + +* *_AWS_*: xref:admin:installation/platform-deployment/platform-aws-deployment.adoc#deploy-additional-recources-for-okd[Розгортання додаткових ресурсів для інсталяції OKD-кластера в AWS] + +* *_vSphere_*: xref:admin:installation/platform-deployment/platform-vsphere-deployment.adoc#launch-okd-installer-deploy-empty-okd[Запуск OKD4-інсталера та розгортання порожнього кластера OKD4] + +[IMPORTANT] +У випадку аварії кластера, важливо мати доступ до ресурсів відновлення. Оскільки актуальний стан кластера зберігається на ресурсах (віртуальній машині), без них відновлення не буде можливим. Уникнути втрати даних можна лише забезпечивши, що всі критично важливі ресурси доступні та функціональні. + +== Підготовка кластера до видалення + +=== Середовище AWS + +Підготовка до видалення кластера у хмарному сервісі AWS включає критичний етап видалення тегів з EC2 Snapshots. Виконайте наступні кроки для ефективного видалення: + +. Відкрийте *консоль AWS* та перейдіть до розділу *EC2 Snapshots*. ++ +image:admin:disaster-recovery/ebs-snapshot-common-view.png[] + +. Використовуйте поле пошуку для введення назви кластера (як показано на зображенні, пошук за назвою `1-9-7-42`). Фільтруйте результати, щоб відобразити лише ті snapshots, що належать вашому кластеру. ++ +image:admin:disaster-recovery/filtered-snapshot-by-name-view.png[] + +. Пройдіться по списку відфільтрованих snapshots. Для кожного з них використовуйте опцію *Manage Tags* та видаліть тег у форматі: `kubernetes.io/cluster/-: owned`, де `` -- назва кластера, `` -- хеш. ++ +Зображення нижче демонструють приклад із тегом `kubernetes.io/cluster/1-9-7-42-d2gdt: owned`. ++ +.Manage Tags +image::admin:disaster-recovery/ebs-snapshot-tag-view.png[] ++ +.Manage Tags +image::admin:disaster-recovery/ebs-snapshot-delete-tag.png[] ++ +.Manage Tags +image::admin:disaster-recovery/ebs-snapshot-tag-deleted.png[] + +NOTE: Повторіть ці кроки для всіх snapshots, які асоціюються з вашим кластером. Такий підхід забезпечить чисте та безпечне видалення кластера з урахуванням усіх пов'язаних ресурсів. + +=== Середовище vSphere + +Openshift-кластер, що розгорнуто у середовищі vSphere, використовує інший підхід до зберігання даних, тому передумов для видалення немає. + +== Процедура видалення кластера + +Перед тим, як розпочинати видалення кластера, упевніться, що виконуєте дії з інстансу (jumpbox), з якого здійснювалася інсталяція кластера. Нижче наведено детальні кроки для безпечного видалення кластера на різних платформах, зокрема AWS або vSphere. + +=== Середовище AWS + +. *Запуск контейнера openshift-install*: + +Дотримуйтеся інструкцій на сторінці xref:admin:installation/platform-deployment/platform-aws-deployment.adoc#launch-openshift-install[Запуск контейнера openshift-install] для налаштування та запуску контейнера, необхідного для видалення кластера. + +. *Виконання команди видалення кластера*: + +У терміналі інстансу виконайте команду: ++ +[source,bash] +---- +$ ./openshift-install destroy cluster --dir /tmp/openshift-cluster/cluster-state +---- ++ +Це ініціює процес видалення кластера. + +. *Перевірка видалення кластера*: + +По завершенню, ви маєте отримати повідомлення схоже на наступне, що підтверджує успішне видалення: ++ +[source,bash] +---- +level=info msg=Time elapsed: 10min +---- + +=== Середовище vSphere + +. *Перехід до інстансу інсталяції*: + +Переконайтеся, що ви виконуєте дії з інстансу, з якого кластер був розгорнутий. Дотримуйтеся інструкцій на сторінці xref:admin:installation/platform-deployment/platform-vsphere-deployment.adoc#launch-okd-installer-deploy-empty-okd[Запуск OKD4-інсталера та розгортання порожнього кластера OKD4]. + +. *Команда видалення кластера*: + +Запустіть наступну команду у терміналі інстансу для ініціації процесу видалення кластера: ++ +[source,bash] +---- +openshift-installer destroy cluster +---- + +== Інсталяція кластера та розгортання Платформи + +Для інсталяції кластера та розгортання платформи на різних типах хмарних провайдерів, використовуйте наступну документацію: + +* *_AWS_*: xref:admin:installation/platform-deployment/platform-aws-deployment.adoc[] + +* *_vSphere_*: xref:admin:installation/platform-deployment/platform-vsphere-deployment.adoc[] + +[WARNING] +==== +Версія Платформи має бути такою ж, як і та, що була встановлена на кластер до його видалення. +==== + +== Відновлення платформи з останніх доступних резервних копій + +[NOTE] +==== +Відновлення платформи рекомендовано виконувати з інстансу, де проводилася процедура інсталяції кластера/Платформи +==== + +Після встановлення Платформи, можна розпочати відновлення центральних компонент та реєстрів із резервних копій. Для цього: + +. Збережіть link:{attachmentsdir}/disaster-recovery/disaster-recovery.zip[архів], +що містить Helm chart для відновлення з останніх резервних копій. + +. Актуалізуйте логін через *oc client* у терміналі інстансу. + +.. Відкрийте консоль Openshift та у правому верхньому куті, де профіль користувача, натисніть *`Copy Login Command`*. + +.. Пройдіть авторизацію через *Keycloak/kubeadmin*. + +.. Далі натисніть *`Display token`*, скопіюйте рядок *Log in with this token*, вставте його у терміналі та пройдіть процедуру логіну. + +. Перейдіть у директорію зі збереженим архівом та виконайте наступну команду для його розпакування. ++ +[source,bash] +---- +unzip disaster-recovery.zip +---- + +. Виконайте наступну команду для запуску процедури відновлення платформних компонент з останніх резервних копій: ++ +[source,bash] +---- +helm install disaster-recovery disaster-recovery -n velero +---- ++ +У випадку, коли потрібно використати не останню версію резервної копії, а вибрати з наявних для центральних компонент, команду можна доповнити наступними ключами: + +* для компонента *`user-management`* ++ +[source,bash] +---- +--set umBackupName="<назва бекапу>"#приклад +--set umBackupName="velero-usermanagement-20231206093235" +---- + +* для компонента *`control-plane`* ++ +[source,bash] +---- +--set cpBackupName="<назва бекапу>"#приклад +--set cpBackupName="control-plane-2023-12-04-18-53-02" +---- +* для компонента *`control-plane-nexus`* ++ +[source,bash] +---- +--set cpNexusBackupName="<назва бекапу>"#приклад +--set cpNexusBackupName="velero-controlplanenexus-20231206095034" +---- + ++ +-- +Приклад команди, де вибрана версія резервної копії для компонента *`control-plane`*: + +[source,bash] +---- +helm install disaster-recovery ./disaster-recovery -n velero --set cpBackupName="control-plane-2023-12-04-18-53-02" +---- + +У випадку, де для одного з компонент (`control-plane`) вибрана версія для двох інших компонент (`control-plane-nexus`, `user-management`), процес самостійно обере останні доступні версії резервних копій. + +Ключі можна поєднувати через пробіл: + +[source,bash] +---- +--set cpBackupName="control-plane-2023-12-04-18-53-02" --set umBackupName="velero-usermanagement-20231206093235" +---- +-- + +. Після виконання команди, зачекайте коли под *`disaster-recovery`* в Openshift проєкті *`velero`* буде у статусі `completed`. + +. Увійдіть до адміністративної панелі Control Plane, відкрийте розділ *Керування Платформою* > *Швидкі посилання*, перейдіть до *Сервісу розгортання конфігурації (Jenkins)* та для кожного з наявних реєстрів виконайте кроки з відновлення, описані у розділі xref:admin:backup-restore/control-plane-backup-restore.adoc#restore-registry[Відновлення реєстру (Restore)]. \ No newline at end of file diff --git a/docs/ua/modules/admin/pages/installation/.minio-vault-auto-deploy.adoc b/docs/ua/modules/admin/pages/installation/.minio-vault-auto-deploy.adoc deleted file mode 100644 index 92a990704d..0000000000 --- a/docs/ua/modules/admin/pages/installation/.minio-vault-auto-deploy.adoc +++ /dev/null @@ -1,373 +0,0 @@ -= Автоматичне розгортання компонентів MinIO та Vault - -//Секції 1 та 2 актуалізовані і використовуються у docs/ua/modules/admin/pages/installation/platform-deployment/platform-vsphere-deployment.adoc; решта контенту не оновлена. - -include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] - -== Розгортання кластера Платформи з нуля у середовищі vSphere - -=== Передумови - -NOTE: Переконайтеся, що встановлено необхідні пакети: `docker`, `wget`, `unzip`. - -[prerequisites-plan] -==== План - -. Завантажте необхідну версію інсталера. -+ -[source,shellscript] ----- -сd /tmp -wget -O mdtu-ddm-platform-.zip https://nexus-public-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/nexus/repository/edp-maven-releases/ua/gov/mdtu/ddm/infrastructure/mdtu-ddm-platform//mdtu-ddm-platform-.zip ----- - -. Розпакуйте архів у домашній директорії. - -+ -[source,shellscript] ----- -unzip /tmp/mdtu-ddm-platform-.zip -d /home//workdir/installer- ----- - -. Перенесіть _kubeconfig_ після встановлення кластера: - -+ -[source,shellscript] ----- -cd /home//workdir/installer- -cp /path/to/kubeconfig ./ ----- - -. Перенесіть папку _certificates_ для DSO: - -+ -[source,shellscript] ----- -cp /path/to/folder/certificates ./ ----- - -=== Додавання окремого конфігураційного файлу для розгортання в середовищі vSphere - -. Відредагуйте _exports.list_ для vSphere. -+ -Усі значення необхідно взяти після інсталяції кластера. Також необхідно уточнити актуальні значенння для `idgovuaClientId` та `idgovuaClientSecret`. - -+ -[source,shellscript] ----- -vi exports.list - -### vSphere Credentials ### -export VSPHERE_SERVER="" -export VSPHERE_USER="" -export VSPHERE_PASSWORD="" -export VSPHERE_CLUSTER="" -export VSPHERE_DATASTORE="" -export VSPHERE_DATACENTER="" -export VSPHERE_NETWORK="" -export VSPHERE_NETWORK_GATEWAY="" -export VSPHERE_RESOURCE_POOL="" #якщо не використовується, ставимо "/" -export VSPHERE_FOLDER="" - -### Minio and Vault IPs ### -export VSPHERE_VAULT_INSTANCE_IP="" -export VSPHERE_MINIO_INSTANCE_IP="" - -### id.gov.ua ### -export idgovuaClientId="" -export idgovuaClientSecret="" ----- - -. Відредагуйте _install.sh_, а саме після `source ./functions.sh` додайте `source ./exports.list`. - -+ -[source,shellscript] ----- -vi install.sh ----- -+ -Це виглядатиме наступним чином: - -+ -[source,shellscript] ----- -#!/usr/bin/env bash -set -e -#Include function file -source ./functions.sh -source ./exports.list ----- - -=== Розгортання інсталятора - -. Виконайте наступні команди: -+ -[source,shellscript] ----- -IMAGE_CHECKSUM=$(sudo docker load -i control-plane-installer.img | sed -r "s#.*sha256:(.*)#\\1#" | tr -d '\n'); -echo $IMAGE_CHECKSUM -sudo docker tag ${IMAGE_CHECKSUM} control-plane-installer:; ----- - -. Розгорніть нову версію Платформи з образами з нуля: -+ -[source,shellscript] ----- -sudo docker run --rm --name control-plane-installer- --user root:$(id -g) --net host -v $(pwd):/tmp/installer --env KUBECONFIG=/tmp/installer/kubeconfig --env idgovuaClientId=mock --env idgovuaClientSecret=mock --env CUSTOM_INGRESS_CIDRS="['0.0.0.0/0', '85.223.209.0/24']" --env deploymentMode=development --entrypoint "/bin/bash" control-plane-installer: -c "./install.sh -i" ----- -+ -* Де `deploymentMode` може бути `development` чи `production`. - -== Оновлення кластера Платформи у середовищі vSphere - -=== Передумови - -NOTE: Переконайтеся, що встановлено необхідні пакети: `docker`, `wget`, `unzip`. - -[prerequisites-plan] -==== План - -. Завантажте необхідну версію інсталера. -+ -[source,shellscript] ----- -сd /tmp -wget -O mdtu-ddm-platform-.zip https://nexus-public-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/nexus/repository/edp-maven-releases/ua/gov/mdtu/ddm/infrastructure/mdtu-ddm-platform//mdtu-ddm-platform-.zip ----- - -. Розпакуйте архів у домашній директорії. - -+ -[source,shellscript] ----- -unzip /tmp/mdtu-ddm-platform-.zip -d /home//workdir/installer- ----- - -. Перенесіть _kubeconfig_ після встановлення кластера: - -+ -[source,shellscript] ----- -cd /home//workdir/installer- -cp /path/to/kubeconfig ./ ----- - -. Перенесіть папку _certificates_ для DSO. -+ -NOTE: Якщо сертифікати не змінювалися, даний крок можна пропустити. - -+ -[source,shellscript] ----- -cp /path/to/folder/certificates ./ ----- - -=== Додавання окремого конфігураційного файлу для розгортання в середовищі vSphere - -. Перенесіть _exports.list_ з минулого релізу. - -+ -[source,shellscript] ----- -cp /home//workdir/installer-/exports.list ./ ----- -+ -Також необхідно уточнити актуальні значенння для `idgovuaClientId` та `idgovuaClientSecret`. - -. Відредагуйте _install.sh_, а саме після `source ./functions.sh` додайте `source ./exports.list`. - -+ -[source,shellscript] ----- -vi install.sh ----- -+ -Це виглядатиме наступним чином: - -+ -[source,shellscript] ----- -#!/usr/bin/env bash -set -e -#Include function file -source ./functions.sh -source ./exports.list ----- - -=== Налаштування компонента MinIO при оновленні кластера у середовищі vSphere - -. Перенесіть tfstate MinIO з минулого релізу для vSphere. - -+ -[source,shellscript] ----- -cp /home//workdir/installer-/terraform/minio/vsphere/terraform.tfstate ./terraform/minio/vsphere/ ----- - -. Перенесіть tfstate MinIO (Packer) з минулого релізу для vSphere. - -+ -[source,shellscript] ----- -сp /home//workdir/installer-/terraform/minio/vsphere/packer/terraform.tfstate ./terraform/minio/vsphere/packer/ ----- - -=== Налаштування компонента Vault при оновленні кластера у середовищі vSphere - -. Перенесіть tfstate Vault з минулого релізу. - -+ -[source,shellscript] ----- -cp /home//workdir/installer-/terraform/vault/vsphere/terraform.tfstate ./terraform/vault/vsphere/ ----- - -. Перенесіть tfstate Vault (Packer) з минулого релізу. - -+ -[source,shellscript] ----- -сp /home//workdir/installer-/terraform/vault/vsphere/packer/terraform.tfstate ./terraform/vault/vsphere/packer/ ----- - -=== Розгортання інсталятора - -. Виконайте наступні команди: -+ -[source,shellscript] ----- -IMAGE_CHECKSUM=$(sudo docker load -i control-plane-installer.img | sed -r "s#.*sha256:(.*)#\\1#" | tr -d '\n'); -echo $IMAGE_CHECKSUM -sudo docker tag ${IMAGE_CHECKSUM} control-plane-installer:; ----- - -. Оновіть версію Платформи з образами оновлення. -+ -[source,shellscript] ----- -sudo docker run --rm --name control-plane-installer- --user root:$(id -g) --net host -v $(pwd):/tmp/installer --env KUBECONFIG=/tmp/installer/kubeconfig --env idgovuaClientId=mock --env idgovuaClientSecret=mock --env CUSTOM_INGRESS_CIDRS="['0.0.0.0/0', '85.223.209.0/24']" --env deploymentMode=development --entrypoint "/bin/bash" control-plane-installer: -c "./install.sh -u" ----- -+ -* Де `deploymentMode` може бути `development` чи `production` в залежності від минулого запуску. - -== Розгортання кластера платформи з нуля у середовищі AWS - -=== Передумови - -NOTE: Переконайтеся, що встановлено необхідні пакети: `docker`, `wget`, `unzip`. - -[prerequisites-plan] -==== План - -. Завантажте необхідну версію інсталера. -+ -[source,shellscript] ----- -сd /tmp -wget -O mdtu-ddm-platform-.zip https://nexus-public-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/repository/edp-maven-releases/ua/gov/mdtu/ddm/infrastructure/mdtu-ddm-platform//mdtu-ddm-platform-.zip ----- - -. Розпакуйте архів у домашній директорії. - -+ -[source,shellscript] ----- -unzip /tmp/mdtu-ddm-platform-.zip -d /home//workdir/installer- ----- - -. Перенесіть _kubeconfig_ після встановлення кластера: - -+ -[source,shellscript] ----- -cp /path/to/kubeconfig ./ ----- - -=== Розгортання інсталера - -. Виконайте наступні команди: -+ -[source,shellscript] ----- -IMAGE_CHECKSUM=$(sudo docker load -i control-plane-installer.img | sed -r "s#.*sha256:(.*)#\\1#" | tr -d '\n'); -echo $IMAGE_CHECKSUM -sudo docker tag $\{IMAGE_CHECKSUM} control-plane-installer:; ----- - -. Розгорніть нову версію платформи з образами з нуля. -+ -[source,shellscript] ----- -sudo docker run --rm --name control-plane-installer-*(version)* --user root:$(id -g) --net host -v $(pwd):/tmp/installer --env KUBECONFIG=/tmp/installer/kubeconfig --env idgovuaClientId=f90ab33dc272f047dc330c88e5663b75 --env idgovuaClientSecret=cba49c104faac8c718e6daf3253bc55f2bf11d9e --env CUSTOM_INGRESS_CIDRS="['0.0.0.0/0', '85.223.209.0/24']" --entrypoint "/bin/sh" control-plane-installer:*(version)* -c "./install.sh -i" ----- - -== Оновлення кластера платформи у середовищі AWS - -=== Передумови - -NOTE: Переконайтеся, що встановлено необхідні пакети: `docker`, `wget`, `unzip`. - -[prerequisites-plan] -==== План - -. Завантажте необхідну версію інсталера. -+ -[source,shellscript] ----- -сd /tmp -wget -O mdtu-ddm-platform-.zip https://nexus-public-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/repository/edp-maven-releases/ua/gov/mdtu/ddm/infrastructure/mdtu-ddm-platform//mdtu-ddm-platform-.zip ----- - -. Розпакуйте архів у домашній директорії. - -+ -[source,shellscript] ----- -unzip /tmp/mdtu-ddm-platform-.zip -d /home//workdir/installer- ----- - -. Перенесіть _kubeconfig_ після встановлення кластера: - -+ -[source,shellscript] ----- -cp /path/to/kubeconfig ./ ----- - -=== Налаштування компонента Minio при оновленні кластера у середовищі AWS - -. Перенесіть tfstate minio з минулого релізу. - -+ -[source,shellscript] ----- -cp /home//workdir/installer-/terraform/minio/aws/terraform.tfstate ./terraform/minio/aws/ ----- - -=== Налаштування компонента Vault при оновленні кластера у середовищі AWS - -. Перенесіть tfstate vault з минулого релізу. - -+ -[source,shellscript] ----- -cp /home//workdir/installer-/terraform/vault/aws/terraform.tfstate ./terraform/vault/aws/ ----- - -=== Розгортання інсталера - -. Виконайте наступні команди: -+ -[source,shellscript] ----- -IMAGE_CHECKSUM=$(sudo docker load -i control-plane-installer.img | sed -r "s#.*sha256:(.*)#\\1#" | tr -d '\n'); -echo $IMAGE_CHECKSUM -sudo docker tag $\{IMAGE_CHECKSUM} control-plane-installer:; ----- - -. Оновіть версію платформи з образами оновлення. -+ -[source,shellscript] ----- -sudo docker run --rm --name control-plane-installer-*(version)* --user root:$(id -g) --net host -v $(pwd):/tmp/installer --env KUBECONFIG=/tmp/installer/kubeconfig --env idgovuaClientId=f90ab33dc272f047dc330c88e5663b75 --env idgovuaClientSecret=cba49c104faac8c718e6daf3253bc55f2bf11d9e --env CUSTOM_INGRESS_CIDRS="['0.0.0.0/0', '85.223.209.0/24']" --entrypoint "/bin/sh" control-plane-installer:*(version)* -c "./install.sh -u" ----- \ No newline at end of file diff --git a/docs/ua/modules/admin/pages/installation/admins-security/2fa.adoc b/docs/ua/modules/admin/pages/installation/admins-security/2fa.adoc new file mode 100644 index 0000000000..48552e9a63 --- /dev/null +++ b/docs/ua/modules/admin/pages/installation/admins-security/2fa.adoc @@ -0,0 +1,75 @@ += Налаштування двохфакторної автентифікації +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +== Загальні положення + +Двохфакторна автентифікація (2FA) є важливою стратегією в кібербезпеці, яка забезпечує додатковий рівень захисту облікових записів, комбінуючи два різні типи перевірки - зазвичай це щось, що користувач знає (пароль), і щось, що користувач має (наприклад, мобільний телефон або токен). Цей метод значно ускладнює несанкціонований доступ, зменшуючи ризики, пов'язані зі слабкими або скомпрометованими паролями, та допомагає відповідати нормативним вимогам. Незважаючи на додатковий крок у процесі входу та потенційні технічні виклики, переваги 2FA в контексті зростаючих кіберзагроз є значними, що робить її критично важливим компонентом у стратегії кібербезпеки Платформи Реєстрів. + +== Кроки налаштування 2FA + +1. Вхід в Адміністративну Консоль Keycloak +2. Виберіть _openshift_ реалм, для якого будуть здійснені налаштування. +3. У меню зліва виберіть "Authentication". +4. Перейдіть у вкладку "Flows" +5. Навпроти "Browser - Conditional OTP " поставте перемикач у положення "REQUIRED" +6. Переконайтесь що на кроці "Condition - User Configured" та OTP Form перемикач також у положенні "REQUIRED" +7. Переконайтесь що у вкладці "Required Actions" параметр "Configure OTP" увімкнений (див. Зображення Кроки налаштування OTP "Required Actions" ) +8. При наступному вході адміністративному користувачеві буде запропоновано налаштувати двухфакторну автентифікацію (див. Зображення 2 та наступну секцію) + +CAUTION: Процедура має бути повторена для _-admin_ реалму реєстру для випадків, коли користувача було створено не через Control Plane, а напряму в реєстровому реалмі через Keycloak UI. + +.Кроки налаштування двохфакторної автентифікації +image::admins-security/2fa.png[Кроки налаштування двохфакторної автентифікації] + +.Кроки налаштування OTP "Required Actions" +image::admins-security/required_actions_otp.png[Кроки налаштування OTP "Required Actions"] + +== Кроки налаштування автентифікатора + +. Вхід в Адміністративну Консоль Keycloak +. Після введення облікових даних зявиться інтерфейс налаштування другого фактору. ++ + +.Кроки налаштування автентифікатора +image::admins-security/authenticator.png[Кроки налаштування автентифікатора] + ++ +[TIP] +-- +Додатки які офіційно підтримуються KeyCloak для налаштування TOTP - Google Authenticator та FreeOTP. Microsoft Authenticator, на момент написання розділу (кінець 2023 року), може бути використаний лише за умови налаштування OTP політики з ненадійним алгоритмом SHA1 та не рекомендується. +-- + +. Встановіть додаток "Google Authenticator" на ваш мобільний пристрій. +. Відкрийте додаток та натисніть "+" додати обліковий запис. +. Відскануйте згенерований RQ-код з другого кроку (якщо треба надайте "Google Authenticator" доступ до камери). ++ + +.Відскануйте QR-код +image::admins-security/qr_scan.png[Відскануйте QR-код] + +. Переконайтесь що новий обліковий запис було додано ++ + +.Обліковий запис додано +image::admins-security/authenticator_added.png[Обліковий запис додано] + +. Введіть згенерований одноразовий код в інтерйесі з другого кроку +. Введіть довільний ідентифікатор вашого пристрою. Будь-яка назва яка для вас буде ідентифікувати використаний пристрій з автентифікатором +. Підтверте форму. + +== Кроки налаштування параметрів OTP + +1. Вхід в Адміністративну Консоль Keycloak +2. Виберіть openshift realm, для якого будуть здійснені налаштування. +3. У меню зліва виберіть "Authentication". +4. Перейдіть у вкладку "OTP Policy" +5. Змініть "OTP Hash Algorithm" на SHA256 +6. Збережіть зміни + +.Кроки налаштування OTP політик +image::admins-security/otp_policy.png[Кроки налаштування OTP політик] + +[TIP] +-- +Хоча SHA1 широко використовується та підтримується, він вважається слабшим , ніж SHA256 або SHA512. Якщо можливо, використовуйте SHA256 або SHA512 для підвищення безпеки. Однак переконайтеся, що ваш вибір сумісний із користувацькими OTP додатками. +-- diff --git a/docs/ua/modules/admin/pages/installation/admins-security/bruteforce-protection.adoc b/docs/ua/modules/admin/pages/installation/admins-security/bruteforce-protection.adoc new file mode 100644 index 0000000000..4076564fb3 --- /dev/null +++ b/docs/ua/modules/admin/pages/installation/admins-security/bruteforce-protection.adoc @@ -0,0 +1,31 @@ += Захист від підбору паролів +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +== Загальні положення + +Захист від атак brute force є ключовим аспектом забезпечення безпеки для системи управління ідентифікацією та доступом, як Keycloak. Атаки brute force полягають у спробах несанкціонованого доступу шляхом безперервного підбору паролів, що може призвести до компрометації облікових записів. Щоб запобігти таким атакам, необхідно впровадити механізми, які обмежують кількість спроб входу та встановлюють часові затримки після невдалих спроб. + +=== Кроки налаштування + +1. Вхід в Адміністративну Консоль Keycloak +2. Виберіть openshift realm, для якого будуть здійснені налаштування. +3. У меню зліва виберіть "Realm Settings". +4. Перейдіть до вкладки "Security Defenses". +5. Нище перейдіть до вкладки "Brute Force Detection" +6. Увімкніть перемиках +7. Конфігурація параметрів + +*Постійне Блокування (Permanent Lockout):* Не рекомендується включати постійне блокування, оскільки це може призвести до відмови у обслуговуванні та незручностей для користувачів. + +*Максимальна Кількість Невдалих Спроб Входу (Max Login Failures):* 5 спроб + +*Збільшення Часу Очікування (Wait Increment):* 300 секунд + +Це часовий період, що додається до часу блокування після кожної невдалої спроби входу після досягнення порога максимальної кількості невдалих спроб. + +*Швидка Перевірка Входу (Quick Login Check):* Рекомендоване значення 1000 мілісекунд (1 секунда) + +Це мінімальний час між спробами входу. Установка його на 1 секунду може запобігти швидким автоматизованим атакам, не впливаючи значно на користувацький досвід. + +*Мінімальний Час Швидкого Входу (Minimum Quick Login Wait):* 2 хвилини + +Це мінімальний час очікування для спроби входу після невдачі. + +*Максимальний Час Очікування (Max Wait):* 30 хвилин + +Це максимальний час, протягом якого користувач буде заблокований після повторних невдач. + +*Час Скидання Невдач (Failure Reset Time):* 12 годин + +Це час, після якого кількість невдач для користувача скидається, якщо не було невдач. + + +.Кроки налаштування OTP політик +image::admins-security/bruteforce_protection.png[Кроки налаштування OTP політик] \ No newline at end of file diff --git a/docs/ua/modules/admin/pages/installation/admins-security/overview.adoc b/docs/ua/modules/admin/pages/installation/admins-security/overview.adoc new file mode 100644 index 0000000000..a425c977e6 --- /dev/null +++ b/docs/ua/modules/admin/pages/installation/admins-security/overview.adoc @@ -0,0 +1,9 @@ += Безпечне налаштування адміністративних акаунтів + +Безпечне налаштування систем та облікових записів адміністраторів платформи є критично важливим для забезпечення захисту від кіберзагроз та несанкціонованого доступу. Воно включає застосування надійної політики паролів, впровадження двофакторної аутентифікації для додаткового рівня перевірки, та активацію захисту від brute force атак. + +== Огляд розділу + +* xref:admin:installation/admins-security/password-policy.adoc[] +* xref:admin:installation/admins-security/2fa.adoc[] +* xref:admin:installation/admins-security/bruteforce-protection.adoc[] \ No newline at end of file diff --git a/docs/ua/modules/admin/pages/installation/admins-security/password-policy.adoc b/docs/ua/modules/admin/pages/installation/admins-security/password-policy.adoc new file mode 100644 index 0000000000..a281f26559 --- /dev/null +++ b/docs/ua/modules/admin/pages/installation/admins-security/password-policy.adoc @@ -0,0 +1,123 @@ += Політика паролів +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +== Загальний опис + +Цей розділ описує еволюцію в підходах до політики паролів у сфері кібербезпеки. Традиційно, визначені стандарти, такі як PCI DSS (Стандарт безпеки даних індустрії платіжних карток) та ISO/IEC 27001 (Міжнародний стандарт управління інформаційною безпекою), акцентували на необхідності використання складних паролів. Ці паролі включали комбінації великих і малих літер, цифр та спеціальних символів для підвищення захисту від несанкціонованого доступу. + +Однак, з часом організації, такі як NIST та OWASP, почали віддавати перевагу підходам, які зосереджуються на довжині та унікальності паролів, зменшуючи акцент на використанні спецсимволів та чисел. Це призвело до змін у стандартизованих практиках парольної безпеки, роблячи їх більш орієнтованими на зручність запам'ятовування паролів та зменшення ризику створення слабких або легко вгадуваних паролів. + +NOTE: Наведені нижче налаштування є рекомендаціями, а не обов'язковими вимогами. + +== Базова політика + +Цей розділ висвітлює класичний підхід до складності паролів. + +. Відкрийте адміністративну консоль Keycloak. +. Оберіть `openshift` realm для налаштування парольної політики. +. У меню зліва виберіть розділ *Authentication*. +. Перейдіть до вкладки *Password Policy*. +. Додайте нову політику через кнопку *`Add policy`*. +. Виберіть *Regular Expression*, встановіть потрібне значення та збережіть зміни. ++ +[source] +---- +^(?=.*[0-9])(?=.*[a-z])(?=.*[A-Z])(?=.*[@#$%^&+=])(?=\S+$)[a-zA-Z0-9@#$%^&+=]{10,}$ +---- ++ +[TIP,caption="Вимоги до паролю"] +-- +1. Мінімум 10 символів. +2. Принаймні одна мала літера. +3. Принаймні одна велика літера. +4. Мінімум одна цифра. +5. Принаймні один спеціальний символ (`@, #, $, %, ^, &, +, =`). +6. Лише латинські літери. +7. Без пробілів. +-- + +.Кроки налаштування базової політики +image::admins-security/password_policy_general.png[Кроки налаштування базової політики] + +[configure-steps] +=== Політика "Not Recently Used" + +Додаткова політика *Not Recently Used* забороняє встановлення 5 останніх використаних паролів. + +. Увійдіть до адміністративної консолі Keycloak. +. Оберіть реалм. +. Виберіть розділ *Authentication* у меню зліва. +. Перейдіть до *Password Policy*. +. Оберіть *`Add policy`* та встановіть політику *Not Recently Used*. ++ +image::admins-security/not-recently-used.png[] + +== Просунута політика + +Ця секція розглядає просунуту політику паролів, що базується на впровадженні рекомендацій OWASP ASVS 2.1 Password Security та NIST Special Publication 800-63: Digital Identity Guidelines. Основна увага тут приділяється створенню паролів, які були б не тільки безпечними, але й інтуїтивно зрозумілими та легкими для запам'ятовування. + +Ключові аспекти цієї політики включають: :: + +. Використання довгих паролів, які забезпечують кращий захист. +. Дозвіл на включення пробілів у паролях, що робить їх більш читабельними. +. Впровадження символів Unicode, які розширюють можливості для створення складніших та унікальних паролів. +. Використання чорного списку (blacklist) поширених паролів, який запобігає вибору надто очевидних або часто використовуваних паролів, які можуть бути вразливими до онлайн-атак. ++ +CAUTION: Функція blacklist загальних паролів доступна починаючи з версії 1.9.8. Ця функція значно підвищує рівень безпеки, запобігаючи використанню слабких та загальновідомих паролів, які часто стають мішенню для хакерів. + +[configure-steps] +=== Кроки налаштування + +. Відкрийте адміністративну консоль *Keycloak* та увійдіть за допомогою облікових даних адміністратора. +. Виберіть `openshift` realm, для якого буде налаштована політика паролів. +. У меню зліва виберіть розділ *Authentication*. +. Перейдіть до вкладки *Password Policy*. +. Натисніть *`Add policy`*, щоб додати нову політику. +. Виберіть *Minimum Length* та встановіть значення `12`. +. Виберіть *Password Blacklist* та встановіть значення `blacklist.txt`. +. Збережіть зміни. + +[TIP] +==== +- *Мінімальна довжина пароля*: Встановлено обов'язкову мінімальну довжину пароля в 12 символів, що забезпечує підвищену безпеку. +- *Максимальна довжина пароля*: Keycloak підтримує створення паролів до 64 символів або більше, дозволяючи формувати складніші комбінації. +- *Використання пробілів у паролях*: Платформа Keycloak дозволяє включення пробілів у паролях, не видаляючи їх автоматично, що додає гнучкості у формуванні паролів. +- *Підтримка символів Unicode*: Використання різноманітних символів Unicode дозволено в паролях, розширюючи можливості для їхнього унікального створення. +- *Відсутність жорстких обмежень на склад пароля*: Не рекомендується створювати політику паролів, що обмежує використання певних типів символів, для забезпечення гнучкості та безпеки. +==== + +.Кроки налаштування просунутої політики +image::admins-security/password_policy_advanced.png[Кроки налаштування просунутої політики] + +== Примусова зміна паролів користувачів + +Keycloak не пропонує вбудованого рішення для масової зміни паролів, але є два способи здійснення цього: + +* через *Required User Actions* в адміністративному інтерфейсі KeyCloak; +* автоматизовано, за допомогою скрипту через *Keycloak REST API*. + +=== Ручні кроки + +. Відкрийте адміністративну консоль Keycloak та увійдіть за допомогою своїх облікових даних адміністратора. + +. У верхньому лівому куті виберіть потрібний реалм, де ви хочете примусово змінити паролі користувачам. + +. У лівому меню перейдіть до розділу *Users*. + +. Відкрийте список користувачів у реалмі та клікніть на ім'я користувача, щоб відкрити його налаштування. + +. На вкладці *Details*, у полі *Required User Actions* виберіть `Update Password`. + +. Збережіть зміни. + +.Кроки налаштування примусової зміни паролів користувачів вручну +image::admins-security/password_reset.png[Кроки налаштування примусової зміни паролів користувачів в ручну] + +NOTE: Такі дії потрібно виконати для кожного користувача окремо. Якщо кількість користувачів велика, це може бути доволі кропітким процесом. + +=== Автоматизація процесу зміни паролів + +У випадку, коли необхідно управляти великою кількістю користувацьких акаунтів, ви можете скористатися можливостями *Keycloak REST API* для автоматизації процесу встановлення дії *Update Password* (оновлення пароля) для кожного користувача. + +Для цього потрібно розробити спеціалізований скрипт, який послідовно пройде через всі облікові записи користувачів у вибраному реалмі та застосує потрібну дію. Це значно спрощує та прискорює процес зміни паролів, особливо при великій кількості користувачів, і мінімізує необхідність вручну змінювати налаштування для кожного облікового запису окремо. + diff --git a/docs/ua/modules/admin/pages/installation/okd-requirements.adoc b/docs/ua/modules/admin/pages/installation/okd-requirements.adoc index 4feab2e127..bf3185d485 100644 --- a/docs/ua/modules/admin/pages/installation/okd-requirements.adoc +++ b/docs/ua/modules/admin/pages/installation/okd-requirements.adoc @@ -3,17 +3,20 @@ include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc include::platform:ROOT:partial$admonitions/language-ua.adoc[] +*_OKD_* є community-версією Kubernetes, яка розвивається під егідою Red Hat. Це відкритий проєкт, що надає платформу для розгортання, управління та масштабування контейнеризованих застосунків. Дізнатися більше можна на офіційному вебсайті https://www.okd.io/[OKD] та у https://www.okd.io/docs/[документації]. + Для виведення Платформи реєстрів у промислову експлуатацію слід обов'язково використовувати віртуальні інфраструктури, що отримують офіційну підтримку. Наразі це: https://aws.amazon.com/[Amazon Web Services (AWS)], https://azure.microsoft.com/[Microsoft Azure (Azure)], https://cloud.google.com/[Google Cloud Platform (GCP)] та https://www.vmware.com/products/vsphere.html[VMWare vSphere]. На таких інфраструктурах необхідно встановити OKD-кластер, версія якого відповідає вимогам Платформи, визначеним нижче. .Вимоги до OKD-кластерів щодо інсталювання Платформи реєстрів [options="header"] |=== -| +++Версія Платформи+++ | +++ Підтримувані версії OKD +++ +| Версія Платформи | Підтримувані версії OKD | `1.9.2` | `4.11` | `1.9.3` | `4.11` | `1.9.4` | `4.11` | `1.9.5` | `4.11` | `1.9.6` | `4.11` +| `1.9.7` | `4.11`, `4.12` |=== Встановлення та налаштування Платформи виконується відповідно до вказівок, наданих в офіційній документації Платформи: diff --git a/docs/ua/modules/admin/pages/installation/overview.adoc b/docs/ua/modules/admin/pages/installation/overview.adoc index c33e6b52fa..b7e5bcdbad 100644 --- a/docs/ua/modules/admin/pages/installation/overview.adoc +++ b/docs/ua/modules/admin/pages/installation/overview.adoc @@ -5,28 +5,19 @@ include::platform:ROOT:partial$admonitions/language-ua.adoc[] В цьому розділі описані усі аспекти, пов'язані з розгортанням Платформи. -//This section covers all the aspects related to the Platform deployment. В підрозділі _Вимоги до OKD-кластерів щодо інсталювання Платформи_ можна знайти опис віртуальних інфраструктур, які підтримуються, а також вимоги до встановлення кластеру OKD залежно від версії Платформи. -//In the _Platform for state registries: requirements for OKD clusters_ subsection you can find the description of the supported virtual infrastructures and requirements to the installed OKD cluster depending on the Platform version. Підрозділ _Розгортання Платформи на цільових оточеннях_ надає покрокові інструкції для розгортання Платформи в чотирьох хмарних середовищах. -//The _Deploying the Platform on target environments_ subsection provides the step-by-step instructions for the Platform deployment in four cloud environments. Підрозділ _Налаштування внутрішнього SMTP-сервера_ надає необхідну інформацію для забезпечення налаштування компонента `smtp-server`, що використовується для надсилання сповіщень користувачам Платформи. -//The _Configuring internal SMTP server_ subsection gives the required information for configuring the `smtp-server` component used for sending notifications to the Platform users. У підрозділі _Зміна мережевого провайдера кластера OKD 4.x_ ви можете дізнатися про доступні варіанти зміни мережевого провайдера. -//In the _Changing the network provider of the OKD 4.x cluster_ subsection, you can learn about the available options for changing the network provider. == Огляд розділу * xref:installation/okd-requirements.adoc[Вимоги до OKD-кластерів щодо інсталювання Платформи] * xref:installation/platform-deployment/platform-deployment-overview.adoc[Розгортання Платформи на цільових оточеннях] -//** xref:installation/platform-deployment/platform-aws-deployment.adoc[] -//** xref:installation/platform-deployment/platform-azure-deployment.adoc[] -//** xref:installation/platform-deployment/platform-gcp-deployment.adoc[] -//** xref:installation/platform-deployment/platform-vsphere-deployment.adoc[] -//* xref:installation/griada/griada-301-deployment.adoc[Розгортання програмного емулятора криптомодуля Гряда-301] * xref:installation/internal-smtp-server-setup.adoc[Налаштування внутрішнього SMTP-сервера] -* xref:installation/changing-network-provider.adoc[Зміна мережевого провайдера кластера OKD 4.x] \ No newline at end of file +* xref:installation/changing-network-provider.adoc[Зміна мережевого провайдера кластера OKD 4.x] +* xref:installation/admins-security/overview.adoc[] \ No newline at end of file diff --git a/docs/ua/modules/admin/pages/installation/platform-deployment/platform-aws-deployment.adoc b/docs/ua/modules/admin/pages/installation/platform-deployment/platform-aws-deployment.adoc index e27d87aa98..87c3728201 100644 --- a/docs/ua/modules/admin/pages/installation/platform-deployment/platform-aws-deployment.adoc +++ b/docs/ua/modules/admin/pages/installation/platform-deployment/platform-aws-deployment.adoc @@ -16,8 +16,8 @@ include::platform:ROOT:partial$admonitions/language-ua.adoc[] Документація: :: -* [*] Документ xref:release-notes:release-notes.adoc[Примітки до релізу]; -* [*] Документ xref:release-notes:backward-incompatible-changes.adoc[Зворотно несумісні зміни]; +//* [*] Документ xref:release-notes:release-notes.adoc[Примітки до релізу]; +//* [*] Документ xref:release-notes:backward-incompatible-changes.adoc[Зворотно несумісні зміни]; * [*] Документ xref:update/overview.adoc[]. Він потрібний лише для процедури оновлення Платформи. Сертифікати цифрового підпису (digital-signature-ops сертифікати): :: @@ -225,678 +225,298 @@ TIP: Докладніше процес створення IAM-користува [#deploy-additional-recources-for-okd] == Розгортання додаткових ресурсів для інсталяції OKD-кластера в AWS -Для вдалого встановлення кластера та платформи, потрібно підняти наступні ресурси в AWS. На малюнку нижче зображена схема інфраструктури із ними. +Для вдалого встановлення кластера та платформи, потрібно підняти наступні ресурси в AWS. На малюнку нижче зображена схема інфраструктури із ними. Це зроблено для спрощення інсталяції платформи та уникнення небажаних помилок, які можуть бути пов’язані з встановленням із локального комп'ютера. -image:installation/aws/installation-aws-1.png[image,width=468,height=375] +image:installation/aws/installation-aws-1.svg[image,width=468,height=375] -Це можна зробити самостійно за рекомендаціями зазначеними нижче або використати підготовлений Terraform-код. +=== Опис додаткових ресурсів -=== Опис Terraform-коду - -Як приклад автоматизації процесу було реалізовано Terraform-код, який можна підлаштувати під свої параметри та використати для розгортання інфраструктури. - -==== Початковий Terraform-код - -Це Terraform-код, який створить ресурси для подальших кроків. До таких ресурсів відносяться: - -* S3 Bucket -- сховище для зберігання файлів _*.tfstate_; -* DynamoDB Table -- таблиця, необхідна для блокування стану Terraform. +Більш докладний опис додаткових ресурсів зі схеми подано нижче: -.Початковий код. Опис шаблонів Terraform -==== -.main.tf -[%collapsible] -===== -[source,terraform] ----- -data "aws_caller_identity" "current" {} +* *S3-кошик* -- використовується для зберігання стану Terraform; +* *DynamoDB table* -- використовується для збереження інформації про блокування стану Terraform; +* *NAT Gateway* -- використовується для забезпечення приватного сервера доступом до інтернету; +* *Bastion* -- використовується як проміжний сервер для забезпечення безпечного та обмеженого доступу до сервера у приватній мережі. Надалі, через цей bastion буде створено SSH-тунель до deployer-node; +* *Deployer-node* -- сервер у приватній мережі, через який буде відбуватися інсталяція кластера та Платформи. -module "s3_bucket" { - source = "terraform-aws-modules/s3-bucket/aws" - version = "3.6.0" +Розгорнути ці ресурси можна за допомогою підготовленого Terraform-коду у наступних кроках. - bucket = "terraform-states-${data.aws_caller_identity.current.account_id}" - acl = "private" - # S3 bucket-level Public Access Block configuration - block_public_acls = true - block_public_policy = true - ignore_public_acls = true - restrict_public_buckets = true +==== Рекомендовані налаштування bastion - versioning = { - enabled = true - } +У таблиці нижче наведено рекомендовані налаштування для bastion . - tags = merge(var.tags) -} - -module "dynamodb_table" { - source = "terraform-aws-modules/dynamodb-table/aws" - version = "3.1.2" +.Налаштування bastion +[width="100%",cols="6%,33%,61%",options="header",] +|=== - name = var.table_name - billing_mode = "PROVISIONED" - read_capacity = "1" - write_capacity = "1" - hash_key = "LockID" +|*№* |*Опція налаштування* |*Значення* - attributes = [ - { - name = "LockID" - type = "S" - } - ] +|1 |Instance type |t2.nano +|2 |vCPUs |1 +|3 |RAM |0.5 GiB +|4 |CPU Credits/hr |3 +|5 |Platform |Ubuntu +|6 |AMI name |ubuntu-bionic-18.04-amd64-server-20210224 +|7 |Volume |8 Gb - tags = merge(var.tags, tomap({ "Name" = var.table_name })) -} ----- -===== +|=== +==== Рекомендовані налаштування deployer-node -.providers.tf -[%collapsible] -===== -[source,terraform] ----- -terraform { - required_version = "= 1.3.7" -} +У таблиці нижче наведено рекомендовані налаштування для deployer-node. -provider "aws" { - region = var.region -} ----- -===== +.Налаштування deployer-node +[width="100%",cols="6%,33%,61%",options="header",] +|=== -.terraform.tfvars -[%collapsible] -===== -[source,terraform] ----- -region = "eu-central-1" -tags = { - "SysName" = "EPAM" - "Department" = "MDTU-DDM" - "user:tag" = "mdtuddm1" -} ----- -===== +|*№* |*Опція налаштування* |*Значення* +|1 |Instance type |t2.medium +|2 |vCPUs |2 +|3 |RAM |4 GiB +|4 |CPU Credits/hr |24 +|5 |Platform |Ubuntu +|6 |AMI name |ubuntu-bionic-18.04-amd64-server-20210224 +|7 |Volume |150 Gb -.variables.tf -[%collapsible] -===== -[source,terraform] ----- -variable "region" { - description = "The AWS region to deploy the cluster into, e.g. eu-central-1" - type = string -} +|=== -variable "s3_states_bucket_name" { - description = "Prefix for S3 bucket name. Since the name should be unique the account number will be added as suffix, e.g. terraform-states-" - type = string - default = "terraform-states" -} +=== Додаткові налаштування -variable "table_name" { - description = "the name of DynamoDb table to store terraform tfstate lock" - type = string - default = "terraform_locks" -} +==== Встановлення необхідних інструментів -variable "tags" { - description = "A map of tags to apply to all resources" - type = map(any) -} ----- -===== -==== +Для подальших дій потрібно встановити необхідні інструменти на локальний комп'ютер: -==== Основний Terraform-код +* unzip; +* https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html[aws cli v2]; +* https://docs.docker.com/engine/install/[terraform v1.6.6]. -Основний Terraform-код, розгортає усі необхідні ресурси. Опис шаблонів наведено нижче. +Перевірити правильність встановлення інструментів можна за допомогою наступних команд: -.Основний код. Опис шаблонів Terraform +.Перевірка встановлення інструментів ==== -.main.tf -[%collapsible] -===== -[source,terraform] +.Перевірка unzip ---- -module "vpc" { - source = "terraform-aws-modules/vpc/aws" - version = "3.19.0" - - name = var.platform_name - - cidr = var.platform_cidr - azs = var.subnet_azs - private_subnets = var.private_cidrs - public_subnets = var.public_cidrs - - enable_dns_hostnames = true - enable_dns_support = true - enable_nat_gateway = true - single_nat_gateway = true - one_nat_gateway_per_az = false - - tags = var.tags -} - -module "ec2_instance" { - source = "terraform-aws-modules/ec2-instance/aws" - version = "4.3.0" - - name = var.node_name - - ami = var.node_ami - instance_type = var.node_type - key_name = module.key_pair.key_pair_name - vpc_security_group_ids = [aws_security_group.sg_private.id] - subnet_id = module.vpc.private_subnets[0] - user_data = templatefile("files/user_data.sh.tpl", { cross_account_role = var.cross_account_role_arn }) - iam_instance_profile = aws_iam_instance_profile.node_profile.name - enable_volume_tags = false - - root_block_device = [ - { - encrypted = false - volume_type = var.volume_type - volume_size = var.volume_size - tags = var.tags - }, - ] - - tags = var.tags -} - -module "ec2_bastion" { - source = "terraform-aws-modules/ec2-instance/aws" - version = "4.3.0" - - name = "bastion" - - ami = var.node_ami - instance_type = "t2.nano" - key_name = module.key_pair.key_pair_name - vpc_security_group_ids = [aws_security_group.sg_public.id] - subnet_id = module.vpc.public_subnets[0] - enable_volume_tags = false - - tags = var.tags -} - -module "key_pair" { - source = "terraform-aws-modules/key-pair/aws" - version = "2.0.1" - - key_name = var.key_pair - public_key = trimspace(tls_private_key.main.public_key_openssh) - tags = merge(var.tags, { - "Name" = var.key_pair - }) -} +$ unzip -v ---- -===== - -.providers.tf -[%collapsible] -===== -[source,terraform] ----- -terraform { - required_version = "= 1.3.7" - - # Fill the gaps instead <...> - backend "s3" { - bucket = "terraform-states-" - key = "node/eu-central-1/terraform/terraform.tfstate" - region = "eu-central-1" - acl = "bucket-owner-full-control" - dynamodb_table = "terraform_locks" - encrypt = true - } - - required_providers { - aws = { - source = "hashicorp/aws" - version = ">= 4.51.0" - } - } -} -provider "aws" { - region = var.region -} +.Перевірка aws cli +---- +$ aws --version ---- -===== -.iam-node-role.tf -[%collapsible] -===== -[source,terraform] +.Перевірка terraform +---- +$ terraform version ---- -data "aws_iam_policy_document" "assume_role_policy" { - statement { - actions = ["sts:AssumeRole"] - principals { - type = "Service" - identifiers = ["ec2.amazonaws.com"] - } +==== - } -} +==== Налаштування AWS CLI -resource "aws_iam_role" "node_role" { - name = var.role_name - description = "IAM role to assume to initial node" - assume_role_policy = data.aws_iam_policy_document.assume_role_policy.json - force_detach_policies = true +За допомогою AWS CLI автентифікуйтесь в обліковому записі AWS. Для цього виконайте наступну команду: - inline_policy { - name = "CrossAccountPolicy" +.*Автентифікація в обліковому записі AWS* +[source,bash] +---- +$ aws configure +AWS Access Key ID [None]: ******************** +AWS Secret Access Key [None]: *************************************** +Default region name [None]: eu-central-1 +Default output format [None]: json +---- - policy = jsonencode({ - Version = "2012-10-17" - Statement = [ - { - Action = "sts:AssumeRole" - Effect = "Allow" - Resource = var.cross_account_role_arn - }, - ] - }) - } - tags = merge(var.tags, tomap({ "Name" = var.role_name })) -} +TIP: Докладніше процес автентифікація в обліковому записі AWS за допомогою AWS CLI описано в офіційній документації на сайті AWS: https://docs.aws.amazon.com/cli/latest/userguide/cli-authentication-user.html#cli-authentication-user-configure.title[Configure the AWS CLI]. -resource "aws_iam_instance_profile" "node_profile" { - name = var.role_name - role = aws_iam_role.node_role.name +==== Налаштування AWS cross account - tags = var.tags -} ----- -===== +Перед запуском Terraform-код його необхідно завантажити. Для цього треба отримати доступ до AWS S3 бакету, в якому він знаходиться. Це можливо лише за умови, що створена спеціальна IAM-роль. Це можна зробити, виконавши наступні кроки: -.elastic-ip.tf -[%collapsible] -===== -[source,terraform] +. Створіть AWS IAM-роль. ++ +[source,bash] ---- -resource "aws_eip" "bastion_ip" { - instance = module.ec2_bastion.id - - tags = merge(var.tags, { - "Name" = "bastion-ip" - }) -} +$ aws iam create-role \ + --role-name UserCrossAccountRole \ + --description "Role for uploading terraform files from AWS S3" \ + --assume-role-policy-document '{ + "Version": "2012-10-17", + "Statement": [ + { + "Action": "sts:AssumeRole", + "Effect": "Allow", + "Principal": { + "AWS": "arn:aws:iam:::root" + } + } + ] + }' ---- -===== - -.security-groups.tf -[%collapsible] -===== -[source,terraform] ----- -resource "aws_security_group" "sg_public" { - name = "sg public for bastion" - vpc_id = module.vpc.vpc_id - ingress { - from_port = var.ssh_port - to_port = var.ssh_port - protocol = "tcp" - # cidr_blocks = var.ingress_cidr_blocks - prefix_list_ids = [var.prefix_list_ids] - } - - egress { - from_port = 0 - to_port = 0 - protocol = "-1" - cidr_blocks = ["0.0.0.0/0"] - } - tags = merge(var.tags, { - "Name" = "sg-public" - }) -} ++ +[NOTE] +==== +* *``* -- додайте сюди ID від облікового запису AWS. +==== -resource "aws_security_group" "sg_private" { - name = "sg private for node" - vpc_id = module.vpc.vpc_id - ingress { - from_port = var.ssh_port - to_port = var.ssh_port - protocol = "tcp" - security_groups = [aws_security_group.sg_public.id] - } - - egress { - from_port = 0 - to_port = 0 - protocol = "-1" - cidr_blocks = ["0.0.0.0/0"] - } - tags = merge(var.tags, { - "Name" = "sg-private" - }) -} +. Створіть AWS IAM-політику. ++ +[source,bash] ---- -===== - -.ssh-key.tf -[%collapsible] -===== -[source,terraform] +$ aws iam create-policy \ + --policy-name UserCrossAccountPolicy \ + --policy-document '{ + "Version": "2012-10-17", + "Statement": [ + { + "Action": "sts:AssumeRole", + "Effect": "Allow", + "Resource": "arn:aws:iam::764324427262:role/CustomCrossAccountRole" + } + ] + }' ---- -resource "tls_private_key" "main" { - algorithm = "RSA" -} - -resource "null_resource" "main" { - provisioner "local-exec" { - command = "echo \"${tls_private_key.main.private_key_pem}\" > private.key" - } - provisioner "local-exec" { - command = "chmod 600 private.key" - } -} +. Приєднайте політику до ролі. ++ +[source,bash] ---- -===== +$ aws iam attach-role-policy \ + --role-name UserCrossAccountRole \ + --policy-arn arn:aws:iam:::policy/UserCrossAccountPolicy +---- ++ +[NOTE] +==== +* *``* -- додайте сюди ID від облікового запису AWS. +==== -.files/user_data.sh.tpl -[%collapsible] -===== -[source,sh] +. Додайте до файлу `config` необхідні значення для ролі. ++ +[source,bash] ---- -#!/bin/bash -export VERSION_STRING=5:20.10.23~3-0~ubuntu-bionic - -# Install docker -sudo apt-get update -y -sudo apt-get install \ - ca-certificates \ - curl \ - gnupg \ - lsb-release -y -sudo mkdir -p /etc/apt/keyrings -curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg -echo \ - "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \ - $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null -sudo apt-get update -y -sudo apt-get install docker-ce=$VERSION_STRING docker-ce-cli=$VERSION_STRING containerd.io docker-compose-plugin -y -sudo usermod -aG docker ubuntu - -# Install unzip -sudo apt install unzip -y - -# Install aws-cli-v2 -curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip" -unzip awscliv2.zip -sudo ./aws/install - -# Configure config for cross account integration -mkdir -p /home/ubuntu/.aws -touch /home/ubuntu/.aws/config -cat <> /home/ubuntu/.aws/config -[profile cross-account-role] -role_arn = ${cross_account_role} -credential_source = Ec2InstanceMetadata +$ cat <> ~/.aws/config +[profile user-cross-account-role] +role_arn = arn:aws:iam::764324427262:role/CustomCrossAccountRole +source_profile = default EOT ---- -===== - -.terraform.tfvars -[%collapsible] -===== -[source,terraform] ----- -# Check out all the inputs based on the comments below and fill the gaps instead <...> -# More details on each variable can be found in the variables.tf file - -region = "eu-central-1" -platform_name = "okd-4-11" # the name of the cluster and AWS resources -platform_cidr = "10.0.0.0/16" -# The following will be created or used existing depending on the create_vpc value -subnet_azs = ["eu-central-1a", "eu-central-1b", "eu-central-1c"] -private_cidrs = ["10.0.1.0/24"] -public_cidrs = ["10.0.101.0/24"] - -ssh_port = 22 - -# Uncomment this line to use a custom IP address for the SSH connection -#ingress_cidr_blocks = [""] - -# Using prefix-list from epam-east-eu -prefix_list_ids = "pl-0ede2509a36215538" -node_name = "initial-node" -node_ami = "ami-0e0102e3ff768559b" -node_type = "t2.medium" -key_pair = "node_key" +. Для доступу до файлів із зовнішнього облікового запису AWS, зверніться до команди підтримки. Вам потрібно, щоб вони додали ID вашого AWS облікового запису до списку довірених (trust relationship) для ролі `CustomCrossAccountRole` у їхньому обліковому записі AWS. -volume_type = "gp3" -volume_size = 150 +==== Завантаження Terraform-коду -role_name = "CustomEC2Role" -cross_account_role_arn = "arn:aws:iam::764324427262:role/CustomCrossAccountRole" - -tags = { - "SysName" = "EPAM" - "Department" = "MDTU-DDM" - "user:tag" = "mdtuddm1" -} +. Завантажте архів з Terraform-кодом. ++ +[source,bash] ---- -===== - -.variables.tf -[%collapsible] -===== -[source,terraform] +$ aws s3 cp s3://mdtu-ddm-platform-installer/terraform/terraform.zip terraform.zip --profile user-cross-account-role ---- -variable "region" { - description = "The AWS region to deploy the cluster into, e.g. eu-central-1" - type = string -} - -variable "platform_name" { - description = "The name of the node that is used for tagging resources. Match the [a-z0-9_-]" - type = string -} - -variable "platform_cidr" { - description = "CIDR of your future VPC" - type = string -} - -variable "subnet_azs" { - description = "Available zones of your future or existing subnets" - type = list(any) - default = [] -} - -variable "private_cidrs" { - description = "CIDR of your future VPC" - type = list(any) - default = [] -} - -variable "public_cidrs" { - description = "CIDR of your future VPC" - type = list(any) - default = [] -} - -variable "node_name" { - description = "The name of the node that is used for tagging resources. Match the [a-z0-9_-]" - type = string -} - -variable "node_ami" { - description = "The ami of the node" - type = string -} - -variable "node_type" { - description = "Type of the node" - type = string -} - -variable "key_pair" { - description = "The name of DynamoDb table to store terraform tfstate lock" - type = string -} - -variable "volume_type" { - description = "Root volume type of the node" - type = string -} - -variable "volume_size" { - description = "Root volume size of the node" - type = number -} - -variable "ssh_port" { - description = "Open the 22 port" - type = number -} - -#Use this for a custom IP address for the SSH connection -#variable "ingress_cidr_blocks" { -# description = "IP CIDR blocks for bastion" -# type = list(string) -#} -variable "prefix_list_ids" { - description = "IP CIDR blocks for bastion" - type = string -} - -variable "role_name" { - description = "The AWS IAM role name for initial node" - type = string -} - -variable "cross_account_role_arn" { - description = "The AWS IAM role arn to assume from another AWS account" - type = string -} - - -variable "tags" { - description = "A map of tags to apply to all resources" - type = map(any) -} +. Розпакуйте Terraform-код в окрему директорію. ++ +[source,bash] +---- +$ unzip terraform.zip -d ~/terraform ---- -===== - -==== - -[NOTE] -==== -IP-адреса :: -Для підключення через SSH до додаткової віртуальної машини потрібно додати в файл terraform.tfvars необхідну IP адресу. Якщо потрібно відкрити для підключення декілька адрес, то потрібно створити префікс **``prefix-list ``**та використовувати його. -==== - -WARNING: Якщо для підняття додаткових компонентів використано Terraform-код, то перейдіть одразу до пункту xref:#launch-openshift-install[]. -=== Рекомендовані налаштування бастіону +=== Опис Terraform-коду -У таблиці нижче наведено рекомендовані налаштування для бастіону. +Як приклад автоматизації процесу було реалізовано Terraform-код, який можна підлаштувати під свої параметри та використати для розгортання інфраструктури. -.Налаштування бастіону -[width="100%",cols="6%,33%,61%",options="header",] -|=== +==== Початковий Terraform-код -|*№* |*Опція налаштування* |*Значення* +Це Terraform-код, який створить ресурси для подальших кроків. До таких ресурсів відносяться: -|1 |Instance type |t2.nano -|2 |vCPUs |1 -|3 |RAM |0.5 GiB -|4 |CPU Credits/hr |3 -|5 |Platform |Ubuntu -|6 |AMI name |ubuntu-bionic-18.04-amd64-server-20210224 -|7 |Volume |8 Gb +* S3 Bucket +* DynamoDB Table -|=== +{empty} -=== Рекомендовані налаштування додаткової віртуальної машини +Початковий код. Опис Terraform-файлів: :: -У таблиці нижче наведено рекомендовані налаштування для додаткової віртуальної машини. +* `main.tf` -- основний конфігураційний Terraform файл. Він містить модулі для створення: +** S3-бакета; +** таблиці DynamoDB. +* `providers.tf` -- використовується для визначення версії Terraform, необхідних плагінів та параметрів провайдера AWS; +* `variables.tf` -- використовується для опису всіх змінних, які використовуються в конфігурації Terraform; +* `terraform.tfvars` -- містить значення для конкретних змінних, які визначені у конфігураційних файлах Terraform. За потреби змініть значення для наступних параметрів на необхідні: +** `region` -- ця змінна використовується для визначення регіону AWS, в якому будуть створюватися ресурси; +** `tags` -- ця змінна, використовується для додавання тегів (міток) для ресурсів. -[width="100%",cols="6%,33%,61%",options="header",] -|=== +==== Основний Terraform-код -|*№* |*Опція налаштування* |*Значення* -|1 |Instance type |t2.medium -|2 |vCPUs |2 -|3 |RAM |4 GiB -|4 |CPU Credits/hr |24 -|5 |Platform |Ubuntu -|6 |AMI name |ubuntu-bionic-18.04-amd64-server-20210224 -|7 |Volume |150 Gb +Основний Terraform-код, розгортає усі необхідні ресурси. Опис шаблонів наведено нижче. -|=== +.Основний код. Опис Terraform файлів +* `main.tf` -- основний конфігураційний Terraform файл. Він містить модулі для створення: +** `VPC`; +** `ec2_bastion`; +** `ec2_instance`; +** `key_pair`. +* `providers.tf` -- використовується для визначення версії Terraform, необхідних плагінів та параметрів провайдера AWS. Обов'язково змініть значення для наступних параметрів на необхідні: +** `bucket` -- ця змінна містить ім’я S3-бакета. Змініть на ID від облікового запису AWS. +* `iam-node-role.tf` -- використовується для створення спеціальної IAM-ролі із необхідними дозволами. Це дасть змогу налаштувати AWS cross account resource access та завантажити Docker-образ для контейнера та Інсталера; +* `elastic-ip.tf` – використовується для створення ресурсу AWS Elastic IP (EIP) за допомогою Terraform; +* `security-groups.tf` -- створюються Security Groups, які дозволяють SSH-з'єднання (TCP порт 22) для bastion та deployer-node; +* `ssh-key.tf` -- містить код для створення SSH приватного ключа та збереження ключа у файл та налаштування його прав доступу; +* `files/user_data.sh.tpl` -- шаблон скрипту, який буде виконуватися при створенні або оновленні EC2 інстансу в середовищі AWS. Цей скрипт зробить наступне для deployer-node: +** встановить Docker; +** встановить Unzip; +** встановить AWS CLI v2; +** додатково налаштує AWS cross account resource access. +* `variables.tf` -- використовується для опису всіх змінних, які використовуються в конфігурації Terraform; +* `terraform.tfvars` -- містить значення для конкретних змінних, які визначені у конфігураційних файлах Terraform. За потреби змініть значення для наступних параметрів на необхідні: +** `region` -- ця змінна використовується для визначення регіону AWS, в якому будуть створюватися ресурси; +** `platform_name` -- ця змінна використовується для додавання назви для кластера та ресурсів AWS; +** `ingress_cidr_blocks` -- для підключення через SSH до deployer-node потрібно додати сюди необхідну IP адресу; +** `prefix_list_ids` -- якщо потрібно відкрити для підключення декілька адрес, то потрібно створити префікс prefix-list та використовувати в цьому параметрі його ID; +** `tags` -- ця змінна, використовується для додавання тегів (міток) для ресурсів. + +=== Запуск Terraform-коду + +Після зробленних змін в минулих кроках, Terraform-код тепер готовий до запуску. + +==== Запуск початкового Terraform-коду +. Послідовно виконуйте наступні команди для того, щоб увійти до директорії з початковим Terraform-кодом та ініціалізувати робочу Terraform-директорію. ++ +[source,bash] +---- +$ cd ~/terraform/initCode -=== Налаштування AWS cross account +$ terraform init +---- -Щоб встановити кластер та Платформу, необхідно завантажити на додаткову віртуальну машину _Docker-образ для контейнера_ та _Інсталер_. Це можливо лише за умови, що створена спеціальна IAM-роль. +. Використайте наступну команду для застосування змін, визначених у конфігураційних файлах та створення ресурсів. ++ +[source,bash] +---- +$ terraform apply -auto-approve +---- -Потрібно перейти до AWS IAM-сервісу та створити роль для EC2-сервісу із наступними дозволами: +. Дочекайтеся створення ресурсів. -.*_Trusted entities_* -[%collapsible] -==== -[source,json] +==== Запуск основного Terraform-коду +. Послідовно виконуйте наступні команди для того, щоб увійти до директорії з основним Terraform-кодом та ініціалізувати робочу Terraform-директорію. ++ +[source,bash] ---- -{ - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "", - "Effect": "Allow", - "Principal": { - "Service": "ec2.amazonaws.com" - }, - "Action": "sts:AssumeRole" - } - ] -} +$ cd ~/terraform/mainCode + +$ terraform init ---- -==== -.*_Inline permissions policies_* -[%collapsible] -==== -[source,json] +. Використайте наступну команду для застосування змін, визначених у конфігураційних файлах та створення ресурсів. ++ +[source,bash] ---- -{ - "Version": "2012-10-17", - "Statement": [ - { - "Action": "sts:AssumeRole", - "Effect": "Allow", - "Resource": "arn:aws:iam::764324427262:role/CustomCrossAccountRole" - } - ] -} +$ terraform apply -auto-approve ---- -==== - -Після цього необхідно приєднати створену IAM роль до додаткової віртуальної машини. - -TIP: Докладніше про створення IAM-ролі та приєднання її до віртуальної машини описано в офіційній документації на сайті AWS: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html[IAM roles for Amazon EC2]. -=== Додаткові налаштування віртуальної машини +. Дочекайтеся створення ресурсів. -==== Підключення до додаткової віртуальної машини +=== Підключення до deployer-node -Щоб під'єднатися з локального комп'ютера до додаткової віртуальної машини, потрібно створити SSH-тунель. Це потрібно зробити наступною командою: +Щоб під'єднатися з локального комп'ютера до deployer-node, потрібно створити SSH-тунель. Це потрібно зробити наступною командою: .Створення SSH-тунелю ==== @@ -905,7 +525,7 @@ $ ssh -i -L 1256::22 -N -f ubuntu@ ---- ==== -Після створення SSH-тунелю, можна підключатися до додаткової віртуальної машини. Це потрібно зробити наступною командою: +Після створення SSH-тунелю, можна підключатися до deployer-node. Це потрібно зробити наступною командою: .Підключення через SSH ==== @@ -916,69 +536,11 @@ $ ssh -i ubuntu@localhost -p 1256 [IMPORTANT] ==== -Мета додаткової віртуальної машини :: +Мета deployer-node :: -З додаткової віртуальної машини потрібно виконувати усі подальші кроки, а саме інсталяцію кластера та встановлення платформи. +З deployer-node потрібно виконувати усі подальші кроки, а саме інсталяцію кластера та встановлення платформи. ==== -==== Встановлення необхідних інструментів - -Для подальших дій потрібно встановити необхідні інструменти на додаткову віртуальну машину. - -* unzip -* https://docs.docker.com/engine/install/[docker] -* https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html[aws cli v2] - -Перевірити правильність встановлення інструментів можна за допомогою наступних команд: - -.Перевірка встановлення інструментів -==== - -.Перевірка unzip ----- -$ unzip -v ----- - -.Перевірка docker ----- -$ docker --version ----- - -.Перевірка aws cli ----- -$ aws --version ----- - -==== - -==== Використання профілю для AWS cross account - -Необхідно виконати наступні кроки, щоб авторизуватися під роллю, яка має доступ до Docker образу для контейнера та Інсталера. - -. Авторизуватися на машині від IAM-користувача. -+ ----- -$ export AWS_ACCESS_KEY_ID=<КЛЮЧ_ДОСТУПУ> -$ export AWS_SECRET_ACCESS_KEY=<СЕКРЕТНИЙ_КЛЮЧ_ДОСТУПУ> ----- - -. Створити директорію *_.aws_* та файл *_config_* усередині: -+ ----- -$ mkdir -p ~/.aws -$ touch ~/.aws/config ----- - -. Додати до файлу *_config_* необхідні значення для ролі. -+ ----- -$ cat <> ~/.aws/config -[profile cross-account-role] -role_arn = arn:aws:iam::764324427262:role/CustomCrossAccountRole -credential_source = Ec2InstanceMetadata -EOT ----- - [#launch-openshift-install] === Запуск контейнера openshift-install @@ -1053,21 +615,35 @@ $ sudo docker run --rm -it --name openshift-install-v3 \ $ cd /tmp/openshift-cluster ---- +. Виконайте дії, які описані в офіційній документації на сайті OKD https://docs.openshift.com/container-platform/4.11/installing/installing_aws/installing-aws-customizations.html[Installing a cluster on AWS with customizations], до кроку *Obtaining an AWS Marketplace image*: https://docs.openshift.com/container-platform/4.11/installing/installing_aws/installing-aws-customizations.html#installation-aws-marketplace-subscribe_installing-aws-customizations[Obtaining an AWS Marketplace image]. + + . Завантажте кастомізований OKD інсталер, що містить виправлення blocker-проблеми, описаної в https://issues.redhat.com/browse/OCPBUGS-11636. + [source,bash] ---- -$ aws s3 cp s3://mdtu-ddm-platform-installer/okd-installer/openshift-install-zver-fix-aws-4.11.0-0.okd-2022-08-20-022-fix-aws.tar.gz openshift-install-zver-fix-aws-4.11.0-0.okd-2022-08-20-022-fix-aws.tar.gz --profile cross-account-role +$ aws s3 cp s3://mdtu-ddm-platform-installer/okd-installer/openshift-install-fix-aws-4.11.0-0.okd-2022-08-20-022-fix-aws.tar.gz openshift-install-fix-aws-4.11.0-0.okd-2022-08-20-022-fix-aws.tar.gz --profile cross-account-role ---- - -. Виконайте дії, які описані в офіційній документації на сайті OKD, до кроку *Deploying the cluster*: https://docs.openshift.com/container-platform/4.11/installing/installing_aws/installing-aws-customizations.html[Installing a cluster on AWS with customizations]. + -Зверніть увагу, що пункт https://docs.openshift.com/container-platform/4.11/installing/installing_aws/installing-aws-customizations.html#installation-obtaining-installer_installing-aws-customizations[Obtaining the installation program] можна пропустити у зв'язку з використанням власного openshift-installer, що був завантажений раніше. +. Розархівуйте програму встановлення із завантаженого архіву. ++ +[source,bash] +---- +$ tar xvfz openshift-install-fix-aws-4.11.0-0.okd-2022-08-20-022-fix-aws.tar.gz +---- + [CAUTION] Щоб налаштувати встановлення, потрібно створити файл *_install-config.yaml_* і внести до нього необхідні параметри перед тим, як встановити кластер. + +. Створіть нову директорію для конфігураційних файлів кластера та файл _install-config.yaml_. Для цього виконайте послідовно наступні команди: + -Після створення файлу потрібно заповнити необхідні параметри, які будуть представлені в контекстному меню. Створений конфігураційний файл включає тільки необхідні параметри для мінімального розгортання кластера. Для кастомізації налаштувань можна звернутись до офіційної документації. +[source,bash] +---- +$ mkdir /tmp/openshift-cluster/cluster-state + +$ touch /tmp/openshift-cluster/cluster-state/install-config.yaml +---- ++ +Після створення файлу потрібно заповнити його необхідними параметрами. Створений конфігураційний файл включає тільки необхідні параметри для мінімального розгортання кластера. Для кастомізації налаштувань можна звернутись до офіційної документації. + Рекомендовані параметри для файлу *_install-config.yaml_*: :: + @@ -1090,6 +666,7 @@ compute: size: 80 type: gp3 type: r5.2xlarge + amiID: ami-094fe1584439e91dd replicas: 3 controlPlane: architecture: amd64 @@ -1102,17 +679,17 @@ controlPlane: rootVolume: size: 80 type: gp3 - type: r5.2xlarge + type: r5.xlarge replicas: 3 metadata: - name: + name: (2) networking: clusterNetwork: - cidr: 10.128.0.0/14 hostPrefix: 23 machineNetwork: - cidr: 10.0.0.0/16 - networkType: OpenShiftSDN + networkType: OVNKubernetes platform: aws: region: eu-central-1 @@ -1123,11 +700,11 @@ pullSecret: (4) sshKey: (3) ---- -* (1) ` -- домен, який було створено та налаштовано у підрозділах xref:#setup-route-53[] та xref:#setup-external-domain[]. +* (1) ` -- домен, який було створено та налаштовано у підрозділах xref:#setup-route-53[] та xref:#setup-external-domain[]; -* (2) `` -- ім'я майбутнього OKD-кластера. +* (2) `` -- ім'я майбутнього OKD-кластера; -* (3) `` -- ключ або ключі SSH для автентифікації доступу до машин кластера. Можна використати той самий ключ, що був створений під час встановлення OKD-кластера, або будь-який інший. +* (3) `` -- ключ або ключі SSH для автентифікації доступу до машин кластера. Можна використати той самий ключ, що був створений під час встановлення OKD-кластера, або будь-який інший; + TIP: Докладніше описано в офіційній документації на сайті OKD: https://docs.openshift.com/container-platform/4.11/installing/installing_aws/installing-aws-customizations.html#installation-configuration-parameters-optional_installing-aws-customizations[Optional configuration parameters]. @@ -1187,7 +764,14 @@ TIP: Докладніше про це описано в п. 5 офіційної ==== + -WARNING: Після запуску процесу розгортання кластера, Інсталер видаляє *install-config.yam*, тому рекомендовано виконати резервування цього файлу, якщо є потреба розгортання кількох кластерів. +WARNING: Після запуску процесу розгортання кластера, Інсталер видаляє *install-config.yaml*, тому рекомендовано виконати резервування цього файлу, якщо є потреба розгортання кількох кластерів. + +. Також виконайте наступну команду для кастомізації встановлення OpenShift кластеру версії 4.11. Ця змінна дозволяє вказати конкретний образ, який буде використовуватися під час інсталяції. ++ +[source,bash] +---- +$ export OPENSHIFT_INSTALL_RELEASE_IMAGE_OVERRIDE="quay.io/openshift/okd:4.11.0-0.okd-2022-08-20-022919" +---- == Запуск OKD4-інсталера та розгортання порожнього кластера OKD4 @@ -1327,6 +911,12 @@ $ unzip mdtu-ddm-platform-(version).zip -d ./installer- $ cp ~/openshift-cluster/cluster-state/auth/kubeconfig ./installer- ---- +. Перенесіть *_kubeconfig_* від встановленого кластера. ++ +---- +$ cp ~/openshift-cluster/cluster-state/auth/kubeconfig ./installer- +---- + . Перенесіть сертифікати та допоміжні файли сервісу `digital-signature-ops` в директорію *_certificates_* та увійдіть до директорії з Інсталером. + [source,bash] @@ -1351,7 +941,7 @@ $ cd installer- + [source,bash] ---- -$ IMAGE_CHECKSUM=$(sudo docker load -i control-plane-installer.img | sed -r "s#.*sha256:(.*)#\\1#" \| tr -d '\n') +$ IMAGE_CHECKSUM=$(sudo docker load -i control-plane-installer.img | sed -r "s#.*sha256:(.*)#\1#" \| tr -d '\n') ---- + [source,bash] @@ -1426,9 +1016,10 @@ $ docker rm $(docker ps --latest -q) ==== Стан додаткових ресурсів :: -Після виконання усіх дій, бастіон та додаткову віртуальну машину можна вимкнути. +Після виконання усіх дій, bastion та deployer-node можна вимкнути. Вони не будуть потрібні до наступного оновлення Платформи. ==== +[#installer-update] === Оновлення ==== Передумови @@ -1459,6 +1050,12 @@ $ unzip mdtu-ddm-platform-(version).zip -d ./installer- $ cp ~/openshift-cluster/cluster-state/auth/kubeconfig ./installer- ---- +. Перенесіть *_kubeconfig_* від встановленого кластера. ++ +---- +$ cp ~/openshift-cluster/cluster-state/auth/kubeconfig ./installer- +---- + . Перенесіть сертифікати та допоміжні файли сервісу `digital-signature-ops` в директорію *_certificates_* та увійдіть до директорії з Інсталером. + [source,bash] @@ -1508,7 +1105,7 @@ $ ~/installer/installer-/terraform/vault/aws/private.key ./terraform/va + [source,bash] ---- -$ IMAGE_CHECKSUM=$(sudo docker load -i control-plane-installer.img | sed -r "s#.*sha256:(.*)#\\1#" \| tr -d '\n') +$ IMAGE_CHECKSUM=$(sudo docker load -i control-plane-installer.img | sed -r "s#.*sha256:(.*)#\1#" \| tr -d '\n') ---- + [source,bash] @@ -1531,9 +1128,8 @@ $ sudo docker run --rm \ --net host \ -v $(pwd):/tmp/installer \ --env KUBECONFIG=/tmp/installer/kubeconfig \ - --env idgovuaClientId=f90ab33dc272f047dc330c88e5663b75 \ - --env idgovuaClientSecret=cba49c104faac8c718e6daf3253bc55f2bf11d9e \ - --env CUSTOM_INGRESS_CIDRS='["0.0.0.0/0", "85.223.209.0/24"]' \ + --env idgovuaClientId=mock \ + --env idgovuaClientSecret=mock \ --env deploymentMode= \ --entrypoint "/bin/sh" control-plane-installer: \ -c "./install.sh -u" @@ -1542,7 +1138,7 @@ $ sudo docker run --rm \ [NOTE] ==== * *`--rm`* -- цей параметр автоматично видалить контейнер після завершення його роботи. Параметр можна прибрати, якщо потрібно дізнатися статус та лог завершеного контейнера або при нестабільному інтернет-з'єднанні. -* *`DEPLOYMENT_MODE`* -- може бути development чи production (залежить від минулого запуску). +* *`DEPLOYMENT_MODE`* -- може бути *`development`* чи *`production`*. ==== + [WARNING] @@ -1583,6 +1179,13 @@ $ docker rm $(docker ps --latest -q) . Виконайте необхідні спеціальні кроки для оновлення до вашої версії Платформи. . В рамках виконання спеціальних кроків оновіть xref:update/update_cluster-mgmt.adoc[інфраструктурні компоненти Платформи] через інтерфейс Control Plane. +[NOTE] +==== +Стан додаткових ресурсів :: + +Після виконання усіх дій, bastion та deployer-node можна вимкнути. Вони не будуть потрібні до наступного оновлення Платформи. +==== + == Типові помилки під час розгортання платформи Ця секція надає інформацію про типові помилки, які можуть виникнути під час розгортання платформи з нуля, та методи їх вирішення. @@ -1681,7 +1284,6 @@ $ sudo docker run -it --rm \ --env KUBECONFIG=/tmp/installer/kubeconfig \ --env idgovuaClientId=f90ab33dc272f047dc330c88e5663b75 \ --env idgovuaClientSecret=cba49c104faac8c718e6daf3253bc55f2bf11d9e \ - --env CUSTOM_INGRESS_CIDRS='["0.0.0.0/0", "85.223.209.0/24"]' \ --env deploymentMode= control-plane-installer: bash ---- @@ -1719,9 +1321,9 @@ $ terraform destroy -var cluster_name="${clusterNameShort}" -var baseDomain="${r image:installation/aws/installation-aws-8.png[image,width=468,height=228] -Ця помилка пов'язана із *skopeo*. Цей інструмент надсилає образи до Nexus. Якщо образ не зміг завантажитися за 10 хвилин, то skopeo починає повертати помилку через тайм-аут. +Ця помилка пов'язана зі *skopeo*. Цей інструмент надсилає образи до Nexus. Якщо образ не зміг завантажитися за 10 хвилин, то skopeo починає повертати помилку через тайм-аут. [send-images-to-nexus-issue-resolving] ==== Розв'язання -Виконувати встановлення Платформи із додаткової віртуальної машини, як описано в п. xref:#deploy-additional-recources-for-okd[]. \ No newline at end of file +Виконувати встановлення Платформи із deployer-node, як описано в п. xref:#deploy-additional-recources-for-okd[]. \ No newline at end of file diff --git a/docs/ua/modules/admin/pages/installation/platform-deployment/platform-vsphere-deployment.adoc b/docs/ua/modules/admin/pages/installation/platform-deployment/platform-vsphere-deployment.adoc index 8b1a3e6d27..28de6e4a86 100644 --- a/docs/ua/modules/admin/pages/installation/platform-deployment/platform-vsphere-deployment.adoc +++ b/docs/ua/modules/admin/pages/installation/platform-deployment/platform-vsphere-deployment.adoc @@ -3,7 +3,11 @@ include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc include::platform:ROOT:partial$admonitions/language-ua.adoc[] -== Підготовка інфраструктури vSphere для встановлення OKDfootnote:[**OKD** - це дистрибутив Kubernetes, оптимізований для неперервної розробки додатків та розгортання декількох екземплярів ізольованого контейнерного середовища (у нашому випадку -- екземплярів реєстру). За детальною інформацією зверніться до https://docs.okd.io/[офіційного джерела].] +IMPORTANT: Будь ласка, зверніться до вашого постачальника, щоб отримати необхідний _vSphere_-інсталятор. + +== Підготовка інфраструктури vSphere для встановлення OKD + +*OKD* -- це дистрибутив Kubernetes, оптимізований для неперервної розробки додатків та розгортання декількох екземплярів ізольованого контейнерного середовища (у нашому випадку -- екземплярів реєстру). За детальною інформацією зверніться до https://docs.okd.io/[офіційного джерела]. === Налаштування довіреного інтерфейсу vCenter API @@ -15,7 +19,7 @@ include::platform:ROOT:partial$admonitions/language-ua.adoc[] Сертифікати можуть бути завантажені з домашньої сторінки vCenter. -За замовчуванням сертифікати зберігаються за посиланням `/certs/download.zip`. Після завантаження і розархівування буде створено директорію, що містить сертифікати для ОС Linux, MacOS та Windows. +За замовчуванням сертифікати зберігаються за посиланням `/certs/download.zip`. Після завантаження і розархівування буде створено директорію, що містить сертифікати для ОС Linux, macOS та Windows. ==== Приклад перегляду структури @@ -93,10 +97,10 @@ $ sudo update-ca-trust extract * одну тег-категорію (1 Tag Category) * 1 тег (1 Tag) * віртуальні машини (Virtual machines): - - один шаблон (1 template) - - одну тимчасову ноду bootstrap (1 temporary bootstrap node) - - три ноди консолі для управління Платформою (3 control-plane nodes) - - три обчислювальні машини (3 compute machines) +- один шаблон (1 template) +- одну тимчасову ноду bootstrap (1 temporary bootstrap node) +- три ноди консолі для управління Платформою (3 control-plane nodes) +- три обчислювальні машини (3 compute machines) ==== Необхідні вимоги до ресурсів @@ -252,41 +256,40 @@ $ cd acme.sh === Запит на отримання сертифікатів -1) Для того, щоб полегшити процес отримання сертифікатів, необхідно задати дві змінні середовища. Перша змінна повинна вказувати на API Endpoint. Переконайтесь, що ви увійшли до OKD як `system:admin` і використовуєте CLI-консоль Openshift, щоб знайти API Endpoint URL. - +. Щоб полегшити процес отримання сертифікатів, необхідно задати дві змінні середовища. Перша змінна повинна вказувати на API Endpoint. Переконайтесь, що ви увійшли до OKD як `system:admin` і використовуєте CLI-консоль Openshift, щоб знайти API Endpoint URL. ++ [source,bash] ---- $ oc whoami --show-server ---- - -**Приклад отриманої відповіді**: ++ +.Приклад отриманої відповіді ---- https://api.e954.ocp4.opentlc.com:6443 ---- -2) Тепер встановіть змінну `LE_API` для повністю визначеного доменного імені API: - +. Тепер встановіть змінну `LE_API` для повністю визначеного доменного імені API: ++ [source,bash] ---- $ export LE_API=$(oc whoami --show-server | cut -f 2 -d ':' | cut -f 3 -d '/' | sed 's/-api././') ---- -3) Встановіть другу змінну `LE_WILDCARD` для вашого Wildcard Domain: - +. Встановіть другу змінну `LE_WILDCARD` для вашого Wildcard Domain: ++ [source,bash] ---- $ export LE_WILDCARD=$(oc get ingresscontroller default -n openshift-ingress-operator -o jsonpath='{.status.domain}') ---- -4) Запускаємо скрипт acme.sh: - +. Запустіть скрипт `acme.sh`: ++ [source,bash] ---- $ ${HOME}/acme.sh/acme.sh --issue -d ${LE_API} -d *.${LE_WILDCARD} --dns ---- - -**Приклад отриманої відповіді**: - ++ +.Приклад отриманої відповіді [source, bash] ---- $ ./acme.sh --issue -d ${LE_API} -d \*.${LE_WILDCARD} --dns --yes-I-know-dns-manual-mode-enough-go-ahead-please @@ -310,33 +313,32 @@ $ ./acme.sh --issue -d ${LE_API} -d \*.${LE_WILDCARD} --dns --yes-I-know-dns-m [Wed Jul 28 18:37:38 EEST 2021] Please add the TXT records to the domains, and re-run with --renew. [Wed Jul 28 18:37:38 EEST 2021] Please add '--debug' or '--log' to check more details. ---- - ++ CAUTION: DNS-записи з попередньої відповіді необхідно додати на DNS-сервері, що відповідає за зону `e954.ocp4.opentlc.com` (**значення зони тут є прикладом**). Таким чином, TXT-записи повинні мати наступний вигляд: - -**TXT-запис 1** ++ +.TXT-запис 1 [source,bash] ---- _acme-challenge.api.e954.ocp4.opentlc.com TXT value: 'VZ2z3XUe4cdNLwYF7UplBj7ZTD8lO9Een0yTD7m_Bbo' ---- - -**TXT-запис 2** ++ +.TXT-запис 2 [source,bash] ---- _acme-challenge.apps.e954.ocp4.opentlc.com TXT value: 'f4KeyXkpSissmiLbIIoDHm5BJ6tOBTA0D8DyK5sl46g' ---- -6) Після цього необхідно повторно запустити команду `acme.sh`: - +. Після цього необхідно повторно запустити команду `acme.sh`: ++ [source,bash] ---- $ acme.sh --renew -d e954.ocp4.opentlc.com --yes-I-know-dns-manual-mode-enough-go-ahead-please ---- -7) Після успішного виконання попередніх пунктів необхідно запустити наступні команди. - -Зазвичай, хорошим підходом є перенесення сертифікатів із шляху acme.sh за замовчуванням (default path) до більш зручної директорії. Для цього можна використати `—install-cert`-ключ скрипта `acme.sh` для копіювання сертифікатів до `$HOME/certificates`, для прикладу: - - +. Після успішного виконання попередніх пунктів необхідно запустити наступні команди. ++ +Зазвичай, хорошим підходом є перенесення сертифікатів зі шляху acme.sh за замовчуванням (default path) до більш зручної директорії. Для цього можна використати `—install-cert`-ключ скрипту `acme.sh` для копіювання сертифікатів до `$HOME/certificates`, для прикладу: ++ [source,bash] ---- $ export CERTDIR=$HOME/certificates @@ -359,7 +361,9 @@ $ oc create secret tls router-certs --cert=${CERTDIR}/fullchain.pem --key=${CERT $ oc patch ingresscontroller default -n openshift-ingress-operator --type=merge --patch='{"spec": { "defaultCertificate": { "name": "router-certs" }}}' ---- -== Створення MachineSetfootnote:[**Ресурси MachineSet** - це групи машин. Набори машин призначені для машин як набори копій (реплік) для Pods, в яких розгорнуто контейнери. Якщо вам потрібно більше машин або, навпаки, необхідно зменшити їх кількість, можна змінити значенням поля реплік на рівні MachineSet, щоб задовольнити ваші обчислювальні потреби. Для детальної інформації щодо створення MachineSet зверніться до https://docs.openshift.com/container-platform/4.6/machine_management/creating_machinesets/creating-machineset-vsphere.html[офіційного джерела.]] для інфраструктури Ceph +== Створення MachineSet для інфраструктури Ceph + +TIP: _Ресурси **MachineSet**_ -- це групи машин. Набори машин призначені для машин як набори копій (реплік) для Pods, в яких розгорнуто контейнери. Якщо вам потрібно більше машин або, навпаки, необхідно зменшити їх кількість, можна змінити значенням поля реплік на рівні MachineSet, щоб задовольнити ваші обчислювальні потреби. Для детальної інформації щодо створення MachineSet зверніться до https://docs.openshift.com/container-platform/4.6/machine_management/creating_machinesets/creating-machineset-vsphere.html[офіційного джерела.] Для розгортання Платформи необхідно створити MachineSet для системи зберігання даних https://ceph.io/en/[Ceph]. Для цього необхідно використати конфігураційний файл `machine-set-ceph.yaml`, в якому необхідно змінити назву кластера. @@ -427,7 +431,9 @@ spec: TIP: У нашому випадку назва кластера визначена в _.yaml_-файлі як `mdtuddm-b86zw`. -== Підготовка та запуск Інсталераfootnote:[_Інсталер_ -- набір команд (скрипт) для розгортання Платформи.] для розгортання Платформи на цільовому OKD-кластері +== Підготовка та запуск Інсталера для розгортання Платформи на цільовому OKD-кластері + +TIP: _Інсталер_ -- набір команд (скрипт) для розгортання Платформи. Для запуску Інсталера, необхідно виконати ряд умов з підготовки робочої станції, з якої запускатиметься Інсталер. Нижче розглянуто приклад такої підготовки на базі Ubuntu 20.04 LTS. @@ -508,26 +514,6 @@ export idgovuaClientId="" export idgovuaClientSecret="" ---- -. Відредагуйте _install.sh_, а саме після `source ./functions.sh` додайте `source ./exports.list`. - -+ -[source,shellscript] ----- -vi install.sh ----- -+ -Це виглядатиме наступним чином: - -+ -[source,shellscript] ----- -#!/usr/bin/env bash -set -e -#Include function file -source ./functions.sh -source ./exports.list ----- - ===== Розгортання Інсталера . Виконайте наступні команди: @@ -543,7 +529,7 @@ sudo docker tag ${IMAGE_CHECKSUM} control-plane-installer:; + [source,shellscript] ---- -sudo docker run --rm --name control-plane-installer- --user root:$(id -g) --net host -v $(pwd):/tmp/installer --env KUBECONFIG=/tmp/installer/kubeconfig --env idgovuaClientId=mock --env idgovuaClientSecret=mock --env CUSTOM_INGRESS_CIDRS="['0.0.0.0/0', '85.223.209.0/24']" --env deploymentMode=development --entrypoint "/bin/bash" control-plane-installer: -c "./install.sh -i" +sudo docker run --rm --name control-plane-installer- --user root:$(id -g) --net host -v $(pwd):/tmp/installer --env KUBECONFIG=/tmp/installer/kubeconfig --env idgovuaClientId=mock --env idgovuaClientSecret=mock --env deploymentMode=development --entrypoint "/bin/bash" control-plane-installer: -c "./install.sh -i" ---- + * де `deploymentMode` може бути `development` чи `production`. @@ -601,42 +587,30 @@ cp /home//workdir/installer-/exports.list ./ + Також необхідно уточнити актуальні значенння для `idgovuaClientId` та `idgovuaClientSecret`. -. Відредагуйте _install.sh_, а саме після `source ./functions.sh` додайте `source ./exports.list`. +===== Налаштування компонента MinIO при оновленні кластера у середовищі vSphere -+ -[source,shellscript] ----- -vi install.sh ----- -+ -Це виглядатиме наступним чином: +. Перенесіть tfstate MinIO з минулого релізу для vSphere. + [source,shellscript] ---- -#!/usr/bin/env bash -set -e -#Include function file -source ./functions.sh -source ./exports.list +cp /home//workdir/installer-/terraform/minio/vsphere/terraform.tfstate ./terraform/minio/vsphere/ ---- -===== Налаштування компонента MinIO при оновленні кластера у середовищі vSphere - -. Перенесіть tfstate MinIO з минулого релізу для vSphere. +. Перенесіть tfstate MinIO (Packer) з минулого релізу для vSphere. + [source,shellscript] ---- -cp /home//workdir/installer-/terraform/minio/vsphere/terraform.tfstate ./terraform/minio/vsphere/ +сp /home//workdir/installer-/terraform/minio/vsphere/packer/terraform.tfstate ./terraform/minio/vsphere/packer/ ---- -. Перенесіть tfstate MinIO (Packer) з минулого релізу для vSphere. +. Перенесіть публічний та приватний SSH ключі для інстанса MinIO з минулого релізу для vSphere. + [source,shellscript] ---- -сp /home//workdir/installer-/terraform/minio/vsphere/packer/terraform.tfstate ./terraform/minio/vsphere/packer/ +сp /home//workdir/installer-/terraform/minio/vsphere/packer/*.key ./terraform/minio/vsphere/packer/ ---- ===== Налаштування компонента Vault при оновленні кластера у середовищі vSphere @@ -657,6 +631,14 @@ cp /home//workdir/installer-/terraform/vault/vsphere/terraform.tf сp /home//workdir/installer-/terraform/vault/vsphere/packer/terraform.tfstate ./terraform/vault/vsphere/packer/ ---- +. Перенесіть публічний та приватний SSH ключі для інстанса Vault з минулого релізу для vSphere. + ++ +[source,shellscript] +---- +сp /home//workdir/installer-/terraform/vault/vsphere/packer/*.key ./terraform/vault/vsphere/packer/ +---- + ===== Розгортання Інсталера . Виконайте наступні команди: @@ -672,7 +654,7 @@ sudo docker tag ${IMAGE_CHECKSUM} control-plane-installer:; + [source,shellscript] ---- -sudo docker run --rm --name control-plane-installer- --user root:$(id -g) --net host -v $(pwd):/tmp/installer --env KUBECONFIG=/tmp/installer/kubeconfig --env idgovuaClientId=mock --env idgovuaClientSecret=mock --env CUSTOM_INGRESS_CIDRS="['0.0.0.0/0', '85.223.209.0/24']" --env deploymentMode=development --entrypoint "/bin/bash" control-plane-installer: -c "./install.sh -u" +sudo docker run --rm --name control-plane-installer- --user root:$(id -g) --net host -v $(pwd):/tmp/installer --env KUBECONFIG=/tmp/installer/kubeconfig --env idgovuaClientId=mock --env idgovuaClientSecret=mock --env deploymentMode=development --entrypoint "/bin/bash" control-plane-installer: -c "./install.sh -u" ---- + TIP: де `deploymentMode` може бути `development` чи `production`, залежно від попереднього запуску. diff --git a/docs/ua/modules/admin/pages/installation/push-docker-image-cp-nexus.adoc b/docs/ua/modules/admin/pages/installation/push-docker-image-cp-nexus.adoc new file mode 100644 index 0000000000..b374096fe9 --- /dev/null +++ b/docs/ua/modules/admin/pages/installation/push-docker-image-cp-nexus.adoc @@ -0,0 +1,78 @@ += Перенесення Docker-образів до Nexus-кластера +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +Цей документ надає детальні інструкції щодо опублікування docker-образів у Nexus-кластері, сховищі артефактів. + +== Передумови + +Перед початком переконайтесь, що ви маєте встановлені наступні компоненти: + +* Docker +* oc CLI + +== Перенесення локального образу до Nexus-кластера + +Якщо у вас є локальний образ і ви хочете його перенести до Nexus-кластера, виконайте наступні кроки: + +. Увійдіть до вашого Docker реєстру за допомогою команди: ++ +[source,bash] +---- +docker login -u ваш_користувач -p ваш_пароль +---- + +. Витягніть образ, який ви хочете перенести: ++ +[source,bash] +---- +docker pull ваше_ім'я_репозиторію/ім'я_образу:тег +---- + +. Після отримання усіх необхідних образів локально, перейменуйте їх, використовуючи `docker image tag`: ++ +[source,bash] +---- +docker image tag ваше_ім'я_репозиторію/ім'я_образу:тег localregistry:5000/control-plane/ім'я_образу:тег +---- + +. Автентифікуйтеся на Платформі використовуючи oc CLI, токен можна отримати через консоль Openshift у розділі *Copy login command*. ++ +image::admin:installation/push-docker-images/push-docker-image-1.png[width="428px"] + +. Якщо ви користувач Windows, додайте наступний запис до `C:\Windows\System32\drivers\etc\hosts`. Якщо ви на Linux, додайте його до `/etc/hosts`: ++ +[source,bash] +---- +127.0.0.1 localregistry +---- + +. Відкрийте кілька терміналів, в одному з них виконайте перенаправлення порту до поду *Nexus*, який можна знайти у проєкті `control-plane-nexus` в menu:Openshift[Workloads > Pods]. ++ +[source,bash] +---- +oc port-forward <ім'я_поди_nexus> 5000:5000 -n control-plane-nexus +---- + +. Увійдіть до Nexus, пароль можна знайти у секреті `nexus-admin-password` проєкту `control-plane-nexus`. ++ +[source,bash] +---- +docker login -u admin -p <секретний_пароль> localregistry:5000 +---- + +. Ви повинні побачити, що вхід успішний, після чого можна виконати `push`. ++ +NOTE: Пам'ятайте, що в іншому терміналі має бути активним перенаправлення порту. ++ +[source,bash] +---- +docker push localregistry:5000/control-plane/ім'я_образу:тег +---- ++ +Процес може зайняти деякий час. Будь ласка, зачекайте. + +. Після того, як ваш образ з'явиться в Nexus, ви можете переглянути всі образи у розділі menu:Browse[docker-registry]. ++ +TIP: Ви можете потрапити в docker-registry через menu:Openshift[Networking > Routes > Nexus] у проєкті `control-plane-nexus`. ++ +image::admin:installation/push-docker-images/push-docker-image-2.png[height="150px"] \ No newline at end of file diff --git a/docs/ua/modules/admin/pages/migration/migrate-registry.adoc b/docs/ua/modules/admin/pages/migration/migrate-registry.adoc index a0fdc4bdec..b4184fc296 100644 --- a/docs/ua/modules/admin/pages/migration/migrate-registry.adoc +++ b/docs/ua/modules/admin/pages/migration/migrate-registry.adoc @@ -14,6 +14,24 @@ NOTE: Міграція реєстру виконується з останньо == Передумови для міграції +[NOTE] +==== +📌 Примітка до організації міграції:: + +. _Планування_: важливо розробити чіткий графік міграції. Він має включати: + +* Дату та час створення бекапу. +* Час відновлення. +* Визначений час завершення роботи надавачів послуг перед бекапом. + +. _Комунікація_: важливо забезпечити, щоб усі користувачі-надавачі послуг були вчасно повідомлені: + +* Сповіщайте користувачів за допомогою зовнішніх комунікаційних каналів поза межами Платформи. +* Вкажіть їм про необхідність завершення роботи до визначеного у графіку часу. + +Дотримуючись цих рекомендацій, ви забезпечите плавний процес міграції без непотрібних затримок та незручностей для користувачів. +==== + . Процес міграції включає запуск bash-скрипту, що здійснює перенесення даних з кластера А до кластера B. Для успішної міграції, цей скрипт має бути виконаний на платформі Linux з архітектурою мікропроцесора `x86-64` (відомою також як `AMD64`, Intel 64, чи `x64`) . Користувач, який буде переносити реєстр на інший кластер, повинен бути доданий до адміністраторів Платформи на обох кластерах через *`control-plane-console`*. + @@ -88,7 +106,10 @@ TIP: Дані для аутентифікації в Minio знаходятьс == Підготовка реєстру до міграції -. Зробіть резервну копію реєстру на кластері A. +[IMPORTANT,caption=Перед початком міграції] +Перед початком міграції необхідно повністю обмежити доступ для кінцевих користувачів до цього реєстру. + +. Створіть резервну копію реєстру на кластері A. + Перед перенесенням реєстру на новий кластер, необхідно запустити Jenkins-процес *`Create-registry-backup-<назва реєстру>`*. + @@ -130,6 +151,60 @@ velero backup describe <назва бекапу> . Якщо останній velero backup завершився зі статусом *`Completed`*, то можна переходити далі. У випадку, коли статус velero backup відрізняється від `Completed`, необхідно долучати спеціалістів із технічної підтримки L2-L3 для перевірки працездатності Jenkins-пайплайну. +. Отримайте консистентні дані у бекапах бакетів реєстру, що мігрується. + +.. Для початку, отримайте актуальні бекапи S3-бакетів реєстру в проєкті `velero`. Відкрийте розділ *Workloads*, потім перейдіть до *CronJobs*. Тут використовуйте пошукову панель для фільтрації бакетів за назвою реєстру, наприклад, `migrationreg`. ++ +.CronJobs +image::admin:migrate-registry/migrate-registry-01.png[] + +.. Відкрийте кожну *CronJob* і змініть час її запуску на найближчий можливий, та додайте `value` для змінної оточення `MAX_AGE`. Для прикладу, встановіть запуск через 10-15 хвилин. Щоб це зробити, перейдіть до налаштувань кожної CronJob, відкрийте її *YAML*-конфігурацію і змініть параметр `spec.schedule`. Наприклад, для запуску CronJob щодня о 10:50 за UTC, використовуйте наступну конфігурацію: ++ +.CronJob details. YAML-конфігурація +[source,yaml] +---- +spec: + schedule: 50 10 * * * +---- ++ +[CAUTION] +==== +При роботі з `cron`, час вказується за https://time.is/UTC[UTC]. +==== ++ +.CronJob details. Schedule +image::admin:migrate-registry/migrate-registry-02.png[] ++ +Для конфігурації `MAX_AGE` використовуйте наступну конфігурацію: ++ +[source,yaml] +---- +spec: + ... + jobTemplate: + ... + spec: + template: + ... + spec: + ... + containers: + ... + env: + - name: MAX_AGE + value: '2y' +---- + +.. Після цього дочекайтеся запуску і завершення усіх CronJob. Прогрес і статус можна перевірити в розділі *Jobs*, обравши відповідний Job і переглянувши розділ *Status*, де має бути позначка `✅ Complete`. ++ +.CronJob details. Jobs +image::admin:migrate-registry/migrate-registry-03.png[] ++ +.Job details. Status +image::admin:migrate-registry/migrate-registry-04.png[] + +.. Завдяки цим діям ви отримаєте консистентні дані з бекапів бакетів реєстру, який перебуває у процесі міграції. + . Забороніть робити зміни у реєстрі за допомогою Jenkins пайплайнів. + У кожному пайплайні для реєстру перейдіть до секції *Configure* та знайдіть параметр *`Disable this project`* у секції *Build Triggers*, встановіть напроти нього прапорець та збережіть зміни за допомогою кнопки kbd:[*Save*]. @@ -236,7 +311,8 @@ TIP: Дані для логіну можна отримати із секрет * За допомогою `*Select realm*` (1) > *`Add realm`* (2) > *`Import`* (3), виберіть файл _keycloak-export-<назва реєстру>-*/*-realm.json_ та створити реалми (оберіть стратегію *`SKIP`*, запропоновану Keycloak). Так пройдіться по усіх директоріях із назвою _keycloak-export-<назва реєстру>-*_. + -image:admin:migrate-registry/migrate-registry-1.png[image,width=514,height=194] +.Keycloak. Add realm +image::admin:migrate-registry/migrate-registry-1.png[image,width=514,height=194] . Перенесіть користувачів. + @@ -245,7 +321,8 @@ image:admin:migrate-registry/migrate-registry-1.png[image,width=514,height=194] NOTE: Якщо файлів більше одного, то виконайте імпорт усіх файлів. + -image:admin:migrate-registry/migrate-registry-2.png[image,width=601,height=417] +.File import +image::admin:migrate-registry/migrate-registry-2.png[image,width=601,height=417] . Створіть реєстр через *`control-plane-console`*. @@ -284,10 +361,10 @@ NOTE: Дочекайтеся створення директорії `<назв . Перенесіть файли конфігурації *_values.yaml_* та *_values.gotmpl_* з репозиторію реєстру кластера А на кластер B. * Перейдіть до репозиторію реєстру на кластері А: + -Відкрийте *Control-plane-console* > +++Дашборд+++ > *Gerrit* > *Browse* > *Repositories* > оберіть репозиторій *`<назва реєстру>`*. + +Відкрийте *Control-plane-console* > *Дашборд* > *Gerrit* > *Browse* > *Repositories* > оберіть репозиторій *`<назва реєстру>`*. + У репозиторії реєстру перейдіть до *Branches* > `master`, далі перейдіть до *deploy-templates*, відкрийте файл *_values.yaml_* ( *_values.gotmpl_* ) > Скопіюйте *raw*-код до буфера обміну. * Далі перейдіть до репозиторію реєстру на кластері B: + -*Control-plane-console* > +++Дашборд+++ > *Gerrit* ) > *Browse* > *Repositories* та оберіть репозиторій *`<назва реєстру>`*. Через *commands* > *`Create change`* створіть зміну (change) із наступними параметрами: +*Control-plane-console* > *Дашборд* > *Gerrit* ) > *Browse* > *Repositories* та оберіть репозиторій *`<назва реєстру>`*. Через *commands* > *`Create change`* створіть зміну (change) із наступними параметрами: ** `Select branch for new change: master`. ** `Description: Update registry before migration`. @@ -316,11 +393,13 @@ for file in $(ls crds); do oc apply -f crds/$file; done == Відновлення реєстру на кластері B +IMPORTANT: Увімкніть доступ для кінцевих користувачів до реєстру _ЛИШЕ_ після завершення процесу відновлення реєстру. + . Відрийте до Jenkins (namespace *`control-plane`* > *Networking* > *Routes* > *`jenkins`*), перейдіть до папки із назвою реєстру та запустіть Jenkins-пайплайн *`Restore-registry-<назва реєстру>`*. Після запуску пайплайну оберіть версію (на етапі `cleanup-registry-before-restore`) та дочекайтеся, коли процес завершиться. + NOTE: У випадку, коли процес завершується помилкою або триває понад 1-2 години, зверніться до спеціалістів команди технічної підтримки L2-L3 "ЕПАМ". -. Після завершення пайплайну перейдіть в Openshift-консоль > Projects > <назва реєстру>, та перевірте, що немає под у статусі помилок. +. Після завершення пайплайну перейдіть в Openshift-консоль -> Projects -> , та перевірте, що немає под у статусі помилок. + [NOTE] ==== @@ -579,16 +658,16 @@ git push origin refs/heads/master:refs/for/master Перенесіть конфігурацію реєстру із кластера А на кластер B відповідно до документації: :: -* +++Адміністратори+++ (_див. детальніше на сторінці xref:registry-develop:registry-admin/create-users/create-registry-admins.adoc[])_. -* +++Дані про ключ+++ (_див. детальніше на сторінці xref:admin:registry-management/system-keys/control-plane-registry-keys.adoc[]_). -* +++Поштовий сервер+++ (_див. детальніше на сторінці xref:registry-develop:registry-admin/user-notifications/email/config-smtp-server.adoc[]_). -* +++Ресурси реєстру+++ +* *Адміністратори* (_див. детальніше на сторінці xref:registry-develop:registry-admin/create-users/create-registry-admins.adoc[])_. +* *Дані про ключ* (_див. детальніше на сторінці xref:admin:registry-management/system-keys/control-plane-registry-keys.adoc[]_). +* *Поштовий сервер* (_див. детальніше на сторінці xref:registry-develop:registry-admin/user-notifications/email/config-smtp-server.adoc[]_). +* *Ресурси реєстру* + [NOTE] Перенесіть параметри налаштувань із файлу _values.yaml_ (секція `global.registry` ) реєстру на кластері А до налаштувань у файлі _values.yaml_ реєстру на кластері В. * DNS (_див. детальніше на сторінці xref:admin:registry-management/custom-dns/custom-dns-overview.adoc[]_). -* +++Обмеження доступу+++ (_див. детальніше на сторінці xref:admin:registry-management/control-plane-cidr-access-endpoints.adoc[]_). -* +++Автентифікація надавачів послуг+++ (_див. детальніше на сторінках xref:registry-develop:registry-admin/cp-auth-setup/cp-auth-setup-officers.adoc[] та xref:registry-develop:registry-admin/cp-auth-setup/cp-officer-self-registration.adoc[]_). -* +++Автентифікація отримувачів послуг+++ (_див. детальніше на сторінці xref:registry-develop:registry-admin/cp-auth-setup/cp-auth-setup-citizens.adoc[]_) -* +++Резервне копіювання+++ (_див. детальніше на сторінках xref:admin:backup-restore/control-plane-backup-restore.adoc[] та xref:admin:backup-restore/backup-schedule-registry-components.adoc[]_). \ No newline at end of file +* *Обмеження доступу* (_див. детальніше на сторінці xref:admin:registry-management/control-plane-cidr-access-endpoints.adoc[]_). +* *Автентифікація надавачів послуг* (_див. детальніше на сторінках xref:registry-develop:registry-admin/cp-auth-setup/cp-auth-setup-officers.adoc[] та xref:registry-develop:registry-admin/cp-auth-setup/cp-officer-self-registration.adoc[]_). +* *Автентифікація отримувачів послуг* (_див. детальніше на сторінці xref:registry-develop:registry-admin/cp-auth-setup/cp-auth-setup-citizens.adoc[]_) +* *Резервне копіювання* (_див. детальніше на сторінках xref:admin:backup-restore/control-plane-backup-restore.adoc[] та xref:admin:backup-restore/backup-schedule-registry-components.adoc[]_). \ No newline at end of file diff --git a/docs/ua/modules/admin/pages/platform-id-gov-ua-setup.adoc b/docs/ua/modules/admin/pages/platform-id-gov-ua-setup.adoc index 395f37da1b..3f50609728 100644 --- a/docs/ua/modules/admin/pages/platform-id-gov-ua-setup.adoc +++ b/docs/ua/modules/admin/pages/platform-id-gov-ua-setup.adoc @@ -20,7 +20,9 @@ image::id-gov-ua-setup/id-gov-ua-setup-2.png[Налаштування еміте == Налаштування Keycloak id-gov-ua realm -Вкажіть ідентифікатор та секрет клієнта, надані ІСЕІ, у реалмі `id-gov-ua` Keycloak, у налаштуваннях *Identity Providers*: +Вкажіть ідентифікатор та секрет клієнта, надані ІСЕІ, у реалмі `id-gov-ua` Keycloak, у налаштуваннях *Identity Providers*. : + +Також вкажіть url системи id.gov.ua з необхідними значеннями атрибута auth_type, "Encryption key name" залишити пустим: .Налаштування доступу до id.gov.ua image::id-gov-ua-setup/id-gov-ua-setup-3.png[Налаштування доступу до id.gov.ua] diff --git a/docs/ua/modules/admin/pages/registry-management/control-plane-cidr-access-endpoints.adoc b/docs/ua/modules/admin/pages/registry-management/control-plane-cidr-access-endpoints.adoc index 241bed352b..a0c98128ec 100644 --- a/docs/ua/modules/admin/pages/registry-management/control-plane-cidr-access-endpoints.adoc +++ b/docs/ua/modules/admin/pages/registry-management/control-plane-cidr-access-endpoints.adoc @@ -60,7 +60,7 @@ image::admin:infrastructure/cluster-mgmt/update-cluster-mgmt-01.png[] ==== + .Розділ керування реєстрами -image::infrastructure/cluster-mgmt/cp-registry-deploy-1.png[] +image::infrastructure/cluster-mgmt/cp-registry-deploy-ua-1.png[] . Пройдіть усіма кроками створення реєстру та зупиніться на секції [.underline]#Обмеження доступу#. + diff --git a/docs/ua/modules/admin/pages/registry-management/control-plane-create-registry.adoc b/docs/ua/modules/admin/pages/registry-management/control-plane-create-registry.adoc index bbed35a9f9..7dcd11852f 100644 --- a/docs/ua/modules/admin/pages/registry-management/control-plane-create-registry.adoc +++ b/docs/ua/modules/admin/pages/registry-management/control-plane-create-registry.adoc @@ -1,36 +1,19 @@ -:toc-title: ЗМІСТ -:toc: auto -:toclevels: 5 -:experimental: -:important-caption: ВАЖЛИВО -:note-caption: ПРИМІТКА -:tip-caption: ПІДКАЗКА -:warning-caption: ПОПЕРЕДЖЕННЯ -:caution-caption: УВАГА -:example-caption: Приклад -:figure-caption: Зображення -:table-caption: Таблиця -:appendix-caption: Додаток -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - -// Use this to make a text bold: +++Компонент для розробки регламенту+++ -// Use this to make a text bold and code: -//Option 1: `+++Компонент для розробки регламенту+++` -//Option 2: Use this to make a text bold and code: +++Підтвердити+++ -//Option 3: `+++Створити новий+++` - = Розгортання екземпляра реєстру +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] Після успішного xref:installation/platform-deployment/platform-deployment-overview.adoc[встановлення Платформи на цільовому оточенні], адміністратор Платформи отримує доступ до адміністративної панелі, що має назву *Control Plane*. Вона дозволяє керувати конфігураціями інфраструктурних компонентів Платформи (`cluster-mgmt`), а також компонентів реєстру. [TIP] ==== -Посилання до сервісу *Control Plane* можливо отримати у консолі *Openshift*. Перейдіть до розділу *Networking* > *Routes*, у пошуку вкажіть значення *`control-plane`*, і посилання буде доступне у стовпці *Location*. +Посилання до сервісу *Control Plane* можливо отримати у консолі *Openshift*: +. Відкрийте консоль +include::platform:ROOT:partial$templates/links/platform/administrative/openshift.adoc[] +. +. Перейдіть до розділу *Networking* > *Routes*, у пошуку вкажіть значення *`control-plane`*, і посилання буде доступне у стовпці *Location*. ++ image:infrastructure/cluster-mgmt/cp-registry-deploy-12.png[] ==== @@ -46,11 +29,11 @@ image:infrastructure/cluster-mgmt/cp-registry-deploy-12.png[] + . Увійдіть до адміністративної панелі *Control Plane*, використовуючи попередньо отримані логін та пароль. + -image:admin:infrastructure/cluster-mgmt/update-cluster-mgmt-01.png[] +image:admin:infrastructure/cluster-mgmt/update-cluster-mgmt-ua-01.png[] -. Перейдіть до розділу +++Реєстри+++ > далі натисніть `+++Створити новий+++`. +. Перейдіть до розділу *Реєстри* > далі натисніть *`Створити новий`*. + -image:infrastructure/cluster-mgmt/cp-registry-deploy-1.png[] +image:infrastructure/cluster-mgmt/cp-registry-deploy-ua-1.png[] . Заповніть параметри конфігурації відповідними даними. + @@ -59,24 +42,86 @@ TIP: Детальніше про кроки розгортання описан [#general-settings] == Загальні налаштування -На цьому кроці ви можете вказати службову (системну) назву реєстру, яка буде використовуватися у різних операціях обміну даними на Платформі. +На цьому кроці ви можете вказати службову (системну) назву, опис призначення реєстру, а також встановити режим розгортання та обрати версію шаблону реєстру. + +image:admin:registry-management/registry-create/cp-create-registry-ua-1.png[] + +[registry-name-description] +=== Назва та опис реєстру + +На цьому кроці ви можете вказати службову (системну) назву реєстру, яка буде використовуватися у різних операціях обміну даними на Платформі, та опис призначення реєстру. [CAUTION] ==== -* Назва повинна бути унікальною, і її неможливо буде змінити після створення реєстру. Поле +++Назва реєстру+++ є обов'язковим до заповнення. +* Назва повинна бути унікальною, і її неможливо буде змінити після створення реєстру. Поле *Назва реєстру* є обов'язковим до заповнення. * Для введення доступні лише латинські літери (`"a-z"`) та знак `"-"`. * Довжина не повинна перевищувати 12 символів. ==== Додатково ви можете вказати опис, який може містити офіційну назву реєстру чи його призначення. Це поле потрібне для інформаційних (бізнес- або юридичних) цілей. -Натисніть `+++Підтвердити+++` для переходу до наступного кроку. +[deployment-mode] +[#deployment-mode] +=== Режим розгортання + +У цьому полі ви повинні вибрати режим розгортання вашого реєстру. + +* *Режим розгортання* -- поле обов'язкове. Виберіть один із двох варіантів: `development` або `production`. + +WARNING: Після створення реєстру змінити режим розгортання буде неможливо. + +*Режим розгортання* (*deployment mode*) -- це параметр, який вказує на те, в якому середовищі відбувається розгортання регламенту реєстру. Він дозволяє відрізнити виробниче середовище від середовища розробки, а також налаштувати конфігурацію відповідно до потреб кожного з них. Платформа реєстрів підтримує 2 режими розгортання: `*development*` та *`production`*. + +Режим `*development*` передбачає розгортання із налаштуваннями для зручності розробки та відлагодження. + +Режим *`production`* передбачає розгортання, оптимізоване для максимальної продуктивності, стабільності та безпеки. Він виключає додаткові інструменти відлагодження, забезпечує оптимальну конфігурацію та налаштування для роботи в реальних умовах на цільових кластерах. + +[IMPORTANT] +==== +У виробничому режимі разом із продуктивними версіями Платформи _не_ розгортаються: + +* компоненти, залучені у процесах розробки регламенту реєстрів; + +* публічні ендпоінти компонентів, залучені у процесах розробки регламенту реєстрів. +==== + +TIP: Більш детально читайте про режими розгортання на сторінці xref:registry-develop:registry-admin/change-dev-prod-mode.adoc[]. + +[template-version] +=== Версія шаблону -image:admin:registry-management/registry-create/cp-create-registry-1.png[] +У цьому полі ви можете вибрати версію шаблону для вашого реєстру. + +CAUTION: Поле є обов'язковим до заповнення. + +*Версія шаблону* -- поле вказує на певну гілку компонента в Gerrit-репозиторії, що містить відповідну версію шаблону реєстру. Ви можете вибрати між останньою актуальною або попередньою стабільною версією. + +* _Остання актуальна версія_ -- містить останні затверджені зміни та нові функціональні можливості. Наприклад, `1.9.8.23`. Рекомендується вибирати поточну версію для використання всіх актуальних налаштувань. +* _Попередня стабільна версія_ -- рекомендуємо обирати лише в разі обґрунтованої необхідності. Наприклад, `1.9.7.57`. + +[WARNING] +==== + +. *Підготовка до Міграції*: +* Перед міграцією вашого реєстру на нову версію, яка _НЕ_ використовує кілька шаблонів, необхідно виконати деякі підготовчі дії. + +. *Робота з файлом _values.yaml_*: +* _values.yaml_ – це файл конфігурації, який містить усі налаштування для вашого реєстру. Вам потрібно вручну заповнити цей файл необхідними значеннями, які відповідають тому шаблону, який ви обрали при створенні реєстру, або іншими відповідними параметрами. + +. *Коміт (commit) змін*: +* Після внесення змін у _values.yaml_, важливо зробити коміт (`commit`) цих змін у Gerrit. + +. *Міграція реєстру*: +* Лише після того, як ви виконали вищезазначені кроки, реєстр готовий до міграції на нову версію. + +Цей процес дозволяє забезпечити, що всі налаштування та конфігурації вашого реєстру будуть коректно перенесені під час оновлення, і що нова версія буде працювати згідно з вашими потребами та вимогами. +==== + +Натисніть *`Далі`* для переходу до наступного кроку. == Створення адміністраторів реєстру -На цьому кроці ви можете призначити _адміністраторів реєстру_. +На цьому кроці ви можете призначити *_адміністраторів реєстру_*. [NOTE] ==== @@ -85,25 +130,25 @@ image:admin:registry-management/registry-create/cp-create-registry-1.png[] Детальніше про це див. на сторінці xref:registry-develop:registry-admin/create-users/create-registry-admins.adoc[]. ==== -. У полі +++Адміністратори+++ вкажіть адміністраторів, яким буде надано доступ до реєстру. +. У полі *Адміністратори* вкажіть адміністраторів, яким буде надано доступ до реєстру. + CAUTION: Поле є обов'язковим до заповнення. + -image:admin:registry-management/registry-create/cp-create-registry-2-1.png[] +image:admin:registry-management/registry-create/cp-create-registry-ua-2.png[] + -Натисніть `+` (`Додати`) та у новому вікні введіть дані кожного адміністратора реєстру, а саме: +Натисніть *`+`* (*`Додати`*) та у новому вікні введіть дані кожного адміністратора реєстру, а саме: + -- -* +++Ім'я+++ -* +++Прізвище+++ -* +++Електронна пошта+++ -* +++Тимчасовий пароль+++ +* *Ім'я* +* *Прізвище* +* *Електронна пошта* +* *Тимчасовий пароль* -- + -image:admin:registry-management/registry-create/cp-create-registry-2.png[] +image:admin:registry-management/registry-create/cp-create-registry-ua-2-1.png[] + -Для того, щоб надати доступ декільком особам, повторіть дію для кожного адміністратора окремо (`+` > вкажіть дані адміністратора > `+++Підтвердити+++`). +Для того, щоб надати доступ декільком особам, повторіть дію для кожного адміністратора окремо (*`+`* > вкажіть дані адміністратора > *`Підтвердити`*). + [NOTE] ==== @@ -112,65 +157,34 @@ image:admin:registry-management/registry-create/cp-create-registry-2.png[] Доступні символи: `"0-9"`, `"a-z"`, `"_"`, `"-"`, `"@"`, `"."`, `","`. ==== -. Натисніть `+++Далі+++` для переходу до наступного кроку. +. Натисніть *`Далі`* для переходу до наступного кроку. + -image:admin:registry-management/registry-create/cp-create-registry-2-2.png[] - +image:admin:registry-management/registry-create/cp-create-registry-ua-2-2.png[] + [NOTE] ==== Користувач-адміністратор реєстру автоматично створюється у реалмі `openshift` сервісу *Keycloak* із роллю `cp-registry-admin-` та групою `/cp-registry-admin-`, де `` -- назва реєстру. ==== - -== Шаблон розгортання реєстру - -На цьому кроці оберіть шаблон для розгортання реєстру. Залежно від навантаження, яке очікується на реєстр, ви можете обрати одну з доступних конфігурацій, тобто певний шаблон із відповідною кількістю ресурсів. Наприклад, мінімальна або рекомендована конфігурація, або конфігурація з геосервером тощо). - -Приблизну вартість обчислювальних ресурсів реєстру ви можете розрахувати на сторінці xref:arch:architecture/platform-system-requirements/registry-cost.adoc[], або зверніться за консультацією до команди технічної підтримки Платформи. - -image:admin:registry-management/registry-create/cp-create-registry-3.png[] - -. У полі +++Шаблон реєстру+++ оберіть зі списку шаблон конфігурації, відповідно до якого розгортатиметься реєстр. -+ -Шаблон реєстру визначає параметри конфігурації та кількість інстансів для реєстру, що розгортається, тобто виділену кількість ресурсів, зокрема *CPU*, *RAM* тощо, та кількість нод у *MachineSets*. -+ -CAUTION: Поле є обов'язковим до заповнення. -+ -image:admin:registry-management/registry-create/cp-create-registry-3-1.png[] - -. У полі +++Гілка шаблону реєстру+++ оберіть гілку, яка буде застосована при розгортанні реєстру. -+ -NOTE: Мається на увазі версія гілки компонента у Gerrit-репозиторії, що містить відповідну версію шаблону реєстру. -+ -CAUTION: Поле є обов'язковим до заповнення. -+ -image:admin:registry-management/registry-create/cp-create-registry-3-2.png[] - -. Натисніть `+++Далі+++` для переходу до наступного кроку. - -+ -image:admin:registry-management/registry-create/cp-create-registry-3-3.png[] - == Вибір поштового сервера На цьому кроці оберіть тип поштового сервера для відправлення email-повідомлень у реєстрі. CAUTION: Крок є опціональним. Ви можете пропустити ці налаштування. Їх можна змінити під час редагування реєстру. -image:admin:registry-management/registry-create/cp-create-registry-4.png[] +image:admin:registry-management/registry-create/cp-create-registry-ua-4.png[] -* +++Внутрішній поштовий сервер+++ (`*platform-mail-server*`) — поштовий сервер, який розповсюджується як платформний сервіс та доступний для використання усіма реєстрами одного екземпляра Платформи. +* *Платформний поштовий сервер* (`platform-mail-server`) — поштовий сервер, який розповсюджується як внутрішній Платформний сервіс та доступний для використання усіма реєстрами одного екземпляра Платформи. -* +++Зовнішній поштовий сервер+++ (*`external-mail-server`*) — зовнішній відносно платформи поштовий сервіс (*gmail* тощо). +* *Зовнішній поштовий сервер* (`external-mail-server`) — зовнішній відносно платформи поштовий сервіс (*Gmail* тощо). [TIP] ==== Детальна інформація доступна на сторінці xref:registry-develop:registry-admin/user-notifications/email/config-smtp-server.adoc[]. ==== -Натисніть `+++Далі+++` для переходу до наступного кроку. +Натисніть `*Далі*` для переходу до наступного кроку. == Дані про ключ @@ -180,7 +194,7 @@ image:admin:registry-management/registry-create/cp-create-registry-4.png[] ==== Крок є обов'язковим. -Секція +++Дані про ключ+++ має містити налаштування для ініціалізації криптосервісу (*`digital-signature-ops`*) та накладання системного підпису (цифрової печатки системи). Без внесення цих даних пода криптосервісу не запуститься. +Секція *Дані про ключ* має містити налаштування для ініціалізації криптосервісу (*`digital-signature-ops`*) та накладання системного підпису (цифрової печатки системи). Без внесення цих даних пода криптосервісу не запуститься. Такі ключі використовуються для підпису витягів, сформованих Платформою, та підпису даних, що змінюються відповідно до логіки бізнес-процесів реєстру. ==== @@ -190,37 +204,127 @@ image:admin:registry-management/registry-create/cp-create-registry-4.png[] Детальна інформація щодо налаштування ключів доступна на сторінці xref:registry-management/system-keys/control-plane-registry-keys.adoc[]. ==== -. У полі +++Тип носія+++ оберіть відповідний тип ключа, що використовується. +. У полі *Тип носія* оберіть відповідний тип ключа, що використовується. . Оберіть електронний ключ. + -Поле +++Файловий ключ (розширення .dat)+++ заповнюється операційним ключем із розширенням -`.dat` (_Key-6.dat_) адміністратора Платформи. +Поле *Файловий ключ (розширення .dat)* заповнюється операційним ключем адміністратора Платформи із розширенням `.dat` (_Key-6.dat_). Завантажте файл із ключем, натиснувши kbd:[*Browse*], оберіть ключ у відповідній директорії та натисніть kbd:[*Open*]. -. У полі +++АЦСК, що видав ключ+++ показана повна назва АЦСКfootnote:[**АЦСК** - Акредитований центр сертифікації ключів.], що видав ключ. +. У полі *АЦСК, що видав ключ* показана повна назва АЦСКfootnote:[**АЦСК** - Акредитований центр сертифікації ключів.], що видав ключ. -. У полі +++Пароль до файлового ключа+++ введіть пароль до завантаженого ключа. +. У полі *Пароль до файлового ключа* введіть пароль до завантаженого ключа. -. Секція +++Дані для перевірки ключа+++ містить дані публічних сертифікатів та перелік АЦСК: +. У полі *Перелік дозволених ключів* заповніть дані для усіх довірених ключів: -* У полі +++Публічні сертифікати АЦСК (розширення .p7b)+++ завантажте файл із переліком сертифікатів сумісних ЦСК (https://iit.com.ua/download/productfiles/CACertificates.p7b[CACertificates.p7b]), який можна отримати на сайті АТ "ІІТ" за посиланням https://iit.com.ua/downloads. -* У полі +++Список АЦСК (розширення .json)+++ завантажте файл із параметрами взаємодії сумісними ЦСК (link:https://iit.com.ua/download/productfiles/[CAs.json]), який можна отримати на сайті АТ "ІІТ" за посиланням: https://iit.com.ua/downloads. +* *Емітент ключа*: параметр `issuer` у файлі _allowed-keys.yml_; +* *Серійний номер ключа*: параметр `serial` у файлі _allowed-keys.yml_. -. Вкажіть +++Перелік дозволених ключів+++, підпис яких може вважатися дійсним. + [NOTE] ==== У цьому блоці зазначається перелік ключів, у тому числі й старих (наприклад, при ротації ключів), щоб все, що раніше було підписано старим ключем, вважалося валідованим. Тобто перелік дозволених ключів повинен містити історію даних усіх ключів, що використовувались у системі для накладання підпису. ==== -. Натисніть `+++Далі+++` для переходу до наступного кроку. +. Натисніть `*Далі*` для переходу до наступного кроку. + +image:admin:registry-management/registry-create/cp-create-registry-ua-5.png[] + +== Дані для перевірки підписів + +На цьому кроці ви можете внести сертифікати АЦСК для перевірки ключів системного підпису та КЕП користувачів, які будуть застосовані до налаштувань реєстру. + +. У полі *Публічні сертифікати АЦСК (розширення .p7b)* завантажте файл із переліком сертифікатів сумісних ЦСК (https://iit.com.ua/download/productfiles/CACertificates.p7b[CACertificates.p7b]), який можна отримати на сайті АТ "ІІТ" за посиланням https://iit.com.ua/downloads. +. У полі *Перелік АЦСК (розширення .json)* завантажте файл із параметрами взаємодії сумісними ЦСК (https://iit.com.ua/download/productfiles/[CAs.json]), який можна отримати на сайті АТ "ІІТ" за посиланням: https://iit.com.ua/downloads[]. + +image:admin:registry-management/registry-create/cp-create-registry-ua-5-1.png[] + +[TIP] +==== +Детальна інформація щодо налаштування сертифікатів цифрового підпису доступна на сторінці xref:registry-management/system-keys/control-plane-registry-certificates.adoc[]. +==== + +Натисніть `*Далі*` для переходу до наступного кроку. + +[#vm-params] +== Параметри віртуальних машин + +NOTE: Кластер OpenShift розгорнутий на інфраструктурі AWS. Докладніше про допустимі значення параметрів віртуальних машин -- див. https://docs.openshift.com/container-platform/4.12/installing/installing_aws/preparing-to-install-on-aws.html[Системні вимоги OpenShift]. + +На цьому кроці ви можете налаштувати інфраструктуру кластера для вашого реєстру. Встановіть специфічні параметри, які мають передзаповнені значення за замовчуванням. + +image:admin:registry-management/registry-create/cp-create-registry-ua-01.png[] + +[required-vm] +=== Кількість віртуальних машин + +*Кількість віртуальних машин* (ВМ) -- поле обов'язкове. Виберіть кількість машин у діапазоні від 1 до 2000. Це визначає масштаб вашого кластера. + +NOTE: За замовчуванням встановлено `2` ВМ. + +[aws-ec2-type] +=== Тип AWS EC2-інстансу + +*Тип AWS EC2-інстансу* -- поле обов'язкове. + +* `r5.2xlarge`: Оптимізований для пам'яті, рекомендований для баз даних та кешування. +* `m5.xlarge`: Збалансований тип, підходить для загальних цілей. +* `c5.4xlarge`: Оптимізований для обчислень, ідеальний для великих обчислювальних завдань. + +NOTE: За замовчуванням встановлено `r5.2xlarge`. + +[aws-ec2-spot] +=== Використання AWS EC2 Spot-інстансу + +*Використати AWS EC2 Spot-інстанс* -- це опційний параметр, який вмикається або вимикається перемикачем. + +NOTE: Вимкнено за замовчуванням. + +Якщо увімкнено, стають доступними додаткові налаштування: -image:admin:registry-management/registry-create/cp-create-registry-5.png[] +Максимальна ціна AWS EC2-інстансу (за годину): :: ++ +Цей параметр дозволяє вам встановити максимальну ціну, яку ви готові платити за годину використання EC2 Spot Instance. Spot Instances -- це невикористані EC2-інстанси, які Amazon Web Services (AWS) пропонує за значно нижчими цінами порівняно з On-Demand Instances. Ціни на Spot Instances змінюються в реальному часі залежно від попиту та пропозиції. ++ +Ви можете обрати: + +* *On-Demand Instance price* (_встановлено за замовчуванням_): Цей варіант означає, що ви готові платити стандартну ціну за використання інстансу, яка не змінюється і є вищою порівняно зі Spot Instances. Вибір цього параметра гарантує доступність інстансу, але за вищою ціною. + +* *Вказати власну ціну ($/година)*: Цей варіант дозволяє вам встановити власну максимальну ціну за годину використання. Якщо ринкова ціна Spot Instance є нижчою або дорівнює вашій вказаній ціні, інстанс буде запущений. Якщо ринкова ціна підвищується і перевищує вашу максимальну ціну, інстанс може бути автоматично вимкнений. + +Використання Spot Instances може суттєво знизити витрати на обчислювальні ресурси, але вимагає гнучкості щодо доступності ресурсів, оскільки AWS може вимкнути ці інстанси з невеликим попередженням, якщо виникне підвищений попит на ці ресурси. + +[disk-type] +=== Тип системного диска AWS EC2-інстансу + +* *Тип системного диска AWS EC2-інстансу* -- поле обов'язкове. + +** За замовчуванням встановлено `gp3`. Надає збалансовану продуктивність і ціну. +** Інші типи, такі як `io1` (висока продуктивність) і `st1` (оптимізовані для великих обсягів даних), можуть бути вибрані залежно від ваших потреб. + +[disk-size] +=== Розмір системного диска віртуальної машини (GB) + +*Розмір системного диска віртуальної машини (GB)* -- поле обов'язкове. +Ви можете вибрати розмір диска в діапазоні від 50 до 200 GB залежно від ваших вимог до зберігання даних. + +NOTE: За замовчуванням встановлено `80 GB`. + +Натисніть `*Далі*` для переходу до наступного кроку. + +[TIP] +==== +Ознайомтеся з цими ресурсами для отримання додаткової інформації та поглиблення вашого розуміння: + +* xref:admin:registry-management/control-plane-registry-resources.adoc[] +* xref:arch:architecture/platform-system-requirements/registry-requirements.adoc[] +==== + +[#registry-resources] == Ресурси реєстру -На цьому кроці ви можете визначити конфігурацію для ресурсів реєстру по певних сервісах, які у ньому розгортаються. Керування ресурсами, що використовуються контейнерами в рамках вашого екземпляра реєстру, дозволяє забезпечити оптимальну працездатність та ефективність. +На цьому кроці ви можете визначити конфігурацію для ресурсів реєстру по певних сервісах, які у ньому розгортаються. Також можна включити автоматичне горизонтальне масштабування для окремих компонентів. Керування ресурсами, що використовуються контейнерами в рамках вашого екземпляра реєстру, дозволяє забезпечити оптимальну працездатність та ефективність. . Оберіть зі списку сервіс для конфігурації ресурсів і натисніть *`+`* (`Додати`). + @@ -228,17 +332,18 @@ image:admin:registry-management/registry-create/cp-create-registry-5.png[] ==== Крок є опціональним. -Під час розгортання реєстру усі наявні сервіси налаштовані та передзаповнені відповідними значеннями запитів, лімітів та змінних оточення за замовчуванням. +Під час розгортання реєстру усі наявні сервіси налаштовані та передзаповнені відповідними значеннями кількості реплік, запитів, лімітів та змінних оточення за замовчуванням. Навіть у випадку видалення сервісів зі списку, під час розгортання реєстру Платформа застосує стандартну конфігурацію. ==== + -image:admin:registry-management/registry-create/cp-create-registry-7.png[] +image:admin:registry-management/registry-resources/registry-resources-1.png[] ++ +image:admin:registry-management/registry-resources/registry-resources-2.png[] . Встановіть власні значення для ресурсів. -. Натисніть `+++Далі+++` для переходу до наступного кроку. -+ -image:admin:registry-management/registry-create/cp-create-registry-7-1.png[] + +. Натисніть `*Далі*` для переходу до наступного кроку. TIP: Детальніше про налаштування ви можете переглянути на сторінці xref:registry-management/control-plane-registry-resources.adoc[]. @@ -253,11 +358,11 @@ TIP: Детальніше про налаштування ви можете пе Якщо ви не вкажете тут жодних налаштувань, система використає значення за замовчуванням. ==== -image:admin:registry-management/registry-create/cp-create-registry-6.png[] +image:admin:registry-management/registry-create/cp-create-registry-ua-6.png[] TIP: Детальніше про функціональність читайте у розділі xref:admin:registry-management/custom-dns/custom-dns-overview.adoc[]. -Натисніть `+++Далі+++` для переходу до наступного кроку. +Натисніть `*Далі*` для переходу до наступного кроку. == Обмеження доступу @@ -268,109 +373,193 @@ TIP: Детальніше про функціональність читайте Крок є опціональним, але з метою безпеки рекомендовано встановити CIDR для відповідних компонентів. ==== -image:admin:registry-management/registry-create/cp-create-registry-8.png[] +image:admin:registry-management/registry-create/cp-create-registry-ua-8.png[] TIP: Детальніше про функціональність читайте на сторінці xref:admin:registry-management/control-plane-cidr-access-endpoints.adoc[]. -Натисніть `+++Далі+++` для переходу до наступного кроку. +Натисніть `*Далі*` для переходу до наступного кроку. -== Автентифікація надавачів послуг +== Кабінет надавача послуг -На цьому кроці ви можете налаштувати тип автентифікації для надавачів послуг (посадових осіб), а також дозволити, або заборонити можливість автореєстрації. +На цьому кроці ви можете дозволити або заборонити розгортання Кабінету надавача послуг, налаштувати параметри доступу користувачів, тип автентифікації, а також увімкнути або вимкнути самостійну реєстрацію для надавачів послуг. [CAUTION] ==== Крок є опціональним. -Якщо ви не вкажете тут жодних налаштувань, система використає значення за замовчуванням -- автентифікація з КЕП та вимкнена автореєстрація. +Якщо ви не вкажете тут жодних налаштувань, система використає значення за замовчуванням. ==== -image:admin:registry-management/registry-create/cp-create-registry-9.png[] +image:admin:registry-management/registry-create/cp-create-registry-ua-9.png[] + +TIP: Детальніше про Кабінет користувача читайте на сторінках xref:user:officer/officer-portal-overview.adoc[]. + +[deploy-officer-portal] +=== Розгортання Кабінету + +*Перемикач для розгортання Кабінету надавача послуг* дозволяє вам вирішити, чи буде доступний Кабінет надавача послуг у вашому реєстрі. + +NOTE: Увімкнено за замовчуванням. Якщо вимкнути, всі подальші налаштування на цій сторінці стануть недоступними. + +[configure-access] +=== Управління доступом + +*Дозволити доступ з КЕП фізичної особи* -- перемикач, який дозволяє або забороняє доступ користувачам до Кабінету з використанням КЕП фізичної особи. + +NOTE: Вимкнено за замовчуванням. + +TIP: Детальніше про функціональність ви можете дізнатися на сторінці xref:registry-develop:registry-admin/cp-auth-setup/officer-portal-access-individual-qes.adoc[]. -Ви можете обрати один із двох типів автентифікації, який буде доступний для ідентифікації особи в системі: +[officers-auth-type] +=== Тип автентифікації -* КЕП (*IIT*-віджет) -* Віджет *id.gov.ua* +*Тип автентифікації*: ви можете вибрати між IIT-віджетом автентифікації або налаштувати інтеграцію з *id.gov.ua*. Визначте тип автентифікації та надайте необхідні URL-адреси та параметри для віджетів. + +* *IIT-віджет* (_встановлено за замовчуванням_) -- дозволяє автентифікацію надавачів послуг лише з КЕП. +* *Віджет id.gov.ua* -- дозволяє автентифікацію надавачів послуг лише за допомогою зовнішнього провайдера ідентифікації, *id.gov.ua*. TIP: Детальніше про функціональність читайте на сторінці xref:registry-develop:registry-admin/cp-auth-setup/cp-auth-setup-officers.adoc[]. -Самостійна реєстрація посадових осіб дозволить вам спростити процес реєстрації користувачів без необхідності залучення адміністратора. +[officers-self-register] +=== Самостійна реєстрація користувачів + +*Самостійна реєстрація користувачів* дозволить вам спростити процес реєстрації користувачів без необхідності залучення адміністратора. Передбачає наявність у реєстрі попередньо змодельованого бізнес-процесу самореєстрації. + +NOTE: Вимкнено за замовчуванням. TIP: Детальніше про функціональність читайте на сторінці xref:registry-develop:registry-admin/cp-auth-setup/cp-officer-self-registration.adoc[]. -Натисніть `+++Далі+++` для переходу до наступного кроку. +Натисніть `*Далі*` для переходу до наступного кроку. -== Автентифікація отримувачів послуг +== Кабінет отримувача послуг -На цьому кроці ви можете налаштувати перевірку наявності активного запису в ЄДР для бізнес-користувачів, що дозволяє встановити зв'язок між КЕП користувача та його юридичною особою чи фізичною особою-підприємцем, що зареєстровані в Єдиному державному реєстрі (ЄДР). Це важливий аспект безпеки та надійності системи, який допомагає забезпечити відповідність даних користувача та підтвердження їх особистості. +На цьому кроці ви можете дозволити або заборонити розгортання Кабінету отримувача послуг, налаштувати ключові параметри автентифікації для отримувачів послуг, зокрема перевірку даних з КЕП користувачів у Єдиному державному реєстрі (ЄДР), вибір типу автентифікації та налаштування віджета підпису документів. Ці налаштування допоможуть забезпечити високий рівень безпеки та зручність для користувачів системи. [CAUTION] ==== Крок є опціональним. -Якщо ви не вкажете тут жодних налаштувань, система використає значення за замовчуванням -- перевірка увімкнена. +Якщо ви не вкажете тут жодних налаштувань, система використає значення за замовчуванням. ==== -image:admin:registry-management/registry-create/cp-create-registry-10.png[] +image:admin:registry-management/registry-create/cp-create-registry-ua-10.png[] -TIP: Детальніше про функціональність читайте на сторінці xref:registry-develop:registry-admin/cp-auth-setup/cp-auth-setup-citizens.adoc[]. +TIP: Детальніше про Кабінет користувача читайте на сторінках xref:user:citizen/citizen-portal-overview.adoc[]. -Натисніть `+++Далі+++` для переходу до наступного кроку. +[deploy-officer-portal] +=== Розгортання Кабінету -== Цифрові документи +*Перемикач для розгортання Кабінету отримувача послуг* дозволяє вам вирішити, чи буде доступний Кабінет отримувача послуг у вашому реєстрі. + +NOTE: Увімкнено за замовчуванням. Якщо вимкнути, всі подальші налаштування на цій сторінці стануть недоступними. + +[citizens-edr-check] +=== Перевірка даних в ЄДР + +Перевірка даних з КЕП користувачів у Єдиному державному реєстрі (ЄДР) відбувається за умови налаштованої інтеграції поточного реєстру з ЄДР через ШБО "Трембіта". Ця функція дозволяє вам переконатися, що бізнес-користувачі мають активний запис у ЄДР, забезпечуючи додатковий рівень перевірки та підтвердження особи. + +TIP: Детальніше про функціональність читайте на сторінці xref:registry-develop:registry-admin/cp-auth-setup/cp-auth-setup-citizens.adoc#edr-check[Перевірка наявності активного запису в ЄДР для бізнес-користувачів]. -Адміністративна панель Control Plane надає зручний інтерфейс, який дозволяє адміністраторам керувати обмеженнями на завантаження цифрових документів до реєстру користувачами та бізнес-процесами. +NOTE: Увімкнено за замовчуванням. -Ви можете встановити максимальний розмір для одного файлу та групи файлів для завантаження до реєстру. +[citizens-auth-type] +=== Тип автентифікації -NOTE: Значення вводиться у мегабайтах (MB) і може складатися з цифр (`0-9`) та крапки. Максимальна довжина значення -- 4 символи. Наприклад, можна встановити значення `10`, `100`, `50.2` тощо. Головне, щоб воно було менше або дорівнювало глобальному обмеженню на рівні Платформи, яке становить `100` МБ для максимального розміру запита. +*Тип автентифікації*: ви можете вибрати між IIT-віджетом автентифікації або налаштувати інтеграцію з *id.gov.ua*. Визначте тип автентифікації та надайте необхідні URL-адреси та параметри для віджетів. -image:registry-management/cp-digital-docs-restrictions/cp-digital-docs-restrictions-2.png[] +* *IIT-віджет* (_встановлено за замовчуванням_) -- дозволяє автентифікацію отримувачів послуг лише з КЕП. +* *Віджет id.gov.ua* -- дозволяє автентифікацію отримувачів послуг лише за допомогою зовнішнього провайдера ідентифікації, *id.gov.ua*. -TIP: TIP: Детальніше про функціональність читайте на сторінці xref:admin:registry-management/control-plane-digital-documents.adoc[]. +TIP: Детальніше про функціональність читайте на сторінці xref:registry-develop:registry-admin/cp-auth-setup/cp-auth-setup-citizens.adoc#setup-auth-sign[Налаштування автентифікації та підпису даних в Control Plane]. -Натисніть `+++Далі+++` для переходу до наступного кроку. +[citizens-sign-widget] +=== Віджет підпису документів + +Налаштуйте віджет для електронного підпису документів, вказавши URL та висоту віджета у пікселях. + +*Використовувати налаштування віджета автентифікації* (_за замовчуванням вимкнено_) -- перемикач надає можливість уніфікувати віджети для підпису та автентифікації. Якщо увімкнено, то автоматично застосуються налаштування віджета автентифікації. + +TIP: Детальніше про функціональність читайте на сторінці xref:registry-develop:registry-admin/cp-auth-setup/cp-auth-setup-citizens.adoc#citizens-sign-widget[Налаштування віджета підпису документів]. + +Натисніть `*Далі*` для переходу до наступного кроку. + +== Кабінет адміністратора регламенту + +Кабінет адміністратора регламенту є ключовим компонентом у процесі створення та управління реєстром. На цьому кроці ви можете дозволити або заборонити розгортання вебпорталу для моделювання та розробки регламенту реєстру. + +NOTE: Увімкнено за замовчуванням. Рекомендовано залишати увімкненим значення за замовчуванням при розгортанні реєстру у xref:#deployment-mode[режимі розробки] (`development`) і навпаки -- вимикати розгортання адміністративного порталу у промисловій експлуатації (`production`) реєстру. + +image:admin:registry-management/registry-create/cp-create-registry-ua-02.png[] + +TIP: Більше про Кабінет адміністратора регламентів ви можете дізнатися у розділі xref:registry-develop:registry-admin/admin-portal/overview.adoc[]. + +Натисніть `*Далі*` для переходу до наступного кроку. + +== Підсистема управління геоданими + +Підсистема управління геоданими є інтегральною частиною будь-якої сучасної інформаційної системи, що вимагає обробки та аналізу просторових даних. Ця підсистема надає засоби для зберігання, обробки, візуалізації та розподілення геопросторової інформації. + +Відповідний перемикач дозволяє активувати підсистему управління геоданими у вашому реєстрі. Це включає інтеграцію з різними геоінформаційними сервісами, можливість використання геопросторових баз даних та інструментів для створення та адміністрування геоданих. + +NOTE: Вимкнено за замовчуванням. + +[WARNING] +==== +Важливо зазначити, що після створення реєстру змінити ці налаштування буде неможливо. Тому ретельно обдумайте потребу включення підсистеми управління геоданими на цьому етапі. Вона особливо важлива для реєстрів, що використовують геопросторову інформацію для аналітики, планування, або візуалізації. +==== + +image:admin:registry-management/registry-create/cp-create-registry-ua-03.png[] + +TIP: Більше про можливості геосервера ви можете дізнатися на сторінці xref:registry-develop:registry-admin/geoserver.adoc[]. + + +Натисніть `*Далі*` для переходу до наступного кроку. + +== Цифрові документи + +Адміністративна панель Control Plane надає зручний інтерфейс для керування обмеженнями на завантаження цифрових документів до реєстру користувачами та бізнес-процесами. Ви маєте можливість встановити максимальний розмір для окремих файлів, а також загальний максимальний розмір для групи файлів, які можуть бути завантажені користувачами через інтерфейс. + +NOTE: Значення вводяться у мегабайтах (MB) і можуть складатися з цифр (`0-9`) та крапки. Максимальна довжина значення — 4 символи, наприклад `10`, `100`, `50.2`. Головне, щоб воно було менше або дорівнювало глобальному обмеженню на рівні Платформи, яке становить `100` МБ для максимального розміру запита. За замовчуванням встановлено максимальні можливі значення -- 100 МБ для обох полів. + +image:registry-management/cp-digital-docs-restrictions/cp-digital-docs-restrictions-ua-1.png[] + +TIP: Детальніше про функціональність читайте на сторінці xref:admin:registry-management/control-plane-digital-documents.adoc[]. + +Натисніть `*Далі*` для переходу до наступного кроку. == Резервне копіювання На цьому кроці ви можете налаштувати розклад створення резервних копій компонентів реєстру, а також період зберігання таких копій у сховищі бекапів. +NOTE: Крок є опційним. Вимкнено за замовчуванням. + Резервні копії компонентів створюються за допомогою інструменту *`velero`* та зберігаються у захищеному сховищі бекапів *`minio`*, що знаходиться поза межами кластера Платформи. Розклад резервного копіювання налаштовується у форматі https://uk.wikipedia.org/wiki/Cron[*unix-cron*] на інтерфейсі адміністративної панелі *Control Plane*. Також система виконує автоматичну реплікацію даних, які зберігаються в S3-бакетах. Ви можете налаштувати розклад резервного копіювання таких реплікацій. -image:admin:backup-restore/backup-schedule-registry-components/backup-schedule-registry-components-8-1.png[] +image:admin:registry-management/registry-create/cp-create-registry-ua-04.png[] TIP: Детальніше про автоматичне створення резервних копій реєстру, а також резервне копіювання реплікацій S3-бакетів, читайте на сторінці xref:admin:backup-restore/backup-schedule-registry-components.adoc[]. TIP: Додатково ознайомтеся зі створенням бекапів у ручному режимі та відновленням з них середовища реєстру на сторінці xref:admin:backup-restore/control-plane-backup-restore.adoc[]. -Натисніть `+++Далі+++` для переходу до наступного кроку. +Натисніть `*Далі*` для переходу до наступного кроку. == ШБО Трембіта На цьому кроці ви можете надати можливість зовнішнім системам звертатися до реєстру через ШБО "Трембіта". Для цього вкажіть IP-адреси ШБО "Трембіта", з яких буде дозволено доступ до SOAP API реєстру. -[CAUTION] -==== -Крок є опціональним. +NOTE: Крок є опційним. За замовчуванням доступ вимкнено для нових реєстрів. -Якщо ви не вкажете тут жодних налаштувань, система не створить роути для вхідних SOAP-інтеграцій. Ви можете завжди зможете виконати необхідні конфігурації потім. -==== +. Перейдіть до секції *ШБО Трембіта*. Тут можна вказати дозволи на доступ до SOAP API реєстру через ШБО "Трембіта". Активуйте перемикач, щоб увімкнути доступ. -. Перейдіть до секції +++ШБО Трембіта+++. Тут можна вказати дозволи на доступ до SOAP API реєстру через ШБО "Трембіта". Активуйте перемикач, щоб увімкнути доступ. -+ -TIP: За замовчуванням доступ вимкнено для нових реєстрів. -+ -image:registry-management/cp-soap-api-access/cp-soap-api-access-trembita-5.png[] - -. У полі +++IP-адреси ШБО Трембіта+++ додайте нову IP-адресу ШБО "Трембіта", з якої буде дозволено доступ до хосту, на якому розгортатимуться роути SOAP API. - -. Натисніть +++Підтвердити+++ та повторіть дію для кожної такої IP-адреси. +. У полі *IP-адреси ШБО Трембіта* додайте нову IP-адресу ШБО "Трембіта", з якої буде дозволено доступ до хосту, на якому розгортатимуться роути SOAP API. + image:registry-management/cp-soap-api-access/cp-soap-api-access-trembita-6.png[] + +. Натисніть *Підтвердити* та повторіть дію для кожної такої IP-адреси. Допустима кількість значень -- 10. + [NOTE] ==== @@ -381,27 +570,27 @@ image:registry-management/cp-soap-api-access/cp-soap-api-access-trembita-6.png[] * Якщо перелік `ipList` не містить жодної IP-адреси, доступ до SOAP API є відсутнім (роут не створюється). ==== + -image:registry-management/cp-soap-api-access/cp-soap-api-access-trembita-7.png[] +image:admin:registry-management/registry-create/cp-create-registry-ua-05.png[] -. Натисніть +++Далі+++ для переходу до наступного кроку. +. Натисніть *Далі* для переходу до наступного кроку. TIP: Детальніше з описом функціональності ви можете ознайомитися на сторінці xref:registry-management/control-plane-soap-api-access-trembita.adoc[]. == Підтвердження та процес розгортання -Завершіть процедуру натисканням клавіші `+++Створити реєстр+++`. +Завершіть процедуру натисканням клавіші `*Створити реєстр*`. Ви можете також перевірити дані, внесені на попередніх кроках, переміщаючись між відповідними вкладками. -image:admin:registry-management/registry-create/cp-create-registry-12.png[] +image:admin:registry-management/registry-create/cp-create-registry-ua-06.png[] -У результаті реєстр додається до переліку доступних у розділі +++Реєстри+++ адміністративної панелі *Control Plane*. +У результаті реєстр додається до переліку доступних у розділі *Реєстри* адміністративної панелі *Control Plane*. -У разі успішного розгортання, реєстр позначається зеленою піктограмою у стовпці +++Статус+++. +У разі успішного розгортання, реєстр позначається зеленою піктограмою у стовпці *Статус*. image:admin:registry-management/registry-create/cp-create-registry-12-2.png[] -Розгортання реєстру займає певний час і виконується автоматично сервісом Jenkins. Сервіс запускає процес (пайплайн), що має назву *Master-Build-``*, де `` -- назва реєстру. Переглянути статус розгортання можна, перейшовши до розділу +++Реєстри+++ > відкрийте щойно створений реєстр > +++Конфігурація+++ > *CI*. +Розгортання реєстру займає певний час і виконується автоматично сервісом Jenkins. Сервіс запускає процес (пайплайн), що має назву *Master-Build-``*, де `` -- назва реєстру. Переглянути статус розгортання можна, перейшовши до розділу *Реєстри* > відкрийте щойно створений реєстр > *Конфігурація* > *CI*. image:admin:registry-management/registry-create/cp-create-registry-12-1.png[] diff --git a/docs/ua/modules/admin/pages/registry-management/control-plane-digital-documents.adoc b/docs/ua/modules/admin/pages/registry-management/control-plane-digital-documents.adoc index cf901182a8..cd7a85a9cf 100644 --- a/docs/ua/modules/admin/pages/registry-management/control-plane-digital-documents.adoc +++ b/docs/ua/modules/admin/pages/registry-management/control-plane-digital-documents.adoc @@ -3,35 +3,31 @@ include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc include::platform:ROOT:partial$admonitions/language-ua.adoc[] -== Опис функціональності +== Загальний опис та налаштування -Адміністративна панель Control Plane надає зручний інтерфейс, який дозволяє адміністраторам керувати обмеженнями на завантаження цифрових документів до реєстру користувачами та бізнес-процесами. +Адміністративна панель Control Plane надає зручний інтерфейс для керування обмеженнями на завантаження цифрових документів до реєстру користувачами та бізнес-процесами. Ви маєте можливість встановити максимальний розмір для окремих файлів, а також загальний максимальний розмір для групи файлів, які можуть бути завантажені користувачами через інтерфейс. -+++Максимальний розмір файлу для завантаження (MB)+++: це поле дозволяє встановлювати максимальний розмір окремого файлу, який можна завантажити. +NOTE: Значення вводяться у мегабайтах (MB) і можуть складатися з цифр (`0-9`) та крапки. Максимальна довжина значення — 4 символи, наприклад `10`, `100`, `50.2`. Головне, щоб воно було менше або дорівнювало глобальному обмеженню на рівні Платформи, яке становить `100` МБ для максимального розміру запита. За замовчуванням встановлено максимальні можливі значення -- 100 МБ для обох полів. -NOTE: Значення вводиться у мегабайтах (MB) і може складатися з цифр (`0-9`) та крапки. Максимальна довжина значення -- 4 символи. Наприклад, можна встановити значення `10`, `100`, `50.2` тощо. Головне, щоб воно було менше або дорівнювало глобальному обмеженню на рівні Платформи, яке становить `100` МБ для максимального розміру запита. +image:registry-management/cp-digital-docs-restrictions/cp-digital-docs-restrictions-ua-1.png[] -+++Максимальний сумарний розмір групи файлів для завантаження (MB)+++: це поле дозволяє встановлювати максимальний сумарний розмір для групи файлів, які можна завантажити за один раз. +* *Максимальний розмір файлу для завантаження*: Ви можете встановити обмеження на максимальний розмір одного файлу, який може бути завантажений користувачами та в процесах. Це значення застосовується до кожного окремого файлу та не може перевищувати загальне системне обмеження. Це значення визначає параметр *File Maximum Size* у конструкторі UI-форм. -NOTE: Це значення також вводиться у мегабайтах (MB) і може складатися з цифр (`0-9`) та крапки, при цьому максимальна довжина значення також становить 4 символи. Наприклад, можна встановити значення `10`, `100`, `50.2` тощо. Головне, щоб воно було менше або дорівнювало глобальному обмеженню на рівні Платформи, яке становить `100` МБ для максимального розміру запита. +* *Макс. сумарний розмір групи файлів для завантаження*: Встановіть обмеження на загальний максимальний розмір групи файлів, які можуть бути завантажені одночасно. Це обмеження діє на всю групу файлів, які завантажуються через одне або декілька файлових полів UI-форми. Значення використовується для визначення параметра *Maximum Total Size* в конструкторі UI-форм. -image:registry-management/cp-digital-docs-restrictions/cp-digital-docs-restrictions-1.png[] +Натисніть `*Далі*` для переходу до наступного кроку при створенні реєстру або `*Підтвердити*` при редагуванні налаштувань. -Застосування змін та розгортання конфігурації :: +== Застосування змін та розгортання конфігурації -. Встановіть власні обмеження або залиште значення за замовчуванням. +Після підтвердження налаштувань система формує запит на оновлення зі статусом `Новий` та типом `Редагування реєстру`. -. Натисніть +++Підтвердити+++, щоб зберегти зміни до конфігурації. - -. У результаті система формує запит на оновлення зі статусом `Новий` та типом `Редагування реєстру`. - -. У розділі +++Реєстри+++ > +++Запити на оновлення+++ знайдіть необхідний запит. +. У розділі *Реєстри* > *Запити на оновлення* знайдіть необхідний запит. + image:registry-management/cp-submit-mr/cp-submit-mr-1.png[] . Відкрийте сформований запит, натиснувши іконку перегляду -- 👁. -. У новому вікні зіставте 2 версії змін, переконайтеся, що внесені вами дані вірні, та натисніть `+++Підтвердити+++`. Ви також можете відразу відхилити зміни до конфігурації, натиснувши `+++Відхилити+++`. +. У новому вікні зіставте 2 версії змін, переконайтеся, що внесені вами дані вірні, та натисніть *`Підтвердити`*. Ви також можете відразу відхилити зміни до конфігурації, натиснувши *`Відхилити`*. + NOTE: Запропоновані зміни вносяться до конфігурації файлу *_deploy-templates/values.yaml_* репозиторію реєстру у разі підтвердження. + diff --git a/docs/ua/modules/admin/pages/registry-management/control-plane-edit-registry.adoc b/docs/ua/modules/admin/pages/registry-management/control-plane-edit-registry.adoc index 48eb4231e8..9dd4fd33df 100644 --- a/docs/ua/modules/admin/pages/registry-management/control-plane-edit-registry.adoc +++ b/docs/ua/modules/admin/pages/registry-management/control-plane-edit-registry.adoc @@ -45,7 +45,7 @@ image:registry-management/registry-edit/cp-edit-registry-2.png[] . Знайдіть розділ +++Реєстри+++ та відкрийте необхідний. + На цій сторінці ви можете побачити 2 основні вкладки: - ++ [tabs] ==== Інформація про реєстр:: diff --git a/docs/ua/modules/admin/pages/registry-management/control-plane-quick-links.adoc b/docs/ua/modules/admin/pages/registry-management/control-plane-quick-links.adoc index 18a7277644..1069a05195 100644 --- a/docs/ua/modules/admin/pages/registry-management/control-plane-quick-links.adoc +++ b/docs/ua/modules/admin/pages/registry-management/control-plane-quick-links.adoc @@ -23,7 +23,7 @@ Адміністративна панель *Control Plane* надає адміністраторам реєстру зручний спосіб доступу до всіх необхідних вебсервісів в одному місці. У цій статті ми розглянемо основні аспекти цієї функціональності. -При переході у розділ [.underline]#Реєстри#, ви побачите вкладку [.underline]#Швидкі посилання#. Тут представлені посилання до вебінтерфейсів різних сервісів з коротким описом їх призначення. +При переході у розділ *Реєстри*, ви побачите вкладку *Швидкі посилання*. Тут представлені посилання до вебінтерфейсів різних сервісів з коротким описом їх призначення. image:registry-management/quick-links/quick-links-1.png[] @@ -50,197 +50,473 @@ image:registry-management/quick-links/quick-links-1.png[] [CAUTION] ==== Посилання на відповідні сервіси можуть змінюватися, оскільки розташування сервісів залежить від середовища реєстру та кластера платформи, на якому розгорнуто певний сервіс. - -* Замініть `` на ім'я вашого проєкту/реєстру в OpenShift та `` -- на ваш DNS wildcard. -+ -Приклад посилання: `https://admin-tools-demo-reg-main.apps.envone.dev.registry.eua.gov.ua/` - -* Замініть на URL вашого кластера OpenShift. -+ -Приклад посилання: `https://console-openshift-console.apps.envone.dev.registry.eua.gov.ua` ==== [#registry-admin-zone] === Адміністративна зона реєстру -[#admin-portal] -[admin-portal] -==== Вебінтерфейс моделювання регламенту (Admin Portal) +image:registry-management/quick-links/quick-links-3.png[] -Призначення: :: -Клієнтський вебдодаток для адміністрування реєстрів. Інтерфейс дозволяє виконувати необхідну конфігурацію регламенту реєстру без володіння глибокими уміннями програмування. -+ -TIP: `https://admin-tools-.[]` +.Сервіси адміністративної зони реєстру +[options="header", cols="10%,10%,40%,30%,10%"] +|=== +|Логотип |Назва сервісу |Призначення |Шаблон посилання |Посилання на демо-реєстр -[gerrit] -==== Сервіс інспекції та зберігання змін регламенту (Gerrit) +|image:registry-management/quick-links/logos/admin-portal-logo.svg[width=50,height=auto] -Призначення: :: -Програмний інструмент, що дозволяє керувати версіями компонентів та конфігурацій. -+ -TIP: `https://admin-tools-./gerrit[]` +|*Admin Portal*: Вебінтерфейс моделювання регламенту -[jenkins] -==== Сервіс розгортання регламенту (Jenkins) +|Клієнтський вебдодаток для адміністрування та розробки реєстрів. Інтерфейс дозволяє виконувати необхідну конфігурацію регламенту реєстру без володіння глибокими уміннями програмування. -Призначення: :: -Програмний комплекс, що забезпечує автоматизацію в життєвому циклі розгортання регламенту реєстру. +a| +---- +https://admin-tools-. +---- -+ -TIP: `https://admin-tools-./cicd[]` +* `` -- назва реєстру; +* `` -- визначає домен та піддомени середовища, де розгорнуто ваш сервіс. -[swagger] -==== API-документація сервісу управління даними реєстру (Swagger) +*Наприклад:* -Призначення: :: -Вебінтерфейс для перегляду згенерованих API-точок доступу та API-документації Підсистеми управління даними реєстру з метою подальшого використання при побудові взаємодії через типові інтеграційні розширення-конектори у бізнес-процесах. -+ -TIP: `https://registry-rest-api-./openapi` +https://admin-tools-platform-demo.example.com -NOTE: Обов'язково додавайте [.underline]`*/openapi*` в кінець посилання, інакше ви потрапите до тестового середовища (пісочниці) Swagger. +| +include::platform:ROOT:partial$templates/links/registry/administrative/admin-portal.adoc[] -[redash-admin] -==== Вебінтерфейс моделювання звітів (Redash Admin) +|image:infrastructure/cluster-mgmt/quick-links/logos/gerrit-logo.svg[width=50,height=auto] -Призначення: :: -Користувацький інтерфейс для створення та налаштування аналітичних звітів та дашбордів. -+ -TIP: `https://admin-tools-<назва-реєстру>.dnsWildcard/reports` +|*Gerrit*: Сервіс інспекції та зберігання змін регламенту -[camunda-cockpit] -==== Вебінтерфейс управління виконанням бізнес-процесів (Business Process Administration Portal) +|Програмний інструмент, що дозволяє керувати версіями компонентів та конфігурацій. -Призначення: :: -Користувацький інтерфейс для перегляду стану виконання та управління бізнес-процесами реєстру. -+ -TIP: `https://business-proc-admin-.[]` +a| +---- +https://admin-tools-./gerrit +---- -[pg-admin] -==== Вебінтерфейс перегляду даних реєстру (pgAdmin) +* `` -- назва реєстру; +* `` -- визначає домен та піддомени середовища, де розгорнуто ваш сервіс. -Призначення: :: -Користувацький інтерфейс для перегляду даних та схеми моделі даних реєстру. -+ -TIP: `https://pgadmin-.[]` +*Наприклад:* -[geoserver] -==== Вебінтерфейс управління геоданими (Geo-server UI) +https://admin-tools-platform-demo.example.com/gerrit -Призначення: :: -Користувацький інтерфейс для адміністрування геоданих. -+ -TIP: `https://geo-server-./geoserver` +| +include::platform:ROOT:partial$templates/links/registry/administrative/gerrit.adoc[] + +|image:infrastructure/cluster-mgmt/quick-links/logos/jenkins-logo.svg[width=50,height=auto] + +|*Jenkins*: Сервіс розгортання регламенту + +|Програмний комплекс, що забезпечує автоматизацію в життєвому циклі розгортання регламенту реєстру. + +a| +---- +https://admin-tools-./cicd +---- + +* `` -- назва реєстру; +* `` -- визначає домен та піддомени середовища, де розгорнуто ваш сервіс. + +*Наприклад:* + +https://admin-tools-platform-demo.example.com/jenkins + +| +include::platform:ROOT:partial$templates/links/registry/administrative/jenkins.adoc[] + +|image:infrastructure/cluster-mgmt/quick-links/logos/nexus-logo.svg[width=50,height=auto] + +|*Nexus*: Сховище артефактів реєстру + +|Сховище артефактів, компонентів реєстру та їх залежностей, з яких складається кожна окрема підсистема реєстру. Збереження згенерованих в реєстрі артефактів. + +a| +---- +https://admin-tools-./nexus +---- + +* `` -- назва реєстру; +* `` -- визначає домен та піддомени середовища, де розгорнуто ваш сервіс. + +*Наприклад:* + +https://admin-tools-platform-demo.example.com/nexus + +| +include::platform:ROOT:partial$templates/links/registry/administrative/nexus.adoc[] + +|image:registry-management/quick-links/logos/swagger-logo.svg[width=50,height=auto] + +|*OpenAPI/Swagger*: API-документація сервісу управління даними реєстру + +|Вебінтерфейс для перегляду згенерованих API-точок доступу та API-документації Підсистеми управління даними реєстру. + +a| +---- +https://registry-rest-api-./openapi +---- + +* `` -- назва реєстру; +* `` -- визначає домен та піддомени середовища. + +*Наприклад:* + +https://registry-rest-api-platform-demo.example.com/openapi + +| +include::platform:ROOT:partial$templates/links/registry/administrative/openapi-swagger.adoc[] + +|image:registry-management/quick-links/logos/redash-logo.svg[width=50,height=auto] + +|*Redash Admin*: Вебінтерфейс моделювання звітів + +|Користувацький інтерфейс для створення та налаштування аналітичних звітів та дашбордів. -[nexus] -==== Сховище артефактів реєстру (Nexus) +a| +---- +https://admin-tools--main./reports +---- -Призначення: :: -Збереження згенерованих в реєстрі артефактів. +* `` -- назва реєстру; +* `-main` -- системна константа; +* `` -- визначає домен та піддомени середовища; +* `/reports` -- ендпоінт доступу до сервісу. -TIP: `https://nexus-control-plane-./nexus[]` +*Наприклад:* + +https://admin-tools-platform-demo-main.example.com/reports + +| +include::platform:ROOT:partial$templates/links/registry/administrative/redash-admin.adoc[] + +|image:registry-management/quick-links/logos/business-proc-admin-logo.svg[width=50,height=auto] + +|*Business Process Administration Portal*: Вебінтерфейс управління виконанням бізнес-процесів + +|Користувацький інтерфейс для перегляду стану виконання та управління бізнес-процесами реєстру. + +a| +---- +https://business-proc-admin-. +---- + +* `` -- назва реєстру; +* `` -- визначає домен та піддомени середовища. + +*Наприклад:* + +https://business-proc-admin-platform-demo.example.com + +| +include::platform:ROOT:partial$templates/links/registry/administrative/business-proc-admin-portal.adoc[] + +|image:registry-management/quick-links/logos/pgadmin-logo.svg[width=50,height=auto] + +|*pgAdmin*: Вебінтерфейс перегляду даних реєстру + +|Користувацький інтерфейс для перегляду даних та схеми моделі даних реєстру. + +a| +---- +https://pgadmin-. +---- + +* `` -- назва реєстру; +* `` -- визначає домен та піддомени середовища. + +*Наприклад:* + +https://pgadmin-platform-demo.example.com + +| +include::platform:ROOT:partial$templates/links/registry/administrative/pgadmin.adoc[] + +|image:registry-management/quick-links/logos/geo-server-logo.svg[width=50,height=auto] + +|*Geo-server UI*: Вебінтерфейс управління геоданими + +|Користувацький інтерфейс для адміністрування геоданих. + +a| +---- +https://geo-server-./geoserver +---- + +* `` -- назва реєстру; +* `` -- визначає домен та піддомени середовища. + +*Наприклад:* + +https://geo-server-platform-demo.example.com/geoserver + +| +include::platform:ROOT:partial$templates/links/registry/administrative/geoserver.adoc[] + +|=== [#registry-operational-zone] === Операційна зона реєстру -[citizen-portal] -==== Кабінет отримувача послуг (Citizen Portal) +image:registry-management/quick-links/quick-links-4.png[] -Призначення: :: -Клієнтський вебдодаток для отримання адміністративних та інформаційних послуг громадянами. -+ -TIP: `https://citizen-portal-.[]` +.Сервіси операційної зони реєстру +[options="header", cols="10%,10%,40%,30%,10%"] +|=== +|Логотип |Назва сервісу |Призначення |Шаблон посилання |Посилання на демо-реєстр -[officer-portal] -==== Кабінет посадової особи (Officer Portal) +|image:admin:registry-management/quick-links/logos/citizen-portal-logo.svg[width=50,height=auto] -Призначення: :: -Клієнтський вебдодаток для надання адміністративних та інформаційних послуг посадовою особою. -+ -TIP: `https://officer-portal-.[]` +|*Citizen Portal*: Кабінет отримувача послуг + +|Клієнтський вебдодаток для отримання адміністративних та інформаційних послуг громадянами. + +a| +---- +https://citizen-portal-. +---- + +* `` -- назва реєстру; +* `` -- визначає домен та піддомени середовища, де розгорнуто ваш сервіс. + +*Наприклад:* + +https://citizen-portal-platform-demo.example.com + +| +include::platform:ROOT:partial$templates/links/registry/operational/citizen-portal.adoc[] + +|image:admin:registry-management/quick-links/logos/officer-portal-logo.svg[width=50,height=auto] + +|*Officer Portal*: Кабінет користувача/надавача послуг + +|Клієнтський вебдодаток для надання адміністративних та інформаційних послуг посадовими та іншими уповноваженими особами. + +a| +---- +https://officer-portal-. +---- + +* `` -- назва реєстру; +* `` -- визначає домен та піддомени середовища, де розгорнуто ваш сервіс. + +*Наприклад:* + +https://officer-portal-platform-demo.example.com + +| +include::platform:ROOT:partial$templates/links/registry/operational/officer-portal.adoc[] + +|image:registry-management/quick-links/logos/redash-logo.svg[width=50,height=auto] + +|*Redash Viewer*: Вебінтерфейс перегляду звітів + +a|Користувацький інтерфейс для перегляду та вивантаження аналітичних звітів та дашбордів. + +NOTE: Redash Viewer може бути недоступним через інтерфейс Control Plane. У такому випадку, ви завжди маєте можливість доступу до цього сервісу через Кабінет надавача послуг (користувача) або через відповідний роут у середовищі вашого реєстру в OpenShift-консолі. + +a| +---- +https://officer-portal--main./reports +---- + +* `` -- назва реєстру; +* `-main` -- системна константа; +* `` -- визначає домен та піддомени середовища. + +*Наприклад:* + +https://officer-portal-platform-demo-main.example.com/reports + +| +include::platform:ROOT:partial$templates/links/registry/operational/redash-viewer.adoc[] + +|=== [#platform-admin-zone] === Адміністративна зона Платформи -[openshift-console] -==== Вебінтерфейс управління кластером OpenShift (Console) +image:admin:infrastructure/cluster-mgmt/quick-links/platform-management-quick-links-2-1.png[] -Призначення: :: -Інтерфейс користувача, доступний із веббраузера. Адміністратори Платформи можуть використовувати OpenShift вебконсоль для візуалізації, перегляду та керування вмістом або ресурсами OpenShift кластера, Платформи та реєстрів. -+ -TIP: `https://console-.[]` +.Сервіси адміністративної зони Платформи +[options="header", cols="10%,10%,40%,30%,10%"] +|=== +|Логотип |Назва сервісу |Призначення | Шаблон посилання |Посилання на демо-реєстр -[platform-gerrit] -==== Сервіс інспекції та зберігання змін конфігурації (Gerrit) +|image:infrastructure/cluster-mgmt/quick-links/logos/openshift-logo.svg[width=50,height=auto] -Призначення: :: -Програмний інструмент, що дозволяє керувати версіями компонентів та конфігурацій. Тісно інтегрований з розподіленою системою контролю версій Git та з допомогою цього інструменту адміністратори Платформи мають можливість переглядати всі модифікації коду та конфігурацій за допомогою веббраузер і затверджувати або відхиляти ці зміни. -+ -TIP: `https://gerrit-.[]` +|*OpenShift Console*: Вебінтерфейс управління кластером -[platform-jenkins] -==== Сервіс розгортання конфігурації (Jenkins) +|Інтерфейс користувача, доступний із веббраузера. Адміністратори Платформи можуть використовувати OpenShift вебконсоль для візуалізації, перегляду та керування вмістом або ресурсами OpenShift кластера, Платформи та реєстрів. -Призначення: :: -Програмний комплекс, що забезпечує автоматизацію в життєвому циклі Платформи та Реєстрів. Виконує фактичне розгортання Реєстру, конфігурування, оновлення та безліч інших автоматизованих задач на Платформі. +a| +---- +https://console-openshift-console. +---- -+ -TIP: `https://jenkins-.[]` +* `` -- визначає домен та піддомени середовища. + +*Наприклад:* + +https://console-openshift-console.example.com + +| +include::platform:ROOT:partial$templates/links/platform/administrative/openshift.adoc[] + +|image:infrastructure/cluster-mgmt/quick-links/logos/gerrit-logo.svg[width=50,height=auto] + +|*Gerrit*: Сервіс інспекції та зберігання змін конфігурації + +|Програмний інструмент, що дозволяє керувати версіями компонентів та конфігурацій. Тісно інтегрований з розподіленою системою контролю версій Git та з допомогою цього інструменту адміністратори Платформи мають можливість переглядати всі модифікації коду та конфігурацій за допомогою веббраузер і затверджувати або відхиляти ці зміни. + +a| +---- +https://gerrit-control-plane-platform-main. +---- + +* `` -- визначає домен та піддомени середовища. + +*Наприклад:* + +https://gerrit-control-plane-platform-main.example.com + +| +include::platform:ROOT:partial$templates/links/platform/administrative/gerrit.adoc[] + +|image:infrastructure/cluster-mgmt/quick-links/logos/jenkins-logo.svg[width=50,height=auto] + +|*Jenkins*: Сервіс розгортання конфігурації + +|Програмний комплекс, що забезпечує автоматизацію в життєвому циклі Платформи та Реєстрів. Виконує фактичне розгортання Реєстру, конфігурування, оновлення та безліч інших автоматизованих задач на Платформі. + +a| +---- +https://jenkins-control-plane-platform-main. +---- + +* `` -- визначає домен та піддомени середовища. + +*Наприклад:* + +https://jenkins-control-plane-platform-main.example.com + +| +include::platform:ROOT:partial$templates/links/platform/administrative/jenkins.adoc[] + +|=== [#platform-operational-zone] === Операційна зона Платформи -[platform-keycloak] -==== Сервіс управління користувачами та ролями (Keycloak) +image:admin:infrastructure/cluster-mgmt/quick-links/platform-management-quick-links-3-1.png[] -Призначення: :: -Аутентифікація та авторизація користувачів. -+ -TIP: `https://platform-keycloak-.[]` +.Сервіси операційної зони Платформи +[options="header", cols="10%,10%,40%,30%,10%"] +|=== +|Логотип |Назва сервісу |Призначення | Шаблон посилання |Посилання на демо-реєстр -[kibana] -==== Вебінтерфейс перегляду журналу подій Платформи (Kibana) +|image:infrastructure/cluster-mgmt/quick-links/logos/keycloak-logo.svg[width=50,height=auto] -Призначення: :: -Доступ та відображення логів в платформі. -+ -TIP: `https://kibana-openshift-logging.[]` +|*Keycloak*: Сервіс управління користувачами та ролями +|Аутентифікація та авторизація користувачів. -NOTE: Платформні сервіси для логування розгортаються в окремому проєкті -- *`openshift-logging`*. +a| +---- +https://platform-keycloak./auth +---- -[grafana] -==== Вебінтерфейс моніторингу Платформи (Grafana) +* `` -- визначає домен та піддомени середовища. +* `/auth` -- ендпоінт сторінки автентифікації сервісу Keycloak -Призначення: :: -Візуалізація та надання доступу до даних моніторингу. -+ -TIP: `https://grafana-grafana-monitoring.[]` +*Наприклад:* -NOTE: Платформні сервіси для моніторингу подій системи розгортаються в окремому проєкті -- *`grafana-monitoring`*. +https://platform-keycloak.example.com/auth -[kiali] -==== Вебінтерфейс управління та моніторингу Service Mesh (Kiali) +| +include::platform:ROOT:partial$templates/links/platform/operational/keycloak.adoc[] -Призначення: :: -Компонент, що дозволяє конфігурувати, перевіряти та аналізувати service-mesh Платформи, а також візуалізувати трафік всередині Платформи. -+ -[NOTE] -==== -.Що таке Service Mesh? -[%collapsible] -===== -Service Mesh (сервісна сітка) - це архітектурний підхід в розподілених системах, який спрощує взаємодію між мікросервісами та допомагає їм працювати разом ефективніше. Service mesh додає прозору інфраструктуру, яка забезпечує зв'язок між сервісами, керує трафіком, безпекою, моніторингом та іншими аспектами роботи мікросервісів. -===== -==== -+ -TIP: `https://kiali-istio-system.[]`. +|image:infrastructure/cluster-mgmt/quick-links/logos/kibana-logo.svg[width=50,height=auto] -[jaeger] -==== Вебінтерфейс моніторингу та трасування запитів (Jaeger) +|*Kibana*: Вебінтерфейс перегляду журналу подій Платформи -Призначення: :: -Сервіс, що використовується для моніторингу запитів та аналізу несправностей розподілених систем на основі мікросервісів. Дозволяє виконати аналіз залежностей компонента, аналіз несправностей, моніторинг транзакцій та оптимізацію продуктивності роботи Платформи. -+ -TIP: `https://jaeger-istio-system.[]` +|Доступ та відображення логів на Платформі. + +a| +---- +https://kibana-openshift-logging. +---- + +* `` -- визначає домен та піддомени середовища. + +*Наприклад:* + +https://kibana-openshift-logging.example.com + +| +include::platform:ROOT:partial$templates/links/platform/operational/kibana.adoc[] + +|image:infrastructure/cluster-mgmt/quick-links/logos/grafana-logo.svg[width=50,height=auto] + +|*Grafana*: Вебінтерфейс моніторингу Платформи + +|Візуалізація та надання доступу до даних моніторингу. + +a| +---- +https://grafana-grafana-monitoring./login +---- + +* `` -- визначає домен та піддомени середовища. +* `/login` -- ендпоінт, який приводить до сторінки входу у сервіс. + +*Наприклад:* + +https://grafana-grafana-monitoring.example.com/login + +| +include::platform:ROOT:partial$templates/links/platform/operational/grafana.adoc[] + +|image:infrastructure/cluster-mgmt/quick-links/logos/kiali-logo.svg[width=50,height=auto] + +|*Service Mesh (Kiali)*: Вебінтерфейс управління та моніторингу + +|Компонент, що забезпечує адміністраторів Платформи та реєстрів можливістю налаштовувати та аналізувати стан компонентів `service-mesh` Платформи та реєстрів, здійснювати моніторинг компонентів що входять в `service-mesh` в реальному часі та швидко виявляти проблеми в мережі. + +a| +---- +https://kiali-istio-system. +---- + +* `` -- визначає домен та піддомени середовища. + +*Наприклад:* + +https://kiali-istio-system.example.com + +| +include::platform:ROOT:partial$templates/links/platform/operational/kiali.adoc[] + +|image:infrastructure/cluster-mgmt/quick-links/logos/jaeger-logo.svg[width=50,height=auto] + +|*Jaeger*: Вебінтерфейс моніторингу та трасування запитів + +|Сервіс, що використовується для моніторингу запитів та аналізу несправностей розподілених систем на основі мікросервісів. Дозволяє виконати аналіз залежностей компонента, аналіз несправностей, моніторинг транзакцій та оптимізацію продуктивності роботи Платформи. + +a| +---- +https://jaeger-istio-system. +---- + +* `` -- визначає домен та піддомени середовища. + +*Наприклад:* + +https://jaeger-istio-system.example.com + +| +include::platform:ROOT:partial$templates/links/platform/operational/jaeger.adoc[] + +|=== == Обмеження доступу до сервісів diff --git a/docs/ua/modules/admin/pages/registry-management/control-plane-registry-grant-access.adoc b/docs/ua/modules/admin/pages/registry-management/control-plane-registry-grant-access.adoc index 27b66e35ff..732eb492c7 100644 --- a/docs/ua/modules/admin/pages/registry-management/control-plane-registry-grant-access.adoc +++ b/docs/ua/modules/admin/pages/registry-management/control-plane-registry-grant-access.adoc @@ -56,7 +56,7 @@ . Увійдіть до адміністративної панелі керування кластером та реєстрами *Control Plane*. + -image:infrastructure/cluster-mgmt/update-cluster-mgmt-01.png[] +image:infrastructure/cluster-mgmt/update-cluster-mgmt-ua-01.png[] . Відкрийте меню _Реєстри_. . Увійдіть до налаштувань реєстру. diff --git a/docs/ua/modules/admin/pages/registry-management/control-plane-registry-resources.adoc b/docs/ua/modules/admin/pages/registry-management/control-plane-registry-resources.adoc index 88dd0c8b39..e918b2ebea 100644 --- a/docs/ua/modules/admin/pages/registry-management/control-plane-registry-resources.adoc +++ b/docs/ua/modules/admin/pages/registry-management/control-plane-registry-resources.adoc @@ -3,29 +3,106 @@ include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc include::platform:ROOT:partial$admonitions/language-ua.adoc[] +== Загальний опис + Адміністративна панель *Control Plane* надає вам гнучке управління параметрами, використовуючи потужність Платформи. Це ефективний інструмент для керування ресурсами, що використовуються контейнерами в рамках вашого екземпляра реєстру, забезпечуючи оптимальну працездатність та ефективність. +image:admin:registry-management/registry-resources/registry-resources-1.png[] + TIP: Керування ресурсами доступне як при розгортанні, так і при оновленні реєстру. Кожний реєстр має розгорнуту конфігурацію сервісів за замовчуванням, яку надалі можна змінити. -== Перелік доступних сервісів +Ви можете додати окремі компоненти до реєстру та гнучко налаштувати для них ресурси. Також є можливість горизонтально масштабувати ресурси таких компонентів. + +. Відрийте інтерфейс +include::platform:ROOT:partial$templates/links/platform/administrative/control-plane.adoc[] +. + +. Оберіть з переліку компонент, для якого потрібно налаштувати ресурси. ++ +image:admin:registry-management/registry-resources/registry-resources-2.png[] + +. Натисніть *`Додати`*. ++ +image:admin:registry-management/registry-resources/registry-resources-3.png[] -.Перелік доступних сервісів для конфігурації ресурсів +== Перелік доступних компонентів + +.Перелік доступних компонентів для конфігурації ресурсів [options="header"] |=== -| +++Сервіс+++ | +++Опис+++ -| `bpms` | Сервіс, що керує моделюванням і виконанням бізнес-процесів на Платформі. -| `digitalDocumentService` | Сервіс керує операціями, пов'язаними з цифровими документами, такими як створення, зберігання та управління цифровими документами. -| `digitalSignatureOps` | Сервіс керує операціями, пов'язаними з цифровими підписами, наприклад, створення, перевірка та накладання цифрових підписів та печаток на документи. -| `formManagementProvider` | Сервіс відповідає за управління формами, включаючи створення, редагування та обробку форм даних. -| `kafkaApi` | Сервіс для обробки потокових даних у реальному часі. +| Компонент | Опис +| `adminPortal` | Вебінтерфейс моделювання регламенту (Admin Portal). +Клієнтський вебдодаток для адміністрування реєстрів. Інтерфейс дозволяє виконувати необхідну конфігурацію регламенту реєстру без володіння глибокими уміннями програмування. +| `analyticalInstance` | Аналітична база даних реєстру +| `bpAdminPortal` | Вебінтерфейс управління виконанням бізнес-процесів (Business Process Administration). +Користувацький інтерфейс для перегляду стану виконання та управління бізнес-процесами реєстру. +| `bpWebserviceGateway` | Сервіс викликів бізнес-процесів зовнішніми системами. +| `bpms` | Сервіс, що керує виконанням бізнес-процесів на Платформі. +| `citizenPortal` | Кабінет отримувача послуг +| `Crunchy Postgres` | Це дистрибутив PostgreSQL, оптимізований для високої доступності та безпеки. Цей сервіс забезпечує зберігання даних у базі даних PostgreSQL. +| `ddmLanguageServer` | Сервер, який надає специфічні для мови програмування інтелектуальні можливості та комунікує з розробницькими інструментами через протокол Language Server Protocol (LSP). Цей протокол стандартизує спосіб комунікації між такими серверами та інструментами розробки, що дозволяє використовувати один і той же Language Server у багатьох інструментах розробки, забезпечуючи підтримку кількох мов програмування з мінімальними зусиллями. +| `ddmNotificationService` | Сервіс нотифікацій користувачів +| `digitalDocumentService` | Сервіс керує операціями створення, зберігання та управління цифровими документами. +| `digitalSignatureOps` | Сервіс керує операціями створення, перевірки та накладання цифрових підписів та печаток на документи. +| `excerptServiceApi` | Сервіс управління витягами +| `excerptWorker` | Сервіс формування PDF-витягів +| `excerptWorkerCsv` | Сервіс формування CSV-витягів (витяги-звіти) +| `excerptWorkerDocx` | Сервіс формування DOCX-витягів (проєкти наказів) +| `externalSecrets` | Компонент, що дозволяє управляти секретами Kubernetes за допомогою External Secrets Operator. Він підтримує створення єдиного ресурсу `Secret` на основі декількох записів секретів з `HashiCorp Vault`. Такий підхід дозволяє централізовано керувати секретними даними та застосовувати різноманітні трансформації до них перед використанням у Kubernetes, забезпечуючи вищий рівень безпеки та ефективності управління конфіденційною інформацією. +| `formSchemaProvider` | Сервіс постачання UI-форм +| `formSubmissionValidation` | Сервіс валідації даних UI-форм +| `geoServer` | Сервер, призначений для обробки та візуалізації геопросторових даних. Він дозволяє взаємодіяти з базами даних для отримання геопросторової інформації та її подальшої репрезентації у форматі `GeoJSON`, що є відкритим стандартом формату для кодування різноманітних геоданих. +| `gerrit` | Сервіс інспекції та зберігання змін регламенту (Gerrit). Програмний інструмент, що дозволяє керувати версіями компонентів та конфігурацій. +| `hashicorpVault` | Сервіс управління секретами та шифруванням (Vault). Інструмент для безпечного управління секретами та захисту доступу до конфіденційної інформації в обчислювальних середовищах. +| `istioIngressGateway` | Компонентом сервісної мережі Istio, який забезпечує управління вхідним трафіком. Це ворота (gateway), через які зовнішні запити входять у сервісну мережу. Цей компонент дозволяє детально контролювати та маршрутизувати трафік до різних сервісів у Kubernetes-кластері. +| `jenkins` | Сервіс розгортання регламенту (Jenkins). Програмний комплекс, що забезпечує автоматизацію в життєвому циклі розгортання регламенту реєстру. + +| `kafkaApi` | Сервіс для обробки потокових даних у реальному часі. Використовується для публікації, підписки, зберігання та обробки потокових даних, забезпечуючи високу пропускну спроможність та надійність. +| `kafkaClusterEntityOperator` | Забезпечує моніторинг та управління сутностями всередині Kafka кластера, включаючи топіки, користувачів Kafka та Kafka Connect. Цей компонент важливий для адміністрування та оптимізації роботи кластера. +| `kafkaClusterKafka` | Описує основні вузли у Kafka-кластері. Цей компонент відповідає за обробку потокових даних та пов'язаних з ними операцій, таких як публікація та споживання повідомлень. +| `kafkaClusterKafkaExporter` | Використовується для експорту метрик з Kafka кластера. Це дозволяє здійснювати моніторинг та аналіз продуктивності кластера, сприяючи оптимізації його ефективності. +| `kafkaClusterZookeper` | Компонент, що відповідає за координацію та управління станом всередині Kafka кластера. Zookeeper використовується для управління конфігурацією, неймінгом сервісів та синхронізації серед вузлів кластера. +| `kafkaConnectClusterConnect` | Забезпечує інтеграцію Kafka кластера з зовнішніми системами для імпорту та експорту даних. Це дозволяє автоматизувати перенесення даних між Kafka та іншими системами, наприклад, базами даних та іншими потоковими джерелами. +| `kafkaSchemaRegistry` | Зберігає схеми даних, які використовуються у Kafka топіках. Це забезпечує узгодженість формату даних, які передаються між виробниками та споживачами, знижуючи ймовірність помилок у потоковій обробці. +| `kafkaUi` | Графічний інтерфейс користувача для управління Kafka кластером та моніторингу його стану. Цей інструмент забезпечує візуальний огляд кластера, включаючи топіки, споживачів, продуктивність та інші ключові метрики. | `kong` | Сервіс для авторизації та контролю доступу до внутрішніх API-роутів реєстру. Відповідає за управління роутами, запитами та відповідями API. Також контролює пропускну здатність кількості запитів за одиницю часу від клієнтів до кінцевих сервісів (rate-ліміти). -| `redis` | Сервіс для зберігання даних у пам'яті, що часто використовується як кеш або брокер повідомлень. Наприклад, redis зберігає частину даних бізнес-процесів. +| `kongAdminTools` | -- +| `nexus` | Сховище для зберігання згенерованих артефактів реєстру (Nexus) +| `operationalInstance` | Операційна база даних реєстру, що забезпечує зберігання та управління даними, які активно використовуються в робочих процесах. Ця база даних відіграє ключову роль у підтримці операційної ефективності реєстру. +| `operationalPool` | Набір ресурсів, призначений для підтримки операційних потреб реєстру. Це може включати сервери, мережеві ресурси, та інші компоненти інфраструктури, які забезпечують високу доступність, продуктивність та масштабованість для обробки операційних запитів і транзакцій. +| `pgAdmin` | Користувацький інтерфейс для перегляду даних та схеми моделі даних реєстру +| `platformGateway` | Шлюзу міжреєстрової взаємодії +| `processHistoryServiceApi` | Сервіс доступу до історичних даних бізнес-процесів +| `processHistoryServicePersistence` | -- +| `redashAdmin` | Користувацький інтерфейс для створення та налаштування аналітичних звітів та дашбордів (Redash Admin). + +| `redashAdminAdhocworker` | Компонент, призначений для виконання адміністративних завдань на вимогу у Redash. Він обробляє непланові або одноразові запити, такі як генерація специфічних звітів чи виконання користувацьких запитів. + +| `redashAdminRedisMaster` | Відповідає за управління базою даних Redis, яка використовується для кешування та сесій в адміністративному інтерфейсі Redash. Цей компонент забезпечує високу швидкість доступу та ефективність операцій з даними. + +| `redashAdminScheduler` | Планувальник, який керує автоматизованими задачами в Redash Admin, наприклад, регулярним оновленням дашбордів чи звітів. + +| `redashExporter` | Використовується для експорту даних з Redash. Це може включати вивантаження звітів, дашбордів або інших аналітичних даних для подальшої обробки чи зберігання. + +| `redashViewer` | Вебінтерфейс перегляду аналітичної звітності (Redash Viewer). Надає користувачам можливість переглядати дашборди та звіти, створені в Redash Admin. + +| `redashViewerAdhocworker` | Компонент, що обробляє одноразові запити в Redash Viewer. Він забезпечує виконання запитів на перегляд або аналіз даних, які не підлягають регулярному оновленню. + +| `redashViewerRedisMaster` | Керує Redis базою даних для Redash Viewer, оптимізуючи швидкість доступу та обробку даних для користувачів, які переглядають звіти та дашборди. + +| `redashViewerScheduler` | Відповідає за планування та автоматизацію завдань у Redash Viewer, наприклад, регулярне оновлення даних на дашбордах чи у звітах. + +| `redis` | Сервіс для зберігання даних у пам'яті, що часто використовується як кеш або брокер повідомлень. Наприклад, `redis` зберігає частину даних бізнес-процесів. +| `registryRegulationManagement` | Сервіс управління регламентом +| `reloader` | -- +| `reportExporter` | Компонент, призначений для експорту звітів та аналітичних даних із системи. Він дозволяє автоматизувати процес вивантаження даних у різні формати, зокрема PDF, Excel, CSV. Це забезпечує зручність у подальшому аналізі даних, їх презентації чи інтеграції з іншими системами. | `restApi` | Сервіс надає інтерфейси REST (Representational State Transfer), які дозволяють взаємодіяти із системою через HTTP-запити. -| `soapApi` | Сервіс надає SOAP (Simple Object Access Protocol) інтерфейси для обміну структурованою інформацією у рамках вебсервісів. | `sentinel` | Сервіс відповідає за моніторинг та сповіщення безпеки на Платформі. +| `soapApi` | Сервіс надає SOAP (Simple Object Access Protocol) інтерфейси для обміну структурованою інформацією у рамках вебсервісів. | `userProcessManagement` | Сервіс відповідає за управління процесами, пов'язаними з користувачами, включаючи створення, відстеження та управління процесами користувачів. +| `userSettingsServiceApi` | Опис для `userSettingsServiceApi`. | `userTaskManagement` | Сервіс відповідає за управління задачами користувачів, включаючи створення, відстеження та управління задачами користувачів. -| `Crunchy Postgres` | Це дистрибутив PostgreSQL, оптимізований для високої доступності та безпеки. Цей сервіс забезпечує зберігання даних у базі даних PostgreSQL. +| `wiremock` | Сервіс, призначений для симуляції API зовнішніх систем. Він дозволяє розробникам імітувати поведінку вебсервісів та API в тестовому середовищі, що спрощує процес тестування та розробки. |=== [#configure-resources] @@ -36,89 +113,188 @@ TIP: Керування ресурсами доступне як при розг Принцип налаштування ресурсів для усіх сервісів є однаковим, за винятком `Crunchy Postgres`, `restApi` та `kafkaApi` для яких також передбачені додаткові специфічні параметри, описані у розділі xref:#data-services-resources[]. ==== -. Оберіть зі списку сервіс для конфігурації ресурсів і натисніть *`+`* (`Додати`). +. Додайте зі списку сервіс для конфігурації ресурсів. Розглянемо приклад із налаштуваннями для BPMS. + [CAUTION] ==== -Під час розгортання реєстру усі наявні сервіси налаштовані та передзаповнені відповідними значеннями запитів, лімітів та змінних оточення за замовчуванням. +Під час розгортання реєстру усі наявні сервіси налаштовані та передзаповнені відповідними значеннями кількості реплік, запитів, лімітів та змінних оточення за замовчуванням. Навіть у випадку видалення сервісів зі списку, під час розгортання реєстру Платформа застосує стандартну конфігурацію. ==== -+ -image:admin:registry-management/registry-create/cp-create-registry-7.png[] -. Встановіть власні значення для ресурсів. +. Встановіть власні значення для ресурсів (_див. опис нижче_). -Istio sidecar :: -*Sidecar* -- це додатковий контейнер, який запускається поряд з основним контейнером у поді OpenShift. *Istio* використовує підхід *sidecar* для внесення змін у мережеві налаштування без необхідності зміни самого додатку. +[replicas-amount] +=== Кількість реплік (Replicas Amount) -* Активуйте параметр *Enabled*. + -Цей параметр вказує, чи включено використання sidecar Istio для цього конкретного сервісу. +*Кількість реплік* (*Replicas Amount*) -- це параметр, який вказує на число копій (або реплік) певного сервісу. Це ключовий компонент горизонтального масштабування, оскільки дозволяє системі розподіляти навантаження та забезпечувати високу доступність. -* Налаштуйте параметри *Requests* i *Limits*. -+ -Ці параметри вказують на оптимальні (*Requests*) та максимальні (*Limits*) ресурси, які мають бути виділені для Istio sidecar. -+ -*Requests* -- це мінімум ресурсів, які OpenShift гарантує для контейнера. У нашому прикладі -- це `350m` CPU і `128Mi` пам'яті для Istio sidecar. Якщо контейнер потребує більше ресурсів, і якщо ці додаткові ресурси доступні, OpenShift зможе їх надати. -+ -*Limits* -- це максимум ресурсів, які OpenShift дозволить контейнеру використовувати. У нашому прикладі -- це `350m` CPU, `128Mi` пам'яті для Istio sidecar. Якщо контейнер спробує використати більше ресурсів, він може бути примусово зупинений або переведений на нижчий пріоритет у черзі розкладу розгортання подів на нодах. +NOTE: За замовчуванням встановлюється одна репліка, але це число може бути збільшене залежно від потреб системи та доступних ресурсів. -Container :: -*Container* -- основний контейнер із додатком. +Основні цілі використання кількості реплік: :: -* Налаштуйте параметри *Requests* i *Limits*. -+ -Ці параметри вказують на оптимальні (*Requests*) та максимальні (*Limits*) ресурси, які мають бути виділені для основного контейнера. -+ -*Requests* -- це мінімум ресурсів, які OpenShift гарантує для контейнера. У нашому прикладі -- це `1` CPU, `2Gi` пам'яті для основного контейнера. Якщо контейнер потребує більше ресурсів, і якщо ці додаткові ресурси доступні, OpenShift може їх надати. -+ -*Limits* -- це максимум ресурсів, які OpenShift дозволить контейнеру використовувати. У нашому прикладі -- це `1` CPU, `2Gi` пам'яті для основного контейнера. Якщо контейнер спробує використати більше ресурсів, він може бути примусово зупинений або переведений на нижчий пріоритет у черзі розкладу розгортання подів на нодах. +. *Підвищення доступності*: репліки забезпечують високу доступність сервісу чи додатку. Якщо одна з реплік зазнає збою або стає недоступною, інші репліки можуть продовжувати обслуговувати запити, зменшуючи ризик відмови системи. + +. *Розподіл навантаження*: з декількома репліками, запити можуть бути розподілені між ними, що допомагає уникнути перевантаження одного сервера або вузла. Це покращує загальну продуктивність системи. + +. *Горизонтальне масштабування*: реплікація є основою для горизонтального масштабування, де ви можете збільшити кількість реплік, щоб впоратися зі збільшеним обсягом запитів або навантаження на систему. + +. *Надійність та стійкість*: у випадку непередбачених збоїв або планового обслуговування, наявність декількох реплік забезпечує неперервність роботи системи. -* +++Змінні оточення+++ (або *environment variables*) -- це динамічні назви значень, що зберігаються в системі й можуть використовуватися різними програмами. Вони особливо корисні в контейнеризованих та розподілених середовищах, таких як Платформа реєстрів, де кожен контейнер або под може мати свої власні змінні оточення. Це дає змогу керувати конфігурацією та поведінкою кожного контейнера або пода індивідуально. -+ -Змінна `JAVA_OPTS` використовується для налаштування параметрів JVM (Java Virtual Machine). + +image:admin:registry-management/registry-resources/registry-resources-5.png[] + +[container-limits] +=== Ліміти контейнерів (Container Limits) + +*Основний контейнер* (`container`) є ключовою частиною додатка в середовищі контейнеризації. Нижче наведені параметри для налаштування мінімальних (`Requests`) та максимальних (`Limits`) лімітів ресурсів, що мають бути виділені для основного контейнера. + +* *Requests* -- якщо контейнер потребує більше ресурсів, і якщо ці додаткові ресурси доступні, OpenShift може їх надати. + +* *Limits* -- Якщо контейнер спробує використати більше ресурсів за встановлене значення, він може бути примусово зупинений або переведений на нижчий пріоритет у черзі розкладу розгортання подів на нодах. + +.Ліміти CPU та Memory для основного контейнера +[options="header",cols="20%,10%,70%"] +|=== +| Параметр | Значення за замовчуванням | Опис + +| *CPU Requests* +| `1` +| Мінімальна кількість ресурсів CPU, яку OpenShift гарантує контейнеру. Значення `1` означає одне повне CPU ядро. Якщо вказати, наприклад, значення `100m` -- це означатиме 100 millicores, або 10% одного ядра CPU тощо. + +| *CPU Limits* +| `1` +| Максимальний обсяг ресурсів CPU, який OpenShift дозволяє використовувати контейнеру. Значення `1` означає одне повне CPU ядро. Якщо вказати, наприклад, значення `100m` -- це означатиме 100 millicores, або 10% одного ядра CPU тощо. + +| *Memory Requests* +| `2Gi` +| Мінімальний обсяг пам'яті, який OpenShift гарантує контейнеру. Значення `2Gi` означає 2 гібібайти. Якщо вказати, наприклад, значення `400Mi` -- це означатиме 400 мебібайтів тощо. + +| *Memory Limits* +| `2Gi` +| Максимальний обсяг пам'яті, який OpenShift дозволяє використовувати контейнеру. Значення `2Gi` означає 2 гібібайти. Якщо вказати, наприклад, значення `400Mi` -- це означатиме 400 мебібайтів тощо. + +|=== + +NOTE: Гібібайт (GiB) і гігабайт (GB) це різні одиниці вимірювання. 1 гібібайт (1 GiB) дорівнює приблизно 1.074 гігабайтам. + +image:admin:registry-management/registry-resources/registry-resources-6.png[] + +[istio-sidecar] +=== Ліміти Istio Sidecar + +*Istio Sidecar* -- це додатковий контейнер, що запускається поряд з основним контейнером у поді OpenShift. Istio використовує підхід _sidecar_ для внесення змін до мережевих налаштувань без необхідності зміни самого додатку. Налаштування лімітів ресурсів для Istio sidecar допомагає управляти використанням ресурсів і забезпечувати стабільність системи. + +NOTE: *Istio Sidecar* є опційним параметром. Активуйте його за потреби та встановіть необхідну конфігурацію. + +* *Requests* -- якщо контейнер потребує більше ресурсів, і якщо ці додаткові ресурси доступні, OpenShift може їх надати. + +* *Limits* -- Якщо контейнер спробує використати більше ресурсів за встановлене значення, він може бути примусово зупинений або переведений на нижчий пріоритет у черзі розкладу розгортання подів на нодах. + +.Ліміти CPU та Memory для Istio Sidecar +[options="header",cols="20%,10%,70%"] +|=== +| Параметр | Значення за замовчуванням | Опис + +| *CPU Requests* +| `350m` +| Мінімальна кількість ресурсів CPU, яку OpenShift гарантує Istio Sidecar. Значення `350m` означає 350 millicores, або приблизно 35% одного ядра CPU. + +| *CPU Limits* +| `350m` +| Максимальний обсяг ресурсів CPU, який OpenShift дозволяє використовувати Istio Sidecar. Значення `350m` також означає 350 millicores, обмежуючи використання ресурсів до 35% одного ядра CPU. + +| *Memory Requests* +| `128Mi` +| Мінімальний обсяг пам'яті, який OpenShift гарантує Istio Sidecar. Значення `128Mi` означає 128 мебібайтів. + +| *Memory Limits* +| `128Mi` +| Максимальний обсяг пам'яті, який OpenShift дозволяє використовувати Istio Sidecar. Значення `128Mi` також означає 128 мебібайтів, обмежуючи використання пам'яті до цієї кількості. + +|=== + +NOTE: Гібібайт (GiB) і гігабайт (GB) це різні одиниці вимірювання. 1 гібібайт (1 GiB) дорівнює приблизно 1.074 гігабайтам. + +image:admin:registry-management/registry-resources/registry-resources-7.png[] + +[env-variables] +=== Змінні оточення + +*Змінні оточення* (або *environment variables*) -- це динамічні назви значень, що зберігаються в системі й можуть використовуватися різними програмами. Вони особливо корисні в контейнеризованих та розподілених середовищах, таких як Платформа реєстрів, де кожен контейнер або под може мати свої власні змінні оточення. Це дає змогу керувати конфігурацією та поведінкою кожного контейнера або пода індивідуально. + +Наприклад, змінна `JAVA_OPTS` часто встановлена за замовчуванням для різних компонентів і використовується для налаштування параметрів JVM (Java Virtual Machine). + У цьому випадку, вказані параметри `-Xms1536m` і `-Xmx1536m` встановлюють мінімальний (`-Xms`) та максимальний (`-Xmx`) розмір пам'яті, який JVM може використовувати. -+ -TIP: Ви можете прибрати змінні оточення з налаштувань, натиснувши на кнопку *`-`*. -. Натисніть `+++Далі+++`, якщо це крок розгортання реєстру, або `+++Підтвердити+++`, якщо це оновлення конфігурації. -+ -image:admin:registry-management/registry-create/cp-create-registry-7-2.png[] -+ -При редагуванні реєстру буде сформовано запит на оновлення зі статусом `Новий`. +TIP: Ви можете прибрати змінні оточення з налаштувань, натиснувши хрестик (*`х`*). -[start=4] -. Поверніться до розділу +++Реєстри+++, прокрутіть бігунок униз сторінки та знайдіть секцію +++Запити на оновлення+++. -+ -image:registry-management/cp-submit-mr/cp-submit-mr-1.png[] +image:admin:registry-management/registry-resources/registry-resources-8.png[] -. Відкрийте сформований запит, натиснувши іконку перегляду -- 👁. -+ -NOTE: Запропоновані зміни вносяться до конфігурації файлу _deploy-templates/values.yaml_ у разі підтвердження. -. У новому вікні зіставте 2 версії змін, переконайтеся, що внесені вами дані вірні, та натисніть `+++Підтвердити+++`. -+ -image:admin:registry-management/registry-create/cp-create-registry-7-3.png[] +Натисніть *`Далі`*, якщо це крок розгортання реєстру, або *`Підтвердити`*, якщо це оновлення конфігурації. -[data-services-resources] [#data-services-resources] -=== Окремі налаштування сервісів по роботі з даними +== Окремі налаштування сервісів по роботі з даними Деякі сервіси Фабрики даних окрім типових налаштувань, описаних у розділі xref:#configure-resources[], дозволяють конфігурувати також і специфічні, зокрема такими є: Crunchy Postgres :: Відповідає за зберігання даних у вигляді реляційної бази даних. Дозволяє налаштувати такі ресурси: ++ +.Конфігурація ресурсів для Crunchy Postgres +[options="header",cols="25%,20%,55%"] +|=== +| Параметр | Значення за замовчуванням | Опис + +| *Max Connections* +| `200` +| Вказує на максимальну кількість одночасних з'єднань, які Crunchy Postgres може підтримувати. Наприклад, якщо ви вкажете значення `200`, то не більше 200 користувачів або процесів можуть мати відкрите з'єднання із базою даних одночасно. + +| *Storage Size* +| `10Gi` +a| +Вказує на розмір сховища даних, виділеного для Crunchy Postgres. Наприклад, якщо ви вкажете значення `10Gi`, Crunchy Postgres матиме 10 гібібайтів місця для зберігання даних. -* *Max Connections*: вказує на максимальну кількість одночасних з'єднань, які Crunchy Postgres може підтримувати. Тобто, якщо ви вкажете значення `200`, то не більше 200 користувачів або процесів можуть мати відкрите з'єднання із базою даних одночасно. +NOTE: Гібібайт (GiB) і гігабайт (GB) це різні одиниці вимірювання. 1 гібібайт (1 GiB) дорівнює приблизно 1.074 гігабайтам. -* *Storage Size*: вказує на розмір сховища даних, виділеного для Crunchy Postgres. Тобто якщо ви вкажете значення 10Gi, Crunchy Postgres матиме 10 гігабайтів місця для зберігання даних. +|=== + ++ +image:admin:registry-management/registry-resources/registry-resources-4.png[] kafkaApi :: + Сервіс для обробки потокових даних у реальному часі. include::partial$templates/snippets/registry-resources-ua.adoc[] restApi :: Сервіс надає інтерфейси REST (Representational State Transfer), які дозволяють взаємодіяти із системою через HTTP-запити. -include::partial$templates/snippets/registry-resources-ua.adoc[] \ No newline at end of file +include::partial$templates/snippets/registry-resources-ua.adoc[] + +== Застосування та розгортання змін до конфігурації + +При редагуванні реєстру, в результаті виконаних вище налаштувань, буде сформовано запит на оновлення зі статусом `Новий`. + +. Поверніться до розділу *Реєстри*, прокрутіть бігунок униз сторінки та знайдіть секцію *Запити на оновлення*. ++ +image:registry-management/cp-submit-mr/cp-submit-mr-1.png[] + +. Відкрийте сформований запит, натиснувши іконку перегляду -- 👁. ++ +NOTE: Запропоновані зміни вносяться до конфігурації файлу _deploy-templates/values.yaml_ у разі підтвердження. + +. У новому вікні зіставте 2 версії змін, переконайтеся, що внесені вами дані вірні, та натисніть *`Підтвердити`*. ++ +image:admin:registry-management/registry-create/cp-create-registry-7-3.png[] + +. В результаті запуститься пайплайн розгортання конфігурації реєстру -- *MASTER-Build-``*, де `` -- назва реєстру. Зачекайте кілька хвилин, доки пройде збірка. Після цього компоненти отримають встановлену кількість ресурсів. + +== Пов'язані сторінки + +Ознайомтеся з цими ресурсами для отримання додаткової інформації та поглиблення вашого розуміння: + +* xref:arch:architecture/platform/administrative/control-plane/configuration-structure/registry-configuration-structure.adoc[] +* xref:admin:registry-management/control-plane-create-registry.adoc#vm-params[Параметри віртуальних машин] +* xref:arch:architecture/platform-system-requirements/registry-requirements.adoc[] \ No newline at end of file diff --git a/docs/ua/modules/admin/pages/registry-management/control-plane-submit-mr.adoc b/docs/ua/modules/admin/pages/registry-management/control-plane-submit-mr.adoc index fcce1db6bd..e660f09c8d 100644 --- a/docs/ua/modules/admin/pages/registry-management/control-plane-submit-mr.adoc +++ b/docs/ua/modules/admin/pages/registry-management/control-plane-submit-mr.adoc @@ -1,4 +1,7 @@ = Підтвердження запитів на внесення змін до реєстру +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] Адміністративна панель Control Plane дозволяє підтверджувати запити на внесення змін до конфігурації реєстру в Gerrit, тобто виконувати `git merge` до репозиторію, не виходячи за межі Control Plane. @@ -23,10 +26,9 @@ image:admin:infrastructure/cluster-mgmt/change-key/change-key-02.png[] ==== Детальніше про додавання адміністраторів платформи та реєстру ви можете переглянути за посиланнями: -* xref:admin:registry-management/control-plane-assign-platform-admins.adoc#add-platform-admin-cp[Призначення адміністраторів платформи] -* xref:admin:registry-management/control-plane-create-registry.adoc#add-registry-admin[Призначення адміністраторів реєстру] +* xref:admin:registry-management/control-plane-assign-platform-admins.adoc[] +* xref:registry-develop:registry-admin/create-users/create-registry-admins.adoc[] ==== - + image:registry-management/cp-submit-mr/cp-add-registry-admin-1.png[] + diff --git a/docs/ua/modules/admin/pages/registry-management/custom-dns/cp-custom-dns-keycloak.adoc b/docs/ua/modules/admin/pages/registry-management/custom-dns/cp-custom-dns-keycloak.adoc index 9c3644ab78..1d640d5166 100644 --- a/docs/ua/modules/admin/pages/registry-management/custom-dns/cp-custom-dns-keycloak.adoc +++ b/docs/ua/modules/admin/pages/registry-management/custom-dns/cp-custom-dns-keycloak.adoc @@ -1,23 +1,7 @@ -:toc-title: ЗМІСТ -:toc: auto -:toclevels: 5 -:experimental: -:important-caption: ВАЖЛИВО -:note-caption: ПРИМІТКА -:tip-caption: ПІДКАЗКА -:warning-caption: ПОПЕРЕДЖЕННЯ -:caution-caption: УВАГА -:example-caption: Приклад -:figure-caption: Зображення -:table-caption: Таблиця -:appendix-caption: Додаток -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Налаштування власного DNS-імені для Keycloak +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Загальний опис @@ -153,15 +137,13 @@ www.example.net. CNAME www.example.com. `CNAME` не може бути встановлений для *apex*-доменів (example.com), а піддомен повинен бути вказаний (www.example.com). ==== -. Напишіть у Telegram-каналі `[EPAM] IIT Digital Signature Library Questions`, щоб додати нову адресу до тестового віджету link:https://eu.iit.com.ua/[eu.iit.com.ua]. -+ - +. Зверніться до _служби підтримки технічного адміністратора інстансу Платформи_ через Ваш канал та залиште запит на додавання нової адреси до тестового віджета https://eu.iit.com.ua/[eu.iit.com.ua] + -- -Кабінет посадової особи та отримувача послуг стає доступний за налаштованими DNS-іменами після додаткової (ручної) зовнішньої конфігурації адміністратором. +Нове DNS-ім'я Keycloak стає доступним після активації додаткової зовнішньої конфігурації. [CAUTION] -Зазвичай оновлення DNS-імен відбувається впродовж однієї години, хоча глобальне оновлення може тривати до 48 годин. +Зазвичай оновлення DNS-імен відбувається впродовж однієї години, хоча глобальне оновлення може тривати до 48 годин, а в окремих випадках до 72-х годин. -- == Застосування змін до конфігурації @@ -221,4 +203,4 @@ registry-kv/registry//domains// key:caCertificate value: key:certificate value: key:key value: ----- \ No newline at end of file +---- diff --git a/docs/ua/modules/admin/pages/registry-management/custom-dns/cp-custom-dns-portals.adoc b/docs/ua/modules/admin/pages/registry-management/custom-dns/cp-custom-dns-portals.adoc index 617435ce0e..c77373fccc 100644 --- a/docs/ua/modules/admin/pages/registry-management/custom-dns/cp-custom-dns-portals.adoc +++ b/docs/ua/modules/admin/pages/registry-management/custom-dns/cp-custom-dns-portals.adoc @@ -52,7 +52,7 @@ global: === Обрання реєстру та перехід до налаштувань [arabic] -. Увійдіть до адміністративної панелі керування платформою та реєстрами *Control Plane*, використовуючи попередньо отримані логін та пароль. +. Увійдіть до адміністративної панелі керування Платформою та реєстрами *Control Plane*, використовуючи попередньо отримані логін та пароль. + image:admin:infrastructure/cluster-mgmt/update-cluster-mgmt-01.png[] @@ -145,15 +145,12 @@ www.example.net. CNAME www.example.com. `CNAME` не може бути встановлений для *apex*-доменів (example.com), а піддомен повинен бути вказаний (www.example.com). ==== -. Напишіть у Telegram-каналі `[EPAM] IIT Digital Signature Library Questions`, щоб додати нову адресу до тестового віджету link:https://eu.iit.com.ua/[eu.iit.com.ua]. -+ +. Зверніться до _служби підтримки технічного адміністратора інстансу Платформи_ через Ваш канал та залиште запит на додавання нової адреси до тестового віджета https://eu.iit.com.ua/[eu.iit.com.ua] + -- Кабінет посадової особи та отримувача послуг стає доступний за налаштованими DNS-іменами після додаткової (ручної) зовнішньої конфігурації адміністратором. [CAUTION] -Зазвичай оновлення DNS-імен відбувається впродовж однієї години, хоча глобальне оновлення може тривати до 48 годин. +Зазвичай оновлення DNS-імен відбувається впродовж однієї години, хоча глобальне оновлення може тривати до 48 годин, а в окремих випадках до 72-х годин. -- - -//TODO додати аналогічний опис до інструкції xref:admin:registry-management/control-plane-create-registry.adoc[Розгортання екземпляру реєстру] \ No newline at end of file diff --git a/docs/ua/modules/admin/pages/registry-management/platform/platform-management-quick-links.adoc b/docs/ua/modules/admin/pages/registry-management/platform/platform-management-quick-links.adoc new file mode 100644 index 0000000000..fa06c2cb26 --- /dev/null +++ b/docs/ua/modules/admin/pages/registry-management/platform/platform-management-quick-links.adoc @@ -0,0 +1,314 @@ += Швидкі посилання до адміністративних ресурсів Платформи +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +== Загальний опис + +Адміністративна панель *Control Plane* надає адміністраторам Платформи зручний спосіб доступу до ключових адміністративних ресурсів в одному місці. У цій статті ми розглянемо основні аспекти цієї функціональності. + +При переході у розділ *Керування Платформою*, ви побачите вкладку *Швидкі посилання*. Тут представлені посилання до вебінтерфейсів різних адміністративних та операційних ресурсів із коротким описом їх призначення. + +image:admin:infrastructure/cluster-mgmt/quick-links/platform-management-quick-links-1.png[] + +[NOTE] +==== +Щоб дізнатися більше про кожен сервіс, перейдіть до відповідного розділу документації, використовуючи пошук за англійською назвою сервісу, яка вказана у заголовку посилання. +==== + +== Класифікація сервісів за групами + +Сервіси розділені на три групи: :: ++ +//Адміністративна зона платформи +* xref:#platform-admin-zone[] +//Операційна зона платформи +* xref:#platform-operational-zone[] + +* xref:#central-components[] + +Групи розташовані в порядку від найчастіше використовуваних до найменш використовуваних, а посилання всередині груп також впорядковані за частотою використання від більшого до меншого. + +[#platform-admin-zone] +=== Адміністративна зона Платформи + +image:admin:infrastructure/cluster-mgmt/quick-links/platform-management-quick-links-2.png[] + +.Сервіси адміністративної зони Платформи +[options="header", cols="10%,10%,40%,30%,10%"] +|=== +|Логотип |Назва сервісу |Призначення | Шаблон посилання |Посилання на демо-реєстр + +|image:infrastructure/cluster-mgmt/quick-links/logos/openshift-logo.svg[width=50,height=auto] + +|*OpenShift Console*: Вебінтерфейс управління кластером + +|Інтерфейс користувача, доступний із веббраузера. Адміністратори Платформи можуть використовувати OpenShift вебконсоль для візуалізації, перегляду та керування вмістом або ресурсами OpenShift кластера, Платформи та реєстрів. + +a| +---- +https://console-openshift-console. +---- + +* `` -- визначає домен та піддомени середовища. + +*Наприклад:* + +https://console-openshift-console.example.com + +| +include::platform:ROOT:partial$templates/links/platform/administrative/openshift.adoc[] + +|image:infrastructure/cluster-mgmt/quick-links/logos/gerrit-logo.svg[width=50,height=auto] + +|*Gerrit*: Сервіс інспекції та зберігання змін конфігурації + +|Програмний інструмент, що дозволяє керувати версіями компонентів та конфігурацій. Тісно інтегрований з розподіленою системою контролю версій Git та з допомогою цього інструменту адміністратори Платформи мають можливість переглядати всі модифікації коду та конфігурацій за допомогою веббраузер і затверджувати або відхиляти ці зміни. + +a| +---- +https://gerrit-control-plane-platform-main. +---- + +* `` -- визначає домен та піддомени середовища. + +*Наприклад:* + +https://gerrit-control-plane-platform-main.example.com + +| +include::platform:ROOT:partial$templates/links/platform/administrative/gerrit.adoc[] + +|image:infrastructure/cluster-mgmt/quick-links/logos/jenkins-logo.svg[width=50,height=auto] + +|*Jenkins*: Сервіс розгортання конфігурації + +|Програмний комплекс, що забезпечує автоматизацію в життєвому циклі Платформи та Реєстрів. Виконує фактичне розгортання Реєстру, конфігурування, оновлення та безліч інших автоматизованих задач на Платформі. + +a| +---- +https://jenkins-control-plane-platform-main. +---- + +* `` -- визначає домен та піддомени середовища. + +*Наприклад:* + +https://jenkins-control-plane-platform-main.example.com + +| +include::platform:ROOT:partial$templates/links/platform/administrative/jenkins.adoc[] + +|image:infrastructure/cluster-mgmt/quick-links/logos/nexus-logo.svg[width=50,height=auto] + +|*Nexus*: Сховище артефактів Платформи + +|Центральне сховище артефактів, компонентів та їх залежностей, з яких складається кожна окрема підсистема та Платформа в цілому. Збереження артефактів Платформи. + +a| +---- +https://nexus-control-plane-platform-main. +---- + +* `` -- визначає домен та піддомени середовища. + +*Наприклад:* + +https://nexus-control-plane-platform-main.example.com + +| +include::platform:ROOT:partial$templates/links/platform/administrative/nexus.adoc[] + +|=== + + + + + + + + + + + + + +[#platform-operational-zone] +=== Операційна зона Платформи + +image:admin:infrastructure/cluster-mgmt/quick-links/platform-management-quick-links-3.png[] + +.Сервіси операційної зони Платформи +[options="header", cols="10%,10%,40%,30%,10%"] +|=== +|Логотип |Назва сервісу |Призначення | Шаблон посилання |Посилання на демо-реєстр + +|image:infrastructure/cluster-mgmt/quick-links/logos/keycloak-logo.svg[width=50,height=auto] + +|*Keycloak*: Сервіс управління користувачами та ролями +|Аутентифікація та авторизація користувачів. + +a| +---- +https://platform-keycloak./auth +---- + +* `` -- визначає домен та піддомени середовища. +* `/auth` -- ендпоінт сторінки автентифікації сервісу Keycloak + +*Наприклад:* + +https://platform-keycloak.example.com/auth + +| +include::platform:ROOT:partial$templates/links/platform/operational/keycloak.adoc[] + +|image:infrastructure/cluster-mgmt/quick-links/logos/kibana-logo.svg[width=50,height=auto] + +|*Kibana*: Вебінтерфейс перегляду журналу подій Платформи + +|Доступ та відображення логів на Платформі. + +a| +---- +https://kibana-openshift-logging. +---- + +* `` -- визначає домен та піддомени середовища. + +*Наприклад:* + +https://kibana-openshift-logging.example.com + +| +include::platform:ROOT:partial$templates/links/platform/operational/kibana.adoc[] + +|image:infrastructure/cluster-mgmt/quick-links/logos/grafana-logo.svg[width=50,height=auto] + +|*Grafana*: Вебінтерфейс моніторингу Платформи + +|Візуалізація та надання доступу до даних моніторингу. + +a| +---- +https://grafana-grafana-monitoring./login +---- + +* `` -- визначає домен та піддомени середовища. +* `/login` -- ендпоінт, який приводить до сторінки входу у сервіс. + +*Наприклад:* + +https://grafana-grafana-monitoring.example.com/login + +| +include::platform:ROOT:partial$templates/links/platform/operational/grafana.adoc[] + +|image:infrastructure/cluster-mgmt/quick-links/logos/kiali-logo.svg[width=50,height=auto] + +|*Service Mesh (Kiali)*: Вебінтерфейс управління та моніторингу + +|Компонент, що забезпечує адміністраторів Платформи та реєстрів можливістю налаштовувати та аналізувати стан компонентів `service-mesh` Платформи та реєстрів, здійснювати моніторинг компонентів що входять в `service-mesh` в реальному часі та швидко виявляти проблеми в мережі. + +a| +---- +https://kiali-istio-system. +---- + +* `` -- визначає домен та піддомени середовища. + +*Наприклад:* + +https://kiali-istio-system.example.com + +| +include::platform:ROOT:partial$templates/links/platform/operational/kiali.adoc[] + +|image:infrastructure/cluster-mgmt/quick-links/logos/jaeger-logo.svg[width=50,height=auto] + +|*Jaeger*: Вебінтерфейс моніторингу та трасування запитів + +|Сервіс, що використовується для моніторингу запитів та аналізу несправностей розподілених систем на основі мікросервісів. Дозволяє виконати аналіз залежностей компонента, аналіз несправностей, моніторинг транзакцій та оптимізацію продуктивності роботи Платформи. + +a| +---- +https://jaeger-istio-system. +---- + +* `` -- визначає домен та піддомени середовища. + +*Наприклад:* + +https://jaeger-istio-system.example.com + +| +include::platform:ROOT:partial$templates/links/platform/operational/jaeger.adoc[] + +|image:infrastructure/cluster-mgmt/quick-links/logos/vault-logo.svg[width=50,height=auto] + +|*Hashicorp Vault*: Сервіс управління секретами та шифруванням +|Інструмент для безпечного управління секретами та захисту доступу до конфіденційної інформації в обчислювальних середовищах. + +a| +---- +https://hashicorp-vault-user-management. +---- + +* `` -- визначає домен та піддомени середовища. + +*Наприклад:* + +https://hashicorp-vault-user-management.example.com + +| +include::platform:ROOT:partial$templates/links/platform/operational/hashicorp-vault.adoc[] + +|=== + +[#central-components] +=== Центральні компоненти + +image:admin:infrastructure/cluster-mgmt/quick-links/platform-management-quick-links-4.png[] + +.Центральні компоненти Платформи +[options="header", cols="10%,10%,40%,30%,10%"] +|=== +|Логотип |Назва сервісу |Призначення | Шаблон посилання |Посилання на демо-реєстр + +|image:infrastructure/cluster-mgmt/quick-links/logos/vault-logo.svg[width=50,height=auto] +|*Platform Vault*: Центральний сервіс управління секретами Платформи +|Забезпечення операції Auto unseal для підсистем управління секретами та шифруванням. + +a| +---- +https://platform-vault. +---- + +* `` -- визначає домен та піддомени середовища. + +*Наприклад:* + +https://platform-vault.example.com + +| +include::platform:ROOT:partial$templates/links/platform/central/platform-vault.adoc[] + +|image:infrastructure/cluster-mgmt/quick-links/logos/minio-logo.svg[width=50,height=auto] + +|*Minio*: Сховище резервних копій Платформи +|S3-сумісне сховище даних, що забезпечує надійне та масштабоване сховище резервних копій Платформи та реєстрів. + +a| +---- +https://platform-minio-ui. +---- + +* `` -- визначає домен та піддомени середовища. + +*Наприклад:* + +https://platform-minio-ui.example.com + +| +include::platform:ROOT:partial$templates/links/platform/central/minio.adoc[] + +|=== + diff --git a/docs/ua/modules/admin/pages/registry-management/system-keys/control-plane-platform-certificates.adoc b/docs/ua/modules/admin/pages/registry-management/system-keys/control-plane-platform-certificates.adoc new file mode 100644 index 0000000000..de7e6a98f4 --- /dev/null +++ b/docs/ua/modules/admin/pages/registry-management/system-keys/control-plane-platform-certificates.adoc @@ -0,0 +1,90 @@ += Налаштування сертифікатів для перевірки ключів цифрового підпису Платформи +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] + + +== Загальний опис + +[.underline]#_Сертифікати для перевірки ключів цифрового підпису_# слугують для підтвердження автентичності публічного ключа, який використовується в процесі цифрового підписання. Їх випускає довірена організація, відома як _Акредитований Центр Сертифікації Ключів (АЦСК)_, і вони відіграють важливу роль у створенні довіри до електронних документів та транзакцій. + +[.underline]#_Ключі системного підпису_# призначені для підписання та перевірки даних системами або програмами. Іншими словами, вони допомагають гарантувати, що відповідний пакет даних чи програмне забезпечення походить від відомого джерела і не було змінено. + +[.underline]#_КЕП (Кваліфікований електронний підпис)_# -- це покращена версія ЕЦП (Електронний цифровий підпис). Він забезпечує вищий рівень безпеки та довіри, адже для його створення використовуються більш надійні криптографічні алгоритми та процедури. КЕП часто має правову силу і дозволяє підтверджувати автентичність електронних документів в юридичних ситуаціях. + +*_CACertificates.p7b_* та *_CA.json_*: :: + +* *_CACertificates.p7b_*: цей файл містить один або декілька сертифікатів у форматі `PKCS#7`. Формат `PKCS#7` широко використовується для обміну та зберігання сертифікатів або цілого ланцюжка сертифікатів. + +* *_CA.json_*: це файл у форматі JSON, який може містити деталі про сертифікати. Формат JSON інформацію про сертифікати у форматі JSON, який легко читається людиною та машиною. + ++ +Платформа надає широкі можливості для управління сертифікатами: забезпечує їх безпечне _завантаження_, _зберігання_, _використання_ та _оновлення_. + +== Додавання сертифікатів + +NOTE: Сертифікати АЦСК для перевірки ключів системного підпису, внесені у секції +++Дані для перевірки підписів+++, будуть застосовані до налаштувань Платформи. + +Щоб додати сертифікати АЦСК, виконайте наступні кроки: + +. Увійдіть до адміністративної панелі керування Платформою *Control Plane*, використовуючи попередньо отримані логін та пароль. ++ +image:admin:infrastructure/cluster-mgmt/update-cluster-mgmt-01.png[] + +. Відкрийте меню +++Керування Платформою+++. + +. У правому верхньому куті сторінки натисніть `+++Редагувати+++`. ++ +image:admin:infrastructure/cluster-mgmt/update-cluster-mgmt-1.png[] + +. Перейдіть до секції +++Дані для перевірки підписів+++. ++ +image:admin:infrastructure/cluster-mgmt/cp-platform-certificates/01-platform-certificates.png[] + +. Додайте публічні сертифікати АЦСК (*_CACertificates.p7b_*). + +.. Додайте список сертифікатів сумісних ЦСК (link:https://iit.com.ua/download/productfiles/CACertificates.p7b[CACertificates.p7b]), який можна отримати на сайті АТ "ІІТ" за посиланням https://iit.com.ua/downloads. + +.. Додайте файл сертифіката, натиснувши кнопку `+++Обрати файл+++` у полі у полі +++Публічні сертифікати АЦСК (розширення .p7b)+++. У новому вікні перейдіть до теки, де зберігається файл сертифіката, оберіть його і натисніть kbd:[Відкрити]. ++ +image:admin:infrastructure/cluster-mgmt/cp-platform-certificates/02-platform-certificates.png[] + +. Додайте перелік АЦСК (*_CA.json_*). + +.. Додайте параметри взаємодії із сумісними ЦСК (link:https://iit.com.ua/download/productfiles/CAs.json[CAs.json]). Файл можна отримати на сайті АТ "ІІТ" за посиланням https://iit.com.ua/downloads. + +.. Додайте файл сертифіката, натиснувши кнопку `+++Обрати файл+++` у полі +++Перелік АЦСК (розширення .json)+++. У новому вікні перейдіть до теки, де зберігається файл з параметрами, оберіть його і натисніть kbd:[Відкрити]. ++ +image:admin:infrastructure/cluster-mgmt/cp-platform-certificates/03-platform-certificates.png[] + +. На завершення перевірте внесену інформацію і натисніть кнопку `+++Підтвердити+++`. ++ +[NOTE] +==== +У результаті оновлення даних про ключ на інтерфейсі Control Plane, створюється новий запит на оновлення конфігурації *`cluster-mgmt`*, який необхідно підтвердити. +==== + +. В інтерфейсі адмін-панелі Control Plane поверніться до розділу +++Керування Платформою+++, прокрутіть бігунок униз сторінки та знайдіть секцію +++Запити на оновлення+++. Знайдіть потрібний запит та натисніть іконку перегляду 👁. ++ +image::admin:infrastructure/cluster-mgmt/change-key/change-key-41.png[] + +. Відкрийте сформований запит, натиснувши іконку перегляду -- 👁. +. Прокрутіть донизу та натисніть кнопку `+++Підтвердити+++`. ++ +image:admin:infrastructure/cluster-mgmt/cp-registry-certificates/04-registry-certificates.png[] + ++ +NOTE: Запропоновані зміни вносяться до конфігурації файлу _deploy-templates/values.yaml_ компонента *`cluster-mgmt`* у разі підтвердження. ++ +Далі відбувається автоматичний запуск пайплайну *`Master-Build-cluster-mgmt`*, який застосовує параметри заданої конфігурації та створює секрети для ключів цифрового підпису. + +. Зачекайте, доки виконається збірка коду. Це може зайняти декілька хвилин. ++ +Ви можете перевірити поточний статус та результат виконання за посиланням *`CI`* на інтерфейсі. ++ +image::admin:infrastructure/cluster-mgmt/change-key/change-key-42.png[] ++ +В інтерфейсі Jenkins знайдіть відповідний пайплайн та відстежуйте статус виконання. ++ +image:registry-management/cp-platform-admins/cp-platform-admins-25.png[] + diff --git a/docs/ua/modules/admin/pages/registry-management/system-keys/control-plane-platform-keys.adoc b/docs/ua/modules/admin/pages/registry-management/system-keys/control-plane-platform-keys.adoc index 4ee249ec35..9a58babb7a 100644 --- a/docs/ua/modules/admin/pages/registry-management/system-keys/control-plane-platform-keys.adoc +++ b/docs/ua/modules/admin/pages/registry-management/system-keys/control-plane-platform-keys.adoc @@ -1,5 +1,4 @@ = Оновлення ключів та сертифікатів цифрового підпису для Платформи -{empty} + include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] @@ -58,7 +57,9 @@ image:admin:infrastructure/cluster-mgmt/change-key/change-key-07.png[] * 3.2. Інсталюйте та запустіть програму _«ІІТ Користувач ЦСК»_, пройшовши всі запропоновані кроки. + image:admin:infrastructure/cluster-mgmt/change-key/change-key-08.png[] + [#key_info] +-- * 3.3. У вікні програми натисніть `Зчитати`. + image:admin:infrastructure/cluster-mgmt/change-key/change-key-09.png[] @@ -74,6 +75,7 @@ image:admin:infrastructure/cluster-mgmt/change-key/change-key-11.png[] * 3.6. У новому вікні буде зазначена інформація з назвою АЦСК у полі `ЦСК`. + image:admin:infrastructure/cluster-mgmt/change-key/change-key-12.png[] +-- * 3.7. Скопіюйте назву ЦСК на попередньому кроці й вставте її значення у поле `АЦСК, що видав ключ` у налаштуваннях *Control Plane*. + @@ -82,7 +84,8 @@ image:admin:infrastructure/cluster-mgmt/change-key/change-key-13.png[] . Введіть пароль обраного системного ключа у відповідному полі. + image:admin:infrastructure/cluster-mgmt/change-key/change-key-06.png[] - ++ +//// . Наступним кроком додайте список сертифікатів сумісних ЦСК (link:https://iit.com.ua/download/productfiles/CACertificates.p7b[CACertificates.p7b]), який можна отримати на сайті АТ "ІІТ" за посиланням https://iit.com.ua/downloads. + Додайте файл сертифіката, натиснувши кнопку kbd:[Вибрати файл] у полі `Публічні сертифікати АЦСК (розширення .p7b)`. У новому вікні перейдіть до теки, де зберігається файл сертифіката, оберіть його і натисніть kbd:[Відкрити]. @@ -94,7 +97,7 @@ image:admin:infrastructure/cluster-mgmt/change-key/change-key-14.png[] Додайте файл сертифіката, натиснувши кнопку kbd:[Вибрати файл] у полі `Перелік АЦСК (розширення .json)`. У новому вікні перейдіть до теки, де зберігається файл з параметрами, оберіть його і натисніть kbd:[Відкрити]. + image:admin:infrastructure/cluster-mgmt/change-key/change-key-15.png[] - +//// . Далі вкажіть `Перелік дозволених ключів`, підпис яких може вважатися правдивим. + [NOTE] @@ -102,28 +105,30 @@ image:admin:infrastructure/cluster-mgmt/change-key/change-key-15.png[] + У переліку дозволених ключів вказуються наступні дані ключа: -** `«Емітент ключа»` _(див. кроки xref:#issuer_key[7.1.-7.2. цієї інструкції])_; -** `«Серійний номер ключа»` _(див. кроки xref:#serial_number[7.3.-7.4. цієї інструкції])_. +** `«Емітент ключа»` _(див. кроки xref:#issuer_key[5.1.-5.2. цієї інструкції])_; +** `«Серійний номер ключа»` _(див. кроки xref:#serial_number[5.3.-5.4. цієї інструкції])_. + image:admin:infrastructure/cluster-mgmt/change-key/change-key-16.png[] - + [#issuer_key] -* 7.1. Для отримання інформації для поля `Емітент ключа` відкрийте детальну інформацію про ключ, після його зчитування у програмі _«ІІТ Користувач ЦСК»_ _(див. кроки xref:#key_info[4.3.-4.6. цієї інструкції])_, натиснувши `Детальна інформація`. +* 5.1. Для отримання інформації для поля `Емітент ключа` відкрийте детальну інформацію про ключ, після його зчитування у програмі _«ІІТ Користувач ЦСК»_ _(див. кроки xref:#key_info[3.3.-3.6. цієї інструкції])_, натиснувши `Детальна інформація`. + image:admin:infrastructure/cluster-mgmt/change-key/change-key-17.png[] -* 7.2. У новому вікні оберіть рядок `Реквізити ЦСК`, і в нижньому полі скопіюйте його повне значення для заповнення поля `Емітент ключа` у *Control Plane*. +* 5.2. У новому вікні оберіть рядок `Реквізити ЦСК`, і в нижньому полі скопіюйте його повне значення для заповнення поля `Емітент ключа` у *Control Plane*. + image:admin:infrastructure/cluster-mgmt/change-key/change-key-18.png[] + [#serial_number] -* 7.3. Для отримання інформації для поля `Серійний номер ключа` відкрийте детальну інформацію про ключ, після його зчитування в програмі _«ІІТ Користувач ЦСК»_ _(див. кроки xref:#key_info[4.3.-4.6. цієї інструкції])_, натиснувши `Детальна інформація`. +-- +* 5.3. Для отримання інформації для поля `Серійний номер ключа` відкрийте детальну інформацію про ключ, після його зчитування в програмі _«ІІТ Користувач ЦСК»_ _(див. кроки xref:#key_info[3.3.-3.6. цієї інструкції])_, натиснувши `Детальна інформація`. +//TODO: Link doesn`t work + image:admin:infrastructure/cluster-mgmt/change-key/change-key-17.png[] -* 7.4. У новому вікні оберіть рядок `Реєстраційний номер`, і в нижньому полі скопіюйте його повне значення для заповнення поля `Серійний номер ключа` у *Control Plane*. +* 5.4. У новому вікні оберіть рядок `Реєстраційний номер`, і в нижньому полі скопіюйте його повне значення для заповнення поля `Серійний номер ключа` у *Control Plane*. +-- + image:admin:infrastructure/cluster-mgmt/change-key/change-key-19.png[] @@ -161,7 +166,7 @@ image:admin:infrastructure/cluster-mgmt/change-key/change-key-23.png[] + [TIP] ==== -Кроки інсталяції програми описані у xref:#iit[пунктах 4.1-4.3] попереднього розділу. +Кроки інсталяції програми описані у xref:#iit[пунктах 3.1-3.3] попереднього розділу. ==== * 4.2. У вікні програми натисніть «`Зчитати`». @@ -254,7 +259,8 @@ image:admin:infrastructure/cluster-mgmt/change-key/change-key-35.png[] . На підставі усіх раніше вказаних параметрів буде автоматично сконфігуровано `INI`-файл. Детальна інформація щодо його вмісту і додаткових параметрів відображається у відповідному полі `*INI* конфігурація`, яке доступне до редагування. + image:admin:infrastructure/cluster-mgmt/change-key/change-key-36.png[] - ++ +//// . Наступним кроком додайте список сертифікатів сумісних ЦСК (link:https://iit.com.ua/download/productfiles/CACertificates.p7b[CACertificates.p7b]), який можна отримати на сайті АТ "ІІТ" за посиланням https://iit.com.ua/downloads. + Додайте файл сертифіката, натиснувши кнопку kbd:[Вибрати файл] у полі `Публічні сертифікати АЦСК (розширення .p7b)`. У новому вікні перейдіть до теки, де зберігається файл сертифіката, оберіть його та натисніть kbd:[Відкрити]. @@ -266,6 +272,7 @@ image:admin:infrastructure/cluster-mgmt/change-key/change-key-14.png[] Додайте файл сертифіката, натиснувши кнопку kbd:[Вибрати файл] у полі `Перелік АЦСК (розширення .json)`. У новому вікні перейдіть до директорії, де зберігається файл з параметрами, оберіть його та натисніть kbd:[Відкрити]. + image:admin:infrastructure/cluster-mgmt/change-key/change-key-15.png[] +//// . Вкажіть `Перелік дозволених ключів`, підпис яких може вважатися правдивим. + @@ -274,9 +281,8 @@ image:admin:infrastructure/cluster-mgmt/change-key/change-key-15.png[] + У переліку дозволених ключів вказуються наступні дані ключа: -** `«Емітент ключа»` _(як отримати інформацію, показано у кроках xref:#issuer_key[7.1.-7.2. попереднього розділу])_; -** `«Серійний номер ключа»` _(як отримати інформацію, показано у кроках xref:#serial_number[7.3.-7.4. попереднього розділу])_. - +** `«Емітент ключа»` _(як отримати інформацію, показано у кроках xref:#issuer_key[5.1.-5.2. попереднього розділу])_; +** `«Серійний номер ключа»` _(як отримати інформацію, показано у кроках xref:#serial_number[5.3.-5.4. попереднього розділу])_. + image:admin:infrastructure/cluster-mgmt/change-key/change-key-16.png[] diff --git a/docs/ua/modules/admin/pages/registry-management/system-keys/control-plane-registry-certificates.adoc b/docs/ua/modules/admin/pages/registry-management/system-keys/control-plane-registry-certificates.adoc new file mode 100644 index 0000000000..53b687cb9d --- /dev/null +++ b/docs/ua/modules/admin/pages/registry-management/system-keys/control-plane-registry-certificates.adoc @@ -0,0 +1,106 @@ += Налаштування сертифікатів для перевірки ключів цифрового підпису реєстру +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] + +== Загальний опис + +[.underline]#_Сертифікати для перевірки ключів цифрового підпису_# слугують для підтвердження автентичності публічного ключа, який використовується в процесі цифрового підписання. Їх випускає довірена організація, відома як _Акредитований Центр Сертифікації Ключів (АЦСК)_, і вони відіграють важливу роль у створенні довіри до електронних документів та транзакцій. + +[.underline]#_Ключі системного підпису_# призначені для підписання та перевірки даних системами або програмами. Іншими словами, вони допомагають гарантувати, що відповідний пакет даних чи програмне забезпечення походить від відомого джерела і не було змінено. + +[.underline]#_КЕП (Кваліфікований електронний підпис)_# -- це покращена версія ЕЦП (Електронний цифровий підпис). Він забезпечує вищий рівень безпеки та довіри, адже для його створення використовуються більш надійні криптографічні алгоритми та процедури. КЕП часто має правову силу і дозволяє підтверджувати автентичність електронних документів в юридичних ситуаціях. + +*_CACertificates.p7b_* та *_CA.json_*: :: + +* *_CACertificates.p7b_*: цей файл містить один або декілька сертифікатів у форматі `PKCS#7`. Формат `PKCS#7` широко використовується для обміну та зберігання сертифікатів або цілого ланцюжка сертифікатів. + +* *_CA.json_*: це файл у форматі JSON, який може містити деталі про сертифікати. Формат JSON інформацію про сертифікати у форматі JSON, який легко читається людиною та машиною. + ++ +Платформа надає широкі можливості для управління сертифікатами: забезпечує їх безпечне _завантаження_, _зберігання_, _використання_ та _оновлення_. + +== Додавання сертифікатів + +NOTE: Сертифікати АЦСК для перевірки ключів системного підпису та КЕП користувачів, внесені у секції +++Дані для перевірки підписів+++, будуть застосовані до налаштувань реєстру. + +Щоб додати сертифікати АЦСК, виконайте наступні кроки: + +. Увійдіть до адміністративної панелі керування реєстрами *Control Plane*, використовуючи попередньо отримані логін та пароль. ++ +image:admin:infrastructure/cluster-mgmt/update-cluster-mgmt-ua-01.png[] + +. Перейдіть до розділу +++Реєстри+++ та оберіть відповідний реєстр, в якому необхідно завантажити сертифікати для перевірки підпису. ++ +image:admin:infrastructure/cluster-mgmt/change-key/change-key-01.png[] + +. Натисніть кнопку `+++Редагувати+++`, що розташована у правому верхньому куті. ++ +image:admin:infrastructure/cluster-mgmt/change-key/change-key-02.png[] + +. Перейдіть до секції +++Дані для перевірки підписів+++. + +. Додайте публічні сертифікати АЦСК (*_CACertificates.p7b_*). + +.. Додайте список сертифікатів сумісних ЦСК (_.p7b_). Файл можна отримати на сайті АТ "ІІТ" за посиланням https://iit.com.ua/downloads. ++ +[NOTE] +==== +При розгортанні та роботі з тестовим реєстром, використовуйте сертифікати тестового АЦСК, інакше пайплайн розгортання реєстру не пройде, а ви отримаєте помилку ініціалізації криптосервісу `digital-signature-ops`. Це станеться через те, що файли сертифікатів для виробничого середовища просто не містять даних про тестові АЦСК. + +Для промислового середовища використовуйте відповідні prod-сертифікати. + +* Сертифікати АЦСК тестового середовища: https://iit.com.ua/download/productfiles/CACertificates.Test.All.p7b[]. +* Сертифікати АЦСК промислового середовища: https://iit.com.ua/download/productfiles/CACertificates.p7b[]. +==== ++ +.. Додайте файл сертифіката, натиснувши кнопку `+++Обрати файл+++` у полі +++Публічні сертифікати АЦСК (розширення .p7b)+++. У новому вікні перейдіть до теки, де зберігається файл сертифіката, оберіть його і натисніть kbd:[Відкрити]. ++ +image:admin:infrastructure/cluster-mgmt/cp-registry-certificates/01-registry-certificates.png[] + +. Додайте перелік АЦСК (*_CA.json_*). + +.. Додайте параметри взаємодії із сумісними ЦСК (_.json_). Файл можна отримати на сайті АТ "ІІТ" за посиланням https://iit.com.ua/downloads. ++ +[NOTE] +==== +При розгортанні та роботі з тестовим реєстром, використовуйте сертифікати тестового АЦСК, інакше пайплайн розгортання реєстру не пройде, а ви отримаєте помилку ініціалізації криптосервісу `digital-signature-ops`. Це станеться через те, що файли сертифікатів для виробничого середовища просто не містять даних про тестові АЦСК. + +Для промислового середовища використовуйте відповідні prod-сертифікати. + +* Сертифікати АЦСК тестового середовища: https://iit.com.ua/download/productfiles/CAs.Test.All.json[]. +* Сертифікати АЦСК промислового середовища: https://iit.com.ua/download/productfiles/CAs.json[]. +==== ++ +.. Додайте файл сертифіката, натиснувши кнопку `+++Обрати файл+++` у полі +++Перелік АЦСК (розширення .json)+++. У новому вікні перейдіть до теки, де зберігається файл з параметрами, оберіть його і натисніть kbd:[Відкрити]. ++ +image:admin:infrastructure/cluster-mgmt/cp-registry-certificates/02-registry-certificates.png[] + +. На завершення перевірте внесену інформацію і натисніть кнопку `+++Підтвердити+++`. ++ +[NOTE] +У результаті оновлення даних про ключ на інтерфейсі Control Plane, створюється новий запит на оновлення конфігурації реєстру, який необхідно підтвердити. + +. В інтерфейсі адмін-панелі Control Plane поверніться до розділу +++Реєстри+++, прокрутіть бігунок униз сторінки та знайдіть секцію +++Запити на оновлення+++. Знайдіть потрібний запит та натисніть іконку перегляду 👁. ++ +image:admin:infrastructure/cluster-mgmt/cp-registry-certificates/03-registry-certificates.png[] + +. Прокрутіть донизу та натисніть кнопку `+++Підтвердити+++`. ++ +image:admin:infrastructure/cluster-mgmt/cp-registry-certificates/04-registry-certificates.png[] ++ +Далі відбувається автоматичний запуск пайплайну *MASTER-Build-``*, який застосовує параметри заданої конфігурації та створює секрети для ключів цифрового підпису. + +. Зачекайте, доки виконається збірка коду. Це може зайняти приблизно 15 хвилин, але все залежатиме від конфігурації певного реєстру. ++ +Ви можете перевірити поточний статус та результат виконання за посиланням *`CI`* на інтерфейсі. ++ +image:registry-develop:registry-admin/cp-auth-setup-officers/cp-id-gov-ua-iit-setup-6.png[] ++ +image:registry-develop:registry-admin/cp-auth-setup-officers/cp-id-gov-ua-iit-setup-7.png[] ++ +image:registry-develop:registry-admin/cp-auth-setup-officers/cp-id-gov-ua-iit-setup-8.png[] + + + + diff --git a/docs/ua/modules/admin/pages/registry-management/system-keys/control-plane-registry-keys.adoc b/docs/ua/modules/admin/pages/registry-management/system-keys/control-plane-registry-keys.adoc index 534649a533..0b0f699a34 100644 --- a/docs/ua/modules/admin/pages/registry-management/system-keys/control-plane-registry-keys.adoc +++ b/docs/ua/modules/admin/pages/registry-management/system-keys/control-plane-registry-keys.adoc @@ -1,29 +1,13 @@ -:toc-title: ЗМІСТ -:toc: auto -:toclevels: 5 -:experimental: -:important-caption: ВАЖЛИВО -:note-caption: ПРИМІТКА -:tip-caption: ПІДКАЗКА -:warning-caption: ПОПЕРЕДЖЕННЯ -:caution-caption: УВАГА -:example-caption: Приклад -:figure-caption: Зображення -:table-caption: Таблиця -:appendix-caption: Додаток -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Оновлення ключів та сертифікатів цифрового підпису для реєстру -{empty} + +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] Під час xref:admin:registry-management/control-plane-create-registry.adoc[розгортання екземпляра реєстру] необхідно налаштувати ключ цифрового підпису. Після цього ви можете оновлювати інформацію про ключі в рамках редагування реєстру. Механізм налаштування з боку адміністратора є однаковим як при початковому додаванні, так і при оновленні даних про ключ. Для заміни цифрового ключа реєстру дотримуйтеся кроків, описаних нижче в поточній інструкції. + == Редагування даних ключа . Увійдіть до адміністративної панелі управління реєстрами *Control Plane*, використовуючи попередньо отримані логін та пароль. @@ -77,7 +61,9 @@ image:admin:infrastructure/cluster-mgmt/change-key/change-key-07.png[] * 3.2. Інсталюйте та запустіть програму _«ІІТ Користувач ЦСК»_, пройшовши всі запропоновані кроки. + image:admin:infrastructure/cluster-mgmt/change-key/change-key-08.png[] + [#key_info] +-- * 3.3. У вікні програми натисніть `Зчитати`. + image:admin:infrastructure/cluster-mgmt/change-key/change-key-09.png[] @@ -93,6 +79,7 @@ image:admin:infrastructure/cluster-mgmt/change-key/change-key-11.png[] * 3.6. У новому вікні буде зазначена інформація з назвою АЦСК у полі `ЦСК`. + image:admin:infrastructure/cluster-mgmt/change-key/change-key-12.png[] +-- * 3.7. Скопіюйте назву ЦСК на попередньому кроці й вставте її значення у поле `АЦСК, що видав ключ` у налаштуваннях реєстру *Control Plane*. + @@ -101,7 +88,9 @@ image:admin:infrastructure/cluster-mgmt/change-key/change-key-13.png[] . Введіть пароль обраного системного ключа у відповідному полі. + image:admin:infrastructure/cluster-mgmt/change-key/change-key-06.png[] ++ +//// . Наступним кроком додайте список сертифікатів сумісних ЦСК (_.p7b_). Файл можна отримати на сайті АТ "ІІТ" за посиланням https://iit.com.ua/downloads. + [NOTE] @@ -113,6 +102,7 @@ image:admin:infrastructure/cluster-mgmt/change-key/change-key-06.png[] * Сертифікати АЦСК тестового середовища: https://iit.com.ua/download/productfiles/CACertificates.Test.All.p7b[]. * Сертифікати АЦСК промислового середовища: https://iit.com.ua/download/productfiles/CACertificates.p7b[]. ==== + + Додайте файл сертифіката, натиснувши кнопку kbd:[Вибрати файл] у полі `Публічні сертифікати АЦСК (розширення .p7b)`. У новому вікні перейдіть до теки, де зберігається файл сертифіката, оберіть його і натисніть kbd:[Відкрити]. + @@ -133,7 +123,8 @@ image:admin:infrastructure/cluster-mgmt/change-key/change-key-14.png[] Додайте файл сертифіката, натиснувши кнопку kbd:[Вибрати файл] у полі `Перелік АЦСК (розширення .json)`. У новому вікні перейдіть до теки, де зберігається файл з параметрами, оберіть його і натисніть kbd:[Відкрити]. + image:admin:infrastructure/cluster-mgmt/change-key/change-key-15.png[] - +//// ++ . Далі вкажіть `Перелік дозволених ключів`, підпис яких може вважатися правдивим. + [NOTE] @@ -141,30 +132,34 @@ image:admin:infrastructure/cluster-mgmt/change-key/change-key-15.png[] + У переліку дозволених ключів вказуються наступні дані ключа: -** `«Емітент ключа»` _(див. кроки xref:#issuer_key[7.1.-7.2. цієї інструкції])_; -** `«Серійний номер ключа»` _(див. кроки xref:#serial_number[7.3.-7.4. цієї інструкції])_. +** `«Емітент ключа»` _(див. кроки xref:#issuer_key[5.1.-5.2. цієї інструкції])_; +** `«Серійний номер ключа»` _(див. кроки xref:#serial_number[5.3.-5.4. цієї інструкції])_. + image:admin:infrastructure/cluster-mgmt/change-key/change-key-16.png[] - + [#issuer_key] -* 7.1. Для отримання інформації для поля `Емітент ключа` відкрийте детальну інформацію про ключ, після його зчитування у програмі _«ІІТ Користувач ЦСК»_ _(див. кроки xref:#key_info[4.3.-4.6. цієї інструкції])_, натиснувши `Детальна інформація`. +-- +* 5.1. Для отримання інформації для поля `Емітент ключа` відкрийте детальну інформацію про ключ, після його зчитування у програмі _«ІІТ Користувач ЦСК»_ _(див. кроки xref:#key_info[3.3.-3.6. цієї інструкції])_, натиснувши `Детальна інформація`. + image:admin:infrastructure/cluster-mgmt/change-key/change-key-17.png[] -* 7.2. У новому вікні оберіть рядок `Реквізити ЦСК`, і в нижньому полі скопіюйте його повне значення для заповнення поля `Емітент ключа` у *Control Plane*. +* 5.2. У новому вікні оберіть рядок `Реквізити ЦСК`, і в нижньому полі скопіюйте його повне значення для заповнення поля `Емітент ключа` у *Control Plane*. + image:admin:infrastructure/cluster-mgmt/change-key/change-key-18.png[] + +-- + [#serial_number] -* 7.3. Для отримання інформації для поля `Серійний номер ключа` відкрийте детальну інформацію про ключ, після його зчитування в програмі _«ІІТ Користувач ЦСК»_ _(див. кроки xref:#key_info[4.3.-4.6. цієї інструкції])_, натиснувши `Детальна інформація`. +-- +* 5.3. Для отримання інформації для поля `Серійний номер ключа` відкрийте детальну інформацію про ключ, після його зчитування в програмі _«ІІТ Користувач ЦСК»_ _(див. кроки xref:#key_info[3.3.-3.6. цієї інструкції])_, натиснувши `Детальна інформація`. + image:admin:infrastructure/cluster-mgmt/change-key/change-key-17.png[] -* 7.4. У новому вікні оберіть рядок `Реєстраційний номер`, і в нижньому полі скопіюйте його повне значення для заповнення поля `Серійний номер ключа` у *Control Plane*. +* 5.4. У новому вікні оберіть рядок `Реєстраційний номер`, і в нижньому полі скопіюйте його повне значення для заповнення поля `Серійний номер ключа` у *Control Plane*. + image:admin:infrastructure/cluster-mgmt/change-key/change-key-19.png[] +-- . На завершення перевірте внесену інформацію і натисніть кнопку kbd:[Підтвердити]. + @@ -200,7 +195,7 @@ image:admin:infrastructure/cluster-mgmt/change-key/change-key-23.png[] + [TIP] ==== -Кроки інсталяції програми описані у xref:#iit[пунктах 4.1-4.3] попереднього розділу. +Кроки інсталяції програми описані у xref:#iit[пунктах 3.1-3.3] попереднього розділу. ==== * 4.2. У вікні програми натисніть «`Зчитати`». @@ -299,7 +294,8 @@ image:admin:infrastructure/cluster-mgmt/change-key/change-key-35.png[] . На підставі усіх раніше вказаних параметрів буде автоматично сконфігуровано `INI`-файл. Детальна інформація щодо його вмісту і додаткових параметрів відображається у відповідному полі `*INI* конфігурація`, яке доступне до редагування. + image:admin:infrastructure/cluster-mgmt/change-key/change-key-36.png[] - ++ +//// . Наступним кроком додайте список сертифікатів сумісних ЦСК (_.p7b_). Файл можна отримати на сайті АТ "ІІТ" за посиланням https://iit.com.ua/downloads. + [NOTE] @@ -331,6 +327,7 @@ image:admin:infrastructure/cluster-mgmt/change-key/change-key-14.png[] Додайте файл сертифіката, натиснувши кнопку kbd:[Вибрати файл] у полі `Перелік АЦСК (розширення .json)`. У новому вікні перейдіть до директорії, де зберігається файл з параметрами, оберіть його та натисніть kbd:[Відкрити]. + image:admin:infrastructure/cluster-mgmt/change-key/change-key-15.png[] +//// . Вкажіть `Перелік дозволених ключів`, підпис яких може вважатися правдивим. + @@ -339,8 +336,8 @@ image:admin:infrastructure/cluster-mgmt/change-key/change-key-15.png[] + У переліку дозволених ключів вказуються наступні дані ключа: -** `«Емітент ключа»` _(як отримати інформацію, показано у кроках xref:#issuer_key[7.1.-7.2. попереднього розділу])_; -** `«Серійний номер ключа»` _(як отримати інформацію, показано у кроках xref:#serial_number[7.3.-7.4. попереднього розділу])_. +** `«Емітент ключа»` _(як отримати інформацію, показано у кроках xref:#issuer_key[5.1.-5.2. попереднього розділу])_; +** `«Серійний номер ключа»` _(як отримати інформацію, показано у кроках xref:#serial_number[5.3.-5.4. попереднього розділу])_. + image:admin:infrastructure/cluster-mgmt/change-key/change-key-16.png[] diff --git a/docs/ua/modules/admin/pages/update/overview.adoc b/docs/ua/modules/admin/pages/update/overview.adoc index c2b896ba31..08e6e02784 100644 --- a/docs/ua/modules/admin/pages/update/overview.adoc +++ b/docs/ua/modules/admin/pages/update/overview.adoc @@ -1,16 +1,19 @@ :tip-caption: ПІДКАЗКА -= Оновлення компонентів Платформи та реєстру += Оновлення -Цей розділ надає всебічне керівництво з оновлення Платформи та реєстру до конкретної версії збірки, наприклад, `1.9.x.28`. Він описує весь спектр необхідних процедур, від загальних методів оновлення платформи, включно із ручним оновленням та використанням пайплайну `platform-deploy`, до спеціалізованих кроків, які необхідно виконати після оновлення. +Цей розділ надає всебічне керівництво з оновлення Платформи та реєстру до конкретної версії збірки, наприклад, `1.9.x.28`. Він описує весь спектр необхідних процедур, від загальних методів оновлення Платформи, включно із ручним оновленням та використанням пайплайну `platform-deploy`, до спеціалізованих кроків, які необхідно виконати після оновлення. -У цьому розділі ви знайдете детальну інформацію про процес оновлення реєстру, з акцентом на критичні дії, які потрібно виконувати на різних етапах: перед, під час та після самого процесу оновлення. Зокрема, приділяється велика увага відомим потенційним проблемам та специфічним помилкам, що можуть виникнути у процесі апгрейду. Ця інформація дозволить вам комплексно зрозуміти процес для ефективного впровадження оновлень. +У цьому розділі також міститься керівництво по оновленню OKD-кластера, яке охоплює всі необхідні процедури й рекомендації для забезпечення успішного оновлення з будь-якої попередньої версії OKD до актуальної, забезпечуючи безперервність і ефективність роботи кластера. -TIP: Розпочніть процес оновлення на сторінці xref:update/special-steps-for-update/special-steps.adoc[]. +Тут ви також знайдете детальну інформацію про процес оновлення реєстру, з акцентом на критичні дії, які потрібно виконувати на різних етапах: перед, під час та після самого процесу оновлення. Зокрема, приділяється велика увага відомим потенційним проблемам та специфічним помилкам, що можуть виникнути у процесі апгрейду. Ця інформація дозволить вам комплексно зрозуміти процес для ефективного впровадження оновлень. + +TIP: Розпочніть процес оновлення на сторінці xref:update/special-steps-for-update/special-steps.adoc[Оновлення Платформи та реєстрів до версії 1.9.7: спеціальні кроки]. == Огляд секції * xref:update/special-steps-for-update/special-steps.adoc[] * xref:admin:update/update_cluster-mgmt.adoc[] * xref:admin:update/update-registry-components.adoc[] +* xref:admin:update/update-okd-4-12.adoc[] * xref:admin:update/certificates-update.adoc[] \ No newline at end of file diff --git a/docs/ua/modules/admin/pages/update/special-steps-for-update/special-steps.adoc b/docs/ua/modules/admin/pages/update/special-steps-for-update/special-steps.adoc index a9b11e6df1..ae89fa0e7b 100644 --- a/docs/ua/modules/admin/pages/update/special-steps-for-update/special-steps.adoc +++ b/docs/ua/modules/admin/pages/update/special-steps-for-update/special-steps.adoc @@ -1,22 +1,852 @@ -:toc-title: ЗМІСТ -:toc: auto -:toclevels: 5 -:experimental: -:important-caption: ВАЖЛИВО -:note-caption: ПРИМІТКА -:tip-caption: ПІДКАЗКА -:warning-caption: ПОПЕРЕДЖЕННЯ -:caution-caption: УВАГА -:example-caption: Приклад -:figure-caption: Зображення -:table-caption: Таблиця -:appendix-caption: Додаток -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - -= Оновлення Платформи та реєстрів до версії 1.9.6: спеціальні кроки - -CAUTION: Документ у процесі формування. Перегляньте останню доступну версію сторінки -- xref:1.9.5@admin:update/special-steps-for-update/special-steps.adoc[Оновлення Платформи та реєстрів до версії 1.9.5: спеціальні кроки]. \ No newline at end of file += Оновлення Платформи та реєстрів до версії 1.9.7: спеціальні кроки +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +== Мета інструкції + +Метою цієї сторінки є відображення процесу оновлення та спеціальних кроків, необхідних для оновлення кластера Платформи та реєстрів з версії `1.9.6.34` до `1.9.7.42`. + +[#update-platform] +== Оновлення Платформи + +=== Розгортання нової версії Інсталера + +[TIP] +==== +Виконайте оновлення Платформи згідно з інструкціями: + +* xref:admin:installation/platform-deployment/platform-aws-deployment.adoc#installer-update[Оновлення Платформи в OKD-кластері на AWS] + +* xref:admin:installation/platform-deployment/platform-vsphere-deployment.adoc#installer-update[Оновлення Платформи в OKD-кластері на vSphere] +==== + +=== Оновлення інфраструктурних компонентів Платформи + +Цей крок описує стандартний процес оновлення інфраструктурних компонентів Платформи за допомогою пайплайну *cluster-mgmt* в адміністративній панелі *Control Plane*. + +Перед тим, як запускати оновлення пайплайну *cluster-mgmt*, необхідно створити *EDPComponent* `nexus` у просторі імен `control-plane`. Для цього: + +. Перейдіть до проєкту *control-plane*. +. Відкрийте розділ menu:Home[Search]. +. У пошуковому рядку введіть `EDPComponent` та натисніть кнопку *`Create EDPComponent`*. ++ +image:infrastructure/special-steps/special-steps-1-9-7-1.png[] + +. Вставте наступний код: ++ +[%collapsible] +.*_Create EDPComponent_* +==== +[source,yaml] +---- +apiVersion: v1.edp.epam.com/v1 +kind: EDPComponent +metadata: + annotations: + control-plane-console/description: >- + Центральне сховище артефактів, компонентів та їх залежностей, з яких + складається кожна окрема підсистема та Платформа в цілому. Збереження + артефактів платформи. + control-plane-console/display-name: Сховище артефактів Платформи (Control Plane Nexus) + control-plane-console/display-order: '3' + control-plane-console/operational-zone: platform-administration-zone + control-plane-console/platform-only: 'true' + meta.helm.sh/release-name: openshift-edp-components + meta.helm.sh/release-namespace: control-plane + name: nexus + namespace: control-plane + labels: +app.kubernetes.io/managed-by: Helm +spec: + icon: >- +PHN2ZyB3aWR0aD0iNDYiIGhlaWdodD0iNTIiIHZpZXdCb3g9IjAgMCA0NiA1MiIgZmlsbD0ibm9uZSIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj4KPHBhdGggZD0iTTIzLjU0NDggMzMuMjMwOVYyNC4wNzRDMjMuOTcxOSAyMy41ODgzIDI0LjQ5NTggMjMuMTk3MyAyNS4wODMgMjIuOTI2QzI1LjY3MDEgMjIuNjU0NyAyNi4zMDc0IDIyLjUwOTEgMjYuOTU0MSAyMi40OTg2QzI3LjI5MjcgMjIuNDg4OCAyNy42MzEzIDIyLjUxNzcgMjcuOTYzMyAyMi41ODQ4VjE5LjAyNzhDMjcuMTEzNSAxOS4wNjQ4IDI2LjI4MTEgMTkuMjgwMSAyNS41MTk5IDE5LjY1OTZDMjQuNzU4NyAyMC4wMzkyIDI0LjA4NTggMjAuNTc0NSAyMy41NDQ4IDIxLjIzMDlWMTkuMzcyNEgxOS44NTI1VjMzLjIzMDlIMjMuNTQ0OFoiIGZpbGw9IiMyOUI0NzMiLz4KPHBhdGggZD0iTTAgMTIuNTI5MlYzOC44NDMxTDIyLjc2OTIgNTJMNDUuNTM4NSAzOC44NDMxVjEzLjkwNzdMMzkuOTUwOCAxNy4xMzIzVjM1LjYxODVMMjIuNzY5MiA0NS41Mzg1TDUuNiAzNS42MTg1VjE1Ljc2NjJMMjEuNjk4NSA2LjQ2MTU0VjBMMCAxMi41MjkyWiIgZmlsbD0iIzFDMUYyQSIvPgo8cGF0aCBkPSJNMjMuOTM4NyAwVjYuNDYxNTRMMzkuMDUyNiAxNS4yTDQ0LjY0MDMgMTEuOTc1NEwyMy45Mzg3IDBaIiBmaWxsPSIjMjlCNDczIi8+Cjwvc3ZnPg== + type: nexus + url: 'https://nexus./nexus/' + visible: true +---- +==== ++ +[IMPORTANT] +==== +Переконайтеся, що параметр `url` вказує на правильне посилання до Nexus вашого кластера. Замініть `` на домен та піддомени кластера, щоб вказати валідне посилання. + +Наприклад, якщо ваш домен кластера `cluster-environment.project-name.projects.example.com`, то посилання до `nexus` буде: + +[source,yaml] +---- +metadata: + url: 'https://nexus.apps.cluster-environment.project-name.projects.example.com/nexus/' +---- + +Тобто `` тут -- `apps.cluster-environment.project-name.projects.example.com`. +==== + +. Далі виконайте стандартну процедуру оновлення центральних/інфраструктурних компонентів Платформи за допомогою пайплайну *cluster-mgmt*. ++ +TIP: Див. детальніше на сторінці xref:admin:update/update_cluster-mgmt.adoc[]. + +== Кроки після оновлення Платформи + +=== Необхідні зміни у Wiremock Deployment після оновлення + +Після оновлення Платформи, необхідно внести наступні зміни у файл _deploy-templates/templates/deployment.yaml_, у репозиторій _components/registry/wiremock_, до гілки `1.5.0-SNAPSHOT.7`: + +[source,yaml] +---- +spec: + ... + strategy: + type: Recreate +---- + +image:infrastructure/special-steps/special-steps-1-9-7-2.png[] + +Це забезпечить правильний рестарт компонента `wiremock` під час подальшого оновлення реєстру. + +[#update-registry-postgres] +=== Адаптація `registry-postgres` для сумісності з OKD 4.12 + +Щоб запобігти проблемам при створенні реєстрів на версії 1.9.6 після оновлення OKD до 4.12 (_див. детальніше -- xref:update/update-okd-4-12.adoc[]_), необхідно внести зміни до репозиторію *_registry-postgres_*. + +. Увійдіть до Gerrit у простор імен `control-plane`. У розділі *BROWSE* оберіть *Repositories*. ++ +image:infrastructure/special-steps/special-steps-1-9-7-3.png[] + +. У вікні пошуку репозиторіїв вкажіть наступний шлях: + + components/registry/registry-postgres ++ +image:infrastructure/special-steps/special-steps-1-9-7-4.png[] + +. Перейдіть до знайденого репозиторію *_registry-postgres_*. + +. Оберіть розділ *Commands* та натисніть кнопку *`Create change`*. ++ +image:infrastructure/special-steps/special-steps-1-9-7-5.png[] + +. У полі *Select branch for new change* введіть назву гілки `1.9.6.2` та у полі *Description* введіть наступний опис: `Change apiVersion for audit-clean-cron-job to v1`. ++ +image:infrastructure/special-steps/special-steps-1-9-7-6.png[] + +. Автоматично відкриється вікно редагування. У правому верхньому куті натисніть *`Edit`*. ++ +image:infrastructure/special-steps/special-steps-1-9-7-7.png[] ++ +Далі натисніть кнопку *`ADD/OPEN/UPLOAD`*. ++ +image:infrastructure/special-steps/special-steps-1-9-7-8.png[] + +. В автоматично відкритому вікні пошуку файлів вкажіть наступний шлях: + + deploy-templates/templates/audit-clean-cron-job.yaml ++ +Оберіть знайдений файл та натисніть *`Confirm`*. ++ +image:infrastructure/special-steps/special-steps-1-9-7-9.png[] + +. У вікні редагування файлу _audit-clean-cron-job.yaml_ замініть перший рядок: + + apiVersion: batch/v1beta1" ++ +на + + apiVersion: batch/v1 ++ +image:infrastructure/special-steps/special-steps-1-9-7-10.png[] ++ +Після виконаних змін, у правому верхньому куті натисніть *`Save & Publish`*. ++ +image:infrastructure/special-steps/special-steps-1-9-7-11.png[] + +. Після автоматичного переходу до сторінки із виконаною зміною, натисніть кнопку *`Start Review`*, виставте відповідні оцінки та натисніть *`Send and start review`*. ++ +image:infrastructure/special-steps/special-steps-1-9-7-12.png[] + +. Застосуйте запропоновану зміну. Для цього натисніть *`Submit`* у правому верхньому куті. ++ +image:infrastructure/special-steps/special-steps-1-9-7-13.png[] + +[#update-jaeger-operator] +=== Адаптація `jaeger-operator` для сумісності з OKD 4.12 + +Поточна версія `jaeger-operator` не може працювати з останньою версією OKD. Це відбувається через те, що у новій версії OKD було видалено Kubernetes API `batch/v1beta1`, яке використовується для ресурсу *CronJob*. Така зміна перешкоджає оновленню до OKD версії `4.12`. Додаткову інформацію можна знайти в https://docs.okd.io/4.12/updating/updating-cluster-prepare.html#update-preparing-list_updating-cluster-prepare[офіційній документації OKD]. + +Для розв'язання цієї проблеми слід оновити `jaeger-operator` до версії `1.39.0`. Виконайте наступні кроки: + +. Застосуйте нові Custom Resources Definitions (CRD) через термінал. Для цього завантажте файли xref:attachment$special-steps/cert-manager-crds.yaml[_cert-manager-crds.yaml_] та xref:attachment$special-steps/jaeger-crd.yaml[_jaeger-crd.yaml_] й виконайте наступні команди: ++ +[source,bash] +---- +$ oc apply -f cert-manager-crds.yaml +$ oc replace -f jaeger-crd.yaml +---- + +. Відкрийте Gerrit та перейдіть до репозиторію *_service-mesh_*. Оберіть вкладку *Branches*. ++ +image:infrastructure/special-steps/special-steps-1-9-7-14.png[] + +. Створіть нову гілку, натиснувши у правому верхньому куті кнопку *`Create New`*. При створенні, підставте значення поля *Revision* з актуальної на цей час гілки (_наприклад, для Платформи версії 1.9.7 це гілка_ `1.9.7.7`). ++ +image:infrastructure/special-steps/special-steps-1-9-7-15.png[] + +. Через термінал клонуйте репозиторій _service-mesh_ зі створеною на попередньому кроці гілкою. ++ +[source,bash] +---- +$ git clone -b 1.9.7.7-jaeger-update ... +$ cd service-mesh +---- + +. Завантажте патчсет змін xref:attachment$special-steps/ccc6194.diff[_ccc6194.diff_], та покладіть файл у директорію *_service-mesh_*. + +[#apply-patchset-jaeger-operator] +-- +[start=6] +. Застосуйте зміни наступною командою: ++ +[source,bash] +---- +$ git apply ccc6194.diff +---- ++ +NOTE: При застосуванні цього патчсету можуть показуватися попередження (WARNING). Таку поведінку можна ігнорувати та починати виконання наступного кроку. ++ +image:infrastructure/special-steps/special-steps-1-9-7-16.png[] +-- + +[#git-commit-update-jaeger-operator] +-- +[start=7] +. Переконайтеся, що зміни застосовано, внесіть ваші оновлення та виконайте `git push`. ++ +[source,bash] +---- +$ git status +$ git add deploy-templates/ +$ git commit -m "Update jaeger-operator" +$ git push origin HEAD:refs/for/1.9.7.7-jaeger-update +---- +-- + +[start=8] +. У щойно створеній зміні в Gerrit натисніть кнопку *`Reply`* та виставте відповідні оцінки. ++ +image:infrastructure/special-steps/special-steps-1-9-7-17.png[] + +. Застосуйте зміни натисканням кнопки *`Submit`* у правому верхньому куті. + +. Перейдіть до репозиторію *_cluster-mgmt_*. На вкладці *Commands* натисніть кнопку *`Create Change`* та заповніть наступні поля: + +.. У полі *Select branch for new change* вкажіть `master`. +.. У полі *Description* вкажіть опис зміни: `update version of service-mesh`. + ++ +image:infrastructure/special-steps/special-steps-1-9-7-18.png[] + + +. Ви будете автоматично перенаправлені до новоствореної зміни. Натисніть кнопку *`Edit`*. ++ +image:infrastructure/special-steps/special-steps-1-9-7-19.png[] + +. У полі пошуку файлів знайдіть наступний файл за шляхом: `properties/cluster-mgmt.yaml`. Натисніть *`Confirm`*. ++ +image:infrastructure/special-steps/special-steps-1-9-7-20.png[] + +. У вікні редагування знайдіть блок для репозиторію _service-mesh_ та змініть поля `version` та `branch` на назву гілки, яку було створено на одному з попередніх кроків. У нашому випадку назва гілки -- `1.9.7.7-jaeger-update`. ++ +.Приклад блоку після редагування +[source,yaml] +---- +- name: service-mesh + labels: + type: remote + update_scc: false + isbranch: false + path: components/infra/ + repoURL: ssh://jenkins@gerrit.mdtu-ddm-edp-cicd:32114/mdtu-ddm/infrastructure/service-mesh.git + branch: 1.9.7.7-jaeger-update + version: 1.9.7.7-jaeger-update + values: [] +---- + +. Після редагування коду, у верхньому правому куті натисніть кнопку *`Save & Publish`*. ++ +image:infrastructure/special-steps/special-steps-1-9-7-21.png[] + +. Повторіть процес виставлення оцінок та застосування зміни на прикладі кроків xref:#apply-patchset-jaeger-operator[Застосування патчсету для jaeger-operator] та xref:#git-commit-update-jaeger-operator[Commit та push змін до Gerrit]. ++ +Після застосування зміни, запуститься пайплайн в Jenkins для `cluster-mgmt`. ++ +Після успішного проходження *cluster-mgmt*-пайплайну, слід перевірити версію ``jaeger-operato``r. Це можна зробити у поді `jaeger-operator` проєкту `istio-system`. Версія образу повинна дорівнювати `1.39.0`. ++ +image:infrastructure/special-steps/special-steps-1-9-7-22.png[] ++ +Також перевірте наявність роутів. Це можна зробити у розділі menu:Networking[Routes] проєкту `istio-system`. Має існувати роут `jaeger`. ++ +image:infrastructure/special-steps/special-steps-1-9-7-23.png[] + +== Оновлення реєстру + +. Оновіть реєстр до нової версії відповідно до інструкції xref:admin:update/update-registry-components.adoc[]. При створенні запита на оновлення, не підтверджуйте його. У 1.9.7 відбулися глобальні зміни з переходом на Єдиний шаблон (_див. детальніше -- xref:release-notes:whats-new/part-7/wn-7.adoc#single-template[Оптимізація процесу створення реєстрів: мінімізація шаблонів і гнучкість налаштувань]_), тому необхідно виконати ручні зміни у процесі оновлення реєстрів. + +Після створення запита на оновлення до версії 1.9.7, перейдіть у Gerrit за посиланням з Control Plane та виконайте міграцію налаштувань, описану нижче. + +image:infrastructure/special-steps/special-steps-1-9-7-24.png[] + +image:infrastructure/special-steps/special-steps-1-9-7-25.png[] + +=== Оновлення наявних реєстрів + +Для плавного переходу до нового підходу з єдиним шаблоном, необхідно внести зміни у файл *_deploy-templates/values.yaml_* реєстру. + +==== Налаштування параметрів віртуальних машин + +Залежно від типу інфраструктури, залиште необхідні параметри та заповніть значеннями, на яких працює реєстр. Для цього внесіть зміни у файл _deploy-templates/values.yaml_ до наступної секції: + +[source,yaml] +---- +global: + ... + computeResources: + instanceCount: 2 + awsInstanceType: "r5.2xlarge" + awsSpotInstance: false + awsSpotInstanceMaxPrice: "" + awsInstanceVolumeType: "gp3" + instanceVolumeSize: 80 + vSphereInstanceCPUCount: 8 + vSphereInstanceCoresPerCPUCount: 1 + vSphereInstanceRAMSize: 32768 +---- + +. Секція `computeResources` _ДО_ змін має такий вигляд: ++ +image:infrastructure/special-steps/special-steps-1-9-7-26.png[] + +. У налаштуваннях для AWS, значення параметрів змінені на значення з наявних налаштувань реєстру. ++ +[source,yaml] +---- +global: + ... + computeResources: + instanceCount: 2 + awsInstanceType: "r5.2xlarge" + awsSpotInstance: false + awsSpotInstanceMaxPrice: "" + awsInstanceVolumeType: "gp3" + instanceVolumeSize: 80 +---- + +. Відповідно у випадку налаштувань для vSphere, видаліть параметри для AWS та внесіть актуальні значення, наприклад: ++ +[source,yaml] +---- +global: + ... + computeResources: + instanceCount: 2 + instanceVolumeSize: 120 + vSphereInstanceCPUCount: 8 + vSphereInstanceCoresPerCPUCount: 1 + vSphereInstanceRAMSize: 32768 +---- + +==== Редагування ресурсів, кількість реплік/або HPA + +Перенесіть встановлені значення з вашого реєстру. При використанні параметрів за замовчуванням, нічого змінювати не треба. + +.Приклад секції з параметрами за замовчуванням для компонента bpms +[source,yaml] +---- +global: + ... + registry: + ... + bpms: + replicas: 1 + hpa: + enabled: false + minReplicas: 1 + maxReplicas: 3 + istio: + sidecar: + enabled: true + container: + envVars: + JAVA_OPTS: "-Xms1536m -Xmx1536m -Duser.timezone=UTC" +---- + +Якщо необхідно ввімкнути HPA, змінюйте значення у відповідній секції. Зверніть увагу, що в такому випадку необхідно встановити й параметри ресурсів контейнера: + +[source,yaml] +---- +global: + ... + registry: + ... + hpa: + enabled: true + minReplicas: 1 + maxReplicas: 3 + container: + resources: + limits: + cpu: "2" + requests: + cpu: "1" + memory: "4Gi + ... +---- + +==== Редагування ресурсів контейнера та/або istio sidecar + +Параметри ресурсів контейнера необхідно внести й без включеного HPA, якщо вони були попередньо визначені. + +Також є можливість параметризувати ресурси для istio sidecar, якщо він був активований. Наприклад: + +[source,yaml] +---- +global: + ... + registry: + ... + userProcessManagement: + replicas: 1 + hpa: + enabled: false + minReplicas: 1 + maxReplicas: 3 + istio: + sidecar: + enabled: true + resources: + limits: + cpu: 350m + memory: 128Mi + requests: + cpu: 350m + memory: 128Mi + container: + envVars: + JAVA_OPTS: "-Xms512m -Xmx512m" + resources: + limits: + cpu: "2" + requests: + cpu: "1" + memory: 4Gi +---- + +==== Редагування `maxPoolSize` для компонентів `restApi` та `kafkaApi` + +За потреби відредагуйте значення `maxPoolSize` для компонентів `restApi` та `kafkaApi`, відповідно до попередніх налаштувань вашого реєстру: + +[source,yaml] +---- +global: + ... + registry: + ... + kafkaApi: + ... + datasource: + maxPoolSize: 10 +---- + +==== Додаткові умови при розгорнутому геосервері + +Якщо реєстр має геосервер, змініть значення параметра `geoServerEnabled` на `true`. + +[source,yaml] +---- +global: + ... + geoServerEnabled: true +---- + +=== Оновлення реєстрів версії 1.9.6, що були створені після оновлення Платформи до 1.9.7 + +Якщо реєстр 1.9.6 було створено на оновленій платформі 1.9.7, для його оновлення необхідно змінити значення анотації та перезапустити пайплайн *cluster-mgmt* у центральному Jenkins. Після цього з'явиться можливість оновити реєстр: + +menu:Project: `control-plane`[Codebases > Codebase details] + +---- +registry-parameters/template-name: templates/registry-tenant-template +---- + +== Відомі проблеми + +[cols="2*", options="header"] +|=== +| Проблема | Тимчасове рішення (_за потреби_) + +| *Невалідна валідація SSL-сертифіката* при попередньому включенні DNS та спроби змінити на недійсний SSL файл. +| Перевірте файл на коректність (розширення, зміст). Поверніться до редагування Реєстру та завантажте правильний файл. + +| *Під час одночасного створення запита на оновлення* у двох різних реєстрах, Control Plane не знаходить Merge Request (MR). +| Відхиліть зміни безпосередньо у Gerrit, потім виконайте новий запит на оновлення. + +| *Не збігаються статуси* на сторінці переліку реєстрів і сторінці інформації про реєстр. +| Обхідний шлях не потрібен, функціональність Платформи не порушена. + +| *Після рестарту кластера падають* *Create-release* пайплайни у реєстрах. +| Обхідний шлях не потрібен, функціональність Платформи не порушена. + +|=== + +== Виправлення помилки при відновленні центрального компонента `control-plane` + +Для коректного відновлення з резервної копії центрального компонента control-plane, потрібно внести зміни в `control-plane-gerrit`, в репозиторій *_backup-management_*, гілку `1.9.7.4`, та замінити повністю зміст двох файлів: + +. _deploy-templates/charts/velero/templates/control-plane-backup-clusterrole.yaml_ +. _deploy-templates/charts/velero/templates/control-plane-restore-control-plane.tpl_ + +.*_Цільовий код у файлі deploy-templates/charts/velero/templates/control-plane-backup-clusterrole.yaml_* +[%collapsible] +==== +[source,yaml] +---- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ .Values.cronJob.name }}-clusterrole +rules: + - verbs: + - use + apiGroups: + - security.openshift.io + resources: + - securitycontextconstraints + resourceNames: + - anyuid + - verbs: + - '*' + apiGroups: + - rbac.authorization.k8s.io + resources: + - rolebindings + - verbs: + - get + - list + apiGroups: + - config.openshift.io + resources: + - infrastructures + - verbs: + - '*' + apiGroups: + - apps + resources: + - deployments + - deployments/scale + - verbs: + - get + - delete + - list + - patch + apiGroups: + - '' + resources: + - pods + - verbs: + - '*' + apiGroups: + - velero.io + resources: + - '*' + - verbs: + - create + - get + - list + - watch + - patch + - update + - delete + apiGroups: + - '*' + resources: + - secrets + - services + - adminconsoles + - cdstagedeployments + - cdstagejenkinsdeployments + - codebasebranches + - codebaseimagestreams + - codebases + - gerritgroupmembers + - gerritgroups + - gerritmergerequests + - gerritprojectaccesses + - gerritprojects + - gerritreplicationconfigs + - gerrits + - gitservers + - gittags + - imagestreamtags + - jenkins + - jenkinsagents + - jenkinsauthorizationrolemappings + - jenkinsauthorizationroles + - jenkinsfolders + - jenkinsjobbuildruns + - jenkinsjobs + - jenkinsscripts + - jenkinsserviceaccounts + - jenkinssharedlibraries + - jiraissuemetadatas + - jiraservers + - nexuses + - nexususers + - edpcomponents + - keycloakauthflows + - keycloakclients + - keycloakclientscopes + - keycloakrealmcomponents + - keycloakrealmgroups + - keycloakrealmidentityproviders + - keycloakrealmrolebatches + - keycloakrealmroles + - keycloakrealms + - keycloakrealmusers + - keycloaks + - endpointslices + - customresourcedefinitions + - routes + - routes/custom-host + - namespaces + - validatingwebhookconfigurations +---- +==== + +.*_Цільовий код у файлі deploy-templates/charts/velero/templates/control-plane-restore-control-plane.tpl_* +[%collapsible] +==== +[source,tpl] +---- +{{- define "restore-script" }} +#!/usr/bin/env bash +set -e + +if [[ -z "${BACKUP_NAME}" ]] || [[ "${BACKUP_NAME}" = "REPLACE_IT" ]]; then + echo "Environment variable with backup_name is missing or value has not change. +Please add/change ${BACKUP_NAME} to pod parameters" + exit 1 +fi + +backup_name="${BACKUP_NAME}" +backup_secret_name="backup-credentials" +edp_project="control-plane" +resource_type="customresourcedefinition" +resources_folder="/tmp/openshift_resources" + +declare -a crds_to_patch=("gerritmergerequests.v2.edp.epam.com" "codebases.v2.edp.epam.com" "jenkins.v2.edp.epam.com" "gerrits.v2.edp.epam.com") +declare -a animals=("deployment,app=gerrit,gerrit" "deployment,app=jenkins,jenkins") + +execution_time=$(date '+%Y-%m-%d-%H-%M-%S') +cloud_provider=$(oc get infrastructure cluster --no-headers -o jsonpath='{.status.platform}') + + +restic_wait() { + while [[ $(oc get pods "${1}" -o 'jsonpath={..status.conditions[?(@.type=="Initialized")].status}' -n "${2}") != "True" ]]; do + sleep 10 + echo "Restic is not initialized in pod ${1}" + done +} + +delete_namespace(){ + declare -a groups=( "v2.edp.epam.com" "v1.edp.epam.com" ) + if [ ! "$(oc get namespace ${edp_project} --ignore-not-found | wc -c)" -eq 0 ]; then + if [ ! "$(oc get deployment -n ${edp_project} --ignore-not-found | wc -c)" -eq 0 ];then + oc -n "${edp_project}" scale deployments --all=true --replicas 0 + else + echo "[DEBUG] Deployments already deleted from namespace ${edp_project}" + fi + for group in "${groups[@]}";do + for kind in $(oc get crd -o json | jq -r '.items[] | select(.spec.group == "'${group}'") | .spec.names.plural');do + if [ ! "$(oc -n "${edp_project}" get "${kind}" --ignore-not-found | wc -c)" -eq 0 ];then + oc -n "${edp_project}" get "${kind}" --no-headers -o=custom-columns='NAME:.metadata.name' | xargs oc -n "${edp_project}" patch "${kind}" -p '{"metadata":{"finalizers":null}}' --type=merge + else + echo "[DEBUG] CRs with kind ${kind} are already deleted, or not found." + fi + done + done + oc delete namespace ${edp_project} --wait=true + else + echo "Project ${edp_project} already deleted" + fi +} + +minio_resources(){ + declare -a resources_kind=("service" "route" "endpointslice") + resource_name="platform-minio" + for kind in "${resources_kind[@]}";do + if [ "${1}" == "delete" ];then + oc delete "${kind}" "${resource_name}" --ignore-not-found + else + if [ ! "$(oc get "${kind}" "${resource_name}" --ignore-not-found=true | wc -c)" -eq 0 ];then + echo "[INFO] Resource ${kind} ${resource_name} already exist. Continuing restore." + else + if [ ! "$(oc -n "${edp_project}" get "${kind}" "${resource_name}" --ignore-not-found=true | wc -c)" -eq 0 ];then + oc get -n "${edp_project}" "${kind}" "${resource_name}" -o json | jq 'del(.metadata.namespace,.spec.clusterIPs,.spec.clusterIP,.metadata.resourceVersion,.metadata.uid,.metadata.managedFields,.metadata.selfLink,.metadata.ownerReferences)' | oc create -f - + else + echo "Exit from script, resource ${kind} ${resource_name} not found in ${edp_project}" + exit 1 + fi + fi + fi + done +} + +codebase_webhook() { + if [ ! "$(oc get ValidatingWebhookConfiguration "edp-codebase-operator-validating-webhook-configuration-${edp_project}" --ignore-not-found| wc -c)" -eq 0 ];then + oc get ValidatingWebhookConfiguration "edp-codebase-operator-validating-webhook-configuration-${edp_project}" -o yaml > codebase_webhook.yaml + oc delete -f codebase_webhook.yaml + else + if [ -f ./codebase_webhook.yaml ];then + oc apply -f codebase_webhook.yaml + rm -rf codebase_webhook.yaml + fi + fi +} + +restore() { + replica_count="" + + echo "Start restoring deployment application with label - ${3}" + velero create restore "${1}-${execution_time}-${5}" --selector "${3}" --from-backup "${1}" + + timeout 200 bash -c 'while [[ ! $(oc get deployment -l '${3}' -n '${4}' --no-headers -o name) ]]; do sleep 10; echo "Waiting for deployment - '${3}'"; done' + replica_count=$(oc get deployment -l "${3}" -n "${4}" -o jsonpath='{.items[0].spec.replicas}' --ignore-not-found) + + if [ -n "${replica_count}" ] && [ "${cloud_provider}" != "AWS" ]; then + deployment_pod_name=$(oc get pods -l "${3}" -n "${4}" -o json | jq -c '.items[] | select( .metadata.ownerReferences != null ) |.metadata.name' | tr -d '"') + restic_pod_name=$(oc get pods -l "${3}" -o=jsonpath="{range .items[*]}{.metadata.name},{.spec.initContainers[*].name}{'\n'}{end}" -n "${4}" | grep "restic-wait" | awk -F, '{ print $1 }') + if [[ "${deployment_pod_name}" != "${restic_pod_name}" ]]; then + oc scale deployment -l "${3}" -n "${4}" --replicas 0 + oc delete pod "${deployment_pod_name}" -n "${4}" --grace-period=0 --force=true --ignore-not-found=true + fi + echo "Waiting for Restic pod in pod ${restic_pod_name}" + restic_wait "${restic_pod_name}" "${4}" + sleep 5 + oc scale deployment -l "${3}" -n "${4}" --replicas "${replica_count}" + fi + + sleep 30 + + echo "Delete pods with label ${3}. Root cause: network issue" + oc delete pod -l "${3}" -n "${4}" --wait=true + echo "[DEBUG]Restic restore done for label - ${3}, pod in Running state" +} + +minio_resources "create" + +codebase_webhook + +delete_namespace + +echo "Initing restore" +velero restore create --from-backup "${backup_name}" --include-resources secrets,configmaps --wait + +echo "Restoring resources from minio" +minio_endpoint=$(oc get secret $backup_secret_name -n $edp_project -o jsonpath='{.data.backup-s3-like-storage-url}' | base64 -d) +minio_backup_bucket_name=$(oc get secret $backup_secret_name -n $edp_project -o jsonpath='{.data.backup-s3-like-storage-location}' | base64 -d) +minio_access_key=$(oc get secret ${backup_secret_name} -n ${edp_project} -o jsonpath='{.data.backup-s3-like-storage-access-key-id}' | base64 -d) +minio_secret_key=$(oc get secret ${backup_secret_name} -n ${edp_project} -o jsonpath='{.data.backup-s3-like-storage-secret-access-key}' | base64 -d) + +mkdir -p ~/.config/rclone + +echo " +[minio] +type = s3 +env_auth = false +access_key_id = ${minio_access_key} +secret_access_key = ${minio_secret_key} +endpoint = ${minio_endpoint} +region = eu-central-1 +location_constraint = EU +acl = bucket-owner-full-control" > ~/.config/rclone/rclone.conf + +mkdir -p "${resources_folder}" + +rclone copy "minio:/${minio_backup_bucket_name}/openshift-backups/backups/${backup_name}/openshift-resources" ${resources_folder} + +for resource_name in "${crds_to_patch[@]}";do + oc patch "${resource_type}" "${resource_name}" --type='json' -p='[{"op":"replace","path":"/spec/versions/0/subresources","value":null}]' +done + +for op_object in "${resources_folder}"/*; do + [[ -e "${op_object}" ]] || break + oc apply -f "${op_object}"; +done + +codebase_webhook + +for resource_name in "${crds_to_patch[@]}";do + oc patch "${resource_type}" "${resource_name}" --type='json' -p='[{"op":"add","path":"/spec/versions/0/subresources","value":{"status":{}}}]' +done + +rm -rf "${resources_folder}" + +oc adm policy add-scc-to-user anyuid -z jenkins -n "${edp_project}" +oc adm policy add-scc-to-user anyuid -z istio-ingressgateway-control-plane-main-service-account -n "${edp_project}" + +for object in "${animals[@]}"; do + type=$(echo "${object}" | awk -F, '{ print $1 }') + label=$(echo "${object}" | awk -F, '{ print $2 }') + resource_name=$(echo "${object}" | awk -F, '{ print $3 }') + restore "${backup_name}" "${type}" "${label}" "${edp_project}" "${resource_name}" +done + +echo "[DEBUG] Finish restoring process" +velero create restore --from-backup "${backup_name}" --exclude-resources secrets,configmaps,persistentvolumes,persistentvolumeclaims,roles,rolebindings,clusterrolebindings,clusterroles,podsecuritypolicies --wait + +sleep 120 && oc delete pod -n "${edp_project}" -l name=jenkins-operator && sleep 120 + +minio_resources "delete" +{{- end }} +---- +==== + +Merge Request повинен виглядати наступним чином: + +image:infrastructure/special-steps/special-steps-1-9-7-27.png[] + +Після цього натисніть `menu:Reply`[`Code-Review +2`, `Verify +1` > `Submit`] та запустіть пайплайн *MASTER-Build-cluster-mgmt*. Дочекайтеся завершення збірки коду. + +Виходячи з вашого прикладу і враховуючи гугл-стиль, я переформатую наданий чорновик у asciidoc форматі, дотримуючись зрозумілості, конкретності та точності інструкцій. + +== Важливі виправлення (хотфікси) + +[cp-pass-validation] +=== Налаштування валідації в консолі Control Plane для паролів користувачів + +У зв'язку з впровадженням xref:admin:installation/admins-security/overview.adoc[політик Keycloak для безпеки адміністративних акаунтів] на продуктивних середовищах, необхідно внести зміни в інтерфейс користувача (UI) консолі Control Plane, щоб узгодити правила валідації паролів для нових користувачів. + +Для розв'язання цього питання були розроблені спеціальні версії (хотфікси) консолі Control Plane, які потрібно застосувати після оновлення та інсталяції платформи версії 1.9.7. + +. Завантажте необхідні версії хотфіксів консолі Control Plane з Docker Hub за посиланням https://hub.docker.com/u/uss2jelastic: ++ +---- +control-plane-console-1-9-6-fix:1.9.6-FIX.5 +control-plane-console-1-9-7-1:1.9.7.27 +---- + +. Опублікуйте завантажені версії хотфіксів, тобто виконайте `git push` у ваш `control-plane-nexus`. Докладні інструкції ви можете знайти на сторінці xref:admin:installation/push-docker-image-cp-nexus.adoc[]. + +. Замініть поточні версії консолі Control Plane на хотфікс-версії. ++ +Для цього, в репозиторії *_cluster-mgmt_*, у файлі *_deploy-templates/console-versions.yaml_* на гілці `master` оновіть вказівки на нові версії консолей: ++ +[source,yaml] +---- +consoleVersions: + ... + - consoleVersion: 1.9.6-FIX.5 + registryVersion: 1.9.6 + stream: 1-9-6-fix + - consoleVersion: 1.9.7.27 + registryVersion: 1.9.7 + stream: 1-9-7-1 +---- + +. Після внесення виправлень в Docker-образи через Gerrit, автоматично запуститься Jenkins-пайплайн *MASTER-Build-cluster-mgmt*, який актуалізує версії консолі Control Plane. \ No newline at end of file diff --git a/docs/ua/modules/admin/pages/update/update-okd-4-12.adoc b/docs/ua/modules/admin/pages/update/update-okd-4-12.adoc new file mode 100644 index 0000000000..e82cc4e9d8 --- /dev/null +++ b/docs/ua/modules/admin/pages/update/update-okd-4-12.adoc @@ -0,0 +1,891 @@ += Оновлення версії OKD з 4.11 до 4.12 +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +Стаття описує процедуру оновлення версії OKD з `4.11` до `4.12` на платформах _AWS_ та _vSphere_. + +[NOTE,caption=Рекомендована послідовність оновлення версій OKD] +==== +[%collapsible] +.Розгорнути або згорнути список +===== +{empty} +---- +4.11.0-0.okd-2022-07-29-154152 +---- +↓ +---- +4.11.0-0.okd-2022-08-20-022919 +---- +↓ +---- +4.11.0-0.okd-2022-10-28-153352 +---- +↓ +---- +4.11.0-0.okd-2022-12-02-145640 +---- +↓ +---- +4.12.0-0.okd-2023-03-18-084815 +---- +↓ +---- +4.12.0-0.okd-2023-04-16-041331 +---- +===== +==== + +CAUTION: Не рекомендовано оновлювати OKD на версію `4.11.0-0.okd-2023-01-14-152430` через наявний баг із працездатністю компонента *Ceph*. Дотримуйтеся рекомендованої послідовності оновлення. + +[NOTE,caption=середня тривалість оновлення] +==== +* Повне оновлення OKD на одну мінорну версію -- від 1:10:00 до 1:35:00 годин (_орієнтовно ~6:30:00 годин на всі мінорні версії_). +* Заміна AMI для мастер нод перед оновленням OKD до 4.12 -- 2:00:00 години (_для AWS_). +* Заміна образу `fedora-coreos` для шаблону VM -- 00:10:00 хвилин (_для vSphere_). +==== + +[NOTE] +==== +Ви можете зупинити процес оновлення OKD та продовжити у будь-який зручний час. Головною умовою для зупинки процесу є кластер, який не знаходиться у процесі оновлення OKD або у процесі заміни `ami` для мастер-нод. Перелік пунктів, після виконання яких можна зупинити процес оновлення: + +* xref:#update-to-2022-08-20[Оновлення OKD до версії 4.11.0-0.okd-2022-08-20-022919] +* xref:#update-to-2022-10-28[Оновлення OKD до версії 4.11.0-0.okd-2022-10-28-153352] +* xref:#update-to-2022-12-02[Оновлення OKD до версії 4.11.0-0.okd-2022-12-02-145640] +* xref:#update-to-2023-03-18[Оновлення OKD до версії 4.12.0-0.okd-2023-03-18-084815] +==== + +== Передумови + +Для успішного проведення описаної процедури оновлення мають бути виконані наступні умови: + +. OKD-кластер версії `4.11` або вище. +. Версія Платформи на кластері -- `1.9.7` або вище (_див. детальніше -- xref:admin:installation/okd-requirements.adoc[]_). +. Локально встановлений інструмент *`oc cli`* версії `4.12` або вище. + +. Для інфраструктури *AWS*: +* Наявний *IAM*-користувач із доступом до сервісу *EC2*. +* Користувач має права на увімкнення та вимкнення вузлів (нод). + +. Для інфраструктури *vSphere*: +* Наявний доступ до *vSphere Client*. +* Наявний доступ до кожного вузла (ноди) кластера за допомогою *SSH* ключа. + +. Локально встановлений інструмент *`jq`* для роботи через термінал. +. Роль `cluster-admin` на OKD-кластері. +. Ознайомлення з процесом оновлення з офіційного джерела: link:https://docs.okd.io/4.12/updating/[Офіційна документація оновлення OKD]. + +CAUTION: У випадку використання інфраструктури *vSphere*, обов'язково перевірте доступ по *SSH* до всіх вузлів кластера перед початком оновлення. Не розпочинайте процес оновлення OKD, якщо доступ по *SSH* не налаштований. Варто зазначити, що доступ до вузлів за командою `oc debug node/{node_name}` не буде доступний під час оновлення! + +== Підготовчі дії перед оновленням + +. Перед початком процесу оновлення, важливо переконатися, що ваш OKD кластер працює без помилок: ++ +-- +* Відрийте вебінтерфейс OKD. +* Перейдіть до розділу *Administration* > *Cluster Settings*. +* Уважно перевірте стан кластера. Переконайтеся, що інформаційна панель стану кластера не показує жодних попереджень (`WARNING`) або помилок (`ERROR`). Це забезпечить, що кластер знаходиться у готовності до оновлення. +-- ++ +image:admin:infrastructure/update-okd/update-okd-1.png[] ++ +[NOTE] +==== +У випадку, якщо під час перевірки стану кластера з'являється повідомлення: + +---- +Cluster operator machine-config should not be upgraded between minor versions: PoolUpdating: One or more machine config pools are updating, please see oc get mcp for further details +---- + +та у ресурсі *MachineConfigPool* із назвою *master* спостерігається помилка: + +---- +Node ip-*-*-*-*.eu-central-1.compute.internal is reporting: "machineconfig.machineconfiguration.openshift.io \"rendered-master-***\" not found" +---- + +в такому випадку рекомендується виконати наступну команду в `oc cli` та дочекатися перезапуску всіх мастер-нод кластера: + +[source,bash] +---- +$ oc delete mc 99-okd-master-disable-mitigations 99-master-okd-extensions +---- +==== + +. Перевірте, чи встановлено параметр *Upstream configuration* у значення `https://amd64.origin.releases.ci.openshift.org/graph`. Це вказує на офіційне джерело оновлень. ++ +image:admin:infrastructure/update-okd/update-okd-2.png[] + +. У розділі *Administration* > *Cluster Settings*" перейдіть на вкладку *ClusterOperators*. ++ +Перевірте, що жоден з операторів не перебуває у стані `Updating`. ++ +image:admin:infrastructure/update-okd/update-okd-3.png[] + +== Процедура оновлення + +. Спочатку переконайтеся, що ваш кластер готовий до цього процесу видалення Kubernetes API в OKD 4.12. Для цього виконайте наступну команду через термінал: ++ +[source,bash] +.okd +---- +$ oc -n openshift-config patch cm admin-acks --patch '{"data":{"ack-4.11-kube-1.25-api-removals-in-4.12":"true"}}' --type=merge +---- + +. Призупиніть ресурси *MachineHealthCheck* перед оновленням кластера. Це дозволить уникнути перезавантаження нод при оновленні. ++ +[source,bash] +.pause +---- +$ oc get machinehealthcheck -n openshift-machine-api +$ oc -n openshift-machine-api annotate mhc cluster.x-k8s.io/paused="" +---- + +. *Вимкніть усі реєстри*. Для вимкнення усіх реєстрів використовуйте наступний процес, який може бути автоматизований за допомогою запропонованого bash-скрипту. Скрипт виконує наступні дії для кожного реєстру (codebase): + +.. Перевірка стану *Istio*. +.. Патчінг ресурсу *IstioControlPlane* для вимкнення роботи *Istio* для реєстру. +.. Анотування ресурсу *MachineSet* реєстру з поточною кількістю реплік. +.. Анотування ресурсів *Machine* для *MachineSet* реєстру для подальшого їх видалення. +.. Позначення кожної ноди реєстру як `Unscheduled`. +.. Видалення усіх подів з ноди для подальшого видалення ноди. +.. Перехід усіх *CronJob* реєстру в стан паузи. +.. Виконання scale *MachineSet* реєстру до 0 реплік. + ++ +Цей процес забезпечує безпечне та ефективне вимкнення реєстрів, готуючи їх до подальшого видалення чи оновлення. + ++ +.*_Скрипт registries_turn_off.sh_* +[%collapsible] +==== +[source,shellscript] +---- +#!/usr/bin/env bash + +CHECK-HEALTH-OF-ISTIO() { + echo "Checking if IstioOperator resource is healthy..." + isIstioHealthy=$(oc get -n istio-system IstioOperator istiocontrolplane -o jsonpath='{.status.status}') + counterForCheckingIstio=3 + while [ ${counterForCheckingIstio} -gt 0 ]; do + if [[ ${isIstioHealthy} == "HEALTHY" ]]; then + echo "IstioOperator resource is healthy" + break + else + counterForCheckingIstio=$[ $counterForCheckingIstio - 1 ] + if [ ${counterForCheckingIstio} -eq 0 ]; then + echo "IstioOperator resource with name istiocontrolplane in namespace istio-system is not healthy!" + echo "Fix it manually and try again later!" + exit 1 + else + echo "IstioOperator resource with name istiocontrolplane in namespace istio-system is not healthy!" + echo "Sleeping for 30 seconds" + sleep 30 + echo "Trying again..." + fi + fi + done +} + +PATCH-ISTIO() { + CHECK-HEALTH-OF-ISTIO + echo "Turning off Istio ingress gateway in registry ${1}" + indexOfIstioIngressGateways=$(oc get -n istio-system IstioOperator istiocontrolplane -o json | jq '.spec.components.ingressGateways | map(.namespace == "'${1}'") | index(true)') + oc patch -n istio-system IstioOperator istiocontrolplane --type json -p '[{"op": "replace", "path": "/spec/components/ingressGateways/'${indexOfIstioIngressGateways}'/enabled", "value": false}]' +} + +CHECK-HEALTH-OF-ISTIO +for registry in $(oc get codebases -n control-plane --no-headers -o custom-columns=":metadata.name" --field-selector=metadata.name!=cluster-mgmt); do + registryMachineSet=$(oc get -n openshift-machine-api MachineSet -o=jsonpath='{.items[?(@.metadata.annotations.meta\.helm\.sh/release-namespace=="'"${registry}"'")].metadata.name}') + registryMachineSetReplicas=$(oc get -n openshift-machine-api MachineSet ${registryMachineSet} -o jsonpath='{.spec.replicas}') + if [ $registryMachineSetReplicas -ne 0 ]; then + echo "Turn off registry ${registryMachineSet}" + PATCH-ISTIO "${registry}" + + isAnnotationPresent=$(oc get -n openshift-machine-api MachineSet ${registryMachineSet} -o=jsonpath='{.metadata.annotations.registryMachineSetReplicas}') + + if [ ${isAnnotationPresent} ]; then + echo "Annotation [registryMachineSetReplicas] is already present in MachineSet ${registryMachineSet}" + else + echo "Annotate MachineSet ${registryMachineSet} before scale down" + oc annotate -n openshift-machine-api MachineSet ${registryMachineSet} registryMachineSetReplicas=${registryMachineSetReplicas} + fi + + for machine in $(oc get -n openshift-machine-api Machines -l machine.openshift.io/cluster-api-machineset=${registryMachineSet} -o jsonpath='{range .items[*].metadata}{.name}{"\n"}{end}'); do + echo "Annotate Machine ${machine} before deletion" + oc annotate -n openshift-machine-api machine/${machine} machine.openshift.io/cluster-api-delete-machine="true" + oc annotate -n openshift-machine-api machine/${machine} machine.openshift.io/exclude-node-draining="true" + done + + for node in $(oc get -n openshift-machine-api Nodes -l node=${registry} -o jsonpath='{range .items[*].metadata}{.name}{"\n"}{end}'); do + echo "Cordon Node ${node}" + oc adm cordon ${node} + + oc delete -n ${registry} pods --all --force --grace-period=0 + + echo "Drain Node ${node}" + oc adm drain ${node} --ignore-daemonsets --force --grace-period=0 --delete-emptydir-data + done + + for cronjob in $(oc get -n velero CronJobs -o jsonpath='{range .items[*].metadata}{.name}{"\n"}{end}' | grep ${registry}); do + echo "Suspend CronJob ${cronjob}" + oc patch -n velero CronJobs ${cronjob} -p '{"spec":{"suspend":true}}' + done + + oc scale -n openshift-machine-api --replicas=0 MachineSet ${registryMachineSet} + else + echo "Registry ${registryMachineSet} is disabled" + fi +done +---- +==== + +. Змініть конфігурацію розгортання (patch deployment) `istiod` у вашому Kubernetes-кластері. Для цього запустіть команду, яка зменшить кількість реплік до нуля, що дозволить уникнути переривань під час оновлення кластера. Команда, яку ви можете використати в `oc` (OpenShift CLI), виглядає так: ++ +.patch deployment istiod +[source,bash] +---- +$ oc scale deployment istiod --replicas=0 -n istio-system +---- ++ +Ця команда встановлює кількість реплік розгортання (deployment) `istiod` як `0` у просторі імен `istio-system`, тимчасово зупиняючи його. + +. Оновіть ресурс *istioOperator* з ім'ям *istiocontrolplane* у просторі імен `istio-systems`. Для цього внесіть зміни до конфігурації, встановивши поле `enabled` у значення `false` для специфічного блоку `istio-ingressgateway-control-plane-main`. Це можна зробити шляхом редагування *YAML*-файлу конфігурації. ++ +image:admin:infrastructure/update-okd/update-okd-4.png[] + +. Збільште кількість реплік `worker`-нод із 3 до 4 у вашому OKD кластері. Для цього оновіть конфігурацію відповідного *MachineSet*. Це дозволить запобігти можливим проблемам із нестачею ресурсів під час оновлення OKD. ++ +NOTE: Перед переходом до наступного кроку важливо дочекатися, коли нова `worker`-нода повністю підійметься та стане активною у кластері. + ++ +image:admin:infrastructure/update-okd/update-okd-5.png[] + +.. Перед оновленням OKD слід враховувати, що під час процесу оновлення воркер ноди можуть зависати або не оновлюватися. Якщо ви помічаєте таку поведінку, рекомендується видалити ресурс *Machine* для проблемної ноди. Цей ресурс зазвичай знаходиться у розділі *Compute* в інтерфейсі керування кластером. ++ +image:admin:infrastructure/update-okd/update-okd-6.png[] ++ +NOTE: Також під час оновлення OKD можуть з'являтися попередження та помилки. В більшості випадків це вважається нормальною поведінкою, яка згодом самостійно вирішується. ++ +image:admin:infrastructure/update-okd/update-okd-7.png[] + +[#update-to-2022-08-20] +-- +[start=7] +. Оновіть OKD до версії *`4.11.0-0.okd-2022-08-20-022919`*. ++ +Для цього перейдіть до розділу *Administration* > *Cluster Settings* у вебінтерфейсі OKD. Далі оберіть потрібну версію зі списку доступних (_поле_ *Select new version*). ++ +Після вибору версії, дочекайтеся завершення процесу оновлення та пропозиції оновитися далі. ++ +NOTE: Якщо ваша поточна версія OKD вже відповідає `4.11.0-0.okd-2022-08-20-022919`, цей крок можна пропустити. ++ +image:admin:infrastructure/update-okd/update-okd-8.png[] +-- + +[#update-to-2022-10-28] +[start=8] +. Оновіть OKD до версії *`4.11.0-0.okd-2022-10-28-153352`*. ++ +Для цього перейдіть до розділу *Administration* > *Cluster Settings* у вебінтерфейсі OKD. Далі оберіть потрібну версію зі списку доступних (_поле_ *Select new version*). ++ +Після вибору версії, дочекайтеся завершення процесу оновлення та пропозиції оновитися далі. ++ +image:admin:infrastructure/update-okd/update-okd-9.png[] + +[#update-to-2022-12-02] +[start=9] +. Оновіть OKD до версії *`4.11.0-0.okd-2022-12-02-145640`*. ++ +Для цього перейдіть до розділу *Administration* > *Cluster Settings* у вебінтерфейсі OKD. Далі оберіть потрібну версію зі списку доступних (_поле_ *Select new version*). ++ +Після вибору версії, дочекайтеся завершення процесу оновлення та пропозиції оновитися далі. ++ +image:admin:infrastructure/update-okd/update-okd-10.png[] ++ +[#aws-ami-update] +. *_На інфраструктурі AWS_* через баг OKD (https://github.com/okd-project/okd/issues/1657), оновлення не може бути продовжене до версії 4.12. Для розв'язання цієї проблеми необхідно перевести всі `master`-ноди на новий *AMI*. Це можна зробити за https://docs.openshift.com/container-platform/4.11/backup_and_restore/control_plane_backup_and_restore/replacing-unhealthy-etcd-member.html#restore-replace-stopped-etcd-member_replacing-unhealthy-etcd-member[документацією], шляхом заміни `master`-ів. ++ +WARNING: Процедуру заміни AMI потрібно виконати для кожної `master`-ноди по черзі. *Перед заміною нода має бути вимкнена!* ++ +Кроки виконання заміни *AMI* для мастер ноди: ++ +[#shut-down-master-node] +.. Вимкніть мастер-ноду, яку плануєте замінити. Для цього, для *AWS*-інфраструктури, перейдіть до *AWS UI* та у сервісі *EC2* виконайте для обраного екземпляра дію *`Stop`*. ++ +[#available-etcd-pods-status] +.. Перевірте стан наявних *etcd*-подів. Усі поди мають бути зі статусом `Running`. ++ +[source,bash] +---- +$ oc -n openshift-etcd get pods -l k8s-app=etcd +---- ++ +.Результат виконання команди +image::admin:infrastructure/update-okd/update-okd-11.png[] ++ +[#connect-to-any-etcd-pod] +.. Під'єднайтеся до будь-якого *etcd*-поду, *що не відповідає мастер-ноді, яку плануєте замінити*. Це можна визначити за назвою *etcd*-поду. ++ +[source,bash] +---- +$ oc rsh -n openshift-etcd etcd-ip-10-0-154-204.ec2.internal +---- ++ +[#get-etcd-member-list] +.. Перегляньте список *etcd*-учасників (members). ++ +[source,bash] +---- +$ etcdctl member list -w table +---- ++ +.Результат виконання команди +image::admin:infrastructure/update-okd/update-okd-12.png[] + +.. Видаліть etcd-учасника, що відповідає мастер-ноді, яку плануєте видалити. ++ +[source,bash] +---- +$ etcdctl member remove 6fc1e7c9db35841d +---- + +.. Перевірте видалення etcd-учасника. Повинно залишитись 2 учасники. ++ +[source,bash] +---- +$ etcdctl member list -w table +---- ++ +NOTE: Цю команду рекомендовано запустити декілька разів, щоб упевнитись, що etcd не перестворює видаленого etcd-учасника знову. + +.. Виходимо з поди etcd та вимикаємо *Quorum Guard* для etcd. ++ +[source,bash] +---- +$ oc patch etcd/cluster --type=merge -p '{"spec": {"unsupportedConfigOverrides": {"useUnsupportedUnsafeNonHANonProductionUnstableEtcd": true}}}' +---- + +.. Знайдіть секрети для мастер-ноди, яку ви плануєте видалити, та видаліть їх. ++ +[source,bash] +---- +$ oc get secrets -n openshift-etcd | grep ip-10-0-131-183.ec2.internal +---- ++ +.Приклад видалення секретів для обраної ноди +---- +$ oc delete secret -n openshift-etcd etcd-peer-ip-10-0-131-183.ec2.internal +$ oc delete secret -n openshift-etcd etcd-serving-ip-10-0-131-183.ec2.internal +$ oc delete secret -n openshift-etcd etcd-serving-metrics-ip-10-0-131-183.ec2.internal +---- ++ +NOTE: Секрети можуть відновитися після видалення -- це нормальна поведінка. + +.. Виводимо список машин. ++ +[source,bash] +---- +$ oc get machines -n openshift-machine-api -o wide +---- + +.. Збережіть конфігураційний файл мастер-ноди, яку ви плануєте видалити. ++ +[source,bash] +---- +$ oc get machine clustername-8qw5l-master-0 -n openshift-machine-api -o yaml > new-master-machine.yaml +---- + +.. Відредагуйте збережену конфігурацію у файлі *_new-master-machine.yaml_*. Редагування файлу конфігурації для заміни мастер ноди в OKD включає наступні кроки: + +... Замініть поле `.metadata.name` на нове. Рекомендується зберегти основну частину наявного імені старої машини, змінивши лише кінцевий номер на наступний доступний. Наприклад, з `clustername-8qw5l-master-0` на `clustername-8qw5l-master-3`. +... Видаліть поле `.status`. +... Видаліть поле `.spec.providerID`. +... Замініть значення у `.spec.providerSpec.value.ami.id` на новий AMI ID. Наприклад: `ami-0037cfd83bf77778c`. + +.. Видаліть машину мастер-ноди, яку ви планували замінити. ++ +[source,bash] +---- +$ oc delete machine -n openshift-machine-api clustername-8qw5l-master-0 +---- ++ +NOTE: Цей крок може зайняти до 20 секунд. + +.. Перевірте, що машину видалено. ++ +[source,bash] +---- +$ oc get machines -n openshift-machine-api -o wide +---- ++ +[CAUTION] +==== +Після видалення машини важливо зачекати *2-3 хвилини* перед тим, як переходити до наступного кроку: xref:#apply-new-machine-config[Застосування файлу конфігурації нової машини] (_крок n_). Недотримання цієї паузи може призвести до непередбачених наслідків, таких як проблеми з мережею на новій ноді тощо. Якщо виникають проблеми із запуском нової ноди, потрібно повторно виконати процес видалення, починаючи з кроку xref:#shut-down-master-node[Вимкнення мастер-ноди]. +==== ++ +[#apply-new-machine-config] +.. Застосуйте файл конфігурації нової машини. ++ +Зачекавши 2-3 хвилини з моменту видалення ноди, застосуйте новий файл конфігурації. ++ +[source,bash] +---- +$ oc apply -f new-master-machine.yaml +---- ++ +Якщо при застосуванні файлу конфігурації нової машини команда `oc apply` не відповідає, це може бути ознакою того, що кластер почав процес перезавантаження. У цьому випадку важливо дочекатися, коли кластер знову стане доступним, перш ніж повторно застосовувати файл конфігурації нової машини. + +.. Перевірте, що машина створюється та запускається нова нода. ++ +[source,bash] +---- +$ oc get machines -n openshift-machine-api -o wide +---- ++ +[source,bash] +---- +$ oc get nodes +---- ++ +NOTE: Важливо зауважити, що процес створення нової машини для кластера може зайняти декілька хвилин. Під час цього процесу ноди кластера будуть перезавантажуватися, що може призвести до тимчасової недоступності кластера. Врахуйте це, плануючи виконання робіт, щоб уникнути незапланованого переривання доступу до послуг. + +.. Щойно нова мастер-нода буде успішно піднята та інтегрована в кластер, увімкніть *Quorum Guard* для `etcd`. Це гарантує, що `etcd` зберігає кворум та продовжує працювати стабільно. Увімкнення *Quorum Guard* важливе для забезпечення цілісності та високої доступності кластера. ++ +[source,bash] +---- +$ oc patch etcd/cluster --type=merge -p '\{"spec": \{"unsupportedConfigOverrides": null}}' +---- + +.. Зачекайте, поки підніметься новий *etcd*-под для нової ноди. ++ +[source,bash] +---- +$ oc -n openshift-etcd get pods -l k8s-app=etcd +---- ++ +NOTE: На цьому етапі можуть перезавантажуватися ноди кластера. Це нормальна поведінка. + + +.. На послідовних кроках xref:#available-etcd-pods-status[Перевірка стану наявних etcd-подів], xref:#connect-to-any-etcd-pod[З'єднайтеся із довільним *etcd*-подом] та xref:#get-etcd-member-list[Перегляд списку *etcd*-учасників] можна перевірити, чи присутня нова нода в etcd-кворумі. ++ +[#etcd-reconciliation] +.. Після успішної заміни ноди обов'язково дочекайтеся реконсиляції etcd. Це можна перевірити у ресурсі etcd за допомогою команди: ++ +[source,bash] +---- +$ oc get etcd/cluster -oyaml +---- ++ +TIP: Одним із ключових індикаторів успішної реконсиляції є однаковий `revision` усіх нод. Це свідчить про те, що всі ноди синхронізовані та коректно працюють після заміни. ++ +image::admin:infrastructure/update-okd/update-okd-13.png[] ++ +[#operators-status-active] +.. Перейдіть до розділу *Administration* > *Cluster Settings* > *ClusterOperators* у вебінтерфейсі управління OKD, щоб перевірити статус усіх операторів. Усі оператори мають бути у статусі `Active`. Зверніть увагу, що оператор `kube-apiserver` часто має статус `Progressing`, оскільки він оновлює `revision` нод. Це нормальний процес, і вам слід дочекатися, коли він змінить статус на `Active`, що свідчить про завершення оновлення та стабільність кластера. ++ +image::admin:infrastructure/update-okd/update-okd-14.png[] + +.. Після завершення реконсиляції `etcd` (_див. xref:#etcd-reconciliation[Реконсиляція etcd]_) та перевірки, що всі оператори мають статус `Active` (_xref:#operators-status-active[Статус операторів: Active]_), можна переходити до заміни AMI для наступної мастер-ноди, починаючи з кроку xref:#shut-down-master-node[Вимкнення мастер-ноди]. ++ +WARNING: Важливо не ігнорувати ці кроки, оскільки завершена реконсиляція `etcd` і статус `Active` усіх операторів є ключовими умовами для безпечної заміни AMI наступних мастер-нод. Недотримання цих вимог може привести до непередбачених проблем у кластері. + +[#update-to-2023-03-18] +[start=11] +. Після успішної заміни AMI на всіх мастер-нодах (для *AWS* інфраструктури, крок xref:#aws-ami-update[Заміна AMI для мастер-нод]), оновіть OKD до версії *`4.12.0-0.okd-2023-03-18-084815`*. ++ +Для цього перейдіть до розділу *Administration* > *Cluster Settings* у вебінтерфейсі OKD. Далі оберіть потрібну версію зі списку доступних (_поле_ *Select new version*). ++ +*_На інфраструктурі vSphere_*, під час оновлення OKD до версії `4.12.0-0.okd-2023-03-18-084815`, може виникнути проблема, пов'язана з багом OKD, що стосується *SELinux policies* (_див. детальніше: https://github.com/okd-project/okd/issues/1475[]_) Цей баг може спричинити недоступність нод під час оновлення та статус `Not Ready`, який не змінюється з часом. ++ +.Приклад проблемних нод під час оновлення при виконанні команди `oc get nodes` +image::admin:infrastructure/update-okd/update-okd-15.png[] ++ +.. Для розв'язання цієї проблеми під'єднайтеся до відповідної ноди зі статусом `Not Ready` через *SSH*. ++ +[NOTE] +==== +IP-адресу ноди, яка перебуває у статусі `Not Ready`, можна знайти за допомогою команди: + +[source,bash] +---- +oc get nodes -o wide. +---- +==== + +.. Після підключення до проблемної ноди через *SSH*, введіть наступну команду у терміналі цієї ноди: ++ +[source,bash] +---- +$ restorecon -R -v /etc/NetworkManager/dispatcher.d/ +---- + +.. Після виконання команди перезапустіть ноду через *vSphere Client* за шляхом *Power* > *Restart Guest OS*. ++ +image:admin:infrastructure/update-okd/update-okd-16.png[] ++ +NOTE: Якщо спостерігаються певні проблеми при перезапуску ноди, слід виконати наступний перезапуск за шляхом *Power* > *Reset*. + +.. Після перезапуску кожної ноди важливо переконатися, що вона успішно піднялася та отримала статус `Ready`. Це можна зробити, виконавши команду `oc get nodes`. Після підтвердження, що нода працює належним чином і має статус `Ready`, можна повторити процедуру для наступної ноди, яка все ще перебуває у статусі `Not Ready`. Цей підхід гарантує, що усі ноди кластера будуть стабільно працювати після оновлення. ++ +CAUTION: Важливо виконати цей процес для кожної ноди, яка зазнала проблем під час оновлення і має статус `Not Ready`, який не змінюється протягом часу. Це забезпечить, що всі ноди вашого кластера будуть оновлені та працюватимуть коректно. + +.. Дочекайтеся оновлення OKD до версії `4.12.0-0.okd-2023-03-18-084815`. + +. *_На інфраструктурі AWS_*, перед оновленням *OKD* до версії `4.12.0-0.okd-2023-04-16-041331`, додайте перелік *IP-адрес* із сервісу `router-default` до ресурсу *ingresscontroller*. + +.. Знайдіть ресурс з типом *Service* та імʼям *router-default* у просторі імен *openshift-ingress* та скопіюйте перелік *IP адрес* з анотації *"service.beta.kubernetes.io/load-balancer-source-ranges"* ++ +.router-default.yaml +image::admin:infrastructure/update-okd/update-okd-17.png[] + +.. Застосуйте цей перелік IP для ресурсу *ingresscontroller* з ім'ям `default` у просторі імен `openshift-ingress-operator`. ++ +[source,bash] +---- +$ oc patch ingresscontroller default -n openshift-ingress-operator --type='json' -p='[{"op": "add", "path": "/spec/endpointPublishingStrategy", "value": {"loadBalancer": {"allowedSourceRanges": ['${ip_list}'], "dnsManagementPolicy": "Managed", "scope": "External"}, "type": "LoadBalancerService"}}]' +---- ++ +NOTE: Змінну `$\{ip_list}` замініть на скопійований раніше список *IP-адрес*. + +.. Якщо ви зіткнулися з помилкою `Command too long` при спробі внести зміни за допомогою команди `oc patch`, необхідно внести список IP-адрес до ресурсу `ingresscontroller` вручну. Для цього потрібно відредагувати YAML файл конфігурації `ingresscontroller` з ім'ям `default`, розташований у просторі імен `openshift-ingress-operator`. Внесіть необхідні зміни вручну, дотримуючись відповідної структури YAML. ++ +.*_IP-адреси. YAML файл конфігурації ``ingresscontroller``_* +[%collapsible] +==== +[source,yaml] +---- +spec: + endpointPublishingStrategy: + loadBalancer: + allowedSourceRanges: + - 174.128.55.224/29 + - 174.128.60.0/24 + - 91.120.48.0/27 + - 91.120.48.32/27 + - 195.56.119.208/28 + - 195.56.109.192/28 + - 85.223.209.0/24 + - 85.223.141.72/29 + - 87.245.220.0/26 + - 3.67.249.129/32 + - 18.198.70.194/32 + - 18.192.234.58/32 + - 213.108.75.174/32 + - 176.102.33.181/32 + - 213.160.142.156/32 + - 80.94.82.14/32 + - 188.190.252.22/32 + - 176.37.203.227/32 + - 178.150.71.4/32 + - 178.150.19.142/32 + - 176.36.85.141/32 + - 93.74.201.250/32 + - 91.218.97.99/32 + - 78.47.172.92/32 + - 95.67.49.154/32 + - 18.184.216.234/32 + - 85.223.141.72/29 + - 85.223.209.0/24 + - 217.20.186.32/30 + - 89.162.139.0/27 + - 80.92.226.192/29 + - 188.163.232.128/25 + - 87.245.220.0/26 + - 85.223.208.64/29 + - 193.110.100.132/30 + - 80.92.226.132/30 + - 85.223.157.168/29 + - 91.202.109.220/30 + - 46.164.141.64/29 + - 94.153.227.200/30 + - 94.153.227.200/30 + - 217.20.173.100/30 + - 83.170.216.64/27 + - 176.102.36.64/26 + - 3.122.30.161/32 + - 3.123.171.165/32 + - 3.125.134.79/32 + - 3.65.5.240/32 + - 3.73.147.132/32 + dnsManagementPolicy: Managed + scope: External + type: LoadBalancerService +---- +==== + +. *_На інфраструктурі vSphere_*, перед оновленням OKD до версії `4.12.0-0.okd-2023-04-16-041331`, замініть образ `fedora-coreos` для шаблону VM. Це пов'язано з виявленим багом, який може ускладнити створення нових нод після оновлення до версії OKD `4.12.0-0.okd-2023-03-18-084815`. Докладніше про цей баг та інструкції щодо його вирішення можна знайти за посиланням https://access.redhat.com/solutions/6979105[Red Hat Solution 6979105]. ++ +Для розв'язання цієї проблеми, виконайте наступні кроки. ++ +[#download-image-rhcos-ova] +.. Завантажте образ *RHCOS OVA* версії `37.20230218.3.0`. Це можна зробити на сайті https://builds.coreos.fedoraproject.org/browser?stream=stable&arch=x86_64 або за https://builds.coreos.fedoraproject.org/prod/streams/stable/builds/37.20230218.3.0/x86_64/fedora-coreos-37.20230218.3.0-vmware.x86_64.ova[посиланням]. + +.. Відкрийте *vSphere Client* та перейдіть до директорії кластера, де планується оновлення шаблону VM. Натисніть правою клавішею миші по назві директорії та оберіть пункт *Deploy OVF Template*. ++ +image::admin:infrastructure/update-okd/update-okd-18.png[] ++ +[#deploy-ovf-template] +.. Автоматично відкриється вікно *Deploy OVF Template*. + +... У першому розділі *Select an OVF template* оберіть пункт *Local file* та вкажіть шлях до образу *RHCOS OVA*, який було завантажено у пункті xref:#download-image-rhcos-ova[Завантаження образу RHCOS OVA]. ++ +image::admin:infrastructure/update-okd/update-okd-19.png[] + +... У другому розділі *Select a name and folder* введіть будь-яку назву для віртуальної машини та оберіть директорію вашого кластера. ++ +image::admin:infrastructure/update-okd/update-okd-20.png[] + +... У третьому розділі *Select a computer resource* оберіть обчислювальний ресурс в якому буде знаходитись віртуальна машина. ++ +image::admin:infrastructure/update-okd/update-okd-21.png[] + +... У п'ятому розділі *Select storage* оберіть сховище, в яке бажаєте зберегти віртуальну машину. ++ +image::admin:infrastructure/update-okd/update-okd-22.png[] + +... У шостому розділі *Select networks* оберіть мережу для віртуальної машини. ++ +image::admin:infrastructure/update-okd/update-okd-23.png[] + +... Сьомий розділ *Customize template* залиште без змін. ++ +image::admin:infrastructure/update-okd/update-okd-24.png[] + +... У восьмому розділі натисніть кнопку *`Finish`*. ++ +image::admin:infrastructure/update-okd/update-okd-25.png[] + +.. Зачекайте, поки буде створена нова віртуальна машина у нижній частині *vSphere Client*. ++ +image::admin:infrastructure/update-okd/update-okd-26.png[] ++ +[#copy-vm-template-name] +.. Для подальшого створення VM-шаблону знайдіть старий шаблон, з якого запускалися ноди, та скопіюйте його назву. ++ +image::admin:infrastructure/update-okd/update-okd-27.png[] + +.. Знайдіть новостворену віртуальну машину (_крок xref:#deploy-ovf-template[Розгортання OVF-шаблону]_) у директорії кластера. Натисніть по назві правою клавішею миші та оберіть пункт *`Clone`* > *`Clone to Template`*. ++ +image::admin:infrastructure/update-okd/update-okd-28.png[] + +.. Автоматично відкриється вікно *Clone Virtual Machine to Template*. + +... У першому розділі *Select a name and folder* введіть назву шаблону, яка була скопійована на кроці xref:#copy-vm-template-name[Копіювання назви шаблону VM], та допишіть до назви суфікс *`-1`* (_бо старий шаблон зі старою назвою досі існує_). Також оберіть директорію кластера. ++ +image::admin:infrastructure/update-okd/update-okd-29.png[] + +... У другому розділі *Select a compute resource* оберіть обчислювальний ресурс, в якому буде знаходитися шаблон. ++ +image::admin:infrastructure/update-okd/update-okd-30.png[] + +... У третьому розділі *Select storage* оберіть сховище, до якого бажаєте зберегти шаблон. ++ +image::admin:infrastructure/update-okd/update-okd-31.png[] + +... Четвертий розділ *Customize vApp* залиште без змін. ++ +image::admin:infrastructure/update-okd/update-okd-32.png[] + +... У п'ятому розділі *Ready to complete* натисніть кнопку *`Finish`*. ++ +image::admin:infrastructure/update-okd/update-okd-33.png[] + +.. Переконайтеся, що директорія кластера містить два шаблони: + +* Старий +* Новий із суфіксом *`-1`*. Новий шаблон повинен мати оновлені дані на вкладці *Summary*. ++ +image::admin:infrastructure/update-okd/update-okd-34.png[] + +.. Новий шаблон успішно створений та готовий до використання. _Але_ щоб новий шаблон міг використовувати *OKD*, надайте йому назву, як у попереднього шаблону, тобто видаліть суфікс *`-1`*. Це можна зробити двома способами: або видалити старий шаблон, або перейменувати його. Для цього у директорії кластера знайдіть старий шаблон, натисніть на нього правою клавішею миші та оберіть один із двох варіантів: *`Rename`* або *`Delete form Disk`*. У випадку перейменування, до назви слід додати будь-яку послідовність цифр чи літер. ++ +image::admin:infrastructure/update-okd/update-okd-35.png[] + +.. Останньою дією є перейменування новоствореного шаблону, а саме прибирання суфікса `-1`. Для цього у директорії кластера знайдіть новий шаблон з приставкою *-1*, натисніть на нього правою клавішею миші та оберіть пункт *`Rename`*. ++ +image::admin:infrastructure/update-okd/update-okd-36.png[] ++ +Автоматично відкриється вікно перейменування. Далі приберіть приставку *-1*. ++ +image::admin:infrastructure/update-okd/update-okd-37.png[] + +.. (*_Опційно_*) Для перевірки працездатності можна спробувати підняти один інстанс для будь-якого реєстру в *OKD*. Для цього в *OKD* оберіть розділ *machineSets*, знадіть потрібний машин-сет реєстру та встановіть кількість реплік у значення `1`. ++ +image::admin:infrastructure/update-okd/update-okd-38.png[] + +. Після успішного додавання переліку IP до ресурсу *ingresscontroller* (_для *AWS*-інфраструктури_) або заміни образу *`fedora-coreos`* для VM-шаблону (_для *vSphere*-інфраструктури_), у розділі *Administration* > *Cluster Settings* натисніть кнопку *`Select a version`* та оберіть версію OKD `4.12.0-0.okd-2023-04-16-041331`. ++ +NOTE: При оновленні OKD до версії `4.12.0-0.okd-2023-04-16-041331` може з'явитися помилка `"message: Retrieving payload failed version="4.12.0-0.okd-2023-04-16-041331""` (_див. детальніше -- https://github.com/okd-project/okd/discussions/1566#discussioncomment-5633599[]_). ++ +.Приклад помилки +image::admin:infrastructure/update-okd/update-okd-39.png[] ++ +Для розв'язання цієї проблеми, виконайте наступну команду через термінал. ++ +[source,bash] +---- +$ oc patch --type='merge' --patch='\{"spec":\{"desiredUpdate":\{"force":true}}}' clusterversion version +---- + +. Після успішного оновлення OKD до версії `4.12.0-0.okd-2023-04-16-041331`, зніміть ресурс *MachineHealthCheck* з паузи. ++ +[source,bash] +---- +$ oc get machinehealthcheck -n openshift-machine-api +$ oc -n openshift-machine-api annotate mhc cluster.x-k8s.io/paused- +---- + +. Увімкніть розгортання (deployment) *istiod*. ++ +[source,bash] +---- +$ oc scale deployment istiod --replicas=2 -n istio-system +---- + +. У ресурсі *istioOperator* з ім'ям *istiocontrolplane*, у просторі імен `istio-systems` встановіть поле *enabled* у значення `true` для блоку з імʼям `istio-ingressgateway-control-plane-main`. ++ +image::admin:infrastructure/update-okd/update-okd-40.png[] + +. Увімкніть вимкнені реєстри. ++ +Рекомендовано запускати по 1-2 реєстри за раз запропонованим bash-скриптом, що виконує наступні дії для кожного реєстру (кодової бази): ++ +-- +* Виконує патч ресурсу *istiocontrolplane* для повернення роботи `istio` для реєстру. +* Переводить усі *CronJob* реєстру в активний стан. +* Масштабує кількість реплік для MachineSet реєстру відповідно до анотації (_якщо анотації не знайдено, значення кількості реплік за замовчуванням дорівнює 2_). +-- ++ +Приклад синтаксису запуску скрипту файлом *`./registry_turn_on.sh `*, де `` -- назва реєстру, вводити без `< >`. Наприклад: `./registry_turn_on.sh test-registry`. ++ +.*_registry_turn_on.sh_* +[%collapsible] +==== +[source,shellscript] +---- +#!/usr/bin/env bash + +PATCH-ISTIO() { + echo "Turning on Istio ingress gateway in registry ${1}" + indexOfIstioIngressGateways=$(oc get -n istio-system IstioOperator istiocontrolplane -o json | jq '.spec.components.ingressGateways | map(.namespace == "'${1}'") | index(true)') + oc patch -n istio-system IstioOperator istiocontrolplane --type json -p '[{"op": "replace", "path": "/spec/components/ingressGateways/'${indexOfIstioIngressGateways}'/enabled", "value": true}]' +} + +registry=${1} +echo "Registry is ${registry}" +registryMachineSet=$(oc get -n openshift-machine-api MachineSet -o=jsonpath='{.items[?(@.metadata.annotations.meta\.helm\.sh/release-namespace=="'"${registry}"'")].metadata.name}') +registryMachineSetReplicas=$(oc get -n openshift-machine-api MachineSet ${registryMachineSet} -o jsonpath='{.spec.replicas}') +if [ $registryMachineSetReplicas -eq 0 ]; then + echo "Turn on registry ${registryMachineSet}" + PATCH-ISTIO "${registry}" + + for cronjob in $(oc get -n velero CronJobs -o jsonpath='{range .items[*].metadata}{.name}{"\n"}{end}' | grep ${registry}); do + echo "Unsuspend CronJob ${cronjob}" + oc patch -n velero CronJobs ${cronjob} -p '{"spec":{"suspend":true}}' + done + + isAnnotationPresent=$(oc get -n openshift-machine-api MachineSet ${registryMachineSet} -o=jsonpath='{.metadata.annotations.registryMachineSetReplicas}') + + if [ ${isAnnotationPresent} ]; then + echo "Annotation [registryMachineSetReplicas] is present in MachineSet ${registryMachineSet}" + echo "Scale up ${registryMachineSet} to ${isAnnotationPresent} replicas" + oc scale -n openshift-machine-api --replicas=${isAnnotationPresent} MachineSet ${registryMachineSet} + else + echo "Annotation [registryMachineSetReplicas] is not present in MachineSet ${registryMachineSet}" + echo "Scale up ${registryMachineSet} to 2 replicas by default" + oc scale -n openshift-machine-api --replicas=2 MachineSet ${registryMachineSet} + fi + +else + echo "Registry ${registryMachineSet} is running" +fi +---- +==== + +. Поверніть кількість worker-нод з 4 до 3 реплік. ++ +image:admin:infrastructure/update-okd/update-okd-41.png[] + +. Оновіть вручну `ocs`-оператор через вебінтерфейс OKD. ++ +Кроки для оновлення: + +.. Для ресурсу *Subscriptions* із назвою *ocs-operator* у просторі імен `openshift-storage` змініть наступні поля: ++ +---- +.spec.channel - "stable-4.12" +---- ++ +---- +.spec.installPlanApproval - "Automatic" +---- ++ +---- +.spec.startingCSV - "ocs-operator.v4.12.0" +---- + +.. Для ресурсу *Subscriptions* із назвою *mcg-operator-stable-4.11-redhat-operators-openshift-marketplace* у просторі імен `openshift-storage` змініть наступні поля: ++ +---- +.spec.channel - "stable-4.12" +---- ++ +---- +.spec.installPlanApproval - "Automatic" +---- ++ +При спробі редагування ресурсів *Subscriptions* можуть виникати помилки. ++ +image:admin:infrastructure/update-okd/update-okd-42.png[] ++ +Для розв'язання цієї проблеми слід скористатися наступними командами та редагувати ресурси через термінал. ++ +[source,bash] +---- +$ oc -n openshift-storage get subscriptions –o wide +$ oc -n openshift-storage edit subscription ocs-operator +$ oc -n openshift-storage edit subscriptions mcg-operator-stable-4.11-redhat-operators-openshift-marketplace +---- ++ +(*_Опційно_*) Якщо після внесених змін автоматично не почалось оновлення *ocs-operator*, перейдіть до оператора *OpenShift Container Storage* та запустіть оновлення вручну. ++ +image:admin:infrastructure/update-okd/update-okd-43.png[] ++ +NOTE: Через проблему відображання оператора *OpenShift Container Storage* на вкладці *Operators* > *Installed Operators*, знайти оператор можна через Deployment *ocs-operator*, у просторі імен `openshift-storage`. Після віднайдення Deployment, натисніть посилання у рядку *Managed by*, яке веде на сторінку оператора. ++ +image:admin:infrastructure/update-okd/update-okd-44.png[] + +. Запустіть *cluster-mgmt* пайплайн. + +== Ключові проблеми, що були вирішені під час процесу оновлення OKD + +Проблеми, які не були зазначені в офіційній документації та рекомендаціях: + +* Проблема з ресурсом *Machine Config Pool*. MCP для мастер-нод не міг знайти потрібний ресурс *Machine Config*. +* Проблема з невалідним значенням *Upstream configuration*, через яке не починалось оновлення кластера. +* Проблема працездатності `redis-operator` на OKD 4.12 та подальше його оновлення до сумісної з OKD 4.12 версії. +* Проблема працездатності `kafka-operator` на OKD 4.12 та подальше його оновлення до сумісної з OKD 4.12 версії. +* Проблема оновлення та працездатності `ocs-operator` на OKD 4.12 через невалідні CRDs. +* Проблема видалення компонента *NooBaa* через ресурс *StorageCluster*. +* Проблема працездатності `istio-operator` на OKD 4.12 та Ceph, та подальше його оновлення до сумісної з OKD 4.12 версії. +* Проблема працездатності поди `mailu-postfix` через помилку `"fatal: the Postfix mail system is already running"` після оновлення до OKD 4.12. +* Проблема невалідного оновлення OKD 4.11 на 4.12 через несумісний базовий образ (base image) мастер-нод, та подальша ручна заміна AMI для розв'язання проблеми. +* Проблема оновлення OKD на плагінах *OVNKubernetes* та *OpenshiftSDN*. +* Непрацездатність `master`- та `worker`-нод при оновленні OKD до 4.12 через системні сервіси `ovsdb-server`, `openvswitch`, `systemd-sysusers` та `unbound-anchor`. +* Проблема зупинки оновлення `worker`-нод через ресурс *PodDisruptionBudgets*, який блокував процес `drain`. +* Проблема з доступом до `master`- та `worker`-нод та подальше блокування процесу траблшутингу через відсутність доступу за SSH-ключем та авторизації за паролем. +* Проблема з `kubelet`-процесом на мастер-нодах при оновленні OKD до 4.12 на мережевому плагіні *OVNKubernetes*. +* Проблема працездатності поду `machine-config-operator` та `machine-config-controller`, через що процес оновлення OKD зупинявся. +* Проблема з *SELinux* при оновленні на vSphere (_у процесі підтвердження_). +* Проблема зміни хеш-суми образів для OKD 4.12, через що процес оновлення OKD не починався. +* Проблема працездатності реєстрів на нових агентах із новою версією `oc cli`. +* Проблема оновлення `ocs-operator` на OKD 4.12. Не починалося оновлення після оновлення версії в ресурсі *Subscription*. + +== Потребує подальшого тестування + +* Оновлення OKD на vSphere -- _у процесі_. +* QA-тестування сценаріїв Install/Update (OKD, Платформи, реєстрів) на AWS -- _у процесі_. +* QA-тестування сценаріїв Install/Update (OKD, Платформи, реєстрів) на vSphere. +* QA-тестування резервного копіювання та відновлення компонентів Control Plane та реєстрів -- _у процесі_. +* Оновлення OKD з версії `4.11.0-0.okd-2022-07-29-154152`, що розгорнута у середовищі *EnvOne*, *КРРТ*. +* Резервне копіювання та відновлення `master`-ів та *etcd*. +* Загальний Recovery-процес у випадку зупинки або невдалого оновлення OKD. diff --git a/docs/ua/modules/admin/pages/update/update-registry-components.adoc b/docs/ua/modules/admin/pages/update/update-registry-components.adoc index a3ffdf68cb..35f3ea0a70 100644 --- a/docs/ua/modules/admin/pages/update/update-registry-components.adoc +++ b/docs/ua/modules/admin/pages/update/update-registry-components.adoc @@ -30,9 +30,9 @@ include::platform:ROOT:partial$admonitions/language-ua.adoc[] . Увійдіть до адміністративної панелі керування кластером та реєстрами *Control Plane*. + -image:infrastructure/cluster-mgmt/update-cluster-mgmt-01.png[] +image:infrastructure/cluster-mgmt/update-cluster-mgmt-ua-01.png[] -. Відкрийте меню _Реєстри_. +. Відкрийте меню *Реєстри*. . Увійдіть до налаштувань реєстру. + image:infrastructure/update-registry-components/update-registry-components-1.png[] diff --git a/docs/ua/modules/admin/pages/update/update_cluster-mgmt.adoc b/docs/ua/modules/admin/pages/update/update_cluster-mgmt.adoc index d0b4e0720f..f21508f0aa 100644 --- a/docs/ua/modules/admin/pages/update/update_cluster-mgmt.adoc +++ b/docs/ua/modules/admin/pages/update/update_cluster-mgmt.adoc @@ -39,10 +39,10 @@ TIP: *Cluster Management* або *cluster-mgmt* -- це композитний . Увійдіть до адміністративної панелі керування кластером та реєстрами *Control Plane*. + -image:infrastructure/cluster-mgmt/update-cluster-mgmt-01.png[] +image:infrastructure/cluster-mgmt/update-cluster-mgmt-ua-01.png[] -. Відкрийте меню _Керування кластером_. -. У правому верхньому куті сторінки натисніть `Редагувати`. +. Відкрийте меню *Керування Платформою*. +. У правому верхньому куті сторінки натисніть *`Редагувати`*. + image:admin:infrastructure/cluster-mgmt/update-cluster-mgmt-1.png[] . На сторінці, що відкрилася, знайдіть секцію _Оновлення кластера_. diff --git a/docs/ua/modules/admin/pages/user-management-auth/user-management.adoc b/docs/ua/modules/admin/pages/user-management-auth/.user-management.adoc similarity index 99% rename from docs/ua/modules/admin/pages/user-management-auth/user-management.adoc rename to docs/ua/modules/admin/pages/user-management-auth/.user-management.adoc index b12ac1b02e..3067efef7b 100644 --- a/docs/ua/modules/admin/pages/user-management-auth/user-management.adoc +++ b/docs/ua/modules/admin/pages/user-management-auth/.user-management.adoc @@ -19,6 +19,8 @@ = Управління користувачами +IMPORTANT: Документ застарів і зберігається в репозиторії для історії. Окремі аспекти, висвітлені на цій сторінці, доступні як окремі статті в документації продукту. + [WARNING] ==== Рекомендуємо виконувати усі налаштування, використовуючи браузер link:https://www.google.com/intl/uk_ua/chrome/[Google Chrome] для стабільної роботи усіх сервісів. @@ -699,7 +701,7 @@ spec: . Увійдіть до консолі Control Plane як тимчасовий адміністратор. + -image:admin:infrastructure/cluster-mgmt/update-cluster-mgmt-01.png[] +image:admin:infrastructure/cluster-mgmt/update-cluster-mgmt-ua-01.png[] . Перейдіть до розділу _Керування платформою_ > _Редагувати_. + diff --git a/docs/ua/modules/admin/pages/user-management-auth/keycloak-create-users.adoc b/docs/ua/modules/admin/pages/user-management-auth/keycloak-create-users.adoc deleted file mode 100644 index 48e2e2a7c3..0000000000 --- a/docs/ua/modules/admin/pages/user-management-auth/keycloak-create-users.adoc +++ /dev/null @@ -1,162 +0,0 @@ -= Створення користувачів та надання їм прав доступу -:toc: -:toc-title: ЗМІСТ -:toclevels: 5 -:sectnums: -:sectnumlevels: 5 -:sectanchors: - -== Загальний опис - -Створення нових користувачів та надання їм прав доступу до інструментів реєстру здійснюється в **консолі адміністратора** сервісу https://www.keycloak.org/[Keycloak]. - -//TODO: Додати інструкцію: "Як отримати доступ до Keycloak?" - -[realms-access] -=== Доступ до реалмів реєстру - -Адміністратор Платформи повинен мати доступ до 4-х reamlfootnote:[*Realm* - це концепція в https://www.keycloak.org/[Keycloak], яка відноситься до об’єкта, -що керує набором користувачів, а також їхніми обліковими даними, ролями та групами.] реєстру: `-admin`, `officer-portal`, `-citizen-portal`, `external-system`. - -.Реалми реєстру та їх призначення - -|=== -|Realm |Призначення - -|`-admin` -|Реалм для доступу до адміністративних інструментів, таких як Gerrit, Jenkins, Camunda реєстру. - -|`-officer-portal` -|Призначення ролей для доступу до Кабінету Посадової особи (**Officer Portal**) та звітів (https://redash.io/[Redash]). - -|`-citizen-portal` -|Призначення ролей для доступу до Кабінету отримувача послуг (**Citizen Portal**). - -|`-external-system` -|Призначення ролей для доступу до зовнішніх систем(наприклад, "Трембіта" та ін.). - -|=== - -image:admin:user-management-auth/keycloak/keycloak-permissions/realms-list.png[] - -== Створення нового користувача в Keycloak - -Для створення нового користувача в Keycloak, необхідно виконати наступні кроки: - -* Перейдіть до необхідного realm відповідного реєстру: -** на вкладці **Users** натисніть `View all users`; -** натисніть кнопку `Add user`. - -image:admin:user-management-auth/keycloak/keycloak_view_users.png[] - -* У відкритому вікні введіть дані користувача: - -** `Username` -- унікальний ідентифікатор користувача у системі. -** `Email` -- електронна пошта користувача (_поле не є обов'язковим_). -** `First Name` -- ім'я користувача (_поле не є обов'язковим_). -** `Last Name` -- прізвище (_поле не є обов'язковим_). -** `User Enabled` -- позначка, що користувач активований у системі (якщо вона не активна, доступ такого користувача до систем буде обмежено). - -* Натисніть кнопку `Save` та перейдіть на вкладку **Credentials**. - -image:admin:user-management-auth/keycloak/keycloak_add_user.png[] - -* Введіть пароль у полі `Password` та підтвердьте його в полі `Password Confirmation`. + -Активуйте позначку `Temporary`, щоб згенерувати тимчасовий пароль. - -CAUTION: _З метою безпеки необхідно змінити тимчасовий пароль при першому логіні._ - -* Натисніть кнопку `Save Password`. - -image:admin:user-management-auth/keycloak/keycloak_set_credentials.png[] - -* Перейдіть на вкладку **Role Mappings** та призначте необхідні ролі користувачу. - -* Натисніть кнопку `Add selected`, щоб обрана роль відображалася в секції **Assigned Roles**. - -image:admin:user-management-auth/keycloak/keycloak_assign_roles_check.png[] - -== Налаштування доступу адміністратора регламенту - -У реалмі `-admin` створіть користувача та призначте йому наступні ролі: - -image:admin:user-management-auth/keycloak/keycloak-permissions/admin-user-roles-list.png[] - -** `gerrit-administrators` -- адміністратори Gerrit, роль необхідна для розгортання регламенту та підтвердження змін (проходження Quality gates); -** `jenkins-administrators` -- адміністратори Jenkins, роль необхідна для запуску `clean-up` job, перегляду згенерованих та доданих до Jenkins pipelines, перегляду логів та ін.; -** `camunda-admin` -- адміністратор Camunda Cockpit, роль необхідна для перегляду доступних бізнес-процесів, правил, задач тощо. - -[NOTE] -==== -_Окрім ролі, користувачеві необхідно призначити групу:_ - -* _перейдіть до вкладки **Groups** -> **Available Groups**;_ -* _оберіть `camunda-admin`;_ -* _натисніть `join`._ - -_В результаті, група має з'явитися в переліку **Group Membership**._ -==== - -image:admin:user-management-auth/keycloak/keycloak-permissions/admin-user-groups.png[] - -== Типи ролей для Кабінетів посадової особи та отримувача послуг реєстру - -Ролі у системі Keycloak розподілені на **системні** та **регламентні**: - -* **Системні** -- створюються Платформою під час розгортання реєстру або встановлення Платформи (наприклад, `officer`, `citizen`, `auditor` тощо). -* **Регламентні** -- створюються під час розгортання реєстру та налаштовуються в регламенті реєстру -> директорія `roles` -> у відповідному конфігураційному файлі `.yml`. - -TIP: _Наприклад, створення ролей Кабінету посадової особи відбувається через налаштування їх у відповідному файлі `officer.yml`:_ - -image:admin:user-management-auth/keycloak/keycloak-permissions/registry-roles.png[] - -== Адміністрування доступу користувачів до Кабінету посадової особи - -Для створення нового користувача **Кабінету посадової особи** необхідно виконати наступні кроки: - -* Перейдіть до реалму `-officer-portal` відповідного реєстру: -** на вкладці **Users** натисніть кнопку `View all users` -> далі натисніть кнопку `Add user`. - -image:admin:user-management-auth/keycloak/keycloak-permissions/officer-realm-users-list.png[] - -* Виконайте кроки зі створення користувача, описані вище, та встановіть роль `officer` на вкладці **Role Mappings**. -* Оберіть необхідні регламентні ролі (наприклад, `head-officer`). -* Оберіть роль `auditor` у разі необхідності доступу до системних звітів Redash -- **Журнал подiй системи** та **Журнал дій користувача**) -* Натисніть кнопку `Add selected`. - -image:admin:user-management-auth/keycloak/keycloak-permissions/officer-sidorenko-user-roles.png[] - -* Перейдіть на вкладку **Attributes** та встановіть значення для ключів параметрів `drfo`, `edrpou` та `fullName`, що пов'язані з КЕП користувача. - -[TIP] -==== -_Наприклад:_ - -** `drfo:1010101014`; -** `edrpou: 34554362`; -** `fullName: Сидоренко Василь Леонідович`. -==== - -image:admin:user-management-auth/keycloak/keycloak-permissions/officer-sidorenko-user-attributes.png[] - -CAUTION: _У разі невідповідності значень атрибутів до значень, заданих у КЕП, користувач не матиме можливості увійти до Кабінету посадової особи та підписувати задачі КЕП._ - -== Адміністрування доступу користувачів до Кабінету отримувача послуг - -Створення користувача Кабінету отримувача послуг відбувається **при першому вході до Кабінету**. Користувачеві пропонується **пройти початковий бізнес-процес** -- **«Створення суб'єкта»**, де необхідно вказати Email. - -В результаті дані користувача з'являться в Keycloak, у реалмі `-citizen`, з відповідними ролями (`legal`, `entrepreneur`, `individual` та ін.) та атрибутами. - -image:admin:user-management-auth/keycloak/keycloak-permissions/citizen-realm-users-list.png[] - -image:admin:user-management-auth/keycloak/keycloak-permissions/citizen-legal-roles.png[] - -image:admin:user-management-auth/keycloak/keycloak-permissions/citizen-legal-attributes.png[] - -== Адміністрування доступу до зовнішніх систем - -Створення користувачів для доступу до зовнішніх систем дизайном Платформи не передбачається. - -Всі доступи надаються на рівні ролей та клієнта `trembita-invoker` (у випадку із СЕВ ДЕІР «Трембіта»). У разі необхідності, є можливість додати регламентні ролі, що будуть залучені для побудови бізнес-процесів. - - diff --git a/docs/ua/modules/admin/pages/user-management-auth/users-upload.adoc b/docs/ua/modules/admin/pages/user-management-auth/users-upload.adoc deleted file mode 100644 index 8055de9fa0..0000000000 --- a/docs/ua/modules/admin/pages/user-management-auth/users-upload.adoc +++ /dev/null @@ -1,141 +0,0 @@ -:toc-title: ЗМІСТ -:toc: auto -:toclevels: 5 -:experimental: -:important-caption: ВАЖЛИВО -:note-caption: ПРИМІТКА -:tip-caption: ПІДКАЗКА -:warning-caption: ПОПЕРЕДЖЕННЯ -:caution-caption: УВАГА -:example-caption: Приклад -:figure-caption: Зображення -:table-caption: Таблиця -:appendix-caption: Додаток -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - -= Пояснення до заповнення файлу «Users_Upload» - -*Для автоматичного завантаження користувачів до системи управління користувачами:* - -. Завантажте шаблон CSV-файлу Users_Upload.csv за посиланням на екрані. -. Відкрийте завантажений файл та заповніть колонки шаблону своїми значеннями згідно з поясненнями, поданими нижче. Заповнені поля не повинні мати додаткових пробілів на початку та в кінці значення. CSV-роздільник між колонками – крапка з комою. -. Завантажте заповнений файл на сторінку Кабінету адміністратора регламентів та натисніть кнопку підтвердження. Зачекайте декілька хвилин до повного завантаження користувачів реєстру. Результат можна переглянути в технічних логах за посиланням на екрані. - -*Пояснення до заповнення файлу "Users_Upload", для мінімізації помилок:* - -[WARNING] -==== -При заповненні колонок drfo, edrpou і fullName потрібно обов'язково використовувати дані, що вказані в кваліфікаційному електронному підписі (КЕП) юридичної особи, яку представлятиме посадова особа. -==== - -. `*drfo*` – особистий реєстраційний номер облікової картки платника податків (РНОКПП). Код РНОКПП містить 10 цифр. Якщо через релігійні переконання особа не отримувала РНОКПП, необхідно вказати серію та номер паспорта або номер ID-картки. При внесенні серії та номера паспорта необхідно звернути увагу, як саме ці дані записані у КЕП з точністю до символу (з пробілом чи без). *Поле обов'язкове до заповнення.* -+ -Для перевірки даних у КЕП можна скористатися порталом Дія: https://id.diia.gov.ua/. Виконайте вхід та оберіть спосіб авторизації _Файловий ключ_ або _Апаратний ключ_, залежно від вашого носія. У правому верхньому куті сторінки відкрийте меню *«Мій профіль»*. У блоці *«Персональні дані»* ви побачите інформацію про свій КЕП. - -. `*edrpou*` – унікальний ідентифікаційний номер юридичної особи в Єдиному державному реєстрі підприємств та організацій України. Ідентифікаційні коди ЄДРПОУ містять 8 цифр. Якщо перша цифра в ЄДРПОУ – нуль, то спочатку обов'язково потрібно змінити формат клітинки на *_Текстовий_* (натисність правою клавішею на поле та оберіть *_«Формат клітинок»_*) і після цього ввести значення. *Поле обов'язкове до заповнення.* - -. `*fullName*` – прізвище, ім'я, по батькові (за наявності). Має містити більше 3-х, але не менше 2-х слів. ПІБ повинне мати 100% співпадіння із даними у КЕП з точністю до символу. *Поле обов'язкове до заповнення.* -+ -[CAUTION] -==== -У разі невідповідності значень атрибутів до значень, вказаних у КЕП, користувач не матиме можливості увійти до Кабінету посадової особи та підписувати задачі КЕП. -==== -<<< -+ -. `*Realm Roles*` – перелік системних та регламентних (за наявності) ролей користувача. *Для Кабінету посадової особи обов'язквою є одна системна роль –* `*officer*`. Якщо посадова особа має додатково визначені регламентні ролі, вони вносяться через кому після значення `*officer*`. Управління регламентними ролями здійснює Адміністратор реєстру, інформацію про те, чи передбачені у конкретному реєстрі регламентні ролі, і які саме, можна дізнатися у нього. -+ -[WARNING] -==== -За відсутності системної ролі, користувач не матиме доступу до Кабінету посадової особи. - -* Системна роль *`officer`* створюється Платформою під час розгортання реєстру або встановлення Платформи. -* Регламентні ролі створюються під час розгортання реєстру та налаштовуються у регламенті реєстру → директорія _roles_ → у відповідному конфігураційному файлі _*.yml_. -==== - -+ -. `*KATOTTG*` – перелік кодів з Кодифікатора адміністративно-територіальних одиниць та територій територіальних громад. -+ -[NOTE] -==== -Поле обов'язкове для реєстрів, які використовують рольову модель за територіальною ознакою, для інших реєстрів необов'язкове. -==== -+ -Значення складається із літер «UA», за якими слідують 17 цифр. Якщо користувач матиме доступ до декількох територіальних одиниць, їх коди вносяться через кому. Максимально можлива кількість значень для одного користувача – 16. Користувач Кабінету посадової особи матиме доступ до записів саме тієї області/району/територіальної громади тощо, код якої буде вказано. -+ -У випадку надання користувачу доступу до записів всієї України в значенні KATOTTG потрібно вказати тільки два символи – *UA*. -+ -Для визначення коду KATOTTG потрібно скористатись найактуальнішим файлом «Кодифікатор» за link:https://www.minregion.gov.ua/napryamki-diyalnosti/rozvytok-mistsevoho-samovryaduvannya/administratyvno/kodyfikator-administratyvno-terytorialnyh-odynycz-ta-terytorij-terytorialnyh-gromad/[посиланням]. Код адміністративно-територіальної одиниці слід обирати з тієї колонки файлу, на рівні якої посадовій особі буде надано права доступу. -+ -Перелік можливих значень в колонці «Категорія об'єкта» файлу Кодифікатор: -+ -|=== -|*_Рівень_*|*_Значення_* -|Перший рівень|«O» – Автономна Республіка Крим, області - -«K» – міста, що мають спеціальний статус -|Другий рівень|«P» – райони в областях та Автономній Республіці Крим -|Третій рівень|«H» – території територіальних громад (назви територіальних громад) в областях, територіальні громади Автономної Республіки Крим -|Четвертий рівень|«M» – міста - -«T» – селища міського типу - -«C» – села - -«X» – селища -|Додатковий рівень|«B» – райони в містах -|=== -+ -ПРИКЛАД 1: :: -Вам необхідно надати доступ користувачу до Кабінету посадової особи на рівні Миргородської територіальної громади (Третій рівень) Полтавської області. Для цього: -• в колонці «Категорія об'єкта» виберіть значення «Н»; -• в колонці «Назва об'єкта» введіть в пошуку назву територіальної громади «Миргородська»; -• скопіюйте з колонки «Третій рівень» код значення територіальної одиниці (UA53060230000098362). -+ -У деяких випадках пошук з Прикладу 1 видасть вам декілька однакових значень (якщо на території України існує більше, ніж одна територіальна одиниця на одному рівні з тією самою назвою). В цьому разі використовуйте пошук, описаний у Прикладі 2. - -+ -ПРИКЛАД 2: :: -Вам необхідно надати доступ користувачу до Кабінету посадової особи на рівні Шевченківського району м.Полтава (Додатковий рівень). Для цього: -• спочатку в колонці «Категорія об'єкта» виберіть значення «О»; -• в колонці «Назва об'єкта» введіть в пошуку назву області «Полтавська»; -• скопіюйте з колонки «Перший рівень» код значення області (UA53000000000028050); -• за допомогою фільтра залиште лише ті значення, які в колонці «Перший рівень» містять значення UA53000000000028050; -• в колонці «Категорія об'єкта» виберіть значення «В»; -• в колонці «Назва об'єкта» введіть в пошуку назву району «Шевченківський»; -• скопіюйте з колонки «Додатковий рівень» код значення територіальної одиниці (UA53080370010339303). - -<<< - -Приклад заповнення файлу: :: -|=== -|*drfo*|*edrpou*|*fullName*|*Realm Roles*|*KATOTTG* -|1010101018|34554362|Сидоренко Василь Леонідович|officer|UA32000000000030281 -|3030303033|33333333|Степанченко Степан Степанович|officer|UA32020000000057002 -|СО 522654|20559371|Алмаз-заде Гайяне Мухамедівна|officer, head-officer `*`|UA32020050000062595, UA32020170000020698 -|2354689712|20553149|Петру Іон|officer|UA32020050040035161 -|=== - -`*`- приклад регламентної ролі, яка може бути створена в реєстрі додатково до основної системної ролі officer. У кожному реєстрі перелік регламентних ролей налаштовується індивідуально і може відрізнятися. - -{empty} + -{empty} + - -[TIP] -==== -За необхідності після колонки KATOTTG ви можете додати до файлу *`довільні колонки`*. Вони будуть збережені в атрибути користувачів з тією ж назвою та значеннями, з якими ви внесете їх в файл. Наприклад, в csv-файлі ви створили додаткову колонку з назвою *_city_* і заповнили це значення в кожному рядку. В результаті у кожного користувача з'явиться в системі атрибут з назвою *`city`* і значеннями з csv-файлу. - -Заборонено включати до значення спеціальні символи ([, ], {, }, \, "), а також значення, які містять понад 200 символів. -Назва кожного додаткового атрибута обов'язково повинна бути однаковою для всіх користувачів реєстру і мати унікальну назву серед інших параметрів. - -Приклад заповнення файлу з довільною колонкою `city`: :: -|=== -|*drfo*|*edrpou*|*fullName*|*Realm Roles*|*KATOTTG*|*city* -|1010101018|34554362|Сидоренко Василь Леонідович|officer|UA32000000000030281|Київ -|2354689712|20553149|Петру Іон|officer|UA32020050040035161|Дніпро -|=== - -==== \ No newline at end of file diff --git a/docs/ua/modules/admin/partials/nav.adoc b/docs/ua/modules/admin/partials/nav.adoc index a003737fd2..407eb658ba 100644 --- a/docs/ua/modules/admin/partials/nav.adoc +++ b/docs/ua/modules/admin/partials/nav.adoc @@ -11,9 +11,12 @@ **** xref:admin:installation/platform-deployment/platform-vsphere-deployment.adoc[] *** xref:admin:installation/internal-smtp-server-setup.adoc[] *** xref:admin:installation/changing-network-provider.adoc[] -*** xref:installation/griada/griada-301-deployment.adoc[Розгортання програмного емулятора криптомодуля Гряда-301] -+ -//TODO:Update or deprecate*** xref:admin:user-management-auth/keycloak-create-users.adoc[] +*** xref:admin:installation/griada/griada-301-deployment.adoc[Розгортання програмного емулятора криптомодуля Гряда-301] +*** xref:admin:installation/admins-security/overview.adoc[] +**** xref:admin:installation/admins-security/password-policy.adoc[] +**** xref:admin:installation/admins-security/2fa.adoc[] +**** xref:admin:installation/admins-security/bruteforce-protection.adoc[] +*** xref:admin:installation/push-docker-image-cp-nexus.adoc[] + // ====================== CONTROL PLANE ========================= ** xref:admin:registry-management/overview.adoc[] @@ -23,9 +26,13 @@ *** xref:admin:registry-management/control-plane-remove-registry.adoc[] *** xref:admin:registry-management/control-plane-registry-grant-access.adoc[] *** xref:admin:registry-management/system-keys/system-keys-overview.adoc[] -**** xref:admin:registry-management/system-keys/control-plane-platform-keys.adoc[] -**** xref:admin:registry-management/system-keys/control-plane-registry-keys.adoc[] -**** xref:admin:registry-management/system-keys/create-qes-keys-test-ca-iit.adoc[] +**** Ключі цифрового підпису +***** xref:admin:registry-management/system-keys/control-plane-platform-keys.adoc[] +***** xref:admin:registry-management/system-keys/control-plane-registry-keys.adoc[] +***** xref:admin:registry-management/system-keys/create-qes-keys-test-ca-iit.adoc[] +**** Сертифікати для перевірки підписів +***** xref:admin:registry-management/system-keys/control-plane-platform-certificates.adoc[] +***** xref:admin:registry-management/system-keys/control-plane-registry-certificates.adoc[] *** xref:admin:registry-management/control-plane-registry-resources.adoc[] *** xref:admin:registry-management/custom-dns/custom-dns-overview.adoc[] **** xref:admin:registry-management/custom-dns/cp-custom-dns-portals.adoc[] @@ -34,7 +41,9 @@ *** xref:admin:registry-management/control-plane-submit-mr.adoc[] *** xref:admin:registry-management/control-plane-digital-documents.adoc[] *** xref:admin:registry-management/control-plane-soap-api-access-trembita.adoc[] -*** xref:admin:registry-management/control-plane-quick-links.adoc[] +*** Швидкі посилання до сервісів +**** xref:admin:registry-management/platform/platform-management-quick-links.adoc[] +**** xref:admin:registry-management/control-plane-quick-links.adoc[] + // ===================== МІГРАЦІЯ РЕЄСТРІВ ======================== ** xref:admin:migration/migration-overview.adoc[] @@ -43,20 +52,24 @@ + //========================= ОНОВЛЕННЯ ========================= ** xref:admin:update/overview.adoc[] +*** xref:admin:update/special-steps-for-update/special-steps.adoc[] *** xref:admin:update/update_cluster-mgmt.adoc[] *** xref:admin:update/update-registry-components.adoc[] +*** xref:admin:update/update-okd-4-12.adoc[] *** xref:admin:update/certificates-update.adoc[] + // Резервне копіювання та відновлення ** xref:admin:backup-restore/overview.adoc[] +*** Відновлення кластера +**** xref:admin:disaster-recovery/cluster-disaster-recovery.adoc[Аварійне відновлення роботи кластера у випадку збоїв] +**** xref:backup-restore/master_ip_repair.adoc[Відновлення master-нод кластера] *** Центральні компоненти **** xref:admin:backup-restore/control-plane-components-backup-restore.adoc[] **** xref:admin:backup-restore/backup-schedule-cluster-mgmt.adoc[] *** Середовище реєстру **** xref:admin:backup-restore/control-plane-backup-restore.adoc[] **** xref:admin:backup-restore/backup-schedule-registry-components.adoc[] -*** xref:admin:backup-restore/postgres-backup-restore.adoc[] -*** xref:admin:backup-restore/master_ip_repair.adoc[] +**** xref:admin:backup-restore/postgres-backup-restore.adoc[] + // Масштабування ** xref:admin:scaling/overview.adoc[] diff --git a/docs/ua/modules/admin/partials/templates/snippets/backup-restore-planning-ua.adoc b/docs/ua/modules/admin/partials/templates/snippets/backup-restore-planning-ua.adoc new file mode 100644 index 0000000000..ed5b662540 --- /dev/null +++ b/docs/ua/modules/admin/partials/templates/snippets/backup-restore-planning-ua.adoc @@ -0,0 +1 @@ +NOTE: Важливо планувати створення резервних копій на час, коли ваша система найменш завантажена. Рекомендуємо робити це вночі. Так все пройде плавно і без зайвих незручностей. \ No newline at end of file diff --git a/docs/ua/modules/admin/partials/templates/snippets/registry-resources-ua.adoc b/docs/ua/modules/admin/partials/templates/snippets/registry-resources-ua.adoc index 944050445d..40b0375805 100644 --- a/docs/ua/modules/admin/partials/templates/snippets/registry-resources-ua.adoc +++ b/docs/ua/modules/admin/partials/templates/snippets/registry-resources-ua.adoc @@ -1,12 +1,19 @@ Дозволяє налаштувати параметри з'єднання із базою даних -- *Database connection parameters*: - -* *Maximum pool size* (_за замовчуванням_ `10`): + +.Конфігурація пулу з'єднань +[options="header",cols="30%,10%,60%"] +|=== +| Параметр | Значення за замовчуванням | Опис + +| *Maximum pool size* (_Допустиме значення параметра > 0_) +| `10` +a| Параметр *Maximum pool size* вказує на максимальну кількість одночасних з'єднань до бази даних, які можуть бути створені та підтримувані пулом з'єднань. -Пул з'єднань -- це набір відкритих з'єднань, які підтримуються з метою підвищення продуктивності та ефективності доступу до бази даних. -Замість відкриття нового з'єднання з базою даних при кожному запиті, використовується одне із вже відкритих з'єднань із пулу. -Це дозволяє зекономити час та ресурси. -+ -Наприклад, якщо *Maximum pool size* встановлено у значення `10`, то максимум 10 запитів можуть одночасно взаємодіяти із базою даних через пул. Якщо одинадцятий запит намагається отримати доступ, йому доведеться чекати, поки одне з наявних з'єднань не буде віддано назад до пулу. + +Пул з'єднань -- це набір відкритих з'єднань, які підтримуються з метою підвищення продуктивності та ефективності доступу до бази даних. Замість відкриття нового з'єднання з базою даних при кожному запиті, використовується одне із вже відкритих з'єднань із пулу. Це дозволяє зекономити час та ресурси. + +Наприклад, якщо *Maximum pool size* встановлено у значення `10`, то максимум 10 запитів можуть одночасно взаємодіяти із базою даних через пул. Якщо одинадцятий запит намагається отримати доступ, йому доведеться чекати, поки одне з наявних з'єднань не буде віддано назад до пулу. Вибір правильного розміру пулу з'єднань важливий для оптимальної роботи сервісу. Занадто малий пул може призвести до затримок, оскільки додаткові запити будуть очікувати доступу, але занадто великий пул може використовувати надмірні системні ресурси. + +|=== + -Вибір правильного розміру пулу з'єднань важливий для оптимальної роботи сервісу. Занадто малий пул може призвести до затримок, оскільки додаткові запити будуть очікувати доступу, але занадто великий пул може використовувати надмірні системні ресурси. \ No newline at end of file +image:admin:registry-management/registry-resources/registry-resources-9.png[] diff --git a/docs/ua/modules/arch/attachments/architecture-workspace/performance/registry-resources.xlsx b/docs/ua/modules/arch/attachments/architecture-workspace/performance/registry-resources.xlsx new file mode 100644 index 0000000000..06b10462c7 Binary files /dev/null and b/docs/ua/modules/arch/attachments/architecture-workspace/performance/registry-resources.xlsx differ diff --git a/docs/ua/modules/arch/attachments/architecture-workspace/platform-evolution/auto-remove-on-deploy/fsp-getList-swagger.yml b/docs/ua/modules/arch/attachments/architecture-workspace/platform-evolution/auto-remove-on-deploy/fsp-getList-swagger.yml new file mode 100644 index 0000000000..f3a886cde6 --- /dev/null +++ b/docs/ua/modules/arch/attachments/architecture-workspace/platform-evolution/auto-remove-on-deploy/fsp-getList-swagger.yml @@ -0,0 +1,157 @@ +openapi: 3.0.1 +info: + title: OpenAPI definition + version: v0 +servers: +- url: https://form-schema-provider-mdtu-ddm-edp-cicd-platform-sit.apps.cicd2.mdtu-ddm.projects.epam.com + description: Generated server url +paths: + # "/api/forms/{key}": + # get: + # tags: + # - form-schema-provider-controller + # summary: отримати ресурс по ідентифікатору + # description: Використовується для отримання об’єктів. Не змінює стан ресурсу + # operationId: getForm + # parameters: + # - name: key + # in: path + # required: true + # schema: + # type: string + # - name: X-Access-Token + # in: header + # required: false + # schema: + # type: string + # responses: + # '200': + # description: OK з результатом + # content: + # "*/*": + # schema: + # type: object + # properties: + # empty: + # type: boolean + # additionalProperties: + # type: object + # '401': + # description: Помилка аутентифікації (відсутній токен або цифровий підпис) + # '403': + # description: Недостатньо прав для виконання операції (роль користувача не + # передбачає доступу до даного ресурсу) + # '500': + # description: Внутрішня помилка сервера + # '501': + # description: Не імплементовано (використовується для заглушок) + # put: + # tags: + # - form-schema-provider-controller + # summary: змінити ресурс + # description: Використовується для зміни вже існуючого ресурсу з вказанням id + # operationId: updateForm + # parameters: + # - name: key + # in: path + # required: true + # schema: + # type: string + # - name: X-Access-Token + # in: header + # required: false + # schema: + # type: string + # requestBody: + # content: + # application/json: + # schema: + # type: string + # required: true + # responses: {} + # delete: + # tags: + # - form-schema-provider-controller + # summary: видалити ресурс + # description: Використовується для видалення ресурсу з вказанням id + # operationId: deleteFormByKey + # parameters: + # - name: key + # in: path + # required: true + # schema: + # type: string + # - name: X-Access-Token + # in: header + # required: false + # schema: + # type: string + # responses: {} + "/api/forms": + # post: + # tags: + # - form-schema-provider-controller + # summary: створити ресурс + # description: Використовується для створення ресурсу. + # operationId: saveForm + # parameters: + # - name: X-Access-Token + # in: header + # required: false + # schema: + # type: string + # requestBody: + # content: + # application/json: + # schema: + # type: string + # required: true + # responses: + # '200': + # description: OK з результатом + # '400': + # description: Некоректні вхідні дані (наприклад, неправильний тип поля) + # '401': + # description: Помилка аутентифікації (відсутній токен або цифровий підпис) + # '403': + # description: Недостатньо прав для виконання операції (роль користувача не + # передбачає доступу до даного ресурсу) + # '422': + # description: Помилка валідації, запит містить дані, що не відповідають правилам + # вказаним в домені + # '500': + # description: Внутрішня помилка сервера + # '501': + # description: Не імплементовано (використовується для заглушок) + get: + tags: + - form-schema-provider-controller + summary: отримати список ідентифікаторів усіх ресурсів + description: Використовується для отримання об'єктів. Не змінює стан ресурсу + operationId: getList + parameters: + - name: X-Access-Token + in: header + required: false + schema: + type: string + responses: + '200': + description: OK з результатом + content: + application/json: + schema: + type: array + items: + type: string + '401': + description: Помилка аутентифікації (відсутній токен або цифровий підпис) + '403': + description: Недостатньо прав для виконання операції (роль користувача не + передбачає доступу до даного ресурсу) + '500': + description: Внутрішня помилка сервера + '501': + description: Не імплементовано (використовується для заглушок) +components: + schemas: {} diff --git a/docs/ua/modules/arch/attachments/architecture-workspace/platform-evolution/citizen-id-gov-ua/digital-signature-ops-swagger.yml b/docs/ua/modules/arch/attachments/architecture-workspace/platform-evolution/citizen-id-gov-ua/digital-signature-ops-swagger.yml new file mode 100644 index 0000000000..4be0f4839b --- /dev/null +++ b/docs/ua/modules/arch/attachments/architecture-workspace/platform-evolution/citizen-id-gov-ua/digital-signature-ops-swagger.yml @@ -0,0 +1,260 @@ +openapi: 3.0.1 +info: + title: OpenAPI definition + version: v0 +paths: + /api/key/decrypt: + post: + tags: + - digital-key-controller + summary: Returns decrypted user info data + description: Decrypts user info data + operationId: decryptUserInfo + parameters: + - in: query + name: keyName + schema: + type: string + required: false + description: Name of the key to use for the operation + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/DecryptUserInfoRequest' + required: true + responses: + '200': + description: Request processed successfully and user info data is returned in body + content: + '*/*': + schema: + $ref: '#/components/schemas/UserInfoResponse' + /api/file/sign: + post: + tags: + - digital-signature-file-controller + summary: Signs file in specified Ceph bucket + description: Applies system signature to file in Ceph and updates it in storage + operationId: sign + parameters: + - in: query + name: keyName + schema: + type: string + required: false + description: Name of the key to use for the operation + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/SignFileRequestDto' + required: true + responses: + '200': + description: File signed and updated successfully + content: + '*/*': + schema: + $ref: '#/components/schemas/SignFileResponseDto' + '404': + description: File not found in storage + content: + '*/*': + schema: + $ref: '#/components/schemas/SignFileResponseDto' + '500': + description: Internal server error in case of error at any processing steps + content: + '*/*': + schema: + $ref: '#/components/schemas/SignFileResponseDto' + /api/eseal/sign: + post: + tags: + - digital-seal-controller + summary: Signs data passed in request + description: Applies digital signature by system key for requested data + operationId: sign_1 + parameters: + - in: query + name: keyName + schema: + type: string + required: false + description: Name of the key to use for the operation + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/SignRequestDto' + required: true + responses: + '200': + description: Request processed successfully signature returned in body + content: + '*/*': + schema: + $ref: '#/components/schemas/SignResponseDto' + '400': + description: Passed headers or request body has invalid syntax + content: + '*/*': + schema: + $ref: '#/components/schemas/SignResponseDto' + '500': + description: Internal server error in case of error at any processing steps + content: + '*/*': + schema: + $ref: '#/components/schemas/SignResponseDto' + /api/key/certificate: + get: + tags: + - digital-key-controller + summary: Returns private key certificate initialized in application + description: Certificate is Base64 cert file encoded to url representation + operationId: certificate + parameters: + - in: query + name: keyName + schema: + type: string + required: false + description: Name of the key to use for the operation + responses: + '200': + description: Request processed successfully and certificate is returned in body + content: + '*/*': + schema: + $ref: '#/components/schemas/CertificateResponse' +components: + schemas: + DecryptUserInfoRequest: + type: object + properties: + encryptedUserInfo: + type: string + UserInfoResponse: + type: object + properties: + issuer: + type: string + issuercn: + type: string + serial: + type: string + subject: + type: string + subjectcn: + type: string + locality: + type: string + state: + type: string + o: + type: string + ou: + type: string + title: + type: string + lastname: + type: string + middlename: + type: string + givenname: + type: string + email: + type: string + address: + type: string + phone: + type: string + dns: + type: string + edrpoucode: + type: string + drfocode: + type: string + SignFileRequestDto: + required: + - cephKey + type: object + properties: + cephKey: + type: string + SignFileResponseDto: + type: object + properties: + signed: + type: boolean + VerificationRequestDto: + required: + - data + - signature + type: object + properties: + signature: + type: string + data: + type: string + ErrorDto: + type: object + properties: + code: + type: string + message: + type: string + localizedMessage: + type: string + VerificationResponseDto: + type: object + properties: + error: + $ref: '#/components/schemas/ErrorDto' + valid: + type: boolean + VerifySubjectRequestDto: + required: + - allowedSubjects + - data + - signature + type: object + properties: + allowedSubjects: + type: array + items: + type: string + enum: + - INDIVIDUAL + - ENTREPRENEUR + - LEGAL + signature: + type: string + data: + type: string + VerifySubjectResponseDto: + type: object + properties: + error: + $ref: '#/components/schemas/ErrorDto' + valid: + type: boolean + SignRequestDto: + required: + - data + type: object + properties: + data: + type: string + SignResponseDto: + type: object + properties: + signature: + type: string + CertificateResponse: + type: object + properties: + certificate: + type: string diff --git a/docs/ua/modules/arch/attachments/architecture/performance-testing/registry.json b/docs/ua/modules/arch/attachments/architecture/performance-testing/registry.json new file mode 100644 index 0000000000..96b90587e5 --- /dev/null +++ b/docs/ua/modules/arch/attachments/architecture/performance-testing/registry.json @@ -0,0 +1,49 @@ +{ + "registry": { + "name": "perf-25", // Назва реєстру + "instanceCount": "3", + "isDefaultResources": true, + "isGeoserver": true, // Присутність геосерверу + "admins": [ + { + "firsName": "Admin", + "lastName": "Control Plane", + "email": "admin_role@epam.com", + "password": "MTIzNA==" + } + ], + "accessToPlatforms": [ + { + "name": "a-smoke" + } + ], + //Налаштування назви доступу зовнішніх систем + "accessToExternalSystems": [ + { + "name": "test-0000" + } + ], + //Налаштування назви та ендпоінту публічного доступу + "publicApiSettings" : { + "name" : "laboratory-public", + "integrationPoint" : "/laboratory-start-with-edrpou-contains-name", + "numberOfRequests" : "10000000" //Ліміт за годину запитів + }, + "cleanUp": { + "isCleanUp": false, + "isDeleteRegistryRegulationsGerritRepository": false + }, + "description": "Опис реєстру", + "template": "development", //Тип реєстру + "repository": "certified-laboratories-registry-regulation", //Назва регламенту + "branch": "performaceTesting", //Гілка регламенту + "cloneByTag": false, + "tag": "refs/tags/build/1.6.0.181", + "regulationFoldersToExclude": [ + "notifications/diia" + ], + "regulationDeployOnly": false, //Тип запуску прекондішн сьюту + "onlyAutoTestsRun": false, + "auto-tests": [] + } +} \ No newline at end of file diff --git a/docs/ua/modules/arch/attachments/architecture/performance-testing/sign-widget-mock-users.yml b/docs/ua/modules/arch/attachments/architecture/performance-testing/sign-widget-mock-users.yml new file mode 100644 index 0000000000..7d42a2c4d4 --- /dev/null +++ b/docs/ua/modules/arch/attachments/architecture/performance-testing/sign-widget-mock-users.yml @@ -0,0 +1,330 @@ +kind: ConfigMap +apiVersion: v1 +metadata: + name: sign-widget-mock-users + namespace: + uid: 2c6a30e7-e00d-4cd8-9676-352d7277e3fc + resourceVersion: '214529941' + creationTimestamp: '2023-09-15T11:25:14Z' + managedFields: + - manager: Mozilla + operation: Update + apiVersion: v1 + time: '2023-09-15T11:25:14Z' + fieldsType: FieldsV1 + fieldsV1: + 'f:data': + .: {} + 'f:isolation-predefined-users.yml': {} + 'f:users.js': {} +data: + isolation-predefined-users.yml: |- + predefined-users: + '[Key-6-common-organisation-erdpo.dat]': + drfo: "111111113" + edrpou: "99999999" + fullName: Гендальф Сірий + '[Key-6-common-organisation-erdpo2.dat]': + drfo: "111111114" + edrpou: "99999999" + fullName: Легалас Легаласенко + '[Key-6-cp-entrepreneur-business.dat]': + drfo: "6774800300" + edrpou: "6774800300" + fullName: Чубака Энокин Дукович + '[Key-6-cp-entrepreneur.dat]': + drfo: "2145809873" + edrpou: "2145809873" + fullName: Потідейська Габрієль Геродотівна + '[Key-6-cp-legal-business.dat]': + drfo: "6774800300" + edrpou: "67748003" + fullName: Скайвокер Люк Дартвейдерович + '[Key-6-cp-legal.dat]': + drfo: "9093064723" + edrpou: "90924909" + fullName: Холмс Шерлок Артурович + '[Key-6-entr-without-lab.dat]': + drfo: "42044444" + edrpou: "42044444" + fullName: Бальбоа Роберт Рокки + '[Key-6-entrepreneur-excerpt.dat]': + drfo: "8080803333" + edrpou: "8080803333" + fullName: Кюрі Марія Соломонівна + '[Key-6-entrepreneur-view-lab.dat]': + drfo: "8065806733" + edrpou: "8065806733" + fullName: Вінфілд Джулс Квентінович + '[Key-6-legal-excerpt.dat]': + drfo: "0808080808" + edrpou: "88888888" + fullName: Поттер Гарри Джеймс + '[Key-6-legal-view-lab.dat]': + drfo: "0400010404" + edrpou: "10014004" + fullName: Вега Вінсент Квентінович + '[Key-6-legal-without-lab.dat]': + drfo: "42033333" + edrpou: "42021212" + fullName: Рэмбо Джон Джеймс + '[Key-6-op-entrepreneur.dat]': + drfo: "3135009313" + edrpou: "3135009313" + fullName: Ватсон Джон Артурович + '[Key-6-op-legal.dat]': + drfo: "8643063204" + edrpou: "16324098" + fullName: Амфіполійська Ксена Атріусівна + '[Key-6-op-with-subject.dat]': + drfo: "0000001312" + edrpou: "1111111213" + fullName: Петренко Петро Петрович + '[Key-6.dat]': + drfo: "1010101014" + edrpou: "34554362" + fullName: Сидоренко Василь Леонідович + '[Key-6_cp-layout-empty.dat]': + drfo: "42033333" + edrpou: "42021212" + fullName: Рэмбо Джон Джеймс + '[Key-6_cp_automation.dat]': + drfo: "1010101014" + fullName: Сидоренко Василь Леонідович + '[Key-6_cp_entrepreneur-auth.dat]': + drfo: "42054321" + edrpou: "42054321" + fullName: Уотсон Мері Джейн + '[Key-6_cp_entrepreneur_onboard.dat]': + drfo: "0102030405" + edrpou: "0102030405" + fullName: Рибалко Карась Карпович + '[Key-6_cp_individual_onboard.dat]': + drfo: "0908070605" + fullName: Чаклуненко Маг Візардович + '[Key-6_cp_initiator.dat]': + drfo: "0404040404" + fullName: Сергієнко Сергій Сергійович + '[Key-6_cp_layout.dat]': + drfo: "0707070707" + fullName: Котейко Кіт Котейович + '[Key-6_cp_legal_auth.dat]': + drfo: "4208523697" + edrpou: "42074583" + fullName: Роджерс Стівен Грант + '[Key-6_cp_representative_entrepreneur_onboard.dat]': + drfo: "42012345" + edrpou: "42012345" + fullName: Паркер Пітер Бенджамін + '[Key-6_cp_representative_legal_onboard.dat]': + drfo: "4209632587" + edrpou: "42074125" + fullName: Старк Тоні Едвард + '[Key-6_cp_sorting.dat]': + drfo: "0606060606" + fullName: Слейв Дженкінс Дженкінсон + '[Key-6_initiator.dat]': + drfo: "0808080808" + edrpou: "88888888" + fullName: Поттер Гарри Джеймс + '[Key-6_layout.dat]': + drfo: "0707070707" + edrpou: "77777777" + fullName: Котейко Кіт Котейович + '[Key-6_no_role.dat]': + drfo: "0505050505" + edrpou: "0505050505" + fullName: Пчолкін Шмель Вуликович + '[Key-6_op-layout-empty.dat]': + drfo: "42044444" + edrpou: "42044444" + fullName: Бальбоа Роберт Рокки + '[Key-6_op_assignment.dat]': + drfo: "42066666" + edrpou: "42066666" + fullName: Кеноби Оби Ван + '[Key-6_sorting.dat]': + drfo: "0606060606" + edrpou: "66666666" + fullName: Слейв Дженкінс Дженкінсон + '[user-35-Key-6.dat]': + drfo: "42011111" + edrpou: "42012121" + fullName: Беннер Брюс Роберт + '[user-36-Key-6.dat]': + drfo: "42022222" + edrpou: "42022222" + fullName: Стрейндж Стивен Винсент + users.js: |- + var MOCK_USERS = { + "[Key-6-common-organisation-erdpo.dat]": { + "drfo": "111111113", + "edrpou": "99999999", + "fullName": "Гендальф Сірий" + }, + "[Key-6-common-organisation-erdpo2.dat]": { + "drfo": "111111114", + "edrpou": "99999999", + "fullName": "Легалас Легаласенко" + }, + "[Key-6-cp-entrepreneur-business.dat]": { + "drfo": "6774800300", + "edrpou": "6774800300", + "fullName": "Чубака Энокин Дукович" + }, + "[Key-6-cp-entrepreneur.dat]": { + "drfo": "2145809873", + "edrpou": "2145809873", + "fullName": "Потідейська Габрієль Геродотівна" + }, + "[Key-6-cp-legal-business.dat]": { + "drfo": "6774800300", + "edrpou": "67748003", + "fullName": "Скайвокер Люк Дартвейдерович" + }, + "[Key-6-cp-legal.dat]": { + "drfo": "9093064723", + "edrpou": "90924909", + "fullName": "Холмс Шерлок Артурович" + }, + "[Key-6-entr-without-lab.dat]": { + "drfo": "42044444", + "edrpou": "42044444", + "fullName": "Бальбоа Роберт Рокки" + }, + "[Key-6-entrepreneur-excerpt.dat]": { + "drfo": "8080803333", + "edrpou": "8080803333", + "fullName": "Кюрі Марія Соломонівна" + }, + "[Key-6-entrepreneur-view-lab.dat]": { + "drfo": "8065806733", + "edrpou": "8065806733", + "fullName": "Вінфілд Джулс Квентінович" + }, + "[Key-6-legal-excerpt.dat]": { + "drfo": "0808080808", + "edrpou": "88888888", + "fullName": "Поттер Гарри Джеймс" + }, + "[Key-6-legal-view-lab.dat]": { + "drfo": "0400010404", + "edrpou": "10014004", + "fullName": "Вега Вінсент Квентінович" + }, + "[Key-6-legal-without-lab.dat]": { + "drfo": "42033333", + "edrpou": "42021212", + "fullName": "Рэмбо Джон Джеймс" + }, + "[Key-6-op-entrepreneur.dat]": { + "drfo": "3135009313", + "edrpou": "3135009313", + "fullName": "Ватсон Джон Артурович" + }, + "[Key-6-op-legal.dat]": { + "drfo": "8643063204", + "edrpou": "16324098", + "fullName": "Амфіполійська Ксена Атріусівна" + }, + "[Key-6-op-with-subject.dat]": { + "drfo": "0000001312", + "edrpou": "1111111213", + "fullName": "Петренко Петро Петрович" + }, + "[Key-6.dat]": { + "drfo": "1010101014", + "edrpou": "34554362", + "fullName": "Сидоренко Василь Леонідович" + }, + "[Key-6_cp-layout-empty.dat]": { + "drfo": "42033333", + "edrpou": "42021212", + "fullName": "Рэмбо Джон Джеймс" + }, + "[Key-6_cp_automation.dat]": { + "drfo": "1010101014", + "fullName": "Сидоренко Василь Леонідович" + }, + "[Key-6_cp_entrepreneur-auth.dat]": { + "drfo": "42054321", + "edrpou": "42054321", + "fullName": "Уотсон Мері Джейн" + }, + "[Key-6_cp_entrepreneur_onboard.dat]": { + "drfo": "0102030405", + "edrpou": "0102030405", + "fullName": "Рибалко Карась Карпович" + }, + "[Key-6_cp_individual_onboard.dat]": { + "drfo": "0908070605", + "fullName": "Чаклуненко Маг Візардович" + }, + "[Key-6_cp_initiator.dat]": { + "drfo": "0404040404", + "fullName": "Сергієнко Сергій Сергійович" + }, + "[Key-6_cp_layout.dat]": { + "drfo": "0707070707", + "fullName": "Котейко Кіт Котейович" + }, + "[Key-6_cp_legal_auth.dat]": { + "drfo": "4208523697", + "edrpou": "42074583", + "fullName": "Роджерс Стівен Грант" + }, + "[Key-6_cp_representative_entrepreneur_onboard.dat]": { + "drfo": "42012345", + "edrpou": "42012345", + "fullName": "Паркер Пітер Бенджамін" + }, + "[Key-6_cp_representative_legal_onboard.dat]": { + "drfo": "4209632587", + "edrpou": "42074125", + "fullName": "Старк Тоні Едвард" + }, + "[Key-6_cp_sorting.dat]": { + "drfo": "0606060606", + "fullName": "Слейв Дженкінс Дженкінсон" + }, + "[Key-6_initiator.dat]": { + "drfo": "0808080808", + "edrpou": "88888888", + "fullName": "Поттер Гарри Джеймс" + }, + "[Key-6_layout.dat]": { + "drfo": "0707070707", + "edrpou": "77777777", + "fullName": "Котейко Кіт Котейович" + }, + "[Key-6_no_role.dat]": { + "drfo": "0505050505", + "edrpou": "0505050505", + "fullName": "Пчолкін Шмель Вуликович" + }, + "[Key-6_op-layout-empty.dat]": { + "drfo": "42044444", + "edrpou": "42044444", + "fullName": "Бальбоа Роберт Рокки" + }, + "[Key-6_op_assignment.dat]": { + "drfo": "42066666", + "edrpou": "42066666", + "fullName": "Кеноби Оби Ван" + }, + "[Key-6_sorting.dat]": { + "drfo": "0606060606", + "edrpou": "66666666", + "fullName": "Слейв Дженкінс Дженкінсон" + }, + "[user-35-Key-6.dat]": { + "drfo": "42011111", + "edrpou": "42012121", + "fullName": "Беннер Брюс Роберт" + }, + "[user-36-Key-6.dat]": { + "drfo": "42022222", + "edrpou": "42022222", + "fullName": "Стрейндж Стивен Винсент" + } + }; \ No newline at end of file diff --git a/docs/ua/modules/arch/attachments/architecture/platform-api/services/bp-webservice-gateway-core-image-swagger.yml b/docs/ua/modules/arch/attachments/architecture/platform-api/services/bp-webservice-gateway-core-image-swagger.yml new file mode 100644 index 0000000000..482c472ab5 --- /dev/null +++ b/docs/ua/modules/arch/attachments/architecture/platform-api/services/bp-webservice-gateway-core-image-swagger.yml @@ -0,0 +1,170 @@ +openapi: 3.0.3 +info: + title: Business process web service gateway API + description: This document describes REST API of 'Business process web service gateway' + version: "1.0" +tags: + - name: bp-webservice-gateway-api + description: Business process web service gateway Rest API +paths: + /api/start-bp: + post: + tags: + - bp-webservice-gateway-api + summary: Start process instance + description: |- + ### Endpoint purpose: + This endpoint allows you to start a business process instance based on the provided _businessProcessDefinitionKey_ in request body. + ### Business process start validation: + This endpoint requires valid _businessProcessDefinitionKey_ and _startVariables_. If no business process definition found or required parameters are missing, then _422_ response code returned. + operationId: startBp + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/BusinessProcessStartDataRequest' + example: + businessProcessDefinitionKey: my-business-process + startVariables: + variable1: value1 + variable2: value2 + variable3: null + required: true + responses: + "200": + description: Returns result variable of business process + content: + application/json: + schema: + $ref: '#/components/schemas/BusinessProcessStartResponse' + example: + resultVariables: + return_var_1: return_value_1 + return_var_2: null + "404": + description: Business process definition not found in trembita.process_definitions + content: + application/json: + schema: + $ref: '#/components/schemas/SystemErrorDto' + "422": + description: Business process definition cannot be started or missing required + start variable for the business process + content: + application/json: + schema: + $ref: '#/components/schemas/SystemErrorDto' + "500": + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/SystemErrorDto' + /api/start-bp/{key}: + post: + tags: + - bp-webservice-gateway-api + summary: Start process instance by key + description: |- + ### Endpoint purpose: + This endpoint allows you to start a business process instance by process definition key. + ### Business process start validation: + This endpoint requires valid process definition key and _startVariables_. If no business process definition found or required parameters are missing, then _422_ response code returned. + operationId: startBpByDefinitionKey + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: key + in: path + description: Process definition key + required: true + schema: + type: string + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/BusinessProcessStartVariableRequest' + example: + startVariables: + variable1: value1 + variable2: value2 + variable3: null + required: true + responses: + "200": + description: Returns result variable of business process + content: + application/json: + schema: + $ref: '#/components/schemas/BusinessProcessStartResponse' + example: + resultVariables: + return_var_1: return_value_1 + return_var_2: null + "404": + description: Business process definition not found in trembita.process_definitions + content: + application/json: + schema: + $ref: '#/components/schemas/SystemErrorDto' + "422": + description: Business process definition cannot be started or missing required + start variable for the business process + content: + application/json: + schema: + $ref: '#/components/schemas/SystemErrorDto' + "500": + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/SystemErrorDto' +components: + schemas: + BusinessProcessStartDataRequest: + type: object + properties: + businessProcessDefinitionKey: + type: string + startVariables: + type: object + additionalProperties: + type: object + BusinessProcessStartResponse: + type: object + properties: + resultVariables: + type: object + additionalProperties: + type: object + SystemErrorDto: + type: object + properties: + traceId: + type: string + code: + type: string + message: + type: string + localizedMessage: + type: string + BusinessProcessStartVariableRequest: + type: object + properties: + startVariables: + type: object + additionalProperties: + type: object \ No newline at end of file diff --git a/docs/ua/modules/arch/attachments/architecture/platform-api/services/bp-webservice-gateway-swagger.yml b/docs/ua/modules/arch/attachments/architecture/platform-api/services/bp-webservice-gateway-swagger.yml deleted file mode 100644 index 3aca4c4876..0000000000 --- a/docs/ua/modules/arch/attachments/architecture/platform-api/services/bp-webservice-gateway-swagger.yml +++ /dev/null @@ -1,68 +0,0 @@ -openapi: 3.0.1 -info: - title: OpenAPI definition - version: v0 -paths: - /api/start-bp: - post: - tags: - - start-bp-controller - summary: Start process instance - description: Returns result variable of business process - operationId: startBp - requestBody: - content: - application/json: - schema: - $ref: '#/components/schemas/StartBpRestRequest' - required: true - responses: - '200': - description: Returns result variable of business process - content: - '*/*': - schema: - $ref: '#/components/schemas/StartBpResponse' - '422': - description: Business process definition cannot be started or missing required start variable for the business process - content: - '*/*': - schema: - $ref: '#/components/schemas/SystemErrorDto' - '500': - description: Internal server error - content: - '*/*': - schema: - $ref: '#/components/schemas/SystemErrorDto' -components: - schemas: - StartBpRestRequest: - type: object - properties: - businessProcessDefinitionKey: - type: string - startVariables: - type: object - additionalProperties: - type: object - SystemErrorDto: - type: object - properties: - traceId: - type: string - code: - type: string - message: - type: string - localizedMessage: - type: string - StartBpResponse: - required: - - resultVariables - type: object - properties: - resultVariables: - type: object - additionalProperties: - type: object \ No newline at end of file diff --git a/docs/ua/modules/arch/attachments/architecture/platform-api/services/bpms-swagger.yml b/docs/ua/modules/arch/attachments/architecture/platform-api/services/bpms-swagger.yml index 41a3029945..adfb2358ce 100644 --- a/docs/ua/modules/arch/attachments/architecture/platform-api/services/bpms-swagger.yml +++ b/docs/ua/modules/arch/attachments/architecture/platform-api/services/bpms-swagger.yml @@ -1,32 +1,62 @@ openapi: 3.0.1 info: - title: bpms API - version: v1 + title: "Business-process-management-service REST API" + description: "OpenApi Spec for Business-process management service REST API. Contains Camunda REST API and extended Business-process management service API." + version: "Camunda version 7.16.0" +servers: + - url: "/api" + description: "The API server for the default process engine" + - url: "{url}" + description: "The API server with a custom url" + variables: + url: + default: "" paths: /extended/authorizations/process-instance/create: post: + operationId: createProcessInstanceAuthorizations summary: Create authorizations for process instances. + description: | + ### Endpoint purpose + The purpose of the endpoint is to create authorizations for list of roles to be able to create [process instances](https://docs.camunda.org/manual/7.16/user-guide/process-engine/process-engine-concepts/#process-instances). It takes a list of group names as input and creates authorizations for those groups and returns the count of created authorizations. + + Created authorizations are [Camunda Process-Instance authorizations](https://docs.camunda.org/manual/7.16/webapps/admin/authorization-management/) with permissions `CREATE` and resource id `'*'` requestBody: required: true content: application/json: schema: type: array + description: List of group names + example: ["officer", "citizen", "custom-registry-role"] items: type: string + description: Not empty group name + example: "custom-registry-role" + nullable: false + minLength: 1 + example: ["officer", "citizen", "custom-registry-role"] responses: '200': - description: Successful response + description: Authorizations created content: application/json: schema: $ref: '#/components/schemas/DdmCountResultDto' + '500': + $ref: '#/components/responses/SystemError' tags: - - Extended Authorizations + - Extended authorizations /extended/authorizations/process-definition/create: post: + operationId: createProcessDefinitionAuthorizations summary: Create authorizations for process definitions. + description: | + ### Endpoint purpose + The purpose of the endpoint is to create a list of authorizations for role for exact [process definition](https://docs.camunda.org/manual/7.16/user-guide/process-engine/process-engine-concepts/#process-definitions) to be able to read them and create instances of these processes. It takes a list of pairs group name/process definition key as input and creates authorizations for them and returns the count of created authorizations. + + Created authorizations are [Camunda Process-Definition authorizations](https://docs.camunda.org/manual/7.16/webapps/admin/authorization-management/) with permissions `READ,CREATE_INSTANCE` requestBody: required: true content: @@ -42,12 +72,21 @@ paths: application/json: schema: $ref: '#/components/schemas/DdmCountResultDto' + '500': + $ref: '#/components/responses/SystemError' tags: - - Extended Authorizations + - Extended authorizations /extended/authorizations/delete: delete: summary: Delete authorizations for process instances and process definitions. + description: | + ### Endpoint purpose + The purpose of the endpoint is to delete all created authorizations created by [/extended/authorizations/process-instance/create](#Extended%20authorizations/createProcessInstanceAuthorizations) and [/extended/authorizations/process-definition/create](#Extended%20authorizations/createProcessDefinitionAuthorizations) at once. + + It returns the count of deleted authorizations. + + __*WARNING:*__ If there are any authorizations that match the endpoint search criteria and were created _manually_ or with a _different endpoint_, they will be __deleted__ as well. This applies to process definitions with permissions `READ, CREATE_INSTANCE` and to process instances with `CREATE` permission and resource ID `'*'`. responses: '200': description: Successful response @@ -55,18 +94,29 @@ paths: application/json: schema: $ref: '#/components/schemas/DdmCountResultDto' + '500': + $ref: '#/components/responses/SystemError' tags: - - Extended Authorizations + - Extended authorizations /extended/process-definition/key/{key}: get: summary: Get process definition by key. + description: | + ### Endpoint purpose + The purpose of the endpoint is to retrieve a [process definition](https://docs.camunda.org/manual/7.16/user-guide/process-engine/process-engine-concepts/#process-definitions) object by its key with start-form. + + This endpoint was created to join Camunda [get process definition endpoint](https://docs.camunda.org/manual/7.16/reference/rest/process-definition/get/) and [get start form key endpoint](https://docs.camunda.org/manual/7.16/reference/rest/process-definition/get-start-form-key/). + + It takes the key as a path parameter and returns the corresponding process definition object with it's start form key if present. parameters: - in: path name: key required: true + description: Unique process definition key schema: type: string + example: awesome-process-definition responses: '200': description: Successful response @@ -74,12 +124,32 @@ paths: application/json: schema: $ref: '#/components/schemas/DdmProcessDefinitionDto' + '404': + description: Business process not found + content: + application/json: + schema: + $ref: '#/components/schemas/ErrorDto' + example: | + { + "traceId": "ac3bee6c5cdb10142947264715dd5559", + "code": "RestException", + "message": "No matching process definition with key: awesome-process-definition and no tenant-id", + "localizedMessage": "No matching process definition with key: awesome-process-definition and no tenant-id" + } + '500': + $ref: '#/components/responses/SystemError' tags: - Extended Process Definition /extended/process-definition: post: - summary: Get process definitions by params. + summary: Search process definitions by params. + description: | + ### Endpoint purpose + The purpose of the endpoint is to search a [process definition](https://docs.camunda.org/manual/7.16/user-guide/process-engine/process-engine-concepts/#process-definitions) objects by search parameters. + + This endpoint was created to join Camunda [get process definition list endpoint](https://docs.camunda.org/manual/7.16/reference/rest/process-definition/get-query/) and [get start form key endpoint](https://docs.camunda.org/manual/7.16/reference/rest/process-definition/get-start-form-key/) in complex POST method with limited query parameters that won't have query size restrictions. requestBody: required: true content: @@ -95,55 +165,37 @@ paths: type: array items: $ref: '#/components/schemas/DdmProcessDefinitionDto' + '500': + $ref: '#/components/responses/SystemError' tags: - Extended Process Definition - /extended/process-instance: - post: - summary: Get list of historical process-instances by provided query params - parameters: - - in: query - name: firstResult - required: false - schema: - type: integer - - in: query - name: maxResults - required: false - schema: - type: integer - requestBody: - required: true - content: - application/json: - schema: - $ref: '#/components/schemas/ProcessInstanceExtendedQueryDto' - responses: - '200': - description: Successful response - content: - application/json: - schema: - type: array - items: - $ref: '#/components/schemas/DdmProcessInstanceDto' - tags: - - Extended Process Instance - /extended/task: post: + operationId: getByParams summary: Get list of user tasks by provided query params + description: | + ### Endpoint purpose + The purpose of the endpoint is to search a [user tasks](https://docs.camunda.org/manual/7.16/reference/bpmn20/tasks/user-task/) objects by search parameters. + + This endpoint was created to extend Camunda [get task list endpoint](https://docs.camunda.org/manual/7.16/reference/rest/task/get-query/) with returning process definition name and business key with task info. + + Request has same structure as Camunda [get task list endpoint](https://docs.camunda.org/manual/7.16/reference/rest/task/get-query/). parameters: - in: query name: firstResult + description: Defines how many tasks will be skipped required: false schema: type: integer + example: 20 - in: query + description: Defines how many tasks will be returned name: maxResults required: false schema: type: integer + example: 10 requestBody: content: application/json: @@ -159,28 +211,35 @@ paths: type: array items: $ref: '#/components/schemas/DdmTaskDto' + '500': + $ref: '#/components/responses/SystemError' tags: - Extended Task /extended/task/lightweight: post: - summary: Method for getting list of lightweight camunda user tasks + summary: Method for getting list of lightweight Camunda user tasks + description: 'Lightweight version of [/extended/task](#Extended%20task/getByParams) endpoint that returns only task id and its assignee.' parameters: - in: query name: firstResult + description: Defines how many tasks will be skipped required: false schema: type: integer + example: 20 - in: query + description: Defines how many tasks will be returned name: maxResults required: false schema: type: integer + example: 10 requestBody: content: application/json: schema: - $ref: '#/components/schemas/TaskQueryDto' + $ref: '#/components/schemas/DdmTaskQueryDto' required: true responses: '200': @@ -191,15 +250,24 @@ paths: type: array items: $ref: '#/components/schemas/DdmLightweightTaskDto' + '500': + $ref: '#/components/responses/SystemError' tags: - Extended Task /extended/task/{id}: get: summary: Method for getting extended camunda user task + description: | + ### Endpoint purpose + The purpose of the endpoint is to get a [user task](https://docs.camunda.org/manual/7.16/reference/bpmn20/tasks/user-task/) object by id. + + This endpoint was created to extend Camunda [get task endpoint](https://docs.camunda.org/manual/7.16/reference/rest/task/get/) with returning process definition name, id of a root process instance, indicator if that task is signable, signature validation pack and business process form variables with task info. parameters: - name: id + description: Unique identificator of a task in: path + example: fa1fdc6e-361a-4236-8d9e-a7ce126a03a5 required: true schema: type: string @@ -210,16 +278,34 @@ paths: application/json: schema: $ref: '#/components/schemas/DdmSignableTaskDto' + '404': + description: Task not found + content: + application/json: + example: | + { + "type": "RestException", + "message": "No matching task with id fa1fdc6e-361a-4236-8d9e-a7ce126a03a5" + } + '500': + $ref: '#/components/responses/SystemError' tags: - Extended Task /extended/task/{id}/complete: post: summary: Complete user task by ID + description: | + ### Endpoint purpose + The purpose of the endpoint is to complete a [user task](https://docs.camunda.org/manual/7.16/reference/bpmn20/tasks/user-task/) by id. + + This endpoint was created to extend Camunda [complete task endpoint](https://docs.camunda.org/manual/7.16/reference/rest/task/post-complete/) with returning root process instance id and whether the root process instance has ended. operationId: completeTaskById parameters: - - in: path - name: id + - name: id + description: Unique identificator of a task + in: path + example: fa1fdc6e-361a-4236-8d9e-a7ce126a03a5 required: true schema: type: string @@ -236,311 +322,1183 @@ paths: application/json: schema: $ref: '#/components/schemas/DdmCompletedTaskDto' + '404': + description: Task not found + content: + application/json: + example: | + { + "type": "RestException", + "message": "No matching task with id fa1fdc6e-361a-4236-8d9e-a7ce126a03a5" + } '422': description: Client validation exception content: application/json: schema: $ref: '#/components/schemas/ClientValidationException' + '500': + $ref: '#/components/responses/SystemError' tags: - Extended Task components: + responses: + Unauthenticated: + description: Unauthenticated + Unauthorized: + description: Unauthorized + SystemError: + description: Some system error occurred + content: + application/json: + schema: + $ref: '#/components/schemas/ErrorDto' schemas: DdmProcessDefinitionDto: type: object + description: DTO that represents the process definition resource properties: id: type: string + example: awesome-process-definition:5:9b1d903c-51bc-41b0-b5bc-360362e0d7cb + nullable: false + description: The ID of the specific version of business-process. key: type: string + example: awesome-process-definition + nullable: false + description: The ID of the specific business-process. It is same for all versions of the business-process. name: type: string + example: Awesome process definition + nullable: false + description: Human readable name of business process definition. Unlike base Camunda, the name cannot be null. suspended: type: boolean + example: false + nullable: false + description: Flag that indicates whether this business process is suspended for starting process instances. formKey: type: string + example: awesome-process-definition-start-form-key + nullable: true + description: Key of the process definition start form. Can be null if business process doesn't require start form. DdmProcessDefinitionAuthDto: type: object + description: DTO that represents the pair of a group and process-definition for which an authorization is required to be created. properties: groupId: type: string + description: Not empty group name + example: "custom-registry-role" + nullable: false + minLength: 1 processDefinitionId: type: string + nullable: false + description: Process-definition key. + example: "awesome-business-process" DdmCountResultDto: type: object + description: DTO that represents the result of a count operation. + example: {"count": 42} properties: count: - type: integer + type: number + minimum: 0 + description: Result count of entities + example: 42 ProcessDefinitionQueryDto: type: object + description: DTO that represents the set of query parameters for searching process definitions. properties: + active: + type: boolean + example: true + nullable: true + default: false + description: | + Flag that indicates that it's needed to search only active process definitions (suspension state = ACTIVE). + + NOTE: If suspended flag is set to true then this flag is ignored. latestVersion: type: boolean - sortBy: - type: string - sortOrder: - type: string + example: true + nullable: true + default: false + description: | + Flag that indicates that it's needed to search only latest versions of the process definitions for each process definition key. + + NOTE: Cannot be used with processDefinitionId. processDefinitionId: type: string + example: awesome-process-definition:5:9b1d903c-51bc-41b0-b5bc-360362e0d7cb + nullable: true + default: null + description: | + Specifies the ID of the process definition specific version to retrieve. Can be null. + + NOTE: Cannot be used with latestVersion. And shouldn't be used with processDefinitionIdIn. processDefinitionIdIn: type: array + example: ["awesome-process-definition:5:9b1d903c-51bc-41b0-b5bc-360362e0d7cb", "awesome-process-definition:4:0c7ee46d-7e43-46c2-b440-6b30b2267a6a"] + nullable: true + default: null + description: | + Specifies an array of process definition IDs to retrieve. Can be null. Ignored if empty array is set. + + NOTE: Shouldn't be used with processDefinitionId as conflict search criteria. items: type: string + sortBy: + type: string + example: name + nullable: true + default: null + description: Specifies the field to sort the process definitions by. Can be null. + enum: + - "category" + - "key" + - "id" + - "name" + - "version" + - "deploymentId" + - "deployTime" + - "tenantId" + - "versionTag" + - null + sortOrder: + type: string + example: asc + nullable: true + default: null + description: Specifies the order in which the process definitions should be sorted. Can be null. Cannot work without sortBy. + enum: + - asc + - desc + - null suspended: type: boolean - active: - type: boolean + example: false + nullable: true + default: false + description: | + Flag that indicates that it's needed to search only suspended process definitions (suspension state = SUSPENDED). + + NOTE: If this flag is set to true then active flag is ignored. - DdmProcessInstanceDto: + DdmTaskDto: type: object + description: DTO that represents task resource along with process definition name and process instance business key properties: id: type: string - processDefinitionId: + example: 9402afe5-ce88-4af4-be0b-5035bbe47722 + nullable: false + description: Represents the unique identifier of the task. + taskDefinitionKey: type: string - processDefinitionName: + example: awesome-task-definition + nullable: false + description: Represents the key of the task's definition in business process. + name: type: string - startTime: + example: Awesome task definition + nullable: false + description: Represents the human readable name of the task. + assignee: + type: string + example: some_username + nullable: true + description: Represents the username of a user that assigned to the task. + created: type: string format: date-time - state: + nullable: false + description: Represents the date and time when the task was created. + description: + type: string + example: Task that assigned to business process initiator + nullable: true + description: Represents the description of the task. + processDefinitionName: + type: string + example: Awesome process definition + nullable: false + description: Represents the human readable name of the process definition associated with the task. + processInstanceId: + type: string + example: 31b15466-2743-438a-b4cb-fa1a7d1478e9 + nullable: false + description: Represents the unique identifier of the process instance associated with the task. + processDefinitionId: type: string - enum: [ACTIVE, PENDING, SUSPENDED] + example: awesome-process-definition:5:9b1d903c-51bc-41b0-b5bc-360362e0d7cb + nullable: false + description: Represents the unique identifier of the process definition associated with the task. + formKey: + type: string + example: awesome-task-form + nullable: false + description: Represents the form key associated with the task. + suspended: + type: boolean + example: false + nullable: false + description: Represents the status of the task (suspended or not). + businessKey: + type: string + example: null + nullable: true + description: Represents the business key of the process instance associated with the task. + - ProcessInstanceExtendedQueryDto: + TaskQueryDto: type: object properties: - deploymentId: - type: string - processDefinitionKey: + processInstanceId: type: string - processDefinitionKeys: + description: Restrict to tasks that belong to process instances with the given + id. + nullable: true + processInstanceIdIn: type: array + description: Restrict to tasks that belong to process instances with the given + ids. + nullable: true items: type: string - processDefinitionKeyNotIn: + processInstanceBusinessKey: + type: string + description: Restrict to tasks that belong to process instances with the given + business key. + nullable: true + processInstanceBusinessKeyExpression: + type: string + description: "Restrict to tasks that belong to process instances with the given + business key which \nis described by an expression. See the \n[user guide](https://docs.camunda.org/manual/7.16/user-guide/process-engine/expression-language/#internal-context-functions)\n for + more information on available functions." + nullable: true + processInstanceBusinessKeyIn: type: array + description: "Restrict to tasks that belong to process instances with one of + the give business keys. \nThe keys need to be in a comma-separated list." + nullable: true items: type: string - businessKey: - type: string - businessKeyLike: - type: string - caseInstanceId: - type: string + processInstanceBusinessKeyLike: + type: string + description: "Restrict to tasks that have a process instance business key that + has the parameter \n value as a substring." + nullable: true + processInstanceBusinessKeyLikeExpression: + type: string + description: "Restrict to tasks that have a process instance business key that + has the parameter \n value as a substring and is described by an expression. + See the\n[user guide](https://docs.camunda.org/manual/7.16/user-guide/process-engine/expression-language/#internal-context-functions) + \n for more information on available functions." + nullable: true processDefinitionId: type: string - superProcessInstance: - type: string - subProcessInstance: - type: string - superCaseInstance: - type: string - subCaseInstance: + description: Restrict to tasks that belong to a process definition with the + given id. + nullable: true + processDefinitionKey: type: string - active: - type: boolean - suspended: - type: boolean - processInstanceIds: + description: Restrict to tasks that belong to a process definition with the + given key. + nullable: true + processDefinitionKeyIn: type: array + description: "Restrict to tasks that belong to a process definition with one + of the given keys. The \n keys need to be in a comma-separated list." + nullable: true items: type: string - withIncident: - type: boolean - incidentId: + processDefinitionName: type: string - incidentType: + description: Restrict to tasks that belong to a process definition with the + given name. + nullable: true + processDefinitionNameLike: type: string - incidentMessage: + description: "Restrict to tasks that have a process definition name that has + the parameter value as \na substring." + nullable: true + executionId: type: string - incidentMessageLike: + description: Restrict to tasks that belong to an execution with the given id. + nullable: true + caseInstanceId: type: string - tenantIds: + description: Restrict to tasks that belong to case instances with the given + id. + nullable: true + caseInstanceBusinessKey: + type: string + description: Restrict to tasks that belong to case instances with the given + business key. + nullable: true + caseInstanceBusinessKeyLike: + type: string + description: "Restrict to tasks that have a case instance business key that + has the parameter value \nas a substring." + nullable: true + caseDefinitionId: + type: string + description: Restrict to tasks that belong to a case definition with the given + id. + nullable: true + caseDefinitionKey: + type: string + description: Restrict to tasks that belong to a case definition with the given + key. + nullable: true + caseDefinitionName: + type: string + description: Restrict to tasks that belong to a case definition with the given + name. + nullable: true + caseDefinitionNameLike: + type: string + description: "Restrict to tasks that have a case definition name that has the + parameter value as a \n substring." + nullable: true + caseExecutionId: + type: string + description: Restrict to tasks that belong to a case execution with the given + id. + nullable: true + activityInstanceIdIn: + type: array + description: "Only include tasks which belong to one of the passed and comma-separated + activity \n instance ids." + nullable: true + items: + type: string + tenantIdIn: type: array + description: "Only include tasks which belong to one of the passed and comma-separated + \n tenant ids." + nullable: true items: type: string withoutTenantId: type: boolean - activityIds: + description: "Only include tasks which belong to no tenant. Value may only be + `true`, \nas `false` is the default behavior." + nullable: true + default: false + assignee: + type: string + description: Restrict to tasks that the given user is assigned to. + nullable: true + assigneeExpression: + type: string + description: "Restrict to tasks that the user described by the given expression + is assigned to. See the\n[user guide](https://docs.camunda.org/manual/7.16/user-guide/process-engine/expression-language/#internal-context-functions) + \n for more information on available functions." + nullable: true + assigneeLike: + type: string + description: "Restrict to tasks that have an assignee that has the parameter + \n value as a substring." + nullable: true + assigneeLikeExpression: + type: string + description: "Restrict to tasks that have an assignee that has the parameter + value described by the \n given expression as a substring. See the \n[user + guide](https://docs.camunda.org/manual/7.16/user-guide/process-engine/expression-language/#internal-context-functions) + \n for more information on available functions." + nullable: true + assigneeIn: type: array + description: Only include tasks which are assigned to one of the passed and + comma-separated user ids. + nullable: true items: type: string - rootProcessInstances: - type: boolean - leafProcessInstances: - type: boolean - isProcessDefinitionWithoutTenantId: + assigneeNotIn: + type: array + description: Only include tasks which are not assigned to one of the passed + and comma-separated user ids. + nullable: true + items: + type: string + owner: + type: string + description: Restrict to tasks that the given user owns. + nullable: true + ownerExpression: + type: string + description: "Restrict to tasks that the user described by the given expression + owns. See the \n[user guide](https://docs.camunda.org/manual/7.16/user-guide/process-engine/expression-language/#internal-context-functions) + \n for more information on available functions." + nullable: true + candidateGroup: + type: string + description: Only include tasks that are offered to the given group. + nullable: true + candidateGroupExpression: + type: string + description: "Only include tasks that are offered to the group described by + the given expression. \nSee the \n[user guide](https://docs.camunda.org/manual/7.16/user-guide/process-engine/expression-language/#internal-context-functions) + \n for more information on available functions." + nullable: true + candidateUser: + type: string + description: Only include tasks that are offered to the given user or to one + of his groups. + nullable: true + candidateUserExpression: + type: string + description: "Only include tasks that are offered to the user described by the + given expression. \nSee the \n[user guide](https://docs.camunda.org/manual/7.16/user-guide/process-engine/expression-language/#internal-context-functions) + \n for more information on available functions." + nullable: true + includeAssignedTasks: type: boolean - variableNamesIgnoreCase: + description: "Also include tasks that are assigned to users in candidate queries. + Default is to only \n include tasks that are not assigned to any user if you + query by candidate user or\n group(s)." + nullable: true + default: false + involvedUser: + type: string + description: "Only include tasks that the given user is involved in. A user + is involved in a task if \nan identity link exists between task and user (e.g., + the user is the assignee)." + nullable: true + involvedUserExpression: + type: string + description: |- + Only include tasks that the user described by the given expression is involved in. + A user is involved in a task if an identity link exists between task and user + (e.g., the user is the assignee). See the + [user guide](https://docs.camunda.org/manual/7.16/user-guide/process-engine/expression-language/#internal-context-functions) + for more information on available functions. + nullable: true + assigned: type: boolean - variableValuesIgnoreCase: + description: If set to `true`, restricts the query to all tasks that are assigned. + nullable: true + default: false + unassigned: type: boolean - variables: - type: array - items: - type: object - orQueries: + description: If set to `true`, restricts the query to all tasks that are unassigned. + nullable: true + default: false + taskDefinitionKey: + type: string + description: Restrict to tasks that have the given key. + nullable: true + taskDefinitionKeyIn: type: array + description: Restrict to tasks that have one of the given keys. The keys need + to be in a comma-separated list. + nullable: true items: - type: object - - DdmTaskDto: - type: object - properties: - id: - type: string - taskDefinitionKey: + type: string + taskDefinitionKeyLike: type: string + description: Restrict to tasks that have a key that has the parameter value + as a substring. + nullable: true name: type: string - assignee: - type: string - created: + description: Restrict to tasks that have the given name. + nullable: true + nameNotEqual: type: string - format: date-time - description: + description: Restrict to tasks that do not have the given name. + nullable: true + nameLike: type: string - processDefinitionName: + description: Restrict to tasks that have a name with the given parameter value + as substring. + nullable: true + nameNotLike: type: string - processInstanceId: + description: |- + Restrict to tasks that do not have a name with the given parameter + value as substring. + nullable: true + description: type: string - processDefinitionId: - type: string - formKey: + description: Restrict to tasks that have the given description. + nullable: true + descriptionLike: type: string + description: |- + Restrict to tasks that have a description that has the parameter + value as a substring. + nullable: true + priority: + type: integer + description: Restrict to tasks that have the given priority. + format: int32 + nullable: true + maxPriority: + type: integer + description: Restrict to tasks that have a lower or equal priority. + format: int32 + nullable: true + minPriority: + type: integer + description: Restrict to tasks that have a higher or equal priority. + format: int32 + nullable: true + dueDate: + type: string + description: |- + Restrict to tasks that are due on the given date. By + [default](https://docs.camunda.org/manual/7.16/reference/rest/overview/date-format/), the date must have the format + `yyyy-MM-dd'T'HH:mm:ss.SSSZ`, e.g., `2013-01-23T14:42:45.546+0200`. + format: date-time + nullable: true + dueDateExpression: + type: string + description: |- + Restrict to tasks that are due on the date described by the given expression. See the + [user guide](https://docs.camunda.org/manual/7.16/user-guide/process-engine/expression-language/#internal-context-functions) + for more information on available functions. The expression must evaluate to a + `java.util.Date` or `org.joda.time.DateTime` object. + nullable: true + dueAfter: + type: string + description: |- + Restrict to tasks that are due after the given date. By + [default](https://docs.camunda.org/manual/7.16/reference/rest/overview/date-format/), the date must have + the format `yyyy-MM-dd'T'HH:mm:ss.SSSZ`, e.g., `2013-01-23T14:42:45.435+0200`. + format: date-time + nullable: true + dueAfterExpression: + type: string + description: |- + Restrict to tasks that are due after the date described by the given expression. + See the + [user guide](https://docs.camunda.org/manual/7.16/user-guide/process-engine/expression-language/#internal-context-functions) + for more information on available functions. The expression must evaluate to a + `java.util.Date` or `org.joda.time.DateTime` object. + nullable: true + dueBefore: + type: string + description: |- + Restrict to tasks that are due before the given date. By + [default](https://docs.camunda.org/manual/7.16/reference/rest/overview/date-format/), the date must have + the format `yyyy-MM-dd'T'HH:mm:ss.SSSZ`, e.g., `2013-01-23T14:42:45.243+0200`. + format: date-time + nullable: true + dueBeforeExpression: + type: string + description: |- + Restrict to tasks that are due before the date described by the given expression. + See the + [user guide](https://docs.camunda.org/manual/7.16/user-guide/process-engine/expression-language/#internal-context-functions) + for more information on available functions. The expression must evaluate to a + `java.util.Date` or `org.joda.time.DateTime` object. + nullable: true + withoutDueDate: + type: boolean + description: "Only include tasks which have no due date. Value may only be `true`, + \nas `false` is the default behavior." + nullable: true + default: false + followUpDate: + type: string + description: |- + Restrict to tasks that have a followUp date on the given date. By + [default](https://docs.camunda.org/manual/7.16/reference/rest/overview/date-format/), the date + must have the format `yyyy-MM-dd'T'HH:mm:ss.SSSZ`, e.g., `2013-01-23T14:42:45.342+0200`. + format: date-time + nullable: true + followUpDateExpression: + type: string + description: |- + Restrict to tasks that have a followUp date on the date described by the given + expression. See the + [user guide](https://docs.camunda.org/manual/7.16/user-guide/process-engine/expression-language/#internal-context-functions) + for more information on available functions. The expression must evaluate to a + `java.util.Date` or `org.joda.time.DateTime` object. + nullable: true + followUpAfter: + type: string + description: |- + Restrict to tasks that have a followUp date after the given date. By + [default](https://docs.camunda.org/manual/7.16/reference/rest/overview/date-format/), the date must have + the format `yyyy-MM-dd'T'HH:mm:ss.SSSZ`, e.g., `2013-01-23T14:42:45.542+0200`. + format: date-time + nullable: true + followUpAfterExpression: + type: string + description: |- + Restrict to tasks that have a followUp date after the date described by the given + expression. See the + [user guide](https://docs.camunda.org/manual/7.16/user-guide/process-engine/expression-language/#internal-context-functions) + for more information on available functions. The expression must evaluate to a + `java.util.Date` or `org.joda.time.DateTime` object. + nullable: true + followUpBefore: + type: string + description: |- + Restrict to tasks that have a followUp date before the given date. By + [default](https://docs.camunda.org/manual/7.16/reference/rest/overview/date-format/), the date must have + the format `yyyy-MM-dd'T'HH:mm:ss.SSSZ`, e.g., `2013-01-23T14:42:45.234+0200`. + nullable: true + followUpBeforeExpression: + type: string + description: |- + Restrict to tasks that have a followUp date before the date described by the given + expression. See the + [user guide](https://docs.camunda.org/manual/7.16/user-guide/process-engine/expression-language/#internal-context-functions) + for more information on available functions. The expression must evaluate to a + `java.util.Date` or `org.joda.time.DateTime` object. + nullable: true + followUpBeforeOrNotExistent: + type: string + description: |- + Restrict to tasks that have no followUp date or a followUp date before the given date. + By [default](https://docs.camunda.org/manual/7.16/reference/rest/overview/date-format/), the date must have + the format `yyyy-MM-dd'T'HH:mm:ss.SSSZ`, e.g., `2013-01-23T14:42:45.432+0200`. The typical use case + is to query all `active` tasks for a user for a given date. + format: date-time + nullable: true + followUpBeforeOrNotExistentExpression: + type: string + description: |- + Restrict to tasks that have no followUp date or a followUp date before the date + described by the given expression. See the + [user guide](https://docs.camunda.org/manual/7.16/user-guide/process-engine/expression-language/#internal-context-functions) + for more information on available functions. The expression must evaluate to a + `java.util.Date` or `org.joda.time.DateTime` object. + nullable: true + createdOn: + type: string + description: |- + Restrict to tasks that were created on the given date. By + [default](https://docs.camunda.org/manual/7.16/reference/rest/overview/date-format/), the date must have + the format `yyyy-MM-dd'T'HH:mm:ss.SSSZ`, e.g., `2013-01-23T14:42:45.324+0200`. + format: date-time + nullable: true + createdOnExpression: + type: string + description: |- + Restrict to tasks that were created on the date described by the given expression. + See the + [user guide](https://docs.camunda.org/manual/7.16/user-guide/process-engine/expression-language/#internal-context-functions) + for more information on available functions. The expression must evaluate to a + `java.util.Date` or `org.joda.time.DateTime` object. + nullable: true + createdAfter: + type: string + description: |- + Restrict to tasks that were created after the given date. By + [default](https://docs.camunda.org/manual/7.16/reference/rest/overview/date-format/), the date must + have the format `yyyy-MM-dd'T'HH:mm:ss.SSSZ`, e.g., `2013-01-23T14:42:45.342+0200`. + format: date-time + nullable: true + createdAfterExpression: + type: string + description: |- + Restrict to tasks that were created after the date described by the given expression. + See the + [user guide](https://docs.camunda.org/manual/7.16/user-guide/process-engine/expression-language/#internal-context-functions) + for more information on available functions. The expression must evaluate to a + `java.util.Date` or `org.joda.time.DateTime` object. + nullable: true + createdBefore: + type: string + description: |- + Restrict to tasks that were created before the given date. By + [default](https://docs.camunda.org/manual/7.16/reference/rest/overview/date-format/), the date must + have the format `yyyy-MM-dd'T'HH:mm:ss.SSSZ`, e.g., `2013-01-23T14:42:45.332+0200`. + format: date-time + nullable: true + createdBeforeExpression: + type: string + description: |- + Restrict to tasks that were created before the date described by the given expression. + See the + [user guide](https://docs.camunda.org/manual/7.16/user-guide/process-engine/expression-language/#internal-context-functions) + for more information on available functions. The expression must evaluate to a + `java.util.Date` or `org.joda.time.DateTime` object. + nullable: true + delegationState: + type: string + description: |- + Restrict to tasks that are in the given delegation state. Valid values are + `PENDING` and `RESOLVED`. + nullable: true + enum: + - PENDING + - RESOLVED + candidateGroups: + type: array + description: |- + Restrict to tasks that are offered to any of the given candidate groups. Takes a + comma-separated list of group names, so for example + `developers,support,sales`. + nullable: true + items: + type: string + candidateGroupsExpression: + type: string + description: |- + Restrict to tasks that are offered to any of the candidate groups described by the + given expression. See the + [user guide](https://docs.camunda.org/manual/7.16/user-guide/process-engine/expression-language/#internal-context-functions) + for more information on available functions. The expression must evaluate to + `java.util.List` of Strings. + nullable: true + withCandidateGroups: + type: boolean + description: |- + Only include tasks which have a candidate group. Value may only be `true`, + as `false` is the default behavior. + nullable: true + default: false + withoutCandidateGroups: + type: boolean + description: |- + Only include tasks which have no candidate group. Value may only be `true`, + as `false` is the default behavior. + nullable: true + default: false + withCandidateUsers: + type: boolean + description: |- + Only include tasks which have a candidate user. Value may only be `true`, + as `false` is the default behavior. + nullable: true + default: false + withoutCandidateUsers: + type: boolean + description: |- + Only include tasks which have no candidate users. Value may only be `true`, + as `false` is the default behavior. + nullable: true + default: false + active: + type: boolean + description: |- + Only include active tasks. Value may only be `true`, as `false` + is the default behavior. + nullable: true + default: false suspended: type: boolean - businessKey: + description: |- + Only include suspended tasks. Value may only be `true`, as + `false` is the default behavior. + nullable: true + default: false + taskVariables: + type: array + description: |- + A JSON array to only include tasks that have variables with certain values. The + array consists of JSON objects with three properties `name`, `operator` and `value`. + `name` is the variable name, `operator` is the comparison operator to be used and + `value` the variable value. `value` may be of type `String`, `Number` or `Boolean`. + + Valid `operator` values are: + `eq` - equal to; + `neq` - not equal to; + `gt` - greater than; + `gteq` - greater than or equal to; + `lt` - lower than; + `lteq` - lower than or equal to; + `like`. + `key` and `value` may not contain underscore or comma characters. + nullable: true + items: + type: string + processVariables: + type: array + description: |- + A JSON array to only include tasks that belong to a process instance with variables + with certain values. The array consists of JSON objects with three properties + `name`, `operator` and `value`. `name` is the variable name, `operator` is the + comparison operator to be used and `value` the variable value. `value` may be of + type `String`, `Number` or `Boolean`. + + Valid `operator` values are: + `eq` - equal to; + `neq` - not equal to; + `gt` - greater than; + `gteq` - greater than or equal to; + `lt` - lower than; + `lteq` - lower than or equal to; + `like`; + `notLike`. + `key` and `value` may not contain underscore or comma characters. + nullable: true + items: + type: string + caseInstanceVariables: + type: array + description: |- + A JSON array to only include tasks that belong to a case instance with variables + with certain values. The array consists of JSON objects with three properties + `name`, `operator` and `value`. `name` is the variable name, `operator` is the + comparison operator to be used and `value` the variable value. `value` may be of + type `String`, `Number` or `Boolean`. + + Valid `operator` values are: + `eq` - equal to; + `neq` - not equal to; + `gt` - greater than; + `gteq` - greater than or equal to; + `lt` - lower than; + `lteq` - lower than or equal to; + `like`. + `key` and `value` may not contain underscore or comma characters. + nullable: true + items: + type: string + variableNamesIgnoreCase: + type: boolean + description: |- + Match all variable names in this query case-insensitively. If set + `variableName` and `variablename` are treated as equal. + nullable: true + default: false + variableValuesIgnoreCase: + type: boolean + description: |- + Match all variable values in this query case-insensitively. If set + `variableValue` and `variablevalue` are treated as equal. + nullable: true + default: false + parentTaskId: + type: string + description: Restrict query to all tasks that are sub tasks of the given task. + Takes a task id. + nullable: true + orQueries: + type: array + description: |- + A JSON array of nested task queries with OR semantics. A task matches a nested query if it fulfills + *at least one* of the query's predicates. With multiple nested queries, a task must fulfill at least one predicate of *each* query ([Conjunctive Normal Form](https://en.wikipedia.org/wiki/Conjunctive_normal_form)). + + All task query properties can be used except for: `sorting`, `withCandidateGroups`, + `withoutCandidateGroups`, `withCandidateUsers`, `withoutCandidateUsers` + + See the [User guide](https://docs.camunda.org/manual/7.16/user-guide/process-engine/process-engine-api/#or-queries) + for more information about OR queries. + nullable: true + items: + $ref: '#/components/schemas/TaskQueryDto' + sorting: + type: array + description: Apply sorting of the result + nullable: true + items: + type: string + taskId: type: string + rootProcessInstanceId: + type: string + description: A Task query which defines a group of Tasks. - TaskQueryDto: + DdmTaskQueryDto: type: object + description: DTO that represents a set of query parameters to find user tasks properties: taskId: type: string + example: c3436d47-6b47-498d-89c6-4f65510a1735 + nullable: true + default: null + description: Defines if task with specific taskId has to be found. assignee: type: string + example: some_username + nullable: true + default: null + description: Defines if tasks assigned on specific user have to be found. unassigned: type: boolean + example: false + nullable: true + default: false + description: Defines if only tasks that don't have assignee have to found. processInstanceId: type: string + example: 09c079eb-fea0-4d07-b450-86348840df1f + nullable: true + default: null + description: Defines if tasks of specific process instance have to be found. rootProcessInstanceId: type: string + example: 09c079eb-fea0-4d07-b450-86348840df1f + nullable: true + default: null + description: Defines if tasks of this process instance or its subprocesses have to be found. orQueries: type: array + example: null + nullable: true + default: null + description: | + A JSON array of nested task queries with OR semantics. A task matches a nested query if it fulfills + *at least one* of the query's predicates. With multiple nested queries, a task must fulfill at least one predicate of *each* query ([Conjunctive Normal Form](https://en.wikipedia.org/wiki/Conjunctive_normal_form)). + + All task query properties can be used except for: `sorting` + + See the [User guide](https://docs.camunda.org/manual/7.16/user-guide/process-engine/process-engine-api/#or-queries) + for more information about OR queries. items: - $ref: '#/components/schemas/TaskQueryDto' + $ref: '#/components/schemas/DdmTaskQueryDto' processInstanceIdIn: type: array + example: [09c079eb-fea0-4d07-b450-86348840df1f] + nullable: true + default: null + description: Defines if tasks of specific process instances have to be found. items: type: string sorting: - type: array - items: - $ref: '#/components/schemas/SortingDto' - - SortingDto: - type: object - properties: - sortBy: - type: string - sortOrder: - type: string + type: object + nullable: true + default: null + description: DTO that represents set of sorting query parameters + properties: + sortBy: + type: string + example: created + nullable: true + description: Specifies the field to sort the tasks by. Can be null. + enum: + - instanceId + - caseInstanceId + - dueDate + - followUpDate + - executionId + - caseExecutionId + - assignee + - created + - description + - id + - name + - nameCaseInsensitive + - priority + - tenantId + - processVariable + - executionVariable + - taskVariable + - caseInstanceVariable + - caseExecutionVariable + sortOrder: + type: string + example: asc + nullable: true + default: null + description: Specifies the order in which the tasks should be sorted. Can be null. Cannot work without sortBy. + enum: + - asc + - desc + - null DdmLightweightTaskDto: type: object properties: id: type: string + example: 9402afe5-ce88-4af4-be0b-5035bbe47722 + nullable: false + description: Represents the unique identifier of the task. assignee: type: string + example: some_username + nullable: true + description: Represents the username of a user that assigned to the task. DdmSignableTaskDto: type: object + description: DTO that represents a user task that may require digital signature. properties: id: type: string + nullable: false + example: fa1fdc6e-361a-4236-8d9e-a7ce126a03a5 + description: Represents the ID of the task. taskDefinitionKey: type: string + nullable: false + example: signable-task + description: Represents the key of the task that is defined in process definition. name: type: string + nullable: false + example: Signable task + description: Represents the human readable name of the task. assignee: type: string + nullable: true + example: some_username + description: Represents the username of a user that assigned to the task. created: type: string format: date-time + nullable: false + description: Represents the date and time when the task was created. description: type: string + nullable: true + example: null + description: Represents the description of the task. processDefinitionName: type: string + example: Awesome process definition + nullable: false + description: Represents the human readable name of the process definition associated with the task. processInstanceId: type: string + example: 31b15466-2743-438a-b4cb-fa1a7d1478e9 + nullable: false + description: Represents the unique identifier of the process instance associated with the task. rootProcessInstanceId: type: string + example: 31b15466-2743-438a-b4cb-fa1a7d1478e9 + nullable: false + description: Represents the unique identifier of the root process instance associated with the task. (Can be same as processInstanceId) processDefinitionId: type: string + example: awesome-process-definition:5:9b1d903c-51bc-41b0-b5bc-360362e0d7cb + nullable: false + description: Represents the unique identifier of the process definition associated with the task. formKey: type: string + example: awesome-task-form + nullable: false + description: Represents the form key associated with the task. suspended: type: boolean + example: false + nullable: false + description: Represents the status of the task (suspended or not). eSign: type: boolean + example: true + nullable: false + description: Represents whether the task requires digital signature. signatureValidationPack: type: array + example: [ENTREPRENEUR, LEGAL] + nullable: true + description: Represents a set of subjects used for signature validation. items: type: string enum: [INDIVIDUAL, ENTREPRENEUR, LEGAL] formVariables: type: object + nullable: true + example: {"formVariable1": "formVariableValue", "formVariable2": "formVariableValue2"} + description: Represents a map of form variables associated with the task. DdmCompleteTaskDto: type: object + description: DTO that represents the data required to complete a task in a business process management system (BPMS). properties: variables: type: object + nullable: true + default: null + description: Represents the variables needed for the completed task. Each task may have it's own set of variables. additionalProperties: $ref: '#/components/schemas/DdmVariableValueDto' withVariablesInReturn: type: boolean + nullable: false + default: false + description: Indicates whether the variables should be included in the response or not. DdmCompletedTaskDto: type: object properties: id: type: string + nullable: false + example: fa1fdc6e-361a-4236-8d9e-a7ce126a03a5 + description: Represents the ID of the task. processInstanceId: type: string + example: 31b15466-2743-438a-b4cb-fa1a7d1478e9 + nullable: false + description: Represents the unique identifier of the process instance associated with the task. rootProcessInstanceId: type: string + example: 31b15466-2743-438a-b4cb-fa1a7d1478e9 + nullable: false + description: Represents the unique identifier of the root process instance associated with the task. (Can be same as processInstanceId) rootProcessInstanceEnded: type: boolean + example: true + nullable: false + description: Indicates whether root process instance is ended. variables: type: object + example: null + description: Represents process variables. Will be null if request doesn't contain withVariablesInReturn or it's false. additionalProperties: $ref: '#/components/schemas/DdmVariableValueDto' DdmVariableValueDto: type: object + description: DTO that represents a variable value in a process engine properties: type: type: string + example: string + description: Indicates the type of the variable value. value: - type: object + description: Holds the actual value of the variable. Can be any value. valueInfo: type: object + additionalProperties: + description: Can be any value. + description: Stores additional information about the variable value in the form of a key-value map. + + ErrorDto: + type: object + description: DTO that represents the occurred error. + example: { "traceId": "ac3bee6c5cdb10142947264715dd5559", "code":"500", "message": "Something went wrong", "localizedMessage": null } + properties: + traceId: + type: string + nullable: false + example: ac3bee6c5cdb10142947264715dd5559 + description: Request ID that is read from X-B3-TraceId request header if present or else is generated new one. + code: + type: string + nullable: false + description: The code of an occurred error. + message: + type: string + nullable: false + description: The message of an occurred error. + localizedMessage: + type: string + nullable: true + description: The message of an occurred error based on servers locale. May be null. ClientValidationException: type: object + description: Represent a validation error that occurs on the client side properties: traceId: type: string + nullable: false + example: ac3bee6c5cdb10142947264715dd5559 + description: Request ID that is read from X-B3-TraceId request header if present or else is generated new one. code: type: string + nullable: false + description: The code of an occurred error. details: $ref: '#/components/schemas/ErrorsListDto' @@ -557,7 +1515,16 @@ components: properties: message: type: string + nullable: false + example: "Value cannot be null" + description: The message of an occurred error. field: type: string + nullable: false + example: "nonNullableField" + description: The field name where an error occurred. value: type: string + nullable: false + example: null + description: The field value where an error occurred. diff --git a/docs/ua/modules/arch/attachments/architecture/platform-api/services/ddm-notification-service-swagger.yml b/docs/ua/modules/arch/attachments/architecture/platform-api/services/ddm-notification-service-swagger.yml index 1cbd441b4a..3fce0e7de2 100644 --- a/docs/ua/modules/arch/attachments/architecture/platform-api/services/ddm-notification-service-swagger.yml +++ b/docs/ua/modules/arch/attachments/architecture/platform-api/services/ddm-notification-service-swagger.yml @@ -1,97 +1,253 @@ -openapi: 3.0.1 +openapi: 3.0.3 info: - title: OpenAPI definition - version: v0 + title: User notifications service + description: This document describes REST API of 'User notifications service' + version: "1.0" +tags: +- name: notification-template-api + description: User notification template management Rest API +- name: notification-inbox-api + description: User inbox notification management Rest API paths: /api/notifications/templates/{channel}:{name}: put: tags: - - notification-template-controller - summary: змінити ресурс - description: Використовується для зміни вже існуючого ресурсу з вказанням id + - notification-template-api + summary: Model notification templates separately for each of the communication + channels + description: "### Endpoint purpose: \n This endpoint provides an opportunity\ + \ to model notification templates separately for each of the communication\ + \ channels. \n ### Authorization:\n This endpoint requires valid user authentication.\ + \ To access this endpoint, the request must include a valid access token in\ + \ the _X-Access-Token_ header, otherwise, the API will return a _401 Unauthorized_\ + \ status code" operationId: saveTemplate parameters: - - name: channel - in: path - required: true - schema: - type: string - - name: name - in: path - required: true - schema: - type: string - - name: X-Access-Token - in: header - required: false - schema: - type: string + - name: X-Access-Token + in: header + description: User access token + schema: + type: string + - name: channel + in: path + description: |- + Communication channel for using the message template. Unique in combination with name + + inbox - Citizen portal + + email - email + + diia - Diia application (Ukrainian citizen-facing solution, UA-specific) + required: true + schema: + type: string + - name: name + in: path + description: Template message internal name. Unique in combination with channel + required: true + schema: + type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/SaveNotificationTemplateInputDto' + example: + title: New notification + content: Hello world + attributes: + - name: attribute1 + value: value1 + - name: attribute2 + value: value2 required: true responses: - '200': - description: OK з результатом + "200": + description: OK. Notification templates successfully saved. + content: + application/json: + schema: + $ref: '#/components/schemas/SaveNotificationTemplateOutputDto' + example: + name: Notification Template 1 + channel: email + title: New notification + content: Hello world + checksum: "1234567890" + attributes: + - name: attribute1 + value: value1 + - name: attribute2 + value: value2 + createdAt: 2022-01-01T12:00:00.000Z + updatedAt: 2022-01-02T12:00:00.000Z + externalTemplateId: abcd1234 + externallyPublishedAt: 2022-01-03T12:00:00.000Z + "400": + description: Bad Request. + content: + application/json: {} + "401": + description: Unauthorized. Missing or invalid access token or digital signature. + content: + application/json: {} + "500": + description: Internal Server Error. Server error while processing the request. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' /api/notifications/inbox/{id}/ack: post: tags: - - inbox-notification-controller - summary: створити ресурс - description: Використовується для створення ресурсу. + - notification-inbox-api + summary: Confirmation of in-app message + description: "### Endpoint purpose: \n This endpoint is used for confirming\ + \ notification about the status or result of the business process, receiving\ + \ official messages.\n ### Authorization:\n This endpoint requires valid user\ + \ authentication. To access this endpoint, the request must include a valid\ + \ access token in the _X-Access-Token_ header, otherwise, the API will return\ + \ a _401 Unauthorized_ status code. If the user's ID provided in the JWT token\ + \ does not match the recipient ID of the message, a 403 Forbidden error will\ + \ be returned. Only the recipient of the notification can update its state" operationId: acknowledgeNotification parameters: - - name: id - in: path - required: true - schema: - type: string - format: uuid - - name: X-Access-Token - in: header - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: User access token + required: true + schema: + type: string + - name: id + in: path + description: Notification id + required: true + schema: + type: string + format: uuid responses: - '200': - description: OK з результатом - /api/notifications/inbox: + "200": + description: OK. Inbox notification successfully acknowledged. + "400": + description: Bad Request. + content: + application/json: {} + "401": + description: Unauthorized. Missing or invalid access token or digital signature. + content: + application/json: {} + "403": + description: Forbidden. Insufficient permissions to perform the operation. + content: + application/json: {} + "500": + description: Internal Server Error. Server error while processing the request. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + /api/notifications/templates/: get: tags: - - inbox-notification-controller - summary: отримати список ресурсів - description: Використовується для отримання об’єктів. Не змінює стан ресурсу - operationId: getInboxNotifications - parameters: - - name: X-Access-Token - in: header - required: true - schema: - type: string - - name: request - in: query - required: true - schema: - $ref: '#/components/schemas/InboxOffsetBasedPageRequest' + - notification-template-api + operationId: getAllTemplates responses: - '200': - description: OK з результатом + "200": + description: OK content: '*/*': schema: type: array items: - $ref: '#/components/schemas/InboxNotificationResponseDto' - '401': - description: Помилка аутентифікації (відсутній токен або цифровий підпис) - '403': - description: Недостатньо прав для виконання операції (роль користувача не передбачає доступу до даного ресурсу) - '500': - description: Внутрішня помилка сервера - '501': - description: Не імплементовано (використовується для заглушок) + $ref: '#/components/schemas/NotificationTemplateShortInfoResponseDto' + /api/notifications/inbox: + get: + tags: + - notification-inbox-api + summary: Viewing the list of in-app messages + description: "### Endpoint purpose: \n This endpoint is used for viewing notifications\ + \ about the status or result of the business process, receiving official messages.\n\ + \ ### Authorization:\n This endpoint requires valid user authentication. To\ + \ access this endpoint, the request must include a valid access token in the\ + \ _X-Access-Token_ header, otherwise, the API will return a _401 Unauthorized_\ + \ status code" + operationId: getInboxNotifications + parameters: + - name: X-Access-Token + in: header + description: User access token + required: true + schema: + type: string + - name: offset + in: query + description: Record offset + required: true + schema: + type: integer + default: 0 + - name: limit + in: query + description: Maximum number of records to return + required: true + schema: + type: integer + default: 10 + - name: sort + in: query + description: "Field and order for sorting the records. Example: asc()\ + \ / desc()" + required: true + schema: + type: string + default: desc(endTime) + - name: request + in: query + required: true + schema: + $ref: '#/components/schemas/InboxOffsetBasedPageRequest' + responses: + "200": + description: OK. List of inbox notifications successfully retrieved. + content: + application/json: + schema: + $ref: '#/components/schemas/SaveNotificationTemplateOutputDto' + example: + - id: 3fa85f64-5717-4562-b3fc-2c963f66afa6 + subject: Some subject + message: Some message + isAcknowledged: true + createdAt: 2021-08-10T10:30:00.000Z + "400": + description: Bad Request. + content: + application/json: {} + "401": + description: Unauthorized. Missing or invalid access token or digital signature. + content: + application/json: {} + "500": + description: Internal Server Error. Server error while processing the request. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + /api/notifications/templates/{id}: + delete: + tags: + - notification-template-api + operationId: deleteTemplate + parameters: + - name: id + in: path + required: true + schema: + type: string + format: uuid + responses: + "200": + description: OK components: schemas: NotificationTemplateAttributeDto: @@ -112,6 +268,53 @@ components: type: array items: $ref: '#/components/schemas/NotificationTemplateAttributeDto' + SaveNotificationTemplateOutputDto: + type: object + properties: + name: + type: string + channel: + type: string + title: + type: string + content: + type: string + checksum: + type: string + attributes: + type: array + items: + $ref: '#/components/schemas/NotificationTemplateAttributeDto' + createdAt: + type: string + format: date-time + updatedAt: + type: string + format: date-time + externalTemplateId: + type: string + externallyPublishedAt: + type: string + format: date-time + DetailedErrorResponse: + type: object + properties: + traceId: + type: string + code: + type: string + details: + type: object + NotificationTemplateShortInfoResponseDto: + type: object + properties: + id: + type: string + format: uuid + name: + type: string + channel: + type: string InboxOffsetBasedPageRequest: type: object properties: @@ -133,24 +336,9 @@ components: Sort: type: object properties: - unsorted: + empty: type: boolean sorted: type: boolean - empty: - type: boolean - InboxNotificationResponseDto: - type: object - properties: - id: - type: string - format: uuid - subject: - type: string - message: - type: string - createdAt: - type: string - format: date-time - isAcknowledged: + unsorted: type: boolean diff --git a/docs/ua/modules/arch/attachments/architecture/platform-api/services/digital-document-service-swagger.yml b/docs/ua/modules/arch/attachments/architecture/platform-api/services/digital-document-service-swagger.yml index 58db09a6bb..e67666e7e2 100644 --- a/docs/ua/modules/arch/attachments/architecture/platform-api/services/digital-document-service-swagger.yml +++ b/docs/ua/modules/arch/attachments/architecture/platform-api/services/digital-document-service-swagger.yml @@ -1,290 +1,558 @@ -openapi: 3.0.1 +openapi: 3.0.3 info: - title: OpenAPI definition - version: v0 + title: Digital document service API + description: This document describes REST API of 'Digital document service' + version: "1.0" +tags: +- name: digital-document-service-api + description: Digital document service Rest API +- name: digital-document-service-internal-api-v2 + description: Digital document service internal Rest API +- name: digital-document-service-internal-api + description: Digital document service internal Rest API paths: /internal-api/v2/documents/{rootProcessInstanceId}: post: tags: - - internal-api-document-controller-v-2 + - digital-document-service-internal-api-v2 summary: Upload MultiPart document - description: Returns uploaded document metadata + description: |- + ### Endpoint purpose: + This endpoint allows to upload a document as part of a specified process instance. It accepts a multi-part file and an optional file name. The uploaded document's metadata is returned upon successful storage. + ### Validation: + The file size should not exceed the system limit; otherwise, a _413 Payload Too Large_ status code is returned. For batch file uploads, the total file size should not exceed the expected limit. Media type validation accepts the following formats: PDF, PNG, JPG/JPEG, CSV, ASICs, P7S. If a different format is used, a _422 Unprocessable Entity_ status code is returned. operationId: upload parameters: - - name: rootProcessInstanceId - in: path - required: true - schema: - type: string - - name: filename - in: query - required: false - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: rootProcessInstanceId + in: path + required: true + schema: + type: string + - name: filename + in: query + required: false + schema: + type: string requestBody: content: + multipart/form-data: {} application/json: schema: required: - - file + - file type: object properties: file: type: string format: binary + required: true responses: - '200': - description: OK + "200": + description: "Document uploaded, returns uploaded document metadata" content: '*/*': schema: $ref: '#/components/schemas/InternalApiDocumentMetadataDto' + example: |- + { + "id": "my-file-id", + "name": "my-file-name.pdf", + "type": "application/pdf", + "checksum": "039058c6f2c0cb492c533b0a4d14ef77cc0f78abccced5287d84a1a2011cfb81", + "size": 3, + } + "401": + description: Unauthorized + content: + application/json: {} + "415": + description: Unsupported Media Type + content: + application/json: {} + "422": + description: Unprocessable Entity + content: + application/json: {} + "500": + description: Internal server error + content: + application/json: {} /internal-api/documents/{rootProcessInstanceId}: post: tags: - - internal-api-document-controller + - digital-document-service-internal-api summary: Upload document - description: Returns uploaded document metadata + description: |- + ### Endpoint purpose: + This endpoint downloads document from remote URL passed in request body and using root process instance ID to save document. It returns the uploaded document's metadata. + ### Validation: + The file size should not exceed the system limit; otherwise, a _413 Payload Too Large_ status code is returned. Media type validation accepts the following formats: PDF, PNG, JPG/JPEG, CSV, ASICs, P7S. If a different format is used, a _422 Unprocessable Entity_ status code is returned. operationId: upload_1 parameters: - - name: rootProcessInstanceId - in: path - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: rootProcessInstanceId + in: path + required: true + schema: + type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/RemoteDocumentDto' + example: |- + { + "remoteFileLocation": "https://somefilelocation.com", + "filename": "my-file-name.png", + } required: true responses: - '201': + "200": description: Returns uploaded document metadata content: '*/*': schema: $ref: '#/components/schemas/RemoteDocumentMetadataDto' + example: |- + { + "id": "my-file-id", + "name": "my-file-name.png", + "type": "image/png", + "checksum": "039058c6f2c0cb492c533b0a4d14ef77cc0f78abccced5287d84a1a2011cfb81", + "size": 3, + } + "401": + description: Unauthorized + content: + application/json: {} + "415": + description: Unsupported Media Type + content: + application/json: {} + "422": + description: Unprocessable Entity. Can happen when remote file size more + than allowed. + content: + application/json: {} + "500": + description: Internal server error + content: + application/json: {} /documents/{rootProcessInstanceId}/{taskId}/{fieldName}: post: tags: - - document-controller - summary: Upload document - description: Returns uploaded document metadata + - digital-document-service-api + summary: Upload document in business process + description: |- + ### Endpoint purpose: + This endpoint allows to upload a document as part of a specified process instance and task. It accepts a multi-part file and associated parameters, such as the task ID, form field name, and an optional file name. The uploaded document's metadata is returned upon successful storage. + ### Authorization: + This endpoint requires valid user authentication. To access this endpoint, the request must include a valid access token in the _X-Access-Token_ header, otherwise, the API will return a _401 Unauthorized_ status code. Also if _rootProcessInstanceId_ not in task, which retrieved by _taskId_, or task is suspended, or assignee of task is not the same as provided in _X-Access-Token_ then _403_ status code returned. + ### Validation: + This endpoint requires a valid _fieldName_. If the provided field name is not found in the form related to the user task retrieved by _taskId_, a _422_ status code is returned. The file size should not exceed the system limit; otherwise, a _413 Payload Too Large_ status code is returned. For batch file uploads, the total file size should not exceed the expected limit. Media type validation accepts the following formats: PDF, PNG, JPG/JPEG, CSV, ASICs, P7S. If a different format is used, a _422 Unprocessable Entity_ status code is returned. operationId: upload_2 parameters: - - name: x-forwarded-host - in: header - required: true - schema: - type: string - - name: rootProcessInstanceId - in: path - required: true - schema: - type: string - - name: taskId - in: path - required: true - schema: - type: string - - name: fieldName - in: path - required: true - schema: - type: string - - name: filename - in: query - required: false - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: x-forwarded-host + in: header + required: true + schema: + type: string + - name: rootProcessInstanceId + in: path + required: true + schema: + type: string + - name: taskId + in: path + required: true + schema: + type: string + - name: fieldName + in: path + required: true + schema: + type: string + - name: filename + in: query + required: false + schema: + type: string requestBody: content: + multipart/form-data: {} application/json: schema: required: - - file + - file type: object properties: file: type: string format: binary + required: true responses: - '200': - description: Returns uploaded document metadata + "200": + description: "Document uploaded, returns uploaded document metadata" content: '*/*': schema: $ref: '#/components/schemas/DocumentMetadataDto' + example: |- + { + "id": "my-file-id", + "url": "https://my-file-url", + "name": "my-file-name.pdf", + "type": "application/pdf", + "checksum": "039058c6f2c0cb492c533b0a4d14ef77cc0f78abccced5287d84a1a2011cfb81", + "size": 3, + } + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden. Validation of rootProcessInstanceId or taskId not + passed. + content: + application/json: {} + "413": + description: Payload Too Large. Uploaded document size more than allowed. + content: + application/json: {} + "415": + description: Unsupported Media Type + content: + application/json: {} + "500": + description: Internal server error + content: + application/json: {} /documents/{rootProcessInstanceId}/{taskId}/search: post: tags: - - document-controller + - digital-document-service-api summary: Search documents metadata - description: Returns list of documents metadata + description: |- + ### Endpoint purpose: + This endpoint allows to search for document metadata associated with a specified process instance and task. Document IDs and field names are provided in the request body, and a list of matching document metadata is returned. Server returns every metadata that found and missing files are ignored. + ### Authorization: + This endpoint requires valid user authentication. To access this endpoint, the request must include a valid access token in the _X-Access-Token_ header, otherwise, the API will return a _401 Unauthorized_ status code. Also if _rootProcessInstanceId_ not in task, which retrieved by _taskId_, or task is suspended, or assignee of task is not the same as provided in _X-Access-Token_ then _403_ status code returned. This endpoint requires a valid _fieldName_. If the provided field name is not found in the form related to the user task retrieved by _taskId_, a _403_ status code is returned. operationId: searchMetadata parameters: - - name: x-forwarded-host - in: header - required: true - schema: - type: string - - name: rootProcessInstanceId - in: path - required: true - schema: - type: string - - name: taskId - in: path - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: x-forwarded-host + in: header + required: true + schema: + type: string + - name: rootProcessInstanceId + in: path + required: true + schema: + type: string + - name: taskId + in: path + required: true + schema: + type: string requestBody: content: application/json: schema: - $ref: '#/components/schemas/DocumentMetadataSearchRequestDto' + $ref: '#/components/schemas/RemoteDocumentDto' + example: + - id: file-id-1 + fieldName: form-field-name-1 + - id: file-id-2 + fieldName: form-field-name-2 required: true responses: - '200': - description: OK + "200": + description: Returns list of document metadata content: '*/*': schema: - type: array - items: - $ref: '#/components/schemas/DocumentMetadataDto' + $ref: '#/components/schemas/DocumentMetadataDto' + example: + - id: file-id-1 + url: https://my-file-url + name: my-file-name.pdf + type: application/pdf + checksum: 039058c6f2c0cb492c533b0a4d14ef77cc0f78abccced5287d84a1a2011cfb81 + size: 3 + - id: file-id-2 + url: https://my-file-url2 + name: my-file-name2.pdf + type: application/pdf + checksum: 039058c6f2c0cb492c533b0a4d14ef77cc0f78abccced5287d84a1a2011cfb81 + size: 5 + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden. Validation of rootProcessInstanceId or taskId not + passed. + content: + application/json: {} + "500": + description: Internal server error + content: + application/json: {} /internal-api/documents/{rootProcessInstanceId}/{id}: get: tags: - - internal-api-document-controller + - digital-document-service-internal-api summary: Download document by id - description: Returns document by id + description: |- + ### Endpoint purpose: + This endpoint allows to download a document associated with a specified process instance and document ID. The document is returned as a downloadable resource. operationId: download parameters: - - name: rootProcessInstanceId - in: path - required: true - schema: - type: string - - name: id - in: path - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: rootProcessInstanceId + in: path + required: true + schema: + type: string + - name: id + in: path + required: true + schema: + type: string responses: - '200': - description: OK + "200": + description: Returns uploaded document metadata content: - '*/*': - schema: - type: string - format: binary + application/octet-stream: {} + "401": + description: Unauthorized + content: + application/json: {} + "404": + description: Not Found + content: + application/json: {} + "500": + description: Internal server error + content: + application/json: {} /internal-api/documents/{rootProcessInstanceId}/{id}/metadata: get: tags: - - internal-api-document-controller + - digital-document-service-internal-api summary: Get document metadata by id - description: Returns document metadata by document id + description: |- + ### Endpoint purpose + This endpoint allows users to retrieve document metadata based on a specific document ID associated with a given root process instance. Document metadata includes information such as the document's name, content type, size, and other relevant details. operationId: getMetadata parameters: - - name: rootProcessInstanceId - in: path - required: true - schema: - type: string - - name: id - in: path - required: true - schema: - type: string + - name: rootProcessInstanceId + in: path + required: true + schema: + type: string + - name: id + in: path + required: true + schema: + type: string responses: - '200': - description: OK + "200": + description: Returns uploaded document metadata content: '*/*': schema: $ref: '#/components/schemas/InternalApiDocumentMetadataDto' + example: |- + { + "id": "my-file-id", + "name": "my-file-name.png", + "type": "image/png", + "checksum": "039058c6f2c0cb492c533b0a4d14ef77cc0f78abccced5287d84a1a2011cfb81", + "size": 3, + } + "401": + description: Unauthorized + content: + application/json: {} + "500": + description: Internal server error + content: + application/json: {} /documents/{rootProcessInstanceId}/{taskId}/{fieldName}/{id}: get: tags: - - document-controller - summary: Download document by id - description: Returns document by id + - digital-document-service-api + summary: Download document + description: |- + ### Endpoint purpose: + This endpoint allows users to download a document associated with a specified process instance, task, field, and document ID. The document is returned as a downloadable resource. + ### Authorization: + This endpoint requires valid user authentication. To access this endpoint, the request must include a valid access token in the _X-Access-Token_ header, otherwise, the API will return a _401 Unauthorized_ status code. Also if _rootProcessInstanceId_ not in task, which retrieved by _taskId_, or task is suspended, or assignee of task is not the same as provided in _X-Access-Token_ then _403_ status code returned. This endpoint requires a valid _fieldName_. If the provided field name is not found in the form related to the user task retrieved by _taskId_, a _403_ status code is returned. operationId: download_1 parameters: - - name: rootProcessInstanceId - in: path - required: true - schema: - type: string - - name: taskId - in: path - required: true - schema: - type: string - - name: fieldName - in: path - required: true - schema: - type: string - - name: id - in: path - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: rootProcessInstanceId + in: path + required: true + schema: + type: string + - name: taskId + in: path + required: true + schema: + type: string + - name: fieldName + in: path + required: true + schema: + type: string + - name: id + in: path + required: true + schema: + type: string responses: - '200': - description: OK + "200": + description: Document is returned content: - '*/*': - schema: - type: string - format: binary + application/octet-stream: {} + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden. Validation of rootProcessInstanceId or taskId not + passed. + content: + application/json: {} + "404": + description: Document not found + content: + application/json: {} + "500": + description: Internal server error + content: + application/json: {} /documents/{rootProcessInstanceId}: delete: tags: - - document-controller + - digital-document-service-api + summary: Delete all documents by process instance ID + description: |- + ### Endpoint purpose: + This endpoint is intended for internal system use only and should be restricted to the internal network. It allows the deletion of all documents associated with the specified business process, typically for cleaning temporary data. operationId: delete parameters: - - name: rootProcessInstanceId - in: path - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: rootProcessInstanceId + in: path + required: true + schema: + type: string responses: - '200': - description: OK + "200": + description: Documents deleted successfully. + "401": + description: Unauthorized + content: + application/json: {} + "500": + description: Internal server error + content: + application/json: {} /documents/{rootProcessInstanceId}/{taskId}/{fieldName}/{fileId}: delete: tags: - - document-controller + - digital-document-service-api summary: Delete document by id + description: |- + ### Endpoint purpose: + This endpoint allows the deletion of a specific document associated with the specified process instance ID, task ID, field name, and file ID. + ### Authorization: + This endpoint requires valid user authentication. To access this endpoint, the request must include a valid access token in the _X-Access-Token_ header, otherwise, the API will return a _401 Unauthorized_ status code. Also if _rootProcessInstanceId_ not in task, which retrieved by _taskId_, or task is suspended, or assignee of task is not the same as provided in _X-Access-Token_ then _403_ status code returned. This endpoint requires a valid _fieldName_. If the provided field name is not found in the form related to the user task retrieved by _taskId_, a _403_ status code is returned. operationId: deleteByFileId parameters: - - name: rootProcessInstanceId - in: path - required: true - schema: - type: string - - name: taskId - in: path - required: true - schema: - type: string - - name: fieldName - in: path - required: true - schema: - type: string - - name: fileId - in: path - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: rootProcessInstanceId + in: path + required: true + schema: + type: string + - name: taskId + in: path + required: true + schema: + type: string + - name: fieldName + in: path + required: true + schema: + type: string + - name: fileId + in: path + required: true + schema: + type: string responses: - '200': - description: OK + "200": + description: Document deleted successfully + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden. Validation of rootProcessInstanceId or taskId not + passed. + content: + application/json: {} + "500": + description: Internal server error + content: + application/json: {} components: schemas: InternalApiDocumentMetadataDto: @@ -339,22 +607,3 @@ components: size: type: integer format: int64 - DocumentIdDto: - required: - - fieldName - - id - type: object - properties: - id: - type: string - fieldName: - type: string - DocumentMetadataSearchRequestDto: - required: - - documents - type: object - properties: - documents: - type: array - items: - $ref: '#/components/schemas/DocumentIdDto' diff --git a/docs/ua/modules/arch/attachments/architecture/platform-api/services/excerpt-service-api-swagger.yml b/docs/ua/modules/arch/attachments/architecture/platform-api/services/excerpt-service-api-swagger.yml index 4d05fe0edc..689029df68 100644 --- a/docs/ua/modules/arch/attachments/architecture/platform-api/services/excerpt-service-api-swagger.yml +++ b/docs/ua/modules/arch/attachments/architecture/platform-api/services/excerpt-service-api-swagger.yml @@ -1,210 +1,206 @@ -openapi: 3.0.1 +openapi: 3.0.3 info: - title: OpenAPI definition - version: v0 + title: Excerpts management service + description: This document describes REST API of 'Excerpts management service' + version: "1.0" +tags: +- name: excerpts-service-api + description: Excerpts management service Rest API paths: /excerpts: post: tags: - - excerpt-controller - summary: створити ресурс - description: Використовується для створення ресурсу. + - excerpts-service-api + summary: Create an excerpt generation record + description: |- + ### Endpoint purpose: + Creates an excerpt generation record by sending required parameters as JSON data. Returns the UUID of the generated excerpt, which can be used to access the generated document. + ### Authorization: + This endpoint requires valid user authentication. To access this endpoint, the request must include a valid access token in the _X-Access-Token_ header, otherwise, the API will return a _401 Unauthorized_ status code operationId: generate parameters: - - name: X-Access-Token - in: header - required: false - schema: - type: string - - name: X-Digital-Signature - in: header - required: false - schema: - type: string - - name: X-Digital-Signature-Derived - in: header - required: false - schema: - type: string - - name: X-Source-System - in: header - required: false - schema: - type: string - - name: X-Source-Application - in: header - required: false - schema: - type: string - - name: X-Source-Business-Process - in: header - required: false - schema: - type: string - - name: X-Source-Business-Activity - in: header - required: false - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/ExcerptEventDto' + example: + excerptType: subject-laboratories-accreditation-excerpt + requiresSystemSignature: true + excerptInputData: + subjectId: required: true responses: - '200': - description: OK з результатом + "200": + description: OK. Excerpt ID successfully generated. content: - '*/*': + application/json: schema: $ref: '#/components/schemas/ExcerptEntityId' - '400': - description: Некоректні вхідні дані (наприклад, неправильний тип поля) - '401': - description: Помилка аутентифікації (відсутній токен або цифровий підпис) - '403': - description: Недостатньо прав для виконання операції (роль користувача не передбачає доступу до даного ресурсу) - '422': - description: Помилка валідації, запит містить дані, що не відповідають правилам вказаним в домені - '500': - description: Внутрішня помилка сервера - '501': - description: Не імплементовано (використовується для заглушок) + example: + excerptIdentifier: + "400": + description: Bad Request. Invalid excerpt type or incorrect request parameters. + content: + application/json: {} + "401": + description: Unauthorized. Missing or invalid access token or digital signature. + content: + application/json: {} + "500": + description: Internal Server Error. Error occurred during the excerpt generation + process. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' /excerpts/{id}: get: tags: - - excerpt-controller - summary: отримати ресурс по ідентифікатору - description: Використовується для отримання об’єктів. Не змінює стан ресурсу + - excerpts-service-api + summary: Retrieve an excerpt file + description: "### Endpoint purpose:\n This endpoint allows users to download\ + \ an excerpt file based on the provided excerpt ID. Returns the excerpt file\ + \ as a downloadable resource.\n ### Authorization:\n This endpoint requires\ + \ valid user authentication. To access this endpoint, the request must include\ + \ a valid access token in the _X-Access-Token_ header, otherwise, the API\ + \ will return a _401 Unauthorized_ status code. \n ### Validation: During\ + \ excerpt creation, the system performs validation of the digital signature\ + \ if enabled, and validation of the template associated with the excerpt type.\ + \ If these validations fail, an exception is thrown. If all input data is\ + \ correct, a new excerpt is created and its ID is returned in the response.\ + \ \n ### Validation: During excerpt creation, the system performs validation\ + \ of the digital signature if enabled, and validation of the template associated\ + \ with the excerpt type. If these validations fail, an exception is thrown.\ + \ If all input data is correct, a new excerpt is created and its ID is returned\ + \ in the response." operationId: retrieve parameters: - - name: id - in: path - required: true - schema: - type: string - format: uuid - - name: X-Access-Token - in: header - required: false - schema: - type: string - - name: X-Digital-Signature - in: header - required: false - schema: - type: string - - name: X-Digital-Signature-Derived - in: header - required: false - schema: - type: string - - name: X-Source-System - in: header - required: false - schema: - type: string - - name: X-Source-Application - in: header - required: false - schema: - type: string - - name: X-Source-Business-Process - in: header - required: false - schema: - type: string - - name: X-Source-Business-Activity - in: header - required: false - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: excerptId + in: path + description: The UUID of the excerpt to retrieve + required: true + schema: + type: string + - name: id + in: path + required: true + schema: + type: string + format: uuid + - name: securityContext + in: query + required: true + schema: + $ref: '#/components/schemas/SecurityContext' responses: - '200': - description: OK з результатом + "200": + description: OK. Excerpt file successfully retrieved. + content: + application/octet-stream: {} + "400": + description: Bad Request. Invalid request parameters or data. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "401": + description: Unauthorized. Missing or invalid access token. content: - '*/*': + application/json: schema: - type: string - format: binary - '401': - description: Помилка аутентифікації (відсутній токен або цифровий підпис) - '403': - description: Недостатньо прав для виконання операції (роль користувача не передбачає доступу до даного ресурсу) - '500': - description: Внутрішня помилка сервера - '501': - description: Не імплементовано (використовується для заглушок) + $ref: '#/components/schemas/DetailedErrorResponse' + "500": + description: Internal Server Error. Error occurred while retrieving the + excerpt. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' /excerpts/{id}/status: get: tags: - - excerpt-controller - summary: отримати ресурс по ідентифікатору - description: Використовується для отримання об’єктів. Не змінює стан ресурсу + - excerpts-service-api + summary: Get the status of an excerpt generation + description: "### Endpoint purpose: \n This endpoint is used for getting the\ + \ status of an excerpt generation based on the provided excerpt ID. Returns\ + \ the status of the generation as a JSON object.\n ### Authorization:\n This\ + \ endpoint requires valid user authentication. To access this endpoint, the\ + \ request must include a valid access token in the _X-Access-Token_ header,\ + \ otherwise, the API will return a _401 Unauthorized_ status code" operationId: status parameters: - - name: id - in: path - required: true - schema: - type: string - format: uuid - - name: X-Access-Token - in: header - required: false - schema: - type: string - - name: X-Digital-Signature - in: header - required: false - schema: - type: string - - name: X-Digital-Signature-Derived - in: header - required: false - schema: - type: string - - name: X-Source-System - in: header - required: false - schema: - type: string - - name: X-Source-Application - in: header - required: false - schema: - type: string - - name: X-Source-Business-Process - in: header - required: false - schema: - type: string - - name: X-Source-Business-Activity - in: header - required: false - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: excerptId + in: path + description: The UUID of the excerpt to retrieve + required: true + schema: + type: string + - name: id + in: path + required: true + schema: + type: string + format: uuid responses: - '200': - description: OK з результатом + "200": + description: OK. Excerpt generation status successfully retrieved. content: - '*/*': + application/json: schema: $ref: '#/components/schemas/StatusDto' - '401': - description: Помилка аутентифікації (відсутній токен або цифровий підпис) - '403': - description: Недостатньо прав для виконання операції (роль користувача не передбачає доступу до даного ресурсу) - '500': - description: Внутрішня помилка сервера - '501': - description: Не імплементовано (використовується для заглушок) + example: + status: FAILED + statusDetails: Technical description of the error + "400": + description: Bad Request. Invalid request parameters or data. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "401": + description: Unauthorized. Missing or invalid access token. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "404": + description: Not Found. No generation status found for the provided excerpt + ID. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "500": + description: Internal Server Error. Error occurred while retrieving the + generation status. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' components: schemas: ExcerptEventDto: required: - - excerptType + - excerptType type: object properties: recordId: @@ -224,14 +220,32 @@ components: excerptIdentifier: type: string format: uuid + DetailedErrorResponse: + type: object + properties: + traceId: + type: string + code: + type: string + details: + type: object + SecurityContext: + type: object + properties: + accessToken: + type: string + digitalSignature: + type: string + digitalSignatureDerived: + type: string StatusDto: type: object properties: status: type: string enum: - - IN_PROGRESS - - FAILED - - COMPLETED + - IN_PROGRESS + - FAILED + - COMPLETED statusDetails: type: string diff --git a/docs/ua/modules/arch/attachments/architecture/platform-api/services/form-schema-provider-swagger.yml b/docs/ua/modules/arch/attachments/architecture/platform-api/services/form-schema-provider-swagger.yml index 730a3ede2a..d7bd0a30ff 100644 --- a/docs/ua/modules/arch/attachments/architecture/platform-api/services/form-schema-provider-swagger.yml +++ b/docs/ua/modules/arch/attachments/architecture/platform-api/services/form-schema-provider-swagger.yml @@ -1,125 +1,224 @@ -openapi: 3.0.1 +openapi: 3.0.3 info: - title: OpenAPI definition - version: v0 + title: UI form schemes providing service + description: This document describes REST API of 'UI form schemes providing service' + version: "1.0" +tags: +- name: form-schemes-providing-api + description: UI form schemes providing service paths: /api/forms/{key}: get: tags: - - form-schema-provider-controller - summary: отримати ресурс по ідентифікатору - description: Використовується для отримання об’єктів. Не змінює стан ресурсу + - form-schemes-providing-api + summary: Download form by key + description: |- + ### Endpoint purpose: + This endpoint allows to download a form. The form is returned as a JSON object. operationId: getForm parameters: - - name: key - in: path - required: true - schema: - type: string - - name: X-Access-Token - in: header - required: false - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: key + in: path + description: Form key + required: true + schema: + type: string responses: - '200': - description: OK з результатом + "200": + description: Returns uploaded form metadata content: - '*/*': + application/json: schema: - type: object - properties: - empty: - type: boolean - additionalProperties: - type: object - '401': - description: Помилка аутентифікації (відсутній токен або цифровий підпис) - '403': - description: Недостатньо прав для виконання операції (роль користувача не передбачає доступу до даного ресурсу) - '500': - description: Внутрішня помилка сервера - '501': - description: Не імплементовано (використовується для заглушок) + type: string + example: |- + { + "title": "Test Form", + "path": "test-form", + "name": "test-form", + "display": "form", + "components": [ + { + "type": "button", + "label": "Submit", + "key": "submit", + "size": "md", + "..." + } + ], + } + "401": + description: You are not authorized to get the form + content: + application/json: {} + "404": + description: Form Not Found + content: + application/json: {} + "500": + description: Internal server error + content: + application/json: {} put: tags: - - form-schema-provider-controller - summary: змінити ресурс - description: Використовується для зміни вже існуючого ресурсу з вказанням id + - form-schemes-providing-api + summary: Update form for business process + description: |- + ### Endpoint purpose: + This endpoint allows to update a form that being used by process instance for get user input data. Input form being validated for DuplicateNames, and required properties fillment, and validation of form schema structure operationId: updateForm parameters: - - name: key - in: path - required: true - schema: - type: string - - name: X-Access-Token - in: header - required: false - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: key + in: path + description: Form key + required: true + schema: + type: string requestBody: content: application/json: schema: type: string + example: |- + { + "title": "Test Form", + "path": "test-form", + "name": "test-form", + "display": "form", + "components": [ + { + "type": "button", + "label": "Submit", + "key": "submit", + "size": "md", + "..." + } + ], + } required: true responses: - '200': - description: OK з результатом + "200": + description: Form updated successfully + "400": + description: Bad Request. + content: + application/json: {} + "401": + description: You are not authorized to update the form + content: + application/json: {} + "422": + description: Form scheme is not valid + content: + application/json: {} + "500": + description: Internal server error + content: + application/json: {} delete: tags: - - form-schema-provider-controller - summary: видалити ресурс - description: Використовується для видалення ресурсу з вказанням id + - form-schemes-providing-api + summary: Delete form by key + description: |- + ### Endpoint purpose: + This endpoint allows the deletion of a specific form. operationId: deleteFormByKey parameters: - - name: key - in: path - required: true - schema: - type: string - - name: X-Access-Token - in: header - required: false - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: key + in: path + description: Form key + required: true + schema: + type: string responses: - '200': - description: OK з результатом + "204": + description: Form deleted successfully + "401": + description: You are not authorized to delete the form + content: + application/json: {} + "403": + description: Forbidden + content: + application/json: {} + "500": + description: Internal server error + content: + application/json: {} /api/forms: post: tags: - - form-schema-provider-controller - summary: створити ресурс - description: Використовується для створення ресурсу. + - form-schemes-providing-api + summary: Upload form for business process + description: "### Endpoint purpose:\n This endpoint allows to upload a form\ + \ that being used by process instance for get user input data. Input form\ + \ being validated for duplicate names, validation of form schema structure\ + \ and required properties fillment. Example : property `name` is required\ + \ and should be unique for registry " operationId: saveForm parameters: - - name: X-Access-Token - in: header - required: false - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string requestBody: content: - application/json: + text/plain: schema: type: string + example: |- + { + "title": "Test Form", + "path": "test-form", + "name": "test-form", + "display": "form", + "components": [ + { + "type": "button", + "label": "Submit", + "key": "submit", + "size": "md", + "..." + } + ], + } required: true responses: - '200': - description: OK з результатом - '400': - description: Некоректні вхідні дані (наприклад, неправильний тип поля) - '401': - description: Помилка аутентифікації (відсутній токен або цифровий підпис) - '403': - description: Недостатньо прав для виконання операції (роль користувача не передбачає доступу до даного ресурсу) - '422': - description: Помилка валідації, запит містить дані, що не відповідають правилам вказаним в домені - '500': - description: Внутрішня помилка сервера - '501': - description: Не імплементовано (використовується для заглушок) -components: - schemas: {} + "201": + description: Form saved successfully + "400": + description: Bad Request. + content: + application/json: {} + "401": + description: You are not authorized to add the form + content: + application/json: {} + "422": + description: Form scheme is not valid + content: + application/json: {} + "500": + description: Internal server error + content: + application/json: {} +components: {} diff --git a/docs/ua/modules/arch/attachments/architecture/platform-api/services/form-submission-validation-swagger.yml b/docs/ua/modules/arch/attachments/architecture/platform-api/services/form-submission-validation-swagger.yml index 6bc1bfebd1..b908f50bed 100644 --- a/docs/ua/modules/arch/attachments/architecture/platform-api/services/form-submission-validation-swagger.yml +++ b/docs/ua/modules/arch/attachments/architecture/platform-api/services/form-submission-validation-swagger.yml @@ -1,20 +1,29 @@ openapi: 3.0.0 paths: - '/api/form-submissions/{formKey}/validate': + /api/form-submissions/{formKey}/validate: post: operationId: FormSubmissionsController_validate + summary: Validate form data against scheme + description: |- + ### Endpoint purpose: + This endpoint allows you to validate form data against a specified UI-form scheme. It accepts the form key in the URL, user authentication, and the form schema in the request body. + ### Validation: + This endpoint requires a valid _formKey_ in the URL, which is the unique identifier of the UI-form scheme. If the provided form key does not exist, a _404 Not Found_ status code is returned. The endpoint also validates the form data against the specified UI-form scheme. Validation includes checking for required fields and the overall structure of the submitted data. In case of validation errors, the endpoint returns _422 Unprocessable Entity_. The response body includes details about the errors found during validation. parameters: - - name: X-Request-Id + - &ref_0 + name: X-Request-Id in: header required: false schema: type: string - - name: X-B3-SpanId + - &ref_1 + name: X-B3-SpanId in: header required: false schema: type: string - - name: X-B3-TraceId + - &ref_2 + name: X-B3-TraceId in: header required: false schema: @@ -22,16 +31,16 @@ paths: - name: X-Access-Token required: true in: header - description: Токен доступу користувача + description: Token used for endpoint security schema: type: string - name: formKey required: true in: path - description: Унікальний ідентифікатор схеми UI-форми + description: Unique identifier of UI-form scheme examples: - '1': - value: '1' + "1": + value: "1" user: value: user admin: @@ -64,6 +73,10 @@ paths: value: form-with-all-fields-for-validation auto-form-with-files-upload-validation-soma: value: auto-form-with-files-upload-validation-soma + submission-conversions-day: + value: submission-conversions-day + submission-conversions-phone: + value: submission-conversions-phone schema: type: string requestBody: @@ -71,14 +84,14 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/FormSchemaDTO' + $ref: "#/components/schemas/FormSchemaDTO" responses: - '200': + "200": description: OK - '400': - description: Некоректно сформований запит - '401': - description: Помилка автентифікації (відсутній токен доступу) + "400": + description: Bad request + "401": + description: Authentication error (X-Access-Token missing) content: application/json: schema: @@ -88,8 +101,8 @@ paths: example: 6bf6c1c1d713ec2f message: type: string - '404': - description: Помилка автентифікації (відсутній токен доступу) + "404": + description: Form scheme not found content: application/json: schema: @@ -99,8 +112,8 @@ paths: example: 6bf6c1c1d713ec2f message: type: string - '422': - description: Помилка валідації даних відносно схеми UI-форми + "422": + description: Failed form data validation against UI-form scheme content: application/json: schema: @@ -128,11 +141,11 @@ paths: type: string example: must not be null example: - - value: 'null' + - value: "null" field: entities message: must not be null - '500': - description: Серверна помилка обробки запиту + "500": + description: Internal server error content: application/json: schema: @@ -142,38 +155,34 @@ paths: example: 6bf6c1c1d713ec2f message: type: string - '/api/form-submissions/{formKey}/fields/{fieldKey}/validate': + tags: &ref_3 + - Form submission validation + /api/form-submissions/{formKey}/fields/{fieldKey}/validate: post: operationId: FormSubmissionsController_validateField + summary: Validate form file field value + description: |- + ### Endpoint purpose: + This endpoint allows to validate a specific file field against a UI form schema. + ### Validation: + This endpoint provides validation of file field by size, content type and validation for existance in form scheme. parameters: - - name: X-Request-Id - in: header - required: false - schema: - type: string - - name: X-B3-SpanId - in: header - required: false - schema: - type: string - - name: X-B3-TraceId - in: header - required: false - schema: - type: string + - *ref_0 + - *ref_1 + - *ref_2 - name: X-Access-Token required: true in: header - description: Токен доступу користувача + description: Token used for endpoint security schema: type: string - name: formKey required: true in: path - description: Унікальний ідентифікатор схеми UI-форми + description: Unique identifier of UI-form scheme examples: - '1': - value: '1' + "1": + value: "1" user: value: user admin: @@ -206,12 +215,16 @@ paths: value: form-with-all-fields-for-validation auto-form-with-files-upload-validation-soma: value: auto-form-with-files-upload-validation-soma + submission-conversions-day: + value: submission-conversions-day + submission-conversions-phone: + value: submission-conversions-phone schema: type: string - name: fieldKey required: true in: path - description: Унікальний ідентифікатор поля в межах UI-форми + description: Unique identifier of field within UI-form schema: type: string requestBody: @@ -219,10 +232,10 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/FormFieldValidationDTO' + $ref: "#/components/schemas/FormFieldValidationDTO" responses: - '200': - description: OK з поверненням результату + "200": + description: OK with return result content: application/json: schema: @@ -230,10 +243,10 @@ paths: isValid: type: boolean example: true - '400': - description: Некоректно сформований запит - '401': - description: Помилка автентифікації (відсутній токен доступу) + "400": + description: Bad request + "401": + description: Authentication error (X-Access-Token missing) content: application/json: schema: @@ -243,8 +256,8 @@ paths: example: 6bf6c1c1d713ec2f message: type: string - '404': - description: 'Схема UI-форми за вказаним {form-key} відсутня' + "404": + description: Form scheme not found by provided {form-key} content: application/json: schema: @@ -254,8 +267,8 @@ paths: example: 6bf6c1c1d713ec2f message: type: string - '422': - description: Помилка валідації даних відносно схеми UI-форми + "422": + description: Failed form data validation against UI-form scheme content: application/json: schema: @@ -282,8 +295,8 @@ paths: example: - field: entities message: must not be null - '500': - description: Серверна помилка обробки запиту + "500": + description: Internal server error content: application/json: schema: @@ -293,40 +306,35 @@ paths: example: 6bf6c1c1d713ec2f message: type: string - '501': - description: Операція не підтримується системою - '/api/form-submissions/{formKey}/fields/check': + "501": + description: Not Implemented + tags: *ref_3 + /api/form-submissions/{formKey}/fields/check: post: operationId: FormSubmissionsController_checkFields + summary: Check form fields for existance + description: |- + ### Endpoint purpose: + This endpoint allows to check list of form firlds for existance. + ### Validation: + Endpoint retrieves form scheme by _formKey_ and checks for existance provided fields in request body, returns _422_ status code if no such fields. parameters: - - name: X-Request-Id - in: header - required: false - schema: - type: string - - name: X-B3-SpanId - in: header - required: false - schema: - type: string - - name: X-B3-TraceId - in: header - required: false - schema: - type: string + - *ref_0 + - *ref_1 + - *ref_2 - name: X-Access-Token required: true in: header - description: Токен доступу користувача + description: Token used for endpoint security schema: type: string - name: formKey required: true in: path - description: Унікальний ідентифікатор схеми UI-форми + description: Unique identifier of UI-form scheme examples: - '1': - value: '1' + "1": + value: "1" user: value: user admin: @@ -359,6 +367,10 @@ paths: value: form-with-all-fields-for-validation auto-form-with-files-upload-validation-soma: value: auto-form-with-files-upload-validation-soma + submission-conversions-day: + value: submission-conversions-day + submission-conversions-phone: + value: submission-conversions-phone schema: type: string requestBody: @@ -366,10 +378,10 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/FormFieldsCheckDTO' + $ref: "#/components/schemas/FormFieldsCheckDTO" responses: - '200': - description: OK з поверненням результату + "200": + description: OK with reurn result content: application/json: schema: @@ -382,8 +394,8 @@ paths: example: name: true email: true - '422': - description: Помилка валідації даних відносно схеми UI-форми + "422": + description: Failed form data validation against UI-form scheme content: application/json: schema: @@ -410,10 +422,11 @@ paths: example: - field: entities message: must not be null + tags: *ref_3 info: - title: API - description: '' - version: dev + title: Form submission validation API + description: "" + version: "1.0" contact: {} tags: [] servers: [] @@ -424,8 +437,12 @@ components: properties: data: type: object + example: + formField1: value1 + formField2: value2 processInstanceId: type: string + example: d5a40376-6360-11ee-88e8-0a580a81041b required: - data FormFieldValidationDTO: @@ -433,10 +450,13 @@ components: properties: fileName: type: string + example: file.csv contentType: type: string + example: text/csv size: type: number + example: 10 required: - fileName - contentType @@ -445,9 +465,12 @@ components: type: object properties: fields: - description: Перелік полів форми для первірки + description: List of form fields for verification + example: + - name + - email type: array items: type: string required: - - fields \ No newline at end of file + - fields diff --git a/docs/ua/modules/arch/attachments/architecture/platform-api/services/keycloak-rest-api-ext-swagger.yml b/docs/ua/modules/arch/attachments/architecture/platform-api/services/keycloak-rest-api-ext-swagger.yml index 851deb1699..206577864d 100644 --- a/docs/ua/modules/arch/attachments/architecture/platform-api/services/keycloak-rest-api-ext-swagger.yml +++ b/docs/ua/modules/arch/attachments/architecture/platform-api/services/keycloak-rest-api-ext-swagger.yml @@ -1,10 +1,18 @@ -openapi: 3.0.1 +openapi: 3.0.3 info: - title: Keycloak rest api extension - version: v1 + title: Keycloak rest api extension API + description: This document describes Rest API of 'Keycloak rest api extension' + version: "1.0" +tags: + - name: keycloak-rest-api-extension-api + description: Keycloak rest api extension API + - name: keycloak-rest-api-extension-api-v2 + description: Keycloak rest api extension API v2 paths: /admin/search/{realm}: post: + tags: + - keycloak-rest-api-extension-api summary: Search users by attributes operationId: searchUsersByAttribute parameters: @@ -19,7 +27,7 @@ paths: application/json: schema: $ref: '#/components/schemas/SearchUserRequestDto' - + deprecated: true responses: '200': description: Successful response @@ -27,11 +35,11 @@ paths: application/json: schema: $ref: '#/components/schemas/UserRepresentation' - security: - - bearerAuth: [] /admin/search-by-attributes/{realm}: post: + tags: + - keycloak-rest-api-extension-api summary: Search users by attributes operationId: searchUsersByAttributesDeprecated parameters: @@ -54,14 +62,23 @@ paths: application/json: schema: $ref: '#/components/schemas/UserRepresentation' - security: - - bearerAuth: [] /admin/v2/search-by-attributes/{realm}: post: + tags: + - keycloak-rest-api-extension-api-v2 summary: Search users by attributes (v2) + description: |- + ### Endpoint purpose: + This endpoint allows to search users by attributes. Pagination implemented with using of _imit_ as a page size and _continueToken_. Any response will provide a continue token that must be used for the next page. Returns -1 on the last page. If -1 was passed to a request as continue token it will return empty list of users with _continueToken=-1_. If 0 or _null_ was passed as continue token it will return first page. If 0 or _null_ was passed as _limit_ then pagination is disabled and request will return all found users. operationId: searchUsersByAttributesV2 parameters: + - name: X-Access-Token + required: true + in: header + description: Token used for endpoint security + schema: + type: string - in: path name: realm required: true @@ -69,10 +86,24 @@ paths: type: string requestBody: required: true + description: attributesEquals - contains a map of attributes that user must have with exact match to be returned, attributesStartsWith - contains a map of attributes that user must have with starts with match to be returned, attributesThatAreStartFor - contains a map of attributes that user must have a start for to be returned. content: application/json: schema: $ref: '#/components/schemas/SearchUsersByAttributesRequestDto' + example: + attributesEquals: + attribute1: + - value1 + - value2 + attributesStartsWith: + hierarchyCode: + - "100" + - "101.201" + attributesThatAreStartFor: + hierarchyCode: + - "100.200.300" + - "101" responses: '200': description: Successful response @@ -80,17 +111,34 @@ paths: application/json: schema: $ref: '#/components/schemas/SearchUsersByAttributesResponseDto' - - security: - - bearerAuth: [] + example: + users: + - attributes: + attribute1: value1 + hierarchyCode: "100" + email: user@email.com + firstName: John + lastName: Doe + - attributes: + attribute1: value2 + hierarchyCode: "101.200" + email: user2@email.com + firstName: Steve + lastName: Doe + '401': + description: Unauthorized. Missing auth token or wrong _realm_ in token + content: + application/json: {} + '403': + description: Forbidden users search request for specified realm + content: + application/json: {} + '404': + description: Can happen when could not find client for authorization + content: + application/json: {} components: - securitySchemes: - bearerAuth: - type: http - scheme: bearer - bearerFormat: JWT - schemas: SearchUserRequestDto: type: object diff --git a/docs/ua/modules/arch/attachments/architecture/platform-api/services/platform-gateway-swagger.yml b/docs/ua/modules/arch/attachments/architecture/platform-api/services/platform-gateway-swagger.yml index 58426f10eb..12b1291b12 100644 --- a/docs/ua/modules/arch/attachments/architecture/platform-api/services/platform-gateway-swagger.yml +++ b/docs/ua/modules/arch/attachments/architecture/platform-api/services/platform-gateway-swagger.yml @@ -1,11 +1,20 @@ openapi: 3.0.1 info: - title: platform-gateway API - version: v1 + title: Platform-gateway rest API + description: This document describes Rest API of 'Platform-gateway' + version: "1.0" +tags: + - name: platform-gateway-rest-api + description: Platform gateway rest API paths: /data-factory/{registry}/**: get: + tags: + - platform-gateway-rest-api summary: Access data from the data factory service + description: |- + ### Endpoint purpose: + Retrieves authentication information from Vault, obtains a token from Keycloak based on this authentication information, replaces the existing token in the request header with the new token, passes the request further down the filter chain for processing.. parameters: - in: path name: registry @@ -22,7 +31,12 @@ paths: /bp-gateway/{registry}/**: post: + tags: + - platform-gateway-rest-api summary: Send data to the bp-gateway service + description: |- + ### Endpoint purpose: + The purpose of this filter is to dynamically adjust the URL routing based on the target registry extracted from the request. It enables routing to different destinations or services in a Kubernetes environment by manipulating the route information in the request. parameters: - in: path name: registry @@ -49,7 +63,12 @@ paths: /api/public/data-factory/**: get: + tags: + - platform-gateway-rest-api summary: Access public data from the data factory service + description: |- + ### Endpoint purpose: + This filter is responsible for adding basic authentication headers to incoming requests based on the configuration provided in the basic authentication (based on login/password). It's used to protect certain routes or resources by ensuring that the client provides valid basic authentication credentials.. responses: '200': description: Successful response diff --git a/docs/ua/modules/arch/attachments/architecture/platform-api/services/process-history-service-api-swagger.yml b/docs/ua/modules/arch/attachments/architecture/platform-api/services/process-history-service-api-swagger.yml index 963557abe4..75fdc3d9a5 100644 --- a/docs/ua/modules/arch/attachments/architecture/platform-api/services/process-history-service-api-swagger.yml +++ b/docs/ua/modules/arch/attachments/architecture/platform-api/services/process-history-service-api-swagger.yml @@ -1,174 +1,291 @@ -openapi: 3.0.1 +openapi: 3.0.3 info: - title: OpenAPI definition - version: v0 + title: Business processes history service + description: This document describes REST API of 'Business processes history service' + version: "1.0" +tags: +- name: process-history-service-api + description: Business processes history management Rest API +- name: process-history-service-runtime-api + description: Business processes history management at runtime Rest API paths: /api/runtime/process-instances: get: tags: - - process-runtime-controller - summary: отримати список ресурсів - description: Використовується для отримання об’єктів. Не змінює стан ресурсу + - process-history-service-runtime-api + summary: Get a list of historical data of processes in an unfinished state + description: "### Endpoint assignment: \n This endpoint is used to retrieve\ + \ a list of historical data of processes that are in an incomplete state based\ + \ on specified filtering criteria, including offset, constraint, and sorting\ + \ parameters. Incomplete processes are defined as processes that are currently\ + \ running and have not yet been completed." operationId: getProcesses parameters: - - name: limit - in: query - required: false - schema: - type: integer - format: int32 - default: 10 - - name: offset - in: query - required: false - schema: - type: integer - format: int32 - default: 0 - - name: sort - in: query - required: false - schema: - type: string - default: desc(endTime) - - name: X-Access-Token - in: header - required: false - schema: - type: string + - name: X-Access-Token + in: header + description: User access token + schema: + type: string + - name: offset + in: query + description: Record offset + required: true + schema: + type: integer + default: 0 + - name: limit + in: query + description: Maximum number of records to return + required: true + schema: + type: integer + default: 10 + - name: sort + in: query + description: "Field and order for sorting the records. Example: asc()\ + \ / desc()" + required: true + schema: + type: string + default: desc(endTime) + - name: securityContext + in: query + required: true + schema: + $ref: '#/components/schemas/SecurityContext' responses: - '200': - description: OK з результатом + "200": + description: OK. List of historical process data successfully retrieved. content: - '*/*': + application/json: schema: type: array items: $ref: '#/components/schemas/ProcessResponse' - '401': - description: Помилка аутентифікації (відсутній токен або цифровий підпис) - '403': - description: Недостатньо прав для виконання операції (роль користувача не передбачає доступу до даного ресурсу) - '500': - description: Внутрішня помилка сервера - '501': - description: Не імплементовано (використовується для заглушок) + example: + - processInstanceId: "1234" + superProcessInstanceId: "5678" + processDefinitionId: "91011" + processDefinitionKey: myProcess + processDefinitionName: My Process + businessKey: 1234-5678 + startTime: 2021-01-01T00:00:00Z + startUserId: john.doe + status: + code: InProgress + title: In Progress + "400": + description: Bad Request. Invalid excerpt type or incorrect request parameters. + content: + application/json: {} + "401": + description: Unauthorized. Missing or invalid access token or digital signature. + content: + application/json: {} + "500": + description: Internal Server Error. Server error while processing the request. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' /api/runtime/process-instances/count: get: tags: - - process-runtime-controller - summary: отримати ресурс по ідентифікатору - description: Використовується для отримання об’єктів. Не змінює стан ресурсу + - process-history-service-runtime-api + summary: Get the count of unfinished process instances + description: Returns a count of unfinished process instances based on specified + filtering criteria. Unfinished processes refer to those processes that are + currently executing and have not yet completed. operationId: count parameters: - - name: X-Access-Token - in: header - required: false - schema: - type: string + - name: X-Access-Token + in: header + description: User access token + schema: + type: string + - name: securityContext + in: query + required: true + schema: + $ref: '#/components/schemas/SecurityContext' responses: - '200': - description: OK з результатом + "200": + description: OK. Count of unfinished process instances successfully retrieved. + content: + application/json: + schema: + type: integer + example: + count: 10 + "400": + description: Bad Request. Invalid request parameters. + content: + application/json: {} + "401": + description: Unauthorized. Missing or invalid access token or digital signature. + content: + application/json: {} + "500": + description: Internal Server Error. Server error while processing the request. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' /api/history/tasks: get: tags: - - process-history-controller - summary: отримати список ресурсів - description: Використовується для отримання об’єктів. Не змінює стан ресурсу + - process-history-service-api + summary: Get a list of historical data of tasks + description: "### Endpoint assignment: \n This endpoint is used to retrieve\ + \ a list of historical data of tasks based on specified filtering criteria,\ + \ including offset, constraint, and sorting parameters." operationId: getTasks parameters: - - name: limit - in: query - required: false - schema: - type: integer - format: int32 - default: 10 - - name: offset - in: query - required: false - schema: - type: integer - format: int32 - default: 0 - - name: sort - in: query - required: false - schema: - type: string - default: desc(endTime) - - name: X-Access-Token - in: header - required: false - schema: - type: string + - name: X-Access-Token + in: header + description: User access token + schema: + type: string + - name: offset + in: query + description: Record offset + required: true + schema: + type: integer + default: 0 + - name: limit + in: query + description: Maximum number of records to return + required: true + schema: + type: integer + default: 10 + - name: sort + in: query + description: "Field and order for sorting the records. Example: asc()\ + \ / desc()" + required: true + schema: + type: string + default: desc(endTime) + - name: securityContext + in: query + required: true + schema: + $ref: '#/components/schemas/SecurityContext' responses: - '200': - description: OK з результатом + "200": + description: OK. List of historical tasks data successfully retrieved. content: - '*/*': + application/json: schema: type: array items: - $ref: '#/components/schemas/HistoryTaskResponse' - '401': - description: Помилка аутентифікації (відсутній токен або цифровий підпис) - '403': - description: Недостатньо прав для виконання операції (роль користувача не передбачає доступу до даного ресурсу) - '500': - description: Внутрішня помилка сервера - '501': - description: Не імплементовано (використовується для заглушок) + $ref: '#/components/schemas/ProcessResponse' + example: + - activityInstanceId: "10001" + taskDefinitionKey: task1 + taskDefinitionName: First task + processInstanceId: "1234" + processDefinitionId: "91011" + processDefinitionKey: myProcess + processDefinitionName: My Process + startTime: 2021-04-01T09:00:00Z + endTime: 2021-04-01T12:00:00Z + assignee: john.doe + "400": + description: Bad Request. Invalid excerpt type or incorrect request parameters. + content: + application/json: {} + "401": + description: Unauthorized. Missing or invalid access token or digital signature. + content: + application/json: {} + "500": + description: Internal Server Error. Server error while processing the request. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' /api/history/process-instances: get: tags: - - process-history-controller - summary: отримати список ресурсів - description: Використовується для отримання об’єктів. Не змінює стан ресурсу + - process-history-service-api + summary: Get a list of historical data of processes + description: "### Endpoint assignment: \n This endpoint is used to retrieve\ + \ a list of historical data of processes based on specified filtering criteria,\ + \ including offset, constraint, and sorting parameters." operationId: getProcesses_1 parameters: - - name: limit - in: query - required: false - schema: - type: integer - format: int32 - default: 10 - - name: offset - in: query - required: false - schema: - type: integer - format: int32 - default: 0 - - name: sort - in: query - required: false - schema: - type: string - default: desc(endTime) - - name: X-Access-Token - in: header - required: false - schema: - type: string + - name: X-Access-Token + in: header + description: User access token + schema: + type: string + - name: offset + in: query + description: Record offset + required: true + schema: + type: integer + default: 0 + - name: limit + in: query + description: Maximum number of records to return + required: true + schema: + type: integer + default: 10 + - name: sort + in: query + description: "Field and order for sorting the records. Example: asc()\ + \ / desc()" + required: true + schema: + type: string + default: desc(endTime) + - name: securityContext + in: query + required: true + schema: + $ref: '#/components/schemas/SecurityContext' responses: - '200': - description: OK з результатом + "200": + description: OK. List of historical process data successfully retrieved. content: - '*/*': + application/json: schema: type: array items: - $ref: '#/components/schemas/HistoryProcessResponse' - '401': - description: Помилка аутентифікації (відсутній токен або цифровий підпис) - '403': - description: Недостатньо прав для виконання операції (роль користувача не передбачає доступу до даного ресурсу) - '500': - description: Внутрішня помилка сервера - '501': - description: Не імплементовано (використовується для заглушок) + $ref: '#/components/schemas/ProcessResponse' + example: + - processInstanceId: "1234" + superProcessInstanceId: "5678" + processDefinitionId: "91011" + processDefinitionKey: myProcess + processDefinitionName: My Process + businessKey: 1234-5678 + startTime: 2021-01-01T00:00:00Z + endTime: 2021-01-01T00:01:00Z + startUserId: john.doe + excerptId: "4321" + status: + code: COMPLETED + title: COMPLETED + "400": + description: Bad Request. Invalid excerpt type or incorrect request parameters. + content: + application/json: {} + "401": + description: Unauthorized. Missing or invalid access token or digital signature. + content: + application/json: {} + "500": + description: Internal Server Error. Server error while processing the request. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' components: schemas: ProcessResponse: @@ -199,66 +316,32 @@ components: code: type: string enum: - - ACTIVE - - PENDING - - SUSPENDED - - COMPLETED - - EXTERNALLY_TERMINATED + - ACTIVE + - PENDING + - SUSPENDED + - COMPLETED + - EXTERNALLY_TERMINATED title: type: string - HistoryTaskResponse: + DetailedErrorResponse: type: object properties: - activityInstanceId: - type: string - taskDefinitionKey: - type: string - taskDefinitionName: - type: string - processInstanceId: - type: string - processDefinitionId: - type: string - processDefinitionKey: + traceId: type: string - processDefinitionName: - type: string - rootProcessInstanceId: - type: string - startTime: - type: string - format: date-time - endTime: - type: string - format: date-time - assignee: - type: string - businessKey: + code: type: string - HistoryProcessResponse: + details: + type: object + SecurityContext: type: object properties: - processInstanceId: - type: string - superProcessInstanceId: + accessToken: type: string - processDefinitionId: - type: string - processDefinitionKey: - type: string - processDefinitionName: - type: string - businessKey: + digitalSignature: type: string - startTime: + digitalSignatureDerived: type: string - format: date-time - endTime: + digitalSignatureChecksum: type: string - format: date-time - startUserId: + digitalSignatureDerivedChecksum: type: string - excerptId: - type: string - status: - $ref: '#/components/schemas/StatusModel' diff --git a/docs/ua/modules/arch/attachments/architecture/platform-api/services/registry-regulation-management-swagger.yml b/docs/ua/modules/arch/attachments/architecture/platform-api/services/registry-regulation-management-swagger.yml index f880a2ded0..7a4debeb3c 100644 --- a/docs/ua/modules/arch/attachments/architecture/platform-api/services/registry-regulation-management-swagger.yml +++ b/docs/ua/modules/arch/attachments/architecture/platform-api/services/registry-regulation-management-swagger.yml @@ -1,66 +1,93 @@ openapi: 3.0.3 info: - title: Registry regulations admin-portal + title: Registry regulations management description: This document describes REST API of 'Registry regulations admin-portal' - version: '1.0' + version: "1.0" tags: - - name: Registry regulations version-candidate tables management Rest API - - name: Registry regulations version-candidate management Rest API - - name: Registry regulations version-candidate Business processes management Rest API - - name: Registry regulations version-candidate Forms management Rest API - - name: Registry regulations version-candidate data-model tables file management Rest API - - name: Registry regulations version candidates settings Rest API - - name: Registry regulations master version management Rest API - - name: Registry regulations master version data-model tables file management Rest API - - name: Registry regulations master Business processes management Rest API - - name: Registry regulations Master version Groups management Rest API - - name: Registry regulations candidate version Groups management Rest API - - name: Registry regulations Master version settings Rest API - - name: Users bulk upload RestAPI - - name: Registry regulations Master version Forms management Rest API - - name: Registry regulations master version tables management Rest API +- name: candidate-version-business-processes-api + description: Registry regulations version-candidate Business processes management + Rest API +- name: candidate-version-tables-api + description: Registry regulations version-candidate tables management Rest API +- name: candidate-version-api + description: Registry regulations version-candidate management Rest API +- name: master-version-api + description: Registry regulations master version management Rest API +- name: master-version-data-model-tables-api + description: Registry regulations master version data-model tables file management + Rest API +- name: master-version-tables-api + description: Registry regulations master version tables management Rest API +- name: candidate-version-business-process-groups-api + description: Registry regulations candidate version Groups management Rest API +- name: candidate-version-settings-api + description: Registry regulations version candidates settings Rest API +- name: candidate-version-data-model-tables-api + description: Registry regulations version-candidate data-model tables file management + Rest API +- name: master-version-settings-api + description: Registry regulations Master version settings Rest API +- name: users-batch-loads-api + description: Users bulk upload RestAPI +- name: master-version-forms-api + description: Registry regulations Master version Forms management Rest API +- name: candidate-version-forms-api + description: Registry regulations version-candidate Forms management Rest API +- name: master-version-business-process-groups-api + description: Registry regulations Master version Groups management Rest API +- name: master-version-business-processes-api + description: Registry regulations master Business processes management Rest API paths: /versions/master/forms/{formName}: get: tags: - - Registry regulations Master version Forms management Rest API - description: Get specific form full details + - master-version-forms-api + summary: Get specific form full details + description: | + ### Endpoint purpose: + This endpoint is used for retrieving a JSON representation of a user __form__ directly from the __master__ version. This operation retrieves a single _form_ based on the specified __formName__. If you need to retrieve list of _forms_, you can use the [GET](#master-version-forms-api/getFormsFromMaster) endpoint. operationId: getForm parameters: - - name: X-Access-Token - in: header - description: Token used for endpoint security - required: true - schema: - type: string - - name: formName - in: path - description: Form name - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: formName + in: path + description: Form name + required: true + schema: + type: string responses: - '200': - description: OK - content: - application/json: - schema: - type: string - '401': + "200": + description: Form successfully retrieved. + content: + application/json: + example: |- + { + "display": "form", + "components": [], + "path": "my-awesome-form", + "name": "my-awesome-form", + "title": "Form human-readable title", + } + "401": description: Unauthorized content: application/json: {} - '403': + "403": description: Forbidden content: application/json: {} - '404': + "404": description: Not Found content: application/json: schema: $ref: '#/components/schemas/DetailedErrorResponse' - '500': + "500": description: Internal server error content: application/json: @@ -68,126 +95,205 @@ paths: $ref: '#/components/schemas/DetailedErrorResponse' put: tags: - - Registry regulations Master version Forms management Rest API - description: Update existing form within master + - master-version-forms-api + summary: Update existing form within master version. + description: "### Endpoint purpose: \n This endpoint is used for updating a\ + \ json representation of a user __form__ directly in __master__ version. Just\ + \ as if _version-candidate_ was created, the _form_ was updated in that _version-candidate_\ + \ and then the _version-candidate_ was submitted. It can be used if there\ + \ is needed to update __a single form__. If you need to make some changes\ + \ in several _forms_ and/or _business-processes_ at one time, it's still preferred\ + \ to make this changes through a _version-candidate_. \n ### Conflict resolving:\n\ + \ In this endpoint [Conditional requests](https://datatracker.ietf.org/doc/html/rfc9110#name-conditional-requests)\ + \ are supported. You can use an __ETag__ header value, that can be previously\ + \ obtained in [GET](#master-version-forms-api/getForm) request, as a value\ + \ for __If-Match__ header so you can be sure that you're updating the last\ + \ version of a _form_. But if your __If-Match__ value is differs from the\ + \ servers you will receive a _409 Conflict_ instead of _412 Precondition Failed_.\ + \ For _registry-regulation-management_ service this situation's considered\ + \ as a conflict. If __If-Match__ is not present then conflict checking won't\ + \ be performed.\n### Form validation: \nBefore saving the content to the storage,\ + \ the __validation__ of a _form_ is executed. The _form_ must be a __json__\ + \ document and must have a non-empty __\"title\"__ field. Also the field __\"\ + name\"__ must be present and equal to __\"path\"__ field, that must be present\ + \ too. Also _both_ this values must be equal to __\"formName\"__ pathVariable.\ + \ In other case the _form_ won't be working as expected. Changing __\"name\"\ + __ or __\"path\"__ is not supported. If you need to change these fields then\ + \ you need to copy the _form_ with new name and delete the previous _form_.\ + \ \n ### Missing form handling: \n If the updated _form_ is missing and the\ + \ _If-Match_ header is not present (or equal to __\"*\"__) then the _form_\ + \ will be __created__ instead.\n ### Created and modified dates handling:\n\ + \ If there any of __\"created\"__ or __\"modified\"__ fields present in the\ + \ request body they will be ignored. Value for the __\"created\"__ field is\ + \ automatically getting from the previous _form_ content (if present, in other\ + \ case it's getting from the git log). And for the __\"updated\"__ value the\ + \ current servers datetime in UTC is set." operationId: updateForm parameters: - - name: X-Access-Token - in: header - description: Token used for endpoint security - required: true - schema: - type: string - - name: If-Match - in: header - description: ETag to verify whether user has latest data - schema: - type: string - - name: formName - in: path - description: Name of the form to be updated - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: If-Match + in: header + description: ETag to verify whether user has latest data + schema: + type: string + - name: formName + in: path + description: Name of the form to be updated + required: true + schema: + type: string requestBody: content: application/json: schema: type: string + example: + display: form + components: [] + path: my-awesome-form + name: my-awesome-form + title: Form human-readable title required: true responses: - '200': - description: OK + "200": + description: Form successfully updated. + headers: + ETag: + description: New ETag value for conflict verification + style: simple + schema: + type: string content: - application/json: {} - '401': + application/json: + example: + display: form + components: [] + path: my-awesome-form + name: my-awesome-form + title: Form human-readable title + created: 2023-03-28T09:18:41.941Z + modified: 2023-03-29T09:58:44.100Z + "400": + description: Request body is not a valid json + "401": description: Unauthorized - content: - application/json: {} - '403': + "403": description: Forbidden - content: - application/json: {} - '404': - description: Not Found + "409": + description: Conflict. __If-Match__ input value doesn't equal to servers + value. It means that form already has been updated/deleted after user + obtained __ETag__. content: application/json: schema: $ref: '#/components/schemas/DetailedErrorResponse' - '409': - description: Conflict + "422": + description: Unprocessable Entity. User form is not valid. content: application/json: schema: $ref: '#/components/schemas/DetailedErrorResponse' - '422': - description: Unprocessable Entity - content: - application/json: - schema: - $ref: '#/components/schemas/DetailedErrorResponse' - '500': - description: Internal server error + "500": + description: Internal server error. content: application/json: schema: $ref: '#/components/schemas/DetailedErrorResponse' post: tags: - - Registry regulations Master version Forms management Rest API - description: Create new form within master + - master-version-forms-api + summary: Create new form within master + description: "### Endpoint purpose: \n This endpoint is used for creating a\ + \ JSON representation of a user __form__ directly in the __master__ version.\ + \ It is intended for situations that require the creation of a new _form_.\ + \ This operation creates a single _form_ and should be used when multiple\ + \ _forms_ and/or _business-processes_ do not need to be created or modified\ + \ simultaneously. If you need to create or modify several _forms_ and/or _business-processes_\ + \ at once, it is still recommended to use a _version-candidate_. \n ### Form\ + \ validation: \nBefore saving the new _form_ to the storage, the server validates\ + \ the _form_. The _form_ must be a __json__ document and must have a non-empty\ + \ __\"title\"__ field. Also the field __\"name\"__ must be present and equal\ + \ to __\"path\"__ field, that must be present too. Also _both_ this values\ + \ must be equal to __\"formName\"__ pathVariable. In other case the _form_\ + \ won't be working as expected. \n ### Missing form handling: \n If the specified\ + \ _form_ does not already exist, the server will create a new _form_ with\ + \ the provided data. If the _form_ does exists, the server will return a _409\ + \ Conflict_ error indicating that the _form_ already exists.\n ### Created\ + \ and modified dates handling:\n If there any of __\"created\"__ or __\"modified\"\ + __ fields present in the request body they will be ignored. The __\"created\"\ + __ and __\"updated\"__ fields are automatically set to the current server\ + \ time in UTC." operationId: formCreate parameters: - - name: X-Access-Token - in: header - description: Token used for endpoint security - required: true - schema: - type: string - - name: formName - in: path - description: Name of the new form to be created - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: formName + in: path + description: Name of the new form to be created + required: true + schema: + type: string requestBody: content: application/json: schema: type: string + example: + display: form + components: [] + path: my-awesome-form + name: my-awesome-form + title: Form human-readable title required: true responses: - '201': - description: Created + "201": + description: Form successfully created + headers: + ETag: + description: New ETag value for conflict verification + style: simple + schema: + type: string content: - application/json: {} - '401': + application/json: + example: + display: form + components: [] + path: my-awesome-form + name: my-awesome-form + title: Form human-readable title + created: 2023-03-28T09:18:41.941Z + modified: 2023-03-28T09:18:41.941Z + "401": description: Unauthorized content: application/json: {} - '403': + "403": description: Forbidden content: application/json: {} - '404': - description: Not Found + "409": + description: Conflict. It means that form already has been created. content: application/json: schema: $ref: '#/components/schemas/DetailedErrorResponse' - '409': - description: Conflict + "422": + description: Unprocessable Entity. User form is not valid. content: application/json: schema: $ref: '#/components/schemas/DetailedErrorResponse' - '422': - description: Unprocessable Entity - content: - application/json: - schema: - $ref: '#/components/schemas/DetailedErrorResponse' - '500': + "500": description: Internal server error content: application/json: @@ -195,47 +301,62 @@ paths: $ref: '#/components/schemas/DetailedErrorResponse' delete: tags: - - Registry regulations Master version Forms management Rest API - description: Delete existing form within master + - master-version-forms-api + summary: Delete existing form within master + description: |- + ### Endpoint purpose: + This endpoint is used for deleting a JSON representation of a user __form__ directly from the __master__ version. + ### Conflict resolving: + In this endpoint, [Conditional requests](https://datatracker.ietf.org/doc/html/rfc9110#name-conditional-requests) are supported. You can use an __ETag__ header value, which can be previously obtained in a [GET](#master-version-forms-api/getForm) request, as a value for the __If-Match__ header. This ensures that you're deleting the latest version of the _form_. However, if your __If-Match__ value differs from the server's value, you will receive _409 Conflict_ instead of _412 Precondition Failed_. For the _registry-regulation-management_ service, this situation is considered a conflict. If the __If-Match__ header is not present, conflict checking will not be performed. + ### Missing form handling: + If the specified _form_ is missing and the _If-Match_ header is not present (or equal to __"*"__), the server will return a 404 Not Found error indicating that the specified _form_ does not exist. operationId: deleteForm parameters: - - name: X-Access-Token - in: header - description: Token used for endpoint security - required: true - schema: - type: string - - name: If-Match - in: header - description: ETag to verify whether user has latest data - schema: - type: string - - name: formName - in: path - description: Name of the form to be deleted - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: If-Match + in: header + description: ETag to verify whether user has latest data + schema: + type: string + - name: formName + in: path + description: Name of the form to be deleted + required: true + schema: + type: string responses: - '204': - description: No Content + "204": + description: No Content. Form successfully deleted. content: application/json: {} - '401': + "401": description: Unauthorized content: application/json: {} - '403': + "403": description: Forbidden content: application/json: {} - '404': + "404": description: Not Found content: application/json: schema: $ref: '#/components/schemas/DetailedErrorResponse' - '500': + "409": + description: Conflict. __If-Match__ input value doesn't equal to servers + value. It means that form already has been updated/deleted after user + obtained __ETag__. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "500": description: Internal server error content: application/json: @@ -244,44 +365,64 @@ paths: /versions/master/business-processes/{businessProcessName}: get: tags: - - Registry regulations master Business processes management Rest API - description: Get business process + - master-version-business-processes-api + summary: Get specific business process full details + description: | + ### Endpoint purpose: + This endpoint is used for retrieving a XML representation of a user __business-process__ directly from the __master__ version. This operation retrieves a single _business-process_ based on the specified __businessProcessName__ with full details in _XML_ format. If you need to retrieve list of _business-processes_ with brief information and in _json_ format, you can use the [GET](#master-version-business-processes-api/getBusinessProcessesFromMaster). operationId: getBusinessProcess parameters: - - name: X-Access-Token - in: header - description: Token used for endpoint security - required: true - schema: - type: string - - name: businessProcessName - in: path - description: Process name - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: businessProcessName + in: path + description: Process name + required: true + schema: + type: string responses: - '200': - description: OK - content: - text/xml: - schema: - type: string - '401': + "200": + description: OK. Business process successfully retrieved. + content: + text/plain: + example: |- + + + + + + + + + + + + + + "401": description: Unauthorized content: application/json: {} - '403': + "403": description: Forbidden content: application/json: {} - '404': + "404": description: Not Found content: application/json: schema: $ref: '#/components/schemas/DetailedErrorResponse' - '500': + "500": description: Internal server error content: application/json: @@ -289,65 +430,130 @@ paths: $ref: '#/components/schemas/DetailedErrorResponse' put: tags: - - Registry regulations master Business processes management Rest API - description: Update business process + - master-version-business-processes-api + summary: Update business process within master version. + description: "### Endpoint purpose: \n This endpoint is used for updating a\ + \ xml representation of a user __business process__ directly in __master__\ + \ version. Just as if _version-candidate_ was created, the _business process_\ + \ was updated in that _version-candidate_ and then the _version-candidate_\ + \ was submitted. It can be used if there is needed to update __a single business\ + \ process__. If you need to make some changes in several _business processes_\ + \ at one time, it's still preferred to make this changes through a _version-candidate_.\ + \ \n ### Conflict resolving:\n In this endpoint [Conditional requests](https://datatracker.ietf.org/doc/html/rfc9110#name-conditional-requests)\ + \ are supported. You can use an __ETag__ header value, that can be previously\ + \ obtained in [GET](#master-version-business-processes-api/getBusinessProcess)\ + \ request, as a value for __If-Match__ header so you can be sure that you're\ + \ updating the last version of a _business-process_. But if your __If-Match__\ + \ value is differs from the servers you will receive a _409 Conflict_ instead\ + \ of _412 Precondition Failed_. For _registry-regulation-management_ service\ + \ this situation's considered as a conflict. If __If-Match__ is not present\ + \ then conflict checking won't be performed.\n### Business process validation:\ + \ \nBefore saving the content to the storage, the __validation__ of a _business-process_\ + \ is executed. The _business-process_ must be a __xml__ document, must conform\ + \ to the BPMN20.xsd schema (available at https://github.com/bpmn-io/bpmn-moddle/blob/master/resources/bpmn/xsd/BPMN20.xsd)\ + \ and must have a non-empty __\"name\"__ field (attribute as part of tCallableElement).\ + \ Also _name_ values must be equal to __\"businessProcessName\"__ pathVariable.\ + \ In other case the _business-process_ won't be working as expected. Changing\ + \ __\"name\"__ is not supported. If you need to change this field then you\ + \ need to copy the _business-process_ with new name and delete the previous\ + \ _business-process_. \n ### Missing business process handling: \n If the\ + \ updated _business-process_ is missing and the _If-Match_ header is not present\ + \ (or equal to __\"*\"__) then the _business-process_ will be __created__\ + \ instead." operationId: updateBusinessProcess parameters: - - name: X-Access-Token - in: header - description: Token used for endpoint security - required: true - schema: - type: string - - name: If-Match - in: header - description: ETag to verify whether user has latest data - schema: - type: string - - name: businessProcessName - in: path - description: Process name - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: If-Match + in: header + description: ETag to verify whether user has latest data + schema: + type: string + - name: businessProcessName + in: path + description: Process name + required: true + schema: + type: string requestBody: content: - application/json: + text/plain: schema: type: string + example: |- + + + + + + + + + + + + + required: true responses: - '200': - description: OK - content: - text/xml: {} - '401': + "200": + description: OK. Business process successfully updated. + content: + text/plain: + example: |- + + + + + + + + + + + + + + + "401": description: Unauthorized content: application/json: {} - '403': + "403": description: Forbidden content: application/json: {} - '404': - description: Not Found + "409": + description: Conflict. __If-Match__ input value doesn't equal to servers + value. It means that business process already has been updated/deleted + after user obtained __ETag__. content: application/json: schema: $ref: '#/components/schemas/DetailedErrorResponse' - '409': - description: Conflict - content: - application/json: - schema: - $ref: '#/components/schemas/DetailedErrorResponse' - '422': - description: Unprocessable Entity + "422": + description: Unprocessable Entity. User business process is not valid. content: application/json: schema: $ref: '#/components/schemas/DetailedErrorResponse' - '500': + "500": description: Internal server error content: application/json: @@ -355,60 +561,113 @@ paths: $ref: '#/components/schemas/DetailedErrorResponse' post: tags: - - Registry regulations master Business processes management Rest API - description: Create new business process + - master-version-business-processes-api + summary: Create new business process + description: "### Endpoint purpose: \n This endpoint is used for creating a\ + \ xml representation of a user __business process__ directly in __master__\ + \ version. Just as if _version-candidate_ was created, the _business process_\ + \ was created in that _version-candidate_ and then the _version-candidate_\ + \ was submitted. It can be used if there is needed to create __a single business\ + \ process__. If you need to create several _business processes_ at one time,\ + \ it's still preferred to make this changes through a _version-candidate_.\ + \ \n ### Business process validation: \nBefore saving the content to the storage,\ + \ the __validation__ of a _business-process_ is executed. The _business-process_\ + \ must be a __xml__ document, must conform to the BPMN20.xsd schema (available\ + \ at https://github.com/bpmn-io/bpmn-moddle/blob/master/resources/bpmn/xsd/BPMN20.xsd)\ + \ and must have a non-empty __\"name\"__ field (attribute as part of tCallableElement).\ + \ Also _name_ values must be equal to __\"businessProcessName\"__ pathVariable.\ + \ In other case the _business-process_ won't be working as expected. \n###\ + \ Missing business process handling: \n If the specified _business-process_\ + \ does not already exist, the server will create a new _business-process_\ + \ with the provided data. Otherwise, the server will return a _409 Conflict_\ + \ error indicating that the _business-process_ already exists." operationId: createBusinessProcess parameters: - - name: X-Access-Token - in: header - description: Token used for endpoint security - required: true - schema: - type: string - - name: businessProcessName - in: path - description: Name of the new process to be created - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: businessProcessName + in: path + description: Name of the new process to be created + required: true + schema: + type: string requestBody: content: - application/json: + text/plain: schema: type: string + example: |- + + + + + + + + + + + + + required: true responses: - '201': - description: Created - content: - text/xml: {} - '401': + "201": + description: Business process successfully created. + content: + text/plain: + example: |- + + + + + + + + + + + + + + + "401": description: Unauthorized content: application/json: {} - '403': + "403": description: Forbidden content: application/json: {} - '404': - description: Not Found + "409": + description: Conflict. It means that business process already has been created. content: application/json: schema: $ref: '#/components/schemas/DetailedErrorResponse' - '409': - description: Conflict + "422": + description: Unprocessable Entity. User business process is not valid. content: application/json: schema: $ref: '#/components/schemas/DetailedErrorResponse' - '422': - description: Unprocessable Entity - content: - application/json: - schema: - $ref: '#/components/schemas/DetailedErrorResponse' - '500': + "500": description: Internal server error content: application/json: @@ -416,47 +675,62 @@ paths: $ref: '#/components/schemas/DetailedErrorResponse' delete: tags: - - Registry regulations master Business processes management Rest API - description: Delete business process + - master-version-business-processes-api + summary: Delete existing business process + description: |- + ### Endpoint purpose: + This endpoint is used for deleting a user __business-process__ directly from the __master__ version. + ### Conflict resolving: + In this endpoint, [Conditional requests](https://datatracker.ietf.org/doc/html/rfc9110#name-conditional-requests) are supported. You can use an __ETag__ header value, which can be previously obtained in a [GET](#master-version-business-processes-api/getBusinessProcess) request, as a value for the __If-Match__ header. This ensures that you're deleting the latest version of the _business process_. However, if your __If-Match__ value differs from the server's value, you will receive _409 Conflict_ instead of _412 Precondition Failed_. For the _registry-regulation-management_ service, this situation is considered a conflict. If the __If-Match__ header is not present, conflict checking will not be performed. + ### Missing business process handling: + If the specified _business process_ is missing and the _If-Match_ header is not present (or equal to __"*"__), the server will return a 404 Not Found error indicating that the specified _business process_ does not exist. operationId: deleteBusinessProcess parameters: - - name: X-Access-Token - in: header - description: Token used for endpoint security - required: true - schema: - type: string - - name: If-Match - in: header - description: ETag to verify whether user has latest data - schema: - type: string - - name: businessProcessName - in: path - description: Process name - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: If-Match + in: header + description: ETag to verify whether user has latest data + schema: + type: string + - name: businessProcessName + in: path + description: Process name + required: true + schema: + type: string responses: - '204': - description: No Content + "204": + description: No Content. Business process successfully deleted. content: application/json: {} - '401': + "401": description: Unauthorized content: application/json: {} - '403': + "403": description: Forbidden content: application/json: {} - '404': + "404": description: Not Found content: application/json: schema: $ref: '#/components/schemas/DetailedErrorResponse' - '500': + "409": + description: Conflict. __If-Match__ input value doesn't equal to servers + value. It means that business process already has been updated/deleted + after user obtained __ETag__. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "500": description: Internal server error content: application/json: @@ -465,44 +739,52 @@ paths: /versions/candidates/{versionCandidateId}/settings: get: tags: - - Registry regulations version candidates settings Rest API - description: Get existing settings for version-candidate + - candidate-version-settings-api + summary: Get settings for version-candidate + description: |- + ### Endpoint purpose: + This endpoint is used for retrieving a JSON representations of existing _settings_ for version candidate operationId: getSettings_1 parameters: - - name: X-Access-Token - in: header - description: Token used for endpoint security - required: true - schema: - type: string - - name: versionCandidateId - in: path - description: Version candidate identifier - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: versionCandidateId + in: path + description: Version candidate identifier + required: true + schema: + type: string responses: - '200': - description: OK + "200": + description: OK. Settings information retrieved successfully content: application/json: schema: $ref: '#/components/schemas/SettingsInfoDto' - '401': + example: + themeFile: white-theme.js + title: mdtuddm + titleFull: <Назва реєстру> + supportEmail: support@registry.gov.ua + "401": description: Unauthorized content: application/json: {} - '403': + "403": description: Forbidden content: application/json: {} - '404': + "404": description: Not Found content: application/json: schema: $ref: '#/components/schemas/DetailedErrorResponse' - '500': + "500": description: Internal server error content: application/json: @@ -510,54 +792,76 @@ paths: $ref: '#/components/schemas/DetailedErrorResponse' put: tags: - - Registry regulations version candidates settings Rest API - description: Update existing settings for version-candidate + - candidate-version-settings-api + summary: Update settings for version-candidate + description: |- + ### Endpoint purpose: + This endpoint is used to update/create a _settings_ for the version candidate. A conflict can arise when two or more commits have made changes to the same part of a file. This can happen when two developers are working on the same branch at the same time, and both make changes to the same piece of code without being aware of each other's changes. operationId: updateSettings parameters: - - name: X-Access-Token - in: header - description: Token used for endpoint security - required: true - schema: - type: string - - name: versionCandidateId - in: path - description: Version candidate identifier - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: versionCandidateId + in: path + description: Version candidate identifier + required: true + schema: + type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/SettingsInfoDto' + example: + themeFile: white-theme.js + title: mdtuddm + titleFull: <Назва реєстру> + supportEmail: support@registry.gov.ua required: true responses: - '200': - description: OK + "200": + description: OK. Settings information updated successfully content: - application/json: {} - '401': + application/json: + schema: + $ref: '#/components/schemas/SettingsInfoDto' + example: + themeFile: white-theme.js + title: mdtuddm + titleFull: <Назва реєстру> + supportEmail: support@registry.gov.ua + "401": description: Unauthorized content: application/json: {} - '403': + "403": description: Forbidden content: application/json: {} - '404': + "404": description: Not Found content: application/json: schema: $ref: '#/components/schemas/DetailedErrorResponse' - '422': + "409": + description: Conflict. It means that settings file content already has been + updated/deleted. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "422": description: Unprocessable Entity content: application/json: schema: $ref: '#/components/schemas/DetailedErrorResponse' - '500': + "500": description: Internal server error content: application/json: @@ -566,42 +870,46 @@ paths: /versions/candidates/{versionCandidateId}/rebase: put: tags: - - Registry regulations version-candidate management Rest API - description: Rebase changes from master version + - candidate-version-api + summary: Rebase changes from master version + description: This operation applies the changes made to the _master_ version + onto a __version-candidate__. The purpose is to ensure that the __version + candidate__ has all the latest changes from the _master_ version before merging + it. operationId: rebase parameters: - - name: X-Access-Token - in: header - description: Token used for endpoint security - required: true - schema: - type: string - - name: versionCandidateId - in: path - description: Version candidate identifier - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: versionCandidateId + in: path + description: Version candidate identifier + required: true + schema: + type: string responses: - '200': - description: OK + "200": + description: OK. Rebase was successful content: application/json: {} - '401': + "401": description: Unauthorized content: application/json: {} - '403': + "403": description: Forbidden content: application/json: {} - '404': + "404": description: Not Found content: application/json: schema: $ref: '#/components/schemas/DetailedErrorResponse' - '500': + "500": description: Internal server error content: application/json: @@ -610,48 +918,59 @@ paths: /versions/candidates/{versionCandidateId}/forms/{formName}: get: tags: - - Registry regulations version-candidate Forms management Rest API - description: Get full details of the specific form within version-candidate + - candidate-version-forms-api + summary: Get full details of the specific form within version-candidate + description: | + ### Endpoint purpose: + This endpoint is used for retrieving a JSON representation of a user __form__ from the __version-candidate__. This operation retrieves a single _form_ based on the specified __formName__. If you need to retrieve list of _forms_, you can use the [GET](#candidate-version-forms-api/getFormsByVersionId) endpoint. operationId: getForm_1 parameters: - - name: X-Access-Token - in: header - description: Token used for endpoint security - required: true - schema: - type: string - - name: versionCandidateId - in: path - description: Version candidate identifier - required: true - schema: - type: string - - name: formName - in: path - description: Form name - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: versionCandidateId + in: path + description: Version candidate identifier + required: true + schema: + type: string + - name: formName + in: path + description: Form name + required: true + schema: + type: string responses: - '200': - description: OK - content: - application/json: {} - '401': + "200": + description: Form successfully retrieved. + content: + application/json: + example: |- + { + "display": "form", + "components": [], + "path": "my-awesome-form", + "name": "my-awesome-form", + "title": "Form human-readable title", + } + "401": description: Unauthorized content: application/json: {} - '403': + "403": description: Forbidden content: application/json: {} - '404': + "404": description: Not Found content: application/json: schema: $ref: '#/components/schemas/DetailedErrorResponse' - '500': + "500": description: Internal server error content: application/json: @@ -659,71 +978,113 @@ paths: $ref: '#/components/schemas/DetailedErrorResponse' put: tags: - - Registry regulations version-candidate Forms management Rest API - description: Update existing form within version-candidate + - candidate-version-forms-api + summary: Update existing form within version-candidate + description: "### Endpoint purpose: \n This endpoint is used for updating a\ + \ json representation of a user __form__ in __version-candidate__.\n### Conflict\ + \ resolving:\n In this endpoint [Conditional requests](https://datatracker.ietf.org/doc/html/rfc9110#name-conditional-requests)\ + \ are supported. You can use an __ETag__ header value, that can be previously\ + \ obtained in [GET](#candidate-version-forms-api/getForm) request, as a value\ + \ for __If-Match__ header so you can be sure that you're updating the last\ + \ version of a _form_. But if your __If-Match__ value is differs from the\ + \ servers you will receive a _409 Conflict_ instead of _412 Precondition Failed_.\ + \ For _registry-regulation-management_ service this situation's considered\ + \ as a conflict. If __If-Match__ is not present then conflict checking won't\ + \ be performed.\n### Form validation: \nBefore saving the content to the storage,\ + \ the __validation__ of a _form_ is executed. The _form_ must be a __json__\ + \ document and must have a non-empty __\"title\"__ field. Also the field __\"\ + name\"__ must be present and equal to __\"path\"__ field, that must be present\ + \ too. Also _both_ this values must be equal to __\"formName\"__ pathVariable.\ + \ In other case the _form_ won't be working as expected. Changing __\"name\"\ + __ or __\"path\"__ is not supported. If you need to change these fields then\ + \ you need to copy the _form_ with new name and delete the previous _form_.\n\ + ### Missing form handling: \nIf the updated _form_ is missing and the _If-Match_\ + \ header is not present (or equal to __\"*\"__) then the _form_ will be __created__\ + \ instead.\n### Created and modified dates handling:\nIf there any of __\"\ + created\"__ or __\"modified\"__ fields present in the request body they will\ + \ be ignored. Value for the __\"created\"__ field is automatically getting\ + \ from the previous _form_ content (if present, in other case it's getting\ + \ from the git log). And for the __\"updated\"__ value the current servers\ + \ datetime in UTC is set." operationId: updateForm_1 parameters: - - name: X-Access-Token - in: header - description: Token used for endpoint security - required: true - schema: - type: string - - name: If-Match - in: header - description: ETag to verify whether user has latest data - schema: - type: string - - name: versionCandidateId - in: path - description: Version candidate identifier - required: true - schema: - type: string - - name: formName - in: path - description: Name of the form to be updated - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: If-Match + in: header + description: ETag to verify whether user has latest data + schema: + type: string + - name: versionCandidateId + in: path + description: Version candidate identifier + required: true + schema: + type: string + - name: formName + in: path + description: Name of the form to be updated + required: true + schema: + type: string requestBody: content: application/json: schema: type: string + example: + display: form + components: [] + path: my-awesome-form + name: my-awesome-form + title: Form human-readable title required: true responses: - '200': - description: OK + "200": + description: Form successfully updated. + headers: + ETag: + description: New ETag value for conflict verification + style: simple + schema: + type: string content: - application/json: {} - '401': + application/json: + example: + display: form + components: [] + path: my-awesome-form + name: my-awesome-form + title: Form human-readable title + created: 2023-03-28T09:18:41.941Z + modified: 2023-03-29T09:58:44.100Z + "401": description: Unauthorized content: application/json: {} - '403': + "403": description: Forbidden content: application/json: {} - '404': - description: Not Found + "409": + description: Conflict. __If-Match__ input value doesn't equal to servers + value. It means that form already has been updated/deleted after user + obtained __ETag__. content: application/json: schema: $ref: '#/components/schemas/DetailedErrorResponse' - '409': - description: Conflict + "422": + description: Unprocessable Entity. User form is not valid. content: application/json: schema: $ref: '#/components/schemas/DetailedErrorResponse' - '422': - description: Unprocessable Entity - content: - application/json: - schema: - $ref: '#/components/schemas/DetailedErrorResponse' - '500': + "500": description: Internal server error content: application/json: @@ -731,66 +1092,95 @@ paths: $ref: '#/components/schemas/DetailedErrorResponse' post: tags: - - Registry regulations version-candidate Forms management Rest API - description: Create new form within specific version-candidate + - candidate-version-forms-api + summary: Create new form within specific version-candidate + description: "### Endpoint purpose: \n This endpoint is used for creating a\ + \ JSON representation of a user __form__ in the __version-candidate__.\n###\ + \ Form validation: \nBefore saving the new _form_ to the storage, the server\ + \ validates the _form_. The _form_ must be a __json__ document and must have\ + \ a non-empty __\"title\"__ field. Also the field __\"name\"__ must be present\ + \ and equal to __\"path\"__ field, that must be present too. Also _both_ this\ + \ values must be equal to __\"formName\"__ pathVariable. In other case the\ + \ _form_ won't be working as expected. \n ### Missing form handling: \n If\ + \ the specified _form_ does not already exist, the server will create a new\ + \ _form_ with the provided data. Otherwise, the server will return a _409\ + \ Conflict_ error indicating that the _form_ already exists.\n ### Created\ + \ and modified dates handling:\n If there any of __\"created\"__ or __\"modified\"\ + __ fields present in the request body they will be ignored. The __\"created\"\ + __ and __\"updated\"__ fields are automatically set to the current server\ + \ time in UTC." operationId: formCreate_1 parameters: - - name: X-Access-Token - in: header - description: Token used for endpoint security - required: true - schema: - type: string - - name: versionCandidateId - in: path - description: Version candidate identifier - required: true - schema: - type: string - - name: formName - in: path - description: Name of the new form to be created - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: versionCandidateId + in: path + description: Version candidate identifier + required: true + schema: + type: string + - name: formName + in: path + description: Name of the new form to be created + required: true + schema: + type: string requestBody: content: application/json: schema: type: string + example: + display: form + components: [] + path: my-awesome-form + name: my-awesome-form + title: Form human-readable title required: true responses: - '201': - description: Created + "201": + description: Form successfully created + headers: + ETag: + description: New ETag value for conflict verification + style: simple + schema: + type: string content: - application/json: {} - '401': + application/json: + example: + display: form + components: [] + path: my-awesome-form + name: my-awesome-form + title: Form human-readable title + created: 2023-03-28T09:18:41.941Z + modified: 2023-03-28T09:18:41.941Z + "401": description: Unauthorized content: application/json: {} - '403': + "403": description: Forbidden content: application/json: {} - '404': - description: Not Found - content: - application/json: - schema: - $ref: '#/components/schemas/DetailedErrorResponse' - '409': - description: Conflict + "409": + description: Conflict. It means that form already has been created. content: application/json: schema: $ref: '#/components/schemas/DetailedErrorResponse' - '422': - description: Unprocessable Entity + "422": + description: Unprocessable Entity. User form is not valid. content: application/json: schema: $ref: '#/components/schemas/DetailedErrorResponse' - '500': + "500": description: Internal server error content: application/json: @@ -798,53 +1188,68 @@ paths: $ref: '#/components/schemas/DetailedErrorResponse' delete: tags: - - Registry regulations version-candidate Forms management Rest API - description: Delete existing form within version-candidate + - candidate-version-forms-api + summary: Delete existing form within version-candidate + description: |- + ### Endpoint purpose: + This endpoint is used for deleting a JSON representation of a user __form__ from the __version-candidate__. + ### Conflict resolving: + In this endpoint, [Conditional requests](https://datatracker.ietf.org/doc/html/rfc9110#name-conditional-requests) are supported. You can use an __ETag__ header value, which can be previously obtained in a [GET](#candidate-version-forms-api/getForm) request, as a value for the __If-Match__ header. This ensures that you're deleting the latest version of the _form_. However, if your __If-Match__ value differs from the server's value, you will receive _409 Conflict_ instead of _412 Precondition Failed_. For the _registry-regulation-management_ service, this situation is considered a conflict. If the __If-Match__ header is not present, conflict checking will not be performed. + ### Missing form handling: + If the specified _form_ is missing and the _If-Match_ header is not present (or equal to __"*"__), the server will return a 404 Not Found error indicating that the specified _form_ does not exist. operationId: deleteForm_1 parameters: - - name: X-Access-Token - in: header - description: Token used for endpoint security - required: true - schema: - type: string - - name: If-Match - in: header - description: ETag to verify whether user has latest data - schema: - type: string - - name: versionCandidateId - in: path - description: Version candidate identifier - required: true - schema: - type: string - - name: formName - in: path - description: Name of the form to be deleted - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: If-Match + in: header + description: ETag to verify whether user has latest data + schema: + type: string + - name: versionCandidateId + in: path + description: Version candidate identifier + required: true + schema: + type: string + - name: formName + in: path + description: Name of the form to be deleted + required: true + schema: + type: string responses: - '204': - description: No Content + "204": + description: No Content. Form successfully deleted. content: application/json: {} - '401': + "401": description: Unauthorized content: application/json: {} - '403': + "403": description: Forbidden content: application/json: {} - '404': + "404": description: Not Found content: application/json: schema: $ref: '#/components/schemas/DetailedErrorResponse' - '500': + "409": + description: Conflict. __If-Match__ input value doesn't equal to servers + value. It means that form already has been updated/deleted after user + obtained __ETag__. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "500": description: Internal server error content: application/json: @@ -853,43 +1258,71 @@ paths: /versions/candidates/{versionCandidateId}/data-model/tables: get: tags: - - Registry regulations version-candidate data-model tables file management Rest API - description: Get data-model tables file content from requested version-candidate + - candidate-version-data-model-tables-api + summary: Get data-model tables file content from requested version-candidate + description: |- + ### Endpoint purpose: + This endpoint is used for retrieving a XML representation of the _content of the data-model tables_ file from the _version-candidate_. operationId: getTablesFileContent_1 parameters: - - name: X-Access-Token - in: header - description: Token used for endpoint security - required: true - schema: - type: string - - name: versionCandidateId - in: path - description: Version candidate identifier - required: true - schema: - type: integer - format: int32 + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: versionCandidateId + in: path + description: Version candidate identifier + required: true + schema: + type: integer + format: int32 responses: - '200': - description: OK - content: - application/xml: {} - '401': + "200": + description: OK. Tables file content retrieved successfully + content: + text/plain: + example: |- + + + + + + + + + + + + + + + + + + "401": description: Unauthorized content: application/json: {} - '403': + "403": description: Forbidden content: application/json: {} - '404': - description: Version-candidate doesn't exist or tables file doesn't exists in requested version + "404": + description: Version-candidate doesn't exist or tables file doesn't exists + in requested version content: application/json: schema: $ref: '#/components/schemas/DetailedErrorResponse' - '500': + "500": description: Internal server error content: application/json: @@ -897,52 +1330,118 @@ paths: $ref: '#/components/schemas/DetailedErrorResponse' put: tags: - - Registry regulations version-candidate data-model tables file management Rest API - description: Put data-model tables file content to specified version-candidate + - candidate-version-data-model-tables-api + summary: Put data-model tables file content to specified version-candidate + description: |- + ### Endpoint purpose: + This endpoint is used for updating a XML representation of the _content of the data-model tables_ file from the _version-candidate_. A conflict can arise when two or more commits have made changes to the same part of a file. This can happen when two developers are working on the same branch at the same time, and both make changes to the same piece of code without being aware of each other's changes. In this situation, the system cannot automatically determine which change is the correct one, and will require human intervention to resolve the conflict. operationId: putTablesFileContent parameters: - - name: X-Access-Token - in: header - description: Token used for endpoint security - required: true - schema: - type: string - - name: versionCandidateId - in: path - description: Version candidate identifier - required: true - schema: - type: integer - format: int32 + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: If-Match + in: header + description: ETag to verify whether user has latest data + schema: + type: string + - name: versionCandidateId + in: path + description: Version candidate identifier + required: true + schema: + type: integer + format: int32 requestBody: content: - application/xml: - schema: - type: string - text/xml: + text/plain: schema: type: string + example: |- + + + + + + + + + + + + + + + + + required: true responses: - '200': - description: OK - content: - application/xml: {} - '401': + "200": + description: OK. Tables file content updated successfully + content: + text/plain: + example: |- + + + + + + + + + + + + + + + + + + "401": description: Unauthorized content: application/json: {} - '403': + "403": description: Forbidden content: application/json: {} - '404': + "404": description: Version-candidate doesn't exist content: application/json: schema: $ref: '#/components/schemas/DetailedErrorResponse' - '500': + "409": + description: Conflict. It means that tables file content already has been + updated/deleted. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "422": + description: Unprocessable Entity. Tables file content is not valid. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "500": description: Internal server error content: application/json: @@ -951,48 +1450,70 @@ paths: /versions/candidates/{versionCandidateId}/business-processes/{businessProcessName}: get: tags: - - Registry regulations version-candidate Business processes management Rest API - description: Get business process + - candidate-version-business-processes-api + summary: Get specific business process full details + description: |- + ### Endpoint purpose: + This endpoint is used for retrieving a XML representation of a user __business-process__ from the __version-candidate__. This operation retrieves a single _business-process_ based on the specified __businessProcessName__ with full details in _XML_ format. If you need to retrieve list of _business-processes_ with brief information and in _json_ format, you can use the [GET](#candidate-version-business-processes-api/getBusinessProcessesByVersionId) endpoint. operationId: getBusinessProcess_1 parameters: - - name: X-Access-Token - in: header - description: Token used for endpoint security - required: true - schema: - type: string - - name: versionCandidateId - in: path - description: Version candidate identifier - required: true - schema: - type: string - - name: businessProcessName - in: path - description: Process name - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: versionCandidateId + in: path + description: Version candidate identifier + required: true + schema: + type: string + - name: businessProcessName + in: path + description: Process name + required: true + schema: + type: string responses: - '200': - description: OK - content: - text/xml: {} - '401': + "200": + description: OK. Business process successfully retrieved. + content: + text/plain: + example: |- + + + + + + + + + + + + + + "401": description: Unauthorized content: application/json: {} - '403': + "403": description: Forbidden content: application/json: {} - '404': + "404": description: Not Found content: application/json: schema: $ref: '#/components/schemas/DetailedErrorResponse' - '500': + "500": description: Internal server error content: application/json: @@ -1000,65 +1521,130 @@ paths: $ref: '#/components/schemas/DetailedErrorResponse' put: tags: - - Registry regulations version-candidate Business processes management Rest API - description: Update business process + - candidate-version-business-processes-api + summary: Update business process within version-candidate. + description: "### Endpoint purpose: \n This endpoint is used for updating a\ + \ xml representation of a user __business process__ in __version-candidate__.\n\ + ### Conflict resolving:\n In this endpoint [Conditional requests](https://datatracker.ietf.org/doc/html/rfc9110#name-conditional-requests)\ + \ are supported. You can use an __ETag__ header value, that can be previously\ + \ obtained in [GET](#candidate-version-business-processes-api/getBusinessProcess)\ + \ request, as a value for __If-Match__ header so you can be sure that you're\ + \ updating the last version of a _business-process_. But if your __If-Match__\ + \ value is differs from the servers you will receive a _409 Conflict_ instead\ + \ of _412 Precondition Failed_. For _registry-regulation-management_ service\ + \ this situation's considered as a conflict. If __If-Match__ is not present\ + \ then conflict checking won't be performed.\n### Business process validation:\ + \ \nBefore saving the content to the storage, the __validation__ of a _business-process_\ + \ is executed. The _business-process_ must be a __xml__ document, must conform\ + \ to the BPMN20.xsd schema (available at https://github.com/bpmn-io/bpmn-moddle/blob/master/resources/bpmn/xsd/BPMN20.xsd)\ + \ and must have a non-empty __\"name\"__ field (attribute as part of tCallableElement).\ + \ Also _name_ values must be equal to __\"businessProcessName\"__ pathVariable.\ + \ In other case the _business-process_ won't be working as expected. Changing\ + \ __\"name\"__ is not supported. If you need to change this field then you\ + \ need to copy the _business process_ with new name and delete the previous\ + \ _business process_.\n### Missing business process handling: \n If the updated\ + \ _business-process_ is missing and the _If-Match_ header is not present (or\ + \ equal to __\"*\"__) then the _business process_ will be __created__ instead." operationId: updateBusinessProcess_1 parameters: - - name: X-Access-Token - in: header - description: Token used for endpoint security - required: true - schema: - type: string - - name: If-Match - in: header - description: ETag to verify whether user has latest data - schema: - type: string - - name: versionCandidateId - in: path - description: Version candidate identifier - required: true - schema: - type: string - - name: businessProcessName - in: path - description: Process name - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: If-Match + in: header + description: ETag to verify whether user has latest data + schema: + type: string + - name: versionCandidateId + in: path + description: Version candidate identifier + required: true + schema: + type: string + - name: businessProcessName + in: path + description: Process name + required: true + schema: + type: string requestBody: content: - application/json: + text/plain: schema: type: string + example: |- + + + + + + + + + + + + + required: true responses: - '200': - description: OK - content: - text/xml: {} - '401': + "200": + description: OK. Business process successfully updated. + content: + text/plain: + example: |- + + + + + + + + + + + + + + + "401": description: Unauthorized content: application/json: {} - '403': + "403": description: Forbidden content: application/json: {} - '404': - description: Not Found + "409": + description: Conflict. __If-Match__ input value doesn't equal to servers + value. It means that business process already has been updated/deleted + after user obtained __ETag__. content: application/json: schema: $ref: '#/components/schemas/DetailedErrorResponse' - '422': - description: Unprocessable Entity + "422": + description: Unprocessable Entity. User business process is not valid. content: application/json: schema: $ref: '#/components/schemas/DetailedErrorResponse' - '500': + "500": description: Internal server error content: application/json: @@ -1066,66 +1652,114 @@ paths: $ref: '#/components/schemas/DetailedErrorResponse' post: tags: - - Registry regulations version-candidate Business processes management Rest API - description: Create new business process + - candidate-version-business-processes-api + summary: Create new business process + description: "### Endpoint purpose: \n This endpoint is used for creating a\ + \ xml representation of a user __business process__ in __version-candidate__\ + \ version. \n ### Business process validation: \nBefore saving the content\ + \ to the storage, the __validation__ of a _business-process_ is executed.\ + \ The _business-process_ must be a __xml__ document, must conform to the BPMN20.xsd\ + \ schema (available at https://github.com/bpmn-io/bpmn-moddle/blob/master/resources/bpmn/xsd/BPMN20.xsd)\ + \ and must have a non-empty __\"name\"__ field (attribute as part of tCallableElement).\ + \ Also _name_ values must be equal to __\"businessProcessName\"__ pathVariable.\ + \ In other case the _business-process_ won't be working as expected. \n###\ + \ Missing business process handling: \n If the specified _business-process_\ + \ does not already exist, the server will create a new _business-process_\ + \ with the provided data. Otherwise, the server will return a _409 Conflict_\ + \ error indicating that the _business-process_ already exists." operationId: createBusinessProcess_1 parameters: - - name: X-Access-Token - in: header - description: Token used for endpoint security - required: true - schema: - type: string - - name: versionCandidateId - in: path - description: Version candidate identifier - required: true - schema: - type: string - - name: businessProcessName - in: path - description: Name of the new process to be created - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: versionCandidateId + in: path + description: Version candidate identifier + required: true + schema: + type: string + - name: businessProcessName + in: path + description: Name of the new process to be created + required: true + schema: + type: string requestBody: content: - application/json: + text/plain: schema: type: string + example: |- + + + + + + + + + + + + + required: true responses: - '201': - description: Created - content: - text/xml: {} - '401': + "201": + description: Business process successfully created. + content: + text/plain: + example: |- + + + + + + + + + + + + + + + "401": description: Unauthorized content: application/json: {} - '403': + "403": description: Forbidden content: application/json: {} - '404': - description: Not Found + "409": + description: Conflict. It means that business process already has been created. content: application/json: schema: $ref: '#/components/schemas/DetailedErrorResponse' - '409': - description: Conflict + "422": + description: Unprocessable Entity. User business process is not valid. content: application/json: schema: $ref: '#/components/schemas/DetailedErrorResponse' - '422': - description: Unprocessable Entity - content: - application/json: - schema: - $ref: '#/components/schemas/DetailedErrorResponse' - '500': + "500": description: Internal server error content: application/json: @@ -1133,48 +1767,68 @@ paths: $ref: '#/components/schemas/DetailedErrorResponse' delete: tags: - - Registry regulations version-candidate Business processes management Rest API - description: Delete business process + - candidate-version-business-processes-api + summary: Delete existing business process + description: |- + ### Endpoint purpose: + This endpoint is used for deleting a user __business-process__ from the __version-candidate__. + ### Conflict resolving: + In this endpoint, [Conditional requests](https://datatracker.ietf.org/doc/html/rfc9110#name-conditional-requests) are supported. You can use an __ETag__ header value, which can be previously obtained in a [GET](#candidate-version-business-processes-api/getBusinessProcess) request, as a value for the __If-Match__ header. This ensures that you're deleting the latest version of the _business process_. However, if your __If-Match__ value differs from the server's value, you will receive _409 Conflict_ instead of _412 Precondition Failed_. For the _registry-regulation-management_ service, this situation is considered a conflict. If the __If-Match__ header is not present, conflict checking will not be performed. + ### Missing business process handling: + If the specified _business process_ is missing and the _If-Match_ header is not present (or equal to __"*"__), the server will return a 404 Not Found error indicating that the specified _business process_ does not exist. operationId: deleteBusinessProcess_1 parameters: - - name: X-Access-Token - in: header - description: Token used for endpoint security - required: true - schema: - type: string - - name: versionCandidateId - in: path - description: Version candidate identifier - required: true - schema: - type: string - - name: businessProcessName - in: path - description: Process name - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: If-Match + in: header + description: ETag to verify whether user has latest data + schema: + type: string + - name: versionCandidateId + in: path + description: Version candidate identifier + required: true + schema: + type: string + - name: businessProcessName + in: path + description: Process name + required: true + schema: + type: string responses: - '204': - description: No Content + "204": + description: No Content. Business process successfully deleted. content: application/json: {} - '401': + "401": description: Unauthorized content: application/json: {} - '403': + "403": description: Forbidden content: application/json: {} - '404': + "404": description: Not Found content: application/json: schema: $ref: '#/components/schemas/DetailedErrorResponse' - '500': + "409": + description: Conflict. __If-Match__ input value doesn't equal to servers + value. It means that business process already has been updated/deleted + after user obtained __ETag__. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "500": description: Internal server error content: application/json: @@ -1183,34 +1837,41 @@ paths: /versions/candidates: get: tags: - - Registry regulations version-candidate management Rest API - description: Get list of existing opened version-candidates + - candidate-version-api + summary: Get list of existing opened version-candidates + description: |- + ### Endpoint purpose: + This endpoint is used for retrieving a list of JSON representations of __version information__ from the __version-candidate__, containing only brief information about each __version information__. If you need to retrieve full details of a single __version information__ based on its __versionCandidateId__, you can use the [GET](#candidate-version-api/getVersionDetails) endpoint. operationId: getVersionsList parameters: - - name: X-Access-Token - in: header - description: Token used for endpoint security - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string responses: - '200': - description: OK + "200": + description: OK. Version details successfully retrieved. content: application/json: schema: type: array items: $ref: '#/components/schemas/VersionInfo' - '401': + example: + - id: "1" + name: JohnDoe's version candidate + description: Version candidate to change form + "401": description: Unauthorized content: application/json: {} - '403': + "403": description: Forbidden content: application/json: {} - '500': + "500": description: Internal server error content: application/json: @@ -1218,44 +1879,63 @@ paths: $ref: '#/components/schemas/DetailedErrorResponse' post: tags: - - Registry regulations version-candidate management Rest API - description: Create new version-candidate from current state of master version. + - candidate-version-api + summary: Create new version-candidate from current state of master version. + description: |- + ### Endpoint purpose: + This endpoint is used to create a new __version-candidate__ from the current state of the _master_ version. The purpose is to allow making changes to the data elements without affecting the stability of the _master_ version. The endpoint requires the `X-Access-Token` header for security. Once the new __version-candidate__ is created, it can be developed independently from other __version-candidates__ or the _master_ version. When the changes are ready, the __version-candidate__ can be merged back into the _master_ version. If the operation is _successful_, the resulting `VersionInfoDetailed` object is returned along with a _`201 Created`_ status code. If the request _fails_ due to invalid input or server issues, a _`4xx` or `5xx`_ HTTP response code may be returned along with a detailed error message. operationId: createNewVersion parameters: - - name: X-Access-Token - in: header - description: Token used for endpoint security - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/CreateVersionRequest' + example: + name: JohnDoe's version candidate + description: Version candidate to change form required: true responses: - '201': - description: OK + "201": + description: OK. Version candidate successfully created content: application/json: schema: $ref: '#/components/schemas/VersionInfoDetailed' - '401': + example: + id: "1" + name: JohnDoe's version candidate + description: Version candidate to change form + author: JohnDoe@epam.com + creationDate: 2022-08-10T11:30:00 + latestUpdate: 2022-08-10T11:40:00 + hasConflicts: false + inspections: null + validations: + - name: Validation 1 + result: SUCCESS + message: Validation passed + "401": description: Unauthorized content: application/json: {} - '403': + "403": description: Forbidden content: application/json: {} - '422': - description: Unprocessable Entity + "422": + description: Unprocessable Entity. Version request is not valid content: application/json: schema: $ref: '#/components/schemas/DetailedErrorResponse' - '500': + "500": description: Internal server error content: application/json: @@ -1264,48 +1944,54 @@ paths: /versions/candidates/{versionCandidateId}/submit: post: tags: - - Registry regulations version-candidate management Rest API - description: Integrate version-candidate changes into master version of registry regulation + - candidate-version-api + summary: Integrate version-candidate changes into master version of registry + regulation + description: |- + ### Endpoint purpose: + This endpoint is used to merge an available open __version-candidate__, identified by the _versionCandidateId_ parameter, into master version of the registry regulation after the changes have been reviewed. Once the merge operation is completed, the __version-candidate__ will no longer accept any new changes. Successful completion of the merge operation is indicated by a _204 No Content_ response. In case of any conflicts between the __version-candidate__ and the _master version_, such as duplicate names for data elements or changes made to data elements already changed in the _master version_, this API returns a __409 Conflict__ HTTP response. In such cases, the resulting _conflict_ must be resolved before attempting the merge operation again. operationId: submitVersionCandidate parameters: - - name: X-Access-Token - in: header - description: Token used for endpoint security - required: true - schema: - type: string - - name: versionCandidateId - in: path - description: Version candidate identifier to be merged into master version - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: versionCandidateId + in: path + description: Version candidate identifier to be merged into master version + required: true + schema: + type: string responses: - '204': - description: No Content + "204": + description: No Content. Version candidate successfully merged into master + version. content: application/json: {} - '401': + "401": description: Unauthorized content: application/json: {} - '403': + "403": description: Forbidden content: application/json: {} - '404': + "404": description: Not Found content: application/json: schema: $ref: '#/components/schemas/DetailedErrorResponse' - '409': - description: Conflict + "409": + description: Conflict. The same data has been updated or deleted in the + master version by another merge commit. content: application/json: schema: $ref: '#/components/schemas/DetailedErrorResponse' - '500': + "500": description: Internal server error content: application/json: @@ -1314,48 +2000,51 @@ paths: /versions/candidates/{versionCandidateId}/forms/{formName}/rollback: post: tags: - - Registry regulations version-candidate Forms management Rest API - description: Rollback existing form within version-candidate + - candidate-version-forms-api + summary: Rollback existing form within version-candidate + description: |- + ### Endpoint purpose: + This endpoint is used for rolling back a user __form__ from the __version-candidate__. It is intended for situations where a __form__ needs to be reverted to a prior version, such as to mitigate data corruption or to restore a previous state. operationId: rollbackForm parameters: - - name: X-Access-Token - in: header - description: Token used for endpoint security - required: true - schema: - type: string - - name: versionCandidateId - in: path - description: Version candidate identifier - required: true - schema: - type: string - - name: formName - in: path - description: Name of the form to be rolled back - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: versionCandidateId + in: path + description: Version candidate identifier + required: true + schema: + type: string + - name: formName + in: path + description: Name of the form to be rolled back + required: true + schema: + type: string responses: - '200': - description: OK + "200": + description: OK. Form successfully rolled back. content: application/json: {} - '401': + "401": description: Unauthorized content: application/json: {} - '403': + "403": description: Forbidden content: application/json: {} - '404': + "404": description: Not Found content: application/json: schema: $ref: '#/components/schemas/DetailedErrorResponse' - '500': + "500": description: Internal server error content: application/json: @@ -1364,42 +2053,45 @@ paths: /versions/candidates/{versionCandidateId}/decline: post: tags: - - Registry regulations version-candidate management Rest API - description: Abandon the existing opened version-candidate. After this operation the version-candidate won't take any changes anymore. + - candidate-version-api + summary: Abandon the existing opened version-candidate. + description: |- + ### Endpoint purpose: + This endpoint is used to decline an available open __version-candidate__. It is intended for situations where the __candidate version__ is no longer needed. After this operation the __version-candidate__ won't take any changes anymore. operationId: declineVersionCandidate parameters: - - name: X-Access-Token - in: header - description: Token used for endpoint security - required: true - schema: - type: string - - name: versionCandidateId - in: path - description: Version candidate identifier to abandon - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: versionCandidateId + in: path + description: Version candidate identifier to abandon + required: true + schema: + type: string responses: - '204': - description: No Content + "200": + description: OK. Version candidate successfully abandoned content: application/json: {} - '401': + "401": description: Unauthorized content: application/json: {} - '403': + "403": description: Forbidden content: application/json: {} - '404': + "404": description: Not Found content: application/json: schema: $ref: '#/components/schemas/DetailedErrorResponse' - '500': + "500": description: Internal server error content: application/json: @@ -1408,42 +2100,45 @@ paths: /versions/candidates/{versionCandidateId}/data-model/tables/rollback: post: tags: - - Registry regulations version-candidate data-model tables file management Rest API - description: Rollback data-model tables file content to specified version-candidate + - candidate-version-data-model-tables-api + summary: Rollback data-model tables file content to specified version-candidate + description: |- + ### Endpoint purpose: + This endpoint is used for rolling back a __tables file content__ from the __version-candidate__. It is intended for situations where a __tables file content__ needs to be reverted to a prior version, such as to mitigate data corruption or to restore a previous state. operationId: rollbackTables parameters: - - name: X-Access-Token - in: header - description: Token used for endpoint security - required: true - schema: - type: string - - name: versionCandidateId - in: path - description: Version candidate identifier - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: versionCandidateId + in: path + description: Version candidate identifier + required: true + schema: + type: string responses: - '200': - description: OK + "200": + description: OK. Tables file content successfully rolled back. content: application/json: {} - '401': + "401": description: Unauthorized content: application/json: {} - '403': + "403": description: Forbidden content: application/json: {} - '404': + "404": description: Version-candidate doesn't exist content: application/json: schema: $ref: '#/components/schemas/DetailedErrorResponse' - '500': + "500": description: Internal server error content: application/json: @@ -1452,48 +2147,51 @@ paths: /versions/candidates/{versionCandidateId}/business-processes/{businessProcessName}/rollback: post: tags: - - Registry regulations version-candidate Business processes management Rest API - description: Rollback business process + - candidate-version-business-processes-api + summary: Rollback business process + description: |- + ### Endpoint purpose: + This endpoint is used for rolling back a user __business-process__ from the __version-candidate__. It is intended for situations where a __business process__ needs to be reverted to a prior version, such as to mitigate data corruption or to restore a previous state. operationId: rollbackProcess parameters: - - name: X-Access-Token - in: header - description: Token used for endpoint security - required: true - schema: - type: string - - name: versionCandidateId - in: path - description: Version candidate identifier - required: true - schema: - type: string - - name: businessProcessName - in: path - description: Process name - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: versionCandidateId + in: path + description: Version candidate identifier + required: true + schema: + type: string + - name: businessProcessName + in: path + description: Process name + required: true + schema: + type: string responses: - '200': - description: OK + "200": + description: OK. Business process successfully rolled back. content: application/json: {} - '401': + "401": description: Unauthorized content: application/json: {} - '403': + "403": description: Forbidden content: application/json: {} - '404': + "404": description: Not Found content: application/json: schema: $ref: '#/components/schemas/DetailedErrorResponse' - '500': + "500": description: Internal server error content: application/json: @@ -1502,40 +2200,52 @@ paths: /versions/candidates/{versionCandidateId}/business-process-groups: get: tags: - - Registry regulations candidate version Groups management Rest API - description: Get business process groups for candidate + - candidate-version-business-process-groups-api + summary: Get business process groups for candidate + description: |- + ### Endpoint purpose: + This endpoint is used to retrieve a list of JSON representations of _business process groups_ for the version candidate. operationId: getBusinessProcessGroups_1 parameters: - - name: X-Access-Token - in: header - description: Token used for endpoint security - required: true - schema: - type: string - - name: versionCandidateId - in: path - description: Version candidate identifier - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: versionCandidateId + in: path + description: Version candidate identifier + required: true + schema: + type: string responses: - '200': - description: OK - content: - application/json: - schema: - type: array - items: - $ref: '#/components/schemas/BusinessProcessGroupsResponse' - '401': + "200": + description: OK. Successful retrieval of business process groups + content: + application/json: + schema: + $ref: '#/components/schemas/BusinessProcessGroupsResponse' + example: + groups: + - name: Перша група + processDefinitions: [] + - name: Друга група + processDefinitions: [] + - name: Третя група + processDefinitions: [] + ungrouped: + - id: bp-4-process_definition_id + name: John Doe added new component + "401": description: Unauthorized content: application/json: {} - '403': + "403": description: Forbidden content: application/json: {} - '500': + "500": description: Internal server error content: application/json: @@ -1543,54 +2253,96 @@ paths: $ref: '#/components/schemas/DetailedErrorResponse' post: tags: - - Registry regulations candidate version Groups management Rest API - description: Save business process groups for version-candidate + - candidate-version-business-process-groups-api + summary: Save business process groups for version-candidate + description: "### Endpoint purpose:\n This endpoint is used to create/update\ + \ a _business process groups_ for the version candidate. A conflict can arise\ + \ when two or more commits have made changes to the same part of a file. This\ + \ can happen when two developers are working on the same branch at the same\ + \ time, and both make changes to the same piece of code without being aware\ + \ of each other's changes. ### Group validation: \nBefore saving the new _bp\ + \ groups_, the server validates it. The _groups_ must be a __yaml__ document\ + \ and must have a __\"groups\"__ field. Also the field __\"groups.name\"__\ + \ must be present, unique and valid (name is match with regex). Also _groups.processDefinitions_\ + \ field cannot be empty." operationId: saveBusinessProcessGroups parameters: - - name: X-Access-Token - in: header - description: Token used for endpoint security - required: true - schema: - type: string - - name: versionCandidateId - in: path - description: Version candidate identifier - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: versionCandidateId + in: path + description: Version candidate identifier + required: true + schema: + type: string requestBody: content: application/json: schema: - $ref: '#/components/schemas/GroupListDetails' + type: string + example: + groups: + - name: Перша група + processDefinitions: + - bp-1-process_definition_id + - name: Четверта група + processDefinitions: + - bp-3-process_definition_id + - name: Третя група + ungrouped: + - bp-4-process_definition_id + - bp-5-process_definition_id required: true responses: - '200': - description: OK - content: - application/json: {} - '401': + "200": + description: OK. Business process groups successfully created/updated + content: + application/json: + schema: + $ref: '#/components/schemas/BusinessProcessGroupsResponse' + example: + groups: + - name: Перша група + processDefinitions: [] + - name: Друга група + processDefinitions: [] + - name: Третя група + processDefinitions: [] + ungrouped: + - id: bp-4-process_definition_id + name: John Doe added new component + "401": description: Unauthorized content: application/json: {} - '403': + "403": description: Forbidden content: application/json: {} - '404': + "404": description: Not Found content: application/json: schema: $ref: '#/components/schemas/DetailedErrorResponse' - '422': + "409": + description: Conflict. It means that bp group file content already has been + updated/deleted. + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "422": description: Unprocessable Entity content: application/json: schema: $ref: '#/components/schemas/DetailedErrorResponse' - '500': + "500": description: Internal server error content: application/json: @@ -1599,42 +2351,45 @@ paths: /versions/candidates/{versionCandidateId}/business-process-groups/rollback: post: tags: - - Registry regulations candidate version Groups management Rest API - description: Rollback business process groups for version-candidate + - candidate-version-business-process-groups-api + summary: Rollback business process groups for version-candidate + description: |- + ### Endpoint purpose: + This endpoint is used for rolling back a __bp groups__ from the __version-candidate__. It is intended for situations where a __bp groups__ needs to be reverted to a prior version, such as to mitigate data corruption or to restore a previous state. operationId: rollbackBusinessProcessGroups parameters: - - name: X-Access-Token - in: header - description: Token used for endpoint security - required: true - schema: - type: string - - name: versionCandidateId - in: path - description: Version candidate identifier - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: versionCandidateId + in: path + description: Version candidate identifier + required: true + schema: + type: string responses: - '200': - description: OK + "200": + description: OK. Business process groups successfully rolled back. content: application/json: {} - '401': + "401": description: Unauthorized content: application/json: {} - '403': + "403": description: Forbidden content: application/json: {} - '404': + "404": description: Not Found content: application/json: schema: $ref: '#/components/schemas/DetailedErrorResponse' - '500': + "500": description: Internal server error content: application/json: @@ -1643,38 +2398,65 @@ paths: /batch-loads/users: get: tags: - - Users bulk upload RestAPI - description: Get file information + - users-batch-loads-api + summary: Get file information + description: |- + ### Endpoint purpose: + This endpoint is used for retrieving a JSON representation of a __file__ metadata. Since the file is mapped to a username, the file information of the user who executed the given endpoint is returned. operationId: getFileInfo parameters: - - name: securityContext - in: query - required: true - schema: - type: string + - name: securityContext + in: query + required: true + schema: + type: string responses: - '200': + "200": description: OK content: '*/*': schema: $ref: '#/components/schemas/CephFileInfoDto' + example: + id: "123456789" + name: example_file.txt + size: 1024 + "400": + description: Bad Request + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "500": + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' post: tags: - - Users bulk upload RestAPI - description: Store file endpoint + - users-batch-loads-api + summary: Store file endpoint + description: "### Endpoint purpose: \n This endpoint is used for downloading\ + \ a file with registry user data. \n ### File validation: \nBefore saving\ + \ the new _file_ to the storage, the server validates the _file_. The _file_\ + \ must be a __csv__ document and must have a non-empty __\"name\"__. Also\ + \ the __\"file\"__ must not be null and empty. Also _file_ encoding must be\ + \ UTF-8.\n ### Existing file handling: \n The _file_ in the ceph is tied to\ + \ the user who uploads it, so when you try to upload a second _file_, the\ + \ first _file_ in the ceph is overwritten." operationId: handleFileUpload parameters: - - name: securityContext - in: query - schema: - type: string + - name: securityContext + in: query + schema: + type: string requestBody: content: application/json: schema: required: - - file + - file type: object properties: file: @@ -1683,17 +2465,42 @@ paths: securityContext: $ref: '#/components/schemas/SecurityContext' responses: - '200': - description: OK + "201": + description: Created. Returns uploaded file metadata content: '*/*': schema: $ref: '#/components/schemas/CephFileInfoDto' + example: + id: "123456789" + name: example_file.txt + size: 1024 + "400": + description: Bad Request + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "403": + description: Forbidden + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "500": + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' /batch-loads/users/imports: post: tags: - - Users bulk upload RestAPI - description: Start import endpoint + - users-batch-loads-api + summary: Start import endpoint + description: |- + ### Endpoint purpose: + This endpoint is used for starting the process of importing the downloaded file with registry user data. operationId: imports requestBody: content: @@ -1701,39 +2508,74 @@ paths: schema: $ref: '#/components/schemas/SecurityContext' responses: - '200': - description: OK + "202": + description: Accepted content: '*/*': {} + "400": + description: Bad Request + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "404": + description: Not found + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "500": + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' /versions/master: get: tags: - - Registry regulations master version management Rest API - description: Acquire master version full details + - master-version-api + summary: Acquire master version full details + description: "This endpoint retrieves a JSON representation containing detailed\ + \ information about the last master version, if it exists. Otherwise, an empty\ + \ object will be returned." operationId: getMasterVersionInfo parameters: - - name: X-Access-Token - in: header - description: Token used for endpoint security - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string responses: - '200': - description: OK + "200": + description: OK. Version details successfully retrieved. content: application/json: schema: $ref: '#/components/schemas/MasterVersionInfoDetailed' - '401': + example: + id: "123" + name: Example Master Release + description: This is an example master release. + author: John Doe + latestUpdate: 2022-11-01T13:30:00 + published: true + inspector: Jane Smith + validations: + - name: Example Validation 1 + status: PASSED + - name: Example Validation 2 + status: PASSED + status: APPROVED + "401": description: Unauthorized content: application/json: {} - '403': + "403": description: Forbidden content: application/json: {} - '500': + "500": description: Internal server error content: application/json: @@ -1742,34 +2584,41 @@ paths: /versions/master/tables: get: tags: - - Registry regulations master version tables management Rest API - description: Get tables list from master version + - master-version-tables-api + summary: '"Get a list of tables with brief details for the master version' + description: |- + ### Endpoint purpose: + This endpoint is used for retrieving a list of JSON representations of __tables__ directly from the __master__ version, containing only brief information about each _table_. If you need to retrieve full details of a single _table_ based on its __tableName__, you can use the [GET](#master-version-tables-api/getTable) endpoint. operationId: getTables parameters: - - name: X-Access-Token - in: header - description: Token used for endpoint security - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string responses: - '200': - description: OK + "200": + description: OK. Tables successfully retrieved. content: application/json: schema: type: array items: $ref: '#/components/schemas/TableInfoShort' - '401': + example: + - name: John Doe's table + description: John Doe get table + objectReference: true + "401": description: Unauthorized content: application/json: {} - '403': + "403": description: Forbidden content: application/json: {} - '500': + "500": description: Internal server error content: application/json: @@ -1778,44 +2627,90 @@ paths: /versions/master/tables/{tableName}: get: tags: - - Registry regulations master version tables management Rest API - description: Get specific table full details + - master-version-tables-api + summary: Get specific table full details + description: |- + ### Endpoint purpose: + This endpoint is used for retrieving a JSON representation of a __table__ directly from the __master__ version. This operation retrieves a single _table_ based on the specified __tableName__. If you need to retrieve list of _tables_, you can use the [GET](#master-version-tables-api/getTables) endpoint. operationId: getTable parameters: - - name: X-Access-Token - in: header - description: Token used for endpoint security - required: true - schema: - type: string - - name: tableName - in: path - description: Table name - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: tableName + in: path + description: Table name + required: true + schema: + type: string responses: - '200': - description: OK + "200": + description: OK. Table successfully retrieved. content: application/json: schema: $ref: '#/components/schemas/TableInfo' - '401': + example: + name: ExampleTable + description: Example description + objectReference: true + columns: + id: + name: id + description: Table column id + type: INTEGER + defaultValue: "0" + notNullFlag: true + name: + name: name + description: Table column name + type: VARCHAR + defaultValue: null + notNullFlag: true + foreignKeys: + fk_example: + name: fk_example + targetTable: AnotherTable + columnPairs: + - sourceColumnName: id + targetColumnName: example_id + primaryKey: + name: pk_example + columns: + - name: id + sorting: ASC + uniqueConstraints: + uk_example: + name: uk_example + columns: + - name: name + sorting: ASC + indices: + idx_example: + name: idx_example + columns: + - name: id + sorting: ASC + - name: name + sorting: DESC + "401": description: Unauthorized content: application/json: {} - '403': + "403": description: Forbidden content: application/json: {} - '404': + "404": description: Not Found content: application/json: schema: $ref: '#/components/schemas/DetailedErrorResponse' - '500': + "500": description: Internal server error content: application/json: @@ -1824,38 +2719,40 @@ paths: /versions/master/settings: get: tags: - - Registry regulations Master version settings Rest API - description: Get existing settings for master version + - master-version-settings-api + summary: Get settings for master version + description: |- + ### Endpoint purpose: + This endpoint is used for retrieving a JSON representations of existing _settings_ for master version operationId: getSettings parameters: - - name: X-Access-Token - in: header - description: Token used for endpoint security - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string responses: - '200': - description: OK + "200": + description: OK. Settings information retrieved successfully content: application/json: schema: $ref: '#/components/schemas/SettingsInfoDto' - '401': + example: + themeFile: white-theme.js + title: mdtuddm + titleFull: <Назва реєстру> + supportEmail: support@registry.gov.ua + "401": description: Unauthorized content: application/json: {} - '403': + "403": description: Forbidden content: application/json: {} - '404': - description: Not Found - content: - application/json: - schema: - $ref: '#/components/schemas/DetailedErrorResponse' - '500': + "500": description: Internal server error content: application/json: @@ -1864,34 +2761,42 @@ paths: /versions/master/forms: get: tags: - - Registry regulations Master version Forms management Rest API - description: Get lest of forms for master version + - master-version-forms-api + summary: Get a list of forms with brief details for the master version + description: |- + ### Endpoint purpose: + This endpoint is used for retrieving a list of JSON representations of user __forms__ directly from the __master__ version, containing only brief information about each _form_. If you need to retrieve full details of a single _form_ based on its __formName__, you can use the [GET](#master-version-forms-api/getForm) endpoint. operationId: getFormsFromMaster parameters: - - name: X-Access-Token - in: header - description: Token used for endpoint security - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string responses: - '200': - description: OK + "200": + description: OK. Forms successfully retrieved. content: application/json: schema: type: array items: $ref: '#/components/schemas/FormDetailsShort' - '401': + example: + - name: ExampleFormService + title: Example Form + created: 2022-10-01T10:00:00 + updated: 2022-11-15T13:30:00 + "401": description: Unauthorized content: application/json: {} - '403': + "403": description: Forbidden content: application/json: {} - '500': + "500": description: Internal server error content: application/json: @@ -1900,36 +2805,63 @@ paths: /versions/master/data-model/tables: get: tags: - - Registry regulations master version data-model tables file management Rest API - description: Get data-model tables file content from master version + - master-version-data-model-tables-api + summary: Get data-model tables file content from master version + description: |- + ### Endpoint purpose: + This endpoint is used for retrieving a XML representation of the _content of the data-model tables_ file from the master version. operationId: getTablesFileContent parameters: - - name: X-Access-Token - in: header - description: Token used for endpoint security - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string responses: - '200': - description: OK - content: - application/xml: {} - '401': + "200": + description: OK. Tables file content retrieved successfully + content: + text/plain: + example: |- + + + + + + + + + + + + + + + + + + "401": description: Unauthorized content: application/json: {} - '403': + "403": description: Forbidden content: application/json: {} - '404': + "404": description: Tables file doesn't exists in master version content: application/json: schema: $ref: '#/components/schemas/DetailedErrorResponse' - '500': + "500": description: Internal server error content: application/json: @@ -1938,34 +2870,38 @@ paths: /versions/master/business-processes: get: tags: - - Registry regulations master Business processes management Rest API - description: Get business processes list for master version + - master-version-business-processes-api + summary: Get a list of business processes with brief details for the master + version + description: |- + ### Endpoint purpose: + This endpoint is used for retrieving a list of JSON representations of user __business processes__ directly from the __master__ version, containing only brief information about each _business process_. If you need to retrieve full details of a single _business process_ based on its __businessProcessName__, you can use the [GET](#master-version-business-processes-api/getBusinessProcess) endpoint. operationId: getBusinessProcessesFromMaster parameters: - - name: X-Access-Token - in: header - description: Token used for endpoint security - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string responses: - '200': - description: OK + "200": + description: OK. Business processes successfully retrieved. content: application/json: schema: type: array items: $ref: '#/components/schemas/BusinessProcessDetailsShort' - '401': + "401": description: Unauthorized content: application/json: {} - '403': + "403": description: Forbidden content: application/json: {} - '500': + "500": description: Internal server error content: application/json: @@ -1974,34 +2910,46 @@ paths: /versions/master/business-process-groups: get: tags: - - Registry regulations Master version Groups management Rest API - description: Get business process groups for master version + - master-version-business-process-groups-api + summary: Get business process groups for master version + description: |- + ### Endpoint purpose: + This endpoint is used to retrieve a list of JSON representations of _business process groups_ for the master version. operationId: getBusinessProcessGroups parameters: - - name: X-Access-Token - in: header - description: Token used for endpoint security - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string responses: - '200': - description: OK - content: - application/json: - schema: - type: array - items: - $ref: '#/components/schemas/BusinessProcessGroupsResponse' - '401': + "200": + description: OK. Successful retrieval of business process groups + content: + application/json: + schema: + $ref: '#/components/schemas/BusinessProcessGroupsResponse' + example: + groups: + - name: Перша група + processDefinitions: [] + - name: Друга група + processDefinitions: [] + - name: Третя група + processDefinitions: [] + ungrouped: + - id: bp-4-process_definition_id + name: John Doe added new component + "401": description: Unauthorized content: application/json: {} - '403': + "403": description: Forbidden content: application/json: {} - '500': + "500": description: Internal server error content: application/json: @@ -2010,44 +2958,58 @@ paths: /versions/candidates/{versionCandidateId}: get: tags: - - Registry regulations version-candidate management Rest API - description: Acquire version-candidate full details + - candidate-version-api + summary: Acquire version-candidate full details + description: |- + ### Endpoint purpose: + This endpoint is used for retrieving a JSON representations of _version information_ from the __version-candidate__. This operation retrieves a single __version information__ based on the specified __versionCandidateId__ with full details. If you need to retrieve a list of __version information__ with brief details, you can use the [GET](#candidate-version-api/getVersionsList) endpoint. operationId: getVersionDetails parameters: - - name: X-Access-Token - in: header - description: Token used for endpoint security - required: true - schema: - type: string - - name: versionCandidateId - in: path - description: Version-candidate identifier - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: versionCandidateId + in: path + description: Version-candidate identifier + required: true + schema: + type: string responses: - '200': - description: OK + "200": + description: OK. Version details successfully retrieved. content: application/json: schema: $ref: '#/components/schemas/VersionInfoDetailed' - '401': + example: + id: "1" + name: JohnDoe's version candidate + description: Version candidate to change form + author: JohnDoe@epam.com + creationDate: 2022-08-10T11:30:00.000Z + latestUpdate: 2022-08-10T11:40:00.000Z + hasConflicts: false + inspections: null + validations: + - result: SUCCESS + "401": description: Unauthorized content: application/json: {} - '403': + "403": description: Forbidden content: application/json: {} - '404': + "404": description: Not Found content: application/json: schema: $ref: '#/components/schemas/DetailedErrorResponse' - '500': + "500": description: Internal server error content: application/json: @@ -2056,47 +3018,54 @@ paths: /versions/candidates/{versionCandidateId}/tables: get: tags: - - Registry regulations version-candidate tables management Rest API - description: Get tables list from version-candidate + - candidate-version-tables-api + summary: Get a list of tables with brief details for the version-candidate + description: |- + ### Endpoint purpose: + This endpoint is used for retrieving a list of JSON representations of __tables__ from the __version-candidate__, containing only brief information about each _table_. If you need to retrieve full details of a single _table_ based on its __tableName__, you can use the [GET](#candidate-version-tables-api/getTable) endpoint. operationId: getTables_1 parameters: - - name: X-Access-Token - in: header - description: Token used for endpoint security - required: true - schema: - type: string - - name: versionCandidateId - in: path - description: Version candidate identifier - required: true - schema: - type: integer - format: int32 + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: versionCandidateId + in: path + description: Version candidate identifier + required: true + schema: + type: integer + format: int32 responses: - '200': - description: OK + "200": + description: OK. Tables successfully retrieved. content: application/json: schema: type: array items: $ref: '#/components/schemas/TableInfoShort' - '401': + example: + - name: John Doe's table + description: John Doe get table + objectReference: true + "401": description: Unauthorized content: application/json: {} - '403': + "403": description: Forbidden content: application/json: {} - '404': + "404": description: Version-candidate not found content: application/json: schema: $ref: '#/components/schemas/DetailedErrorResponse' - '500': + "500": description: Internal server error content: application/json: @@ -2105,51 +3074,97 @@ paths: /versions/candidates/{versionCandidateId}/tables/{tableName}: get: tags: - - Registry regulations version-candidate tables management Rest API - description: Get specific table full details from version-candidate + - candidate-version-tables-api + summary: Get specific table full details from version-candidate + description: |- + ### Endpoint purpose: + This endpoint is used for retrieving a JSON representation of a __table__ directly from version-candidate. This operation retrieves a single _table_ based on the specified __tableName__. If you need to retrieve list of _tables_, you can use the [GET](#candidate-version-tables-api/getTables) endpoint. operationId: getTable_1 parameters: - - name: X-Access-Token - in: header - description: Token used for endpoint security - required: true - schema: - type: string - - name: versionCandidateId - in: path - description: Version candidate identifier - required: true - schema: - type: integer - format: int32 - - name: tableName - in: path - description: Table name - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: versionCandidateId + in: path + description: Version candidate identifier + required: true + schema: + type: integer + format: int32 + - name: tableName + in: path + description: Table name + required: true + schema: + type: string responses: - '200': - description: OK + "200": + description: OK. Table successfully retrieved. content: application/json: schema: $ref: '#/components/schemas/TableInfo' - '401': + example: + name: ExampleTable + description: Example description + objectReference: true + columns: + id: + name: id + description: Table column id + type: INTEGER + defaultValue: "0" + notNullFlag: true + name: + name: name + description: Table column name + type: VARCHAR + defaultValue: null + notNullFlag: true + foreignKeys: + fk_example: + name: fk_example + targetTable: AnotherTable + columnPairs: + - sourceColumnName: id + targetColumnName: example_id + primaryKey: + name: pk_example + columns: + - name: id + sorting: ASC + uniqueConstraints: + uk_example: + name: uk_example + columns: + - name: name + sorting: ASC + indices: + idx_example: + name: idx_example + columns: + - name: id + sorting: ASC + - name: name + sorting: DESC + "401": description: Unauthorized content: application/json: {} - '403': + "403": description: Forbidden content: application/json: {} - '404': + "404": description: Version candidate or table not found content: application/json: schema: $ref: '#/components/schemas/DetailedErrorResponse' - '500': + "500": description: Internal server error content: application/json: @@ -2158,46 +3173,48 @@ paths: /versions/candidates/{versionCandidateId}/forms: get: tags: - - Registry regulations version-candidate Forms management Rest API - description: Acquire list of forms for specific version-candidate + - candidate-version-forms-api + summary: Acquire list of forms with brief details for specific version-candidate + description: |- + ### Endpoint purpose: + This endpoint is used for retrieving a list of JSON representations of user __forms__ from the __version-candidate__, containing only brief information about each _form_. If you need to retrieve full details of a single _form_ based on its __formName__, you can use the [GET](#candidate-version-forms-api/getForm) endpoint. operationId: getFormsByVersionId parameters: - - name: X-Access-Token - in: header - description: Token used for endpoint security - required: true - schema: - type: string - - name: versionCandidateId - in: path - description: Version candidate identifier - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: versionCandidateId + in: path + description: Version candidate identifier + required: true + schema: + type: string responses: - '200': - description: OK + "200": + description: OK. Forms successfully retrieved. content: application/json: schema: type: array items: $ref: '#/components/schemas/FormDetailsShort' - '401': + example: + - name: john-does-form + title: John Doe added new component + created: 2022-07-29T18:55:00.000Z + updated: 2022-07-29T18:56:00.000Z + "401": description: Unauthorized content: application/json: {} - '403': + "403": description: Forbidden content: application/json: {} - '404': - description: Not Found - content: - application/json: - schema: - $ref: '#/components/schemas/DetailedErrorResponse' - '500': + "500": description: Internal server error content: application/json: @@ -2206,44 +3223,59 @@ paths: /versions/candidates/{versionCandidateId}/changes: get: tags: - - Registry regulations version-candidate management Rest API - description: Get version changes by version-candidate id + - candidate-version-api + summary: Get version changes by version-candidate id + description: |- + ### Endpoint purpose: + This operation retrieves _changes_ made to the data elements in a __version-candidate__ compared to the _master_ version. The endpoint allows you to review the changes made in a candidate version before merging with the main version. operationId: getVersionChanges parameters: - - name: X-Access-Token - in: header - description: Token used for endpoint security - required: true - schema: - type: string - - name: versionCandidateId - in: path - description: Version candidate identifier - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: versionCandidateId + in: path + description: Version candidate identifier + required: true + schema: + type: string responses: - '200': - description: OK + "200": + description: OK. Version changes successfully retrieved content: application/json: schema: $ref: '#/components/schemas/VersionChangesInfo' - '401': + example: + changedForms: + - name: formToBeUpdated + title: JohnDoe's form + status: CHANGED + changedBusinessProcesses: + - name: newProcess + title: JohnDoe's process + status: NEW + changedGroups: + - title: JohnDoe's group + status: NEW + "401": description: Unauthorized content: application/json: {} - '403': + "403": description: Forbidden content: application/json: {} - '404': + "404": description: Not Found content: application/json: schema: $ref: '#/components/schemas/DetailedErrorResponse' - '500': + "500": description: Internal server error content: application/json: @@ -2252,46 +3284,44 @@ paths: /versions/candidates/{versionCandidateId}/business-processes: get: tags: - - Registry regulations version-candidate Business processes management Rest API - description: Get business processes list - operationId: getBusinessProcessesBuVersionId + - candidate-version-business-processes-api + summary: Get a list of business processes with brief details for the candidate + version + description: |- + ### Endpoint purpose: + This endpoint is used for retrieving a list of JSON representations of user __business processes__ from the __version-candidate__, containing only brief information about each _business process_. If you need to retrieve full details of a single _business process_ based on its __businessProcessName__, you can use the [GET](#candidate-version-business-processes-api/getBusinessProcess) endpoint. + operationId: getBusinessProcessesByVersionId parameters: - - name: X-Access-Token - in: header - description: Token used for endpoint security - required: true - schema: - type: string - - name: versionCandidateId - in: path - description: Version candidate identifier - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: versionCandidateId + in: path + description: Version candidate identifier + required: true + schema: + type: string responses: - '200': - description: OK + "200": + description: OK. Business processes successfully retrieved. content: application/json: schema: type: array items: $ref: '#/components/schemas/BusinessProcessDetailsShort' - '401': + "401": description: Unauthorized content: application/json: {} - '403': + "403": description: Forbidden content: application/json: {} - '404': - description: Not Found - content: - application/json: - schema: - $ref: '#/components/schemas/DetailedErrorResponse' - '500': + "500": description: Internal server error content: application/json: @@ -2300,30 +3330,39 @@ paths: /batch-loads/users/{id}: delete: tags: - - Users bulk upload RestAPI - description: Delete file endpoint + - users-batch-loads-api + summary: Delete file endpoint + description: |- + ### Endpoint purpose: + This endpoint is used for deleting a __file__ from storage by id. operationId: deleteFile parameters: - - name: id - in: path - description: Resource identifier - required: true - schema: - type: string + - name: id + in: path + description: Resource identifier + required: true + schema: + type: string responses: - '200': - description: OK + "204": + description: No content. content: '*/*': schema: $ref: '#/components/schemas/CephFileInfoDto' + "500": + description: Internal server error + content: + application/json: + schema: + $ref: '#/components/schemas/DetailedErrorResponse' components: schemas: DetailedErrorResponse: required: - - code - - details - - traceId + - code + - details + - traceId type: object properties: traceId: @@ -2349,12 +3388,24 @@ components: type: string supportEmail: type: string + CreateVersionRequest: + required: + - description + - name + type: object + properties: + name: + type: string + description: Name from request + description: + type: string + description: Description from request Inspection: required: - - inspector - - name - - result - - resultDetails + - inspector + - name + - result + - resultDetails type: object properties: name: @@ -2367,19 +3418,19 @@ components: type: string description: Inspection result enum: - - PENDING - - SUCCESS - - FAILED + - PENDING + - SUCCESS + - FAILED resultDetails: type: string description: Inspection result detailsN description: Version candidate inspections Validation: required: - - name - - result - - resultDetails - - type + - name + - result + - resultDetails + - type type: object properties: name: @@ -2389,27 +3440,27 @@ components: type: string description: Validation type enum: - - REGULATION_INTEGRITY - - TEST - - DEPLOYMENT_STATUS + - REGULATION_INTEGRITY + - TEST + - DEPLOYMENT_STATUS result: type: string description: Validation result enum: - - PENDING - - SUCCESS - - FAILED + - PENDING + - SUCCESS + - FAILED resultDetails: type: string description: Validation result details description: Version candidate validations VersionInfoDetailed: required: - - author - - creationDate - - hasConflicts - - id - - name + - author + - creationDate + - hasConflicts + - id + - name type: object properties: id: @@ -2449,38 +3500,33 @@ components: description: Version candidate validations items: $ref: '#/components/schemas/Validation' - CreateVersionRequest: - required: - - description - - name + BusinessProcessDefinition: type: object properties: - name: - type: string - description: Name from request - description: + id: type: string - description: Description from request - GroupDetails: - type: object - properties: name: type: string - processDefinitions: - type: array - items: - type: string - GroupListDetails: + BusinessProcessGroupsResponse: type: object properties: groups: type: array items: - $ref: '#/components/schemas/GroupDetails' + $ref: '#/components/schemas/GroupDetailsResponse' ungrouped: type: array items: - type: string + $ref: '#/components/schemas/BusinessProcessDefinition' + GroupDetailsResponse: + type: object + properties: + name: + type: string + processDefinitions: + type: array + items: + $ref: '#/components/schemas/BusinessProcessDefinition' CephFileInfoDto: type: object properties: @@ -2531,8 +3577,8 @@ components: description: Last version candidate status TableInfoShort: required: - - name - - objectReference + - name + - objectReference type: object properties: name: @@ -2540,15 +3586,16 @@ components: description: Table name objectReference: type: boolean - description: Flag that indicates that the entity is an object in the subject data-model + description: Flag that indicates that the entity is an object in the subject + data-model description: type: string description: Table description nullable: true Column: required: - - name - - sorting + - name + - sorting type: object properties: name: @@ -2558,14 +3605,14 @@ components: type: string description: Column index sorting enum: - - ASC - - DESC - - NONE + - ASC + - DESC + - NONE description: Array of index columns ColumnPair: required: - - sourceColumnName - - targetColumnName + - sourceColumnName + - targetColumnName type: object properties: sourceColumnName: @@ -2577,9 +3624,9 @@ components: description: List of related column pairs ColumnShortInfo: required: - - name - - notNullFlag - - type + - name + - notNullFlag + - type type: object properties: name: @@ -2600,8 +3647,8 @@ components: description: Current table column map ForeignKeyShortInfo: required: - - name - - targetTable + - name + - targetTable type: object properties: name: @@ -2618,7 +3665,7 @@ components: description: Current table foreign key map IndexShortInfo: required: - - name + - name type: object properties: name: @@ -2632,7 +3679,7 @@ components: description: Current table index map (unique constraints and primary key excluded) PrimaryKeyConstraintShortInfo: required: - - name + - name type: object properties: name: @@ -2646,9 +3693,9 @@ components: description: Current table primary key index TableInfo: required: - - columns - - name - - objectReference + - columns + - name + - objectReference type: object properties: name: @@ -2656,7 +3703,8 @@ components: description: Table name objectReference: type: boolean - description: Flag that indicates that the entity is an object in the subject data-model + description: Flag that indicates that the entity is an object in the subject + data-model description: type: string description: Table description @@ -2682,10 +3730,11 @@ components: type: object additionalProperties: $ref: '#/components/schemas/IndexShortInfo' - description: Current table index map (unique constraints and primary key excluded) + description: Current table index map (unique constraints and primary key + excluded) UniqueConstraintShortInfo: required: - - name + - name type: object properties: name: @@ -2699,9 +3748,9 @@ components: description: Current table unique constraint index map (primary key excluded) FormDetailsShort: required: - - created - - name - - title + - created + - name + - title type: object properties: name: @@ -2731,37 +3780,10 @@ components: updated: type: string format: date-time - BusinessProcessDefinition: - type: object - properties: - id: - type: string - name: - type: string - BusinessProcessGroupsResponse: - type: object - properties: - groups: - type: array - items: - $ref: '#/components/schemas/GroupDetailsResponse' - ungrouped: - type: array - items: - $ref: '#/components/schemas/BusinessProcessDefinition' - GroupDetailsResponse: - type: object - properties: - name: - type: string - processDefinitions: - type: array - items: - $ref: '#/components/schemas/BusinessProcessDefinition' VersionInfo: required: - - id - - name + - id + - name type: object properties: id: @@ -2775,7 +3797,7 @@ components: description: Version candidate description DataModelChangesInfo: required: - - name + - name type: object properties: name: @@ -2785,13 +3807,13 @@ components: type: string description: Data model file type. enum: - - TABLES_FILE + - TABLES_FILE status: type: string description: Data model file status. It's NEW or CHANGED enum: - - NEW - - CHANGED + - NEW + - CHANGED conflicted: type: boolean description: Is data model has conflicts @@ -2799,9 +3821,9 @@ components: description: List of changed data-model files EntityChangesInfo: required: - - name - - status - - title + - name + - status + - title type: object properties: name: @@ -2812,11 +3834,11 @@ components: description: Changed entity title status: type: string - description: Entity status. It's NEW, CHANGED or DELETED + description: "Entity status. It's NEW, CHANGED or DELETED" enum: - - NEW - - CHANGED - - DELETED + - NEW + - CHANGED + - DELETED conflicted: type: boolean description: Is entity has conflicts @@ -2824,10 +3846,10 @@ components: description: List of changed groups VersionChangesInfo: required: - - changedBusinessProcesses - - changedDataModelFiles - - changedForms - - changedGroups + - changedBusinessProcesses + - changedDataModelFiles + - changedForms + - changedGroups type: object properties: changedForms: diff --git a/docs/ua/modules/arch/attachments/architecture/platform-api/services/user-process-management-swagger.yml b/docs/ua/modules/arch/attachments/architecture/platform-api/services/user-process-management-swagger.yml index d757035547..9615c8ad68 100644 --- a/docs/ua/modules/arch/attachments/architecture/platform-api/services/user-process-management-swagger.yml +++ b/docs/ua/modules/arch/attachments/architecture/platform-api/services/user-process-management-swagger.yml @@ -1,36 +1,59 @@ -openapi: 3.0.1 +openapi: 3.0.3 info: - title: 'v1-alpha: User process management API' - version: 'v1-alpha' + title: User process management API description: All user process management operations + version: "1.0" +tags: +- name: user-process-instance-api + description: User process instance Rest API +- name: user-process-definition-api + description: User process definition Rest API +- name: grouped-user-process-definition-api + description: Grouped user process definition Rest API paths: /api/process-definition/{key}/start: post: tags: - - process-definition-controller + - user-process-definition-api summary: Start process instance - description: Returns started process instance + description: |- + ### Endpoint purpose: + This endpoint allows you to initiate a new process instance based on the provided process definition key operationId: startProcessInstance parameters: - - name: key - in: path - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: key + in: path + required: true + schema: + type: string responses: - '200': + "200": description: Returns started process instance content: '*/*': schema: $ref: '#/components/schemas/StartProcessInstanceResponse' - '404': + example: + id: d81fd894-6842-11ee-b71c-0a580a811836 + processDefinitionId: fcfea78f-66c2-11ee-b586-0a580a80065a + ended: false + "401": + description: Unauthorized + content: + application/json: {} + "404": description: Business process definition hasn't found content: '*/*': schema: $ref: '#/components/schemas/SystemErrorDto' - '500': + "500": description: Internal server error content: '*/*': @@ -39,36 +62,60 @@ paths: /api/process-definition/{key}/start-with-form: post: tags: - - process-definition-controller + - user-process-definition-api summary: Start process instance with form - description: Returns started process instance + description: |- + ### Endpoint purpose: + This endpoint allows to start process instance by process definition key with start form data + ### Form validation: + This endpoint requires valid form, if form provided in request body does not match form structure assigned to task, then _422_ status code returned. operationId: startProcessInstanceWithForm parameters: - - name: key - in: path - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: key + in: path + required: true + schema: + type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/FormDataDto' + example: + data: + formFieldName1: field value 1 + formFieldName2: field value 2 required: true responses: - '200': + "200": description: Returns started process instance content: '*/*': schema: $ref: '#/components/schemas/StartProcessInstanceResponse' - '404': + example: + id: d81fd894-6842-11ee-b71c-0a580a811836 + processDefinitionId: fcfea78f-66c2-11ee-b586-0a580a80065a + ended: false + "404": description: Business process definition hasn't found content: '*/*': schema: $ref: '#/components/schemas/SystemErrorDto' - '500': + "422": + description: Form validation failed + content: + '*/*': + schema: + $ref: '#/components/schemas/ValidationErrorDto' + "500": description: Internal server error content: '*/*': @@ -77,109 +124,237 @@ paths: /api/process-instance/count: get: tags: - - process-instance-controller - summary: Retrieve count of all unfinished process instances with root process instance - description: Returns business process instances count + - user-process-instance-api + summary: Returns business process instances count + description: |- + ### Endpoint purpose: + This endpoint allows to retrieve count of all unfinished process instances with root process instance operationId: countProcessInstances + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string responses: - '200': - description: OK + "200": + description: Count of process instances content: '*/*': schema: $ref: '#/components/schemas/CountResponse' + example: + count: 10 + "401": + description: Unauthorized + content: + application/json: {} + "500": + description: Internal server error + content: + '*/*': + schema: + $ref: '#/components/schemas/SystemErrorDto' /api/process-definition: get: tags: - - process-definition-controller + - user-process-definition-api summary: Retrieve all process definitions - description: Returns business process definitions list + description: |- + ### Endpoint purpose: + This endpoint allows to retrieve a list of process definitions based on the provided parameters, like _active_ or _suspended_ query parameters operationId: getProcessDefinitions parameters: - - name: params - in: query - required: true - schema: - $ref: '#/components/schemas/GetProcessDefinitionsParams' + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: suspended + in: query + description: Parameter used to retrieve suspended processes + schema: + type: boolean + - name: active + in: query + description: Parameter used to retrieve active processes + schema: + type: boolean + - name: params + in: query + required: true + schema: + $ref: '#/components/schemas/GetProcessDefinitionsParams' responses: - '200': - description: OK + "200": + description: List of process definitions content: '*/*': schema: - type: array - items: - $ref: '#/components/schemas/ProcessDefinitionResponse' + $ref: '#/components/schemas/ProcessDefinitionResponse' + example: + - id: ea4430c8-66c2-11ee-b586-0a580a80065a + key: business-process-key + name: Business process name + suspended: false + formKey: null + "401": + description: Unauthorized + content: + application/json: {} + "500": + description: Internal server error + content: + '*/*': + schema: + $ref: '#/components/schemas/SystemErrorDto' /api/process-definition/{key}: get: tags: - - process-definition-controller + - user-process-definition-api summary: Retrieve process definition by key - description: Returns business process definition entity + description: |- + ### Endpoint purpose: + This endpoint allows you to retrieve a process definition based on its unique key. operationId: getProcessDefinitionByKey parameters: - - name: key - in: path - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: key + in: path + required: true + schema: + type: string responses: - '200': - description: OK + "200": + description: Process definition content: '*/*': schema: $ref: '#/components/schemas/ProcessDefinitionResponse' + example: + id: ea4430c8-66c2-11ee-b586-0a580a80065a + key: business-process-key + name: Business process name + suspended: false + formKey: null + "401": + description: Unauthorized + content: + application/json: {} + "404": + description: Business process definition hasn't found + content: + '*/*': + schema: + $ref: '#/components/schemas/SystemErrorDto' + "500": + description: Internal server error + content: + '*/*': + schema: + $ref: '#/components/schemas/SystemErrorDto' /api/process-definition/count: get: tags: - - process-definition-controller - summary: Retrieve count of all process definitions - description: Returns business process definitions count + - user-process-definition-api + summary: Retrieve count of process definitions + description: |- + ### Endpoint purpose: + This endpoint allows you to retrieve the total count of available process definitions that match the specified parameters. You can filter the count by specifying criteria like _active_ or _suspended_ query parameters operationId: countProcessDefinitions parameters: - - name: params - in: query - required: true - schema: - $ref: '#/components/schemas/GetProcessDefinitionsParams' + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: suspended + in: query + description: Parameter used to retrieve suspended processes + schema: + type: boolean + - name: active + in: query + description: Parameter used to retrieve active processes + schema: + type: boolean + - name: params + in: query + required: true + schema: + $ref: '#/components/schemas/GetProcessDefinitionsParams' responses: - '200': - description: OK + "200": + description: Count of process definitions content: '*/*': schema: $ref: '#/components/schemas/CountResponse' + example: + count: 10 + "401": + description: Unauthorized + content: + application/json: {} + "500": + description: Internal server error + content: + '*/*': + schema: + $ref: '#/components/schemas/SystemErrorDto' /api/officer/process-instance: get: tags: - - process-instance-controller + - user-process-instance-api summary: Retrieve all process instances for the officer role - description: Returns business process instances list + description: |- + ### Endpoint purpose: + Retrieve a list of process instances assigned to the currently authenticated officer user. This endpoint returns a paginated list of process instances that are assigned to the authenticated officer user. The provided pageable parameters allow for customization of pagination settings. operationId: getOfficerProcessInstances parameters: - - name: firstResult - in: query - description: Pagination of results. Specifies the index of the first result to return. - schema: - type: integer - - name: maxResult - in: query - description: Pagination of results. Specifies the maximum number of results to return. Will return less results if there are no more results left. - schema: - type: integer - - name: sortBy - in: query - description: Sort the results lexicographically by a given criterion. Valid values are instanceId, caseInstanceId, dueDate, executionId, caseExecutionId,assignee, created, description, id, name, nameCaseInsensitive and priority. Must be used in conjunction with the sortOrder parameter. - schema: - type: string - - name: sortOrder - in: query - description: Sort the results in a given order. Values may be asc for ascending order or desc for descending order. Must be used in conjunction with the sortBy parameter. - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: firstResult + in: query + description: Pagination of results. Specifies the index of the first result + to return. + schema: + type: integer + - name: maxResult + in: query + description: Pagination of results. Specifies the maximum number of results + to return. Will return less results if there are no more results left. + schema: + type: integer + - name: sortBy + in: query + description: "Sort the results lexicographically by a given criterion. Valid\ + \ values are instanceId, caseInstanceId, dueDate, executionId, caseExecutionId,assignee,\ + \ created, description, id, name, nameCaseInsensitive and priority. Must\ + \ be used in conjunction with the sortOrder parameter." + schema: + type: string + - name: sortOrder + in: query + description: Sort the results in a given order. Values may be asc for ascending + order or desc for descending order. Must be used in conjunction with the + sortBy parameter. + schema: + type: string responses: - '200': + "200": description: Business process instances list content: '*/*': @@ -189,63 +364,129 @@ paths: items: $ref: '#/components/schemas/GetProcessInstanceResponse' example: - - id: 4ce5cc26-33ab-11eb-adc1-0242ac120002 - processDefinitionId: processDefinitionId - processDefinitionName: processDefinition - startTime: '2020-12-01T12:00:00' - status: - code: in_progress - title: У виконанні + - id: 4ce5cc26-33ab-11eb-adc1-0242ac120002 + processDefinitionId: processDefinitionId + processDefinitionName: processDefinition + startTime: 2020-12-01T12:00:00 + status: + code: in_progress + title: У виконанні + "401": + description: Unauthorized + content: + application/json: {} + "500": + description: Internal server error + content: + '*/*': + schema: + $ref: '#/components/schemas/SystemErrorDto' /api/grouped-process-definition: get: tags: - - grouped-process-definition-controller + - grouped-user-process-definition-api summary: Retrieve all process definitions with groups - description: Returns grouped and ungrouped business process definitions ordered lists + description: |- + ### Endpoint purpose: + This endpoint allows users to retrieve grouped and ungrouped business process definitions ordered lists based on their system role in X-Access-Token operationId: getProcessDefinitions_1 parameters: - - name: params - in: query - required: true - schema: - $ref: '#/components/schemas/GetProcessDefinitionsParams' + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: params + in: query + required: true + schema: + $ref: '#/components/schemas/GetProcessDefinitionsParams' responses: - '200': - description: OK + "200": + description: List of process definitions with groups content: '*/*': schema: $ref: '#/components/schemas/GroupedProcessDefinitionResponse' + example: |- + { + "groups": [ + { + "name": "Business processes group name", + "processDefinitions": [ + { + "id": "fcfea78f-66c2-11ee-b586-0a580a80065a", + "key": "business-process-in-group", + "name": "Business process in group name", + "suspended": false, + "formKey": null + } + ] + }, + "ungrouped": [ + { + "id": "fcd4151b-66c2-11ee-b586-0a580a80065a", + "key": "ungrouped-process", + "name": "Ungrouped process name", + "suspended": false, + "formKey": null + } + ] + } + "401": + description: Unauthorized + content: + application/json: {} + "500": + description: Internal server error + content: + application/json: {} /api/citizen/process-instance: get: tags: - - process-instance-controller + - user-process-instance-api summary: Retrieve all process instances for the citizen role - description: Returns business process instances list + description: |- + ### Endpoint purpose: + Retrieve a list of process instances assigned to the currently authenticated citizen user. This endpoint returns a paginated list of process instances that are assigned to the authenticated citizen user. The provided pageable parameters allow for customization of pagination settings. operationId: getCitizenProcessInstances parameters: - - name: firstResult - in: query - description: Pagination of results. Specifies the index of the first result to return. - schema: - type: integer - - name: maxResult - in: query - description: Pagination of results. Specifies the maximum number of results to return. Will return less results if there are no more results left. - schema: - type: integer - - name: sortBy - in: query - description: Sort the results lexicographically by a given criterion. Valid values are instanceId, caseInstanceId, dueDate, executionId, caseExecutionId,assignee, created, description, id, name, nameCaseInsensitive and priority. Must be used in conjunction with the sortOrder parameter. - schema: - type: string - - name: sortOrder - in: query - description: Sort the results in a given order. Values may be asc for ascending order or desc for descending order. Must be used in conjunction with the sortBy parameter. - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: firstResult + in: query + description: Pagination of results. Specifies the index of the first result + to return. + schema: + type: integer + - name: maxResult + in: query + description: Pagination of results. Specifies the maximum number of results + to return. Will return less results if there are no more results left. + schema: + type: integer + - name: sortBy + in: query + description: "Sort the results lexicographically by a given criterion. Valid\ + \ values are instanceId, caseInstanceId, dueDate, executionId, caseExecutionId,assignee,\ + \ created, description, id, name, nameCaseInsensitive and priority. Must\ + \ be used in conjunction with the sortOrder parameter." + schema: + type: string + - name: sortOrder + in: query + description: Sort the results in a given order. Values may be asc for ascending + order or desc for descending order. Must be used in conjunction with the + sortBy parameter. + schema: + type: string responses: - '200': + "200": description: Business process instances list content: '*/*': @@ -255,15 +496,34 @@ paths: items: $ref: '#/components/schemas/GetProcessInstanceResponse' example: - - id: 4ce5cc26-33ab-11eb-adc1-0242ac120002 - processDefinitionId: processDefinitionId - processDefinitionName: processDefinition - startTime: '2020-12-01T12:00:00' - status: - code: citizen_in_progress - title: Прийнято в обробку + - id: 4ce5cc26-33ab-11eb-adc1-0242ac120002 + processDefinitionId: processDefinitionId + processDefinitionName: processDefinition + startTime: 2020-12-01T12:00:00 + status: + code: citizen_in_progress + title: Прийнято в обробку + "401": + description: Unauthorized + content: + application/json: {} + "500": + description: Internal server error + content: + '*/*': + schema: + $ref: '#/components/schemas/SystemErrorDto' components: schemas: + StartProcessInstanceResponse: + type: object + properties: + id: + type: string + processDefinitionId: + type: string + ended: + type: boolean SystemErrorDto: type: object properties: @@ -275,15 +535,6 @@ components: type: string localizedMessage: type: string - StartProcessInstanceResponse: - type: object - properties: - id: - type: string - processDefinitionId: - type: string - ended: - type: boolean FormDataDto: type: object properties: @@ -295,19 +546,39 @@ components: type: string x-access-token: type: string + ErrorDetailDto: + type: object + properties: + message: + type: string + field: + type: string + value: + type: string + ErrorsListDto: + type: object + properties: + errors: + type: array + items: + $ref: '#/components/schemas/ErrorDetailDto' + ValidationErrorDto: + type: object + properties: + traceId: + type: string + code: + type: string + message: + type: string + details: + $ref: '#/components/schemas/ErrorsListDto' CountResponse: type: object properties: count: type: integer format: int64 - GetProcessDefinitionsParams: - type: object - properties: - active: - type: boolean - suspended: - type: boolean ProcessDefinitionResponse: type: object properties: @@ -321,6 +592,13 @@ components: type: boolean formKey: type: string + GetProcessDefinitionsParams: + type: object + properties: + active: + type: boolean + suspended: + type: boolean GetProcessInstanceResponse: type: object properties: @@ -341,12 +619,12 @@ components: code: type: string enum: - - ACTIVE - - PENDING - - SUSPENDED - - COMPLETED - - EXTERNALLY_TERMINATED - - INTERNALLY_TERMINATED + - ACTIVE + - PENDING + - SUSPENDED + - COMPLETED + - EXTERNALLY_TERMINATED + - INTERNALLY_TERMINATED title: type: string GroupedProcessDefinitionResponse: diff --git a/docs/ua/modules/arch/attachments/architecture/platform-api/services/user-settings-service-api-swagger.yml b/docs/ua/modules/arch/attachments/architecture/platform-api/services/user-settings-service-api-swagger.yml index 13e53a3ac3..e113792eab 100644 --- a/docs/ua/modules/arch/attachments/architecture/platform-api/services/user-settings-service-api-swagger.yml +++ b/docs/ua/modules/arch/attachments/architecture/platform-api/services/user-settings-service-api-swagger.yml @@ -1,222 +1,326 @@ -openapi: 3.0.1 +openapi: 3.0.3 info: - title: OpenAPI definition - version: v0 + title: User settings service API + description: This document describes REST API of 'User settings service' + version: "1.0" +tags: +- name: user-settings-service-api + description: User settings service Rest API paths: /api/settings/me/channels/{channel}/verify: post: tags: - - settings-controller - summary: створити ресурс - description: Використовується для створення ресурсу. + - user-settings-service-api + summary: Verify channel address + description: |- + ### Endpoint purpose: + This endpoint allows to send verification code to channel address + ### User verification: + For _diia_ channel expecting not one of _unregistered-officer_ or _officer_ user roles from _X-Access-Token_, for other channels user roles must not be empty, otherwise _403 Forbidden_ status code returned. operationId: verifyChannelAddress parameters: - - name: channel - in: path - required: true - schema: - type: string - enum: - - email - - diia - - inbox - - name: X-Access-Token - in: header - required: false - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: channel + in: path + required: true + schema: + type: string + enum: + - email + - diia + - inbox requestBody: content: application/json: schema: $ref: '#/components/schemas/VerificationInputDto' + example: + address: new@email.com required: true responses: - '200': - description: OK з результатом + "200": + description: Returns verification code expiration in seconds content: '*/*': schema: $ref: '#/components/schemas/VerificationCodeExpirationDto' - '400': - description: Некоректні вхідні дані (наприклад, неправильний тип поля) - '401': - description: Помилка аутентифікації (відсутній токен або цифровий підпис) - '422': - description: Помилка валідації, запит містить дані, що не відповідають правилам вказаним в домені - '500': - description: Внутрішня помилка сервера + example: + verificationCodeExpirationSec: 30 + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: User role verification failed + content: + '*/*': + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "500": + description: Internal server error + content: + '*/*': + schema: + $ref: '#/components/schemas/DetailedErrorResponse' /api/settings/me/channels/{channel}/deactivate: post: tags: - - settings-controller - summary: створити ресурс - description: Використовується для створення ресурсу. + - user-settings-service-api + summary: Deactivate channel + description: |- + ### Endpoint purpose: + This endpoint allows to deactivate one of predefined communication channels: _email_, _diia_ or _inbox_. + ### User verification: + For _diia_ channel expecting not one of _unregistered-officer_ or _officer_ user roles from _X-Access-Token_, for other channels user roles must not be empty, otherwise _403 Forbidden_ status code returned. operationId: deactivateChannel parameters: - - name: channel - in: path - required: true - schema: - type: string - enum: - - email - - diia - - inbox - - name: X-Access-Token - in: header - required: false - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: channel + in: path + required: true + schema: + type: string + enum: + - email + - diia + - inbox requestBody: content: application/json: schema: $ref: '#/components/schemas/SettingsDeactivateChannelInputDto' + example: + address: new@email.com + deactivationReason: User deactivated required: true responses: - '200': - description: OK з результатом - '400': - description: Некоректні вхідні дані (наприклад, неправильний тип поля) - '401': - description: Помилка аутентифікації (відсутній токен або цифровий підпис) - '422': - description: Помилка валідації, запит містить дані, що не відповідають правилам вказаним в домені - '500': - description: Внутрішня помилка сервера + "200": + description: Channel deactivated successfully + "400": + description: Communication channel verification failed + content: + '*/*': + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: User role verification failed + content: + '*/*': + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "500": + description: Internal server error + content: + '*/*': + schema: + $ref: '#/components/schemas/DetailedErrorResponse' /api/settings/me/channels/{channel}/activate: post: tags: - - settings-controller - summary: створити ресурс - description: Використовується для створення ресурсу. + - user-settings-service-api + summary: Activate channel + description: |- + ### Endpoint purpose: + This endpoint allows to activate for user one of predefined communication channels: _email_, _diia_ or _inbox_. Accepts verification code in request body, which can be received using [POST](#user-settings-service-api/verifyChannelAddress) endpoint. + ### User verification: + For _diia_ channel expecting not one of _unregistered-officer_ or _officer_ user roles from _X-Access-Token_, for other channels user roles must not be empty, otherwise _403 Forbidden_ status code returned. operationId: activateChannel parameters: - - name: channel - in: path - required: true - schema: - type: string - enum: - - email - - diia - - inbox - - name: X-Access-Token - in: header - required: false - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: channel + in: path + required: true + schema: + type: string + enum: + - email + - diia + - inbox requestBody: content: application/json: schema: $ref: '#/components/schemas/ActivateChannelInputDto' + example: + address: new@email.com + verificationCode: "123456" required: true responses: - '200': - description: OK з результатом - '400': - description: Некоректні вхідні дані (наприклад, неправильний тип поля) - '401': - description: Помилка аутентифікації (відсутній токен або цифровий підпис) - '422': - description: Помилка валідації, запит містить дані, що не відповідають правилам вказаним в домені - '500': - description: Внутрішня помилка сервера + "200": + description: Channel activated successfully + "400": + description: Communication channel verification failed + content: + '*/*': + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: User role verification failed + content: + '*/*': + schema: + $ref: '#/components/schemas/DetailedErrorResponse' + "500": + description: Internal server error + content: + '*/*': + schema: + $ref: '#/components/schemas/DetailedErrorResponse' /api/settings/me/channels/email/validate: post: tags: - - settings-controller - summary: створити ресурс - description: Використовується для створення ресурсу. + - user-settings-service-api + summary: Validate email address + description: |- + ### Endpoint purpose: + This endpoint allows to validate user's email address for restricted symbols in it, or verify if it's empty operationId: validateEmailAddress parameters: - - name: X-Access-Token - in: header - required: false - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/SettingsEmailInputDto' + example: + address: new@email.com required: true responses: - '200': - description: OK з результатом - '400': - description: Некоректні вхідні дані (наприклад, неправильний тип поля) - '401': - description: Помилка аутентифікації (відсутній токен або цифровий підпис) - '422': - description: Помилка валідації, запит містить дані, що не відповідають правилам вказаним в домені - '500': - description: Внутрішня помилка сервера + "200": + description: Email address validation passed + "401": + description: Unauthorized + content: + application/json: {} + "422": + description: Email address not valid or empty + content: + '*/*': + schema: + $ref: '#/components/schemas/DetailedValidationErrorResponse' + "500": + description: Internal server error + content: + '*/*': + schema: + $ref: '#/components/schemas/DetailedErrorResponse' /api/settings/{userId}: get: tags: - - settings-controller - summary: отримати ресурс по ідентифікатору - description: Використовується для отримання об’єктів. Не змінює стан ресурсу + - user-settings-service-api + summary: Retrieve user settings based on user identifier + description: |- + ### Endpoint purpose: + This endpoint allows to retrieve the personal settings of the user, such as channels of communication. operationId: findUserSettingsById parameters: - - name: userId - in: path - required: true - schema: - type: string - format: uuid - - name: X-Access-Token - in: header - required: false - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: userId + in: path + required: true + schema: + type: string + format: uuid responses: - '200': - description: OK з результатом + "200": + description: Returns JSON representation of user settings content: '*/*': schema: $ref: '#/components/schemas/SettingsReadDto' - '400': - description: Некоректні вхідні дані (наприклад, неправильний тип поля) - '401': - description: Помилка аутентифікації (відсутній токен або цифровий підпис) - '500': - description: Внутрішня помилка сервера + example: + settingsId: a6bf7765-1daf-4a51-8510-f1cbf2e943b0 + channels: + - channel: email + activated: true + address: new@email.com + "401": + description: Unauthorized + content: + application/json: {} + "500": + description: Internal server error + content: + '*/*': + schema: + $ref: '#/components/schemas/DetailedErrorResponse' /api/settings/me: get: tags: - - settings-controller - summary: отримати ресурс по ідентифікатору - description: Використовується для отримання об’єктів. Не змінює стан ресурсу + - user-settings-service-api + summary: Retrieve user settings based on X-Access-Token + description: |- + ### Endpoint purpose: + This endpoint allows to retrieve the personal settings of the authenticated user, such as channels of communication. operationId: findUserSettingsFromToken parameters: - - name: X-Access-Token - in: header - required: false - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string responses: - '200': - description: OK з результатом + "200": + description: Returns JSON representation of user settings content: '*/*': schema: $ref: '#/components/schemas/SettingsReadDto' - '400': - description: Некоректні вхідні дані (наприклад, неправильний тип поля) - '401': - description: Помилка аутентифікації (відсутній токен або цифровий підпис) - '500': - description: Внутрішня помилка сервера + example: + settingsId: a6bf7765-1daf-4a51-8510-f1cbf2e943b0 + channels: + - channel: email + activated: true + address: new@email.com + "401": + description: Unauthorized + content: + application/json: {} + "500": + description: Internal server error + content: + '*/*': + schema: + $ref: '#/components/schemas/DetailedErrorResponse' components: schemas: VerificationInputDto: required: - - address + - address type: object properties: address: @@ -227,9 +331,18 @@ components: verificationCodeExpirationSec: type: integer format: int32 + DetailedErrorResponse: + type: object + properties: + traceId: + type: string + code: + type: string + details: + type: object SettingsDeactivateChannelInputDto: required: - - deactivationReason + - deactivationReason type: object properties: address: @@ -238,8 +351,8 @@ components: type: string ActivateChannelInputDto: required: - - address - - verificationCode + - address + - verificationCode type: object properties: address: @@ -248,20 +361,31 @@ components: type: string SettingsEmailInputDto: required: - - address + - address type: object properties: address: type: string + DetailedValidationErrorResponse: + type: object + properties: + traceId: + type: string + code: + type: string + message: + type: string + localizedMessage: + type: string ChannelReadDto: type: object properties: channel: type: string enum: - - email - - diia - - inbox + - email + - diia + - inbox activated: type: boolean address: diff --git a/docs/ua/modules/arch/attachments/architecture/platform-api/services/user-task-management-swagger.yml b/docs/ua/modules/arch/attachments/architecture/platform-api/services/user-task-management-swagger.yml index 13191ab705..87d1dd1ed7 100644 --- a/docs/ua/modules/arch/attachments/architecture/platform-api/services/user-task-management-swagger.yml +++ b/docs/ua/modules/arch/attachments/architecture/platform-api/services/user-task-management-swagger.yml @@ -1,43 +1,73 @@ -openapi: 3.0.1 +openapi: 3.0.3 info: - title: 'v1-alpha: User task management API' - version: 'v1-alpha' + title: User task management API description: All user task management operations + version: "1.0" +tags: +- name: user-task-management-api + description: User task management Rest API paths: /api/task/{id}/save: post: tags: - - user-task-controller + - user-task-management-api summary: Save form data + description: |- + ### Endpoint purpose: + This endpoint allows to save form data to temporary storage without task completion. + ### Authorization: + If user assigned to task does not match user retrieved from _X-Access-Token_ then _403 Forbidden_ status code returned. + ### Form validation: + This endpoint requires valid form, if form provided in request body does not match form structure assigned to task, then _422_ status code returned. operationId: saveFormData parameters: - - name: id - in: path - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: id + in: path + required: true + schema: + type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/FormDataDto' + example: + data: + formFieldName1: field value 1 + formFieldName2: field value 2 required: true responses: - '200': + "200": description: Form data successfully saved - '404': + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden + content: + '*/*': + schema: + $ref: '#/components/schemas/SystemErrorDto' + "404": description: Task hasn't found content: '*/*': schema: $ref: '#/components/schemas/SystemErrorDto' - '422': + "422": description: Form data validation error content: '*/*': schema: $ref: '#/components/schemas/ValidationErrorDto' - '500': + "500": description: Internal server error content: '*/*': @@ -46,35 +76,74 @@ paths: /api/task/{id}/complete: post: tags: - - user-task-controller + - user-task-management-api summary: Complete task by id + description: |- + ### Endpoint purpose: + This endpoint allows users to complete a specific task by providing its unique identifier. Users must include the necessary data in the request body using a FormDataDto. Upon successful completion, information about the completed task is returned. + ### Authorization: + If user assigned to task does not match user retrieved from _X-Access-Token_ then _403 Forbidden_ status code returned. + ### Form validation: + This endpoint requires valid form, if form provided in request body does not match form structure assigned to task, then _422_ status code returned. operationId: completeTaskById parameters: - - name: id - in: path - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: id + in: path + required: true + schema: + type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/FormDataDto' + example: + data: + formFieldName1: field value 1 + formFieldName2: field value 2 required: true responses: - '200': + "200": description: Task successfully completed content: '*/*': schema: $ref: '#/components/schemas/CompletedTaskResponse' - '404': + example: + id: d5a4eddf-6360-11ee-88e8-0a580a81041b + processInstanceId: d5a40376-6360-11ee-88e8-0a580a81041b + rootProcessInstanceId: d5a40376-6360-11ee-88e8-0a580a81041b + rootProcessInstanceEnded: false + variables: {} + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden + content: + '*/*': + schema: + $ref: '#/components/schemas/SystemErrorDto' + "404": description: Task hasn't found content: '*/*': schema: $ref: '#/components/schemas/SystemErrorDto' - '500': + "422": + description: Form data is not valid + content: + '*/*': + schema: + $ref: '#/components/schemas/SystemErrorDto' + "500": description: Internal server error content: '*/*': @@ -83,31 +152,40 @@ paths: /api/task/{id}/claim: post: tags: - - user-task-controller + - user-task-management-api summary: Claim task by id + description: |- + ### Endpoint purpose: + This endpoint allows users to claim a task by its unique identifier. Once a task is claimed, it becomes the responsibility of the user who claimed it and is no longer available for other users to claim. operationId: claimTaskById parameters: - - name: id - in: path - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: id + in: path + required: true + schema: + type: string responses: - '204': + "204": description: Task successfully claimed - '404': + "404": description: Task hasn't found or already completed content: '*/*': schema: $ref: '#/components/schemas/SystemErrorDto' - '409': + "409": description: Task already assigned on another person content: '*/*': schema: $ref: '#/components/schemas/SystemErrorDto' - '500': + "500": description: Internal server error content: '*/*': @@ -116,41 +194,75 @@ paths: /api/officer/task/{id}/sign-form: post: tags: - - user-task-controller + - user-task-management-api summary: Sign and complete officer task by id + description: |- + ### Endpoint purpose: + This endpoint allows officer to sign form data for a specific task. Users must provide the task's unique identifier and the required form data with signature in the request body. Upon successful signing, information about the task is returned. + ### Authorization: + If user assigned to task does not match user retrieved from _X-Access-Token_ then _403 Forbidden_ status code returned. + ### Form and signature validation: + This endpoint requires valid form, if form provided in request body does not match form structure assigned to task or verification of provided signature is failed, then _422_ status code returned. operationId: singOfficerForm parameters: - - name: id - in: path - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: id + in: path + required: true + schema: + type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/FormDataDto' + example: + data: + formFieldName1: field value 1 + formFieldName2: field value 2 + signature: Key-6.dat required: true responses: - '200': + "200": description: Task successfully signed and completed content: '*/*': schema: $ref: '#/components/schemas/CompletedTaskResponse' - '404': + example: + id: fed535d9-6360-11ee-88e8-0a580a81041b + processInstanceId: d5a40376-6360-11ee-88e8-0a580a81041b + rootProcessInstanceId: d5a40376-6360-11ee-88e8-0a580a81041b + rootProcessInstanceEnded: true + variables: {} + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden + content: + '*/*': + schema: + $ref: '#/components/schemas/SystemErrorDto' + "404": description: Task hasn't found content: '*/*': schema: $ref: '#/components/schemas/SystemErrorDto' - '422': + "422": description: Task hasn't verified content: '*/*': schema: $ref: '#/components/schemas/ValidationErrorDto' - '500': + "500": description: Internal server error content: '*/*': @@ -159,41 +271,75 @@ paths: /api/citizen/task/{id}/sign-form: post: tags: - - user-task-controller + - user-task-management-api summary: Sign and complete citizen task by id + description: |- + ### Endpoint purpose: + This endpoint allows citizen to sign form data for a specific task. Users must provide the task's unique identifier and the required form data with signature in the request body. Upon successful signing, information about the task is returned. + ### Authorization: + If user assigned to task does not match user retrieved from _X-Access-Token_ then _403 Forbidden_ status code returned. + ### Form and signature validation: + This endpoint requires valid form, if form provided in request body does not match form structure assigned to task or verification of provided signature is failed, then _422_ status code returned. operationId: signCitizenForm parameters: - - name: id - in: path - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: id + in: path + required: true + schema: + type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/FormDataDto' + example: + data: + formFieldName1: field value 1 + formFieldName2: field value 2 + signature: Key-6.dat required: true responses: - '200': + "200": description: Task successfully signed and completed content: '*/*': schema: $ref: '#/components/schemas/CompletedTaskResponse' - '404': + example: + id: fed535d9-6360-11ee-88e8-0a580a81041b + processInstanceId: d5a40376-6360-11ee-88e8-0a580a81041b + rootProcessInstanceId: d5a40376-6360-11ee-88e8-0a580a81041b + rootProcessInstanceEnded: true + variables: {} + "401": + description: Unauthorized + content: + application/json: {} + "403": + description: Forbidden + content: + '*/*': + schema: + $ref: '#/components/schemas/SystemErrorDto' + "404": description: Task hasn't found content: '*/*': schema: $ref: '#/components/schemas/SystemErrorDto' - '422': + "422": description: Task hasn't verified content: '*/*': schema: $ref: '#/components/schemas/ValidationErrorDto' - '500': + "500": description: Internal server error content: '*/*': @@ -202,127 +348,245 @@ paths: /api/task: get: tags: - - user-task-controller + - user-task-management-api summary: Retrieve all tasks - description: Returns task list + description: |- + ### Endpoint purpose: + This endpoint allows users to retrieve a list of tasks associated with a specified process instance or user. Users can optionally filter tasks by providing a process instance ID. Pagination is supported via the pageable parameter. The endpoint returns a list of UserTaskResponse objects, each representing a retrieved task. operationId: getTasks parameters: - - name: processInstanceId - in: query - required: false - schema: - type: string - - name: firstResult - in: query - description: Pagination of results. Specifies the index of the first result to return. - schema: - type: integer - - name: maxResult - in: query - description: Pagination of results. Specifies the maximum number of results to return. Will return less results if there are no more results left. - schema: - type: integer - - name: sortBy - in: query - description: Sort the results lexicographically by a given criterion. Valid values are instanceId, caseInstanceId, dueDate, executionId, caseExecutionId,assignee, created, description, id, name, nameCaseInsensitive and priority. Must be used in conjunction with the sortOrder parameter. - schema: - type: string - - name: sortOrder - in: query - description: Sort the results in a given order. Values may be asc for ascending order or desc for descending order. Must be used in conjunction with the sortBy parameter. - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: processInstanceId + in: query + required: false + schema: + type: string + - name: firstResult + in: query + description: Pagination of results. Specifies the index of the first result + to return. + schema: + type: integer + - name: maxResult + in: query + description: Pagination of results. Specifies the maximum number of results + to return. Will return less results if there are no more results left. + schema: + type: integer + - name: sortBy + in: query + description: "Sort the results lexicographically by a given criterion. Valid\ + \ values are instanceId, caseInstanceId, dueDate, executionId, caseExecutionId,assignee,\ + \ created, description, id, name, nameCaseInsensitive and priority. Must\ + \ be used in conjunction with the sortOrder parameter." + schema: + type: string + - name: sortOrder + in: query + description: Sort the results in a given order. Values may be asc for ascending + order or desc for descending order. Must be used in conjunction with the + sortBy parameter. + schema: + type: string responses: - '200': - description: OK + "200": + description: List of user tasks content: '*/*': schema: - type: array - items: - $ref: '#/components/schemas/UserTaskResponse' + $ref: '#/components/schemas/UserTaskResponse' + example: + - id: 0b52527c-62ae-11ee-be57-0a580a810416 + taskDefinitionKey: UserTask_AddStatus + name: my task name + assignee: user + created: 2023-10-04T12:03:34.884Z + description: some description + processDefinitionName: my process name + processInstanceId: fd3187f5-62ad-11ee-be57-0a580a810415 + processDefinitionId: Process_160gicr:14:b8fa558e-62aa-11ee-be57-0a580a810416 + formKey: null + suspended: false + businessKey: null + "401": + description: Unauthorized + content: + application/json: {} + "500": + description: Internal server error + content: + application/json: {} /api/task/{id}: get: tags: - - user-task-controller + - user-task-management-api summary: Get task by id - description: Returns task by id + description: |- + ### Endpoint purpose: + This endpoint allows users to retrieve detailed information about a specific task by providing its unique identifier (ID). The task details include information such as task status, assignee, due date, and other relevant data. operationId: getTaskById parameters: - - name: id - in: path - required: true - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: id + in: path + required: true + schema: + type: string responses: - '200': - description: Returns task by id + "200": + description: Returns detailed task information content: '*/*': schema: $ref: '#/components/schemas/SignableDataUserTaskResponse' - '404': - description: Task hasn't found + example: + id: 97839db1-62b2-11ee-be57-0a580a810415 + taskDefinitionKey: UserTask_SignSuccessfulStatusActivity + name: Sign data + assignee: user + created: 2023-10-04T12:36:08.075Z + description: null + processInstanceId: 81ae5334-62b2-11ee-be57-0a580a810415 + rootProcessInstanceId: 81ae5334-62b2-11ee-be57-0a580a810415 + processDefinitionId: Process_160gicr:15:4ef94837-62b0-11ee-be57-0a580a810415 + processDefinitionName: my-process + formKey: my-user-task-form + suspended: false + formVariables: {} + signatureValidationPack: [] + data: + myField: myValue + submit: true + esign: true + "401": + description: Unauthorized + content: + application/json: {} + "404": + description: Not found content: '*/*': schema: $ref: '#/components/schemas/SystemErrorDto' + "500": + description: Internal server error + content: + application/json: {} /api/task/lightweight: get: tags: - - user-task-controller + - user-task-management-api summary: Retrieve all tasks - description: Returns lightweight task list + description: |- + ### Endpoint purpose: + This endpoint allows users to retrieve a lightweight list of tasks associated with a specified process instance or user. Users can optionally filter tasks by providing a root process instance ID. The endpoint returns a list of lightweight user tasks. This lightweight version of the task list provides essential task details for efficient display purposes. operationId: getLightweightTasks parameters: - - name: rootProcessInstanceId - in: query - required: false - schema: - type: string - - name: firstResult - in: query - description: Pagination of results. Specifies the index of the first result to return. - schema: - type: integer - - name: maxResult - in: query - description: Pagination of results. Specifies the maximum number of results to return. Will return less results if there are no more results left. - schema: - type: integer - - name: sortBy - in: query - description: Sort the results lexicographically by a given criterion. Valid values are instanceId, caseInstanceId, dueDate, executionId, caseExecutionId,assignee, created, description, id, name, nameCaseInsensitive and priority. Must be used in conjunction with the sortOrder parameter. - schema: - type: string - - name: sortOrder - in: query - description: Sort the results in a given order. Values may be asc for ascending order or desc for descending order. Must be used in conjunction with the sortBy parameter. - schema: - type: string + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string + - name: rootProcessInstanceId + in: query + required: false + schema: + type: string + - name: firstResult + in: query + description: Pagination of results. Specifies the index of the first result + to return. + schema: + type: integer + - name: maxResult + in: query + description: Pagination of results. Specifies the maximum number of results + to return. Will return less results if there are no more results left. + schema: + type: integer + - name: sortBy + in: query + description: "Sort the results lexicographically by a given criterion. Valid\ + \ values are instanceId, caseInstanceId, dueDate, executionId, caseExecutionId,assignee,\ + \ created, description, id, name, nameCaseInsensitive and priority. Must\ + \ be used in conjunction with the sortOrder parameter." + schema: + type: string + - name: sortOrder + in: query + description: Sort the results in a given order. Values may be asc for ascending + order or desc for descending order. Must be used in conjunction with the + sortBy parameter. + schema: + type: string responses: - '200': - description: OK + "200": + description: List of user lightweight tasks content: '*/*': schema: - type: array - items: - $ref: '#/components/schemas/UserTaskLightweightResponse' + $ref: '#/components/schemas/UserTaskLightweightResponse' + example: |- + [ + { + "id": "0b52527c-62ae-11ee-be57-0a580a810416", + "assignee": "user", + }, + { + "id": "0b52527c-62ae-11ee-be57-0a580a2132312", + "assignee": "user", + } + ] + "401": + description: Unauthorized + content: + application/json: {} + "500": + description: Internal server error + content: + application/json: {} /api/task/count: get: tags: - - user-task-controller + - user-task-management-api summary: Retrieve count of all tasks - description: Returns tasks count + description: |- + ### Endpoint purpose: + This endpoint allows to retrieve the total count of all available tasks for user. operationId: countTasks + parameters: + - name: X-Access-Token + in: header + description: Token used for endpoint security + required: true + schema: + type: string responses: - '200': - description: OK + "200": + description: Returns detailed task information content: '*/*': schema: $ref: '#/components/schemas/CountResponse' + example: |- + { + "count": 10, + } + "401": + description: Unauthorized + content: + application/json: {} components: schemas: FormDataDto: @@ -336,6 +600,17 @@ components: type: string x-access-token: type: string + SystemErrorDto: + type: object + properties: + traceId: + type: string + code: + type: string + message: + type: string + localizedMessage: + type: string ErrorDetailDto: type: object properties: @@ -363,17 +638,6 @@ components: type: string details: $ref: '#/components/schemas/ErrorsListDto' - SystemErrorDto: - type: object - properties: - traceId: - type: string - code: - type: string - message: - type: string - localizedMessage: - type: string CompletedTaskResponse: type: object properties: @@ -446,6 +710,8 @@ components: type: string processInstanceId: type: string + rootProcessInstanceId: + type: string processDefinitionId: type: string processDefinitionName: @@ -464,9 +730,9 @@ components: items: type: string enum: - - INDIVIDUAL - - ENTREPRENEUR - - LEGAL + - INDIVIDUAL + - ENTREPRENEUR + - LEGAL data: type: object additionalProperties: @@ -485,4 +751,4 @@ components: properties: count: type: integer - format: int64 \ No newline at end of file + format: int64 diff --git a/docs/ua/modules/arch/attachments/architecture/platform-system-requirements/registry-resources.xlsx b/docs/ua/modules/arch/attachments/architecture/platform-system-requirements/registry-resources.xlsx deleted file mode 100644 index 0afea2888b..0000000000 Binary files a/docs/ua/modules/arch/attachments/architecture/platform-system-requirements/registry-resources.xlsx and /dev/null differ diff --git a/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/citizen-id-gov-ua/component-citizen-id-gov-ua.drawio.svg b/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/citizen-id-gov-ua/component-citizen-id-gov-ua.drawio.svg index 1484b8b076..442369381c 100644 --- a/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/citizen-id-gov-ua/component-citizen-id-gov-ua.drawio.svg +++ b/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/citizen-id-gov-ua/component-citizen-id-gov-ua.drawio.svg @@ -1,4 +1,4 @@ -
citizen-portal realm
citizen-portal realm
Auth Flow
dso-citizen-auth-flow
Auth Flow...
Authenticator
ds-citizen-authenticator
Authenticator...
FTL_PARAMS.authType ==
 'widget'
FTL_PARAMS.authType ==...
Form
signature-citizen.ftl
Form...
Widget
Widget
FTL_PARAMS.authType
== 'platform-id-gov-ua''
FTL_PARAMS.authType...
FTL_PARAMS.authType
== 'registry-id-gov-ua''
FTL_PARAMS.authType...
Button
id.gov.ua
Button...
First Login Flow
First Login Flow
Identity Provider
idgovua
Identity Provider...
Auth Flow
browser-with-redirector
Auth Flow...
Identity Provider
idgovua
idgovuav2
Identity Provider...
Auth Flow
id-gov-ua
Auth Flow...
Authenticator
id-gov-ua-authenticator
Authenticator...
First Login Flow
First Login Flow
Identity Provider
registry-id-gov-ua
idgovuav2
Identity Provider...
id-gov-ua realm
id-gov-ua realmText is not SVG - cannot display \ No newline at end of file +
citizen-portal realm
citizen-portal realm
Auth Flow
dso-citizen-auth-flow
Auth Flow...
Authenticator
ds-citizen-authenticator
Authenticator...
FTL_PARAMS.authType ==
 'widget'
FTL_PARAMS.authType ==...
Form
signature-citizen.ftl
Form...
Widget
Widget
idp.enabled == true
idp.enabled == true
Button
id.gov.ua
Button...
First Login Flow
First Login Flow
Identity Provider
idgovua
Identity Provider...
Auth Flow
browser-with-redirector
Auth Flow...
Identity Provider
idgovua
idgovuav2
Identity Provider...
Auth Flow
id-gov-ua
Auth Flow...
Authenticator
id-gov-ua-authenticator
Authenticator...
First Login Flow
First Login Flow
Identity Provider
registry-id-gov-ua
idgovuav2
Identity Provider...
id-gov-ua realm
id-gov-ua realm
idp.enabled == true
idp.enabled == trueText is not SVG - cannot display \ No newline at end of file diff --git a/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/citizen-id-gov-ua/use-case-key-mng.drawio.svg b/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/citizen-id-gov-ua/use-case-key-mng.drawio.svg index d3e9beb7f8..809c3166e5 100644 --- a/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/citizen-id-gov-ua/use-case-key-mng.drawio.svg +++ b/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/citizen-id-gov-ua/use-case-key-mng.drawio.svg @@ -1,4 +1,4 @@ -
A2: Save keys and passwords
A2: Save keys and passwords
A3: Save keys params and vault links
A3: Save keys params and vault links
Control Plane
Control Plane
Vault
Vault
CP Gerrit
CP Gerrit
A1: Add keys 
A1: Add keys 
Platform Admin
Plat...
B1: Get available keys
B1: Get available keys
B3: Save encryption key
for registry id gov ua
B3: Save encryption key...
Control Plane
Control Plane
B2: Select encryption key
for registry id gov ua 
from the list
B2: Select encryption key...
Registry Admin
Regi...
A4: Apply cluster-mngm changes 
A4: Apply cluster-mngm changes 
B4: Apply registry changes
B4: Apply registry changes
A5: Setup additional keys
A5: Setup additional keys
B5: setup encrypt key
alias
B5: setup encrypt key...
B6: setup encrypt key
alias
B6: setup encrypt key...
CP Jenkins
CP Jenkins
A6: OpenShift syncs
external secrets
A6: OpenShift syncs...
Platform DSO
Platform DSO
c1: Uses default key for operations
c1: Uses default key for operations
platform id.gov.ua idp
platform id.gov.u...
B7: key alias
certificate/decrypt
B7: key alias...
officer id.gov.ua idp
officer id.gov.ua...
B7: key alias
certificate/decrypt
B7: key alias...
citizen id.gov.ua idp
citizen id.gov.ua...Text is not SVG - cannot display \ No newline at end of file +
A2: Save keys and passwords
A2: Save keys and passwords
A3: Save keys params and vault links
A3: Save keys params and vault links
Control Plane
Control Plane
Vault
Vault
CP Gerrit
CP Gerrit
A1: Add keys 
A1: Add keys 
Platform Admin
Plat...
B1: Get available keys
B1: Get available keys
B3: Save encryption key
for registry id gov ua
B3: Save encryption key...
Control Plane
Control Plane
B2: Select encryption key
for registry id gov ua 
from the list
B2: Select encryption key...
Registry Admin
Regi...
A4: Apply cluster-mngm changes 
A4: Apply cluster-mngm changes 
B4: Apply registry changes
B4: Apply registry changes
A5: Setup keys with names
A5: Setup keys with names
B5: setup encrypt key
name
B5: setup encrypt key...
B6: setup encrypt key
name
B6: setup encrypt key...
CP Jenkins
CP Jenkins
A6: OpenShift syncs
external secrets
A6: OpenShift syncs...
Platform DSO
Platform DSO
c2: key name certificate/decrypt
c2: key name certificate/decrypt
platform id.gov.ua idp
platform id.gov.u...
B7: key name
certificate/decrypt
B7: key name...
officer id.gov.ua idp
officer id.gov.ua...
B7: key name
certificate/decrypt
B7: key name...
citizen id.gov.ua idp
citizen id.gov.ua...
Platform Admin
Plat...
C1: setup encrypt key
by instruction
C1: setup encrypt key...Text is not SVG - cannot display \ No newline at end of file diff --git a/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/documentation-variables/demo.png b/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/documentation-variables/demo.png deleted file mode 100644 index 07ebb3aa7b..0000000000 Binary files a/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/documentation-variables/demo.png and /dev/null differ diff --git a/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/documentation-variables/demo_not_demo.png b/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/documentation-variables/demo_not_demo.png deleted file mode 100644 index 3038ad8707..0000000000 Binary files a/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/documentation-variables/demo_not_demo.png and /dev/null differ diff --git a/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/external-systems-access-separation/cp-ext-system-config.png b/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/external-systems-access-separation/cp-ext-system-config.png new file mode 100644 index 0000000000..f151225f6d Binary files /dev/null and b/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/external-systems-access-separation/cp-ext-system-config.png differ diff --git a/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/initial-load/deployment.svg b/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/initial-load/deployment.svg new file mode 100644 index 0000000000..63b18ab391 --- /dev/null +++ b/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/initial-load/deployment.svg @@ -0,0 +1,4 @@ + + + +
Kong API Gateway
Kong API Gateway
Data Admin Service
(Spring Native)
Data Admin Service...
OpenShift Router
(HA Proxy)
OpenShift Router...
[https]
[https]
Data Admin Dashboard
(React app)
Data Admin Dashboard...
[https]
отримання
статичної сторінки
[https]...
[https, json]
API управління
даними реєстру
[https, json]...
[https, json]
/api/admin
[https, json]...
[s3]
завантаження файлів
[s3]...
Officer-load Job 
Officer-load Job 
Initial load Job 
Initial load Job 
[https,api]
OpenShift API
[https,api]...
[https,api]
OpenShift API
[https,api]...
Rados Gateway
Rados Gateway
initial-data-load-raw
initial-data-load-raw
initial-data-load-archive
initial-data-load-ar...
[s3]
читання файлів
[s3]...
[s3]
запис файлів
[s3]...
PostgresSQL
PostgresSQL
[jdbc]
потоковий запис
[jdbc]...
[s3]
завантаження файлів
[s3]...
registry namespace
registry namespace
Адміністратор даних реєстру
Адміністратор даних реєстру
file-ceph-bucket
file-ceph-bucket
[s3]
запис файлів
[s3]...
Нові компоненти та звʼязки
Нові компоненти та звʼязки
Існуючі компоненти
Існуючі компонентиText is not SVG - cannot display \ No newline at end of file diff --git a/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/initial-load/initial-load.svg b/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/initial-load/initial-load.svg new file mode 100644 index 0000000000..a0e0a41367 --- /dev/null +++ b/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/initial-load/initial-load.svg @@ -0,0 +1,4 @@ + + + +
Адміністративна зона реєстру
Адміністративна зона реєстру
Підсистема управління
зовнішнім трафіком
Підсистема управління...
Міжсервісна взаємодія
Міжсервісна взаємодія
Підсистема реєстру
Підсистема реєстру
Зовнішні системи
Зовнішні системи
Підсистема Платформи
Підсистема Платформи
Компонент цільової підсистеми
Компонент цільової підсистеми
Адміністратор реєстру
Адміністратор реєстру
Підсистема управління
зовнішнім трафіком
Підсистема управління...
Операційна зона реєстру
Операційна зона реєстру
Підсистема адміністрування даних реєстру
Підсистема адміністрування даних реєстру
Вебінтерфейс
адміністрування даних
реєстру
Вебінтерфейс...
Утиліта первинного завантаження даних таблиць
Утиліта первинного завантаження даних таблиць
Сервіс адміністрування даних реєстру
Сервіс адміністрування даних реєстру

Підсистема управління реляційними базами даних

Підсистема управління реляційними базами даних
Підсистема розподіленого
зберігання даних
Підсистема розподіленого...
Кошик тимчасового зберігання первинних даних
(initial-data-load-raw)
Кошик тимчасового зберігання первинних даних...
Кошик архівного зберігання завантажених даних
(initial-data-load-archive)
Кошик архівного зберігання завантажених даних...
Кошик зберігання цифрових документів реєстру
(file-ceph-bucket)
Кошик зберігання цифрових документів реєстру...

Утиліта завантаження надавачів послуг

Утиліта завантаження надавачів послуг
Підсистема управління користувачами та ролями
Підсистема управління користувачами та ролями
1
1
1
1
1
1
1
1
Вебінтерфейс перегляду даних реєстру
Вебінтерфейс перегляду даних реєструText is not SVG - cannot display \ No newline at end of file diff --git a/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/initial-load/load-phase.svg b/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/initial-load/load-phase.svg new file mode 100644 index 0000000000..366734d494 --- /dev/null +++ b/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/initial-load/load-phase.svg @@ -0,0 +1,4 @@ + + + +
Legacy DB
Legacy DB
dbtools
dbtools
Завантаження сирих даних
Завантаження сирих даних
Експорт даних з source  реєстру
Експорт даних з source  реєстру
dev schema
dev schema
pgAdmin
pgAdmin


*.pdf
*.png
...

*.pdf...

*.csv

*.csv

*.csv

*.csv
Операційна БД
Операційна БД
Трансформація даних
Трансформація даних
sandbox
sandbox
SQL Scripts
SQL Scripts
pgAdmin
pgAdmin
Операційна БД
Операційна БД
registry schema
registry s...
Експорт даних 
Експорт даних 
sandbox
sandbox
pgAdmin
pgAdmin
Операційна БД
Операційна БД
registry schema
registry s...
dbeaver
dbeaver
pgAdmin
pgAdmin
Завантаження в цільовий реєстр
Завантаження в цільовий реєстр
Actor
Actor
завантаження 
файлів
завантаження...
Підсистема адміністрування даних реєстру
Підсистема адміністрування даних реєстру
Операційна БД
Операційна БД
registry schema
registry s...

*.csv

*.csv


*.pdf
*.png
...

*.pdf...

*.csv

*.csv
init load 
init load 
Утиліта первинного завантаження сутностей в таблиці
Утиліта первинного завантаження сутностей в таблиці
Вивантаження даних
Вивантаження даних
Підготовка даних
Підготовка даних
Завантаження даних
Завантаження даних
file bucket
file bucket
Text
TextText is not SVG - cannot display \ No newline at end of file diff --git a/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/initial-load/scatch.png b/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/initial-load/scatch.png new file mode 100644 index 0000000000..90ee39441d Binary files /dev/null and b/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/initial-load/scatch.png differ diff --git a/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/localization/localization_admin_portal.svg b/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/localization/localization_admin_portal.svg new file mode 100644 index 0000000000..79a9f58ec2 --- /dev/null +++ b/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/localization/localization_admin_portal.svg @@ -0,0 +1,4 @@ + + + +
updates ENV var "LANGUAGE"
updates ENV var "LANGUAGE"
updates "environment.js" Config Map
updates "environment.js" Config Map
:registry/deploy-templates/values.yaml
:registry/deploy-templates/values.yaml
registry-regulation-management
registry-regulation-...
changes Registry language
changes Registry language
Registry admin
Regis...
updates
updates
control-plane-console
control-plane-console
admin portal (common-web-app)
admin portal (common...Text is not SVG - cannot display diff --git a/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/localization/localization_platform.svg b/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/localization/localization_platform.svg new file mode 100644 index 0000000000..b11fefb769 --- /dev/null +++ b/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/localization/localization_platform.svg @@ -0,0 +1,4 @@ + + + +
updates ENV var "language"
updates ENV var "language"
cluster-mgmt/deploy-templates/values.yaml
cluster-mgmt/deploy-templates/values.yaml
uses ENV var directly
uses ENV var directly
Text
Text
pass "language" as template var
pass "language" as template var
control-plane-console
control-plane-console
changes Platform language
changes Platform language
Platform admin
Platf...
go backend & template
go backend & template
vue frontend
vue frontend
updates
updates
control-plane-console
control-plane-consoleText is not SVG - cannot display diff --git a/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/localization/localization_user_portals.svg b/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/localization/localization_user_portals.svg new file mode 100644 index 0000000000..cea3f15ef0 --- /dev/null +++ b/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/localization/localization_user_portals.svg @@ -0,0 +1,4 @@ + + + +
updates ENV var "LANGUAGE"
updates ENV var "LANGUAGE"
updates "environment.js" Config Map
updates "environment.js" Config Map
:registry/deploy-templates/values.yaml
:registry/deploy-templates/values.yaml
services
services
changes Registry language
changes Registry language
Registry admin
Regis...
updates
updates
control-plane-console
control-plane-console
citizen & officer portals (common-web-app)
citizen & officer por...Text is not SVG - cannot display \ No newline at end of file diff --git a/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/localization/platform_locale_edit.png b/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/localization/platform_locale_edit.png new file mode 100644 index 0000000000..30020e0fc3 Binary files /dev/null and b/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/localization/platform_locale_edit.png differ diff --git a/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/localization/platform_locale_view.png b/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/localization/platform_locale_view.png new file mode 100644 index 0000000000..48e1dd8fdd Binary files /dev/null and b/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/localization/platform_locale_view.png differ diff --git a/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/localization/registry_locale_edit.png b/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/localization/registry_locale_edit.png new file mode 100644 index 0000000000..3731ab1979 Binary files /dev/null and b/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/localization/registry_locale_edit.png differ diff --git a/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/localization/registry_locale_view.png b/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/localization/registry_locale_view.png new file mode 100644 index 0000000000..f458ecb092 Binary files /dev/null and b/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/localization/registry_locale_view.png differ diff --git a/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/logo/logo_platform.svg b/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/logo/logo_platform.svg new file mode 100644 index 0000000000..0d60b12f18 --- /dev/null +++ b/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/logo/logo_platform.svg @@ -0,0 +1,4 @@ + + + +
updates ENV var "platformName"
updates ENV var "platformName"
save logos base64
save logos base64
cluster-mgmt/deploy-templates/values.yaml
  • platformName
  • logos ConfigMap path
cluster-mgmt/deploy-templates/values.yaml...
use logos & name
use logos & name
control-plane-console
control-plane-console
changes Platform logos & name
changes Platform logos & name
Platform admin
Platf...
frontend
frontend
updates
updates
control-plane-console
control-plane-console
get as base64
get as base64
ConfigMap
cluster-mgmt/deploy-templates/platform-logos
ConfigMap...Text is not SVG - cannot display \ No newline at end of file diff --git a/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/logo/logo_registry.svg b/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/logo/logo_registry.svg new file mode 100644 index 0000000000..206d1088b1 --- /dev/null +++ b/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/logo/logo_registry.svg @@ -0,0 +1,4 @@ + + + +
save logos base64
save logos base64
portals (officer, citizen, admin)
portals (officer, ci...
changes Platform logos & name
changes Platform logos & name
Platform admin
Platf...
control-plane-console
control-plane-console
get as base64 file
get as base64 file
ConfigMap platform-logos
ConfigMap platform-logosText is not SVG - cannot display \ No newline at end of file diff --git a/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/logo/platform_logo.png b/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/logo/platform_logo.png new file mode 100644 index 0000000000..213e0ea0e2 Binary files /dev/null and b/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/logo/platform_logo.png differ diff --git a/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/optional-registry-nexus/as-is-nexus.drawio.svg b/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/optional-registry-nexus/as-is-nexus.drawio.svg new file mode 100644 index 0000000000..795d1a8b40 --- /dev/null +++ b/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/optional-registry-nexus/as-is-nexus.drawio.svg @@ -0,0 +1,4 @@ + + + +
Сервіс розгортання
Платформної
конфігурації
(jenkins)
Сервіс розгортання...
Підсистема розгортання та налаштування  Платформи та реєстрів
Підсистема розгортання та налаштування  Платформи та реєстрів
Jenkins агент
(infrastructure-jenkins-agent)
Jenkins агент...
Делегування 
задач
Делегування...
Сховище артефактів реєстру (nexus)
Сховище артефактів реєстру (nexus)
Підсистема розгортання регламенту реєстру
Підсистема розгортання регламенту реєстру
Розгортання та налаштування
 компонентів підсистем реєстру
Розгортання та налаштування...
Збереження артефактів
для сервісів доступу
до даних реєстру
Збереження артефактів...
Агент розгортання
 регламенту
(dataplatform-jenkins-agent)
Агент розгортання...
Делегування задач
Делегування задач
Сервіс розгортання
 регламенту
(jenkins)
Сервіс розгортання...Text is not SVG - cannot display \ No newline at end of file diff --git a/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/optional-registry-nexus/mockup-1.png b/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/optional-registry-nexus/mockup-1.png new file mode 100644 index 0000000000..2e933fe1b6 Binary files /dev/null and b/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/optional-registry-nexus/mockup-1.png differ diff --git a/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/optional-registry-nexus/mockup-2.png b/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/optional-registry-nexus/mockup-2.png new file mode 100644 index 0000000000..7808407400 Binary files /dev/null and b/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/optional-registry-nexus/mockup-2.png differ diff --git a/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/optional-registry-nexus/to-be-nexus.drawio.svg b/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/optional-registry-nexus/to-be-nexus.drawio.svg new file mode 100644 index 0000000000..f2741506e5 --- /dev/null +++ b/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/optional-registry-nexus/to-be-nexus.drawio.svg @@ -0,0 +1,4 @@ + + + +
Сервіс розгортання
Платформної
конфігурації
(jenkins)
Сервіс розгортання...
Підсистема розгортання та налаштування  Платформи та реєстрів
Підсистема розгортання та налаштування  Платформи та реєстрів
Jenkins агент
(infrastructure-jenkins-agent)
Jenkins агент...
Делегування 
задач
Делегування...
Сховище артефактів реєстру (nexus)
Сховище артефактів реєстру (nexus)
Підсистема розгортання регламенту реєстру
Підсистема розгортання регламенту реєстру
Розгортання та налаштування
 компонентів підсистем реєстру
Розгортання та налаштування...
[ALTERNATIVE]
Збереження артефактів
для сервісів доступу
до даних реєстру
[ALTERNATIVE]...
[ALTERNATIVE]
Збереження артефактів
для сервісів доступу
до даних реєстру
[ALTERNATIVE]...
Агент розгортання
 регламенту
(dataplatform-jenkins-agent)
Агент розгортання...
Делегування задач
Делегування задач
Сервіс розгортання
 регламенту
(jenkins)
Сервіс розгортання...
Сховище артефактів Платформи (nexus)
Сховище артефактів Платформи (nexus)
Розгортання/
налаштування
Розгортання/...
Nexus Оператор
(nexus)
Nexus Оператор...Text is not SVG - cannot display \ No newline at end of file diff --git a/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/typical-registry-configuration/mockup1.png b/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/typical-registry-configuration/mockup1.png new file mode 100644 index 0000000000..108001dc78 Binary files /dev/null and b/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/typical-registry-configuration/mockup1.png differ diff --git a/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/universal-installer/authentication.png b/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/universal-installer/authentication.png new file mode 100644 index 0000000000..5f8be9520c Binary files /dev/null and b/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/universal-installer/authentication.png differ diff --git a/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/universal-installer/self-registration.png b/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/universal-installer/self-registration.png new file mode 100644 index 0000000000..ecda130ce8 Binary files /dev/null and b/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/universal-installer/self-registration.png differ diff --git a/docs/ua/modules/arch/images/architecture-workspace/security/ssdlc/proxy-mode-portals.png b/docs/ua/modules/arch/images/architecture-workspace/security/ssdlc/proxy-mode-portals.png new file mode 100644 index 0000000000..8c7da67a1e Binary files /dev/null and b/docs/ua/modules/arch/images/architecture-workspace/security/ssdlc/proxy-mode-portals.png differ diff --git a/docs/ua/modules/arch/images/architecture/container-platform/container-orchestration.svg b/docs/ua/modules/arch/images/architecture/container-platform/container-orchestration.svg index d92ccb363e..c41987be85 100644 --- a/docs/ua/modules/arch/images/architecture/container-platform/container-orchestration.svg +++ b/docs/ua/modules/arch/images/architecture/container-platform/container-orchestration.svg @@ -1,4 +1,4 @@ -
мережа інтернет
мережа інтернет
приватна мережа
приватна мережа
мастер
віртуальні машини
мастер віртуальні машини
платформні 
віртуальні машини
платформні...
Реєстри
Реєстри
Центральні компоненти Платформи
Центральні компоненти Платформи
kube-proxy
kube-proxy
kubelet
kubelet
API сервер
API сервер
etcd
etcd
ctrl manager
ctrl manag...
scheduler
scheduler
kube-proxy
kube-proxy
kubelet
kubelet
kube-proxy
kube-proxy
kubelet
kubelet
системні оператори
системні оператори
системні оператори
системні оператори
OVNKubernetes
OVNKubernetes
cloud ctrl manager
cloud ctrl...
VPC
VPC
публічна мережа
публічна мережа
NAT шлюз
NAT шлюз
реєстрові 
віртуальні машини
реєстрові...
інфраструктурні
віртуальні машини
інфраструктурні...
load balancer
load ba...
load balancer
load ba...
Адміністратори
інфраструктури
Адміністратори...
Службові
адміністратори
Службові...
Користувачі
реєстру
Користувачі реєстру
Реєстри
Реєстри
Реєстри
РеєстриText is not SVG - cannot display \ No newline at end of file +
мережа інтернет
мережа інтернет
приватна мережа
приватна мережа
мастер
віртуальні машини
мастер віртуальні машини
платформні 
віртуальні машини
платформні...
Реєстри
Реєстри
Центральні компоненти Платформи
Центральні компоненти Платформи
kube-proxy
kube-proxy
kubelet
kubelet
API сервер
API сервер
etcd
etcd
ctrl manager
ctrl manag...
scheduler
scheduler
kube-proxy
kube-proxy
kubelet
kubelet
kube-proxy
kube-proxy
kubelet
kubelet
системні оператори
системні оператори
системні оператори
системні оператори
OVNKubernetes
OVNKubernetes
cloud ctrl manager
cloud ctrl...
VPC
VPC
публічна мережа
публічна мережа
NAT-шлюз
NAT-шлюз
реєстрові 
віртуальні машини
реєстрові...
інфраструктурні
віртуальні машини
інфраструктурні...
load balancer
load ba...
load balancer
load ba...
Адміністратори
інфраструктури
Адміністратори...
Службові
адміністратори
Службові...
Користувачі
реєстру
Користувачі реєстру
Реєстри
Реєстри
Реєстри
РеєстриText is not SVG - cannot display \ No newline at end of file diff --git a/docs/ua/modules/arch/images/architecture/platform/administrative/config-management/config-mgmt.drawio.svg b/docs/ua/modules/arch/images/architecture/platform/administrative/config-management/config-mgmt.drawio.svg index f24e4c7e25..cfe2400c8f 100644 --- a/docs/ua/modules/arch/images/architecture/platform/administrative/config-management/config-mgmt.drawio.svg +++ b/docs/ua/modules/arch/images/architecture/platform/administrative/config-management/config-mgmt.drawio.svg @@ -1,4 +1,4 @@ -
Адміністративна зона Платформи
Адміністративна зона Платформи
Підсистема розгортання
та налаштування
 Платформи та реєстрів
Підсистема розгортання...
Отримання
секретів
Отримання секретів
Розгортання
Розгортання
Доступ до API,
керування станом
 ресурсів
Доступ до API,...
Сервіс розгортання
конфігурації
(jenkins)
Сервіс розгортання...
Розгортання,
налаштування та
підтримка
Розгортання,...
Jenkins-оператор
(jenkins-operator)
Jenkins-оператор...
Сховище артефактів Платформи
(nexus)
Сховище артефактів Платформи...
Розгортання,
налаштування та
підтримка
Розгортання,...
Nexus-оператор
(nexus-operator)
Nexus-оператор...
Налаштування
EDP абстракцій
Налаштування...
Codebase-оператор
(codebase-operator)
Codebase-оператор...
Підсистема управління
секретами та шифруванням
Підсистема управління...
Платформа оркестрації контейнерів 
Платформа оркестрації контейнерів 
Службові
адміністратори
Службові...
Міжсервісна взаємодія
Міжсервісна взаємодія
Підсистема Платформи
Підсистема Платформи
Цільовий компонент підсистеми
Цільовий компонент підсистеми
Підсистема управління Платформою та реєстрами
Підсистема управління Платформою та реєстрами
Сервіс інспекції та зберігання
змін конфігурації
(gerrit)
Сервіс інспекції та зберігання...
Отримання
конфігурації
Отримання...
Налаштування EDP
абстракцій
Налаштування EDP...
Підсистема управління
зовнішнім трафіком
Платформи
Підсистема управління...
Доступ до
веб-інтерфейсу
Доступ до...
Доступ до
веб-інтерфейсу
Доступ до...
Підсистема реєстру
Підсистема реєстру
Підсистеми Платформи
Підсистеми Платформи
Підсистеми Платформи
Підсистеми Платформи
Підсистеми Платформи
Підсистеми Платформи
Підсистеми реєстру
Підсистеми реєстру
Підсистеми реєстру
Підсистеми реєстру
Підсистеми реєстру
Підсистеми реєстру
Налаштування
Налаштування
Компонент реєстрової
конфігурації
(registry-configuration)
Компонент реєстрової...Text is not SVG - cannot display \ No newline at end of file +
Адміністративна зона Платформи
Адміністративна зона Платформи
Підсистема розгортання
та налаштування
 Платформи та реєстрів
Підсистема розгортання...
Отримання
секретів
Отримання секретів
Розгортання
Розгортання
Сервіс розгортання
конфігурації
(jenkins)
Сервіс розгортання...
Розгортання,
налаштування та
підтримка
Розгортання,...
Jenkins-оператор
(jenkins-operator)
Jenkins-оператор...
Сховище артефактів Платформи
(nexus)
Сховище артефактів Платформи...
Розгортання,
налаштування та
підтримка
Розгортання,...
Nexus-оператор
(nexus-operator)
Nexus-оператор...
Налаштування
EDP абстракцій
Налаштування...
Codebase-оператор
(codebase-operator)
Codebase-оператор...
Підсистема управління
секретами та шифруванням
Підсистема управління...
Платформа оркестрації контейнерів 
Платформа оркестрації контейнерів 
Службові
адміністратори
Службові...
Міжсервісна взаємодія
Міжсервісна взаємодія
Підсистема Платформи
Підсистема Платформи
Цільовий компонент підсистеми
Цільовий компонент підсистеми
Підсистема управління Платформою та реєстрами
Підсистема управління Платформою та реєстрами
Сервіс інспекції та зберігання
змін конфігурації
(gerrit)
Сервіс інспекції та зберігання...
Отримання
конфігурації
Отримання...
Налаштування EDP
абстракцій
Налаштування EDP...
Підсистема управління
зовнішнім трафіком
Платформи
Підсистема управління...
Доступ до
веб-інтерфейсу
Доступ до...
Доступ до
веб-інтерфейсу
Доступ до...
Підсистема реєстру
Підсистема реєстру
Підсистеми Платформи
Підсистеми Платформи
Підсистеми Платформи
Підсистеми Платформи
Підсистеми Платформи
Підсистеми Платформи
Підсистеми реєстру
Підсистеми реєстру
Підсистеми реєстру
Підсистеми реєстру
Підсистеми реєстру
Підсистеми реєстру
Налаштування
Налаштування
Компонент реєстрової
конфігурації
(registry-configuration)
Компонент реєстрової...
Jenkins агент
(infrastructure-jenkins-agent)
Jenkins агент...
Делегування 
задач
Делегування...
Доступ до API,
керування станом
 ресурсів
Доступ до API,...Text is not SVG - cannot display \ No newline at end of file diff --git a/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/documentation-variables/demo_default.png b/docs/ua/modules/arch/images/architecture/platform/administrative/control-plane/documentation-variables/demo_default.png similarity index 100% rename from docs/ua/modules/arch/images/architecture-workspace/platform-evolution/documentation-variables/demo_default.png rename to docs/ua/modules/arch/images/architecture/platform/administrative/control-plane/documentation-variables/demo_default.png diff --git a/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/documentation-variables/demo_missing.png b/docs/ua/modules/arch/images/architecture/platform/administrative/control-plane/documentation-variables/demo_missing.png similarity index 100% rename from docs/ua/modules/arch/images/architecture-workspace/platform-evolution/documentation-variables/demo_missing.png rename to docs/ua/modules/arch/images/architecture/platform/administrative/control-plane/documentation-variables/demo_missing.png diff --git a/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/individual-officer-access/control-plane-officer-individual-access-control.png b/docs/ua/modules/arch/images/architecture/platform/administrative/control-plane/individual-officer-access/control-plane-officer-individual-access-control.png similarity index 100% rename from docs/ua/modules/arch/images/architecture-workspace/platform-evolution/individual-officer-access/control-plane-officer-individual-access-control.png rename to docs/ua/modules/arch/images/architecture/platform/administrative/control-plane/individual-officer-access/control-plane-officer-individual-access-control.png diff --git a/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/individual-officer-access/individual-officer-auth.svg b/docs/ua/modules/arch/images/architecture/platform/administrative/control-plane/individual-officer-access/individual-officer-auth.svg similarity index 100% rename from docs/ua/modules/arch/images/architecture-workspace/platform-evolution/individual-officer-access/individual-officer-auth.svg rename to docs/ua/modules/arch/images/architecture/platform/administrative/control-plane/individual-officer-access/individual-officer-auth.svg diff --git a/docs/ua/modules/arch/images/architecture-workspace/platform-evolution/individual-officer-access/individual-officer-signature-validation.svg b/docs/ua/modules/arch/images/architecture/platform/administrative/control-plane/individual-officer-access/individual-officer-signature-validation.svg similarity index 100% rename from docs/ua/modules/arch/images/architecture-workspace/platform-evolution/individual-officer-access/individual-officer-signature-validation.svg rename to docs/ua/modules/arch/images/architecture/platform/administrative/control-plane/individual-officer-access/individual-officer-signature-validation.svg diff --git a/docs/ua/modules/arch/images/architecture/platform/operational/distributed-data-storage/distributed-data-storage.drawio.svg b/docs/ua/modules/arch/images/architecture/platform/operational/distributed-data-storage/distributed-data-storage.drawio.svg index 7e7ea9e2af..cba6015c59 100644 --- a/docs/ua/modules/arch/images/architecture/platform/operational/distributed-data-storage/distributed-data-storage.drawio.svg +++ b/docs/ua/modules/arch/images/architecture/platform/operational/distributed-data-storage/distributed-data-storage.drawio.svg @@ -1,4 +1,4 @@ -
Міжсервісна взаємодія
Міжсервісна взаємодія
Підсистема Платформи
Підсистема Платформи
Компонент
цільової підсистеми
Компонент...
Підсистема управління
зовнішнім трафіком
Платформи
Підсистема управління...
Службові
адміністратори
Службові...
Підсистеми реєстру
Підсистеми реєстру
Підсистеми
реєстру
Підсистеми...
Компоненти що керуються Rook Ceph оператором
Компоненти що керуються Rook Ceph оператором
Ceph Object Gateway 
(rook-ceph-rgw)
Ceph Object Gateway...
Ceph Monitor 
(rook-ceph-mon)
Ceph Monitor...
Ceph Metadata Server 
(rook-ceph-mds)
Ceph Metadata Server...
Перегляд стану ceph кластера через
дашборд
Перегляд стану ceph кластера через...
OpenShift Container Storage Operator 
(ocs-operator)
OpenShift Container Storage...
Платформа оркестрації контейнерів 
Платформа оркестрації контейнерів 
Rook Ceph Operator 
(rook-ceph-operator)
Rook Ceph Operator...
Ceph-CSI Driver 
(csi-cephfsplugin-provisioner)
Ceph-CSI Driver...
Ceph-CSI Driver 
(csi-rbdplugin-provisioner)
Ceph-CSI Driver...
Rook Ceph Crash Collector 
(rook-ceph-crashcollector)
Rook Ceph Crash Collector...
Підсистема розподіленого зберігання даних
Підсистема розподіленого зберігання даних
Операційна зона
Операційна зона
Ceph Manager 
(rook-ceph-mgr)
Ceph Manager...
Конфігурація/
оновлення мап кластера
Конфігурація/...
Генерація OSD мапи кластеру/
Моніторинг стану кластера
Генерація OSD мапи кластеру/...
Підсистема моніторингу подій та сповіщення
Підсистема моніторингу подій та сповіщення
Отримання
метрик
Отримання метрик
Збирання інформації 
про збої Ceph кластера
Збирання інформації...
Збирання інформації 
про збої Ceph кластера
Збирання інформації...
Керування даними та інфраструктурними дисками
Керування даними та інфраструктурними дисками
Інфраструктура як Сервіс
Інфраструктура як Сервіс
Створення та керування дисками
Створення та керування дисками
Генерація та керування
MDS мапою
Генерація та керування...
Керування метаданими
cephFS
Керування метаданими...
Збереження / 
отримання даних
Збереження /...
Отриманная поточного
стану ceph кластера
Отриманная поточного...
Зберігання /
отримання даних
Зберігання /...
Розгортання та керування
ceph компонентами на основі 
StorageCluster ресурса
Розгортання та керування...
Ceph Object Storage Device (rook-ceph-osd-1...n)
Ceph Object Storage Device (...
Керування OCSInitialization та
StorageCluster ресурсами
Керування OCSInitialization та...
Телеметрія
Телеметрія
Створення та керування 
дисками
Створення та керування...
Створення та керування дисками
Створення та керування дисками
Операції з блочним
сховищем
Операції з блочним...
Отримання інформації
про кластер ceph
Отримання інформації...
Операції з cephFS
Операції з cephFS
S3 Endpoint
S3 Endpoint
OCS Metrics 
Exporter 
(ocs-metrics-exporter)
OCS Metrics...
Збирання метрик
Збирання метрик
Збирання метрик
Збирання метрик
Компоненти що керуються OCS оператором
Компоненти що керуються OCS операторомText is not SVG - cannot display \ No newline at end of file +
Міжсервісна взаємодія
Міжсервісна взаємодія
Підсистема Платформи
Підсистема Платформи
Компонент
цільової підсистеми
Компонент...
Підсистема управління
зовнішнім трафіком
Платформи
Підсистема управління...
Службові
адміністратори
Службові...
Підсистеми реєстру
Підсистеми реєстру
Підсистеми
реєстру
Підсистеми...
Компоненти що керуються Rook Ceph оператором
Компоненти що керуються Rook Ceph оператором
Ceph Object Gateway 
(rook-ceph-rgw)
Ceph Object Gateway...
Ceph Monitor 
(rook-ceph-mon)
Ceph Monitor...
Ceph Metadata Server 
(rook-ceph-mds)
Ceph Metadata Server...
Перегляд стану ceph кластера через
дашборд
Перегляд стану ceph кластера через...
OpenShift Container Storage Operator 
(ocs-operator)
OpenShift Container Storage...
Платформа оркестрації контейнерів 
Платформа оркестрації контейнерів 
Rook Ceph Operator 
(rook-ceph-operator)
Rook Ceph Operator...
Ceph-CSI Driver 
(csi-cephfsplugin-provisioner)
Ceph-CSI Driver...
Ceph-CSI Driver 
(csi-rbdplugin-provisioner)
Ceph-CSI Driver...
Rook Ceph Crash Collector 
(rook-ceph-crashcollector)
Rook Ceph Crash Collector...
Підсистема розподіленого зберігання даних
Підсистема розподіленого зберігання даних
Операційна зона
Операційна зона
Ceph Manager 
(rook-ceph-mgr)
Ceph Manager...
Конфігурація/
оновлення мап кластера
Конфігурація/...
Генерація OSD мапи кластеру/
Моніторинг стану кластера
Генерація OSD мапи кластеру/...
Підсистема моніторингу подій та сповіщення
Підсистема моніторингу подій та сповіщення
Отримання
метрик
Отримання метрик
Збирання інформації 
про збої Ceph кластера
Збирання інформації...
Збирання інформації 
про збої Ceph кластера
Збирання інформації...
Керування даними та
інфраструктурними дисками
Керування даними та...
Інфраструктура як Сервіс
Інфраструктура як Сервіс
Створення та керування дисками
Створення та керування дисками
Генерація та керування
MDS мапою
Генерація та керування...
Керування метаданими
cephFS
Керування метаданими...
Збереження / 
отримання даних
Збереження /...
Отриманная поточного
стану ceph кластера
Отриманная поточного...
Зберігання /
отримання даних
Зберігання /...
Розгортання та керування
ceph компонентами на основі 
ресурсу StorageCluster
Розгортання та керування...
Ceph Object Storage Device (rook-ceph-osd-1...n)
Ceph Object Storage Device (...
Керування OCSInitialization та
StorageCluster ресурсами
Керування OCSInitialization та...
Телеметрія
Телеметрія
Створення та керування 
дисками
Створення та керування...
Створення та керування дисками
Створення та керування дисками
Операції з блочним
сховищем
Операції з блочним...
Отримання інформації
про кластер ceph
Отримання інформації...
Операції з cephFS
Операції з cephFS
S3 Endpoint
S3 Endpoint
OCS Metrics 
Exporter 
(ocs-metrics-exporter)
OCS Metrics...
Збирання метрик
Збирання метрик
Збирання метрик
Збирання метрик
Компоненти що керуються OCS оператором
Компоненти що керуються OCS оператором
NooBaa Operator 
(noobaa-operator)
NooBaa Operator...
Керування BackingStore
Керування BackingStore
NooBaa Endpoint 
(noobaa-endpoint)
NooBaa Endpoint...
Розгортання та 
налаштування
Розгортання та...
NooBaa Core 
(noobaa-core)
NooBaa Core...
NooBaa Database 
(noobaa-db-pg)
NooBaa Database...
Розгортання та 
налаштування
Розгортання та...
Зберігання метадати про обʼєкти
Зберігання метадати про обʼєкти
Керування доступом до даних
Керування доступом до данихText is not SVG - cannot display \ No newline at end of file diff --git a/docs/ua/modules/arch/images/architecture/platform/operational/secret-management/secret-management.drawio.svg b/docs/ua/modules/arch/images/architecture/platform/operational/secret-management/secret-management.drawio.svg index 20434a7a6a..637718fbb0 100644 --- a/docs/ua/modules/arch/images/architecture/platform/operational/secret-management/secret-management.drawio.svg +++ b/docs/ua/modules/arch/images/architecture/platform/operational/secret-management/secret-management.drawio.svg @@ -1,4 +1,4 @@ -
Операційна зона Платформи
Операційна зона Платформи
Підсистема управління секретами та шифруванням
Підсистема управління секретами та шифруванням
Підсистема управління
зовнішнім трафіком
Платформи
Підсистема управління...
Службові
адміністратори
Службові...
Міжсервісна взаємодія
Міжсервісна взаємодія
Підсистема Платформи
Підсистема Платформи
Сервіс управління
  секретами та шифруванням 
(hashicorp-vault)
Сервіс управління...
Збереження
секретів
Збереження...
Підсистема управління Платформою та Реєстрами
Підсистема управління Платформою та Реєстрами
Компонент цільової підсистеми
Компонент цільової підсистеми
Отримання
секретів
Отримання...
Підсистема розгортання
змін налаштувань
Платформи та Реєстрів
Підсистема розгортання...
Центр. сервіс управління
секретами Платформи
(hashicorp-vault)
Центр. сервіс управління...
Компонент Платформи
Компонент Платформи
Операція Auto-unseal у
Transit Secret Engine
Операція Auto-unseal у...Text is not SVG - cannot display \ No newline at end of file +
Операційна зона Платформи
Операційна зона Платформи
Підсистема управління секретами та шифруванням
Підсистема управління секретами та шифруванням
Підсистема управління
зовнішнім трафіком
Платформи
Підсистема управління...
Службові
адміністратори
Службові...
Міжсервісна взаємодія
Міжсервісна взаємодія
Підсистема Платформи
Підсистема Платформи
Сервіс управління
  секретами та шифруванням 
(hashicorp-vault)
Сервіс управління...
Збереження
секретів
Збереження...
Підсистема управління Платформою та Реєстрами
Підсистема управління Платформою та Реєстрами
Компонент цільової підсистеми
Компонент цільової підсистеми
Отримання
секретів
Отримання...
Підсистема розгортання
змін налаштувань
Платформи та Реєстрів
Підсистема розгортання...
Центр. сервіс управління
секретами Платформи
(hashicorp-vault)
Центр. сервіс управління...
Компонент Платформи
Компонент Платформи
Операція Auto-unseal у
Transit Secret Engine
Операція Auto-unseal у...
Випуск керування життєвим
циклом сертифікатів 
Випуск керування життєвим...
Сервіс управління
сертифікатами та
видавцями (cert-manager)
Сервіс управління...
Підсистема трасування запитів
Підсистема трасування запитівText is not SVG - cannot display \ No newline at end of file diff --git a/docs/ua/modules/arch/images/architecture/platform/operational/user-management/user-management.drawio.svg b/docs/ua/modules/arch/images/architecture/platform/operational/user-management/user-management.drawio.svg index 62000ea99d..d253eb13b1 100644 --- a/docs/ua/modules/arch/images/architecture/platform/operational/user-management/user-management.drawio.svg +++ b/docs/ua/modules/arch/images/architecture/platform/operational/user-management/user-management.drawio.svg @@ -1,4 +1,4 @@ -
отримання мітки часу та 
сертифікату АЦСК
отримання мітки часу та...
перевірка
субʼєкту ЄДР
перевірка...
Сервіс цифрових підписів
(digital-signature-ops)
Сервіс цифрових підписів...
Розгортання та
налаштування
Розгортання та...
Keycloak оператор
(keycloak-operator)
Keycloak оператор...
аутентифікація
користувачів
аутентифікація користувачів
отримання конфігурації,
синхронізація груп,
ролей та користувачів
отримання конфігурації,...
OpenShift OAuth
(oauth-openshift)
OpenShift OAuth...
передача публічного сертифіката та
отримання зашифрованих даних користувача
передача публічного сертифіката та...
Сервіс управління користувачами
 та ролями (keycloak)
Сервіс управління користувачами...
отримання даних
підпису накладеного при логіні /
дешифрування даних з id.gov.ua 
отримання даних...
Налаштування
груп та користувачів
Налаштування груп та користувачів
Оператор синхронізації
користувацьких груп
(group-sync-operator)
Оператор синхронізації...
Програмно-апаратний криптомодуль "Гряда"
Програмно-апаратний криптомодуль "Гряда"
отримання публічного сертифікату
апаратного ключа/виконання криптооперацій 
отримання публічного сертифікату...
Сервіс цифрової ідентифікації
(id.gov.ua)
Сервіс цифрової ідентифікації...
Акредитований Центр
Сертифікації Ключів
(АЦСК)
Акредитований Центр...
Підсистема управління зовнішнім трафіком Платформи
Підсистема управління зовнішнім трафіком Платформи
Платформа оркестрації контейнерів 
Платформа оркестрації контейнерів 
Отримувачі
послуг
Отримувачі...
Надавачі
послуг
Надавачі...
Службові
адміністратори
Службові адміністратори
Міжсервісна взаємодія
Міжсервісна взаємодія
Підсистема Платформи
Підсистема Платформи
Компонент Платформи
Компонент Платформи
Зовнішні системи
Зовнішні системи
Компонент
цільової підсистеми
Компонент...
Підсистема управління користувачами та ролями
Підсистема управління користувачами та ролями
Операційна база даних
(keycloak-postgresql)
Операційна база даних...
Шина безпечного обміну
"Трембіта"
Шина безпечного обміну...Text is not SVG - cannot display \ No newline at end of file +
отримання мітки часу та 
сертифікату АЦСК
отримання мітки часу та...
перевірка
субʼєкту ЄДР
перевірка...
Сервіс цифрових підписів
(digital-signature-ops)
Сервіс цифрових підписів...
Розгортання та
налаштування
Розгортання та...
Keycloak оператор
(keycloak-operator)
Keycloak оператор...
аутентифікація
користувачів
аутентифікація користувачів
отримання конфігурації,
синхронізація груп,
ролей та користувачів
отримання конфігурації,...
OpenShift OAuth
(oauth-openshift)
OpenShift OAuth...
передача публічного сертифіката та
отримання зашифрованих даних користувача
передача публічного сертифіката та...
Збереження операційних даних
Збереження операційних даних
Сервіс управління користувачами
 та ролями (keycloak)
Сервіс управління користувачами...
отримання даних
підпису накладеного при логіні /
дешифрування даних з id.gov.ua 
отримання даних...
Налаштування
груп та користувачів
Налаштування груп та користувачів
Оператор синхронізації
користувацьких груп
(group-sync-operator)
Оператор синхронізації...
Програмно-апаратний криптомодуль "Гряда"
Програмно-апаратний криптомодуль "Гряда"
отримання публічного сертифікату
апаратного ключа/виконання криптооперацій 
отримання публічного сертифікату...
Сервіс цифрової ідентифікації
(id.gov.ua)
Сервіс цифрової ідентифікації...
Акредитований Центр
Сертифікації Ключів
(АЦСК)
Акредитований Центр...
Підсистема управління зовнішнім трафіком Платформи
Підсистема управління зовнішнім трафіком Платформи
Платформа оркестрації контейнерів 
Платформа оркестрації контейнерів 
Отримувачі
послуг
Отримувачі...
Надавачі
послуг
Надавачі...
Службові
адміністратори
Службові адміністратори
Міжсервісна взаємодія
Міжсервісна взаємодія
Підсистема Платформи
Підсистема Платформи
Компонент Платформи
Компонент Платформи
Зовнішні системи
Зовнішні системи
Компонент
цільової підсистеми
Компонент...
Підсистема управління користувачами та ролями
Підсистема управління користувачами та ролями
Операційна база даних
(keycloak-postgresql)
Операційна база даних...
Шина безпечного обміну
"Трембіта"
Шина безпечного обміну...
PostgreSQL Server Exporter
(prometheus-postgres-exporter)
PostgreSQL Server Exporter...
Збір метрик
Збір метрикText is not SVG - cannot display \ No newline at end of file diff --git a/docs/ua/modules/arch/images/architecture/registry/administrative/regulation-management/registry-regulation/regulation-dependencies.svg b/docs/ua/modules/arch/images/architecture/registry/administrative/regulation-management/registry-regulation/regulation-dependencies.svg index e57fef7fdf..64048ec096 100644 --- a/docs/ua/modules/arch/images/architecture/registry/administrative/regulation-management/registry-regulation/regulation-dependencies.svg +++ b/docs/ua/modules/arch/images/architecture/registry/administrative/regulation-management/registry-regulation/regulation-dependencies.svg @@ -1,4 +1,4 @@ -
Бізнес-процеси
Бізнес-процеси
Інтеграції з зовнішніми системами
(bp-trembita)
Інтеграції з зовнішніми системами...
UI-форми бізнес-процесів
UI-форми бізнес-процесів
Шаблони витягів
Шаблони витягів
Права доступу до бізнес-процесів (bp-auth)
Права доступу до бізнес-процесів (bp-auth)
Ролі користувачів (roles)
Ролі користувачів (roles)
Шаблони інформаційних повідомлень
(notifications)
Шаблони інформаційних повідомлень...
Моделі
бізнес-правил
(dmn)
Моделі...
<uses>
<uses>
<uses>
<uses>
Доступ
надавачів послуг
(officer.yml)
Доступ...
Доступ
отримувачів послуг
(citizen.yml)
Доступ...
Доступ
зовнішніх систем
(external-system.yml)
Доступ...
PDF-шаблони
(excerpts)
PDF-шаблони...
CSV-шаблони
(excerpts-csv)
CSV-шаблони...
DOCX-шаблони
(excerpts-docx)
DOCX-шаблони...
<uses>
<uses>
Схеми UI-форм
(forms)
Схеми UI-форм...
Скрипти UI-форм
(form-scripts)
Скрипти UI-форм...
Inbox
повідомлення
(inbox)
Inbox...
Дія
push-нотифікації
(diia)
Дія...
Поштові повідомлення
(email)
Поштові повідомлення...
<uses>
<uses>
Групування
бізнес-процесів
(bp-grouping)
Групуваннябізнес-процесів...
<uses>
<uses>
<uses>
<uses>
<uses>
<uses>
<uses>
<uses>
<uses>
<uses>
Моделі
бізнес-процесів
(bpmn)
Моделі...
Налаштування інтеграцій з зовнішніми системами
(configuration.yml)
Налаштування інтеграцій з зовнішніми системами...
<uses>
<uses>
Налаштування
API бізнес-процесів
для зовнішніх систем
(external-system.yml)
Налаштування...
Шаблони
інформаційних панелей
(reports)
Шаблони...
Ролі
надавачів послуг
(officer.yml)
Ролінадавачів послуг...
Ролі
отримувачів послуг
(citizen.yml)
Роліотримувачів послуг...
Модель даних
(data-model)
Модель даних...
Фізична модель
бази даних
Фізична модель...
<uses>
<uses>
Специфікація API доступу до даних
Специфікація API доступу до даних
<uses>
<uses>
Права доступу
до даних
Права доступу...
<uses>
<uses>
<uses>
<uses>
<uses>
<uses>
<uses>
<uses>Text is not SVG - cannot display \ No newline at end of file +
Бізнес-процеси
Бізнес-процеси
Інтеграції з зовнішніми системами
(bp-trembita)
Інтеграції з зовнішніми системами...
UI-форми бізнес-процесів
UI-форми бізнес-процесів
Шаблони витягів
Шаблони витягів
Права доступу до бізнес-процесів
(bp-auth)
Права доступу до бізнес-процесів...
Ролі користувачів
(roles)
Ролі користувачів...
Шаблони інформаційних повідомлень
(notifications)
Шаблони інформаційних повідомлень...
Моделі
бізнес-правил
(dmn)
Моделі...
<uses>
<uses>
<uses>
<uses>
Доступ
надавачів послуг
(officer.yml)
Доступ...
Доступ
отримувачів послуг
(citizen.yml)
Доступ...
Доступ
зовнішніх систем
(external-system.yml)
Доступ...
PDF-шаблони
(excerpts)
PDF-шаблони...
CSV-шаблони
(excerpts-csv)
CSV-шаблони...
DOCX-шаблони
(excerpts-docx)
DOCX-шаблони...
<uses>
<uses>
Схеми UI-форм
(forms)
Схеми UI-форм...
Скрипти UI-форм
(form-scripts)
Скрипти UI-форм...
Inbox
повідомлення
(inbox)
Inbox...
Дія
push-нотифікації
(diia)
Дія...
Поштові повідомлення
(email)
Поштові повідомлення...
<uses>
<uses>
Групування
бізнес-процесів
(bp-grouping)
Групуваннябізнес-процесів...
<uses>
<uses>
<uses>
<uses>
<uses>
<uses>
<uses>
<uses>
<uses>
<uses>
<uses>
<uses>
Моделі
бізнес-процесів
(bpmn)
Моделі...
Налаштування інтеграцій з зовнішніми системами
(configuration.yml)
Налаштування інтеграцій з зовнішніми системами...
<uses>
<uses>
Налаштування
API бізнес-процесів
для зовнішніх систем
(external-system.yml)
Налаштування...
<uses>
<uses>
Шаблони
інформаційних панелей
(reports)
Шаблони...
Ролі
надавачів послуг
(officer.yml)
Ролінадавачів послуг...
Ролі
отримувачів послуг
(citizen.yml)
Роліотримувачів послуг...
Модель даних
(data-model)
Модель даних...
Фізична модель
бази даних
Фізична модель...
<uses>
<uses>
Специфікація API доступу до даних
Специфікація API доступу до даних
<uses>
<uses>
Права доступу
до даних
Права доступу...
<uses>
<uses>
<uses>
<uses>
<uses>
<uses>
<uses>
<uses>
1
1
<uses>
<uses>
1
1
High Impact
High Impact
Average Impact
Average Impact
Low Impact
Low Impact
Ролі
зовнішніх систем
(external-system.yml)
Ролізовнішніх систем...Text is not SVG - cannot display \ No newline at end of file diff --git a/docs/ua/modules/arch/images/architecture/registry/administrative/regulation-management/registry-regulation/regulation-structure.svg b/docs/ua/modules/arch/images/architecture/registry/administrative/regulation-management/registry-regulation/regulation-structure.svg index f9eb0aeedb..f288a925fc 100644 --- a/docs/ua/modules/arch/images/architecture/registry/administrative/regulation-management/registry-regulation/regulation-structure.svg +++ b/docs/ua/modules/arch/images/architecture/registry/administrative/regulation-management/registry-regulation/regulation-structure.svg @@ -1,4 +1,4 @@ -
Цифровий регламент реєстру
(gerrit:/registry-regulation)
Цифровий регламент реєстру...
Тестування
регламенту
Тестування...
Загальні
налаштування
Загальні...
Бізнес-процеси
Бізнес-процеси
Права доступу до бізнес-процесів
(bp-auth)
Права доступу до бізнес-процесів...
Моделі
бізнес-правил
(dmn)
Моделі...
Налаштування реєстру
(global-vars)
Налаштування реєстру...
Налаштування та кастомізації реєстру
(settings)
Налаштування та кастомізації реєстру...
Доступ
надавачів послуг
(officer.yml)
Доступ...
Доступ
отримувачів послуг
(citizen.yml)
Доступ...
Доступ
зовнішніх систем
(external-system.yml)
Доступ...
Модель даних
(data-model)
Модель даних...
Фізична модель бази диних
Фізична модель бази диних
Шаблони
витягів
Шаблони...
PDF-шаблони
(excerpts)
PDF-шаблони...
CSV-шаблони
(excerpts-csv)
CSV-шаблони...
DOCX-шаблони
(excerpts-docx)
DOCX-шаблони...
UI-форми бізнес-процесів
UI-форми бізнес-процесів
Схеми UI-форм
(forms)
Схеми UI-форм...
Скрипти UI-форм
(form-scripts)
Скрипти UI-форм...
Шаблони інформаційних повідомлень
(notifications)
Шаблони інформаційних повідомлень...
Inbox
повідомлення
(inbox)
Inbox...
Дія
push-нотифікації
(diia)
Дія...
Поштові повідомлення
(email)
Поштові повідомлення...
Групування
бізнес-процесів
(bp-grouping)
Групуваннябізнес-процесів...
Моделі
бізнес-процесів
(bpmn)
Моделі...
Налаштування симуляції API зовнішніх систем
(mock-integrations)
Налаштування симуляції API зовнішніх систем...
Інтеграції з зовнішніми системами
(bp-trembita)
Інтеграції з зовнішніми системами...
Налаштування інтеграцій з зовнішніми системами
(configuration.yml)
Налаштування інтеграцій з зовнішніми системами...
Налаштування
API бізнес-процесів
для зовнішніх систем
(external-system.yml)
Налаштування...
Функціональні
BDD-тести
(autotests)
Функціональні...
Шаблони
аналітичних звітів
Шаблони...
Шаблони
інформаційних панелей
(reports)
Шаблони...
Ролі користувачів
(roles)
Ролі користувачів...
Ролі
надавачів послуг
(officer.yml)
Ролінадавачів послуг...
Ролі
отримувачів послуг
(citizen.yml)
Роліотримувачів послуг...
Специфікація API доступу до даних
Специфікація API доступу до даних
Права доступу
до даних
Права доступу...
Дані для первинного завантаження
Дані для первинного завантаженняText is not SVG - cannot display \ No newline at end of file +
Цифровий регламент реєстру
(gerrit:/registry-regulation)
Цифровий регламент реєстру...
Тестування
регламенту
Тестування...
Додаткові зображення (assets)
Додаткові зображення (assets)
Бізнес-процеси
Бізнес-процеси
Права доступу до бізнес-процесів
(bp-auth)
Права доступу до бізнес-процесів...
Моделі
бізнес-правил
(dmn)
Моделі...
Доступ
надавачів послуг
(officer.yml)
Доступ...
Доступ
отримувачів послуг
(citizen.yml)
Доступ...
Доступ
зовнішніх систем
(external-system.yml)
Доступ...
Модель даних
(data-model)
Модель даних...
Фізична модель бази диних
Фізична модель бази диних
Шаблони
витягів
Шаблони...
PDF-шаблони
(excerpts)
PDF-шаблони...
CSV-шаблони
(excerpts-csv)
CSV-шаблони...
DOCX-шаблони
(excerpts-docx)
DOCX-шаблони...
UI-форми бізнес-процесів
UI-форми бізнес-процесів
Схеми UI-форм
(forms)
Схеми UI-форм...
Скрипти UI-форм
(form-scripts)
Скрипти UI-форм...
Шаблони інформаційних повідомлень
(notifications)
Шаблони інформаційних повідомлень...
Inbox
повідомлення
(inbox)
Inbox...
Дія
push-нотифікації
(diia)
Дія...
Поштові повідомлення
(email)
Поштові повідомлення...
Групування
бізнес-процесів
(bp-grouping)
Групуваннябізнес-процесів...
Моделі
бізнес-процесів
(bpmn)
Моделі...
Налаштування симуляції API зовнішніх систем
(mock-integrations)
Налаштування симуляції API зовнішніх систем...
Інтеграції з зовнішніми системами
(bp-trembita)
Інтеграції з зовнішніми системами...
Налаштування інтеграцій з зовнішніми системами
(configuration.yml)
Налаштування інтеграцій з зовнішніми системами...
Налаштування
API бізнес-процесів
для зовнішніх систем
(external-system.yml)
Налаштування...
Функціональні
BDD-тести
(autotests)
Функціональні...
Шаблони
аналітичних звітів
Шаблони...
Шаблони
інформаційних панелей
(reports)
Шаблони...
Ролі користувачів
(roles)
Ролі користувачів...
Ролі
надавачів послуг
(officer.yml)
Ролінадавачів послуг...
Ролі
зовнішніх систем
(external-system.yml)
Ролізовнішніх систем...
Специфікація API доступу до даних
Специфікація API доступу до даних
Права доступу
до даних
Права доступу...
Дані для первинного завантаження
Дані для первинного завантаження
Ролі
надавачів послуг
(officer.yml)
Ролінадавачів послуг...
Загальні
налаштування
Загальні...
Налаштування реєстру
(global-vars)
Налаштування реєстру...
Налаштування та кастомізації реєстру
(settings)
Налаштування та кастомізації реєстру...
Логотип в адресному рядку
(favicon.png)
Логотип в адресному рядку...
Логотип в заголовках сторінок порталів
(header-logo.svg)
Логотип в заголовках сторінок порталів...
Логотип при завантаженні сторінок 
(loader-logo.svg)
Логотип при завантаженні сторінок...Text is not SVG - cannot display \ No newline at end of file diff --git a/docs/ua/modules/arch/images/architecture/registry/administrative/regulation-publication/registry-publication-design.drawio.svg b/docs/ua/modules/arch/images/architecture/registry/administrative/regulation-publication/registry-publication-design.drawio.svg index d8f9c8bffc..da067ed573 100644 --- a/docs/ua/modules/arch/images/architecture/registry/administrative/regulation-publication/registry-publication-design.drawio.svg +++ b/docs/ua/modules/arch/images/architecture/registry/administrative/regulation-publication/registry-publication-design.drawio.svg @@ -1,4 +1,4 @@ -
Підсистема моделювання
регламенту реєстру
Підсистема моделюваннярегламенту реєстру
Службові
адміністратори
реєстру
Службові...
Розробники
регламенту
реєстру
Розробники...
Підсистема управління
зовнішнім трафіком
Підсистема управління...
Підсистема управління користувачами та ролями
Підсистема управління користувачами та ролями
Підсистема управління
зовнішнім трафіком
Підсистема управління...
Сховище
артефактів реєстру
(nexus)
Сховищеартефактів реєстру...
Отримання змін у мастер версії
чи версії кандидаті
Отримання змін у мастер версії...
Підсистема управління
 реляційними базами даних
Підсистема управління...
Підсистема виконання
бізнес-процесів
Підсистема виконання...
Підсистема аналітичної
 звітності реєстру
Підсистема аналітичної...
Підсистема
нотифікацій користувачів
Підсистема...
Підсистема асинхронного
обміну повідомленнями
Підсистема асинхронного...
Підсистема розподіленого зберігання даних
Підсистема розподіленого зберігання даних
Збереження артефактів
для сервісів доступу
до даних реєстру
Збереження артефактів...
Збереження
згенерованого коду
для сервісів доступу
 до даних реєстру
Збереження...
Розгортання
бізнес-процесів та форм
Розгортання...
Валідація змін
до регламенту реєстру
Валідація змін...
Генерація
коду сервісів
Генерація...
Розгортання
сервісів
Розгортання сервісів
Розгортання конфігурацій
для зовнішніх інтеграцій
Розгортання конфігурацій...
Видалення топіків
Кафка при очищенні
регламенту
Видалення топіків...
Оновлення налаштувань
для кабінетів користувачів
(тема, назва)
Оновлення налаштувань...
Створення ролей
регламенту реєстру
Створення ролей...
Виключення сервісів
при очищенні регламенту
Виключення сервісів...
Налаштування
 правил симуляції
зовнішніх інтеграцій
Налаштування правил симуляції...
Розгортання
схеми бази даних
реєстру
Розгортаннясхеми бази даних...
Агент розгортання
 регламенту
(dataplatform-jenkins-agent)
Агент розгортання...
Делегування виконання
коду пайплайнів
Делегування виконання...
Підсистема управління даними реєстру
Підсистема управління даними реєстру
Підсистема зовнішніх інтеграцій
Підсистема зовнішніх інтеграцій
Утиліта завантаження
 геошарів
(geoserver-publisher)
Утиліта завантаження...
Підсистема управління геоданими
Підсистема управління геоданими
Підсистема кабінетів користувачів
Підсистема кабінетів користувачів
Налаштування авторизації
для бізнес-процесів
Налаштування авторизації...
Збереження шаблонів
нотифікацій
Збереження шаблонів...
Збереження шаблонів
витіягів
Збереження шаблонів...
Створення звітів
 та запитів
Створення звітів...
operational:registry
operational:registry
operational:registry-dev-*
operational:registry-dev-*
operational:camunda
operational:camunda
operational:excerpt
operational:excerpt
analytical:registry
analytical:registry
excerpt-templates
excerpt-templates
Розгортання налаштувань
геоданих
Розгортання налаштувань...
Налаштування метаданих
для підсистеми управління
геоданими
Налаштування метаданих...
1
1
1
1
Підсистема обслуговування операційної зони реєстру
Підсистема обслуговування операційної зони реєстру
Відновлення стану 
у веб-інтерфейсі моделювання звітів 
відповідно до стану регламента(1)
Відновлення стану...
2
2
2
2
Підсистема симуляції API 
зовнішніх систем
Підсистема симуляції API...
Створення
користувачів
Створення користувачів
Збереження метаданих
для витягів
Збереження метаданих...
Видалення даних
при очищенні
регламенту
Видалення даних...
Розгортання
тимчасових
БД
РозгортаннятимчасовихБД...
3
3
Отримання
метаданих
про структуру
схеми реєстру
Отриманняметаданихпро структуру...
3
3
Міжсервісна взаємодія
Міжсервісна взаємодія
Підсистема реєстру
Підсистема реєстру
Підсистема Платформи
Підсистема Платформи
N
N
Умовний поєднувач
Умовний поєднувач
Компонент цільової підсистеми
Компонент цільової підсистеми
Сервіс розгортання
 регламенту
(jenkins)
Сервіс розгортання...
Утиліта управління
 доступом до БП
(camunda-auth-cli)
Утиліта управління...
Утиліта валідації регламенту
(registry-regulations
validator-cli)
Утиліта валідації регламенту...
Утиліта генерації сервісів
доступу до даних реєстру
(service-generation-utility)
Утиліта генерації сервісів...
Утиліта публікації
шаблонів нотифікацій
(notification-template-publisher)
Утиліта публікації...
Утиліта публікації
аналітичних звітів та витягів
(report-publisher)
Утиліта публікації...
Розгортання
схеми бази даних
реєстру
Розгортаннясхеми бази даних...
registry-regulations
registry-regulations
registry-model
registry-model
registry-rest-api
registry-rest-api
registry-soap-api
registry-soap-apiText is not SVG - cannot display \ No newline at end of file +
Підсистема моделювання
регламенту реєстру
Підсистема моделюваннярегламенту реєстру
Службові
адміністратори
реєстру
Службові...
Розробники
регламенту
реєстру
Розробники...
Підсистема управління
зовнішнім трафіком
Підсистема управління...
Підсистема управління користувачами та ролями
Підсистема управління користувачами та ролями
Підсистема управління
зовнішнім трафіком
Підсистема управління...
Сховище артефактів
 реєстру (nexus)
Сховище артефактів...
Отримання змін у мастер версії
чи версії кандидаті
Отримання змін у мастер версії...
Підсистема управління
 реляційними базами даних
Підсистема управління...
Підсистема виконання
бізнес-процесів
Підсистема виконання...
Підсистема аналітичної
 звітності реєстру
Підсистема аналітичної...
Підсистема
нотифікацій користувачів
Підсистема...
Підсистема асинхронного
обміну повідомленнями
Підсистема асинхронного...
Підсистема розподіленого зберігання даних
Підсистема розподіленого зберігання даних
Збереження артефактів
для сервісів реєстру
Збереження артефактів...
Збереження
згенерованого коду
для сервісів реєстру
Збереження...
Розгортання
бізнес-процесів та форм
Розгортання...
Валідація змін
до регламенту реєстру
Валідація змін...
Генерація
коду сервісів
Генерація...
Розгортання
сервісів
Розгортання сервісів
Розгортання конфігурацій
для зовнішніх інтеграцій
Розгортання конфігурацій...
Видалення топіків
Кафка при очищенні
регламенту
Видалення топіків...
Оновлення налаштувань
для кабінетів користувачів
(тема, назва)
Оновлення налаштувань...
Створення ролей
регламенту реєстру
Створення ролей...
Виключення сервісів
при очищенні регламенту
Виключення сервісів...
Налаштування
 правил симуляції
зовнішніх інтеграцій
Налаштування правил симуляції...
Розгортання
схеми бази даних
реєстру
Розгортаннясхеми бази даних...
Агент розгортання
 регламенту
(dataplatform-jenkins-agent)
Агент розгортання...
Делегування виконання
коду пайплайнів
Делегування виконання...
Підсистема управління даними реєстру
Підсистема управління даними реєстру
Підсистема зовнішніх інтеграцій
Підсистема зовнішніх інтеграцій
Утиліта завантаження
 геошарів
(geoserver-publisher)
Утиліта завантаження...
Підсистема управління геоданими
Підсистема управління геоданими
Підсистема кабінетів користувачів
Підсистема кабінетів користувачів
Налаштування авторизації
для бізнес-процесів
Налаштування авторизації...
Збереження шаблонів
нотифікацій
Збереження шаблонів...
Збереження шаблонів
витіягів
Збереження шаблонів...
Створення звітів
 та запитів
Створення звітів...
operational:registry
operational:registry
operational:registry-dev-*
operational:registry-dev-*
operational:camunda
operational:camunda
operational:excerpt
operational:excerpt
analytical:registry
analytical:registry
excerpt-templates
excerpt-templates
Розгортання налаштувань
геоданих
Розгортання налаштувань...
Налаштування метаданих
для підсистеми управління
геоданими
Налаштування метаданих...
1
1
1
1
Підсистема обслуговування операційної зони реєстру
Підсистема обслуговування операційної зони реєстру
Відновлення стану 
у веб-інтерфейсі моделювання звітів 
відповідно до стану регламента(1)
Відновлення стану...
2
2
2
2
Підсистема симуляції API 
зовнішніх систем
Підсистема симуляції API...
Створення
користувачів
Створення користувачів
Збереження метаданих
для витягів
Збереження метаданих...
Видалення даних
при очищенні
регламенту
Видалення даних...
Розгортання
тимчасових
БД
РозгортаннятимчасовихБД...
3
3
Отримання
метаданих
про структуру
схеми реєстру
Отриманняметаданихпро структуру...
3
3
Міжсервісна взаємодія
Міжсервісна взаємодія
Підсистема реєстру
Підсистема реєстру
Підсистема Платформи
Підсистема Платформи
N
N
Умовний поєднувач
Умовний поєднувач
Компонент цільової підсистеми
Компонент цільової підсистеми
Сервіс розгортання
 регламенту
(jenkins)
Сервіс розгортання...
Утиліта управління
 доступом до БП
(camunda-auth-cli)
Утиліта управління...
Утиліта валідації регламенту
(registry-regulations
validator-cli)
Утиліта валідації регламенту...
Утиліта генерації сервісів
доступу до даних реєстру
(service-generation-utility)
Утиліта генерації сервісів...
Утиліта публікації
шаблонів нотифікацій
(notification-template-publisher)
Утиліта публікації...
Утиліта публікації
аналітичних звітів та витягів
(report-publisher)
Утиліта публікації...
Розгортання
схеми бази даних
реєстру
Розгортаннясхеми бази даних...
registry-regulations
registry-regulations
registry-model
registry-model
registry-rest-api
registry-rest-api
registry-soap-api
registry-soap-api
bp-webserv-gateway
bp-webserv-gateway
registry-model
registry-model
registry-rest-api
registry-rest-api
registry-soap-api
registry-soap-api
bp-webservice-gateway
bp-webservice-gatewayText is not SVG - cannot display \ No newline at end of file diff --git a/docs/ua/modules/arch/images/architecture/registry/operational/bpms/services/digital-document-service/context.svg b/docs/ua/modules/arch/images/architecture/registry/operational/bpms/services/digital-document-service/context.svg index 117a67645c..cc0b73d15d 100644 --- a/docs/ua/modules/arch/images/architecture/registry/operational/bpms/services/digital-document-service/context.svg +++ b/docs/ua/modules/arch/images/architecture/registry/operational/bpms/services/digital-document-service/context.svg @@ -1,4 +1,4 @@ -
Підсистема виконання бізнес-процесів
Підсистема виконання бізнес-процесів
Сервіс виконання бізнес-процесів
Сервіс виконання бізнес-процесів
Сервіс валідації даних UI-форм
Сервіс валідації даних UI-форм
Валідація цифрового документу
згідно налаштованих правил
Валідація цифрового документу...
Вивантаження файлів
з зовнішніх систем
Вивантаження файлів...
Збір метрик стану додатку
Збір метрик стану додатку
Збір подій додатку
Збір подій додатку
Публікація метрик додатку
Публікація метрик додатку
Перевірка прав доступу
користувача для виконання
задачі БП при завантаженні
цифрового документу
Перевірка прав доступу...
Сервіс цифрових документів
(digital-document-service)
Сервіс цифрових документів...
Spring Boot
Spring Boot
Istio Envoy
Istio Envoy
Підсистема зберігання даних
Підсистема зберігання даних
Підсистема
управління
зовнішнім трафіком
Підсистема...
Операційне сховище цифрових документів БП
Операційне сховище цифрових документів БП
lowcode-file-storage
lowcode-fil...
Зберігання та читання
цифрових документів
Зберігання та читання...
Підсистема
кабінетів користувачів
Підсистема...
Інші системи
Інші системи
Інші системи
Інші системи
Зовнішні системи
Зовнішні системи
Istio
Service Entry
Istio...
Istio
Service Entry
Istio...
Зовнішні
системи
(Service Entry)
Зовнішні...
Отримувачі
послуг
Отримувачі...
Завантаження, вивантаження цифрових документів
та отримання мета-даних
Завантаження, вивантаження цифрових документів...
Надавачі
послуг
Надавачі послуг
Підсистема
журналювання подій
Підсистема...
Підсистема
моніторингу подій та сповіщеня
Підсистема...
Підсистема
управління міжсервісною
взаємодією
Підсистемауправління міжсервісною...
Візуалізація метрик
Візуалізація метрик
Підсистема
трасування запитів
Підсистема трасування запитів
Запит
на вивантаження файлів
з зовнішніх систем
Запит...
Підсистема операційної зони Платформи
Підсистема операційної зони Платформи
Сервіс операційної зони реєстру
Сервіс операційної зони реєстру
Міжсервісна TCP взаємодія
Міжсервісна TCP взаємодія
Міжсервісна HTTP(S) взаємодія
Міжсервісна HTTP(S) взаємодія
Підсистема операційної зони реєстру
Підсистема операційної зони реєстру
Міжсервісна HTTP взаємодія
з mTLS аутентифікацією
Міжсервісна HTTP взаємодія...Text is not SVG - cannot display \ No newline at end of file +
Підсистема виконання бізнес-процесів
Підсистема виконання бізнес-процесів
Відправка повідомлення
про видалення файлів
Відправка повідомлення...
Сервіс виконання бізнес-процесів
Сервіс виконання бізнес-процесів
Сервіс валідації даних UI-форм
Сервіс валідації даних UI-форм
Валідація цифрового документу
згідно налаштованих правил
Валідація цифрового документу...
Вивантаження файлів
з зовнішніх систем
Вивантаження файлів...
Збір метрик стану додатку
Збір метрик стану додатку
Збір подій додатку
Збір подій додатку
Публікація метрик додатку
Публікація метрик додатку
Перевірка прав доступу
користувача для виконання
задачі БП при завантаженні
цифрового документу
Перевірка прав доступу...
Отримання повідомлення
про видалення файлів
Отримання повідомлення...
Сервіс цифрових документів
(digital-document-service)
Сервіс цифрових документів...
Spring Boot
Spring Boot
Istio Envoy
Istio Envoy
Підсистема зберігання даних
Підсистема зберігання даних
Підсистема
управління
зовнішнім трафіком
Підсистема...
Операційне сховище цифрових документів БП
Операційне сховище цифрових документів БП
lowcode-file-storage
lowcode-file...
Зберігання, читання та видалення
цифрових документів
Зберігання, читання та видалення...
Підсистема
кабінетів користувачів
Підсистема...
Інші системи
Інші системи
Інші системи
Інші системи
Зовнішні системи
Зовнішні системи
Istio
Service Entry
Istio...
Istio
Service Entry
Istio...
Зовнішні
системи
(Service Entry)
Зовнішні...
Отримувачі
послуг
Отримувачі...
Завантаження, вивантаження цифрових документів
та отримання мета-даних
Завантаження, вивантаження цифрових документів...
Надавачі
послуг
Надавачі послуг
Підсистема
журналювання подій
Підсистема...
Підсистема
моніторингу подій та сповіщеня
Підсистема...
Підсистема
управління міжсервісною
взаємодією
Підсистемауправління міжсервісною...
Візуалізація метрик
Візуалізація метрик
Підсистема
трасування запитів
Підсистема трасування запитів
Запит
на вивантаження файлів
з зовнішніх систем
Запит...
Підсистема операційної зони Платформи
Підсистема операційної зони Платформи
Сервіс операційної зони реєстру
Сервіс операційної зони реєстру
Міжсервісна TCP взаємодія
Міжсервісна TCP взаємодія
Міжсервісна HTTP(S) взаємодія
Міжсервісна HTTP(S) взаємодія
Підсистема операційної зони реєстру
Підсистема операційної зони реєстру
Міжсервісна HTTP взаємодія
з mTLS аутентифікацією
Міжсервісна HTTP взаємодія...
Kafka
KafkaText is not SVG - cannot display \ No newline at end of file diff --git a/docs/ua/modules/arch/images/architecture/registry/operational/bpms/services/digital-document-service/lowcode-file-storage-cleanup.svg b/docs/ua/modules/arch/images/architecture/registry/operational/bpms/services/digital-document-service/lowcode-file-storage-cleanup.svg new file mode 100644 index 0000000000..27bdad0a72 --- /dev/null +++ b/docs/ua/modules/arch/images/architecture/registry/operational/bpms/services/digital-document-service/lowcode-file-storage-cleanup.svg @@ -0,0 +1,4 @@ + + + +
send
send
BPMS
BPMS
recieve
recieve
Delete files
Delete files
digital-document-service
digital-document-ser...
Kafka
Kafka
Topic - bpm-locwode-file-storage-cleanup
Topic - bpm-locwode-file-sto...
Bucket - lowcode-file-storage
Bucket - lowcod...
Ceph
CephText is not SVG - cannot display \ No newline at end of file diff --git a/docs/ua/modules/arch/images/architecture/registry/operational/registry-management/data-provenance.drawio.svg b/docs/ua/modules/arch/images/architecture/registry/operational/registry-management/data-provenance.drawio.svg new file mode 100644 index 0000000000..659a283e5d --- /dev/null +++ b/docs/ua/modules/arch/images/architecture/registry/operational/registry-management/data-provenance.drawio.svg @@ -0,0 +1,642 @@ + + + + + + + +
+
+
+ file-ceph-bucket +
+
+
+ + + file-ceph-bucket + + + + + + + + + +
+
+
+ Git репозиторій +
+ регламенту реєстру +
+
+
+ + + Git репозиторій... + + + + + + + +
+
+
+ datafactory-ceph-bucket +
+
+
+ + + datafactory-ceph-bucket + + + + + + + +
+
+
+ БД реєстру +
+
+
+ + + БД реєстру + + + + + + + + + +
+
+
+ JSON Документ форми +
+
+
+ + + JSON Документ форми + + + + + + + +
+
+
+ Бізнес атрибути +
+
+
+ + + Бізнес атрибути + + + + + + + +
+
+
+ Підпис користувача +
+ - КЕП для ручних БП +
+ - Системний для автоматичних БП +
+
+
+ + + Підпис користувача... + + + + + + + +
+
+
+ JWT токен користувача +
+
+
+ + + JWT токен користувача + + + + + + + +
+
+
+ Первинне завантаження +
+
+
+ + + Первинне завантаження + + + + + + + + + + + + +
+
+
+ Історія запису таблиці реєстру +
+
+
+ + + Історія запису таблиці реєстру + + + + + + + +
+
+
+ Бізнес атрибути +
+
+
+ + + Бізнес атрибути + + + + + + + +
+
+
+ Джерело (ID БП або регламент) +
+
+
+ + + Джерело (ID БП або регламент) + + + + + + + +
+
+
+ ID та чексума документа API +
+
+
+ + + ID та чексума документа API + + + + + + + +
+
+
+ ID та чексума документа форми +
+
+
+ + + ID та чексума документа форми + + + + + + + + + + + + +
+
+
+ Запис таблиці реєстру +
+
+
+ + + Запис таблиці реєстру + + + + + + + +
+
+
+ Бізнес атрибути +
+
+
+ + + Бізнес атрибути + + + + + + + +
+
+
+ Файли +
+
+
+ + + Файли + + + + + + + + + +
+
+
+ JSON Документ API +
+
+
+ + + JSON Документ API + + + + + + + +
+
+
+ Бізнес атрибути +
+
+
+ + + Бізнес атрибути + + + + + + + +
+
+
+ Системний підпис +
+
+
+ + + Системний підпис + + + + + + + +
+
+
+ Вихідні дані +
+
+
+ + + Вихідні дані + + + + + + +
+
+
+ CSV +
+
+
+ + + CSV + + + + + + + +
+
+
+ Правила +
+ трансформації +
+
+
+ + + Правила +трансформації + + + + + + +
+
+
+ XML +
+
+
+ + + XML + + + + + + + +
+
+
+ Джерело - первинне завантаження +
+
+
+ + + Джерело - первинне завантаження + + + + + + + + +
+
+
+ F +
+
+
+ + + F + + + + + + + + +
+
+
+ F +
+
+
+ + + F + + + + + + + + + + + + +
+
+
+ F +
+
+
+ + + F + + + + + + + + +
+
+
+ F +
+
+
+ + + F + + + + + + + +
+
+
+ F +
+
+
+ + + F + + + + + + + + + + + +
+
+
+ Джерело - БП +
+
+
+ + + Джерело - БП + + + + + + + +
+
+
+ Бізнес дані +
+
+
+ + + Бізнес дані + + + + + + + +
+
+
+ Службові дані +
+
+
+ + + Службові дані + + + + + + + +
+
+
+ F +
+
+
+ + + F + + + + + + +
+
+
+ Посилання на файл +
+
+
+ + + Посилання на файл + + + + + + + + + Text is not SVG - cannot display + + + + \ No newline at end of file diff --git a/docs/ua/modules/arch/images/architecture/registry/operational/registry-management/platform-evolution/rest-file-transfer/control-plane-public-files.png b/docs/ua/modules/arch/images/architecture/registry/operational/registry-management/platform-evolution/rest-file-transfer/control-plane-public-files.png new file mode 100644 index 0000000000..6e2f97f00b Binary files /dev/null and b/docs/ua/modules/arch/images/architecture/registry/operational/registry-management/platform-evolution/rest-file-transfer/control-plane-public-files.png differ diff --git a/docs/ua/modules/arch/images/architecture/registry/operational/registry-management/platform-evolution/rest-file-transfer/file-transfer-current.drawio.svg b/docs/ua/modules/arch/images/architecture/registry/operational/registry-management/platform-evolution/rest-file-transfer/file-transfer-current.drawio.svg new file mode 100644 index 0000000000..9b155df5fc --- /dev/null +++ b/docs/ua/modules/arch/images/architecture/registry/operational/registry-management/platform-evolution/rest-file-transfer/file-transfer-current.drawio.svg @@ -0,0 +1,728 @@ + + + + + + + +
+
+
+ Підсистема зовнішніх інтеграцій +
+
+
+ + + Підсистема зовнішніх інтеграцій + + + + + + + + +
+
+
+ виконання +
+ пошукового запиту +
+
+
+ + + виконання... + + + + + + + +
+
+
+ Сервіс синхронного управління даними реєстру для міжреєстрової взаємодії +
+ + (registry-rest-api-ext-deployment) + +
+
+
+ + + Сервіс синхронного управління даними реєстру для міжреєстрової взаємодії... + + + + + + + +
+
+
+ Підсистема управління реляційними базами даних +
+
+
+ + + Підсистема управління реляційними базами даних + + + + + + + +
+
+
+

+ + API-шлюз для читання даних реєстру зовнішніми системами + +

+

+ + + (registry-soap-api-deployment) + + +

+
+
+
+ + + API-шлюз для читання даних реєстру зовнішніми системами... + + + + + + + +
+
+
+ Підсистема управління даними реєстру +
+
+
+ + + Підсистема управління даними реєстру + + + + + + + + +
+
+
+ запити на читання +
+ даних +
+
+ відповідь містить +
+ ідентифікатор файлу +
+
+
+ + + запити на читання... + + + + + + + +
+
+
+ Підсистема виконання бізнес-процесів +
+
+
+ + + Підсистема виконання бізнес-процесів + + + + + + + + +
+
+
+ виконання +
+ пошукового запиту +
+
+
+ + + виконання +пошукового запиту + + + + + + + +
+
+
+ Сервіс синхронного управління даними реєстру для публічного доступу до даних +
+ + (registry-rest-api-public-deployment) + +
+
+
+ + + Сервіс синхронного управління даними реєстру для публічного доступу до даних... + + + + + + + +
+
+
+
+ + Сервіс + + + синхронного управління + + + даними реєстру + +
+
+ + (registry-rest-api) + +
+
+
+
+ + + Сервіс синхронного управління даними реєстру... + + + + + + + + +
+
+
+ Копіювання з + + file-ceph-bucket + +
+ в + + lowcode-file-storage + +
+
+
+ + + Копіювання з file-ceph-bucket... + + + + + + + + +
+
+
+ виконання пошукових +
+ запиту +
+
+
+ + + виконання пошукових... + + + + + + + +
+
+
+ Підсистема розподіленого зберігання даних +
+
+
+ + + Підсистема розподіленого зберігання даних + + + + + + + + +
+
+
+ Тимчасове сховище цифрових документів +
+
+ + lowcode-file-storage + +
+
+
+ + + Тимчасове сховище цифрових документів... + + + + + + + +
+
+
+ Операційне сховище цифрових документів +
+
+ + file-ceph-bucket + +
+
+
+ + + Операційне сховище цифрових документів... + + + + + + + + + + + + +
+
+
+ Читання скопійованих файлів +
+ за ідентифікатором +
+
+
+ + + Читання скопійованих файлів... + + + + + + + + + +
+
+
+ API-шлюз міжреєстрової взаємодії +
+ + (platform-gateway-deployment) + +
+
+
+ + + API-шлюз міжреєстрової взаємодії... + + + + + + + + +
+
+
+ + запит на + +
+ + читання даних + +
+
+ + ідентифікатор файлу + +
+ + відсутній у відповіді + +
+
+
+ + + запит на... + + + + + + + + +
+
+
+ + запит на + +
+ + читання даних + +
+
+ + ідентифікатор файлу + +
+ + відсутній у відповіді + +
+
+
+ + + запит на... + + + + + + + +
+
+
+ + Шлюз +
+ безпечного обміну "Трембіта" + +
+
+
+ + + Шлюз... + + + + + + + +
+
+
+ Підсистема управління +
+ зовнішнім трафіком +
+
+
+ + + Підсистема управління... + + + + + + + + +
+
+
+ Зовнішні системи +
+
+
+ + + Зовнішні системи + + + + + + + + + + +
+
+
+ + запит на + +
+ + читання даних + +
+
+ + ідентифікатор файлу + +
+ + відсутній у відповіді + +
+
+
+ + + запит на... + + + + + + + +
+
+
+ Публічні клієнти +
+
+
+ + + Публічні клієнти + + + + + + + + + + +
+
+
+ + запит на + +
+ + читання даних + +
+
+ + ідентифікатор файлу + +
+ + відсутній у відповіді + +
+
+
+ + + запит на... + + + + + + + +
+
+
+ Інші реєстри на платформі +
+
+
+ + + Інші реєстри на платформі + + + + + + + + + + +
+
+
+ взаємодія з доступом до +
+ контенту файлів +
+
+
+ + + взаємодія з доступом до... + + + + + + + +
+
+
+ + взаємодія без доступу до + +
+ + контенту файлів + +
+
+
+ + + взаємодія без доступу до... + + + + + + + +
+
+
+ Підсистема реєстру +
+
+
+ + + Підсистема реєстру + + + + + + + +
+
+
+ Зовнішні системи +
+
+
+ + + Зовнішні системи + + + + + + + +
+
+
+ Підсистема Платформи +
+
+
+ + + Підсистема Платформи + + + + + + + + + Text is not SVG - cannot display + + + + \ No newline at end of file diff --git a/docs/ua/modules/arch/pages/architecture-workspace/architecture-workspace.adoc b/docs/ua/modules/arch/pages/architecture-workspace/architecture-workspace.adoc index df92507e07..10d52ef5c2 100644 --- a/docs/ua/modules/arch/pages/architecture-workspace/architecture-workspace.adoc +++ b/docs/ua/modules/arch/pages/architecture-workspace/architecture-workspace.adoc @@ -3,9 +3,6 @@ == План робіт по технічній документації * [ ] Створити референтний приклад документування низькорівневого дизайну сервісу -* [ ] Задокументувати структуру конфігурації реєстру -* [ ] Створити діаграму розгортання Платформи -* [ ] Створити набір типових візуальних діаграм у якості прикладу для уніфікації підходу до опису дизайну Платформи * [ ] Створити референтний приклад документування низькорівневого дизайну бібліотек Платформи * [ ] Визначити актуальність залишку технічних статей у розділі "Архів технічної документації" та рознести по відповідним розділам або видалити * [ ] Виявити статті розділу "Архітектурна документація", які продубльовано в інструкціях користувачів та видалити дублікати \ No newline at end of file diff --git a/docs/ua/modules/arch/pages/architecture-workspace/performance/admin-services-resource-management.adoc b/docs/ua/modules/arch/pages/architecture-workspace/performance/admin-services-resource-management.adoc new file mode 100644 index 0000000000..cbcd7b9ad9 --- /dev/null +++ b/docs/ua/modules/arch/pages/architecture-workspace/performance/admin-services-resource-management.adoc @@ -0,0 +1,47 @@ += Управління ресурсами сервісів адміністративної зони реєстру + +[NOTE] +-- +Сторінка технічної документації у процесі розробки... +-- + +|=== +|Назва компоненти|Репозиторій|Суть зміни + +|Restic Daemonset +|`backup-management` +a|В Values.gotmpl зменшити кількість виділених ресурсів. Зміна торкнеться всіх реєстрів на Платформі. Приклад: +---- +resources: + limits: + cpu: 1500m + requests: + cpu: 500m + memory: 512Mi +---- + +|Jenkins +|`jenkins-operator` +|В поточному імаджі використовується startup script що задає java opts Xmx від заданого значення `container.limits`. +Єдина можливість обмежити Jenkins — задання `container.limits`, що автоматично вбʼє контейнер. + +|Gerrit +|gerrit-operator +a|Для обмеження кількості споживаємих ресурсів памʼяті, необхідно визначити `heapLimit` в `/var/gerrit/review_site/etc/gerrit.config`. Приклад: +---- +[container] + heapLimit = 512M +---- + +|Nexus +|`nexus-operator` +a|Визначається в `/opt/sonatype/nexus/bin/nexus.vmoptions` Приклад: +---- +-Xmx512m +-Xms256m +-XX:MaxDirectMemorySize=512m +-XX:+UnlockDiagnosticVMOptions +-XX:+LogVMOutput +---- + +|=== \ No newline at end of file diff --git a/docs/ua/modules/arch/pages/architecture-workspace/performance/overview.adoc b/docs/ua/modules/arch/pages/architecture-workspace/performance/overview.adoc new file mode 100644 index 0000000000..21a100001d --- /dev/null +++ b/docs/ua/modules/arch/pages/architecture-workspace/performance/overview.adoc @@ -0,0 +1,6 @@ += Тестування продуктивності + +[NOTE] +-- +З поточним станом налаштувань реєстру можна ознайомитись за xref:attachment$/architecture-workspace/performance/registry-resources.xlsx[посиланням]. +-- \ No newline at end of file diff --git a/docs/ua/modules/arch/pages/architecture-workspace/performance/performance-baseline.adoc b/docs/ua/modules/arch/pages/architecture-workspace/performance/performance-baseline.adoc new file mode 100644 index 0000000000..a6a163d706 --- /dev/null +++ b/docs/ua/modules/arch/pages/architecture-workspace/performance/performance-baseline.adoc @@ -0,0 +1,110 @@ +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] + += Поточний стан тестування навантаження системи + +== Опис поточного тестування навантаження + +=== Поточні сценарії + +Як регламент для тестування навантаження на даний використовується certified-laboratories-registry-regulation. + +Поточні тести покривають наступні сценарії: + +[options="header"] +|=== + +| Сценарій | Сервіси які задієються + +| Створення простої сутності +| registry-rest-api, registry-kafka-api, bpms, digital-signature-ops, user-task-management, form-schema-provider, form-submission-validation + +| Оновлення простої сутності +| registry-rest-api, registry-kafka-api, bpms, digital-signature-ops, user-task-management, form-schema-provider, form-submission-validation + +| Читання простої сутності +| registry-rest-api, bpms, digital-signature-ops, user-task-management, form-schema-provider, form-submission-validation + +| Критерій з пошуком за типом starts-with +| registry-rest-api + +| Критерій з пошуком за типом contains +| registry-rest-api + +| Критерій з пошуком за типом equals +| registry-rest-api + +| Отримання історії виконання БП +| process-history-service, bpms + +| Авторизація +| Keyckoak + +| Логаут +| Keycloak + + +|=== + +=== Технологічний стек + +[options="header"] +|=== + +| Назва утиліти | Опис + +| Apache JMeter +| Утиліта для написання сценаріїв тестів навантаження та їх запуску + +| Carrier +| UI агрегатор репортів з перформанс тестів + +|=== + +=== Поточна калькуляція метрик + +[options="header"] +|=== + +| Операція | Калькуляція | Приклад калькуляції | Метрика + +| Середній час операцій запису даних в реєстрі на рівні Дата Платформи +| 95pct(list_of(all complete bp tasks median duration)) +| 95pct(list_of([portal][bp:${bp-name}][task:${task-name}][sign-form] median duration)) +| ms + +| Середній час операцій читання даних за переліком ключових полів без запитів до сторонніх реєстрів +| 95pct(list_of(all search condition median duration)) +| 95pct(list_of([portal][sc:${sc-name}] median duration)) +| ms + +| Пропускна здібність операцій запису даних в реєстрі на рівні Дата Платформи +| sum(list_of(all complete task tps)) +| sum(list_of([portal][bp:${bp-name}][task:${task-name}][sign-form] tps)) +| req/sec + +| Пропускна здібність операцій читання даних за переліком ключових полів без запитів до сторонніх реєстрів +| sum(list_of(all complete task tps)) +| sum(list_of([portal][sc:${sc-name}] tps)) +| req/sec + +| Загальна кількість операцій збереження даних до реєстру +| sum(list_of(number of all sign-form)) +| sum(list_of([portal][bp:${bp-name}][task:${task-name}][sign-form] number) +| amount + +| Загальна кількість виконаних Бізнес процесів +| sum(start-with-form/start number) +| sum([portal][bp:${bp-name}][start/start-with-form]) +| amount + +| Пропускна здібність на запуск нових бізнес процесів +| sum(start with form tps) +| sum(([portal][bp:${bp-name}][start-with-form/start]) tps) +| req/sec + +| Пропускна здібність виконання користувацьких задач без підпису +| sum(complete task without signature tps) +| sum([portal][bp:${bp-name}][task:${task-name}][complete]) +| req/sec + +|=== \ No newline at end of file diff --git a/docs/ua/modules/arch/pages/architecture-workspace/performance/performance-preparation.adoc b/docs/ua/modules/arch/pages/architecture-workspace/performance/performance-preparation.adoc new file mode 100644 index 0000000000..d652d4b453 --- /dev/null +++ b/docs/ua/modules/arch/pages/architecture-workspace/performance/performance-preparation.adoc @@ -0,0 +1,194 @@ +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] + += Підготовка оточення для запуску тестування навантаження + +== Підготовка реєстру + +=== Налаштування файлу запуску + +Для виконання прекондішнів по підготовці до запуску тестів навантаження необхідно підготувати файл, дана конфігурація виконає наступні кроки: + +** Створення реєстру за заданою назвою +** Розгортання обраного регламенту +** Додавання доступу для зовнішніх систем +** Налаштування EDR +** Налаштування піблічного доступу до заданого ендпоінту + +.Файл підготовки оточення __registry.json__ +(xref:arch:attachment$/architecture/performance-testing/registry.json[Завантажити]) +[%collapsible, json] +==== +---- +include::arch:attachment$/architecture/performance-testing/registry.json[json] +---- +==== + +Необхідно налаштувати параметри до котрих додані коментарі + +[options="header"] +|=== +| Назва секції | Опис +| name +| Назва реєстру. Необхідно вказати назву бажаного реєстру + +| isGeoServer +| Присутність геосерверу. True - присутній, False - не присутній + + +| accessToExternalSystems +| Назва доступу до зовнішньої системи + + +| publicApiSettings +| Необхідно вказати назву публічного доступу, ендпоіну, ліміту на годину + + +| template +| Тип реєстру. Productuion - оточення продакшн типу, Development - оточення для розробки + + +| repository +| Назва регламенту. Доступні регламенти: + +* certified-laboratories-registry-regulation +* consent-data + +| branch +| Гілка регламенту для разгортання + +| regulationDeployOnly +| Тип запуску тестів попереднього розгортання. True - запуск лише розгортання регламенту, False - повний флоу +|=== + +=== Запуск прекондішн тестів +Для виконнання прекондішн тестів необхідно перейти до Jenkins -> Clusters -> -> -run-installer-validation-tests + +* Запуск пайплайну з параметрами + +image::testing:perf-test/test-preparation/run-pipeline.png[] + +* Обрати виключно параметр RUN_REGISTRY_TESTS + +image::testing:perf-test/test-preparation/test-params.png[] + +* Вказати tag з Gerrit до відповідного очікуваного регламенту + +image::testing:perf-test/test-preparation/set-build.png[] + +* Вказати профайл для тестів які виконують пре кондішн як -PPerfTesting + +image::testing:perf-test/test-preparation/perf-testing-profile.png[] + + +* Передати підготовлений файл як input param до пайплайну на кроку control-plane-tests + +image::testing:perf-test/test-preparation/file-uplpad.png[] + + +=== Підготовка оточення до проведення тестування навантаження + +Для подальшого налаштування реєстру необхідно виконати наступні дії: + +* Створення конфіг мапи в опеншифті для тестових користувачів + +Конфіг мапа створюється у namespace реєстру який був створений за назвою sign-widget-mock-users + +.Файл контенту секрету __sign-widget-mock-users__ +(xref:arch:attachment$/architecture/performance-testing/sign-widget-mock-users.yml[Завантажити]) +[%collapsible, json] +==== +---- +include::arch:attachment$/architecture/performance-testing/sign-widget-mock-users.yml[yml] +---- +==== + +* Додати у Control Plane Gerrit, в репозиторії реєстру, файл values.yml наступну змінну + +*caIsolation: true* + +* Встановити аутентифікацію через браузер у опеншифті + +** Необхідно перейти до Пошуку та занайти сутність Keycloak Realms для реєстру та обрати officer-portal + +image::testing:perf-test/test-preparation/keycloak-realm-path.png[] + + +** Встановити для browser-flow у ресурсі browser + +image::testing:perf-test/test-preparation/keycloak-flow.png[] + +** Проконтролювати розподілення ресурсів + +Якщо реєстр розгорнутий на більш, ніж 1 машині певного типу - проконтролювати більш-менш рівномірне розподілення под, які використовують найбільше cpu та memory, між машинами. + +image::testing:perf-test/test-preparation/machine-set-config.png[] + +До таких под належать bpms, operational-instance, kafka-cluster, registry-rest-api. + +Перевірити розподілення ресурсів можливо у Grafana на дашборді Kubernetes / Compute Resources / Node (Pods). + +Якщо присутнє нерівномірне розподілення навантажених под між машинами - в процесі тесту може виникнути тротлінг по cpu/memory в межах ноди, що негативно вплине на результатти тесту. + +Найпростіша опція по перебалансуванню под між машинами - видалити машину, яка виділяється з рівномірного розподілення. + +== Запуск тестування навантаження + +Для запуску тестування навантаження необхідно виконати наступні кроки: + +* Перейти до Carrier та обрати вкладку Backend, натиснути кнопку ран навпроти officer-processes + +image::testing:perf-test/test-preparation/carrier-perf-start.png[] + +* У Test parameters задати необхідні значення та перевірити налаштування Load configuration + +[cols="1,2"] +|=== +|Параметр |Значення + +|*VUSERS* |Кількість віртуальних користувачів +|*RAMP_UP* |Період нарощування кількості віртуальних користувачів, в секундах +|*DURATION* |Тривалість тесту, в секундах +|*ENVIRONMENTS* |Посилання на officer-portal реєстру +|*KEYCLOAK_URL* |Посилання на keycloak кластеру +|=== + +image::testing:perf-test/test-preparation/carrier-perf-params.png[] + +* Налаштувати секцію Load configuration: +** для Engine location вибрати значення mdtu +** для Runners - вибрати значення 1 або 2 + +[NOTE] +==== +Значення 2 для Runners застосовується при великому навантажені, понад 1000 віртуальних користувачів. В такому випадку в параметрі *VUSERS* має бути значення кількість віртуальних користувачів/2. + +Наприклад якщо планується тест з кількістю користувачів 1500, то в Test parameters задаємо значення VUSERS=750, а в Load configuration значення Runners=2: +==== +image::testing:perf-test/test-preparation/carrier-perf-load-config.png[] + +* Натиснути кнопку Run test у верхньому правому куту + +=== Приклади налаштувань +.Smoke test +[cols="1,1"] +|=== +|Параметр |Значення + +|*VUSERS* |10 +|*RAMP_UP* |60 +|*DURATION* |900 +|Engine location | mdtu +|*Runners* |1 +|=== + +.1500 users for an hour +[cols="1,1"] +|=== +|Параметр |Значення + +|*VUSERS* |750 +|*RAMP_UP* |1800 +|*DURATION* |3600 +|Engine location | mdtu +|*Runners* |2 +|=== \ No newline at end of file diff --git a/docs/ua/modules/arch/pages/architecture-workspace/performance/performance-tc-convention.adoc b/docs/ua/modules/arch/pages/architecture-workspace/performance/performance-tc-convention.adoc new file mode 100644 index 0000000000..4a1b90fc57 --- /dev/null +++ b/docs/ua/modules/arch/pages/architecture-workspace/performance/performance-tc-convention.adoc @@ -0,0 +1,111 @@ +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] + += Конвенція іменування кроків тест-кейсів + +В таблиці нижче наведено всі енд-поінти сервісів Платформи Реєстрів, які задіяні в автоматизованих сценаріях тестування продуктивності на _JMeter_ та відповідними назвами кроків. + +[TIP] +-- +При розширенні тестових сценаріїв ця таблиця має бути оновлена з застосуванням конвенцій для стандартизації. +-- + +[options="header"] +|=== +| Логічна група | Патерн URL | Приклад назви кроку + +.5+| Логiн / Логаут + +| ${keycloak_url}/${login_endpoint} +| [portal][login] + +| ${?}/officer/logout +| [portal][logout] + +| ${?}/officer/login +| [portal][get-login-page] + +| ${?}/officer/home +| [portal][get-home-page] + +| ${?}/officer/api/userinfo +| [portal][get-user-info] + +.4+| Критерії пошуку +| ${external-rest-api-route}/api/gateway/data-factory/${sc-name} +| [ext-system][sc:get:koatuu-obl-equals-name] + +| ${public-rest-api-route}/api/public/data-factory/${sc-name} +| [public-api][sc:get:koatuu-obl-equals-name] + +| ${registry-soap-api-route}/ws +| [trembita:soap][sc:koatuu-obl-equals-name] + +| ${registry-rest-api-route}/${sc-name} +| [portal][sc:get:koatuu-obl-equals-name] + +.3+| Процес +| ${external-rest-api-route}/business-process/api/${start\|start-with-form} +| [ext-system][bp:get-lab][start] + +| ${bp-webservice-gateway-route}/ws +| [trembita:soap][bp:get-lab][start] + +| ${user-process-management-route}/${start\|start-with-form} +| [portal][bp:get-lab][start-with-form] + +.8+| Процеси +| ${user-process-management-route}/process-definitions +| [portal][get-process-definitions] + +| ${user-process-management-route}/process-definitions/count +| [portal][get-process-definitions-count] + +| ${user-process-management-route}/history/process-instances +| [portal][get-user-history-process-instances] + +| ${user-process-management-route}/history/process-instances/count +| [portal][get-user-history-process-instances-count] + +| ${user-process-management-route}/history/tasks +| [portal][get-user-history-tasks] + +| ${user-process-management-route}/runtime/process-instances +| [portal][get-user-runtime-process-instances] + +| ${user-process-management-route}/runtime/process-instances/count +| [portal][get-user-runtime-process-instances-count] + +| ${user-process-management-route}/grouped-process-definition +| [portal][get-grouped-process-definitions] + +.3+| Задача +| ${user-task-management-route}/${process-instance-id}/${task-name}/complete +| [portal][bp:create-lab][task:fill-laboratory-data][complete] + +| ${user-task-management-route}/${process-instance-id}/${task-name}/task +| [portal][bp:create-lab][task:fill-laboratory-data][get-task] + +| ${user-task-management-route}/${process-instance-id}/${task-name}/sign-form +| [portal][bp:create-lab][task:fill-laboratory-data][sign-form] + +.5+| Задачі +| ${user-task-management-route}/task +| [portal][get-user-tasks] + +| ${user-task-management-route}/task/lightweight +| [portal][get-user-tasks-lightweight] + +| ${user-task-management-route}/task/count +| [portal][get-user-tasks-count] + +| ${user-task-management-route}/history/task +| [portal][get-user-history-tasks] + +| ${user-task-management-route}/history/task/count +| [portal][get-user-history-tasks-count] + +| Форма +| ${form-schema-provider}/${form-name}/form-by-key +| [portal][get-form-by-key] + +|=== diff --git a/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/admin-portal-localization/admin-portal-localization.adoc b/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/admin-portal-localization/admin-portal-localization.adoc new file mode 100644 index 0000000000..24de200704 --- /dev/null +++ b/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/admin-portal-localization/admin-portal-localization.adoc @@ -0,0 +1,141 @@ += Локалізація реєстру. Інтерфейс моделювання. + +== Загальний опис + +Адміністратор реєстру повинен мати можливість обрати мову для порталу моделювання реєстру. + +== Актори та ролі користувачів + +* Адміністратор платформи +* Технічний адміністратор реєстру +* Моделювальник реєстру + +== Функціональні сценарії + +* Управління налаштуванням мови реєстру у control-plane-console. +* Перегляд та використання інтерфейсу admin portal в обраній мові. + +== Загальні принципи та положення + +* Мову обирає технічний адміністратор реєстру для всіх користувачів порталу моделювання реєстру. +* Застосування змін потребує оновлення файлів у git та пере розгортання кабінетів та сервісів +* Зараз небхідно додати дві мови - англійську та українську +* За замовчуванням обрано мову платформи +** Для існуючих реєстрів значення мови не буде обрано. Необхідно інтерпретувати це значення як українську для зворотної сумісності. +* Переклади зберігаються у вигляді файлів у JSON-форматі стандартизованої структури +* Бекенд та фронтенд додатки зберігають власні JSON файли перекладу окремо + +== Компоненти системи та їх призначення в рамках дизайну рішення + +У даному розділі наведено перелік компонент системи, які задіяні або потребують змін в рамках реалізації функціональних вимог. + +|=== +|Підсистема|Компонент|Опис змін + +|Підсистема управління Платформою та Реєстрами +|*control-plane-console* +|Розширення інтерфейсу управління реєстру налаштуванням мови. + +|Підсистема управління Реєстром +|*registry-regulation-management* +|Додати локалізацію з використанням JSON файлів (зберігаються у сервісі) та локалі з env змінної. + +|Портал управління Реєстром +|*admin-portal* +|Нормалізувати переклади переклавши усі в один файл. Використовувати локаль с Config Map для вибору мови. + +|=== + +== Ключові сценарії + +=== Зміна мови реєстру + +- перехід у налаштування реєстру +- перехід на вкладку Загальне +- на цій вкладці обрати нову мову із запропонованих та зберегти зміни +- прийняти зміни та дочекатись редеплою порталів з новою env змінною та Config Map. +- сторінки тепер завантажуються новою мовою + +=== Інтерфейси адміністратора + +Зміна мови реєстру: + +image::architecture-workspace/platform-evolution/localization/registry_locale_edit.png[] + +Перегляд обраної мови: + +image::architecture-workspace/platform-evolution/localization/registry_locale_view.png[] + +== Міграція існуючих реєстрів при оновленні + +Усі існуючи реєстри не будуть мати змінної у `values.yaml`. Для цього випадку значення за замовчуванням - українська мова (`uk`). Таким чином ніяких змін для міграції вносити не потрібно. + +== Високорівневий план розробки + +=== Технічні експертизи + +* Devops +* BE (Java) +* FE (vue) +* FE (react) + +=== Дизайн рішення + +.Передача мови платформи +image::arch:architecture-workspace/platform-evolution/localization/localization_admin_portal.svg[] + +[source,yaml] +.:registry/deploy-templates/values.yaml +---- +global: + language: uk +---- + +[source,js] +.environment.js +---- +const ENVIRONMENT_VARIABLES = { + language: 'uk' + /*...*/ +}; +---- + +[source,yaml] +.registry-regulation-management/deploy-templates/templates/deployment.yaml +---- +env: + - name: LANGUAGE + value: {{ .Values.global.language }} +---- + +=== План розробки + +* Додати на вкладку `Загальне` налаштувань реєстру можливість вибору мови та обробити запит на оновлення цьєї змінної (у `values.yaml`) +** Доступні дві мови - English (en) та Українська (uk) +** Зберігати необхідно саме https://www.w3schools.com/tags/ref_language_codes.asp[HTML language codes] +* Зробити змінну обраної мови доступною: +** для registry-regulation-management як environment variable (Devops). +** частиною Config Map (`environment.js`) у common-web-app (Devops). +* На admin-portal: +** Нормалізувати переклади та перекласти їх усі в один файл +** У рамках нормалізації перекладів зробити мову Form Builder повність англійською +** Сформувати файл з англомовними перекладами +** Для кожної мови використовувати відповідну локаль (uk - Україна, en - United States) +** Значення мови за замовчуванням у разі порожнього значення з Config Map - `uk` +* На registry-regulation-management: +** додати JSON файли з перекладом (по одній на мову) +** Спираючись на мову з environment variable додати переклад до усіх текстів які може побачити користувач (enum, помилки тощо), а також додати логіку локалі до валідаційних перевірок, форматів дат тощо. +** Значення мови за замовчуванням у разі порожнього значення env змінної - `uk` +** Для кожної мови використовувати відповідну локаль (uk - Україна, en - United States) + +=== Особливості файлів з перекладом + +- Бекенд та фронтенд використовують власні файли перекладу у форматі JSON. По одному файлу на кожну мову. +- Файли перекладу розташовані у репозиторії common-web-app для admin-portal та у registry-regulation-management для системи управління реєстром +- У admin-portal (розташован у common-web-app) треба переформатувати файли перекладу та скласти усі тексти в один файл +- Частина перекладу admin-portal треба при форматуванні перекласти з web-components + +== Поза скоупом + +* Моделювальних реєстру чи адміністратор реєстру обирає свою індивідуальну мову інтерфейсу +* Локалізація пошуку у геомодулі diff --git a/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/auto-remove-on-deploy.adoc b/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/auto-remove-on-deploy.adoc new file mode 100644 index 0000000000..263f395774 --- /dev/null +++ b/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/auto-remove-on-deploy.adoc @@ -0,0 +1,164 @@ += Автоматичне застосування видалення складових регламенту до реєстру + +Для більшої частини компонентів регламенту реєстру діє правило що при видаленні елемента із регламенту він видаляється з реєстру при розгортанні регламенту. На даний час ця функціональність не реалізована для шаблонів витягів, форм, бізнес-процесів та бізнес-правил. В цьому документі описано підхід до реалізації функціональності видалення цих складових при розгортанні регламенту. + +== Функціональні сценарії +* Розгортання регламенту реєстру +* Моделювання регламенту за допомогою вебінтерфейсу + +== Ролі користувачів +* Розробник регламенту +* Адміністратор реєстру + +== Загальні положення +* Компоненти регламенту реєстру, які були видалені з регламенту, видаляються з реєстру при розгортанні регламенту. +* Дані породжені цими компонентами, такі як історія виконання бізнес-процесів, згенеровані витяги та ін., зберігаються в системі. + +== Технічне рішення + +=== Шаблони витягів +При розгортанні регламенту, утилітою `report-publisher` додатково повинні виконуватися наступні дії: + +* При виклику з аргументом `--excerpts`: +** Видаляти із БД `excerpt` ті шаблони для яких нема відповідних директорій в папці `excerpt` регламенту. +* При виклику з аргументом `--excerpts-docx` або `-- excerpts-csv`: +** Видаляти із БД `excerpt` ті шаблони для яких нема відповідних файлів в папці `excerpts-docx` чи `excerpts-csv` регламенту. +** Видаляти із бакету `excerpt-templates` файли шаблонів яких не існує в папці `excerpts-docx` чи `excerpts-csv` регламенту + +Інформація про видалення шаблонів повинна журналюватися, тобто потрапляти в лог, і бути доступною до перегляду в jenkins. + +IMPORTANT: Записи генерації витягів та статусу (*excerpt_record*) видаляти не потрібно. + +IMPORTANT: Перевірка відсутності залежностей бізнес процесів від видалених шаблонів повинна відбуватися при xref:arch:architecture/registry/administrative/regulation-management/platform-evolution/regulations-integrity/regulations-integrity.adoc[валідації регламенту перед розгортанням]. + +=== Форми + +При розгортанні регламенту, на кроці створення та оновлення форм, із сховища _сервісу постачання UI-форм_ потрібно видаляти форми яких нема в регламенті. + +Для реалізації цієї функціональності має буде створений новий метод API сервісу постачання UI-форм, який буде повертати список ідентифікаторів всіх форм що зберігаються у сховищі сервісу постачання UI-форм. + +.OpenAPI Specification (xref:attachment$architecture-workspace/platform-evolution/auto-remove-on-deploy/fsp-getList-swagger.yml[Завантажити]) +[%collapsible] +==== +swagger::{attachmentsdir}/architecture-workspace/platform-evolution/auto-remove-on-deploy/fsp-getList-swagger.yml[] +==== + +Використовуючи цей новий API, отримати список форм що встановлені у сервісі та порівняти його із списком в регламенті. Ті форми яких нема в регламенті мають бути видалені за допомогою методу `DELETE /api/forms/{key}` сервісу постачання UI-форм. + +Інформація про видалення форм повинна журналюватися, тобто потрапляти в лог, і бути доступною до перегляду в jenkins. + +Згідно з принципом найменших привілеїв, політики авторизації для цього методу мають дозволяти його виклик тільки користувачам admin реалму, зокрема користувачу `jenkins-deployer`. + +TIP: Інші методи API цього сервісу, які використовуються тільки підсистемою розгортання регламенту, можуть бути обмежені такою самою політикою. Користувачам citizen та officer реалмів доступним має залишитись тільки метод `GET /api/forms/{key}`, який використовує вебінтерфейсом кабінетів для отримання форм. + +IMPORTANT: Перевірка відсутності залежностей бізнес процесів від видалених форм повинна відбуватися при xref:arch:architecture/registry/administrative/regulation-management/platform-evolution/regulations-integrity/regulations-integrity.adoc[валідації регламенту перед розгортанням]. + +==== Вебінтерфейс моделювання регламенту + +При натисканні на кнопку _видалити форму_, додати попередження, яке інформує користувача що: + +* При розгортанні регламенту форма буде видалена з реєстру +* Якщо є бізнес-процеси які використовують цю форму, вони перестануть працювати. Це стосується також незавершених екземплярів бізнес-процесу старих версій. + +=== Бізнес-процеси та правила + +При розгортанні регламенту, на кроці створення та оновлення бізнес-процесів і правил, із _сервісу виконання бізнес-процесів_ потрібно видаляти бізнес-процеси та правила яких нема в регламенті. + +Для видалення бізнес-процесів треба виконати наступні дії: + +* Просканувати всі файли `.bpmn` в регламенті та зібрати список ідентифікаторів process definitions `` які в цих файлах присутні. +* Порівняти цей список із списком process definitions отриманим із сервісу _bpms_ (`GET /process-definition`) +* Ті process definitions, які присутні в сервісі але відсутні у файлах регламенту, видалити із сервісу. Для видалення всіх версій необхідно повторювати команду `DELETE /process-definition/key/{key}` доки вона не поверне статус 404, що вказує на відсутність процесів із цим ключем. + +Для видалення правил алгоритм такий: + +* Просканувати всі файли `.dmn` в регламенті та зібрати список ідентифікаторів правил ``, які в цих файлах присутні. +* Порівняти цей список із списком правил отриманим із сервісу _bpms_ (`GET /decision-definition`) +* Ті правила, які присутні в сервісі але відсутні у файлах регламенту, видалити із сервісу. Оскільки camunda не надає метод для видалення правил, для цього необхідно виконати декілька кроків: +. Отримати `deploymentId` правила за допомогою `GET /decision-definition/key/{key}` +. Видалити знайдений деплоймент (`DELETE /deployment/{id}`), разом з яким буде видалено і відповідне правило. +. Для видалення всіх версій необхідно повторювати команди, доки `GET /decision-definition/key/{key}` не поверне статус 404, що вказує на відсутність правил із цим ключем. + + +Інформація про видалення бізнес-процесів та правил повинна журналюватися, тобто потрапляти в лог, і бути доступною до перегляду в jenkins. + +IMPORTANT: Перевірка відсутності залежностей бізнес-процесів від видалених бізнес-процесів та правил повинна відбуватися при xref:arch:architecture/registry/administrative/regulation-management/platform-evolution/regulations-integrity/regulations-integrity.adoc[валідації регламенту перед розгортанням]. + +==== Видалення тимчасових даних бізнес-процесу + +В процедурі xref:arch:architecture/registry/operational/bpms/bpm-interim-data-storage.adoc#_автоматичне_видалення_проміжних_даних_бізнес_процесів[автоматичного видалення проміжних даних бізнес-процесів], має також оброблятись статус `INTERNALLY_TERMINATED`, з яким завершуються процеси при видаленні process definition. + +==== Оновлення статусу бізнес-процесу та його задач в історії + +Процес xref:arch:architecture/registry/operational/bpms/bpm-history.adoc#_публікація_історичних_подій[публікації історичних подій] має фіксувати періхід у статус `INTERNALLY_TERMINATED` для інстансів видаленого процесу та дату закінчення для їх задач. + +В кабінеті користувача на вкладці "Виконані послуги" послуги, що були зупинені та видалені (статус `INTERNALLY_TERMINATED`) мають відображатися з результатом "Послуга видалена із системи та більше не доступна" + +TIP:: Фіксація статусу `INTERNALLY_TERMINATED` в БД вже працює в наявній реалізації, але історічні записи з таким статусом не відображаються в кабінеті. Для задач дата закінчення наразі не проставляється, отже вони і не відображуються у "виконаних задачах" в кабінеті. + +==== Вебінтерфейс моделювання регламенту + +При видаленні бізнес процесу, при натисканні на кнопку _видалити бізнес-процес_ або при видаленні в конструкторі (коли в одному файлі декілька бізнес-процесів), додати попередження яке інформує користувача що: + +* При розгортанні регламенту, бізнес-процес буде видалений з реєстру +* Незавершені екземпляри цього бізнес-процесу будуть зупинені та видалені, включно із старими версіями. + +== Міграція + +Впровадження автоматичного видалення компонентів регламенту, які не видалялись раніше, несе певні ризики при постачанні цієї функціональності на промислові оточення. Наприклад: + +* При реалізації цієї функціональності можуть бути не враховані особливості цільового оточення які виникли в результаті ручних змін або інші специфічні властивості реєстру. +* Є шанс що реєстр в своїй роботі покладається на якісь компоненти які були видалені з регламенту, помилково чи ні, але залишаються встановленими. + +Для пом'якшення цих ризиків рекомендується при оновленні реєстру запустити процедуру розгортання регламенту, таким чином щоб спрацювали кроки розгортання форм, витягів, бізнес процесів та правил, та в рамках smoke тесту впевнитися в працездатності реєстру. + +== Компоненти системи та їх призначення в рамках дизайну рішення +У даному розділі наведено перелік компонент системи, які задіяні або потребують змін в рамках реалізації дизайну. + +|=== +|Підсистема|Компонент|Опис змін + +.3+|Підсистема розгортання регламенту реєстру +|*registry-regulations-publications-pipelines* +|Видалення моделей бізнес-процесів (_BPMN_), бізнес-правил (_DMN_) та моделей форм реєстру. + +|*report-publisher* +|Видалення шаблонів витягів + +|*registry-regulations-validator-cli* +|Валідація порушення залежностей + +.4+|Підсистема виконання бізнес-процесів +|*form-schema-provider* +|API отримання списку встановлених форм. + +|*process-history-service-api* +|Доступу до історичних даних виконання бізнес-процесів та задач користувачів + +|*bpms* +|Видалення тимчасових даних при видаленні бізнес-процесів + +|*digital-documents* +|Видалення проміжних даних / документів при видаленні бізнес-процесів + +|Підсистема моделювання регламенту реєстру +|*admin-portal* +|Попередження при видаленні бізнес-процесу чи форми + +|=== + +== Високорівневий план розробки +=== Технічні експертизи +* _DevOps_ +* _BE_ +* _FE_ + +=== Попередній план розробки +* Додавання логіки видалення шаблонів витягів у report-publisher +* Додавання API отримання списку встановлених форм у form-schema-provider +* Додавання логіки видалення форм у registry-regulations-publications-pipelines +* Додавання логіки видалення моделей бізнес процесів та бізнес-правил в registry-regulations-publications-pipelines +* Реалізація видалення тимчасових даних та запису статусу видаленого бізнес-процесу та його задач в історії +* Відображення видалених бізнес-процесів і їх задач, як завершених, в кабінетах користувачів +* Додавання попередження при видаленні бізнес-процесу чи форми в вебінтерфейсі моделювання регламенту +* Додавання валідація цілісності регламенту для тих елементів які ще не реалізовані diff --git a/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/citizen-id-gov-ua/citizen-id-gov-ua.adoc b/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/citizen-id-gov-ua/citizen-id-gov-ua.adoc index 43240137c2..e33eafd6e3 100644 --- a/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/citizen-id-gov-ua/citizen-id-gov-ua.adoc +++ b/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/citizen-id-gov-ua/citizen-id-gov-ua.adoc @@ -1,4 +1,4 @@ -= [DRAFT] Можливість налаштовувати сервіс id.gov.ua як спосіб автентифікації для отримувачів послуг на рівні реєстру += Можливість налаштовувати сервіс id.gov.ua як спосіб автентифікації для отримувачів послуг на рівні реєстру [IMPORTANT] -- @@ -9,27 +9,21 @@ При розгортанні декількох реєстрів на одному екземплярі платформи може виникати потреба в інтеграції з сервісом id.gov.ua для отримувачів послуг на рівні окремого реєстру. При цьому ключ шифрування, який є обов'язковим для використання сервісу id.gov.ua, повинен бути різним для кожного реєстру. Управління цими ключами та налаштуваннями інтеграції -повинно відбуватися через_Веб-інтерфейс управління платформою та реєстрами_. +повинно відбуватися через _Веб-інтерфейс управління платформою та реєстрами_. NOTE: Детальніше з архітектурою інтеграції з id.gov.ua можна ознайомитися https://id.gov.ua/downloads/IDInfoProcessingD.pdf[за посиланням] == Концепти -* _Ключ за замовчуванням_ _Сервісу цифрових підписів_ - ключ з яким виконується первинна ініціалізація та контекст якого -використовується для виконання операцій якщо не вказано інший ключ * _Ключ шифрування_ - ключ який використовується для інтеграції з сервісом id.gov.ua. * _Ключ підпису_ - ключ який використовується для накладання цифрового підпису системи (електронна печатка) -* _Платформена інтеграція з id.gov.ua_ - інтеграція з сервісом id.gov.ua на рівні платформи == Функціональні сценарії +* Первинне розгортання платформи _Адміністратором платформи_ (вибір даних про ключ) +* Управління ключами _Адміністратором платформи_ * Налаштування інтеграції з id.gov.ua на рівні окремого реєстру для _Кабінету отримувача послуг_ _Адміністратором реєстру_ * Налаштування інтеграції з id.gov.ua на рівні окремого реєстру для _Кабінету надавача послуг_ _Адміністратором реєстру_ -* Управління ключами _Адміністратором платформи_ -* Вибір _Ключа шифрування_ для інтеграції з id.gov.ua на рівні окремого реєстру для _Кабінету отримувача послуг_ -_Адміністратором реєстру_ зі списку попередньо зареєстрованих ключів -* Вибір _Ключа шифрування_ для інтеграції з id.gov.ua на рівні окремого реєстру для _Кабінету надавача послуг_ -_Адміністратором реєстру_ зі списку попередньо зареєстрованих ключів -* Вибір _Ключа підпису_ для реєстру _Адміністратором реєстру_ зі списку попередньо зареєстрованих ключів +* Налаштування інтеграції з id.gov.ua на рівні Платформи для _Кабінету отримувача послуг_ _Адміністратором платформи_ == Ролі користувачів * Адміністратор платформи @@ -38,16 +32,55 @@ _Адміністратором реєстру_ зі списку поперед == Загальні принципи та положення === _Сервіс цифрових підписів_ -* Доступ до всіх операцій з ключем забезпечується _Сервісом цифрових підписів_ -* _Сервіс цифрових підписів_ ініціюється з ключем за замовчуванням в контексті (поточна реалізація) -* У _Сервіс цифрових підписів_ можуть бути додані додаткові ключі з вказанням псевдоніма (alias) -* Додаткові ключі можуть бути як файловими, так і з фізичного носія (Гряда-301, Алмаз тощо) -* При виклику методів _Сервісу цифрових підписів_ можна вказати псевдонім ключа, який буде використовуватися для тієї чи -іншою операції -* Якщо псевдонім ключа не вказано, то використовується ключ за замовчуванням -* Вказати псевдонім ключа необхідно тільки для операцій, в яких результат операції залежить від контексту ключа -(наприклад, методи _/officer/verify_, _/citizen/verify_, _/owner_ не залежать від контексту ключа і результат буде -однаковий для будь-якого ключа) +* Доступ до всіх операцій з ключем та підписом забезпечується _Сервісом цифрових підписів_ +* Всі операції можна поділити на 3 групи: +** Операції з системним підписом +** Операції з шифруванням (id.gov.ua) +** Операції без контексту ключа (отримання інформації про підписанта) +* _Сервіс цифрових підписів_ може ініціалізуватися без ключа, з 1 ключем, або з декількома ключами (поточна реалізація - +1 ключ) +* Ключі можуть бути як файловими, так і з фізичного носія (Гряда-301, Алмаз тощо) +* При виклику методів _Сервісу цифрових підписів_ можна вказати назву ключа, який буде використовуватися операції +* Для зворотної сумісності _Сервіс цифрових підписів_ тимчасово буде підтримувати стару реалізацію ключа (якщо назва ключа +не передана, використовувати ключ за старим контрактом) +* Передавати назву ключа можна передавати в операціях з системним підписом та шифруванням +* В проміжному етапі _Сервіс цифрових підписів_ може працювати в одному з 4 режимів: +|=== +|Режим |Опис |Сценарій використання + +|Ключ за старим контрактом +|Єдиний ключ для сервісу який вказується в параметрах _sign.key.*_ без імені ключа +a| +* Операції системного підпису _Операційної зони реєстру_ +* Операції шифрування платформної інтеграції з id.gov.ua для _Кабінету отримувача послуг_ після оновлення +* Операції шифрування реєстрової інтеграції з id.gov.ua для _Кабінету надавача послуг_ після оновлення + +|Без ключа +|Для сервісу не вказується єдиний ключ за старим контрактом +|Встановлення платформи з нуля (первинне розгортання). Операції з отриманням власника ключа (підписанта) при +автентифікації в кабінети за допомогою віджету + +|З переліком ключів +|Новий контракт, в якому для кожного ключа потрібно вказувати ім'я ключа +|Ключі шифрування _Сервісу цифрових підписів_ після додавання через _Веб-інтерфейс управління платформою та реєстрами_ + +|З переліком ключів та ключем за старим контрактом +|Проміжний режим, який підтримує обидві конфігурації +|Перехід від ключа шифрування за старим контрактом до переліку ключів з назвою + +|=== + + +=== Керування ключами +* _Адміністратор платформи_ має можливість керувати ключами в окремій секції _Веб-інтерфейсу управління платформою та +реєстрами_ у вигляді таблиці +* Всі ключі зберігаються у _Підсистемі управління секретами та шифруванням_ +* При додаванні ключів не потрібно вказувати перелік дозволених ключів +* Секція "Дані про ключ" видалена +* Всі ключі які були додані, додаються до контексту _Сервісу цифрових підписів_ _Підсистеми управління користувачами та +ролями_ +* При ініціалізації платформи не треба вказувати ключ для _Сервісу цифрових підписів_ + === Інтеграція з id.gov.ua * Для можливості реєстрової інтеграції з id.gov.ua використовуються тіж самі реалізації автентифікатора (first login flow) @@ -58,8 +91,9 @@ _Адміністратором реєстру_ зі списку поперед * Автентифікатор посадових осіб для інтеграції з id.gov.ua так само розширюється параметром для вказання _Ключа шифрування_ * Параметр _Ключ шифрування_ може мати пусте значення. В такому випадку автентифікатор не буде передавати псевдоним -_Ключа шифрування_ в _Сервіс цифрових підписів_ і буде використовуватися _Ключ за замовчуванням_ +_Ключа шифрування_ в _Сервіс цифрових підписів_ і буде використовуватися ключ за старим контрактом * Для інтеграції з id.gov.ua на рівні реєстру додається новий ідентіті провайдер з типом _IdGovUaIdentityProviderV2_ +на рівні налаштування реалму * Для логіну в кабінет отримувача послуг може бути обраний один з 3 типів автентифікації: widget, platform-id-gov-ua та registry-id-gov-ua * Тип автентифікації задається на рівні автентифікатора _ds-citizen-authenticator_ @@ -67,23 +101,40 @@ registry-id-gov-ua "Увійти через id.gov.ua" * Кнопка формує посилання або на платформений ідентіті провайдер або на реєстровий ідентіті провайдер для id.gov.ua в залежності від обраного параметру автентифікації -* При використанні реєстрової або платформеної інтеграції з id.gov.ua не користувач все одно повинен обрати режим громадянина -або фізичної особи на сторінці в _Веб-інтерфейсі управління користувачами та ролями_ - -=== Керування ключами -* _Адміністратор платформи_ має можливість керувати ключами в окремій секції _Веб-інтерфейсу управління платформою та -реєстрами_ -* Всі ключі зберігаються у _Підсистемі управління секретами та шифруванням_ +* При використанні реєстрової або платформеної інтеграції з id.gov.ua користувач все одно повинен обрати режим фізичної +або юридичної особи на сторінці логіну * При налаштуванні Автентифікації отримувачів послуг _Адміністратор реєстру_ може вказати тип "Реєстрова інтеграція з id.gov.ua" з можливістю вказати Посилання на id.gov.ua, ідентифікатор клієнта, секрет клієнта та обрати _Ключ шифрування_ з переліку заздалегідь створених ключів _Адміністратором платформи_ * При налаштуванні Автентифікації надавачів послуг _Адміністратор реєстру_ додається необхідність обрати _Ключ шифрування_ з переліку заздалегідь створених ключів _Адміністратором платформи_ * Для раніше налаштованих інтеграцій значення в конфігурації реєстру залишається пустим і відповідний автентифікатор -використовує _Ключ за замовчуванням_. При першому редагуванні секції, потрібно буде обрати ключ з переліку +використовує ключ за старим контрактом. При першому редагуванні секції, потрібно буде обрати ключ з переліку * Якщо немає жодного ключа для вибору то _Адміністратор реєстру_ повинен бачити повідомлення про відсутність ключів і необхідність звернутися до _Адміністратора платформи_ +|=== +|Тип інтеграції |As is |Проміжне після оновлення |To be + +|Платформна інтеграція з id.gov.ua +|Використовує єдиний ключ шифрування _Сервісу цифрових підписів_ _Підсистеми управління користувачами та ролями_ +|Використовує єдиний ключ шифрування _Сервісу цифрових підписів_ _Підсистеми управління користувачами та ролями_ +|Використовує зареєстрований ключ шифрування з вказаним іменем. Налаштовується вручну + +|Реєстрова інтеграція з id.gov.ua _Кабінету надавачів послуг_ +|Використовує єдиний ключ шифрування _Сервісу цифрових підписів_ _Підсистеми управління користувачами та ролями_ +|Використовує єдиний ключ шифрування _Сервісу цифрових підписів_ _Підсистеми управління користувачами та ролями_ +|Використовує зареєстрований ключ шифрування з вказаним іменем. Налаштовується в _Веб-інтерфейсі управління платформою +та реєстрами_ + +|Реєстрова інтеграція з id.gov.ua _Кабінету отримувача послуг_ +|- +|- +|Використовує зареєстрований ключ шифрування з вказаним іменем. Налаштовується в _Веб-інтерфейсі управління платформою +та реєстрами_ +|=== + + == Високорівневий дизайн рішення .Діаграма варіантів використання @@ -92,9 +143,80 @@ image::arch:architecture-workspace/platform-evolution/citizen-id-gov-ua/use-case .Компоненти _Сервісу управління користувачами та ролями_ image::arch:architecture-workspace/platform-evolution/citizen-id-gov-ua/component-citizen-id-gov-ua.drawio.svg[] -=== Зміни в ідентіті провайдері IdGovUaIdentityProviderV2 +=== Керування ключами. Helm конфігурація + +[source,yaml] +.cluster-mgmt/deploy-templates/values.yaml +---- +digital-signature: + keys: + mvs-id-gov-ua-key: + device-type: file + file: registry-kv/cluster/key-management-20231608T063220Z + password: registry-kv/cluster/key-management-20231608T063221Z + issuer: КНЕДП ІДД ДПС + minkult-id-gov-ua-key: + device-type: hardware + type: криптомод. ІІТ Гряда-301 + device: 212:3011 (1.1.1.1) + password: registry-kv/cluster/key-management-20231608T063222Z + osplm.ini: registry-kv/cluster/key-management-20231608T063223Z +---- + +=== Сервіс цифрових підписів. Конфігурація + +[source,yaml] +.OpenShift Secret digital-signature-keys +---- +data: + mvs-id-gov-ua-key.file: <> + minkult-id-gov-ua-key.osplm.ini: <> +---- + +[source,yaml] +.OpenShift Secret digital-signature-keys-metadata +---- +data: + keys.mvs-id-gov-ua-key.device-type: file + keys.mvs-id-gov-ua-key.password: abcd1357 + keys.mvs-id-gov-ua-key.issuer: КНЕДП ІДД ДПС + keys.minkult-id-gov-ua-key.device-type: hardware + keys.minkult-id-gov-ua-key.type: криптомод. ІІТ Гряда-301 + keys.minkult-id-gov-ua-key.device: 212:3011 (1.1.1.1) + keys.minkult-id-gov-ua-key.password: "user:password" +---- -=== Контракти налаштувань в Хелм чартах +[source,yaml] +.application.yml +---- +keys-folder: /app/keys +keys: + mvs-id-gov-ua-key: + device-type: file + password: abcd1357 + issuer: КНЕДП ІДД ДПС + minkult-id-gov-ua-key: + device-type: hardware + type: криптомод. ІІТ Гряда-301 + device: 212:3011 (1.1.1.1) + password: "user:password" +---- + +=== Сервіс цифрових підписів. Rest API + +==== +swagger::{attachmentsdir}/architecture-workspace/platform-evolution/citizen-id-gov-ua/digital-signature-ops-swagger.yml[] +==== + +=== Логін для отримувачів послуг + +* При налаштуванні способу логіну отримувача послуг, identity provider, що не використовується повинен бути вимкнутий (enabled = true), або видалений +* На сторінці логіну (_signature-citizen.ftl_) реалізован загальний підхід Кейклоака з +https://github.com/keycloak/keycloak/blob/e084ce95eec0c241dcc2649909f2625e36b17e48/themes/src/main/resources/theme/base/login/login.ftl#L89[перебіркою всіх провайдерів] +та формуванні відповідних кнопок + +NOTE: Bean _socials_, який використовується на сторінці логіну не включає в себе вимкнені провайдери +https://github.com/keycloak/keycloak/blob/e084ce95eec0c241dcc2649909f2625e36b17e48/services/src/main/java/org/keycloak/forms/login/freemarker/model/IdentityProviderBean.java#L55[Keycloak GitHub] == Журнал рішень * Автентифікатори з _Підсистеми управління користувачами та ролями_ не повинні отримувати доступ до _Сервісу цифрових @@ -103,13 +225,6 @@ image::arch:architecture-workspace/platform-evolution/citizen-id-gov-ua/componen == Обсяг робіт -* Додати опис для секції _Керування платформою/Дані про ключ_ текстом, що це _Ключ за замовчуванням_ -_Сервісу цифрових підписів_ _Підсистеми управління користувачами та ролями_ _Веб-інтерфейсу управління платформою -та реєстрами_ -* Додати опис для секції _Керування платформою/Дані про ключ_ текстом, що це _Ключ за замовчуванням_ -_Сервісу цифрових підписів_ _Підсистеми управління користувачами та ролями_ _Веб-інтерфейсу управління платформою -та реєстрами_ - === Попередня декомпозиція * Як _Адміністратор Платформи_ я хочу мати можливість керувати ключами через _Веб-інтерфейсу управління платформою @@ -118,14 +233,13 @@ _Сервісу цифрових підписів_ _Підсистеми упр ** [FE] Додати можливість додавати апаратний ключ в систему ** [FE] Додати сторінку з переглядом ключів, які були внесені в систему ** [FE] Додати можливість видаляти ключ, який був внесений в систему -** [BE] Додати можливість вказувати додаткові ключі в _Сервісі цифрових підписів_ -** [BE] Додати можливість передавати псевдоним ключа в _Сервіс цифрових підписів_ при виклику методів +** [FE] Додати можливість оновлювати ключ, який був внесений в систему +** [BE] Додати можливість вказувати перелік ключів в _Сервісі цифрових підписів_ +** [BE] Додати можливість передавати назву ключа в _Сервіс цифрових підписів_ при виклику методів ** [DEVOPS] Зберігати ключ, який був доданий у систему у _Сервіс управління секретами та шифруванням_ ** [DEVOPS] Видаляти ключ, який був видалений з систему з _Сервісу управління секретами та шифруванням_ -** [DEVOPS] Зберігати ключ, який був доданий у систему як додатковий ключ у _Сервіс цифрових підписів_ _Підсистеми -управління користувачами та ролями_ -** [DEVOPS] Видаляти ключ, який був видалений з системи як додатковий ключ у _Сервісі цифрових підписів_ _Підсистеми -управління користувачами та ролями_ +** [DEVOPS] Оновлювати відповідні секрети _Сервісу цифрових підписів_ _Підсистеми управління користувачами та ролями_ +після оновлення переліку ключів * Як _Адміністратор реєстру_ я хочу мати можливість налаштовувати інтеграцію з id.gov.ua для отримувачів послуг на рівні реєстру через _Веб-інтерфейсу управління платформою та реєстрами_ @@ -133,29 +247,34 @@ _Сервісу цифрових підписів_ _Підсистеми упр з id.gov.ua" (включно з вибором ключа шифрування з переліку) ** [DEVOPS] Додати налаштування реалму _Сервісу управління користувачами та ролями_ при реєстровій інтеграції з id gov ua (identity provider, authenticator, auth flow тощо) -** [BE] Передавати псевдоним ключа при виклику методів _Сервісу цифрових підписів_ з налаштувань в IdGovUaIdentityProviderV2 +** [DEVOPS] Вимикати _citizen-id-gov-ua_ (platform) identity provider при виборі іншого типу автентифікації +** [BE] Передавати назву ключа при виклику методів _Сервісу цифрових підписів_ з налаштувань в IdGovUaIdentityProviderV2 ** [BE] Помітити реалізацію IdGovUaIdentityProvider як deprecated -** [FE/BE] Формувати посилання на кнопку "Вхід з id.gov.ua" на ідентіті провайдер який відповідає за реєстрову інтеграцію -з id.gov.ua при відповідному налаштуванні -** [BE] Додаткові потенційні зміни в автентифікаторах та ідентіті провайдері, які відповідають за реєстрову інтеграцію -(перевірити чи потрібні зміни, для того щоб не додавати нову реалізацію) +** [FE] Виводити кнопки для всіх identity provider, які присутні в реалмі +*** Зробити реалізацію як на стандартних сторінках Кейклоака +https://github.com/keycloak/keycloak/blob/main/themes/src/main/resources/theme/base/login/login.ftl[login.ftl] * Як _Адміністратор реєстру_ я хочу мати можливість обирати _Ключ шифрування_ при налаштуванні інтеграції з id.gov.ua для надавачів послуг через _Веб-інтерфейсу управління платформою та реєстрами_ ** [FE] Розширити секцію _"Автентифікація надавачів послуг"_ для типу автентифікації _id.gov.ua_ можливістю обрати ключ шифрування з переліку -** [DEVOPS] Передавати налаштування по псевдониму ключа в ідентіті провайдер по інтеграції з id.gov.ua для надавачів послуг -** [BE] Передавати псевдоним ключа при виклику методів _Сервісу цифрових підписів_ з налаштувань в IdGovUaOfficerIdentityProvider +** [DEVOPS] Передавати налаштування по назві ключа в ідентіті провайдер по інтеграції з id.gov.ua для надавачів послуг +** [BE] Передавати назву ключа при виклику методів _Сервісу цифрових підписів_ з налаштувань в IdGovUaOfficerIdentityProvider + +* Як _Адміністратор платформи_ я хочу мати можливість налаштовувати _Ключ шифрування_ при налаштуванні інтеграції +з id.gov.ua на рівні Платформи по інструкції +** [BE] Розширити інструкцію xref:admin:platform-id-gov-ua-setup.adoc[] секцією про налаштування _Ключа шифрування_ -NOTE: Всі налаштування зроблені в попередніх версіях повинні працювати і використовувати ключ за замовчуванням для шифрування +NOTE: Всі налаштування зроблені в попередніх версіях повинні працювати і використовувати ключ за старим контрактом +для шифрування === Поза скоупом * Авторизація використання конкретного ключа при виклику методів _Сервісу цифрових підписів_ -* Вказання типу додаткового ключа (шифрування/підпису) в _Сервісі цифрових підписів_ +* Вказання типу ключа (шифрування/підпису) в _Сервісі цифрових підписів_ * Обмеження _Адміністратора реєстру_ на використання певних ключів з переліку (всі ключі відкриті для використання всім _Адміністраторам реєстру_) * Налаштування _Платформеної інтеграція з id.gov.ua_ через _Веб-інтерфейс управління платформою та реєстрами_ (включно -з можливістю вибору _Ключа шифрування_ іншого від _Ключа за замовчуванням_) +з можливістю вибору _Ключа шифрування_) * Можливість вибору _Ключа підпису_ для реєстру з переліку заздалегідь створених ключів _Адміністратором платформи_ * Автоматичний редірект на сторіну id gov ua з _Кабінета отримувача послуг_ і подальший вибір режиму роботи (фізична особа/ юридична особа) diff --git a/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/dso-cert-mng/dso-cert-mng.adoc b/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/dso-cert-mng/dso-cert-mng.adoc new file mode 100644 index 0000000000..af4d8b98e0 --- /dev/null +++ b/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/dso-cert-mng/dso-cert-mng.adoc @@ -0,0 +1,291 @@ += Керування сертифікатами та параметрами взаємодії із сумісними ЦСК для Сервісу цифрових підписів + +== Загальний опис +Поточне рішення для Сервісу цифрових підписів передбачає наявність файлів зі _Списком сертифікатів сумісних центрів +сертифікації ключів (ЦСК)_ (_CACertificates.p7b_) та _Параметрами взаємодії із сумісними ЦСК_ (_CAs.json_) на файловій +системі сервісу. На цільовому оточенні ці файли монтуються за допомогою _OpenShift_ секретів, що, втім мають обмеження +в розмірі у 1MB. Потрібно розробити рішення, що б дозволило працювати з вищевказаними файлами без обмеження на розмір. + +NOTE: В цьому документі для спрощення _Список сертифікатів сумісних центрів сертифікації ключів (ЦСК)_ = файл +_CACertificates.p7b_, а _Параметри взаємодії із сумісними ЦСК_ = файл _CAs.json_ + +== Концепти +* _Список сертифікатів сумісних центрів сертифікації ключів (ЦСК)_ - файл що містить перелік сертифікатів ЦСК, що +вповноважені оформлювати _Кваліфікований Електронний Підпис_. При перевірці чи накладанні підпису відбувається перевірка, +що ключ був випущений _Акредитованим Центром Сертифікації Ключів_. Список зберігається у форматі PKCS #7 з розширенням +_.p7b_, що зазвичай має назву _CACertificates.p7b_. +* _Параметри взаємодії із сумісними ЦСК_ - файл, що містить додаткову інформацію про ЦСК, таку як _Загальне ім'я_, та +параметри доступу до серверів ЦСК (CMP, TSP та OCSP). Зазвичай має назву _CAs.json_ + +== Функціональні сценарії +* Налаштування _Списку сертифікатів сумісних центрів сертифікації ключів (ЦСК)_ та _Параметрів взаємодії із сумісними ЦСК_ +для автентифікації користувачів Адміністратором Платформи +* Налаштування _Списку сертифікатів сумісних центрів сертифікації ключів (ЦСК)_ та _Параметрів взаємодії із сумісними ЦСК_ +для перевірки підписів Адміністратором Реєстру +* Перевірка користувацького електронного підпису +* Накладання системного підпису (електронної печатки) + +== Ролі користувачів +* Адміністратор Платформи +* Адміністратор Реєстру + +== Загальні принципи та положення +* Файли _CACertificates.p7b_ та _CAs.json_ є публічно доступними по своїй природі і не містять секретної інформації +* Сервіс цифрових підписів має можливість використовувати адресу в форматі URL, за якою можна отримати файли +_CACertificates.p7b_ та _CAs.json_ +* Доступ до файлів _CACertificates.p7b_ та _CAs.json_ по URL не передбачає передачі додаткових параметрів, які не +включені в URL конфігурації. За необхідністю додаткові параметри включаються як частина URL +* Інтерфейс взаємодії Адміністратора Платформи та Адміністратора Реєстру для налаштування файлів _CACertificates.p7b_ та +_CAs.json_ у _Веб-інтерфейсі управління Платформою та реєстрами_ не змінюється +* При розгортанні реєстру файли _CACertificates.p7b_ та _CAs.json_ зберігаються в Ceph кошик з публічним доступом до файлу +* Для файлів сертифікатів створюється окремий Ceph кошик шляхом додавання ресурсу _Object Bucket Claim_ у Helm Chart +_Сервісу цифрових підписів_ +* Файли сертифікатів при оновленні перезатираються у Ceph кошику по тому самому ідентифікатору +* Імена файлів статичні та посилання на них не змінюються при оновленні +* Рішення застосовується як для _Сервісу цифрових підписів_ _Підсистеми цифрових підписів_, так і для _Підсистеми +управління користувачами та ролями_ + +== Високорівневий дизайн рішення + +.Діаграма послідовності +[plantuml, dso-cert-mng, svg] +---- +@startuml +actor "Admin" as admin +participant "Control Plane" as cp +participant "Gerrit" as gerrit +participant "Jenkins" as jenkins +participant "Cert Object\nBucket Claim" as obc +participant "Cert Bucket\nConfig Map" as cm +participant "Cert Bucket\nSecret" as secret +participant "Ceph" as ceph +participant "DSO" as dso + +admin -> cp: Update certificates +cp -> gerrit: Update certificates +jenkins -> obc: Create +obc --> secret: Create +obc --> cm: Create +dso --> cm: Read env variables from + +jenkins -> gerrit: Pull certificates +jenkins -> cm: Read +jenkins -> secret: Read +jenkins -> ceph: Save certs in bucket with public access +jenkins -> dso: Restart deployment + +dso -> ceph: Read certs + +@enduml +---- + +=== Взаємодія пайплану публікації з Ceph + +Після створення _Object Bucket Claim_ як частини Helm чарту _Сервісу цифрових підписів_ параметри доступу для нього +зберігаються у відповідних Секреті та Конфіг Мапі в тому ж неймспейсі, де і був створений _Object Bucket Claim_, які +будуть мати туж саму назву, що і _Object Bucket Claim_. + +[source,yaml] +.Object Bucket Claim dso-ca-certificates +---- +apiVersion: objectbucket.io/v1alpha1 +kind: ObjectBucketClaim +metadata: + name: dso-ca-certificates + namespace: registry-ns +spec: + generateBucketName: dso-certificates + storageClassName: registry-bucket +---- + +[source,yaml] +.Config Map dso-ca-certificates +---- +kind: ConfigMap +apiVersion: v1 +metadata: + name: dso-ca-certificates + namespace: registry-ns +data: + BUCKET_HOST: rook-ceph-rgw-mdtuddm.openshift-storage.svc + BUCKET_NAME: dso-certificates-<> + BUCKET_PORT: '80' + BUCKET_REGION: '' + BUCKET_SUBREGION: '' +---- + +[source,yaml] +.Secret dso-ca-certificates +---- +kind: Secret +apiVersion: v1 +metadata: + name: dso-ca-certificates + namespace: registry-ns +data: + AWS_ACCESS_KEY_ID: <> + AWS_SECRET_ACCESS_KEY: <> +type: Opaque +---- + +[source,bash] +.Приклад виконання операції збереження файлу у Ceph +---- +sh ' + AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY_ID \ + AWS_SECRET_ACCESS_KEY=$AWS_SECRET_ACCESS_KEY \ + AWS_DEFAULT_OUTPUT=json \ + AWS_ENDPOINT_URL=$BUCKET_HOST \ + aws s3 cp dso/config/CACertificates.p7b s3://$BUCKET_NAME/CACertificates.p7b --acl public-read +' +---- + +NOTE: В ході розробки треба переконатись, що виконання команд з Ceph не вплине на глобальну конфігурацію AWS, яка також +використовується для іншої функціональності в пайплайні + +Ім'я файлів є статичним і має значення _CACertificates.p7b_ та _CAs.json_ відповідно + +Після оновлення сертифікатів у Ceph кошику виконується рестарт Деплойменту _Сервісу Цифрових Підписів_ + +[source, bash] +---- +oc rollout restart deployment/digital-signature-ops +---- + +=== Конфігурація DSO + +Конфігурація _Сервісу цифрових підписів_ повинна включати два параметри для отримання файлів сертифікатів +(_CACertificates.p7b_) та конфігурацій доступу (_CAs.json_) по заданій адресі в форматі URL. Реалізація повинна бути +незалежної від природи зберігання файлу і можуть бути використані публічні сервери для отримання вищевказаних файлів. + +[source,yaml] +.application.yml. Конфігурація з використанням системного сховища Ceph +---- +ca: + certificates-url: http://rook-ceph-rgw-mdtuddm.openshift-storage.svc/dso-certificates-3ea4ad25-805b-4a27-8df0-c85066501937/CACertificates.p7b + config-url: http://rook-ceph-rgw-mdtuddm.openshift-storage.svc/dso-certificates-3ea4ad25-805b-4a27-8df0-c85066501937/CAs.json +---- + +[source,yaml] +.application.yml. Конфігурація з використанням публічного сервера сертифікатів +---- +ca: + certificates-url: https://eu.iit.com.ua/sign-widget/v20200922/Data/CACertificates.p7b?v=30 + config-url: https://eu.iit.com.ua/sign-widget/v20200922/Data/CAs.json?v=30 +---- +NOTE: Варіант з використанням публічного сервера сертифікатів потребує додаткових налаштувань політик мережі + +Опційно. Реалізація повинна підтримувати конфігурацію URL для файлів, в тому числі на файловій системі сервісу + +[source,yaml] +.application.yml. Конфігурація з використанням файлової системи +---- +ca: + certificates-url: file:/app/data/CACertificates.p7b + config-url: file:/app/data/CAs.json +---- + +Параметри доступу до Ceph кошика, що включають адресу s3 ендпоінта та назву бакета прокинуті в Деплоймент _Сервіс +цифрових підписів_ як змінні оточення + +[source,yaml] +.values.yaml +---- +# part of digital-signature-ops Deployment + env: + - name: CERT_BUCKET_HOST + valueFrom: + configMapKeyRef: + name: dso-ca-certificates + key: BUCKET_HOST + - name: CERT_BUCKET_NAME + valueFrom: + configMapKeyRef: + name: dso-ca-certificates + key: BUCKET_NAME +# ... +---- + +NOTE: Авторизаційна інформація доступу до кошика не використовується у _Сервісі Цифрових Підписів_ + +URL доступу до файлів винесені як параметри Helm values і мають наступні значення, які потенційно можуть бути перевизначені +на рівні реєстру (без відповідного інтерфейсу у _Веб-інтерфейсі управління Платформою та Реєстрами_) + +[source,yaml] +.values.yaml +---- +ca: + certificates-url: http://${CERT_BUCKET_HOST}/${CERT_BUCKET_NAME}/CACertificates.p7b + config-url: http://${CERT_BUCKET_HOST}/${CERT_BUCKET_NAME}/CAs.json +---- + +NOTE: Параметри прокидаються в Spring застосунок за стандартними в платформі принципом _Helm values_ -> _Config Map_ -> +_application.yml_ -> _Spring context_ + +=== Міграція +* В рамках міграції потрібно реалізувати видалення ключів _CACertificates.p7b_ та _CAs.json_ у секреті +_digital-signature-data_ в пайплайнах розгортання реєстру та платформи + +== Попередня декомпозиція +* [BE] Зміна стратегії отримання файлів сертифікатів та конфігурацій на URL у Сервісі цифрових підписів +* [BE] Зміна назв параметрів для кошиків витягів з загальних на більш конкретні (CEPH_BUCKET_HOST -> EXCERPT_BUCKET_HOST +і інші) +* [DEVOPS] Адаптація пайплайну розгортання реєстру для збереження файлів сертифікатів у Ceph кошик (registry dso) +* [DEVOPS] Адаптація пайплайну розгортання платформи для збереження файлів сертифікатів у Ceph кошик (user-mng dso) + +== Поза скоупом +* Можливість задавання URL в ручному режимі в _Веб-інтерфейсі управління Платформою та реєстрами_ +* Відмова від зберігання файлів сертифікатів у Git репозиторії реєстру +* Можливість зберегти файли сертифікатів 1 раз на платформу і задати для всіх реєстрів один і той самий URL + +== Додаток 1. Розглянуті варіанти в порівнянні +.Розгорнути +[%collapsible] +==== +|=== +|Варіант|Опис|Плюси|Мінуси|Ціна + +|Push сертифікатів на файлову систему +|Монтуємо замість секрету PV по тому ж шляху. В пайплайні по розгортанню реєстру оновлюємо сертифікати на файловій +системі +|Дешево. Швидко +|Прозорість налаштування. Може бути не очевидно, що для коректної роботи сервісу треба ще щось зробити руками на +файловій системі, хоча по факту зараз теж саме можна сказати і про секрети +|XS + +|Pull сертифікатів по публічній урлі +|Вказуємо в конфігурації УРЛ по якій скачати сертифікати при старті застосунку. Так само працює віджет +|Мінімум змін. Не треба залучати додаткові компоненти. Локальна розробка не відрізняється від запуску на оточенні +a| + * Залежність від 3rd party сервісів. Якщо сервер з сертифікатами відпаде, сервіс dso не зможе стартанути. +Але якщо він відпаде, віджет так само не буде працювати + * Додаткові динамічні network policy. + * Складність використання кастомних ланцюжків. Так потреба виникла тільки тоді, коли виникла помилка з великим розміром +секрету +|S + +|Pull сертифікатів по публічній/приватній урлі + управління сертифікатами на платформі +|Додаємо можливість адміністратору платформи вказати ланцюжки сертифікатів для платформи. Для них формується урл, який +вказується в конфігурації dso +|Адресування мінусів з попереднього пункту. Незалежність від 3rd party сервісів. Статичні network policy. Можливість +формування кастомних ланцюжків. Можливо розбити на 2 етапи +|Максимум змін, додаємо новий функціонал щоб адресувати ризик з нестабільністтю сервера з сертифікатами (спірний момент) +|M + +|Pull сертифікатів з vault/ceph +|На оточенні dso при старті забирає сертифікати з вказанням кредів доступу до vault/ceph +|Відносно дешеве рішення з точки зору розгортання. Зрозумілий підхід +|Ускладнення локального девелопменту. Або тримати декілька стратегій отримання сертифікатів +|S + +|Pull сертифікатів на файлову систему в ініт контейнері +|init контейнер на оточенні викачує сертифікати з урли/vault/ceph і скаладає на файлову систему +|Жодних змін в DSO. Локально розробка ніяк не змінюється. +a| +* Прозорість налаштування. Може бути не очевидно, що для коректної роботи сервісу треба ще щось зробити руками на +файловій системі, хоча по факту зараз теж саме можна сказати і про секрети +* Додаткова розробка init контейнеру +|M + +|=== +==== \ No newline at end of file diff --git a/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/graalvm-migration.adoc b/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/graalvm-migration.adoc new file mode 100644 index 0000000000..28a85cef01 --- /dev/null +++ b/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/graalvm-migration.adoc @@ -0,0 +1,72 @@ += Перехід до GraalVM images та оновлення Spring Boot + + +== Загальний підхід до оновлення + +=== Java +Мінімальна вимога до версії java для spring boot починаючи від https://github.com/spring-projects/spring-boot/wiki/Spring-Boot-3.0-Release-Notes[версії 3.0] - 17, але оскільки в наступній 21 LTS версії java реалізовано Virtual Threads використання яких додано з версії Spring 6, це може зменшити використання процесорних ресурсів. + +Тому цільова версія java для оновлення: 21 + +=== Spring boot +Починаючи з https://github.com/spring-projects/spring-boot/wiki/Spring-Boot-3.0-Release-Notes[spring boot 3.0] підтримується генерація інструкцій для aot-compilation, а з https://github.com/spring-projects/spring-boot/wiki/Spring-Boot-3.2-Release-Notes[spring boot 3.2] - додається підтримка virtual threads для опрацювання запитів в servlet container та для опрацювання запитів у фоні (Kafka Listeners, Task Scheduling і т.п.) + +Тому цільова версія spring boot для оновлення: 3.2 + +Таким чином тільки оновлення версій має зменшити використання процесорних ресурсів. + +Наступним кроком це побудова native image, яке за умов використання spring boot 3.2 відбувається достатньо просто, але має ряд обмежень. + +https://github.com/spring-projects/spring-boot/wiki/Spring-Boot-with-GraalVM[Загальні обмеження для native images] + +https://github.com/spring-cloud/spring-cloud-release/wiki/AOT-transformations-and-native-image-support[Обмеження Spring cloud для native image] + +[#changes] +=== Відомий перелік необхідних змін + +Для оновлення версій: + +- Міграція налаштувань в application.yaml. +- Міграція конфігурацій Spring Security. +- Міграція запитів jakarta.servlet.ServletRequest, jakarta.servlet.ServletResponse. +- Міграція Spring Cloud Sleuth на Micrometer Tracing. + +Для побудови native image: + +- Видалення log4j2 і заміна на logback. +- Видалення однакових бібліотек різних версій. + + +=== Підхід до узгодження версій + +Оскільки побудова native image вимагає одноманітних налаштувань декількох плагінів то для зменшення boilerplate коду використовується наслідування від "батьківського" pom. + +Сервіси вимагають не тільки узгодженості сторонніх бібліотек та і стартерів які розроблені в рамках платформи для цього створюється платформений "батьківський" проєкт в якому узгоджені бібліотеки і стартери + + +=== Оновлення сервісів + +Оновлення сервісів складається з міграції стартерів використаних в сервісі відповідно до версії spring boot та java і оновлення налаштувань та коду безпосередньо сервісу. Див: xref:architecture-workspace/platform-evolution/graalvm-migration.adoc#changes[перелік знаних змін] + + +=== Оновлення бібліотек та сартерів + +Версіонування стартерів з використанням spring boot 3.2 відбувається з версії 2.0.0 + +Для узгодження версій в бібліотеках та стартерах використовується імпорт "батьківського" pom spring boot. + + +=== Оцінка складності + +На прикладі user-setting-api-service оновлення security та actuator стартерів до можливості компіляції з новими версіями - 1 день + +Загальна кількість стартерів - 16 + +Попередньо стартери які не потребують міграції в конфігурацій: + +- ddm-starter-notifications +- ddm-starter-localization +- ddm-starter-database + +Оновлення коду сервісу user-setting-api-service - 0.5 дня. + +Оптимізація залежностей для компіляції native image user-setting-api-service - 0.5 дня. + + + diff --git a/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/initial-load/inital-load-signature.adoc b/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/initial-load/inital-load-signature.adoc new file mode 100644 index 0000000000..5ef1a0778a --- /dev/null +++ b/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/initial-load/inital-load-signature.adoc @@ -0,0 +1,313 @@ += Початкове завантаження даних + +== Загальний опис + +Мета завантаження історичних даних з інших джерел до реєстру на Платформі. +Історичні данні можуть бути як просто данними таблиць так і повʼязаними з ними файлами. + + +== Ролі користувачів + +* Технічний-адміністратор реєстру +* Адміністратор реєстру (_адміністратор даних_) + + +== Загальні принципи та положення + +* Підтримуються тільки завантаження даних в CSV-форматі. +* Завантаження даних може відбуватись тільки в порожні таблиці. +* Структура файла має повністю відповідати структурі таблиці. +* Завантаження відбувається в режимі streaming так, що нема необхідності завантажувати весь файл в памʼять. +* Завантаження файлів до ceph кошика тимчасового зберігання даних відбувається через s3-сумісний компонент на веб-інтерфейсі. +* Доступ з інтерфейсу адміністрування даних реєстру для додавання та видалення файлів надається тільки до кошику тимчасового зберігання. +* При первинному завантаженні даних, запис здійснюється не через процедуру. +* При первинному завантаженні даних, не застосовуються перевірки RBAC та RLS. +* Зберігання звʼязків між операційною та історичною таблицями відбувається прозоро в утиліті первинного завантаження даних таблиць. +* В один момент часу можна готуватись завантаження тільки для однієї таблиці, оскільки всі інші файли будуть переноситись як повʼязані. + + + +== Високорівневий дизайн рішення + +image::architecture-workspace/platform-evolution/initial-load/initial-load.svg[] + +=== Сервіси та їх призначення + +*Веб-інтерфейс адміністрування даних реєстру* - веб-інтерфейс для створення процесів завантаження посадових осіб та первинного завантаження даних. + +*Сервіс адміністрування даних реєстру* - сервіс який надає REST API для створення запитів на завантаження посадових осіб, завантаження первинних даних. + +*Утиліта первинного завантаження сутностей в таблиці* - утиліта яка за допомогою динамічної генерації SQL на підставі структури вхідного CSV-файлу, зберігає дані в БД підтримуючи звяʼзок таблиці сутності та історичної таблиці. + + +== Розгортання сервісів + +=== Схема розгортання + +image::architecture-workspace/platform-evolution/initial-load/deployment.svg[] + +=== Ключові сценарії взаємодії сервісів + +==== Створення адміністраторів для роботи з сервісом адміністрування даних реєстру. + +При створенні адміністраторів з роллю (_data-administrator_), вказуються додатково _ЄДРПУО_, _ДРФО_, _ПІБ_. + +image::architecture-workspace/platform-evolution/initial-load/load-phase.svg[] + +==== Створення тимчасової схеми в операційній БД + +[NOTE] +Використання цієї функціональності можливо лише для реєстрів в режимі розробки. + +Адміністратор реєстру через, адміністративний інтерфейс управління платформою (control-plane), для реєстру може увімкнути та вимкнути тимчасову схему. +При вмиканні тимчасової схеми відбувається створення схеми (`sandbox`) в операційній БД та створюється додатково вебінтерфейс перегляду даних реєстру(`pgAdmin`) та користувач з доступом тільки до цієї схеми. +А при вимиканні схема видаляється з усіма даними, користувачем та видаленням вебінтерфейсу перегляду даних реєстру. + +==== Завантаження даних в тимчасову схему + +[NOTE] +Використання цієї функціональності можливо лише для реєстрів в режимі розробки. + +Тимчасова схема використовується для розробки, і в ній дозволені прямі маніпуляції з даними, створення та видалення таблиць. Операції в цій схемі здійснюються за допомогою веб-застосунку `pgAdmin`. +Основною метою даної схеми в контексті первинного завантаження є: + +* Приведення наявних даних (історичних даних) до вигляду який відповідає сутностям в реєстрі на Платформі. + +_Наприклад: Конвертація типів, зміна структури зберігання даних тощо._ +* Побудова звʼязків між сутностями реєстру та історичними даними. _Наприклад: Використання посилання на довідники які вже використовуються реєстром на Платформі._ + +==== Завантаження даних до кошика тимчасового зберігання даних + +Завантаження CSV файлу та, при потребі, повʼязаних з даними файлів, до s3 сумісного сховища відбувається безпосередньо з веб-інтерфейс адміністрування даних реєстру. Завантаження файлів може відбуватись в декілька ітерацій. Після завантаження файлів вони відображаються в табличному вигляді. + +Також з даного інтерфейсу можливо видаляти файли. + +==== Завантаження готових даних в операційну базу реєстру + +Після завантаження даних до _кошика тимчасового зберігання даних_ відповідальна особа має вказати в яку структуру БД будуть завантажуватись дані та підписати запит своїм КЕП. + +Процес завантаження включає в себе потокову обробку файлу таким чином, що кожен рядок CSV зберігається у відповідну структуру та додатково створюється запис про вставку в історичній таблиці, при чому в якості підпису та інформації хто створив запис виступає підпис та інформація про посадову особу яка підписала запит завантаження даних. + +==== Завантаження даних з пов'язаними файлами в операційну дану реєстру + +При наявності в таблиці колонок типу файл, в значенні цієї колонки має бути шлях до цього файлу в s3-кошику. +В такому варіанті файл буде збережено до кошика для зберігання файлів та побудовано звʼязок з відповідним записом. + +== Низькорівневий дизайн сервісів + +=== Адміністративний інтерфейс управління платформою + +==== Ключові сценарії + +* Створення та видалення тимчасової схеми +* Налаштування параметрів віджета для перевірки КЕП +* Створення адміністраторів. + +==== Перемикач створення та видалення тимчасовї схеми + + + +==== Екран для конфігурації віджета + +По аналогії з кабінетом надавача і отримувача послуг створити екран _Налаштування автентифікації для адміністраторів_ в якому буде існувати тільки частина конфігурації віджета підпису. + +==== Створення адміністратора + +Розширення вікна створення адміністратора полями ЄДРПУО, ДРФО, ПІБ та поля ролі. + +[NOTE] +Зараз передбачено відокремлення тільки однієї ролі _data-administrator_ разом з тим необхідно передбачити можливість декількох ролей. + +.Схема створення адміністратора з можливістю підписання запитів на завантаження даних. +[source, yaml] +---- +administrators: + - username: admin@platform.ua + email: admin@platform.ua + firstName: Admin + lastName: Adminchenko + #Розширення конфігурації + roles: + - data-administrator + authVaultSecret: registry-kv/registry/%registry_name%/administrators/admin@platform.ua + passwordVaultSecretKey: password + edrpuoVaultSecretKey: edrpuo + drfoSecretKey: drfo + fullNameSecretKey: fullName +---- + +.edp-library-pipeline resources/templates/keycloakRealmUser.yaml +[source, yaml] +---- +apiVersion: v1.edp.epam.com/v1alpha1 +kind: KeycloakRealmUser +metadata: + name: ${resourceName} + namespace: user-management +spec: + #Розширення шаблону + attributes: + drfo: "%drfo%" + edrpuo: "%edrpuo%" + fullName: "%fullName%" + #Існуюча конфігурація + firstName: ${firstName} + lastName: ${lastName} + username: ${username} + email: ${email} + password: ${password} + realm: openshift + enabled: true + emailVerified: true + keepResource: true + roles: ${roles} + groups: ${groups} + requiredUserActions: + - UPDATE_PASSWORD +---- + + +=== Веб-інтерфейс адміністрування даних реєстру + +==== Ключові сценарії + +* Запуск процесу завантаження користувачів +* Завантаження файлів до тимчасового кошика зберігання. +* Запуск процесу завантаження даних до таблиць. + +==== Структура меню + +Передбачено два сценарії використання веб-інтерфейсу для завантаження даних або завантаження посадових осіб. + +* Завантаження даних в реєстр +** Підготовка даних +** Завантаження даних до реєстру +* Завантаження посадових осіб + +Пункт меню _Завантаження даних до реєстру_ відображається тільки для адміністраторів які мають роль _data-administrator_. + +==== Компонент по роботі з S3-кошиком + + +==== Компонент по роботі з S3-кошиком + +Компонент представляє собою існуючий drag-n-drop таблицю для файлів, з реалізацією завантаження на події компоненти. (додавання, видалення, завантаження). + +При завантаженні компонента відбувається перегляд відповідного s3-кошика. + +Для того, щоб не створювати додаткове навантаження на _Сервіс адміністрування даних реєстру_ при роботі з S3-кошиком яким міг би виступати лише як _proxy_ для _Rados Gateway_ компонент інтерфейсу працює безпосередньо з _Rados Gateway_. + +Для автентифікації JS s3-клієнта, ключ і секрет отримується запитому до _Сервісу адміністрування даних реєстру_. + +=== Сервіс адміністрування даних реєстру + +==== Ключові сценарії + +* Запуск _K8s Job_ по завантаженню. +* Отримання статусу виконання Job. +* Отримання ключа і секрета для доступу до s3-кошика. + + +==== Технічний стек +Як основний _framework_ використовується Spring Boot 3.15 та використання _Native Image_ та _in container build_. + +==== Запуск утиліти як K8s Job + +Після підписання запиту на завантаження даних + +=== Утиліта первинного завантаження сутностей в таблиці + +==== Ключові сценарії + +* Копіювання даних з тимчасового кошика зберігання даних до кошика архівного зберігання даних. +* Запис даних з _csv_ файлів до операційної БД в таблиці сутностей та історичних таблиць. + +==== Технічний стек +Як основний _framework_ використовується Spring Boot 3.15 та використання _Native Image_ та _in container build_. + + +==== Вхідні параметри + +USER_ACCESS_TOKEN - токен користувача який ініціалізував процес завантаження даних+ +TABLE_NAME - назва таблиці в яку відбувається завантаження + +CSV_FILE - назва csv файла дані з якого будуть завантажуватись в таблицю вказану в параметрі TABLE_NAME + +REQUEST_ID - ідентифікатор `X-B3-TraceId` для відслідковування + +REQUEST - JSON структура + + +==== Аудит + +Для процесу збереження + +==== Завантаження даних до операційних таблиць. + + +[source, xml] +---- + + + + + + + + + +---- + +.Приклад SCV файла +[source, csv] +---- +firstName;lastName;passport;inn +Петро;Петренко;паспорт_петренко.pdf;11111111 +Кирил;Кириленко;passports/scan.jpg;22222222 +---- + + +.Приклад організації s3-кошика init-data-load-raw для завантаження даних +[plantuml] +---- +@startsalt +{ +{T + +<&file> person.csv + +<&file> паспорт_петренко.pdf + ++<&folder> passports + +++<&file> scan.jpg +} +} +@endsalt +---- + + +Етапи завантаження даних: + +* Збереження даних в таблиці відбувається через виконання _pg copy_ динамічно формуючі _SQL_ запит. +* Для історичної таблиці окрім даних з _csv_ файлу додаються дані з токена та підпису. + + +[NOTE] +З міркувань швидкодії всі файли переносяться до сховища файлів без перевірки використання їх в даних таблиці. + +.Перенесення повʼязаних файлів +[plantuml] +---- +control "Initail data load job" as job +collections "file-ceph-bucket" as file +collections "inital-data-load-raw" as raw +database "Registry DB" as db + + +job -> raw: отримання переліку файлів +return перелік файлів +job -> job: виключення csv файлу з переліку +loop +job -> raw: отримання файлу та генерація uuid для нього +return контент файлу +job -> db: збереження відповідного uuid та назви файлу в таблицю метаданих +return створення запису +job -> file: збереження файлу з uuid в якості імені +return збережено +end +---- + +У випадку непередбачуваного переривання процесу завантаження, пов'язані файли можуть бути видалені, відповідно до таблиці метаданих. + diff --git a/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/initial-load/inital-load.adoc b/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/initial-load/inital-load.adoc new file mode 100644 index 0000000000..db33e3fd63 --- /dev/null +++ b/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/initial-load/inital-load.adoc @@ -0,0 +1,386 @@ +:page-toclevels: 4 += Первинне завантаження даних + +== Загальний опис + +Розробка реєстру на Платформі може передбачати міграцію даних з наявного реєстру або реєстрів на Платформу. +Дані в реєстрах можуть бути представлені в табличному вигляді так і мати додатково пов'язані з ними файли. +В такому випадку адміністратору реєстру необхідно завантажити ці дані до реєстру на Платформі і такі дані називаються _первинні_. + +== Ролі користувачів + +* Адміністратор реєстру + +== Загальні принципи та положення + +* Підтримуються тільки завантаження даних в CSV-форматі. +* Завантаження даних може відбуватись тільки в порожні таблиці. +* Структура файлу має повністю відповідати структурі таблиці. +* Завантаження відбувається в режимі streaming так, що нема потреби завантажувати весь файл в памʼять. +* Завантаження файлів до ceph кошика тимчасового зберігання первинних даних відбувається через s3-сумісний компонент на веб-інтерфейсі. +* Доступ з інтерфейсу адміністрування даних реєстру для додавання та видалення файлів надається тільки до кошику тимчасового зберігання. +* При первинному завантаженні даних, запис здійснюється не через процедуру. +* При первинному завантаженні даних, не застосовуються перевірки RBAC та RLS. +* Зберігання звʼязків між операційною та історичною таблицями відбувається прозоро в утиліті первинного завантаження даних таблиць. +* В один момент часу може готуватись завантаження тільки для однієї таблиці, оскільки всі інші файли будуть переноситись як пов'язані. +* В якості роздільників колонок використовується _;_ а для розділення елементів в масиві використовується кома - `,` +* Завантаження даних відбувається в одній транзакції. + + +== Високорівневий дизайн рішення + +image::architecture-workspace/platform-evolution/initial-load/initial-load.svg[] + +=== Сервіси та їх призначення + +*Вебінтерфейс адміністрування даних реєстру* - вебінтерфейс для створення процесів завантаження посадових осіб та первинного завантаження даних. + +*Сервіс адміністрування даних реєстру* - сервіс який надає REST API для створення запитів на завантаження посадових осіб, завантаження первинних даних. + +*Утиліта первинного завантаження сутностей в таблиці* - утиліта яка за допомогою динамічної генерації SQL на підставі структури вхідного CSV-файлу, зберігає дані в БД підтримуючи звязок таблиці сутності та історичної таблиці. + + +== Розгортання сервісів + +=== Схема розгортання + +image::architecture-workspace/platform-evolution/initial-load/deployment.svg[] + +=== Ключові сценарії взаємодії сервісів + +image::architecture-workspace/platform-evolution/initial-load/load-phase.svg[] + +==== Створення тимчасової схеми в операційній БД + +[NOTE] +Використання цієї функціональності можливо лише для реєстрів в режимі розробки. + +При розгортанні реєстру, створюється додаткова схема _sandbox_ та користувач з правами на створення, видалення, зміну таблиць в рамках цієї схеми. + +==== Завантаження даних в тимчасову схему + +[NOTE] +Використання цієї функціональності можливо лише для реєстрів в режимі розробки. + +Тимчасова схема використовується для розробки, і в ній дозволені прямі маніпуляції з даними, створення та видалення таблиць. Операції в цій схемі здійснюються за допомогою веб-застосунку `pgAdmin`. +Основною метою даної схеми в контексті первинного завантаження є: + +* Приведення наявних даних (історичних даних) до вигляду який відповідає сутностям в реєстрі на Платформі. + +_Наприклад: Конвертація типів, зміна структури зберігання даних тощо._ +* Побудова звʼязків між сутностями реєстру та історичними даними. _Наприклад: Використання посилання на довідники які вже використовуються реєстром на Платформі._ + +==== Завантаження даних до кошика тимчасового зберігання первинних даних + +Завантаження CSV файлу та, при потребі, повʼязаних з даними файлів, до s3 сумісного сховища відбувається безпосередньо з веб-інтерфейс адміністрування даних реєстру. Завантаження файлів може відбуватись в декілька ітерацій. Після завантаження файлів вони відображаються в табличному вигляді. + +.Структура форми для завантаження +image::architecture-workspace/platform-evolution/initial-load/scatch.png[] + +.Структура кошика тимчасового зберігання первинних даних +[plantuml] +---- +@startsalt +{ +{T + +<&folder> content + ++<&file> sidorenko_passport_scan.jpg + ++<&file> petrenko_passport_scan.jpg + ++<&file> ... + +<&file> user.csv + +} +} +@endsalt +---- + +Таким чином компонент який використовується для завантаження даних дозволяє завантажувати тільки один файл з розширенням _csv_ і завантажує його в корінь кошика. + +Компонент для завантаження пов'язаних файлів дозволяє додавати множину файлів і завантажує їх в директорію _content_ + +У випадку необхідності очистити кошик тимчасового зберігання даних передбачено окрему кнопку, яка буде видаляти весь вміст кошика після підтвердження операції. + +==== Завантаження готових даних в операційну базу реєстру + +Після завантаження даних до _кошика тимчасового зберігання первинних даних_ адміністратор реєстру має вказати в яку структуру БД будуть завантажуватись дані, та підтвердити свій вибір. + +Процес завантаження включає в себе потокову обробку файлу таким чином, що кожен рядок CSV зберігається у відповідну структуру та додатково створюється запис про вставку в історичній таблиці. В якості даних для службових полів в історичній таблиці використовується значення _admin_ для того хто зберіг дані та _initial_lodad_ для значення підписів. + +==== Завантаження даних з пов'язаними файлами в операційну дану реєстру + +Якщо сутність що завантажується містить пов'язані файли, то спочатку відбувається перенос файлів до _кошику зберігання файлів_ та збереження відповідного ідентифікатора в таблицю _ddm_initial_load_file_references_ разом з оригінальною назвою файлу. +В подальшому при переносі даних з csv до операційної БД для поля що містить файлові посилання відбувається заміна назви файлу на його ідентифікатор. + + +==== Перегляд перебігу процесу завантаження, результатів та помилок + +Все дії запуску, процесу перенесення пов'язаних файлів, результату виконання та помилок у разі їх виникнення відображаються в логах та прив'язані до ідентифікатора запиту, що запустив цей процес і доступні для перегляду в _Kibana_ + +== Низькорівневий дизайн сервісів + +=== Вебінтерфейс адміністрування даних реєстру + +==== Ключові сценарії + +* Запуск процесу завантаження посадових осіб. +* Завантаження та видалення файлів до тимчасового кошика зберігання первинних даних. +* Перегляд вмісту кошика для тимчасового зберігання первинних даних. +* Запуск процесу завантаження первинних даних до операційної БД. +* Отримання ключа і секрету для доступу до s3-кошика. + + +[plantuml] +---- +actor "Administrator" as admin +participant "Портал адміністрування\nданих реєстру" as portal +participant "Сервіс адміністрування\nданих реєстру" as be +participant "Keycloak" as k +participant "OpenShift API" as os + +admin -> portal: отримання сторінки порталу +portal -> portal: перевірка автентифікації +portal -> k: перенаправлення на сторінку автентифікації +k --> admin: форма входу по логіну і паролю +admin -> k: логін і пароль +k --> k: автентифікація +k --> portal: перенаправлення на сторінку\nз якої був здійснений вхід +portal --> admin: сторінка порталу +== Отримання ключа і секрету до s3 кошика == +admin -> portal: сторінка завантаження первинних даних +portal -> be: перевірка активних завантажень +be -> os: отримання статусу k8s job +alt job in progress +os --> be: перелік задач у виконанні +be --> portal: є задачі у виконанні +portal -> admin: сторінка з деактивованими\nкомпонентами завантаження +else +os --> be: перелік задач у виконанні +be --> portal: задачі у виконанні відсутні +portal -> be: отримання параметрів\nдля ініціалізації s3 клієнта +be -> os: отримання ключа і секрету до s3 кошика +return +be --> portal: параметри для ініціалізації клієнта +portal --> admin: сторінка з проініціалізованими\n компонентами для завантаження +end +---- + +==== Структура меню + +Передбачено два сценарії використання веб-інтерфейсу для завантаження даних або завантаження посадових осіб. + +* Завантаження первинних даних сутності реєстру. +* Завантаження посадових осіб. + +==== Компонент по роботі з S3-кошиком + +Компонент являє собою існуючий drag-n-drop таблицю для файлів, з реалізацією завантаження на події компоненти. (додавання, видалення, перегляд вмісту по ключу). + +При завантаженні компонента відбувається перегляд відповідного s3-кошика для налаштованого шляху. + +Також на компоненті налаштовується перевірка розширень файлів. + +Для того, щоб не створювати додаткове навантаження на _Сервіс адміністрування даних реєстру_ при роботі з S3-кошиком яким міг би виступати лише як _proxy_ для _Rados Gateway_ компонент інтерфейсу працює безпосередньо з _Rados Gateway_. + +Для автентифікації JS s3-клієнта, ключ і секрет отримується запитому до _Сервісу адміністрування даних реєстру_. + +=== Сервіс адміністрування даних реєстру + +==== Ключові сценарії + +* Запуск _K8s Job_ по завантаженню посадових осіб. +* Запуск _K8s Job_ по завантаженню первинних даних сутності реєстру. +* Отримання переліку таблиць доступних для завантаження. +* Отримання статусу виконання завантаження. + + +==== Технічний стек +Як основний _framework_ використовується Spring Boot 3.15 та використання _Native Image_ та _in container build_. + +==== Аудит + +Дії користувачів які фіксуються в аудиті: + +- Старт процесу завантаження посадових осіб. +- Отримання доступу до завантаження даних в s3 кошик. +- Старт процесу завантаження первинних даних. +- Статус завершення процесу завантаження первинних даних. + +==== База даних + +Для визначення переліку доступних таблиць для завантаження, сервіс адміністрування даних реєстру має доступ до схеми реєстру. + +=== Утиліта первинного завантаження сутностей в таблиці + +==== Ключові сценарії + +* Копіювання даних з тимчасового кошика зберігання даних до кошика архівного зберігання даних. +* Запис даних з _csv_ файлів до операційної БД в таблиці сутностей та історичних таблиць. + +==== Технічний стек +Як основний _framework_ використовується Spring Boot 3.15 та використання _Native Image_ та _in container build_. + + +==== Вхідні параметри + +USER_ACCESS_TOKEN - токен користувача який ініціалізував процес завантаження даних+ +TABLE_NAME - назва таблиці в яку відбувається завантаження + +CSV_FILE - назва csv файла дані з якого будуть завантажуватись в таблицю вказану в параметрі TABLE_NAME + +REQUEST_ID - ідентифікатор `X-B3-TraceId` для відслідковування + + +==== Аудит + +Дії користувачів які фіксуються в аудиті: + +- Старт процесу завантаження +- Завершення процесу завантаження + +==== База даних + +Окрім користувача з доступом до вставки даних в таблиці реєстру існує окрема таблиця _ddm_initial_load_file_references_ + +[source, sql] +---- +CREATE TABLE public.initial_load_file_references ( + id INTEGER GENERATED BY DEFAULT AS IDENTITY NOT NULL, + file_bucket_uuid UUID NOT NULL, + initial_load_file_name TEXT NOT NULL, + CONSTRAINT pk_initial_load_file_references PRIMARY KEY (id) +); +---- + +.Призначення колонок таблиці + +[cols="2,4,1"] +|=== +| *Назва колонки* | *Призначення* | *Приклад* +| id | ідентифікатор запису | 42 +| file_bucket_uuid | ідентифікатор з яким було збережено файл до кошика збереження файлів| dd969351-6255-4ae3-ab44-098ea8425c30 +| initial_load_file_name | назва файлу в csv-файлі | sidorenko_passport_scan.jpg +|=== + + +==== Завантаження даних до операційних таблиць. + + +[source, xml] +---- + + + + + + + + + +---- + +.Приклад SCV файла +[source, csv] +---- +firstName;lastName;passport;inn +Петро;Петренко;petrenko_passport_scan.jpg;11111111 +Микола;Сидоренко;sidorenko_passport_scan.jpg;22222222 +---- + + +.Приклад організації s3-кошика init-data-load-raw для завантаження даних +[plantuml] +---- + +@startsalt +{ +{T ++<&folder> content +++<&file> sidorenko_passport_scan.jpg + ++<&file> petrenko_passport_scan.jpg +++<&file> ... + +} +} +@endsalt +---- + + +Кроки завантаження даних: + +* Перенесення файлів з _initial-data-load-raw_ папки _content_ до _file-ceph-bucket_ зі зміною імені на ідентифікатор (uuid). +* Збереження в таблиці _ddm_initial_load_file_references_ відповідності імені до ідентифікатора. +* Динамічне формування запиту вставки сутностей за допомогою _pg copy_ в операційну і історичну таблицю. +* Потокове опрацювання csv файлу з заміною назви файлів на ідентифікатор за допомогою таблиці _ddm_initial_load_file_references_ +* Вставка даних в операційну таблицю та історичну таблицю. +* У випадку помилки вставки в БД, видалення файлів з _file-ceph-bucket_ за ідентифікаторами з _ddm_initial_load_file_references_ +* Видалення даних з таблиці _ddm_initial_load_file_references_ + + + +[NOTE] +З міркувань швидкодії всі файли переносяться до сховища файлів без перевірки використання їх в даних таблиці. + +.Перенесення повʼязаних файлів +[plantuml] +---- +control "Initail data load job" as job +collections "file-ceph-bucket" as file +collections "inital-data-load-raw" as raw +database "Registry DB" as db + + +job -> raw: отримання переліку файлів з директорії +return перелік файлів +loop +job -> raw: отримання файлу та генерація uuid для нього +return контент файлу +job -> db: збереження відповідного uuid та назви файлу в таблицю метаданих +return створення запису +job -> file: збереження файлу з uuid в якості імені +return збережено + +end +job -> db: отримання ідентифікаторів замість файлів +return ідентифікатори файлів +job -> raw: відкриття потоку читання csv файлу +return данні +job -> job: заміна імен файлів на ідентифікатори +job -> db: вставка +alt у разі виникнення помилки +db --> job: помилка +job -> file: видалення файлів які були\nскопійовані в рамках виконання ціїє джоби +return видалено +else +db --> job: успішне збереження +end +job -> db: видалення даних з таблиці ddm_initial_load_file_references +return видалено +---- + +У випадку непередбачуваного переривання процесу завантаження, пов'язані файли можуть бути видалені, відповідно до таблиці метаданих. + +== Високорівневий план розробки + +=== План розробки + + +* Розробка нового вебінтерфейсу +** POC для обрання drug-n-drop компонента. +** Локалізація і конфігурація логотипів та favicon +** Перенос екранів звантаження посадових осіб. +** Імплементація завантаження даних в S3 сумісний кошик. +* Розробка сервісу +** Перенос API для завантаження посадових осіб +** Імплементація точок інтеграції для отримання інформації про таблиці (інтеграція з БД) +** Імплементація точок інтеграції для отримання ключа і секрета для s3-кошика (інтеграція з OpenShift API) +* Розробка утиліти +** Реалізація переносу файлів +** Реалізація завантаження даних +** Реалізація механізму очистки кошика зберігання файлів у випадку помилок при завантаженні даних +* Адмін портал +** Видалення коду по завантаженню посадових осіб +** Переіменування згадки адмін порталу +* Control plane +** Додавання посилань на новий портал +** Зміна назви адмін порталу на екранах швидких посилань та управління розгортання компонентів реєстру. +** Додавання екрану управління розгортанням порталу управління даними реєстру +* Розгортання БД +** Створення додатковох користувачів (ролей) в Postgres та схеми на етапі розгортання реєстру. +* Логування +** Побудова Kibana Dashboard для перегляду перебігу процесу завантаження \ No newline at end of file diff --git a/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/optional-registry-nexus/optional-registry-nexus.adoc b/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/optional-registry-nexus/optional-registry-nexus.adoc new file mode 100644 index 0000000000..230602a5c5 --- /dev/null +++ b/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/optional-registry-nexus/optional-registry-nexus.adoc @@ -0,0 +1,371 @@ += Використання платформного Nexus замість реєстрового при створенні реєстру + +[IMPORTANT] +-- +Сторінка технічної документації є баченням майбутньої реалізації, актуальність якого може бути застарілою. +-- + +В цьому перехідному дизайні розглядається надання опційної можливості використання для потреб реєстру центрального сховища артефактів Платформи. + +== Актори та ролі користувачів +* Технічний адміністратор Платформи +* Технічний адміністратор реєстру +* Моделювальник регламенту реєстру + +== Загальний опис +З точки зору роботи підсистем розгортання та моделювання регламенту реєстру, необхідно мати сховище для зберігання згенерованих +артефактів реєстрових компонентів (registry-rest-api, registry-kafka-api, registry-soap-api, registry-model, bp-webservice-gateway), а саме їх +Docker образи та JAR (Java Archive) файли. + +Задля економії ресурсів реєстру (CPU, RAM) пропонується надати можливість адміністратору Платформи обирати потрібне сховище. + +== Функціональні сценарії +* Створення нового реєстру +* Розгортання регламенту реєстру +* Редагування реєстру + +== Поточна реалізація +В поточній реалізації Платформи, для виконання цієї вимоги під кожний реєстр розгортається своє власне сховище артефактів (SonarType Nexus). + +.Фрагмент діаграми взаємодії між компонентами підсистем +image::architecture-workspace/platform-evolution/optional-registry-nexus/as-is-nexus.drawio.svg[] + +[TIP] +-- +Докладніше про поточну реалізацію описано у відповідних підсистемах: + +* xref:arch:architecture/platform/administrative/config-management/overview.adoc[] +* xref:arch:architecture/registry/administrative/regulation-publication/overview.adoc[] +-- + +.Місця зберігання артефактів в реєстровому Nexus +|=== +|Тип|Назва репозиторію|Шлях|Приклад + +|Docker Image +|docker-registry +|`/v2//` +|/v2/registry-1/registry-rest-api-master-0-0-1 + +|JAR +|edp-maven-releases +|`/ua/gov/mdtu/ddm/dataplatform/template/` +|/ua/gov/mdtu/ddm/dataplatform/template/rest-api + +|=== + +== Загальні принципи та положення +* При створенні реєстру на адмін-консолі доступний вибір типу сховища артефактів (центральне або виділене реєстрове сховище). +* При редагуванні реєстру на адмін-консолі доступний вибір типу сховища артефактів (центральне або виділене реєстрове сховище). +* При зміні типу сховіща існуючі артефакти не переносяться. +* При зміні типу сховіща необхідно повідомити адміністратора про + . При зміні типу сховища, пайплайн публікацій має бути зупинений. + . Після зміни необхідно запустити пайплайн публікацій для отримання артефактів вже в новому сховищі (реєстр продовжить роботу і без цього до першого перзапуску). +* Тільки адміністратор Платформи може змінювати це налаштування. +* Зміна типу сховища не має приводити до business interruption (реєстр має продовжувати роботу після застосування). +* При обраному "центральному" сховищі, відбувається + . Налаштування відповідних компонентів в реєстрі для роботи з ним + . Видалення реєстрового Nexus +* При обраному "виділеному" реєстровому сховищі відбувається розгортання компонентів `nexus-operator` що і розгортає реєстровий nexus. +* Реєстр має свій власний maven репозиторій в Платформному сховищі Nexus. +* Реєстр не має свого власного docker репозиторію в Платформному сховищі Nexus, а використовує вже існуючий. +* Пайплайн розгортання реєстру при його створенні безумновно налаштовує також і центральне сховище артефактів підготовлюючи його для роботи з артефактами реєстру. +* При видаленні реєстру відбувається очистка всіх зроблених налаштувань платформного Nexus. + + +== Цільовий дизайн +Після розробки та впровадження цього перехідного дизайну, адміністратор Платформи буде мати можливість обрати в якості сховища артефактів наступні: + +* Центральне сховище артефактів Платформи +* Виділене реєстрове сховище артефактів + +image::architecture-workspace/platform-evolution/optional-registry-nexus/to-be-nexus.drawio.svg[] + +== UI + +На сторінках створення та редагування реєстру відображається нова таба "Сховище артефактів" з dropdown елементом і з варіантами вибору: + +* Платформне сховище +* Виділене реєстрове сховище + +.Орієнтовний mockup +image::architecture-workspace/platform-evolution/optional-registry-nexus/mockup-1.png[] + +image::architecture-workspace/platform-evolution/optional-registry-nexus/mockup-2.png[] + +[TIP] +-- +Більше мокапів можна знайти за https://www.figma.com/file/7fAv5Fv3q2PFEuvJowiFd1/Untitled?type=design&node-id=0-1&mode=design&t=qFhylGqHMCKpZ42M-0[посиланням]. +-- + +В `values.yaml` реєстру записується значення: + +[source,yaml] +---- +global: + registry: + artifactsStorage: "platform" # platform | registry +---- + +Спираючись на це значення відбувається налаштування відповідних компонентів в реєстрі та Платформі для роботи з ним, а саме: + +* Виділене реєстрове сховище — виконується розгортання реєстрового компонента `nexus-operator`, що за собою тягне всі налаштування які і виконуються наразі. +* Платформне сховище — реєстр налаштовується на роботу з центральним сховищем артефактів Платформи. + +[IMPORTANT] +-- +В інструкції по створенню резервної копії реєстру відобразити інформацію про те, що бекап реєстру з Платформним сховищем +не буде включати сгенеровані артефакти `rest-api`, `soap-api`, `kafka-api`, `bp-webservice-gateway`. Для продовження роботи після відновлення +треба буде запустити пайплайн публікації регламенту. +-- + +== Інтеграція реєстру для роботи з центральним сховищем артефактів + +Для налаштування роботи реєстру з центральним сховищем артефактів Платформи, необхідно виконати наступні кроки пайплайном розгортання реєстру: + +. Створювати maven репозиторій реєстру в центральному nexus. + * Параметризувати конфігмапу `[mdtu-ddm/infrastructure/control-plane-nexus.git]/deploy-templates/nexus-operator/templates/cm/configuration/nexus_repos_to_create.yaml` та через +`_helpers.tpl` динамічно генерувати json для створення репозиторію виключно для реєстру спираючись на перелік реєстрів в `values.yaml` Платформи. ++ +.Діаграма послідовності по роботі консолі з репозиторіями при створенні реєстру +[plantuml] +---- +actor "Технічний адміністратор\nПлатформи" as admin +participant "Адмін-консоль" as console +database "registry.git" as registry +participant "control-plane-jenkins" as cpjenkins +participant "control-plane-nexus" as cpnexus +participant "registry-nexus" as nexus + +admin -> console: Створення реєстру +alt #LightBlue З Платформним сховищем +console -> registry: Запис global.registry.artifactsStorage в values.yaml +cpjenkins -> cpnexus: Налаштування центрального Nexus +return: Налаштовано +else #LightGray З реєстровим сховищем +console -> registry: Запис global.registry.artifactsStorage в values.yaml +cpjenkins -> cpnexus: Налаштування центрального Nexus +return: Налаштовано +cpjenkins -> nexus: Розгортання реєстрового Nexus +return: Розгорнуто +end +console -> admin: "Реєстр створено" +---- ++ +.Приклад json для створення репозиторію +[source,json] +---- + { + "name": "", + "repositoryType": "maven-hosted", + "blob_store": "edp-maven", + "version_policy": "release", + "layout_policy": "strict", + "strict_content_validation": "true", + "write_policy": "allow" + } +---- ++ +[TIP] +Для тригеру реконсиляції оператора тут і надалі можна використовувати анотації Reloader в конфігмапі та Deployment. ++ +. Створювати роль з мінімально необхідним доступом (тільки до maven репозиторію реєстру та docker-registry). + * Параметризувати конфігмапу `[mdtu-ddm/infrastructure/control-plane-nexus.git]/deploy-templates/nexus-operator/templates/cm/configuration/nexus_default_roles.yaml` ++ +.Приклад json для створення ролі +[source,json] +---- + { + "id": "-role", + "name": "-role", + "description": "Read and write access to maven repository and docker-registry", + "privileges": [ + "nx-search-read", + "nx-repository-admin-maven2--*", + "nx-repository-view-maven2--*", + "nx-repository-admin-docker-docker-registry-browse", + "nx-repository-admin-docker-docker-registry-edit", + "nx-repository-admin-docker-docker-registry-add", + "nx-repository-admin-docker-docker-registry-read", + "nx-repository-view-docker-docker-registry-browse", + "nx-repository-view-docker-docker-registry-edit", + "nx-repository-view-docker-docker-registry-add", + "nx-repository-view-docker-docker-registry-read" + ], + "roles": [] + } +---- ++ +. Створювати реєстрового користувача для взаємодії з центральним nexus. + * Параметризувати конфігмапу `[mdtu-ddm/infrastructure/control-plane-nexus.git]/deploy-templates/nexus-operator/templates/cm/configuration/nexus_default_users.yaml` ++ +[source,yaml] +---- +[ + { + "username": "registry-user", + "first_name": "registry-user", + "last_name": "registry-user", + "email": "registry-user@edp.com", + "password": "", + "roles": [ + "edp-admin" + ] + } +] +---- ++ + * Або створити CR `NexusUser`: ++ +[source,yaml] +---- +apiVersion: v2.edp.epam.com/v1alpha1 +kind: NexusUser +metadata: + name: registry- + namespace: control-plane-nexus + labels: + registry: nexus +spec: + email: @ddm.com + firstName: + lastName: + ownerName: nexus + roles: + - -role + status: active + userId: @ddm.com + +---- ++ + +[TIP] +Пароль від створеного користувача буде лежати в сікреті з назвою `nexus-`. ++ +. Проініціалізувати `registry-regulation-publication-pipelines` для роботи з центральним nexus. + * Ініціалізувати екземпляр класу `Codebase` при запуску пайплайну публікацій значенням з поля `host` або поля `proxyHost` в залежності від значення `artifactsStorage` в `values.yaml` реєстру з коректним користувачем. ++ +.Необхідні для адаптації місця коду бібліотеки `registry-regulation-publication-pipelines` +[source,groovy] +---- +class DockerRegistry { + ....... + void init() { + def secretDataJson = context.platform.getAsJson("secret", NEXUS_CI_USER_SECRET)["data"] + ciUser = DecodeHelper.decodeBase64(secretDataJson["username"]) + ciUserPassword = DecodeHelper.decodeBase64(secretDataJson["password"]) + host = context.platform.getJsonPathValue("edpcomponent", "docker-registry", ".spec.url") + proxyHost = context.platform.getJsonPathValue("edpcomponent", "docker-proxy-registry", ".spec.url") + ........ +} + +class Codebase { + ....... + void setImageTag(String imageTag) { + this.imageTag = imageTag + this.imageUrl = "${context.dockerRegistry.host}/${context.namespace}/${imageName}:${imageTag}" + } + + void setImageName(String imageName) { + this.imageName = imageName + this.imageUrl = "${context.dockerRegistry.host}/${context.namespace}/${imageName}:${imageTag}" + } + ........ +} + +class BuildDockerfileImage { + void createBuildConfig() { + context.logger.info("Creating build config ${context.codebase.buildConfigName}") + context.script.sh(script: "oc new-build --name ${context.codebase.buildConfigName} " + + "--binary=true " + + "--to-docker=true " + + "--to=${context.codebase.imageUrl} " + + "--push-secret=${context.dockerRegistry.PUSH_SECRET} " + + "--build-arg=NEXUS_USR=${context.dockerRegistry.ciUser} " + + "--build-arg=NEXUS_PASS=${context.dockerRegistry.ciUserPassword}") + } +} +---- ++ +. Параметризувати `service-generation-utility` для роботи з центральним nexus. + * Параметризувати Dockerfile кожного компонента, а саме `RUN mvn deploy -B --settings settings.xml ....` + * Параметризувати settings.xml кожного компонента + * Адаптувати deployments компонентів під роботу з Платформним nexus (tags, pull secret, etc). + * Для компонента `data-model` прибрати генерування та пуш docker образу. + * Для компонентів `rest-api`, `kafka-api`, `soap-api`, `bp-webservice-gateway` прибрати пуш jar файлу в сховище Nexus (замінити mvn deploy на mvn build). +. Опційно розгортати `nexus-operator` в helmfile в залежності від контенту змінної `artifactsStorage`. +. Підтримка і запуск `CleanUp` задач в Платформному nexus очищенні або видаленні реєстру. +. Видалення всіх створених налаштувань та docker образів Платформного nexus при зміні типу сховища з Платформного на реєстрове. + +.Місця зберігання артефактів в платформному Nexus +|=== +|Тип|Назва репозиторію|Шлях|Приклад + +|Docker Image +|docker-registry +|`/v2/registries//` +|/v2/registries/registry-1/registry-rest-api-master-0-0-1 + +|JAR +|-maven-releases +|`/ua/gov/mdtu/ddm/dataplatform/template/` +|/ua/gov/mdtu/ddm/dataplatform/template/rest-api + +|=== + +== Компоненти системи та їх призначення в рамках дизайну рішення + +У даному розділі наведено перелік компонент системи, які задіяні або потребують змін в рамках реалізації дизайну. + +|=== +|Підсистема|Компонент|Модуль|Опис змін + +|Підсистема розгортання регламенту реєстру +|*registry-regulations-publications-pipelines* +|https://github.com/epam/edp-ddm-registry-regulations-publication-pipeline[github:/epam/edp-ddm-registry-regulations-publication-pipeline] +|Адаптування пайплайнів cleanup та delete registry + +|Підсистема розгортання регламенту реєстру +|*service-generation-utility* +|https://github.com/epam/edp-ddm-service-generation-utility[github:/epam/edp-ddm-service-generation-utility] +|Параметризація шаблонів компонентів + +|Підсистема розгортання та налаштування Платформи та реєстрів +|*control-plane-nexus* +|https://github.com/epam/edp-ddm-control-plane-nexus[github:/epam/edp-ddm-control-plane-nexus] +|Параметризація створення репозиторіїв, користувачів та ролей. + +|Підсистема розгортання регламенту реєстру +|*nexus-operator* +|https://github.com/epam/edp-nexus-operator[github:/epam/edp-nexus-operator] +|Параметризація розгортання реєстрового Nexus + +|Підсистема управління Платформою та реєстрами +|*control-plane-console* +|https://github.com/epam/edp-ddm-control-plane-console[github:/epam/edp-ddm-control-plane-console] +|Зміни в UI, зміни в процесах створення реєстру та merge requests. + +|=== + +== Безпека та логування +* Nexus та OKD журналюють процеси по створенню репозиторіїв, користувачів та ролей в STDOUT. Далі ці логи збираються +підсистемою моніторингу подій та сповіщення. +* Створені користувачі повинні мати мінімальний набір прав для роботи зі сховищами (включаючи pull та push користувачів). + +== Зворотна сумісність +Зміни мають бути зворотно сумісними та не порушувати роботу реєстрів що вже існують на екземплярі Платформи що оновлюється. + +Всі реєстри, що були створені до версії 1.9.8 повинні мати можливість змінити тип сховища артефактів. + +== Високорівневий план розробки +=== Технічні експертизи +* _DevOps_ +* _FE_ +* _BE_ + +=== Попередній план розробки +. Роботи по адмін-консолі +. Адаптація `nexus-operator` +. Адаптація `control-plane-nexus` +. Роботи по `registry-regulations-publications-pipelines` +. Параметризація `service-generation-utility` diff --git a/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/portals-localization/portals-localization.adoc b/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/portals-localization/portals-localization.adoc new file mode 100644 index 0000000000..7777655982 --- /dev/null +++ b/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/portals-localization/portals-localization.adoc @@ -0,0 +1,147 @@ += Локалізація реєстру. Портали користувачів. + +== Загальний опис + +Адміністратор реєстру повинен мати можливість обрати мову для порталів користувачів. + +== Актори та ролі користувачів + +* Адміністратор платформи +* Технічний адміністратор реєстру +* Посадова особа +* Отримувач послуг + +== Функціональні сценарії + +* Управління налаштуванням мови реєстру у control-plane-console. +* Перегляд та використання інтерфейсу citizen-portal та officer-portal в обраній мові. + +== Загальні принципи та положення + +* Мову обирає технічний адміністратор реєстру для всіх користувачів порталів. +* Застосування змін потребує оновлення файлів у git та пере розгортання кабінетів та сервісів +* Бекенд та фронтенд додатки зберігають власні JSON файли перекладу окремо + +== Компоненти системи та їх призначення в рамках дизайну рішення + +У даному розділі наведено перелік компонент системи, які задіяні або потребують змін в рамках реалізації функціональних вимог. + +|=== +|Підсистема|Компонент|Опис змін + +|Сервіс управління процесами користувачів +|*user-process-management* +|Додати локалізацію з використанням JSON файлів (зберігаються у сервісі) та локалі з env змінної. + +|Сервіс управління задачами користувачів +|*user-task-management* +|Додати локалізацію з використанням JSON файлів (зберігаються у сервісі) та локалі з env змінної. + +|Сервіс нотифікацій +|*notifications-service* +|Додати локалізацію з використанням JSON файлів (зберігаються у сервісі) та локалі з env змінної. + +|Сервіс управління налаштуваннями +|*user-settings-service* +|Додати локалізацію з використанням JSON файлів (зберігаються у сервісі) та локалі з env змінної. + +|Сервіс валідації форм +|*form-submission-validation* +|Додати локалізацію з використанням JSON файлів (зберігаються у сервісі) та локалі з env змінної. + +|Сервіс документів +|*document-service* +|Додати локалізацію з використанням JSON файлів (зберігаються у сервісі) та локалі з env змінної. + +|Портали користувачів +|*common-web-app* +|Нормалізувати переклади переклавши усі в один файл. Використовувати локаль с Config Map для вибору мови. + +|=== + +== Ключові сценарії + +=== Зміна мови реєстру + +- перехід у налаштування реєстру +- перехід на вкладку Загальне +- на цій вкладці обрати нову мову із запропонованих та зберегти зміни +- прийняти зміни та дочекатись редеплою порталів з новою env змінною та Config Map. +- сторінки тепер завантажуються новою мовою + +== Міграція існуючих реєстрів при оновленні + +Усі існуючи реєстри не будуть мати змінної у `values.yaml`. Для цього випадку значення за замовчуванням - українська мова (`uk`). Таким чином ніяких змін для міграції вносити не потрібно. + +== Високорівневий план розробки + +=== Технічні експертизи + +* Devops +* BE (Java) +* FE (react) + +=== Дизайн рішення + +.Передача мови платформи +image::arch:architecture-workspace/platform-evolution/localization/localization_user_portals.svg[] + +[source,yaml] +.:registry/deploy-templates/values.yaml +---- +global: + language: uk +---- + +[source,js] +.environment.js +---- +const ENVIRONMENT_VARIABLES = { + language: 'uk' + /*...*/ +}; +---- + +[source,yaml] +.user-process-management/deploy-templates/templates/deployment.yaml +---- +env: + - name: LANGUAGE + value: {{ .Values.global.language }} +---- + +=== План розробки + +* Зробити змінну обраної на реєстрі мови доступною: +** для BE сервісах (список вгорі) як environment variable (Devops). +** частиною Config Map (`environment.js`) у common-web-app для officer та citizen (Devops). +* На citizen-portal та officer-portal: +** Нормалізувати переклади та перекласти їх усі в один файл +** Сформувати файл з англомовними перекладами +** Для кожної мови використовувати відповідну локаль (uk - Україна, en - United States) +** Значення мови за замовчуванням у разі порожнього значення з Config Map - `uk` +* На BE сервісах (список вгорі): +** додати JSON файли з перекладом (по одній на мову) +** Спираючись на мову з environment variable додати переклад до усіх текстів які може побачити користувач (enum, помилки тощо), а також додати логіку локалі до валідаційних перевірок, форматів дат тощо. +** Значення мови за замовчуванням у разі порожнього значення env змінної - `uk` +** Для кожної мови використовувати відповідну локаль (uk - Україна, en - United States) + +=== Особливості файлів з перекладом + +- Бекенд та фронтенд використовують власні файли перекладу у форматі JSON. По одному файлу на кожну мову. +- Файли перекладу розташовані у репозиторії common-web-app для citizen та officer portal та у відповідних репозиторіях сервісів +- У citizen та officer portal (розташовані у common-web-app) треба переформатувати файли перекладу та скласти усі тексти в один файл + +=== Що саме перекладати у сервісах? + +- *user-process-management* - errors, enum +- *user-task-management* - errors +- *notifications-service* - errors +- *documents-service* - errors +- *user-settings-service* - errors +- *form-submission-validation* - formio errors + +== Поза скоупом + +* Користувачі обирають свою індивідуальну мову інтерфейсу +* Локалізація пошуку у геомодулі diff --git a/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/redas-analytical-postgres.adoc b/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/redash-analytical-db/redash-analytical-postgres.adoc similarity index 95% rename from docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/redas-analytical-postgres.adoc rename to docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/redash-analytical-db/redash-analytical-postgres.adoc index c5e1cf81e7..f189433d4d 100644 --- a/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/redas-analytical-postgres.adoc +++ b/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/redash-analytical-db/redash-analytical-postgres.adoc @@ -128,7 +128,7 @@ fi |Підсистема аналітичної звітності реєстру |*redash-viewer* -.2+|https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/data-architecture/devops-application/redash-chart[gerrit:/mdtu-ddm/data-architecture/devops-application/redash-chart] +.2+|https://github.com/epam/edp-ddm-redash-chart[github:/epam/edp-ddm-redash-chart] .2+|Застосування змін конфігурації бази даних: вказання використання зовнішньої бази та URL. |Підсистема моделювання регламенту реєстру @@ -151,7 +151,7 @@ fi |Підсистема розгортання регламенту реєстру |*registry-regulations-publications-pipelines* -|https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/devops/registry-regulations-publications/registry-regulations-publication-pipeline[gerrit:/mdtu-ddm/registry-regulations-publication-pipelines] +|https://github.com/epam/edp-ddm-registry-regulations-publication-pipeline[github:/epam/edp-ddm-registry-regulations-publication-pipeline] |Адаптування пайплайнів cleanup та delete registry та класу Redash. |=== diff --git a/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/typical-registry-configuration/typical-registry-configuration.adoc b/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/typical-registry-configuration/typical-registry-configuration.adoc new file mode 100644 index 0000000000..125f93e58e --- /dev/null +++ b/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/typical-registry-configuration/typical-registry-configuration.adoc @@ -0,0 +1,76 @@ += [BN-02-02][S23][A] Вибір рекомендованої конфігурації розподілення ресурсів згідно профілю реєстру через веб-інтерфейс Control Plane + +== Загальний опис +В поточній версії Платформи конфігурація ресурсів реєстру зберігається в git репозиторії і для налаштування застосовується +інтерфейс адмін-консолі або ручне конфігурування в репозиторії. Цей підхід не завжди зручний, особливо коли необхідно +задати конфігурацію для всіх компонентів реєстру. Для надання адміністратору реєстру більш зручної можливості +налаштовувати конфігурацію реєстрів необхідно впровадити типові конфігурації ресурсів реєстрів. + +== Функціональні сценарії +* Створення реєстру +* Редагування конфігурації реєстру + +== Ролі користувачів +* Адміністратор Платформи +* Адміністратор Реєстру + +== Загальні принципи та положення +. В дистрибутив Платформи Реєстрів включено набір "типових/рекомендованих" конфігурацій для розгортання реєстрів з оптимальним +використанням ресурсів згідно вимог у вигляді yaml-файлів структури, яка повторює операційну конфігурацію +** Реєстр для розробки / мінімальний +** Оперативний +** Тактичний +** Стратегічний +. Адміністратору реєстру / Платформи доступна опція вибору конфігурації ресурсів з переліку доступних +. При виборі конфігурації ресурсів з переліку, формується МР на внесення змін в операційну конфігурацію реєстру зі значеннями з цільового файлу конфігурації + +== Високорівневий дизайн рішення + +=== Мокап інтерфейсу + +.Орієнтовний UI mockup +image::architecture-workspace/platform-evolution/typical-registry-configuration/mockup1.png[] + +=== Типові конфігурації +Файл з типовою конфігурацією ресурсів реєстру являє собою частину реєстрового values.yaml з наступними параметрами: + +* `global.computeResources.*` +* `global.container.*` +* `global.istio.*` +* `global.registry.*` + +та знаходяться за шляхом в `control-plane-gerrit` репозиторії `resources/repositories/templates/registry-tenant-template.git/typical-registry-configurations`. + +=== Застосування типової конфігурації +. Адмін-консоль відображає список наявних типових конфігурацій ресурсів реєстру. +. При виборі однієї з конфігурацій, всі поля мають заповнитись відповідними значеннями з цього файлу. +. Адміністратор може відредагувати значення полів, як він вважає за потрібне або підтвердити вибір конфігурації. +. Відбувається застосування конфігурації до реєстру підсистемою розгортання на налаштування. + +== Компоненти системи та їх призначення в рамках дизайну рішення +У даному розділі наведено перелік компонент системи, які задіяні або потребують змін в рамках реалізації дизайну. + +|=== +|Підсистема|Компонент|Модуль|Опис змін + +|Підсистема управління Платформою та реєстрами +|*control-plane-console* +|https://github.com/epam/edp-ddm-control-plane-console[github:/epam/edp-ddm-control-plane-console] +|Роботи по впровадженню фунціоналу для вибору рекомендованої конфігурації ресурсів реєстру. + +|Підсистема управління Платформою та реєстрами +|*control-plane-gerrit* +|https://github.com/epam/edp-ddm-control-plane-gerrit[github:/epam/edp-ddm-control-plane-gerrit] +|Внесення в єдиний шаблон реєстру типових конфігурацій (перелік може розширюватись). + +|=== + +== Високорівневий план розробки +=== Технічні експертизи +* _DevOps_ +* _FE_ + +=== Попередній план розробки +. Розробка та впровадження рекомендованих конфігурацій ресурсів реєстрів (взяти з perf оточення) +. Розробка та впровадження веб-інтерфейсу для вибору рекомендованої конфігурації ресурсів реєстру + diff --git a/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/universal-installer/conditional-defaults.adoc b/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/universal-installer/conditional-defaults.adoc new file mode 100644 index 0000000000..514466c718 --- /dev/null +++ b/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/universal-installer/conditional-defaults.adoc @@ -0,0 +1,79 @@ += Умовне застосування значень за замовчуванням + +[NOTE] +-- +В даній статті фіксується обсяг змін що були виконані для реалізації підтримки Платформою регіонів обслуговування. +-- + +== Опис + +Задля забезпечення підтримки роботи Платформи реєстрів в різних регіонах або країнах і платформному інсталері +вводиться поняття "Регіон Платформи". Для забезпечення коректного налаштування реєстрів та Платформи під регіон, +необхідно забезпечити можливість застосовувати значення за замовчуванням в залежності від регіону. + +.Значення за замовчуванням +|=== +||*Global*|*UA* +|*Language* +|en +|uk + +|*Назва адмін-консолі (`platformName`)* +|The Platform's administrative control plane +|Адміністративна панель керування Платформою та реєстрами + +|*Логотипи (logosPath)* +|configmap:platform-logos-global-default +|configmap:platform-logos-ua-default +|=== + +== Епіки + +* _https://jiraeu.epam.com/browse/MDTUDDM-29768[[BN-08-03\][S23\][OSS\] Застосування значень за замовчуванням для налаштувань в залежності від обраного регіону обслуговування для Платформи та реєстрів_] + +== Функціональні сценарії +* Розгортання реєстру +* Розгортання Платформи + +== Зміни в підсистемах + +|=== +|Підсистема|Компонент|Зміна +.2+|Підсистема управління Платформою та реєстрами +.2+|Веб-інтерфейс управління Платформою та реєстрами (_control-plane_) +|Додавання конфігмапи з відповідними дефолтними логотипами для Global регіону. Взяти логотип з https://epam.github.io/edp-ddm-architecture/[документації]. + +|Перейменування `platform-logos-default` в `platform-logos-ua-default` + +|Підсистема управління Платформою та реєстрами +|`_control-plane-gerrit_` +|Перенесення змінних `platformName`, `language`, `logosPath` в `values.gotmpl` та застосування значень в залежності від регіону. + +|Jenkins бібліотеки +|edp-library-stages-fork +|Застосування цих значень за замовчуванням для CICD2 оточення. + +|=== + +== Поза скоупом + +|=== +|Підсистема|Компонент|Зміна|Коментар +|— +|— +|— +|— +|=== + +== Вплив на підсистеми + +|=== +|Підсистема|Компонент|Опис +|— +|— +|— +|=== + +== Перелік git-комітів + +Для відстеження MR зі змінами використовувати https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/q/status:merged+-is:wip+branch:master+MDTUDDM-29768[фільтр]. diff --git a/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/universal-installer/demo-regulation-global.adoc b/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/universal-installer/demo-regulation-global.adoc new file mode 100644 index 0000000000..2dc8c8e327 --- /dev/null +++ b/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/universal-installer/demo-regulation-global.adoc @@ -0,0 +1,16 @@ += Адаптація регламенту демо-реєстру + +[NOTE] +-- +В даному розділі ми фіксуємо обсяг змін, які було виконано для реалізації підтримки Платформою регіонів обслуговування: + +* Епіки (для відслідковування комітів в майбутньому) +* Функціональні сценарії +* Підсистеми, які підлягають зміні +* Компоненти підсистем, які підлягають зміні +* Суть змін / перелік дизайн-рішень у вигляді баллет-поінтів +-- + +== Епіки + +* _[BN-08-03][S23][OSS] Розробка регламенту та розгортання демо-реєстру в залежності від обраного регіону обслуговування_ \ No newline at end of file diff --git a/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/universal-installer/ext-systems-simulation.adoc b/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/universal-installer/ext-systems-simulation.adoc new file mode 100644 index 0000000000..4f507f336a --- /dev/null +++ b/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/universal-installer/ext-systems-simulation.adoc @@ -0,0 +1,55 @@ += Адаптація "Підсистеми симуляції API зовнішніх систем + +[NOTE] +-- +В даній статті фіксується обсяг змін що були виконані для реалізації підтримки Платформою регіонів обслуговування. +-- + +== Опис + +На екземплярі Платформи, який обслуговує _global_-регіон не має необхідності в розгортанні кастомних мок-сервісів, оскільки всі мокові інтеграції за необхідності будуть налаштовані на рівні регламенту з використанням _Wiremock_-специфікацій. + +== Епіки + +* _https://jiraeu.epam.com/browse/MDTUDDM-29661[[BN-08-03\][S23\][OSS\] Адаптація "Підсистеми симуляції API зовнішніх систем" згідно налаштованого регіону обслуговування]_ + +== Функціональні сценарії + +* Встановлення Платформи реєстрів +* Розгортання, конфігурування та оновлення компонентів Платформи та реєстрів + +== Зміни в підсистемах + +|=== +|Підсистема|Компонент|Зміна + +|_Підсистеми симуляції API зовнішніх систем_ +a|_external-integration-mocks_: + +* Віджет симуляції підпису даних (_sign-widget-mock_) +* Мок-сервіс інтеграції з ЄДР (_trembita-edr-registry-mock_) +* Мок-сервіс інтеграції з ДРАЦС (_trembita-dracs-registry-mock_) +* Мок-сервіс інтеграції з ЄІБДВПО (_trembita-idp-mock-server_) + +|При розгортанні екземпляра Платформи в _global_-регіоні / при зміні налаштування регіону на _global_ в операційній конфігурації Платформи не мають розгортатись мок-сервіси + +|=== + +== Поза скоупом + +|=== +|Підсистема|Компонент|Зміна|Коментар + +|_Підсистеми симуляції API зовнішніх систем_ +|_external-integration-mocks_ +|На екземплярі Платформи, яка обслуговує _global_-регіон, не має створюватись _external-integration-mocks_ namespace +|Поза скоупом поточних робіт по адаптації +|=== + +== Вплив на підсистеми + +Прямий вплив на інші підсистеми відсутній. За необхідності, мокування зовнішніх систем має бути реалізовано на рівні регламенту з використанням _Wiremock_-специфікацій. + +== Перелік git комітів + +Для відстеження MR зі змінами використовувати https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/q/status:open+-is:wip+MDTUDDM-29661[фільтр]. diff --git a/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/universal-installer/platform-config-management.adoc b/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/universal-installer/platform-config-management.adoc new file mode 100644 index 0000000000..c47a68908b --- /dev/null +++ b/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/universal-installer/platform-config-management.adoc @@ -0,0 +1,41 @@ += Адаптація "Підсистеми розгортання та налаштування Платформи та реєстрів" + +[NOTE] +-- +В даній статті фіксується обсяг змін що були виконані для реалізації підтримки Платформою регіонів обслуговування. +-- + +== Епіки + +* _[BN-08-03][S23][OSS] Адаптація "Підсистеми розгортання та налаштування Платформи та реєстрів" згідно налаштованого регіону обслуговування_ + +== Опис + +== Зміни в підсистемах +|=== +|Підсистема|Компонент|Зміна + +|=== + +== Поза скоупом + +|=== +|Підсистема|Компонент|Зміна|Коментар +|Всі +|Всі +|Прибирання специфічної тільки для UA регіону логіки. +|Буде зроблено в другому етапі адаптування Платформи під OSS. +|=== + +== Вплив на підсистеми + +|=== +|Підсистема|Компонент|Опис +|... +|... +|... +|=== + +== Перелік git-комітів + +Для відстеження MR зі змінами використовувати https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/q/status:merged+-is:wip+branch:master+MDTUDDM-...[фільтр]. diff --git a/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/universal-installer/platform-control-plane.adoc b/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/universal-installer/platform-control-plane.adoc new file mode 100644 index 0000000000..b47fc5ba91 --- /dev/null +++ b/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/universal-installer/platform-control-plane.adoc @@ -0,0 +1,90 @@ += Адаптація "Підсистеми управління Платформою та реєстрами" + +[NOTE] +-- +В даній статті фіксується обсяг змін що були виконані для реалізації підтримки Платформою регіонів обслуговування. +-- + +== Опис + +Для адаптації Підсистеми управління Платформою та реєстрами під роботу в глобальному регіоні, функціонал специфічний для UA регіону +залишається, але частина UI приховується, а BE частина працює за feature toggle орієнтуючись на змінну +`global.region`, що була додана в епіку _https://jiraeu.epam.com/browse/MDTUDDM-28890[[BN-08-03\][S23\][OSS\]Розширення інсталятора Платформи можливістю задати регіон обслуговування_] + +== Епіки + +* _[BN-08-03][S23][OSS] https://jiraeu.epam.com/browse/MDTUDDM-28891[Розширення веб-інтерфейсу "Підсистеми управління Платформою та реєстрами" підтримкою регіону обслуговування_] + +== Функціональні сценарії +* Створення нового реєстру +* Редагування конфігурації реєстру +* Редагування конфігурації Платформи + +== Зміни в підсистемах + +|=== +|Підсистема|Компонент|Розділ|Зміна + +.10+|Підсистема управління Платформою та реєстрами +.9+|Веб-інтерфейс управління Платформою та реєстрами (_control-plane_) +|Платформа +|Вимкнути секції _"Дані про ключ"_ та _"Дані для перевірки підписів"_ при редагуванні. + +.8+|Реєстр + +|Вимкнути секцію _"ШБО Трембіта"_ при створенні або редагуванні. + +|Вимкнути секції "_Дані про ключ_" та _"Дані для перевірки підписів"_ при створенні або редагуванні + +|Вимкнути розділ "_Перевірка даних в ЄДР_" в секції "_Кабінет отримувача послуг_" при створенні або редагуванні + +|Вимкнути розділ "_Тип автентифікації_" в секції "_Кабінет отримувача послуг_" при створенні або редагуванні + +|Вимкнути розділ "_Віджет підпису документів_" в секції "_Кабінет отримувача послуг_" при створенні або редагуванні + +|Вимкнути розділ "_Управління доступом_" в секції "_Кабінет надавача послуг_ при створенні або редагуванні" (Налаштування віджету та налаштування доступом) + +|Вимкнути розділ "Налаштування взаємодії з реєстрами через трембіту" на сторінці перегляду інформації про реєстр. + +|Вимкнути розділ "Налаштування самореєстрації посадових осіб" в секції "_Кабінет надавача послуг_ при створенні або редагуванні" + +|=== + +== Поза скоупом + +|=== +|Підсистема|Компонент|Зміна|Коментар +|Підсистема управління Платформою та реєстрами +|Веб-інтерфейс управління Платформою та реєстрами (_control-plane_) +|Налаштування таймзони +|Залишається Київська тамйзона. Буди реалізовано в рамках іншого епіку. + +|Підсистема розгортання та налаштування Платформи та реєстрів +|Компонент реєстрової конфігурації +|Адаптація конфігурації розгортання реєстрів під регіон +|Буде зроблена в епіку [BN-08-03][S23][OSS] https://jiraeu.epam.com/browse/MDTUDDM-29665[Адаптація "Підсистеми розгортання та налаштування Платформи та реєстрів" згідно налаштованого регіону обслуговування]. + +|Jenkins бібліотеки +|edp-library-stages-fork +|Розгортання реєстрової та кластерної конфігурації. +|Буде зроблена в епіку [BN-08-03][S23][OSS] https://jiraeu.epam.com/browse/MDTUDDM-29665[Адаптація "Підсистеми розгортання та налаштування Платформи та реєстрів" згідно налаштованого регіону обслуговування]. + +|=== + +== Вплив на підсистеми + +|=== +|Підсистема|Компонент|Опис +|Підсистема розгортання та налаштування Платформи та реєстрів +|Компонент реєстрової конфігурації (_registry-configuration_) +|Розгортання реєстрової конфігурації + +|Jenkins бібліотеки +|edp-library-stages-fork +|Розгортання реєстрової та кластерної конфігурації. + +|=== + +== Перелік git-комітів + +Для відстеження MR зі змінами використовувати https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/q/status:merged+-is:wip+branch:master+MDTUDDM-28891[фільтр]. diff --git a/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/universal-installer/platform-installer.adoc b/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/universal-installer/platform-installer.adoc new file mode 100644 index 0000000000..ab8f28c6d1 --- /dev/null +++ b/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/universal-installer/platform-installer.adoc @@ -0,0 +1,82 @@ += Адаптація "Компоненти керування станом ресурсів Платформи" + +[NOTE] +-- +В даній статті фіксується обсяг змін що були виконані для реалізації підтримки Платформою регіонів обслуговування. +-- + +== Опис +Задля забезпечення підтримки роботи Платформи реєстрів в різних регіонах або країнах і платформному інсталері +вводиться поняття "Регіон Платформи". Впроваджується можливість при встановленні Платформи вказати регіон обслуговування, +передати його на рівень конфігурації реєстрів та самої Платформи, а також, розгортання тестового оточення на CICD2 з +можливістю вказання регіону обслуговування. + +== Епіки +* _https://jiraeu.epam.com/browse/MDTUDDM-28890[[BN-08-03\][S23\][OSS\]Розширення інсталятора Платформи можливістю задати регіон обслуговування_] + +== Функціональні сценарії +* Встановлення Платформи реєстрів +* Оновлення Платформи реєстрів +* Розробка та тестування Платформи реєстрів + +== Зміни в підсистемах + +|=== +|Підсистема|Компонент|Зміна + +.3+|Компонент керування станом ресурсів Платформи +.3+|`_control-plane-installer_` +|Реалізація можливості передати регіон обслуговування в інсталяційний образ Платформи. + +|Обробка регіону обслуговування та його застосування в конфігурації `cluster-mgmt` та `registry-tenant-template`. + +|Привести всі вхідні параметри оточення до єдиного стилю написання. + +.3+|Jenkins бібліотеки +.3+|`_edp-library-stages-fork_` +|Адаптація jenkins stages (prepare-helmfile) для розгортання Платформи та реєстрів обробкою переданого з пайплайну обраного регіону та передання його в values чартів. + +|Обробка регіону обслуговування та його застосування в конфігурації `cluster-mgmt` та `registry-tenant-template` на CICD2. + +|Привести всі вхідні параметри оточення в інсталяторі до єдиного стилю написання. + +.2+|Підсистема управління Платформою та реєстрами +|`_control-plane-gerrit_` +|Привести всі вхідні параметри оточення до єдиного стилю написання. + +|`control-plane-console` +|Адаптація по роботі з values під час створення МР + +|Оточення розробки платформи CI/CD2 +|`_devops-technical_` +|Адаптація jenkins job-provisioners додаванням нового параметра регіону. Створення нового тестового оточення без UA-oriented quality gates через EDP консоль. + +|=== + +== Поза скоупом + +|=== +|Підсистема|Компонент|Зміна|Коментар +|Всі підсистеми +|Всі компоненти реєстрів та Платформи +|Адаптація компонента до роботи з регіонами обслуговування. +|- + +|Компонент керування станом ресурсів Платформи +|`_control-plane-installer_` +|Прибирання обовʼязкових сертифікатів для розгортання Платформи. +|Буде виконано в рамках епіку https://jiraeu.epam.com/browse/MDTUDDM-29640[по покращенню інсталлятора Платформи]. + +|=== + +== Вплив на підсистеми + +|=== +|Підсистема|Компонент|Опис +|Впливає на всі підсистеми і реєстру і Платформи. +|Впливає на всі компоненти і реєстру і Платформи. +|Передається нове значення регіону обслуговування в конфігурацію та у всі чарти компонентів. +|=== + +== Перелік git-комітів +Для відстеження MR зі змінами використовувати https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/q/status:merged+-is:wip+branch:master+MDTUDDM-28890[фільтр]. diff --git a/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/universal-installer/platform-user-management.adoc b/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/universal-installer/platform-user-management.adoc new file mode 100644 index 0000000000..838280e4de --- /dev/null +++ b/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/universal-installer/platform-user-management.adoc @@ -0,0 +1,79 @@ += Адаптація "Підсистеми управління користувачами та ролями" + +[NOTE] +-- +В даній статті фіксується обсяг змін що були виконані для реалізації підтримки Платформою регіонів обслуговування. +-- + +== Опис +Для автентифікації в кабінети надавача та отримувача послуг для глобального регіону використовувати вхід по паролю +замість автентифікації по КЕП та _id.gov.ua__ + +== Епіки +* _https://jiraeu.epam.com/browse/MDTUDDM-28892[[BN-08-03\][S23\][OSS\] Адаптація "Підсистеми управління користувачами та ролями" згідно налаштованого регіону обслуговування]_ + +== Функціональні сценарії +* Логін в кабінет надавача послуг +* Логін в кабінет отримувача послуг +* Самореєстрація отримувача послуг при першому вході в кабінет +* Самореєстрація надавача послуг при першому вході в кабінет +* Створення облікових записів надавачів послуг через csv файл + +== Зміни в підсистемах +|=== + +|Підсистема|Компонент|Зміна + +.7+|Підсистема управління користувачами та ролями + +.6+|Сервіс управління користувачами та ролями (_keycloak_) +|Використання стандартного флоу авторизації по паролю +|Використання _Hardcoded claim_ _attribute mapper_ для додавання фіктивних значень полів _drfo_ та _edrpou_ в токен +авторизації +|Створення та використання окремого _attribute mapper_ для додавання поля _fullName_ в токен авторизації, шляхом конкатенації _firstName_ +та _lastName_ користувача +|Налаштування режиму самореєстрації в _keycloak_ (інструкція) +|Додавання системних ролей _officer_ та _citizen_ за замовчуванням на рівні відповідного ріалму (інструкція) +|Вимкнення ідентіті провайдерів на рівні ріалмів + +|Сервіс цифрових підписів (_digital_signature_ops_) +|Повне вимкнення (не розгортати) для глобального регіону + +|=== + +== Поза скоупом + +|=== + +|Підсистема|Компонент|Зміна|Коментар + +|Підсистема управління Платформою та реєстрами +|Веб-інтерфейс управління Платформою та реєстрами (_control-plane_) +|Вимкнути секції _Дані про ключ_ та _Дані для перевірки підписів_ у налаштуваннях платформи +|У скоупі xref:arch:architecture-workspace/platform-evolution/universal-installer/platform-control-plane.adoc[] + +|Підсистема моделювання регламенту реєстру +|Веб-інтерфейс моделювання регламенту (_admin-portal_) +|Вимкнення розділу "Управління користувачами" +|У скоупі xref:arch:architecture-workspace/platform-evolution/universal-installer/regulation-management.adoc[] + +|=== + +== Вплив на підсистеми + +|=== +|Підсистема|Компонент|Зміна + +|Підсистема виконання бізнес-процесів +|Сервіс виконання бізнес-процесів (_bpms_) +|Фіктивні значення атрибутів _edrpou_ та _dfro_ при використанні juel функцій _completer_ та _initiator_ + +|Підсистема управління даними реєстру +|Операційна БД реєстру (_registry_) +|Зберігання фіктивної інформації про персону, що змінювала запис (фіктивний _dfro_ з авторизаційного токену) + +|=== + +== Перелік git комітів + +Для відстеження MR зі змінами використовувати https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/q/status:open+-is:wip+MDTUDDM-28892[фільтр]. \ No newline at end of file diff --git a/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/universal-installer/registry-digital-signatures.adoc b/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/universal-installer/registry-digital-signatures.adoc new file mode 100644 index 0000000000..b496515ca3 --- /dev/null +++ b/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/universal-installer/registry-digital-signatures.adoc @@ -0,0 +1,85 @@ += Адаптація "Підсистеми цифрових підписів" + +[NOTE] +-- +В даній статті фіксується обсяг змін що були виконані для реалізації підтримки Платформою регіонів обслуговування. +-- + +== Опис +Для глобального регіону функціонал по формуванню і перевірки цифрових підписів залишається, але реалізація містить +формування фіктивного підпису, та емуляції перевірки, яке постійно буде мати позитивний результат. + +== Епіки +* _https://jiraeu.epam.com/browse/MDTUDDM-29385[[BN-08-03\][S23\][OSS\] Адаптація "Підсистеми цифрових підписів" згідно налаштованого регіону обслуговування]_ + +== Функціональні сценарії +* Накладання цифрового підпису користувачем в кабінеті +* Перевірка цифрового підпису користувача +* Накладання системного підпису (електронної печатки) при вставці даних в реєстр +* Накладання системного підпису (електронної печатки) на витяги реєстру +* Формування історичного витягу для перевірки змін над записом в реєстрі + +== Зміни в підсистемах +|=== + +|Підсистема|Компонент|Зміна + +.2+|Підсистема цифрових підписів +.2+|Сервіс цифрових підписів (_digital-signature-ops_) +|Реалізація режиму заглушки, в якому всі методи повертають фіктивні дані в незалежності від вхідних параметрів +|Сервіс запускається без ключа та сертифікатів АЦСК + +.2+|Підсистема кабінетів користувачів +|Кабінет надавача послуг (_officer-portal_) +|Віджет підпису реалізовано в режимі заглушки, який формує статичну строку при натисканні на кнопку підпису на задачах + +|Кабінет отримувача послуг (_citizen-portal_) +|Віджет підпису реалізовано в режимі заглушки, який формує статичну строку при натисканні на кнопку підпису на задачах + +|=== + +== Поза скоупом + +|=== + +|Підсистема|Компонент|Зміна|Коментар + +|Підсистема виконання бізнес-процесів +|Сервіс виконання бізнес-процесів (_bpms_) +|Виключення JUEL-функцій, пов'язаних з валідацією підпису +|Поза скоупом 1 версії адаптації + +|Підсистема моделювання регламенту реєстру +|Веб-інтерфейс моделювання регламенту (_admin-portal_) +|Виключення зі списку підказок JUEL-функцій, пов'язаних з валідацією підпису +|У скоупі xref:arch:architecture-workspace/platform-evolution/universal-installer/regulation-management.adoc[] + + +|=== + +== Вплив на підсистеми + +|=== +|Підсистема|Компонент|Зміна + +.2+|Підсистема виконання бізнес-процесів + +|Сервіс управління задачами користувача (_user-task-management_) +|Фіктивна перевірка підпису при виконанні задачі користувача + +|Сервіс виконання бізнес-процесів (_bpms_) +|Фіктивне накладання системного підпису + +.2+|Підсистема формування витягів реєстру + +|Сервіс генерації PDF витягів (_excerpt-worker_) +|Фіктивне накладання підпису на витяг (фактична його відсутність) + +|Утіліта генерації історичних витягів (_history-excerptor_) +|Фіктивні значення у звіті про користувача, що виконував зміни над даними + +|=== + +== Перелік git комітів + +Для відстеження MR зі змінами використовувати https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/q/status:open+-is:wip+MDTUDDM-29385[фільтр]. \ No newline at end of file diff --git a/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/universal-installer/registry-portals.adoc b/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/universal-installer/registry-portals.adoc new file mode 100644 index 0000000000..da77e0e3b0 --- /dev/null +++ b/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/universal-installer/registry-portals.adoc @@ -0,0 +1,78 @@ += Адаптація "Підсистеми кабінетів користувачів" + +[NOTE] +-- +В даній статті фіксується обсяг змін що були виконані для реалізації підтримки Платформою регіонів обслуговування. +-- + +== Опис + +Кабінети отримувача та надавача послуг реєстру, який обслуговує _global_-регіон, мають надавати користувачам можливість налаштування лише стандартизованих каналів зв'язку та відображати лише загальну інформацію на сторінці профілю. + +== Епіки + +* _https://jiraeu.epam.com/browse/MDTUDDM-29662[[BN-08-03\][S23\][OSS\] Адаптація "Підсистеми кабінетів користувачів" згідно налаштованого регіону обслуговування]_ + +== Функціональні сценарії + +* Перегляд профілю користувача +* Управління персональними налаштуваннями + +== Зміни в підсистемах + +|=== +|Підсистема|Компонент|Зміна + +.3+|_Підсистема користувачів кабінетів_ +.2+|Кабінет отримувача послуг (_citizen-portal_) +|Прибрати відображення додаткових атрибутів користувача (_РНОКПП_, _ЄДРПОУ_) +|Прибрати можливість налаштування каналу зв'язку для отримання _push_-нотифікацій в мобільний додаток _Дія_ + +|Кабінет надавача послуг (_officer-portal_) +|Прибрати відображення додаткових атрибутів користувача (_РНОКПП_, _ЄДРПОУ_) + +|=== + +== Поза скоупом + +|=== + +|Підсистема|Компонент|Зміна|Коментар +|_Підсистема нотифікацій користувачів_ +|Сервіс нотифікацій користувачів (_ddm-notification-service_) +|Екстерналізація механізмів відправки повідомлень каналами зв'язку у вигляді окремих плагінів та їх підключення на рівні розгортання / конфігурації +|Поза скоупом поточних робіт по адаптації + +|_Підсистема управління налаштуваннями користувачів_ +|Сервіс управління налаштуваннями користувачів (_user-settings-service-api-deployment_) +|Екстерналізація логіки управління каналами зв'язку у вигляді окремих плагінів та їх підключення на рівні розгортання / конфігурації +|Поза скоупом поточних робіт по адаптації + +.2+|_Підсистема користувачів кабінетів_ +.2+a| +* Кабінет надавача послуг (_officer-portal_) +* Кабінет отримувача послуг (_citizen-portal_) + +|Екстерналізація фрагментів сторінок відображення даних користувача та управління каналами зв'язку у вигляді окремих плагінів та їх підключення на рівні розгортання / конфігурації +|Поза скоупом поточних робіт по адаптації + +|Локалізація / Адаптація під OSS +a|В рамках окремих епіків: + +* _https://jiraeu.epam.com/browse/MDTUDDM-28667[[BN-08-03\][S23\][A\][OpenSourceSimplified\] Можливість налаштування логотипу для кабінетів користувачів та Адмін Порталу]_ +* _https://jiraeu.epam.com/browse/MDTUDDM-27754[[BN-08-03\][S23\][OpenSource\] Створення open source кабінетів користувачів на десктопі]_ +|=== + +== Вплив на підсистеми + +|=== +|Підсистема|Компонент|Опис + +|_Підсистема нотифікацій користувачів_ +|Сервіс нотифікацій користувачів (_ddm-notification-service_) +|Канал зв'язку _push_-нотифікацій _Дія_ є деактивованим за замовченням для отримувачів послуг та не використовується при відправленні інформаційних повідомлень системою. +|=== + +== Перелік git комітів + +Для відстеження MR зі змінами використовувати https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/q/status:open+-is:wip+MDTUDDM-29662[фільтр]. diff --git a/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/universal-installer/registry-regulation-template.adoc b/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/universal-installer/registry-regulation-template.adoc new file mode 100644 index 0000000000..bc0e514c6d --- /dev/null +++ b/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/universal-installer/registry-regulation-template.adoc @@ -0,0 +1,88 @@ += Розгортання регламенту новоствореного реєстру на базі шаблону + +[NOTE] +-- +В даній статті фіксується обсяг змін що були виконані для реалізації підтримки Платформою регіонів обслуговування. +-- + +== Опис + +В залежності від регіону обслуговування, реєстр на Платформі може надавати різні можливості, налаштування яких виконується розробником регламенту. При створенні нового реєстру, репозиторій регламенту ініціалізується шаблоном, який поставляється разом з Платформою і який, в свою чергу, може відрізнятись для різних регіонів. + +== Епіки + +* _https://jiraeu.epam.com/browse/MDTUDDM-29656[[BN-08-03\][S23\][OSS\] Розгортання регламенту новоствореного реєстру на базі шаблону в залежності від обраного регіону обслуговування]_ + +== Функціональні сценарії + +* Створення нового реєстру +* Перегляд витягу історичності даних +* Підтвердження каналу зв’язку шляхом відправлення повідомлень зі згенерованими OTP-кодами + +== Зміни в підсистемах + +|=== +|Підсистема|Компонент|Зміна + +.2+|_Підсистема управління Платформою та реєстрами_ +|`_control-plane-gerrit_` +.2+a| +* Переіменувати компонент / репозиторій регламенту _empty-template-registry-regulation_ в _registry-regulation-template-ua_ +* Створити компонент / репозиторій регламенту _registry-regulation-template-global_ +* В репозиторії _registry-regulation-template-global_: +** Локалізувати витяг історичності даних _/excerpts/HistoryExcerpt/index.html.ftl_ +** Локалізувати шаблон поштових повідомлень зі згенерованим OTP-кодом _/notifications/email/channel-confirmation/_ +* Розширити CI новою компонентою-бібліотекою _registry-regulation-template-global_ +* Включити компонент _registry-regulation-template-global_ в збірку інсталера +* При розгортанні нового реєстру в залежності від налаштованого регіону обслуговування використовувати для ініціалізації репозиторію регламенту реєстру (_CICD_ та _TARGET_): +** _ua_-регіон: _registry-regulation-template-ua_ +** _global_-регіон: _registry-regulation-template-global_ +|`_edp-library-stages-fork_` +|=== + +== Поза скоупом + +|=== +|Підсистема|Компонент|Зміна|Коментар +|_Підсистема управління Платформою та реєстрами_ +|`_control-plane-gerrit_` +|Селективне включення репозиторіїв шаблонів регламенту при збірці інсталятора під конкретний регіон +|Поза скоупом першої фази +.4+|_Підсистема управління Платформою та реєстрами_ +.3+a| +* `_registry-regulation-template-global_` +* `_registry-regulation-template-ua_` +|Переіменування складової регламенту "_bp-trembita_" та файлів налаштувань +a|В рамках окремих епіків: + +* https://jiraeu.epam.com/browse/MDTUDDM-29207[[BN-15-08\][S24\][Dev\] Генералізація складової регламенту управління інтеграціями "bp-trembita" та розмежування управління публікацією API бізнес-процесів для Трембіти / без Трембіти] + +|Розширення шаблону регламенту темою / логотипами за замовчуванням +a|Включення в регламент та локалізація є частиною епіків: + +* https://jiraeu.epam.com/browse/MDTUDDM-28829[[BN-08-03\][S23\][OpenSource\] Адаптування інтерфейсу Адмін Порталу під open source kit] +* https://jiraeu.epam.com/browse/MDTUDDM-28829[[BN-08-03\][S23\][OpenSource\] Додавання diia_dark теми для open source кабінетів користувачів] + +|Розширення шаблону регламенту інформаційними панелями журналів аудиту +a|Включення в регламент та локалізація є частиною епіків: + +* https://jiraeu.epam.com/browse/MDTUDDM-29883[[BN-08-03\][S23\][OSS\] Локалізація службових інформаційних панелей] + +|=== + +== Вплив на підсистеми + +|=== +|Підсистема|Опис +|_Підсистема формування витягів реєстру_ +|При запиті на формування витягу історичності даних, використовується шаблон витягу в залежності від регіону +|_Підсистема нотифікацій користувачів_ +|При відправці поштових повідомлень підтвердження каналу зв'язку використовується шаблон повідомлення в залежності від регіону +|_Підсистема моделювання регламенту реєстру_ +.2+|Репозиторій регламенту реєстру наповнений складовими в залежності від регіону обслуговування +|_Підсистема розгортання регламенту реєстру_ +|=== + +== Перелік git-комітів + +Для відстеження MR зі змінами використовувати https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/q/status:open+-is:wip+MDTUDDM-29656[фільтр]. \ No newline at end of file diff --git a/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/universal-installer/regulation-management.adoc b/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/universal-installer/regulation-management.adoc new file mode 100644 index 0000000000..0ba2ab00be --- /dev/null +++ b/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/universal-installer/regulation-management.adoc @@ -0,0 +1,141 @@ += Адаптація "Підсистеми моделювання регламенту реєстру" + +[NOTE] +-- +В даній статті фіксується обсяг змін що були виконані для реалізації підтримки Платформою регіонів обслуговування. +-- + +== Опис +В рамках адаптації вимикається набір інструментів, які можна використовувати для моделювання регламенту, який специфічний +для українського регіону у _Веб-інтерфейсі моделювання регламенту_ (делегати БП, JUEL функції тощо) + +== Епіки + +* _https://jiraeu.epam.com/browse/MDTUDDM-29659[[BN-08-03\][S23\][OSS\] Адаптація "Підсистеми моделювання регламенту реєстру" згідно налаштованого регіону обслуговування]_ + +== Функціональні сценарії +* Моделювання бізнес-процесів регламенту реєстру +* Моделювання дата-моделі регламенту реєстру +* Створення облікових записів надавачів послуг через csv файл + +== Зміни в підсистемах + +|=== + +|Підсистема|Компонент|Зміна + +.4+|Підсистема моделювання регламенту реєстру +.4+|Веб-інтерфейс моделювання регламенту (_admin-portal_) + +|Вимкнення JUEL функцій зі списку підказок в Groovy скриптах, які специфічні для українського регіону +|Вимкнення шаблонів елементів, які специфічні для українського регіону +|Адаптація окремих шаблонів елементів, які специфічні для українського регіону +|Вимкнення розділу "Управління користувачами" + +|=== + +=== Перелік шаблонів елементів БП для вимкнення в глобальному регіоні + +* Всі deprecated делегати +* Get Certificate By Birthdate +* Get Certificate By Name +* Search Subjects Edr Registry +* Get Subject Detail Edr Registry +* Idp Exchange Service Registry Connector +* Trembita SOAP connector +* Signature validation by DSO service (валідація підписів від 3rd party систем) +* Digital signature by DSO service (залишити тільки System signature by DSO service) + +=== Перелік шаблонів елементів БП для адаптації в глобальному регіоні + +* Create Keycloak officer user (поля _drfo_ та _edrpou_ приховані і мають статичне фіктивне значення) +* Save officer user attributes to Keycloak (поля _drfo_ та _edrpou_ приховані і мають статичне фіктивне значення) + +=== Перелік JUEL функцій для вимкнення в глобальному регіоні +* get_trembita_auth_token +* signature_content +* signature_details + +== Поза скоупом + +|=== + +|Підсистема|Компонент|Зміна|Коментар + +.9+|Підсистема моделювання регламенту реєстру +.3+|Веб-інтерфейс моделювання регламенту (_admin-portal_) + +|Керування блек-лістом для поштових адрес на рівні регламенту +|В рамках епіку https://jiraeu.epam.com/browse/MDTUDDM-20362[[BN-12-03\][S23\][A\][OSS\] Розширення глобальних налаштувань для blacklist email] + +|Адаптація дизайну кабінету, керування логотипами та локалізація +|В рамках окремих епіків _https://jiraeu.epam.com/browse/MDTUDDM-28300[1], https://jiraeu.epam.com/browse/MDTUDDM-28667[2], +https://jiraeu.epam.com/browse/MDTUDDM-28829[3]_ + +|Адаптація компонента "Карта" для стартового тайла (залишається Україна) +|Поза скоупом 1 версії адаптації + +|Бібліотека _liquibase-ddm-ext_ +|Виключення атрибуту _trembita_ у тегу _exposeSearchCondition_ +|Поза скоупом 1 версії адаптації + +|Веб-інтерфейс моделювання звітів (_redash-admin_) +|Локалізація +|В рамках епіку _https://jiraeu.epam.com/browse/MDTUDDM-28301[Підтримка декількох мов інтерфейсу перегляду звітів]_ + +|Сервіс управління регламентом (_registry-regulation-management_) +|Вимкнення API методу по завантаженню користувачів +|Поза скоупом 1 версії адаптації + +|Утиліта завантаження надавачів послуг (_publish-users-job_) +|Не розгортати джобу в глобальному регіоні +|Поза скоупом 1 версії адаптації + +|Операційне сховище файлів з користувачами (_ceph:user-import_) +|Не створювати бакет в глобальному регіоні +|Поза скоупом 1 версії адаптації + +|Архівне сховище файлів з користувачами (_ceph:user-import-archive_) +|Не створювати бакет в глобальному регіоні +|Поза скоупом 1 версії адаптації + +|Підсистема управління реляційними базами даних +|Бібліотека _data-model_ +|Виключення типів _dn_passport_num_, _dn_edrpou_ +|Поза скоупом 1 версії адаптації + +.3+|Підсистема виконання бізнес-процесів +.3+|Сервіс виконання бізнес-процесів (_bpms_) + +|Виключення JUEL-функцій на рівні сервісу виконання БП (вимкнена можливість виконати juel-функцію, якщо вона була +внесена в код напряму) +|Поза скоупом 1 версії адаптації + +|Виключення делегатів БП на рівні сервісу виконання БП (вимкнена можливість запуску делегату, якщо внесений в код +напряму) +|Поза скоупом 1 версії адаптації + +|Валідація email у делегатах відносно блекліста, який налаштований на рівні регламенту +|В рамках епіку https://jiraeu.epam.com/browse/MDTUDDM-20362[[BN-12-03\][S23\][A\][OSS\] Розширення глобальних налаштувань для blacklist email] + +|Підсистема управління Платформою та реєстрами +|Веб-інтерфейс управління Платформою та реєстрами (_control-plane_) +|Вимкнути можливість створення зовнішніх інтеграцій через Трембіту +|У скоупі xref:arch:architecture-workspace/platform-evolution/universal-installer/platform-control-plane.adoc[] + +|=== + +== Вплив на підсистеми + +|=== +|Підсистема|Компонент|Зміна + +|Підсистема розгортання регламенту реєстру +|Утиліта валідації регламент (_registry-regulations-validator-cli_) +|Зміна правил валідації бізнес-процесів через зміни в шаблонах елементів + +|=== + +== Перелік git комітів + +Для відстеження MR зі змінами використовувати https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/q/status:open+-is:wip+MDTUDDM-29659[фільтр]. \ No newline at end of file diff --git a/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/universal-installer/regulation-publication.adoc b/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/universal-installer/regulation-publication.adoc new file mode 100644 index 0000000000..5a295c2a52 --- /dev/null +++ b/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/universal-installer/regulation-publication.adoc @@ -0,0 +1,97 @@ += Адаптація "Підсистеми розгортання регламенту реєстру" + +[NOTE] +-- +В даній статті фіксується обсяг змін що були виконані для реалізації підтримки Платформою регіонів обслуговування. +-- + +== Опис + +В рамках адаптації підсистеми розгортання потрібно внести зміни в пайплайн публікації для можливості обробки структури +цифрового регламенту специфічного для глобального регіону + +== Епіки + +* https://jiraeu.epam.com/browse/MDTUDDM-29663[_[BN-08-03\][S23\][OSS\] Адаптація "Підсистеми розгортання регламенту реєстру" згідно налаштованого регіону обслуговування_] + +== Функціональні сценарії + +* Розгортання регламенту реєстру +* Валідація регламенту реєстру на етапі код-ревью +* Валідація регламенту реєстру на етапі розгортання +* Перегляд аудит звітів у _Веб-інтерфейсі перегляду звітів_ (_redash-server_) + +== Зміни в підсистемах + +|=== +|Підсистема|Компонент|Зміна +.2+|Підсистема розгортання регламенту реєстру +.2+|Пайплайни розгортання регламенту (_registry-regulations-publications-pipelines_) +|Отримання змінної про регіон розгортання _global.region_ з хелм чарту _registry-configuration_ + +|Не передавати параметр _diia-notification-template-folder_ при валідації регламенту в утіліту + +|=== + +== Поза скоупом + +|=== +|Підсистема|Компонент|Зміна|Коментар + +|Підсистема моделювання регламенту реєстру +|Git репозиторій Цифрового регламенту реєстру (_gerrit:registry-regulations_) +|Розділення конфігурацій для запуску БП через Трембіту та іншими зовнішніми системами по REST протоколу +|В рамках епіку https://jiraeu.epam.com/browse/MDTUDDM-29207[Генералізація складової регламенту управління інтеграціями "bp-trembita"] + +.10+|Підсистема розгортання регламенту реєстру +.3+|Утиліта валідації регламенту (_registry-regulations-validator-cli_) + +|Зміна правил валідації директорії bp-trembita і файлу bp-trembita/external-system.yml +|В рамках епіку https://jiraeu.epam.com/browse/MDTUDDM-29207[Генералізація складової регламенту управління інтеграціями "bp-trembita"] + +|Перевірка поштової адреси служби підтримки відносно заборонених доменів +|В рамках епіку https://jiraeu.epam.com/browse/MDTUDDM-20362[Розширення глобальних налаштувань для blacklist email] + +|Умовне включення валідаторів, пов'язаних з перевіркою Дія нотифікацій +|Поза скоупом 1 версії адаптації + +.2+|Пайплайни розгортання регламенту (_registry-regulations-publications-pipelines_) +|Адаптація кроку _create-trembita-business-process_ +|В рамках епіку https://jiraeu.epam.com/browse/MDTUDDM-29207[Генералізація складової регламенту управління інтеграціями "bp-trembita"] + +|Видалення розгортання проекту _registry-soap-api_ +|Поза скоупом 1 версії адаптації + +|Агент розгортання регламенту (_dataplatform-jenkins-agent_) +|Налаштування локалі для Docker контейнеру. Впливає на формат технічних логів +|Поза скоупом 1 версії адаптації + +.2+|Утиліта генерації сервісів доступу до даних реєстру (_service-generation-utility_) +|Вимкнення генерації коду проекту _registry-soap-api_ +|Поза скоупом 1 версії адаптації + +|Перейменування клієнта trembita-invoker для вхідних викликів зовнішніх систем +|В рамках епіку https://jiraeu.epam.com/browse/MDTUDDM-29207[Генералізація складової регламенту управління інтеграціями "bp-trembita"] + +|Утиліта публікації шаблонів нотифікацій (_notification-template-publisher_) +|Умовне включення бінів в контекст застосунку пов'язаних з Дія нотифікаціями +|Поза скоупом 1 версії адаптації + +|Утиліта публікації аналітичних звітів та витягів (_report-publisher_) +|Переклад звітів аудиту і використання англійської мови в глобальному регіоні +|В рамках епіку https://jiraeu.epam.com/browse/MDTUDDM-29883[Локалізація службових інформаційних панелей] + +|=== + +== Вплив на підсистеми + +|=== +|Підсистема|Компонент|Опис +|Підсистема моделювання регламенту реєстру +|Веб-інтерфейс моделювання регламенту (_admin-portal_) +|Зміна правил валідації регламенту +|=== + +== Перелік git-комітів + +Для відстеження MR зі змінами використовувати https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/q/status:open+-is:wip+MDTUDDM-???[фільтр]. \ No newline at end of file diff --git a/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/universal-installer/universal-installer.adoc b/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/universal-installer/universal-installer.adoc new file mode 100644 index 0000000000..313fcecd90 --- /dev/null +++ b/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/universal-installer/universal-installer.adoc @@ -0,0 +1,23 @@ += Підтримка концепції _регіонів обслуговування_ Платформою Реєстрів + +[IMPORTANT] +-- +Розділ технічної документації є баченням майбутньої реалізації, актуальність якого може бути застарілою. +-- + +== Загальні принципи та положення + +* Рішення _Платформи Реєстрів_ надає можливості розгортання екземплярів Платформи для створення реєстрів з урахуванням регіональних вимог +* _Компонент керування станом ресурсів Платформи_ включає набір компонент та скриптів розгортання для всіх регіонів, які підтримуються _Платформою Реєстрів_ +* _Платформа Реєстрів_ підтримує два регіони обслуговування: +** _ua_ - розробка реєстрів з урахуванням регіональних вимог та особливостей +** _global_ - розробка реєстрів з генералізованими вимогами +* Цільовий регіон обслуговування вказується адміністратором при встановленні нового екземпляра _Платформи Реєстрів_ +* Екземпляр _Платформи Реєстрів_ передбачає обслуговування єдиного регіону, вказаного при її інсталяції та не може бути змінений +* Реєстри наслідують регіон обслуговування екземпляра Платформи при їх створенні через _Веб-інтерфейс управління Платформою та реєстрами_ +* Реєстр передбачає обслуговування єдиного регіону, налаштованого на рівні екземпляра Платформи +* У якості підходу для управління поведінкою підсистем Платформи та реєстрів згідно до налаштованого регіону обслуговування прийнято використання _Feature Toggle_ на рівні коду та автоматизації +* Кожен компонент підсистем Платформи та реєстрів параметризується змінною з налаштуванням регіону обслуговування для адаптації поведінки +* _CD_-пайплайн розгортання реєстру на _CI/CD_ підтримує можливість вибору регіону для обслуговування +* Тестування _Платформи Реєстрів_ для регіону обслуговування _global_ виконується в ручному режимі, паралельно основному процесу розробки для _ua_ регіону +* Демонстрація можливостей Платформи та реєстрів, які обслуговують _global_ регіон виконується на базі окремо створеного регламенту, згідно з ключовими сценаріями використання \ No newline at end of file diff --git a/docs/ua/modules/arch/pages/architecture-workspace/research/data-retention.adoc b/docs/ua/modules/arch/pages/architecture-workspace/research/data-retention.adoc new file mode 100644 index 0000000000..9d6525fe1b --- /dev/null +++ b/docs/ua/modules/arch/pages/architecture-workspace/research/data-retention.adoc @@ -0,0 +1,46 @@ += Типи даних та існуючи налаштування політик їх збереження + +[cols="h,a,a,a"] +|=== +|Тип даних |Сховище |Зростання |Налаштування політик збереження + +4.+|_Бізнес дані_ +|Робочі дані реєстру .2+|postgres:registry.registry|Залежить від реєстру .8+| Відсутнє +|Історичні дані реєстру|Пропорційно кількості змін у даних +|Архівні історичні дані реєстру|postgres:registry.archive|Пропорційно кількості змін у даних +|Вкладені файли реєстру|ceph:file-ceph-bucket|Пропорційно кількості вкладених файлів +|Документи форми .2+|ceph:datafactory-ceph-bucket|Пропорційно кількості змін у даних +|Документи API|Пропорційно кількості змін у даних +|Сформовані витяги|ceph:file-excerpt-bucket postgres:excerpt|Пропорційно кількості сформованих витягів +|Історія виконаних послуг|postgres:process_history|Пропорційно активності користувачів +4.+|_Системні дані_ +|Історія бізнес-процесів|postgres:camunda|Пропорційно активності користувачів|За замовчанням: 1 день + +_Прописано в application.yaml компоненту bpms_ +|Аудит дій користувача .3+|postgres:audit|Пропорційно активності користувачів|Часткове + +За замовчанням: 3 дні для вибраних типів подій + + +_operational-audit-clean job_ +|Аудит системних подій|Пропорційно відповідним подіям|Відсутнє +|Аудит подій аутентифікації, авторизації та перевірки підпису|Пропорційно відповідним подіям|Відсутнє +|inbox-нотифікації|postgres:notifications|Пропорційно кількості надісланих inbox-нотифікацій|Відсутнє +|Кеш redash|postgres:redash_viewer|Пропорційно активності користувачів та обʼєму даних у звітах|Відсутнє +|повідомлення kafka підсистеми управління даними|kafka:*-inbound/-inbound.dlt/-outbound| Пропорційно кількості змін у даних і асинхронних читань| Налаштовується в регламенті реєстру (settings.yaml) +|повідомлення kafka інших підсистем|kafka| |За замовчанням: 168 годин (1 тиждень) +|бекапи velereo|minio|Пропорційно розміру реєстру|налаштування і для центральних і для реєстрових компонент доступні в консолі адміністратора +|бекапи postgres|minio|Пропорційно розміру БД реєстру|За замовчанням: 1 копія + +Налаштовується в values реестра +|gerrit реєстру|gerrit|Пропорційно кількості змін регламенту|Відсутнє +|nexus реєстру|nexus|Пропорційно кількості змін регламенту|Відсутнє + +_Ручне видалення за допомогою cleanup_ +|kibana|elastic|Пропорційно часу роботи|За замовчанням: 7 днів + +Налаштовується в OKD +|grafana|prometheus|Пропорційно часу роботи|За замовчанням: 14 днів + +Налаштовується в OKD +// |jenkins реєстру||| +|=== diff --git a/docs/ua/modules/arch/pages/architecture-workspace/security/ssdlc.adoc b/docs/ua/modules/arch/pages/architecture-workspace/security/ssdlc.adoc new file mode 100644 index 0000000000..c287e1457c --- /dev/null +++ b/docs/ua/modules/arch/pages/architecture-workspace/security/ssdlc.adoc @@ -0,0 +1,183 @@ += Secure Software Development Lifecycle (SSDLC) + +== Статичні контролі безпеки + +До всіх build та code review пайплайн (гілка master/main) додані різноманітні статичні сканери для сканування коду на вразливості. Додавання кожного сканеру має під собою додавання двох стейджів до пайплайни: власне самого сканеру (наприклад, iaac-security стейдж для сканування інфраструктурних файлів інструментом kics) та security-quality-gate стейджу, який обробляє файл звіту сканера та пушить знайдені вразливості до vulnerability management tool (Defectdojo). + +На даний момент до усіх пайплайн додані наступні сканери: + +* Semgrep - стейдж sast, статичний сканер, сканує код на типові вразливості. Містить набори правил (ruleset) для всіх популярних мов програмування, а також набори правил під конкретні вразливості (наприклад, owasp-top-ten ruleset). На даний момент у скануванні використовуються рулсети https://semgrep.dev/p/default[default] (містить базові правила для всіх мов програмування та для різних конфігураційних файлів - json, yaml тощо), https://semgrep.dev/p/java[java], https://semgrep.dev/p/javascript[javascript], https://semgrep.dev/p/golang[golang] (містять розширені рули стосовно мов програмування, які використовуються на проекті), https://semgrep.dev/p/owasp-top-ten[owasp-top-ten] (містить додаткові рули, що базуються на виявленні вразливостей з OWASP Top 10). Багато рулів з цих списків перетинаються між собою, проте семгреп перевіряє і сканує кожен рул по одному разу, тому час сканування прийнятний. Посилання на https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/security/semgrep-jenkins-agent[агент] + +* Detect-secrets - стейдж detect-secrets, сканує всі файли в репозиторії на секрети. Без додаткових налаштувань генерує багато false-positives, тому час від часу необхідно аналізувати найчастіші false-positives та додавати винятки у сканер. Це можна зробити в репозиторії https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/gitweb?p=mdtu-ddm/general/libraries/edp-library-stages-fork.git;a=blob;f=src/com/epam/edp/customStages/impl/security/DetectSecrets.groovy;h=c8bfb8e1d20e96e1ea888011e831bae7223589de;hb=refs/heads/master[edp-library-stages-fork]. Посилання на https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/security/detect-secrets-jenkins-agent[агент] + +* Trivy - стейдж container-security, запускається одразу після стейджа build-image-from-dockerfile. Сканує збілджений імедж на наявність вразливих додатків та бібліотек. Посилання на https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/security/trivy-jenkins-agent[агент] + +* Dependency track - стейдж sca. Цей стейдж не сканує додаток, а створює https://www.aquasec.com/cloud-native-academy/supply-chain-security/sbom/#:~:text=A%20software%20bill%20of%20materials,components%20from%20third%2Dparty%20vendors[SBOM] в форматі https://cyclonedx.org/[cycloneDX]. Основні дії з виявлення вразливостей та створення графу залежностей відбуваються у додатку Dependency Track (див розділ керування залежностями). Посилання на https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/security/kics-jenkins-agent[агент] + +* Kics - стейдж iaac-security. Сканує типові інфраструктурні файли на місконфігурації та небезпечні налаштування (docker, terraform, helm etc.). Посилання на https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/security/kics-jenkins-agent[агент] + +Також є спеціальний стейдж security-quality-gate. Він вставляється в пайплайну після кожного стейджа зі сканером. Задача стейджа зі сканером просканувати аплікейшн чи імедж і створити репорт з результатами. security-quality-gate стейдж натомість виконує всі подальші дії з цими репортами: завантажує репорти в Defectdojo чи Dependency-Track, робить різноманітні перевірки на валідність репорту, також саме цей стейдж "валить" пайплайну, завершуючись з ненульовим exit code, якщо встановлені Security Baselines та вони не виконуються (див розділ Керування вразливостями). + +Посилання на код для стейджів дженкінсу https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/gitweb?p=mdtu-ddm/general/libraries/edp-library-stages-fork.git;a=tree;f=src/com/epam/edp/customStages/impl/security;h=e6e7261e03290b9e25fbd6a51f8eb55be141595a;hb=refs/heads/master[тут]. В стейджах власне описуються параметри, з якими запускаються сканери, там же можна змінити verbosity level, режим сканування, додати винятки до сканування тощо. + +== Динамічні контролі безпеки + +=== Загальний опис OWASP ZAP та процесу сканування + +Для динамічного сканування порталів та API був обраний https://www.zaproxy.org/[OWASP ZAP]. Він містить досить широкий набір правил для https://www.zaproxy.org/docs/desktop/addons/active-scan-rules/[активного] та https://www.zaproxy.org/docs/desktop/addons/passive-scan-rules/[пасивного] сканування додатку. Для порталів ми використовуємо повний набір правил для пасивного та активного сканування. Для API використовуємо https://www.zaproxy.org/docs/docker/api-scan/[скрипт], який оптимізований спеціально під сканування API та містить тільки ті правила, які актуальні для API. + +Zap Proxy https://console-openshift-console.apps.cicd2.mdtu-ddm.projects.epam.com/k8s/ns/mdtu-ddm-edp-cicd/deployments/zapproxy[задеплоєний] на енв mdtu-ddm-edp-cicd. Самі DAST тести раняться на енві mdtu-ddm-edp-cicd-proxy-mode-ci-proxy. + + +Для того, щоб успішно виконати динамічне сканування порталів (admin, officer, citizen), необхідно спочатку очистити ZAP від контексту та налаштувань, що залишилися від минулого сканування. Контекст - це список url, на яких буде проводитись сканування. Контекст можна збирати як автоматично засобами ZAP (spider, AJAX spider), так і заповнити його вручну або автотестами. У нашому випадку контекст заповнюється, коли в proxy-mode пайплайні запускаються автотести, створені командою QA. Вони біжать через ZAP Proxy, тому після закінчення автотестів ZAP містить повний контекст. Також у рамках стейджу dast-setup запускається selenium script, який автентифікується на порталах та отримує Cookie. Ці куки також передаються в ZAP в рамках стейджу dast-setup. Далі ZAP engine починає сканувати портали в рамках зібраного контексту, цей процес може зайняти декілька годин. Саме тому стейдж dast-scan періодично перевіряє статус сканування, і у разі його успішного завершення, скачує репорт з ZAP Engine та відправляє його до Defectdojo. + +image::architecture-workspace/security/ssdlc/proxy-mode-portals.png[Процес динамічного сканування для порталів] + + +Процес сканування API набагато простіший. Список API, які скануються на даний момент: user-process-management, user-task-management, digital-signature-ops, digital-document-service, form-schema-provider, registry-regulation-management, process-history-service, excerpt-service, user-settings-service, registry-rest-api. Для кожного api всі необхідні налаштування, сканування та пуш в Defectdojo відбуваються в рамках одного стейджу (наприклад, для — digital-document-service цей стейдж має назву dast-api-scan-dig-doc-service). На стейджі відбуваються всі підготовчі дії, такі як автентифікація та отримання кукі через selenium, отримання swagger та приведення його до необхідного формату. Після цього запускається спеціальний скрипт, наданий розробниками ZAP для сканування API. Цей скрипт сам збирає контекст відповідно до вмісту swagger файлу і запускає всі необхідні правила. Після закінчення роботи скрипта, репорт пушиться в Defectdojo. Сканування одного API займає порівняно невеликий час (до 10 хвилин). + +=== Proxy-mode env для динамічних тестів + +Proxy-mode env використовується виключно командою DevSecOps для запуску тестів безпеки (переважно DAST — динамічне тестування додатків) на порталах та API. Потрібен окремий env, оскільки тести безпеки можуть навмисно намагатися порушити функціональність програми. + +Де знайти: + +Дженкінс: https://jenkins-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/job/proxy-mode-cd-pipeline/ + +EDP: https://edp-admin-console-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/edp/cd-pipeline/proxy-mode/update + +Пайплайна proxy-mode складається з 2 завдань: + +* Proxy-mode-cron - автоматично запускає завдання ci-proxy кожного робочого дня о 10:00 з параметрами: DEPLOY_ALL_LATEST і на medium machine-set + +* ci-proxy - містить стейджі білду енва (build-from-helmfile та інші), підготовки його до тестування (autosetup) та стейджі для запуску тестів безпеки DAST (officer-portal-tests, admin-portal-tests, citizen-portal-tests, dast-api-scan-dig-doc-service та інші) + +=== Список стейджів ci-proxy: +---- +{"name":"checkout-registry-tenant","step_name":"checkout-registry-tenant"},{"name":"create-machine-set","step_name":"create-machine-set "},{"name":"prepare-helmfile","step_name":"prepare-helmfile"},{"name":"deploy-via-helmfile","step_name":"deploy-via-helmfile"} ,{"name":"deploy-codebases","step_name":"deploy-codebases"},{"name":"upload-form-modeler","step_name":"upload-form-modeler"},{ "name":"dast-setup","step_name":"dast-setup"},{"name":"autotests","step_name":"auto-setup"},[{"name":"autotests- no-failure","step_name":"officer-portal-tests"},{"name":"autotests-no-failure","step_name":"admin-portal-tests"},{"name":" autotests-no-failure","step_name":"citizen-portal-tests"}],{"name":"dast-scan","step_name":"dast-scan"},{"name":"dast -api-scan-dig-doc-service","step_name":"dast-api-scan-dig-doc-service"},{"name":"dast-api-scan-dig-sign-ops", "step_name":"dast-api-scan-dig-sign-ops"},{"name":"dast-api-scan-form-schema","step_name":"dast-api-scan-form-schema "},{"name":"dast-api-scan-user-proc","step_name":"dast-api-scan-user-proc"},{"name":"dast-api-scan-user -task","step_name":"dast-api-scan-user-task"},{"name":"dast-api-scan-reg-regulation","step_name":"dast-api-scan-reg -regulation"},{"name":"promote-images","step_name":"promote-images"} +---- + +=== Детальний опис стейджів ci-proxy для сканування порталів: + +* checkout-registry-tenant, create-machine-set, ready-helmfile, deploy-via-helmfile, deploy-codebases, upload-form-modeler, autotests, promote-images – стандартні стейджі, створені командою EDP і QA + +* dast-setup - етап, який створює нову сесію для ZAP і змінює параметри ZAP для сканування + +* officer-portal-tests, admin-portal-tests, citizen-portal-tests – автоматичні тести, розроблені командою QA, які налаштовані для запуску через ZAP Proxy. Ці тести сканують усі ендпоінти порталів, ZAP-проксі фіксує всю цю інформацію та використовує її для сканування, яке відбувається у фоновому режимі. + +* dast-scan — цей етап містить функцію, яка періодично перевіряє, чи завершилося сканування ZAP (оскільки воно зазвичай виконується набагато довше, ніж тести порталу на попередніх етапах). Після завершення сканування сценарій завантажує звіти про сканування в defectdojo. + +=== Детальний опис стейджів ci-proxy для сканування API: + +dast-api-scan-dig-doc-service — сканує api digital-document-service за допомогою спеціального сканування ZAP, розробленого спеціально для api. Щоб отримати доступ до API, ми використовуємо сценарій автентифікації за допомогою Selenium, щоб отримати дійсні заголовки Cookie і User-Agent. Після завершення сканування звіт завантажується в defectdojo. Той самий процес дійсний для всіх інших API. Swagger: +https://digital-document-service-proxy-mode-ci-proxy.apps.cicd2.mdtu-ddm.projects.epam.com/v3/api-docs + +dast-api-scan-dig-sign-ops - сканує api dig-signature-ops. Swagger: +https://dig-sign-ops-proxy-mode-ci-proxy.apps.cicd2.mdtu-ddm.projects.epam.com/v3/api-docs + +dast-api-scan-form-schema - сканує api form-schema-provider. Swagger: https://form-schema-provider-mdtu-ddm-edp-cicd-proxy-mode-ci-proxy.apps.cicd2.mdtu-ddm.projects.epam.com/v3/api-docs/all + +dast-api-scan-user-proc - сканує API user-process-management. Swagger: +https://user-proc-mng-proxy-mode-ci-proxy.apps.cicd2.mdtu-ddm.projects.epam.com/user-process-management/v3/api-docs + +dast-api-scan-user-task - сканує api user-task-management. Swagger: +ttps://user-task-mng-proxy-mode-ci-proxy.apps.cicd2.mdtu-ddm.projects.epam.com/user-task-management/v3/api-docs + + +dast-api-scan-reg-regulation - сканує registry-regulation-management api. Посилання на API було змінено на rmm, оскільки в іншому випадку воно перевищувало б ліміт символів посилання, і API був би недоступний. Swagger: +https://rrm-api-mdtu-ddm-edp-cicd-proxy-mode-ci-proxy.apps.cicd2.mdtu-ddm.projects.epam.com/v3/api-docs + +=== Тести в пайплайні: + +Усі тести, які виконуються в пайплайні, є спеціальними і не виконуються через Moon. Тести налаштовано для виконання через zapproxy https://www.zaproxy.org/, який працює як проксі-сервер безпеки та збирає всі дані, які проходять через нього, і використовує їх для подальшого сканування. + +=== Актуалізація середовища: + +Іноді стадії деплою або autosetup зазнають збою в пайплайні через зміни деяких компонентів або конфігурацій командами розробників. + +Перше, що вам потрібно перевірити, чи правильні версії компонентів використовуються в конфігурації пайплайни. Їх можна перевірити та змінити в EDP https://edp-admin-console-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/edp/cd-pipeline/proxy-mode/update . Зазвичай найкраще місце для порівняння – sit. Якщо версії env EDP у проксі-режимі відрізняються від sit EDP, спробуйте змінити їх відповідно. Доцільно періодично перевіряти збіг версій, навіть якщо пайплайна працює нормально. + +=== Пуш результатів динамічного сканування в систему керування вразливостями + +В кінці кожного стейджа, де відбувається сканування за допомогою ZAP, відбувається пуш репорту зі знайденими вразливостями в Defectdojo. Усі продукти, які містять репорти з результатами динамічного сканування згруповані в Product Type https://mdtu-ddm-edp-cicd-defectdojo-uat.apps.cicd2.mdtu-ddm.projects.epam.com/product/type/5[DAST] + +== Керування вразливостями + +Структура в дефектоджо від більш загального до менш загального: + +*Product type* - кожен продукт обов'язково належить до одного з product type. Станом на зараз існують такі product type: + +* Uncategorized - дефолтний тип, куди завантажуються всі нові продукти. Обов'язково security engineer періодично переглядає продукти, які приписані до цього типу і переносить їх до інших типів продуктів. В ідеалі в Uncategorized не має бути продуктів. +* Research and Development - тип, куди входять всі сервіси, які належать до DevSecOps Security Scope. Містить найбільше сервісів серед інших product type та найчастіше використовується в процесі тріажу вразливостей. +* OutOfScope - містить сервіси, що були визначені як OutOfScope для security активностей (deprecated, internal repos etc.) +* 3rd-party - зовнішні сервіси, які ми використовуємо без модифікацій. Поки в цій групі лише geo-server +* Security products - сервіси, задеплоєні DevSecOps командою. Вони не підлягають тріажу, оскільки не йдуть в інсталер, але інформація з вразливостями може бути корисною при плануванні оновлень. +* DAST - репорти з результатами динамічного сканування з https://jenkins-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/job/proxy-mode-cd-pipeline/[proxy-mode-cd-pipeline] + +*Product* - продукт в Defectdojo відповідає одному сервісу (наприклад, bpms чи excerpt-service-api). + +*Engagement* - сутність всередині продукта, в яку завантажуються тести з різних сканерів. За яким принципом створювати engagements та як часто їх міняти - рішення суто індивідуальне. У нас для всіх продуктів створюється engagement за тегами в геріті порелізно (наприклад, енгейджмент може називатися "Scans for release 1.9.7"). Енгейджмент закривається та створюється новий у двох випадках: змінився тег релізу в геріті або пройшло 3 місяці з дати створення енгейджменту. Це необхідно, щоб мати можливість відслідкувати як змінювалась кількість вразливостей між релізами, побачити в якому саме релізі з'явилася певна вразливість. + +*Test* - сутність всередині енгейджменту, яка містить один репорт одного сканера. Наприклад, "Semgrep Scan", "Trivy Scan". + +=== Групування в Defectdojo + +Defectdojo дозволяє групувати файндінги в рамках одного тесту. Після налаштування це відбувається автоматично. + +Для semgrep та kics файндінги згруповані по finding_title, для detect-secrets по file_path, для trivy по component_name. Це означає, що якщо trivy знайде 10 вразливостей в одному компоненті, буде створений не 20 тікетів в джирі, а 1 тікет з описом на 10 вразливостей. Аналогічно, такий самий процес працює для finding_title (Наприклад, знайдена відсутня User інструкція в 10 Dockerfiles) та file_path (в одному файлі знайдено 10 секретів). Групування зменшує кількість тікетів та дозволяє логічніше розприділити зусилля на фікс вразливостей. + +=== Можливість встановити Security Baseline + +Всі продукти в Defectdojo містять Custom Fields: Container_Security_Severity_Baseline, Detect_Secrets_Severity_Baseline, IAAC_Severity_Baseline, SCA_Severity_Baseline, Semgrep_Severity_Baseline. + +По дефолту всі ці поля створюються зі значенням Disabled, що означає, що Security baseline не встановлена. Ці поля потрібні для того, щоб валити пайплайни, якщо в скані присутні вразливості певної Severity та вище. Наприклад, якщо Container_Security_Severity_Baseline = High, а в Trivy скані присутня хоч одна High чи Critical вразливість, тоді security-quality-gate буде падати з помилкою. + +Змінити значення Custom Field можна в Product - Settings - Edit Custom Fields + +=== Triage вразливостей + +Спочатку варто відфільтрувати вразливосмті по severity, product type (для статичних сканів Research and Development, для динамічних DAST) та по іншим полям, які можуть бути корисні. Для цього варто відкрити панель Open Findings. Після дослідження вразливостей та оцінки ризиків, варто обрати статус вразливості. Вразливість може одночасно містити декілька статусів. Можливі статуси: + +* Active - дефолтний статус, в якому завантажуються вразливості. Якщо забрати цей статус, тікет перейде в Inactive статус та не буде показуватися в Open Findings. + +* Verified - цей статус ставиться після дослідження вразливості, коли підтверджено, що її буде передано на фікс. Без цього статусу буде неможливо запушити файндінг в джиру. + +* False Positive - файндінг не валідний, фікситися не буде + +* Mitigated - Файндінг пофікшений, зазвичайй цей статус підтягується аввтоматично, коли вразливість закривається за допомогою фікса. Дуже рідко цей статус треба проставляти вручну, але це можливо зробити за необхідності. + +Також в bulk edit є поле Risk Acceptance (опції Accept/unaccept) - при виборі accept ризики оцінені і обговорені з бізнесом. Ризик прийнято, фікса не буде. + +Якщо обраний статус Active+Verified, то є можливість запушити тікет в джиру, поставивши в Bulk edit галочку біля "Push to Jira". + +=== Інтеграція з Jira + +Подивитися налаштування інтеграції з Jira на рівні всього дефектдоджо можна https://mdtu-ddm-edp-cicd-defectdojo-uat.apps.cicd2.mdtu-ddm.projects.epam.com/jira[тут] . Також при додаванні нових продуктів у дефектдоджо, необхідно налаштувати інтеграцію з джирою на рівні продукту, інакше не буде можливості пушити в джиру файндінги з цього продукту. Приклад налаштувань Jira на рівні продукту https://mdtu-ddm-edp-cicd-defectdojo-uat.apps.cicd2.mdtu-ddm.projects.epam.com/product/5/edit[тут]. Важливо виставити правильні лейбли. Для статичних сканів label=SAST, для динамічних label=DAST. + +Тікети в Джирі створюються в епіку https://jiraeu.epam.com/browse/MDTUDDM-3017[Security Vulnerabilities]. Тікети створюються в статусі Open та заасайнені на дефолтну людину на проекті. Обов'язково треба перевести тікет в статус In Analysis, бо зі статусу Open тікет не зможе перейти в статус Closed у разі успішного фікса, і буде помилка. Також бажано змінити Asignee на відповідального за конкретний тікет. + +Дефектдоджо підтримує двосторонню інтеграцію з Jira. Це значить, якщо вразливість буде пофікшена і тому відсутня в нових сканах, то Defectdojo відправить сигнал в джиру, щоб перевести тікет в статус Closed. І навпаки, якщо тікет в статусі Closed, а вразливість з'явилася знову, то Defectdojo переведе тікет в статус Open. Так само можна управляти тікетами в дефекдоджо з джири - якщо закрити тікет в джирі, то закриється і вразливість в Defectdojo. + +== Керування залежностями + +Dependency-Track - це відкрите програмне забезпечення, яке призначене для управління залежностями та аналізу безпеки компонентів в програмних проектах. Основна мета Dependency-Track - це допомогти розробникам та інженерам у виявленні та вирішенні потенційних проблем безпеки, пов'язаних із залежностями, використовуваними в їх програмному забезпеченні. + +За допомогою Dependency-Track розробники можуть ефективно керувати ризиками безпеки, пов'язаними з використанням сторонніх компонентів у своєму програмному забезпеченні та приймати відповідні заходи для його поліпшення. + +У dependency track сервіс ідетифікується сукупністю двох речей: project name та version. Project name = назві сервісу, a version завжди дорівнює 1. По суті у dependency track завжди зберігається лише поточна версія сервісу. + +у dependency track завантажується репорт формату cyclonedx та декомпозується методом SBOM. Sbom містить повний список компонентів сервісу та залежності між ними. На відміну від репортів статичних і динамічних сканерів, цей репорт не містить виявлених вразливостей в компонентах. Аналіз виявлених компонентів на вразливості проводить сам dependency track, звертаючись до різноманітних баз вразливостей. + +Dependency track дуже допомагає в роботі з транзитивними залежностями, оскільки можна перевірити, наскільки глибоко в графі залежностей знаходиться транзитивна вразливість. Треба перейти в vulnerabilities, біля назви компоненту натиснути "show in dependency graph" і dependency track покаже, в якому місці в графі містяться різні версії компоненту. + +Defectdojo містить лише вразливі компоненти, тоді як Dependency Track містить всі компоненти. Також Dependency Track надає можливість візуалізувати де саме знаходяться компоненти в рамках одного сервісу за допомогою dependency графу. Крім того, dependency track дозволяє зробити запит по всім сервісам і відповісти на питання: які сервіси містять компонент певної версії, що може бути корисним при розробці. + +У dependencytrack налаштована інтеграція з Defectdojo, як це налаштувати дивись https://docs.dependencytrack.org/integrations/defectdojo/[тут]. Тому всі знайдені вразливості періодично (наразі інтервал налаштований раз в годину, цей параметр можна змінити) пушаться в Дефектдоджо. + +== Цілісність при розробці програмного забезпечення + +Для реалізації цілісності при розробці ПЗ був обраний CIS Software Supply Chain Security Guide. Таблиця з порівняннями з іншими фреймворками знаходиться https://kb.epam.com/pages/viewpage.action?pageId=1782762755[тут]. + +Оцінка відповідності проекту до CIS Software Supply Chain Security Guide знаходиться за https://kb.epam.com/display/MDTUDDM/CIS+Software+Supply+Chain+Security+Assessment[посиланням]. + +Щодо більшості вимог з статусом Non-Valid заведені тікети в епіку https://jiraeu.epam.com/browse/MDTUDDM-12999[Гарантія цілісності компонентів платформи] . \ No newline at end of file diff --git a/docs/ua/modules/arch/pages/architecture-workspace/tech-documentation-tools.adoc b/docs/ua/modules/arch/pages/architecture-workspace/tech-documentation-tools.adoc index 2205fc49db..65575e081f 100644 --- a/docs/ua/modules/arch/pages/architecture-workspace/tech-documentation-tools.adoc +++ b/docs/ua/modules/arch/pages/architecture-workspace/tech-documentation-tools.adoc @@ -1,222 +1,288 @@ -= Інструменти розробки технічної документації += Developing and maintaining technical product documentation +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] -== Опис інструментів для розробки технічної документації проекту +== Description of tools -.Розробка документації ведеться: -- на мові https://asciidoc.org/[AsciiDoc] (мова розмітки з підтримкою структурних та семантичних елементів, яка використовується для формування текстових документів) -- за допомогою https://plantuml.com/[PlantUml] (інструмент з відкритим кодом, який дозволяє описувати UML діаграми, візуалізувати JSON та YAML у текстовому вигляді за допомогою власного доменного синтаксису) -- та за допомогою https://draw.io/[Draw.IO] (онлайн інструмент створення діаграм різних типів з можливостями збереження у SVG форматі с підтримкою подальшого редагування, можна використовувати будь-який інший svg-редактор) +The development of documentation is conducted using the following tools: -Для структурування текстових AsciiDoc документів за розділами та формування єдиного статичного HTML сайту з технічною документацією на базі _.yml_ плейбука конфігурації використовується https://antora.org/[Antora] +* https://asciidoc.org/[AsciiDoc] -- a markup language supporting structural and semantic elements for creating text documents. +* https://plantuml.com/[PlantUml] -- an open-source tool for describing UML diagrams and visualizing `JSON` and `YAML` in text form. +* https://draw.io/[Draw.IO] -- an online tool for creating various types of diagrams, with the ability to save in `SVG` format. -=== Офіційна документація інструментів +For structuring text `AsciiDoc` documents and creating a unified static HTML site, https://antora.org/[Antora] is used, based on _.yml_ playbook configurations. -- https://docs.asciidoctor.org/asciidoc/latest/[Документація AsciiDoc] -- https://asciidoctor.org/docs/asciidoc-writers-guide/[Гайд техрайтера AsciiDoc] -- https://docs.antora.org/antora/2.0/[Документація Antora] +=== Official documentation of tools -=== Локальне оточення для розробки технічної документації +* https://docs.asciidoctor.org/asciidoc/latest/[AsciiDoc Documentation] +* https://asciidoctor.org/docs/asciidoc-writers-guide/[AsciiDoc Technical Writer's Guide] +* https://docs.antora.org/antora/2.0/[Antora Documentation] -.Для ведення розробки документації, необхідно встановити: -- https://www.jetbrains.com/[IntelliJ IDEA / JetBrains WebStorm] -- інтегроване середовище розробки -- https://plugins.jetbrains.com/plugin/7391-asciidoc[AsciiDoc JetBrains плагін] -- підтримка синтаксису AsciiDoc та попереднього перегляду в IntelliJ IDEA та WebStorm -- https://plugins.jetbrains.com/plugin/7017-plantuml-integration[PlantUML Integration IntelliJ IDEA плагін] -- плагін для розробки діаграм у текстовому вигляді з використанням PlantUML синтаксису та їх попереднього перегляду -- (опційно) https://chrome.google.com/webstore/detail/asciidoctorjs-live-previe/iaalpfgpbocpdfblpnhhgllgbdbchmia[Asciidoctor.js Live Preview] -- розширення до браузера Chrome для перегляду AsciiDoc документів (файли з розширенням _.adoc_) +=== Local environment for developing technical documentation -== Перегляд технічної документації через вбудовані можливості перегляду IntelliJ IDEA +Necessary tools for development: -Для перегляду згенерованої документації на локальному оточенні можна використовувати вбудовані можливості перегляду IntelliJ IDEA (_File > Open In > Browser > Built-in Preview_) +- https://www.jetbrains.com/[IntelliJ IDEA / JetBrains WebStorm]: An integrated development environment. +- https://plugins.jetbrains.com/plugin/7391-asciidoc[AsciiDoc JetBrains Plugin]: A plugin for `AsciiDoc` syntax support. +- https://plugins.jetbrains.com/plugin/7017-plantuml-integration[PlantUML Integration]: For developing diagrams with `PlantUML` syntax. +- https://chrome.google.com/webstore/detail/asciidoctorjs-live-previe/iaalpfgpbocpdfblpnhhgllgbdbchmia[Asciidoctor.js Live Preview]: A *Chrome* extension for viewing `AsciiDoc` documents through a web browser. -== Локальне будування Antora +== Viewing technical documentation through IntelliJ IDEA -Також можна збудувати загальну структуру документації https://gitbud.epam.com/mdtu-ddm/general/ddm-architecture[ddm-architecture] за допомогою Antora у локальному оточенні та відкрити збудований файл _index.html_ браузером, встановленим за замовчуванням +IntelliJ IDEA provides several ways for local viewing of technical documentation. Here's how you can utilize these options: -=== Встановлення Antora +=== Using the built-in AsciiDoc toolbar -[NOTE] -Повна інструкція встановлення Antora https://docs.antora.org/antora/2.3/install/install-antora/[тут] +You can use the built-in toolbar above the documentation development window in an open AsciiDoc (`.adoc`) file. Here, you will find options for real-time documentation preview mode: + +. *Show Editor and Preview*: + +** This option lets you see both the code editor and the preview window simultaneously. +** You can edit the documentation in the editor and immediately see the results of these changes in the preview window. +** This is useful for quickly verifying changes, ensuring an efficient editing process. +. *Show Preview Only*: + +** This mode provides only the preview window without the code editor. +** It's ideal for focusing on the final appearance of the documentation, especially when you need to check the overall format and layout of elements. +** You can easily switch to *Show Editor and Preview* mode if you need to make changes. + +=== Viewing options in the top right corner of the development window + +You can also use the viewing options located in the top right corner of the development window: + +. *Built-In Preview*: + +** Opens the built-in preview window directly in the IntelliJ IDEA development environment. +** This is convenient for quick viewing and editing. +. *View in external browser*: + +** *Chrome*: If Chrome is installed, select this option to open a tab with the documentation in the browser. +** *Firefox*: Similarly, select Firefox for viewing in this browser. +** *Edge*: If you use Edge, choose this option. + +TIP: 💡 You can also open the desired viewing option by pressing the key combination `Alt+F2` > `Preview File in...`. + +These IntelliJ IDEA features allow flexible work with technical documentation, providing various viewing options to meet the needs of developers and technical writers. + +== Building Antora in a local environment + +You can build the overall structure of the documentation using Antora in a local environment. -Щоб перевірити чи встановлена Antora можна виконати +=== Installing Antora +NOTE: 📝 Complete installation instructions for Antora can be found at https://docs.antora.org/antora/latest/install/install-antora/[this link]. + +. Check if Antora is installed: ++ [source,bash] ---- antora -v ---- -Для встановлення Antora потрібно для початку встановити Node або yarn - -Щоб перевірити чи Node встановлений та якої версії можна виконати - +. Install *Node*. ++ +To check if *Node* is installed and its version, execute the following command: ++ [source,bash] ---- node --version ---- -==== Встановлення Node на Linux - -Для встановлення Node на Linux треба виконати +==== Installing Node on Linux +* Install Node on Linux using the command: ++ [source,bash] ---- nvm install --lts ---- -[NOTE] --- -Якщо у вас нема встановленого nvm, то його можна встановити https://github.com/nvm-sh/nvm#installing-and-updating[за інструкцією] - -Повна інструкція по встановленню Node на Linux https://docs.antora.org/antora/2.3/install/linux-requirements/[тут] +* See detailed instructions https://docs.antora.org/antora/latest/install/linux-requirements/[at this link]. -Користувачі Linux ласкаво просимо додати важливих деталей які не вказані в цій або повній інструкції --- +TIP: 💡 Linux users are invited to share their comments and supplement important information missing in this brief guide or the complete documentation. -==== Встановлення Node на macOS - -Для встановлення Node на macOS треба виконати +==== Installing Node on macOS +* Install Node on macOS using the command: ++ [source,bash] ---- nvm install --lts ---- -[NOTE] --- -Якщо у вас нема встановленого nvm, то його можна встановити https://github.com/nvm-sh/nvm#installing-and-updating[за інструкцією] - -Повна інструкція по встановленню Node на macOS https://docs.antora.org/antora/2.3/install/macos-requirements/[тут] +* View detailed instructions https://docs.antora.org/antora/latest/install/macos-requirements/[at this link]. -Користувачі macOS ласкаво просимо додати важливих деталей які не вказані в цій або повній інструкції --- +TIP: 💡 macOS users are invited to share their comments and supplement important information missing in this brief guide or the complete documentation. -==== Встановлення Node на Windows +==== Installing Node on Windows -Для встановлення Node на Windows треба: +For installing Node on Windows, follow these steps: -* Встановити https://chocolatey.org/[Chocolatey] -** Відкрити PowerShell від імені адміністратора -** Виконати: +. *Install https://chocolatey.org/[Chocolatey]:* +.. Open *PowerShell* as an administrator. +.. Execute the command: ++ [source,powershell] ---- Set-ExecutionPolicy Bypass -Scope Process -Force; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) ---- -* Встановити nvm: -** Відкрити PowerShell від імені адміністратора (можна в тому ж вікні що й для встановлення Chocolatey) -** Виконати: +. *Install nvm:* +.. Use the same *PowerShell* window as an administrator. +.. Execute the command: ++ [source,powershell] ---- choco install -y nvm ---- -* Встановити node: -** Відкрити нове вікно PowerShell -** Виконати: +. *Install Node:* +.. Open a new *PowerShell* window. +.. Execute the command: ++ [source,powershell] ---- -nvm install 16.1.0 +nvm install 16.20.2 ---- [IMPORTANT] -Для Windows треба вказувати точну версію Node (приклад - 16.0.1) доки не вирішено https://github.com/coreybutler/nvm-windows/issues/214[nvm-windows#214] +==== +🔑 Specify the exact version of Node for Windows (e.g., `16.20.2`) if you encounter an issue https://github.com/coreybutler/nvm-windows/issues/214[nvm-windows#214]. +==== [NOTE] --- -Якщо після `nvm install` у вас нема встановленого Node, то можна спробувати встановити Node через Chocolatey `choco install nodejs-lts` або `choco install nodejs` +==== +📝 If Node is not installed after running the `nvm install` command, try installing Node through *Chocolatey* using the command: -Повна інструкція по встановленню Node на Windows https://docs.antora.org/antora/2.3/install/windows-requirements/[тут] -Користувачі Windows ласкаво просимо додати важливих деталей які не вказані в цій або повній інструкції --- - -==== Встановлення Antora за допомогою npm +[source,powershell] +---- +choco install nodejs-lts +---- -Щоб встановити Antora за допомогою npm треба виконати: +or -[source,bash] +[source,powershell] ---- -npm i -g @antora/cli@2.3 @antora/site-generator-default@2.3 +choco install nodejs ---- -==== Встановлення Antora за допомогою yarn +TIP: 💡 Detailed instructions can be found https://docs.antora.org/antora/latest/install/windows-requirements/[at this link]. + +Windows users are invited to share their comments and supplement important information missing in this brief guide or the complete documentation. +==== -Щоб встановити Antora за допомогою yarn треба виконати: +==== Installing Antora globally using `npm` +. You can install Antora globally so that the `antora` command is available on your `PATH`. To install Antora globally, pass the `-g` option to `npm i`. ++ [source,bash] ---- -yarn global add @antora/cli@2.3 +npm i -g @antora/cli@3.1 @antora/site-generator@3.1 +---- -yarn global add @antora/site-generator-default@2.3 +. Verify the antora command is available on your `PATH` by running: ++ +[source,bash] +---- +antora -v +---- + +. If the installation was successful, the command should report the version of the Antora CLI and site generator. ++ +[source,bash] +---- +antora -v +@antora/cli: 3.1.5 +@antora/site-generator: 3.1.5 ---- -=== Надання Antora доступу у віддалені Git репозиторії +TIP: 💡 See also: https://docs.antora.org/antora/latest/install/install-antora/#install-dir[Installing Antora Locally]. -.Щоб надати доступ Antora до репозиторіів треба: -* Виконати: +=== Granting access for Antora to remote Git repositories +NOTE: 📝 Complete instructions for accessing private repositories can be found https://docs.antora.org/antora/latest/playbook/private-repository-auth/[at this link]. + +==== Populating the credential store interactively + +To grant Antora access to your source repositories, follow these steps: + +. Open a terminal and execute the command to configure Git: ++ [source,bash] ---- git config --global credential.helper store && \ - echo -n 'Repository URL: ' && read REPLY && \ - git ls-remote -h $REPLY > /dev/null +echo -n 'Repository URL: ' && read REPLY && \ +git ls-remote -h $REPLY > /dev/null ---- ++ +NOTE: 📝 For `'Repository URL: '`, enter the URL of the Git repository to which you need to grant access. + +. Repeat these steps for each repository from your Antora playbook. In our example, it's the _site.yml_ file.) + +==== Populating the credential store directly (GitLab example) + +Use personal access tokens to grant access to repositories: -* Вписати URL Git репозиторію до якого треба надати доступ (та повторити для кожного репозиторію із site.yml) +. In your GitLab account, open https://docs.gitlab.com/ee/user/profile/personal_access_tokens.html[GitLab personal access token] and create a token with `read_repository` scope. -.Також можна використати токени особистого доступу: -* Зайти до https://gitbud.epam.com/-/profile/personal_access_tokens[GitLab personal access token] -* Створити токен зі скоупом `read_repository` -* Та надати доступ до репозиторіїв: -** Через змінну оточення `GIT_CREDENTIALS` зі значенням `https://:@gitbud.epam.com` (Antora буде використовувати цей токен для всіх репозиторіїв у https://gitbud.epam.com) -** Через файл `.git_credentials` на базі файлу шаблону _.git-credentials.local_ шляхом копіювання та видалення суфіксу _.local_ та додання необхідних репозиторіїв у вигляді: +. To grant access to repositories, use one of the following methods: +** *Through the `GIT_CREDENTIALS` environment variable:* +Set the environment variable with the value of the personal access token. For example: ++ [source,bash] ---- -https://:@gitbud.epam.com/ -# aбо -https://:@gitbud.epam.com/ -# aбо один токен на всі репозиторії -https://:@gitbud.epam.com/ +export GIT_CREDENTIALS='https://:@gitlab.example.com' ---- ++ +Antora will use this token for all repositories in `gitlab.example.com`. -[NOTE] -Повна інструкція надання доступу до приватних репозиторіїв знаходиться https://docs.antora.org/antora/2.3/playbook/private-repository-auth/[тут] - -=== Генерація технічної документації +** *Through the _$HOME/.git_credentials_ file:* +Create or modify the `.git_credentials` file. Add lines with the necessary repositories in the following format: ++ +[source,bash] +---- +https://:@gitlab.example.com/ +# or +https://:@gitlab.example.com/ +# or use a single token for all repositories +https://:gitlab.example.com/ +---- -Для генерації статичного HTML сайту документації з використанням останніх версій розділів з відповідних репозиторіїв треба виконати: +=== Generating technical documentation +* Generate a static HTML site from the documentation using the command: ++ [source,bash] ---- antora site.yml ---- -Для генерації статичного HTML сайту документації з використанням локальних копій розділів документації (необхідно створити з файлу _site-template.yml_ файл _site-local.yml_ та відкорегувати шляхи до локальних директорій. _site-local.yml_ знаходиться у _.gitignore_): - +* Generate a static _LOCAL_ HTML site from the documentation using the command: ++ [source,bash] ---- antora site-local.yml ---- -В обох випадках, сайт технічної документації буде згенеровано у директорію, налаштовану у _.yml_ плейбуці: +The generated site can be viewed locally through the default browser. The output of this site will be available at the path defined in your site.yml playbook: -[source,yaml] ---- output: - dir: ./build/site + dir: ./output/ua ---- -Проглянути збудований сайт можна через браузер, встановлений за замовчуванням, шляхом відкриття файлу _./build/site/index.html_ в IntelliJ IDEA (_File > Open In > Browser > Default_) +=== Setting up quick launch for a documentation generation process in IntelliJ IDEA -=== Налаштування швидкого запуску процесу генерації документації в IntelliJ IDEA +To automate the documentation generation step, you can set up a *Shell Script* run configuration in IntelliJ IDEA: -.Для автоматизації кроку генерації документації, в IntelliJ IDEA можно налаштувати конфігурацію запуску **Shell Script**: -- Викликати з головного меню: _Run > Edit Configurations > Add New Configuration_ -- Вибрати тип конфігурації запуску **Shell Script** -- Вказати ім'я **Name: antora-site** -- Вказати тип скрипта **Execute: Shell Script** -- Вказати скрипт **Script text: antora site-local.yml** +. From the main menu, select: _Run > Edit Configurations > Add New Configuration_. +. Choose the *Shell Script* run configuration type. +. Specify the name *Name: antora-site*. +. Specify the script type *Execute: Shell Script*. +. Specify the script *Script text: _antora site-local.yml_*. -Як результат, в IntelliJ IDEA з'явиться додаткова конфігурація запуску для генерації технічної документації через Antora **antora-site**, яку можна використовувати у якості швидкого виклику. \ No newline at end of file +After setting up, IntelliJ IDEA will have an additional run configuration *antora-site* for generating technical documentation through Antora, which can be used for the quick launch of the process. \ No newline at end of file diff --git a/docs/ua/modules/arch/pages/architecture/container-platform/container-platform.adoc b/docs/ua/modules/arch/pages/architecture/container-platform/container-platform.adoc index f8e912c9cf..3b7df627cb 100644 --- a/docs/ua/modules/arch/pages/architecture/container-platform/container-platform.adoc +++ b/docs/ua/modules/arch/pages/architecture/container-platform/container-platform.adoc @@ -1,12 +1,11 @@ = Платформа оркестрації контейнерів - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Загальний опис -OpenShift — це платформа управління контейнерами з відкритим кодом, що забезпечує розширені можливості оркестрації та +*_OpenShift_* -- це платформа управління контейнерами з відкритим кодом, що забезпечує розширені можливості оркестрації та розгортання контейнеризованого програмного забезпечення. Вона розроблена на базі Kubernetes, надає повноцінний стек рішень та абстракцій для розробки, розгортання, керування та моніторингу контейнерів. Ця платформа надає можливість розгорнути своє програмне забезпечення в будь-якому публічному хмарному середовищі, приватному хмарному середовищі або на власній локальній інфраструктурі, @@ -22,16 +21,16 @@ OpenShift є гнучкою платформою, що може бути лег * розподілені сховища даних для зберігання стану та інформації stateful-застосунків OpenShift є ідеальним рішенням для організацій, які бажають модернізувати свою інфраструктуру програмного забезпечення -та прискорити процеси цифрової трансформації. В Платформі реєстрів, OpenShift використовується в якості основної платформи +та прискорити процеси цифрової трансформації. У Платформі реєстрів OpenShift використовується як основна платформа для розгортання та управління контейнеризованими застосунками. == Функції платформи оркестрації контейнерів -* Оркестрація контейнерів -* Балансування навантаження -* Масштабування застосунків -* Моніторинг застосунків -* Забезпечення безпеки та надійності +* [*] Оркестрація контейнерів +* [*] Балансування навантаження +* [*] Масштабування застосунків +* [*] Моніторинг застосунків +* [*] Забезпечення безпеки та надійності == Верхньорівнева архітектура платформи оркестрації контейнерів @@ -41,13 +40,13 @@ image::architecture/container-platform/container-orchestration.svg[width=750,flo Архітектура OpenShift складається з декількох віртуальних машин, включаючи: * Мастер віртуальні машини. Відповідають за керування загальним станом кластера, включаючи планування та розгортання застосунків. -* Інфраструктурні та платформні віртуальні машини. Містят в собі системні оператори та застосунки що забезпечують роботу +* Інфраструктурні та Платформні віртуальні машини. Містять системні оператори та застосунки, що забезпечують роботу Платформи оркестрації контейнерів та Платформи реєстрів. * Реєстрові віртуальні машини. Запускають контейнери з програмним забезпеченням для роботи реєстру. == Технологічний стек -При проектуванні та розробці підсистеми, були використані наступні технології: +При проєктуванні та розробці підсистеми, були використані наступні технології: * xref:arch:architecture/platform-technologies.adoc#okd[OKD] * xref:arch:architecture/platform-technologies.adoc#kubernetes[Kubernetes] @@ -64,7 +63,7 @@ image::architecture/container-platform/container-orchestration.svg[width=750,flo Платформа досягає масштабованості за допомогою поєднання декларативної конфігурації, автоматичного масштабування (HPA) та автоматичного масштабування самого кластера. Декларативна конфігурація дозволяє адміністраторам визначати та управляти ресурсами застосунків у послідовний та повторюваний спосіб, що полегшує масштабування відповідно до потреб. HPA -відслідковує використання ресурсів окремих застосунків та масштабує їх кількість вгору або вниз залежно від попередньо +відстежує використання ресурсів окремих застосунків та масштабує їх кількість вгору або вниз залежно від попередньо заданих правил, таких як використання CPU чи пам'яті. Автоматичне масштабування кластера, з іншого боку, автоматично створює або видаляє віртуальні машини в кластері в залежності від попиту, що дозволяє ефективно використовувати ресурси та оптимізувати витрати. @@ -74,8 +73,8 @@ image::architecture/container-platform/container-orchestration.svg[width=750,flo Платформа оркестрації контейнерів Openshift надає кілька функцій та механізмів для покращення доступності застосунків, які працюють на платформі, зокрема: -* Openshift підтримує автоматичне балансування навантаження та переключення на резервні екземпляри застосунків на -різніх віртуальних машинах кластеру. Це гарантує, що якщо віртуальна машина працює некоректно, то його роботу можна +* Openshift підтримує автоматичне балансування навантаження та перемикання на резервні екземпляри застосунків на +різних віртуальних машинах кластера. Це гарантує, що якщо віртуальна машина працює некоректно, то його роботу можна безперешкодно перенести на інші здорові машини без впливу на доступність застосунку. * Openshift підтримує концепцію реплік, яка дозволяє запускати кілька екземплярів застосунків одночасно. Це гарантує, що навіть якщо один або декілька екземплярів вийдуть з ладу, застосунок все ще буде доступний для користувачів @@ -91,18 +90,18 @@ image::architecture/container-platform/container-orchestration.svg[width=750,flo Платформа оркестрації контейнерів побудована шляхом абстрагування від деталей інфраструктури та забезпечує стандартне runtime-середовище для застосунків незалежно від місця їх розгортання. Це досягається за допомогою контейнеризації, яка -дозволяє упаковувати застосунки у самодостатні та переносимі контейнери, та використання декларативної конфігурації, що +дозволяє упаковувати застосунки у самодостатні та переносні контейнери, та використання декларативної конфігурації, що автоматизовує надання та налаштування інфраструктурних ресурсів. Крім того, Платформа оркестрації контейнерів надає набір API та абстракцій, що дозволяє командам -експлуатації керувати та оркеструвати контейнеризовані застосунки в стандартний та платформо-незалежний спосіб. +експлуатації керувати та оркеструвати контейнеризовані застосунки у стандартний та платформо__не__залежний спосіб. Таким чином, платформа оркестрації контейнерів дозволяє розгортати та запускати застосунки у будь-яких середовищах без -змін вихідного коду, забезпечуючи зниження часу та зусиль для розгортання застосунків та забезпечуючи їхню переносимість. +змін вихідного коду, забезпечуючи зменшення часу та зусиль для розгортання застосунків, а також їхню мобільність. === _Operability_ -Платформа оркестрації контейнерів Openshift надає набір інструментів адміністратора та API для управління, експлуатації та вирішення +Платформа оркестрації контейнерів Openshift надає набір інструментів адміністратора та API для управління, експлуатації та розв'язання проблем з кластерами та застосунками на ній, включаючи візуальні інтерфейси, консоль утиліту `oc` та OpenShift API. Ці інструменти дозволяють адміністраторам переглядати та керувати станом кластера, розгортати нові додатки або оновлення, diff --git a/docs/ua/modules/arch/pages/architecture/data-exchange/overview.adoc b/docs/ua/modules/arch/pages/architecture/data-exchange/overview.adoc index 5e840b67bb..314079a95d 100644 --- a/docs/ua/modules/arch/pages/architecture/data-exchange/overview.adoc +++ b/docs/ua/modules/arch/pages/architecture/data-exchange/overview.adoc @@ -1,4 +1,5 @@ = Шлюз безпечного обміну "Трембіта" +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] == Загальний опис diff --git a/docs/ua/modules/arch/pages/architecture/data-exchange/trembita/add_restapi.adoc b/docs/ua/modules/arch/pages/architecture/data-exchange/trembita/add_restapi.adoc index 1b15617a68..a66b8e8b6c 100644 --- a/docs/ua/modules/arch/pages/architecture/data-exchange/trembita/add_restapi.adoc +++ b/docs/ua/modules/arch/pages/architecture/data-exchange/trembita/add_restapi.adoc @@ -1,4 +1,5 @@ = Керування сервісами REST +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] Головною вимогою до сервісу, що буде публікуватись в ШБО і викликатись за домомогою REST API через ШБО, є його повна доступність для реєстрового ШБО через адресу та порт, що буде використовуватись при публікації сервісу. Враховуючи, що сервіс, що буде публікуватись, розгортатиметься в тому ж namespace платформи що і ШБО, він буде доступний для ШБО по внутрішньому доменному імені. diff --git a/docs/ua/modules/arch/pages/architecture/data-exchange/trembita/add_soap.adoc b/docs/ua/modules/arch/pages/architecture/data-exchange/trembita/add_soap.adoc index e5e2180cba..2447154ca3 100644 --- a/docs/ua/modules/arch/pages/architecture/data-exchange/trembita/add_soap.adoc +++ b/docs/ua/modules/arch/pages/architecture/data-exchange/trembita/add_soap.adoc @@ -1,4 +1,5 @@ = Керування сервісами SOAP +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] Сервіси SOAP керуються на двох рівнях: diff --git a/docs/ua/modules/arch/pages/architecture/data-exchange/trembita/uxp_general_info.adoc b/docs/ua/modules/arch/pages/architecture/data-exchange/trembita/uxp_general_info.adoc index 86ccf0269c..b8ab91cc73 100644 --- a/docs/ua/modules/arch/pages/architecture/data-exchange/trembita/uxp_general_info.adoc +++ b/docs/ua/modules/arch/pages/architecture/data-exchange/trembita/uxp_general_info.adoc @@ -1,4 +1,5 @@ -= Загальні питання: += Загальні питання +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] Що таке СЕВДЕІР / Трембіта? diff --git a/docs/ua/modules/arch/pages/architecture/libraries/liquibase-ddm-ext/alter-table-api.adoc b/docs/ua/modules/arch/pages/architecture/libraries/liquibase-ddm-ext/alter-table-api.adoc index cd5d58f1d8..53ae7e0baa 100644 --- a/docs/ua/modules/arch/pages/architecture/libraries/liquibase-ddm-ext/alter-table-api.adoc +++ b/docs/ua/modules/arch/pages/architecture/libraries/liquibase-ddm-ext/alter-table-api.adoc @@ -1,5 +1,4 @@ = Розширення alterTableApi - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] diff --git a/docs/ua/modules/arch/pages/architecture/libraries/liquibase-ddm-ext/create-table-api.adoc b/docs/ua/modules/arch/pages/architecture/libraries/liquibase-ddm-ext/create-table-api.adoc index d876d23ca7..d2253a058d 100644 --- a/docs/ua/modules/arch/pages/architecture/libraries/liquibase-ddm-ext/create-table-api.adoc +++ b/docs/ua/modules/arch/pages/architecture/libraries/liquibase-ddm-ext/create-table-api.adoc @@ -1,5 +1,4 @@ = Розширення createTable - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] diff --git a/docs/ua/modules/arch/pages/architecture/libraries/liquibase-ddm-ext/overview.adoc b/docs/ua/modules/arch/pages/architecture/libraries/liquibase-ddm-ext/overview.adoc index 25a15c3e22..f5b3008703 100644 --- a/docs/ua/modules/arch/pages/architecture/libraries/liquibase-ddm-ext/overview.adoc +++ b/docs/ua/modules/arch/pages/architecture/libraries/liquibase-ddm-ext/overview.adoc @@ -1,5 +1,4 @@ = Бібліотека liquibase-ddm-ext - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] diff --git a/docs/ua/modules/arch/pages/architecture/network-crypto-module/overview.adoc b/docs/ua/modules/arch/pages/architecture/network-crypto-module/overview.adoc index 3e779892fd..0fbb94e104 100644 --- a/docs/ua/modules/arch/pages/architecture/network-crypto-module/overview.adoc +++ b/docs/ua/modules/arch/pages/architecture/network-crypto-module/overview.adoc @@ -1,4 +1,5 @@ = Програмно-апаратний криптомодуль "Гряда" +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] == Загальний опис diff --git a/docs/ua/modules/arch/pages/architecture/overview.adoc b/docs/ua/modules/arch/pages/architecture/overview.adoc index c297701362..0b87010703 100644 --- a/docs/ua/modules/arch/pages/architecture/overview.adoc +++ b/docs/ua/modules/arch/pages/architecture/overview.adoc @@ -1,5 +1,4 @@ = Архітектурна документація - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::ROOT:partial$admonitions/language-ua.adoc[] @@ -23,8 +22,6 @@ _Платформа Реєстрів_ направлена на вирішенн * Кожен реєстр потребує створення власної інфраструктури. * Відсутність централізованого розширення функціональних можливостей реєстрів. -//TODO: HERE - == Бізнес-драйвери * 100% державних послуг доступні громадянам та бізнесу у цифровому вигляді @@ -54,15 +51,14 @@ _Платформа Реєстрів_ направлена на вирішенн == Функціональні можливості -* _Low-code_ підхід до розробки реєстрів включно з моделлю даних, бізнес-процесами інформаційних та адміністративних послуг, організаційною структурою, зовнішніми інтеграціями, тощо. -* Веб-інтерфейси кабінетів користувачів для отримання та надання державних послуг +* _Low-code_ підхід до розробки реєстрів включно з моделлю даних, бізнес-процесами інформаційних та адміністративних послуг, організаційною структурою, зовнішніми інтеграціями тощо. +* Вебінтерфейси кабінетів користувачів для отримання та надання державних послуг * Транзакційна модель внесення змін до реєстру з використанням _КЕП_ для підпису запитів на зміну даних * Підтримка швидкої побудови інтеграцій реєстрів на Платформі з зовнішніми системами та учасниками інформаційного обміну _СЕВДЕІР "Трембіта"_ * Публічний API до даних реєстрів та управління рейт-лімітами * Управління правами доступу до даних реєстру за допомогою _RBAC_ -* Побудова аналітичних звітів по даним реєстру -* Формування витягів по даним реєстрів -* тощо. +* Побудова аналітичних звітів за даними реєстру +* Формування витягів за даними реєстрів та багато іншого == Розділи архітектурної документації @@ -71,9 +67,9 @@ _Платформа Реєстрів_ направлена на вирішенн * xref:arch:architecture/platform-conceptual.adoc[] - опис концептуального дизайну рішення, кінцевих користувачів _Платформи Реєстрів_ та зовнішніх систем, з якими побудована взаємодія * xref:arch:architecture/platform-logical.adoc[] - високорівнева структура рішення з описом декомпозиції на складові (зони, підсистеми, тощо.) та взаємодію між ними * xref:arch:architecture/platform-deployment.adoc[] - архітектура розгортання _Платформи Реєстрів_ -* xref:arch:architecture/platform-system-requirements/overview.adoc[] - опис системних вимог до розгортання _Платформі Реєстрів_ на цільовій інфраструктурі +* xref:arch:architecture/platform-system-requirements/overview.adoc[] - опис системних вимог до розгортання _Платформи Реєстрів_ на цільовій інфраструктурі * xref:arch:architecture/security/overview.adoc[] - технічна документація опису архітектури безпеки _Платформи Реєстрів_ -* xref:arch:architecture/platform-technologies.adoc[] - опис переліку та категорій ключових технологій , які застосовані для побудови рішення _Платформі Реєстрів_ -* xref:arch:architecture/platform-quality-attributes/overview.adoc[] - ключові атрибути якості з описом підходів та техник до їх адресування -* _Високорівневий дизайн зон та підсистем Платформи_ - набір розділів з високорівневою архітектурою, описом складових та їх взаємодії, ключових аспектів рішення, тощо. +* xref:arch:architecture/platform-technologies.adoc[] - опис переліку та категорій ключових технологій, які застосовані для побудови рішення _Платформі Реєстрів_ +* xref:arch:architecture/platform-quality-attributes/overview.adoc[] - ключові атрибути якості з описом підходів та технік до їх адресування +* _Високорівневий дизайн зон та підсистем Платформи_ - набір розділів з високорівневою архітектурою, описом складових та їх взаємодії, ключових аспектів рішення тощо. * xref:arch:architecture/platform-api/overview.adoc[] - документація _API_ сервісів _Платформи Реєстрів_ \ No newline at end of file diff --git a/docs/ua/modules/arch/pages/architecture/platform-api/overview.adoc b/docs/ua/modules/arch/pages/architecture/platform-api/overview.adoc index 5ae7e8f36f..e4c89cd582 100644 --- a/docs/ua/modules/arch/pages/architecture/platform-api/overview.adoc +++ b/docs/ua/modules/arch/pages/architecture/platform-api/overview.adoc @@ -1,4 +1,7 @@ = API документація Платформи +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Перелік цільових сервісів diff --git a/docs/ua/modules/arch/pages/architecture/platform-api/services/bp-webservice-gateway.adoc b/docs/ua/modules/arch/pages/architecture/platform-api/services/bp-webservice-gateway.adoc index e4c9c04a1c..8b99ec2841 100644 --- a/docs/ua/modules/arch/pages/architecture/platform-api/services/bp-webservice-gateway.adoc +++ b/docs/ua/modules/arch/pages/architecture/platform-api/services/bp-webservice-gateway.adoc @@ -1,5 +1,9 @@ = REST API документація Сервісу викликів БП зовнішніми системами ==== -swagger::{attachmentsdir}/architecture/platform-api/services/bp-webservice-gateway-swagger.yml[] +Додатково до правил авторизації сервісу можна переглянути документацію +xref:architecture/registry/operational/ext-api-management/overview.adoc[_Зовнішнього API-шлюзу операційної зони_] та +xref:architecture/platform/operational/service-mesh/overview.adoc[_Підсистеми управління міжсервісною взаємодією_] + +swagger::{attachmentsdir}/architecture/platform-api/services/bp-webservice-gateway-core-image-swagger.yml[] ==== \ No newline at end of file diff --git a/docs/ua/modules/arch/pages/architecture/platform-api/services/bpms.adoc b/docs/ua/modules/arch/pages/architecture/platform-api/services/bpms.adoc index 20bfdf93ef..4271535fb4 100644 --- a/docs/ua/modules/arch/pages/architecture/platform-api/services/bpms.adoc +++ b/docs/ua/modules/arch/pages/architecture/platform-api/services/bpms.adoc @@ -1,5 +1,9 @@ = REST API документація сервісу виконання бізнес-процесів ==== +Додатково до правил авторизації сервісу можна переглянути документацію +xref:architecture/registry/operational/ext-api-management/overview.adoc[_Зовнішнього API-шлюзу операційної зони_] та +xref:architecture/platform/operational/service-mesh/overview.adoc[_Підсистеми управління міжсервісною взаємодією_] + swagger::{attachmentsdir}/architecture/platform-api/services/bpms-swagger.yml[] ==== \ No newline at end of file diff --git a/docs/ua/modules/arch/pages/architecture/platform-api/services/ddm-notification-service.adoc b/docs/ua/modules/arch/pages/architecture/platform-api/services/ddm-notification-service.adoc index 9d21489d4c..4c2fb55262 100644 --- a/docs/ua/modules/arch/pages/architecture/platform-api/services/ddm-notification-service.adoc +++ b/docs/ua/modules/arch/pages/architecture/platform-api/services/ddm-notification-service.adoc @@ -1,5 +1,9 @@ = REST API документація Сервісу нотифікацій користувачів ==== +Додатково до правил авторизації сервісу можна переглянути документацію +xref:architecture/registry/operational/ext-api-management/overview.adoc[_Зовнішнього API-шлюзу операційної зони_] та +xref:architecture/platform/operational/service-mesh/overview.adoc[_Підсистеми управління міжсервісною взаємодією_] + swagger::{attachmentsdir}/architecture/platform-api/services/ddm-notification-service-swagger.yml[] ==== \ No newline at end of file diff --git a/docs/ua/modules/arch/pages/architecture/platform-api/services/digital-document-service.adoc b/docs/ua/modules/arch/pages/architecture/platform-api/services/digital-document-service.adoc index b18331afc0..1e18bfc7ac 100644 --- a/docs/ua/modules/arch/pages/architecture/platform-api/services/digital-document-service.adoc +++ b/docs/ua/modules/arch/pages/architecture/platform-api/services/digital-document-service.adoc @@ -1,5 +1,9 @@ = REST API документація Сервісу цифрових документів ==== +Додатково до правил авторизації сервісу можна переглянути документацію +xref:architecture/registry/operational/ext-api-management/overview.adoc[_Зовнішнього API-шлюзу операційної зони_] та +xref:architecture/platform/operational/service-mesh/overview.adoc[_Підсистеми управління міжсервісною взаємодією_] + swagger::{attachmentsdir}/architecture/platform-api/services/digital-document-service-swagger.yml[] ==== \ No newline at end of file diff --git a/docs/ua/modules/arch/pages/architecture/platform-api/services/digital-signature-ops.adoc b/docs/ua/modules/arch/pages/architecture/platform-api/services/digital-signature-ops.adoc index 6c2fd0392c..2b43dc09cd 100644 --- a/docs/ua/modules/arch/pages/architecture/platform-api/services/digital-signature-ops.adoc +++ b/docs/ua/modules/arch/pages/architecture/platform-api/services/digital-signature-ops.adoc @@ -1,5 +1,9 @@ -= REST API документація Сервісу Цифрових Підписів += REST API документація Сервісу цифрових підписів ==== +Додатково до правил авторизації сервісу можна переглянути документацію +xref:architecture/registry/operational/ext-api-management/overview.adoc[_Зовнішнього API-шлюзу операційної зони_] та +xref:architecture/platform/operational/service-mesh/overview.adoc[_Підсистеми управління міжсервісною взаємодією_] + swagger::{attachmentsdir}/architecture/platform-api/services/digital-signature-ops-swagger.yml[] ==== \ No newline at end of file diff --git a/docs/ua/modules/arch/pages/architecture/platform-api/services/excerpt-service-api.adoc b/docs/ua/modules/arch/pages/architecture/platform-api/services/excerpt-service-api.adoc index 06e3ef86cd..ec36a8b3c0 100644 --- a/docs/ua/modules/arch/pages/architecture/platform-api/services/excerpt-service-api.adoc +++ b/docs/ua/modules/arch/pages/architecture/platform-api/services/excerpt-service-api.adoc @@ -1,5 +1,9 @@ = REST API документація Сервісу управління витягами ==== +Додатково до правил авторизації сервісу можна переглянути документацію +xref:architecture/registry/operational/ext-api-management/overview.adoc[_Зовнішнього API-шлюзу операційної зони_] та +xref:architecture/platform/operational/service-mesh/overview.adoc[_Підсистеми управління міжсервісною взаємодією_] + swagger::{attachmentsdir}/architecture/platform-api/services/excerpt-service-api-swagger.yml[] ==== \ No newline at end of file diff --git a/docs/ua/modules/arch/pages/architecture/platform-api/services/form-schema-provider.adoc b/docs/ua/modules/arch/pages/architecture/platform-api/services/form-schema-provider.adoc index 0a5f396709..59f23eb3d2 100644 --- a/docs/ua/modules/arch/pages/architecture/platform-api/services/form-schema-provider.adoc +++ b/docs/ua/modules/arch/pages/architecture/platform-api/services/form-schema-provider.adoc @@ -1,5 +1,9 @@ = REST API документація Сервісу постачання UI-форм ==== +Додатково до правил авторизації сервісу можна переглянути документацію +xref:architecture/registry/operational/ext-api-management/overview.adoc[_Зовнішнього API-шлюзу операційної зони_] та +xref:architecture/platform/operational/service-mesh/overview.adoc[_Підсистеми управління міжсервісною взаємодією_] + swagger::{attachmentsdir}/architecture/platform-api/services/form-schema-provider-swagger.yml[] ==== \ No newline at end of file diff --git a/docs/ua/modules/arch/pages/architecture/platform-api/services/form-submission-validation.adoc b/docs/ua/modules/arch/pages/architecture/platform-api/services/form-submission-validation.adoc index c425f0d66c..99fb4a8e37 100644 --- a/docs/ua/modules/arch/pages/architecture/platform-api/services/form-submission-validation.adoc +++ b/docs/ua/modules/arch/pages/architecture/platform-api/services/form-submission-validation.adoc @@ -1,5 +1,9 @@ = REST API документація Сервісу валідації даних UI-форм ==== +Додатково до правил авторизації сервісу можна переглянути документацію +xref:architecture/registry/operational/ext-api-management/overview.adoc[_Зовнішнього API-шлюзу операційної зони_] та +xref:architecture/platform/operational/service-mesh/overview.adoc[_Підсистеми управління міжсервісною взаємодією_] + swagger::{attachmentsdir}/architecture/platform-api/services/form-submission-validation-swagger.yml[] ==== \ No newline at end of file diff --git a/docs/ua/modules/arch/pages/architecture/platform-api/services/keycloak-rest-api-ext.adoc b/docs/ua/modules/arch/pages/architecture/platform-api/services/keycloak-rest-api-ext.adoc index c532bd5434..ac31cea18a 100644 --- a/docs/ua/modules/arch/pages/architecture/platform-api/services/keycloak-rest-api-ext.adoc +++ b/docs/ua/modules/arch/pages/architecture/platform-api/services/keycloak-rest-api-ext.adoc @@ -1,5 +1,9 @@ = REST API документація модулю розширення службового API ==== +Додатково до правил авторизації сервісу можна переглянути документацію +xref:architecture/registry/operational/ext-api-management/overview.adoc[_Зовнішнього API-шлюзу операційної зони_] та +xref:architecture/platform/operational/service-mesh/overview.adoc[_Підсистеми управління міжсервісною взаємодією_] + swagger::{attachmentsdir}/architecture/platform-api/services/keycloak-rest-api-ext-swagger.yml[] ==== \ No newline at end of file diff --git a/docs/ua/modules/arch/pages/architecture/platform-api/services/platform-gateway.adoc b/docs/ua/modules/arch/pages/architecture/platform-api/services/platform-gateway.adoc index 0c64fe1508..941e7c9caa 100644 --- a/docs/ua/modules/arch/pages/architecture/platform-api/services/platform-gateway.adoc +++ b/docs/ua/modules/arch/pages/architecture/platform-api/services/platform-gateway.adoc @@ -1,5 +1,9 @@ = REST API документація шлюзу міжреєстрової взаємодії ==== +Додатково до правил авторизації сервісу можна переглянути документацію +xref:architecture/registry/operational/ext-api-management/overview.adoc[_Зовнішнього API-шлюзу операційної зони_] та +xref:architecture/platform/operational/service-mesh/overview.adoc[_Підсистеми управління міжсервісною взаємодією_] + swagger::{attachmentsdir}/architecture/platform-api/services/platform-gateway-swagger.yml[] ==== \ No newline at end of file diff --git a/docs/ua/modules/arch/pages/architecture/platform-api/services/process-history-service-api.adoc b/docs/ua/modules/arch/pages/architecture/platform-api/services/process-history-service-api.adoc index 6294a9a91e..da4854d27f 100644 --- a/docs/ua/modules/arch/pages/architecture/platform-api/services/process-history-service-api.adoc +++ b/docs/ua/modules/arch/pages/architecture/platform-api/services/process-history-service-api.adoc @@ -1,5 +1,9 @@ = REST API документація Сервісу доступу до історичних даних БП ==== +Додатково до правил авторизації сервісу можна переглянути документацію +xref:architecture/registry/operational/ext-api-management/overview.adoc[_Зовнішнього API-шлюзу операційної зони_] та +xref:architecture/platform/operational/service-mesh/overview.adoc[_Підсистеми управління міжсервісною взаємодією_] + swagger::{attachmentsdir}/architecture/platform-api/services/process-history-service-api-swagger.yml[] ==== \ No newline at end of file diff --git a/docs/ua/modules/arch/pages/architecture/platform-api/services/registry-regulation-management.adoc b/docs/ua/modules/arch/pages/architecture/platform-api/services/registry-regulation-management.adoc index 4424f116ae..d1399ffcf6 100644 --- a/docs/ua/modules/arch/pages/architecture/platform-api/services/registry-regulation-management.adoc +++ b/docs/ua/modules/arch/pages/architecture/platform-api/services/registry-regulation-management.adoc @@ -1,5 +1,9 @@ = REST API документація Сервісу управління регламентом ==== +Додатково до правил авторизації сервісу можна переглянути документацію +xref:architecture/registry/operational/ext-api-management/overview.adoc[_Зовнішнього API-шлюзу операційної зони_] та +xref:architecture/platform/operational/service-mesh/overview.adoc[_Підсистеми управління міжсервісною взаємодією_] + swagger::{attachmentsdir}/architecture/platform-api/services/registry-regulation-management-swagger.yml[] ==== \ No newline at end of file diff --git a/docs/ua/modules/arch/pages/architecture/platform-api/services/user-process-management.adoc b/docs/ua/modules/arch/pages/architecture/platform-api/services/user-process-management.adoc index b427892522..866ea26ad8 100644 --- a/docs/ua/modules/arch/pages/architecture/platform-api/services/user-process-management.adoc +++ b/docs/ua/modules/arch/pages/architecture/platform-api/services/user-process-management.adoc @@ -1,5 +1,9 @@ = REST API документація Сервісу управління процесами користувача ==== +Додатково до правил авторизації сервісу можна переглянути документацію +xref:architecture/registry/operational/ext-api-management/overview.adoc[_Зовнішнього API-шлюзу операційної зони_] та +xref:architecture/platform/operational/service-mesh/overview.adoc[_Підсистеми управління міжсервісною взаємодією_] + swagger::{attachmentsdir}/architecture/platform-api/services/user-process-management-swagger.yml[] ==== \ No newline at end of file diff --git a/docs/ua/modules/arch/pages/architecture/platform-api/services/user-settings-service-api.adoc b/docs/ua/modules/arch/pages/architecture/platform-api/services/user-settings-service-api.adoc index 9aa2e51eb9..672d179d53 100644 --- a/docs/ua/modules/arch/pages/architecture/platform-api/services/user-settings-service-api.adoc +++ b/docs/ua/modules/arch/pages/architecture/platform-api/services/user-settings-service-api.adoc @@ -1,5 +1,9 @@ = REST API документація Сервісу управління налаштуваннями користувачів ==== +Додатково до правил авторизації сервісу можна переглянути документацію +xref:architecture/registry/operational/ext-api-management/overview.adoc[_Зовнішнього API-шлюзу операційної зони_] та +xref:architecture/platform/operational/service-mesh/overview.adoc[_Підсистеми управління міжсервісною взаємодією_] + swagger::{attachmentsdir}/architecture/platform-api/services/user-settings-service-api-swagger.yml[] ==== \ No newline at end of file diff --git a/docs/ua/modules/arch/pages/architecture/platform-api/services/user-task-management.adoc b/docs/ua/modules/arch/pages/architecture/platform-api/services/user-task-management.adoc index 592ab58fab..a573ee57f1 100644 --- a/docs/ua/modules/arch/pages/architecture/platform-api/services/user-task-management.adoc +++ b/docs/ua/modules/arch/pages/architecture/platform-api/services/user-task-management.adoc @@ -1,5 +1,9 @@ = REST API документація Сервісу управління задачами користувача ==== +Додатково до правил авторизації сервісу можна переглянути документацію +xref:architecture/registry/operational/ext-api-management/overview.adoc[_Зовнішнього API-шлюзу операційної зони_] та +xref:architecture/platform/operational/service-mesh/overview.adoc[_Підсистеми управління міжсервісною взаємодією_] + swagger::{attachmentsdir}/architecture/platform-api/services/user-task-management-swagger.yml[] ==== \ No newline at end of file diff --git a/docs/ua/modules/arch/pages/architecture/platform-backup-storage/overview.adoc b/docs/ua/modules/arch/pages/architecture/platform-backup-storage/overview.adoc index df581efacc..15ed0c67c2 100644 --- a/docs/ua/modules/arch/pages/architecture/platform-backup-storage/overview.adoc +++ b/docs/ua/modules/arch/pages/architecture/platform-backup-storage/overview.adoc @@ -1,4 +1,7 @@ = Сховище резервних копій Платформи +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Загальний опис diff --git a/docs/ua/modules/arch/pages/architecture/platform-conceptual.adoc b/docs/ua/modules/arch/pages/architecture/platform-conceptual.adoc index 08759a97bf..282b8e038b 100644 --- a/docs/ua/modules/arch/pages/architecture/platform-conceptual.adoc +++ b/docs/ua/modules/arch/pages/architecture/platform-conceptual.adoc @@ -1,5 +1,4 @@ = Концептуальна архітектура Платформи - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] diff --git a/docs/ua/modules/arch/pages/architecture/platform-deployment.adoc b/docs/ua/modules/arch/pages/architecture/platform-deployment.adoc index 73bd8abfa7..7092050eac 100644 --- a/docs/ua/modules/arch/pages/architecture/platform-deployment.adoc +++ b/docs/ua/modules/arch/pages/architecture/platform-deployment.adoc @@ -1,6 +1,7 @@ = Архітектура розгортання Платформи +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] -== Загальний опис +include::platform:ROOT:partial$admonitions/language-ua.adoc[] За процедуру інсталяції _Платформи Реєстрів_ відповідає xref:architecture/platform-installer/overview.adoc[Компонент керування станом ресурсів Платформи], що розроблений з урахуванням сумісності між різними постачальниками інфраструктури. @@ -13,13 +14,13 @@ * xref:admin:installation/platform-deployment/platform-deployment-overview.adoc[] -Детальніше з технічним дизайном підсистем та компонент, які задіяні в інсталяції, можна ознайомитись у розділах: +Детальніше з технічним дизайном підсистем та компонент, які залучені в інсталяції, можна ознайомитись у розділах: * xref:architecture/platform-installer/overview.adoc[Компонент керування станом ресурсів Платформи] * xref:architecture/container-platform/container-platform.adoc#_portability[Платформа оркестрації контейнерів] -- -На даній діаграмі зображено розгортання інфраструктури _Платформи Реєстрів_ в одному регіоні (_AZ_) публічного хмарного середовища _AWS_. +Подана діаграма показує розгортання інфраструктури _Платформи Реєстрів_ в одному регіоні (_AZ_) публічного хмарного середовища _AWS_. -.Архітектура розгортання _Платформи Реєстрів_ на _AWS_ +.Архітектура розгортання _Платформи Реєстрів_ в _AWS_-середовищі image::architecture/ddm-platform-infrastructure-deployment.drawio.svg[] \ No newline at end of file diff --git a/docs/ua/modules/arch/pages/architecture/platform-installer/installation-process.adoc b/docs/ua/modules/arch/pages/architecture/platform-installer/installation-process.adoc index 5a54df24f0..bd3ece8018 100644 --- a/docs/ua/modules/arch/pages/architecture/platform-installer/installation-process.adoc +++ b/docs/ua/modules/arch/pages/architecture/platform-installer/installation-process.adoc @@ -1,4 +1,5 @@ = Процес інсталяції та оновлення Платформи Реєстрів +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] [NOTE] -- diff --git a/docs/ua/modules/arch/pages/architecture/platform-installer/installer-build.adoc b/docs/ua/modules/arch/pages/architecture/platform-installer/installer-build.adoc new file mode 100644 index 0000000000..a80410e4be --- /dev/null +++ b/docs/ua/modules/arch/pages/architecture/platform-installer/installer-build.adoc @@ -0,0 +1,57 @@ += Процес збірки інсталятора Платформи + +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] + +== Загальний опис + +Діаграма послідовності поточного CI/CD процесу: +[plantuml, cicd, svg] +---- +@startuml +autoactivate off +actor "Адміністратор SIT" as user order 10 +participant "SIT" as sit order 20 +participant "control-plane-\nversioner" as versioner order 30 +database "control-plane\n-gerrit.git" as cpgerrit order 40 +participant "control-plane-\ngerrit" as controlplanegerrit order 50 +database "control-plane\n-installer.git" as installer order 60 +participant "control-plane\n-installer" as cpinstaller order 70 + +database "Gerrit" as gerrit order 80 +database "Nexus" as nexus order 90 + +user -> sit: Approve SIT with\nnew component versions +activate sit +sit -> versioner: Start Build +activate versioner +versioner -> sit: Pick component versions from SIT +deactivate sit +versioner -> cpgerrit: Push new component versions to\nstageCR.json, helmfile.yaml +return success +versioner -> controlplanegerrit: Start Build +activate controlplanegerrit +controlplanegerrit -> cpgerrit: Clone repo +controlplanegerrit -> controlplanegerrit: Build cp gerrit +controlplanegerrit -> nexus: Push +return success +versioner -> installer: Push platform component versions\nto helmfile.yaml +return success + +activate cpinstaller +versioner -> cpinstaller: Start Build +versioner -> user: Success build +deactivate user +deactivate versioner +cpinstaller -> nexus: Download components images +return success +cpinstaller -> gerrit: Clone components repos +return success +cpinstaller -> cpinstaller: Building archive +cpinstaller -> nexus: Upload installer archive +return success +deactivate nexus +deactivate user +cpinstaller -> user: Success +@enduml + +---- diff --git a/docs/ua/modules/arch/pages/architecture/platform-installer/installer-structure.adoc b/docs/ua/modules/arch/pages/architecture/platform-installer/installer-structure.adoc index 166555e0f4..fad8dcff21 100644 --- a/docs/ua/modules/arch/pages/architecture/platform-installer/installer-structure.adoc +++ b/docs/ua/modules/arch/pages/architecture/platform-installer/installer-structure.adoc @@ -1,4 +1,7 @@ -= Опис та структура Інсталятора += Опис та структура Інсталера +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Визначення Інсталятор:: набір програмних засобів для розгортання Платформи diff --git a/docs/ua/modules/arch/pages/architecture/platform-installer/overview.adoc b/docs/ua/modules/arch/pages/architecture/platform-installer/overview.adoc index 0b7ae29e1b..c74b2a2003 100644 --- a/docs/ua/modules/arch/pages/architecture/platform-installer/overview.adoc +++ b/docs/ua/modules/arch/pages/architecture/platform-installer/overview.adoc @@ -1,4 +1,7 @@ = Компонент керування станом ресурсів Платформи +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Загальний опис diff --git a/docs/ua/modules/arch/pages/architecture/platform-logical.adoc b/docs/ua/modules/arch/pages/architecture/platform-logical.adoc index fddfea9915..28f1739fd5 100644 --- a/docs/ua/modules/arch/pages/architecture/platform-logical.adoc +++ b/docs/ua/modules/arch/pages/architecture/platform-logical.adoc @@ -1,5 +1,4 @@ = Логічна архітектура Платформи - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] diff --git a/docs/ua/modules/arch/pages/architecture/platform-quality-attributes/platform-performance.adoc b/docs/ua/modules/arch/pages/architecture/platform-quality-attributes/platform-performance.adoc index ceb3d56bce..27ebf8cdad 100644 --- a/docs/ua/modules/arch/pages/architecture/platform-quality-attributes/platform-performance.adoc +++ b/docs/ua/modules/arch/pages/architecture/platform-quality-attributes/platform-performance.adoc @@ -17,24 +17,27 @@ _Атрибут якості визначає здатність системи -- Детальніше з результатами тестування продуктивності можна ознайомитись у відповідних розділах: -* xref:testing:performance-testing/perf-report/1-9-5/perf-test-1-9-5-1500-1.adoc[Тестування продуктивності Платформи 1.9.5 при навантаженні 1500 користувачів на 1 годину] -* xref:testing:performance-testing/perf-report/1-9-5/perf-test-1-9-5-1500-8.adoc[Тестування продуктивності Платформи 1.9.5 при навантаженні 1500 користувачів на 8 годин] +* xref:testing:performance-testing/perf-report/1-9-6/perf-test-1-9-6-1500-1.adoc[Тестування продуктивності Платформи 1.9.6 при навантаженні 1500 користувачів на 1 годину] -- == Цільові метрики При визначенні цільових значень для вищезгаданих метрик, враховується класифікація реєстрів, умови їх експлуатації та прогнозоване навантаження. -.Цільові значення метрик продуктивності для стратегічного реєстру +=== Оперативний реєстр + +.Цільові значення метрик продуктивності для оперативного реєстру |=== .2+|Метрика .2+|Тип запиту 4+^|Цільове значення |_Продуктивні години_|_Години пік_|_Вечірні години_|_Тіньові години_ -.2+|_Latency (мс)_|Операція читання (за ключем та одним полем, без запитів до сторонніх реєстрів)|`1000`|`1500`|`1000`|`1000` -|Операція запису|`3000`|`4500`|`3000`|`3000` -.2+|_Throughput (запитів/c)_|Операція читання|`500`|`1000`|`200`|`100` +.2+|_Latency (мс)_|Операція читання (за ключем та одним полем, без запитів до сторонніх реєстрів)|`1500`|`2000`|`1500`|`1500` +|Операція запису|`3500`|`5000`|`3500`|`3500` +.2+|_Throughput (запитів/c)_|Операція читання|`50`|`75`|`30`|`10` |Операція запису|`5`|`10`|`5`|`0` |=== +=== Тактичний реєстр + .Цільові значення метрик продуктивності для тактичного реєстру |=== .2+|Метрика .2+|Тип запиту 4+^|Цільове значення @@ -45,12 +48,14 @@ _Атрибут якості визначає здатність системи |Операція запису|`5`|`10`|`5`|`0` |=== -.Цільові значення метрик продуктивності для оперативного реєстру +=== Стратегічний реєстр + +.Цільові значення метрик продуктивності для стратегічного реєстру |=== .2+|Метрика .2+|Тип запиту 4+^|Цільове значення |_Продуктивні години_|_Години пік_|_Вечірні години_|_Тіньові години_ -.2+|_Latency (мс)_|Операція читання (за ключем та одним полем, без запитів до сторонніх реєстрів)|`1500`|`2000`|`1500`|`1500` -|Операція запису|`3500`|`5000`|`3500`|`3500` -.2+|_Throughput (запитів/c)_|Операція читання|`50`|`75`|`30`|`10` +.2+|_Latency (мс)_|Операція читання (за ключем та одним полем, без запитів до сторонніх реєстрів)|`1000`|`1500`|`1000`|`1000` +|Операція запису|`3000`|`4500`|`3000`|`3000` +.2+|_Throughput (запитів/c)_|Операція читання|`500`|`1000`|`200`|`100` |Операція запису|`5`|`10`|`5`|`0` |=== \ No newline at end of file diff --git a/docs/ua/modules/arch/pages/architecture/platform-quality-attributes/platform-security.adoc b/docs/ua/modules/arch/pages/architecture/platform-quality-attributes/platform-security.adoc index bf703f0229..55b303a6f6 100644 --- a/docs/ua/modules/arch/pages/architecture/platform-quality-attributes/platform-security.adoc +++ b/docs/ua/modules/arch/pages/architecture/platform-quality-attributes/platform-security.adoc @@ -7,16 +7,111 @@ include::platform:ROOT:partial$admonitions/language-ua.adoc[] _Атрибут якості визначає здатність системи захищати дані та інформацію від несанкціонованого доступу, забезпечуючи при цьому доступ авторизованим користувачам і системам._ -Архітектура безпеки _Платформи Реєстрів_ відповідає за три загальноприйняті характеристики: +Архітектура безпеки _Платформи Реєстрів_ відповідає за наступні характеристики: -* _Конфіденційність_ – властивість захисту даних або сервісів від несанкціонованого доступу. -* _Цілісність_ – властивість того, що дані або послуги не піддаються несанкціонованим маніпуляціям. -* _Доступність_ - властивість, що система буде доступна для цільового використання. +* _Конфіденційність (Confidentiality)_ – властивість захисту даних або сервісів від несанкціонованого доступу. +* _Цілісність (Integrity)_ – властивість того, що дані або послуги не піддаються несанкціонованим маніпуляціям. +* _Доступність (Availability)_- властивість, що система буде доступна для цільового використання. +* _Аутентифікація (Authentication)_ - перевірка ідентичності користувачів, систем або додатків. +* _Авторизація (Authorization)_ - перевірка та надання дозволів на виконання певних дій. +* _Невід'ємність (Non-Repudiation)_ - запобігання спростуванню здійснених дій або комунікацій. +* _Відповідальність (Accountability)_ - здатність відстежувати дії до відповідальної особи. +* _Аудитованість (Auditability)_ - здатність перевіряти дії та зміни для забезпечення дотримання політик. +* _Стійкість (Resilience)_ - здатність системи працювати коректно при негативних умовах. +* _Відповідність (Compliance)_ - забезпечення дотримання законодавчих, регулятивних та політичних вимог щодо безпеки. -[TIP] +Таблиця нижче надає огляд того, як різні аспекти інформаційної безпеки відображаються на атрибутах якості безпеки. Зазначені принципи безпечної розробки, які враховуваються під час роботи над платформою для забезпечення відповідного атрибута якості безпеки та опис поточної реалізації та втілення характеристик атрибуту. + +[NOTE] +-- +Деталі тестування реалізації атрибуту якості наведені у розділі xref:testing:security-testing/security-testing.adoc[]. -- -Детальніше можна ознайомитись у відповідних розділах: -* xref:arch:architecture/security/overview.adoc[] -* xref:testing:security-testing/security-testing.adoc[] --- \ No newline at end of file +[cols="2,1a,1a", options="header"] +|=== +| Характеристика атрибута якості безпеки | Принципи безпечної розробки | Опис поточної реалізації +| _Конфіденційність (Confidentiality)_ +a| +* xref:arch:architecture/security/secure-design-principles.adoc#minimise_attack_surface[Мінімізація площини атак] - Обмежуючи доступ, гарантується, що конфіденційні дані будуть менш доступні. +* xref:arch:architecture/security/secure-design-principles.adoc#defence_in_depth[Принцип захисту на всіх рівнях] - Шифрування даних на всіх етапах (у русі, при зберіганні) забезпечує конфіденційність на декількох рівнях. +* xref:arch:architecture/security/secure-design-principles.adoc#avoid_security_by_obscurity[Уникання безпеки через прихованість] - Покладання на надійне шифрування, а не просто на приховування даних. +a| +* xref:arch:architecture/security/data-encryption-at-rest.adoc[Шифрування даних при зберіганні] +* xref:arch:architecture/security/data-encryption-in-transit.adoc[Шифрування даних у русі] +* xref:arch:architecture/security/secret-management.adoc[Керування Секретами] +* xref:arch:architecture/security/access-control.adoc[Управління доступом] + +| _Цілісність (Integrity)_ +a| +* xref:arch:architecture/security/secure-design-principles.adoc#minimise_attack_surface[Мінімізація площини атак] - Менше точок взаємодії означає менше шансів на зміну даних. +* xref:arch:architecture/security/secure-design-principles.adoc#fail_securely[Безпечна обробка помилок] - Забезпечення того, що збої не призводять до пошкодження даних. +* xref:arch:architecture/security/secure-design-principles.adoc#defence_in_depth[Принцип захисту на всіх рівнях] - Застосування контрольних сум, перевірка цілісності тощо на різних рівнях забезпечує цілісність даних. +* xref:arch:architecture/security/secure-design-principles.adoc#avoid_security_by_obscurity[Уникання безпеки через прихованість] - Використання прозорих методів для забезпечення цілісності даних. +a| +* xref:arch:architecture/security/data-integrity.adoc[Цілісність даних] + +| _Доступність (Availability)_ +a| +* xref:arch:architecture/security/secure-design-principles.adoc#defence_in_depth[Принцип захисту на всіх рівнях] - Резервне копіювання на різних рівнях гарантує постійний доступ до даних та послуг. +* xref:arch:architecture/security/secure-design-principles.adoc#fail_securely[Безпечна обробка помилок] - Система, розроблена для безпечної відмови, забезпечує постійну доступність. +* xref:arch:architecture/security/secure-design-principles.adoc#minimise_attack_surface[Мінімізація площини атак] - Зменшення вразливостей, які можуть призвести до відмови в обслуговуванні. +a| +* xref:arch:architecture/security/data-retention.adoc[Збереження даних] + +| _Аутентифікація (Authentication)_ +a| +* xref:arch:architecture/security/secure-design-principles.adoc#least_privilege[Принцип найменших привілеїв] - Забезпечення доступу до системи тільки для аутентифікованих користувачів з мінімально необхідним набором привілеїв для виконання завдань. +* xref:arch:architecture/security/secure-design-principles.adoc#dont_trust_services[Недовіра до зовнішніх сервісів] - Перевірка ідентичності зовнішніх служб перед взаємодією. +a| +* xref:arch:architecture/security/access-control.adoc[Управління доступом] + +| _Авторизація (Authorization)_ +a| +* xref:arch:architecture/security/secure-design-principles.adoc#least_privilege[Принцип найменших привілеїв] - Призначення мінімально необхідних дозволів +* xref:arch:architecture/security/secure-design-principles.adoc#separation_of_duties[Розділення обов'язків] - Різні ролі мають різні дозволи. +* xref:arch:architecture/security/secure-design-principles.adoc#dont_trust_services[Недовіра до зовнішніх сервісів] - Контроль того, що зовнішні служби можуть та не можуть робити. +a| +* xref:arch:architecture/security/access-control.adoc[Управління доступом] +* xref:arch:architecture/security/secret-management.adoc[Керування Секретами] + +| _Невід'ємність (Non-Repudiation)_ +a| +* xref:arch:architecture/security/secure-design-principles.adoc#audit_and_monitoring[Принцип аудиту та моніторингу] - запобігає спростуванню здійснених дій +a| +* xref:arch:architecture/registry/operational/audit/overview.adoc[Підсистема журналювання подій аудиту] + +| _Відповідальність (Accountability)_ +a| +* xref:arch:architecture/security/secure-design-principles.adoc#separation_of_duties[Розділення обов’язків] - допомагає більш точно відслідкувати зміни до відповідальних осіб. +* xref:arch:architecture/security/secure-design-principles.adoc#audit_and_monitoring[Принцип аудиту та моніторингу] - забезпечення того, що дії можна відстежити до відповідальних осіб. +a| +* xref:arch:architecture/registry/operational/audit/overview.adoc[Підсистема журналювання подій аудиту] +* xref:arch:architecture/platform/operational/logging/overview.adoc[Підсистема журналювання подій] + +| _Аудитованість (Auditability)_ +a| +* xref:arch:architecture/security/secure-design-principles.adoc#keep_security_simple[Простота безпеки] - Прості механізми безпеки легше аудитувати та контролювати. +* xref:arch:architecture/security/secure-design-principles.adoc#audit_and_monitoring[Принцип аудиту та моніторингу] - Забезпечення можливості ефективного огляду та аудиту платформи. +a| +* xref:arch:architecture/registry/operational/audit/overview.adoc[Підсистема журналювання подій аудиту] +* xref:arch:architecture/registry/operational/reporting/overview.adoc[Підсистема аналітичної звітності реєстру] +* xref:arch:architecture/platform/operational/logging/overview.adoc[Підсистема журналювання подій] + + +| _Стійкість (Resilience)_ +a| +* xref:arch:architecture/security/secure-design-principles.adoc#fail_securely[Безпечна обробка помилок] - Система продовжує працювати та зберігати параметри безпеки навіть при виникненні непередбачених помилок. +* xref:arch:architecture/security/secure-design-principles.adoc#defence_in_depth[Принцип захисту на всіх рівнях] - Кілька рівнів безпеки гарантують, що система може витримати різноманітні атаки. +* xref:arch:architecture/security/secure-design-principles.adoc#secure_defaults[Встановлення безпечних значень за замовчуванням] - Використання безпечних налаштувань підвищує стійкість платформи до різноманітних атак +a| +* xref:arch:architecture/security/data-retention.adoc[Збереження даних] + +| _Відповідність (Compliance)_ +a| +* xref:arch:architecture/security/secure-design-principles.adoc#avoid_security_by_obscurity[Уникання безпеки через прихованість] +* xref:arch:architecture/security/secure-design-principles.adoc#keep_security_simple[Простота безпеки] +a| +* xref:arch:architecture/security/data-classification.adoc[Класифікація даних Платформи] +* link:https://epam.github.io/edp-ddm-architecture/en/platform/1.9.6/arch/architecture/security/standards-and-compliance.html[Cтандарти та відповідність] + +|=== diff --git a/docs/ua/modules/arch/pages/architecture/platform-secret-management/overview.adoc b/docs/ua/modules/arch/pages/architecture/platform-secret-management/overview.adoc index 376f5b8738..800330a73f 100644 --- a/docs/ua/modules/arch/pages/architecture/platform-secret-management/overview.adoc +++ b/docs/ua/modules/arch/pages/architecture/platform-secret-management/overview.adoc @@ -1,5 +1,4 @@ = Центральний сервіс управління секретами Платформи - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] diff --git a/docs/ua/modules/arch/pages/architecture/platform-system-requirements/overview.adoc b/docs/ua/modules/arch/pages/architecture/platform-system-requirements/overview.adoc index ef00804eff..eca3e5cda6 100644 --- a/docs/ua/modules/arch/pages/architecture/platform-system-requirements/overview.adoc +++ b/docs/ua/modules/arch/pages/architecture/platform-system-requirements/overview.adoc @@ -1,7 +1,16 @@ -= Системні вимоги Платформи += Системні вимоги +:sectlinks: +:sectanchors: -== Загальний опис +include::platform:ROOT:partial$admonitions/language-ua.adoc[] -В даному розділі задокументовані системні вимоги _Платформи Реєстрів_: +У цьому розділі ви знайдете чіткі та зрозумілі системні вимоги, які допоможуть забезпечити надійну роботу Платформи та екземпляра реєстру. -* xref:arch:architecture/platform-system-requirements/registry-cost.adoc[] - опис підходу до оцінки вартості володіння реєстрами, які розгорнуті на _Платформі Реєстрів_ \ No newline at end of file +_Системні вимоги до екземпляра Платформи_ детально розповідають про технічні специфікації, необхідні для розгортання вашої Платформи у різних середовищах, зокрема _AWS_ та _vSphere_, а також подають огляд вартості інфраструктурних сервісів. + +_Системні вимоги до екземпляра реєстру_ надають конкретні характеристики й вимоги до розгортання реєстру на _Платформі_. Розділ також містить вичерпну інформацію про вартість реєстру. + +== Огляд секції + +* xref:arch:architecture/platform-system-requirements/platform-requirements.adoc[Системні вимоги до екземпляра Платформи] +* xref:arch:architecture/platform-system-requirements/registry-requirements.adoc[Системні вимоги до екземпляра реєстру] \ No newline at end of file diff --git a/docs/ua/modules/arch/pages/architecture/platform-system-requirements/platform-requirements.adoc b/docs/ua/modules/arch/pages/architecture/platform-system-requirements/platform-requirements.adoc new file mode 100644 index 0000000000..4eba81f20d --- /dev/null +++ b/docs/ua/modules/arch/pages/architecture/platform-system-requirements/platform-requirements.adoc @@ -0,0 +1,204 @@ += Системні вимоги до екземпляра Платформи +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] + +CAUTION: Сторінка у процесі розробки... + +У цьому документі наведено системні вимоги до екземпляра Платформи. Основні аспекти цих вимог включають: + +. _Вимоги до OKD-кластера_: OKD-кластер може бути розгорнутим у різних середовищах, включаючи публічні хмари як AWS або приватні рішення на базі vSphere. Кожне середовище вимагає свого підходу та специфікацій. + +. _Вимоги до центральних сервісів Платформи_: Ці сервіси включають компоненти, які є спільними для всіх реєстрів і забезпечують загальне функціонування Платформи. + +Деталі кожного з цих аспектів розглядаються в наступних розділах документа. +Проаналізуйте подану інформацію, щоб забезпечити оптимальний вибір ресурсів та конфігурацію для вашого екземпляра Платформи. + +== Системні вимоги до середовища розгортання Платформи + +=== Системні вимоги до OKD у публічному хмарному середовищі _AWS_ + +CAUTION: Розділ у процесі розробки... + +Хости у вашому середовищі OKD повинні відповідати наступним технічним характеристикам та системним вимогам. + +=== Системні вимоги до OKD 3.11 у хмарному середовищі AWS + +TIP: Див. детальніше https://docs.okd.io/latest/installing/installing_aws/preparing-to-install-on-aws.html[Вимоги до встановлення OKD-кластера у середовищі AWS]. + +//TODO: Check all the figures as they are partially for OKD 3.11 version. Update to 4.11 + +Основні компоненти: :: +* _Мастер-вузли (*master nodes*)_: Керують кластером та ресурсами, контролюють розгортання застосунків, мають сховища конфігурацій. +* _Робочі вузли (*worker nodes*)_: Це вузли, де розгортаються контейнерні застосунки. +* _Інфраструктурні вузли (*infrastructure nodes*)_: Розгортають служби підтримки кластера, такі як маршрутизатори, метрика та журналювання. + +Апаратні вимоги: :: +* _Мастер-вузли (*master nodes*)_: +** CPU: 2 vCPU +** ОЗУ: 16 GB RAM +** Дисковий простір: 40 GB +* _Робочі вузли (*worker nodes*)_: +** CPU: 2 vCPU +** ОЗУ: 8 GB RAM +** Дисковий простір: 15 GB +* _Інфраструктурні вузли (*infrastructure nodes*)_ (якщо вони використовуються): +** CPU: 2 vCPU +** ОЗУ: 8 GB RAM +** Дисковий простір: 20 GB + +Мережеві вимоги: :: +* *MTU*: Рекомендований розмір MTU для ваших мережевих інтерфейсів -- 1500 байтів або більше. +* *DNS*: Усі вузли в кластері повинні мати можливість розв'язувати імена інших вузлів у мережі. + +Вимоги до додаткового програмного забезпечення: :: +* *Docker*: Версія 1.13.1 або новіша для розгортання контейнерів. +* *Red Hat Enterprise Linux*: Версія 8 або новіша для вузлів. + +Вимоги до AWS: :: +* Рекомендовано використовувати оптимізовані для роботи з EBS екземпляри EC2. +* Забезпечте належний доступ до ресурсів AWS, таких як VPC, EC2, S3 тощо. +* Розгляньте використання Elastic Load Balancers для розподілу навантаження. + +=== Системні вимоги до OKD у приватному хмарному середовищі _vSphere_ + +CAUTION: Розділ у процесі розробки... + +Хости у вашому середовищі OKD повинні відповідати наступним технічним характеристикам та системним вимогам. + +//TODO: Check all the figures as they are partially for OKD 3.11 version. Update to 4.11 +[minimal-okd-requirements] +==== Мінімальні вимоги встановлення кластера версії OKD 4.11 на vSphere VMware + +TIP: Див. детальніше https://docs.okd.io/4.11/installing/installing_vsphere/installing-vsphere-installer-provisioned.html[Вимоги до встановлення OKD-кластера у середовищі vSphere]. + +Основні компоненти: :: +* _Мастер-вузли (*master nodes*)_: Керують кластером та ресурсами, контролюють розгортання застосунків, мають сховища конфігурацій. +* _Робочі вузли (*worker nodes*)_: Це вузли, де розгортаються контейнерні застосунки. +* _Інфраструктурні вузли (*infrastructure nodes*)_: Розгортають служби підтримки кластера, такі як маршрутизатори, метрика та журналювання. + +Апаратні вимоги: :: +* _Мастер-вузли (*master nodes*)_: +** CPU: 2 vCPU +** ОЗУ: 16 GB RAM +** Дисковий простір: 40 GB +* _Робочі вузли (*worker nodes*)_: +** CPU: 1 vCPU +** ОЗУ: 8 GB RAM +** Дисковий простір: 15 GB +* _Інфраструктурні вузли (*infrastructure nodes*)_: +** CPU: 2 vCPU +** ОЗУ: 8 GB RAM +** Дисковий простір: 20 GB + +Мережеві вимоги: :: +* *MTU*: Повинен бути налаштований так, щоб підтримувати найбільший розмір пакета, який потрібен для вашого розгортання. +* *DNS*: Всі вузли в кластері повинні мати можливість розв'язувати імена інших вузлів в мережі. + +Вимоги до додаткового програмного забезпечення: :: +* *Docker*: Для розгортання контейнерів. +* *Red Hat Enterprise Linux*: Версія 7.3 або новіша для вузлів. + +Вимоги до vSphere: :: +* *VM hardware*: 13 або новіша версія +* *vSphere ESXi hosts*: 6.5 або новіша +* *vCenter host*: 6.5 або новіша + +{empty} + +Мінімальна підтримувана версія vSphere для компонентів VMware: :: ++ +* *Компонент Hypervisor:* Мінімально підтримувана версія: vSphere 6.5 або новіша, з HW-версією 13. ++ +Це мінімальна версія, яку підтримує Fedora CoreOS (_див. детальніше на офіційному ресурсі: https://access.redhat.com/documentation/ru-ru/red_hat_enterprise_linux/8/html/configuring_and_managing_virtualization/feature-support-and-limitations-in-rhel-8-virtualization_configuring-and-managing-virtualization[Red Hat Enterprise Linux 8 supported hypervisors list]_). + +* *Компонент Storage with in-tree drivers*: Мінімально підтримувана версія -- vSphere 6.5 або новіша. ++ +Цей плагін створює сховище vSphere за допомогою драйверів сховища в ієрархії для vSphere, які входять до OKD. + +* (_Опціонально_) Компонент *Networking (NSX-T)*: Мінімально підтримувана версія -- vSphere 6.5U3 або vSphere 6.7U2 та новіша. ++ +OKD вимагає vSphere 6.5U3 або vSphere 6.7U2+. NSX Container Plug-in (NCP) VMware сертифіковано для OKD 4.6 і NSX-T 3.x. + +== Системні вимоги до центральних сервісів Платформи + +CAUTION: Розділ у процесі розробки... + +Системні вимоги до центральних сервісів Платформи окреслюють необхідні ресурси для їх ефективної роботи. Ці ресурси є спільними для всіх реєстрів. Серед основних сервісів можна виділити: + +Openshift (master та workers):: +Система автоматичного розгортання, масштабування та управління застосунками у контейнерах + +Ceph:: +Підсистема розподіленого зберігання файлів + +Logging:: +Підсистема журналювання подій + +Central Vault:: +Підсистема управління секретами Платформи + +Minio:: +Сховище резервних копій Платформи + +Trembita:: +Шлюз безпечного обміну (ШБО) + +.Орієнтовні системні вимоги до центральних сервісів Платформи +|=== +|Сервіс|Тип машин|Кількість машин|Тип диска машини|Розмір диска машини, Gb + +|Openshift master +|r5.2xlarge (8 CPU, 64 RAM) +|3 +|gp2 +|120 + +|Ceph +|r5.4xlarge (16 CPU, 128 RAM) +|3 +|gp2 +|1170 + +|Logging +|m5.2xlarge (8 CPU, 32 RAM) +|3 +|gp2 +|495 + +|Workers +|r5.2xlarge (8 CPU, 64 RAM) +|5 +|gp2 +|250 + +|Central Vault +|r5.2xlarge (8 CPU, 64 RAM) +|1 +|gp2 +|160 + +|Minio +|r5.2xlarge (8 CPU, 64 RAM) +|1 +|gp2 +|2080 + +|Trembita +|r5.2xlarge (8 CPU, 64 RAM) +|1 +|gp2 +|160 +|=== + +[infra-components-cost] +=== Розрахунок вартості центральних сервісів Платформи + +Обчислювальна вартість центральних сервісів Платформи відображає кошти, вкладені у ресурси, що підтримують спільні сервіси. Оскільки один такий комплекс сервісів може обслуговувати численні реєстри, його вартість розподіляється пропорційно між ними. + +TIP: Більше деталей про те, що входить у вартість, можна знайти в електронній таблиці +xref:attachment$architecture/platform-system-requirements/registry-cost-calculator.xlsx[Розрахунок вартості реєстру] на сторінці _Калькулятор вартості_ _>_ _Орієнтовний розрахунок вартості спільних сервісів_. + +== Пов'язані сторінки + +* xref:arch:architecture/platform-system-requirements/registry-requirements.adoc[] diff --git a/docs/ua/modules/arch/pages/architecture/platform-system-requirements/registry-cost.adoc b/docs/ua/modules/arch/pages/architecture/platform-system-requirements/registry-cost.adoc deleted file mode 100644 index d3f1e1c385..0000000000 --- a/docs/ua/modules/arch/pages/architecture/platform-system-requirements/registry-cost.adoc +++ /dev/null @@ -1,67 +0,0 @@ -= Розрахунок вартості реєстру - -include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] - -include::platform:ROOT:partial$admonitions/language-ua.adoc[] - -Вартість обчислювальних ресурсів реєстру складається з вартості ресурсів які створюються ексклюзивно для реєстру, та частини вартості ресурсів які створені для забезпечення функціонування спільних сервісів. - -Один набір спільних сервісів може обслуговувати десятки реєстрів і вартість його роботи розподіляється між цими реєстрами. В категорію спільних сервісів зокрема входять: - -* Система автоматичного розгортання, масштабування та управління застосунками у контейнерах Openshift (master and workers) -* Підсистема розподіленого зберігання файлів Ceph -* Підсистема журналювання подій Logging -* Підсистема управління секретами платформи Central Vault -* Сховище резервних копій платформи Minio -* Шлюз безпечного обміну Trembita - -== Типові конфігурації - -При розгортанні реєстру за типовими шаблонами можна орієнтуватися на наступну вартість обчислювальних ресурсів. - -|=== -|Шаблон|Кількість ВМ|Сумарна вартість роботи ВМ, $ в міс.|Сумарна вартість диску ВМ, $ в міс.|Сумарна вартість розподіленого сховища, $ в міс.|Сумарна вартість трафіку, $ в міс.|Вартість спільних сервісів, $ в міс.|Підсумкова вартість, $ в міс. - -|Мінімальний|2|220.8|22.85|19.04|49.50|258.52|*570.71* -|Рекомендований|5|552.00|57.12|19.04|49.50|646.30|*1323.96* -|Великий|10|1104.00|114.24|19.04|49.50|1292.61|*2579.39* -|=== - -Ціни дані за тарифами платформи хмарних обчислень Amazon Web Services на кінець 2022 р., за умови режиму роботи 12 годин на добу протягом робочого тижня. - -Більше деталей про те що входить у вартість можна знайти в електронній таблиці xref:attachment$/architecture/platform-system-requirements/registry-cost-calculator.xlsx[розрахунок вартості реєстру] на сторінці _Калькулятор вартості_. - -== Калькулятор вартості - -Для оцінки вартості ресурсів необхідних для роботи реєстру, який відповідає заданим вимогам, можна скористатися наступним калькулятором: - -xref:attachment$/architecture/platform-system-requirements/registry-cost-calculator.xlsx[Розрахунок вартості реєстру - Excel] - -На сторінці _Вибір розміру реєстру_ в рядку _Ваш реєстр_ можна побачити результати розрахунку, а нижче, під результатом, вибір параметрів реєстру. - -=== Результати - -Кількість ВМ:: Розрахована кількість віртуальних машин необхідна для роботи реєстру який відповідає заданим нижче параметрам. -Вартість:: Розрахована місячна вартість роботи за цінами платформи хмарних обчислень Amazon Web Services. Складається з вартості віртуальних машин необхідних для роботи реєстру та вартості користування спільними сервісами платформи реєстрів. - -=== Вхідні параметри -==== Базові параметри - -Режим високої доступності:: Резервування додаткових екземплярів компонентів реєстру та потужностей для автоматичного горизонтального масштабування. -Режим роботи:: Час коли реєстр працює. - -==== Об'єм реєстру -Кількість бізнес сутностей:: Кількість таблиць в моделі даних реєстру -Максимальна кількість екземплярів бізнес сутностей (рядків в таблиці):: Кількість рядків у найбільшій таблиці реєстру. -Приблизний об'єм історичних даних в GB:: Об'єм даних що завантажуються в реєстр перед початком промислової експлуатації (первинне завантаження). - -==== Параметри реєстру -Наступні параметри задаються окремо для кожної з трьох категорій користувачів - посадові особи, громадяни, інші системи. - -Кількість користувачів:: Кількість зареєстрованих користувачів які можуть користуватися реєстром. -Кількість послуг (бізнес-процесів):: Кількість послуг які може надавати реєстр різним категоріям користувачів. -Середня кількість задач для користувачів на послугу:: Середня кількість задач які потребують введення від користувача. -Середня кількість автоматизованих задач на послугу:: Середня кількість задач які не потребують введення від користувача. -Кількість звітів:: Загальна кількість змодельованих звітів, що використовуються посадовими особами. -Кількість витягів:: Загальна кількість змодельованих витягів. -Кількість надаваних послуг в місяць:: Загальна кількість всіх типів послуг надаваних протягом місяця. diff --git a/docs/ua/modules/arch/pages/architecture/platform-system-requirements/registry-requirements.adoc b/docs/ua/modules/arch/pages/architecture/platform-system-requirements/registry-requirements.adoc new file mode 100644 index 0000000000..30031a51bd --- /dev/null +++ b/docs/ua/modules/arch/pages/architecture/platform-system-requirements/registry-requirements.adoc @@ -0,0 +1,137 @@ += Системні вимоги до екземпляра реєстру +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] + +== Системні вимоги + +Розрахунок системних вимог до конкретного реєстру є ключовим аспектом планування його інфраструктури та ресурсів. Різні реєстри можуть мати відмінності через обсяг даних, кількість користувачів, структуру даних та інші параметри, що зумовлюють їхні специфічні системні потреби. + +На цій сторінці представлені рекомендації та параметри для різних конфігурацій реєстру. Параметр *`1 VM calculation reference`* визначає референтне значення для однієї віртуальної машини (ВМ). За його основою ми пропонуємо три основні конфігурації шаблонів розгортання: + +minimal :: +Ця конфігурація призначена для реєстрів із невеликим обсягом даних та користувачів. +Вона оптимально підходить для пілотних проєктів, тестування або реєстрів, які знаходяться на ранніх стадіях впровадження. +Хоча така конфігурація має обмежені ресурси, вона все ще забезпечує надійність і базову продуктивність. + +recommended :: +Ця конфігурація рекомендована для більшості реєстрів, які функціонують у середньому та високому режимах навантаження. +Вона добре збалансована між ресурсами, продуктивністю та вартістю, тому підходить для реєстрів, які обслуговують середню кількість користувачів та мають помірний обсяг даних. + +large:: +Конфігурація для великих реєстрів зі значним обсягом даних та високим навантаженням. +Вона призначена для реєстрів, які обслуговують велику кількість користувачів, мають багато складних бізнес-процесів та вимагають високої продуктивності. +Ця конфігурація забезпечує максимальну продуктивність та гнучкість, але вимагає більше ресурсів і коштів. + +Кожна з таких конфігурацій має свої системні характеристики, такі як _тип машини (CPU, RAM)_, _розмір диска_, _тип диска_, розмір сховища файлової системи, очікуваний об'єм трафіку тощо. + +.Орієнтовні системні вимоги до одного екземпляра реєстру +|=== +|Шаблон|Тип машин|Кількість машин|Тип диску машини|Розмір диска машини, Gb|Тип диска Ceph|Розмір сховища в Ceph, Gb|Очікуваний об'єм трафіку в місяць, Gb + +|1 VM calculation reference + +|m5.2xlarge (8 CPU, 32 RAM) +|1 +|gp3 +|120 +|gp3 +|200 +|550 + +|minimal +|m5.2xlarge (8 CPU, 32 RAM) +|2 +|gp3 +|120 +|gp3 +|200 +|550 + +|recommended +|m5.2xlarge (8 CPU, 32 RAM) +|5 +|gp3 +|120 +|gp3 +|200 +|550 + +|large +|m5.2xlarge (8 CPU, 32 RAM) +|10 +|gp3 +|120 +|gp3 +|200 +|550 +|=== + +== Розрахунок вартості реєстру + +Вартість обчислювальних ресурсів реєстру складається з вартості ресурсів які створюються ексклюзивно для реєстру, та частини вартості ресурсів які створені для забезпечення функціонування спільних сервісів. + +Один набір спільних сервісів може обслуговувати десятки реєстрів і вартість його роботи розподіляється між цими реєстрами (_див. детальніше на сторінці xref:arch:architecture/platform-system-requirements/platform-requirements.adoc[]_). + +=== Типові конфігурації + +При розгортанні реєстру за типовими шаблонами можна орієнтуватися на наступну вартість обчислювальних ресурсів. + +|=== +|Шаблон|Кількість ВМ|Сумарна вартість роботи ВМ, $ в міс.|Сумарна вартість диску ВМ, $ в міс.|Сумарна вартість розподіленого сховища, $ в міс.|Сумарна вартість трафіку, $ в міс.|Вартість спільних сервісів, $ в міс.|Підсумкова вартість, $ в міс. + +|Мінімальний|2|220.8|22.85|19.04|49.50|258.52|*570.71* +|Рекомендований|5|552.00|57.12|19.04|49.50|646.30|*1323.96* +|Великий|10|1104.00|114.24|19.04|49.50|1292.61|*2579.39* +|=== + +NOTE: Ціни подано за тарифами платформи хмарних обчислень Amazon Web Services на кінець 2022 р., за умови режиму роботи 12 годин на добу протягом робочого тижня. + +TIP: Більше деталей про те, що входить у вартість, можна знайти в електронній таблиці +xref:attachment$architecture/platform-system-requirements/registry-cost-calculator.xlsx[Розрахунок вартості реєстру] на сторінці _Калькулятор вартості_. + +=== Калькулятор вартості + +Для оцінки вартості ресурсів необхідних для роботи реєстру, який відповідає заданим вимогам, можна скористатися наступним калькулятором: + +* xref:attachment$architecture/platform-system-requirements/registry-cost-calculator.xlsx[Розрахунок вартості реєстру] + +На сторінці _Вибір розміру реєстру_ в рядку _Ваш реєстр_ можна побачити результати розрахунку, а нижче, під результатом, вибір параметрів реєстру. + +==== Результати + +Кількість ВМ:: Розрахована кількість віртуальних машин, необхідна для роботи реєстру, який відповідає заданим нижче параметрам. +Вартість:: Розрахована місячна вартість роботи за цінами платформи хмарних обчислень Amazon Web Services. Складається з вартості віртуальних машин необхідних для роботи реєстру та вартості користування спільними сервісами Платформи реєстрів. + +==== Вхідні параметри +===== Базові параметри + +Режим високої доступності:: Резервування додаткових екземплярів компонентів реєстру та потужностей для автоматичного горизонтального масштабування. +Режим роботи:: Час, коли реєстр працює. + +===== Об'єм реєстру +Кількість бізнес сутностей:: Кількість таблиць в моделі даних реєстру +Максимальна кількість екземплярів бізнес сутностей (рядків в таблиці):: Кількість рядків у найбільшій таблиці реєстру. +Приблизний об'єм історичних даних в GB:: Об'єм даних що завантажуються в реєстр перед початком промислової експлуатації (первинне завантаження). + +===== Параметри реєстру +Наступні параметри задаються окремо для кожної з трьох категорій користувачів: _посадові особи/надавачі послуг_, _громадяни/отримувачі послуг_, _інші системи_. + +Кількість користувачів:: Кількість зареєстрованих користувачів, які можуть користуватися реєстром. +Кількість послуг (бізнес-процесів):: Кількість послуг, які може надавати реєстр різним категоріям користувачів. +Середня кількість задач для користувачів на послугу:: Середня кількість задач, які потребують введення від користувача. +Середня кількість автоматизованих задач на послугу:: Середня кількість задач, які не потребують введення від користувача. +Кількість звітів:: Загальна кількість змодельованих звітів, що використовуються посадовими особами. +Кількість витягів:: Загальна кількість змодельованих витягів. +Кількість надаваних послуг в місяць:: Загальна кількість всіх типів послуг надаваних протягом місяця. + +== Пов'язані сторінки + +Ознайомтеся з цими ресурсами для отримання додаткової інформації та поглиблення вашого розуміння: + +* xref:arch:architecture/platform-system-requirements/platform-requirements.adoc[] +* xref:admin:registry-management/control-plane-create-registry.adoc#vm-params[Розгортання реєстру: параметри віртуальних машин] +* xref:admin:registry-management/control-plane-registry-resources.adoc[] + + + diff --git a/docs/ua/modules/arch/pages/architecture/platform-technologies.adoc b/docs/ua/modules/arch/pages/architecture/platform-technologies.adoc index f8093aa658..05719b6f93 100644 --- a/docs/ua/modules/arch/pages/architecture/platform-technologies.adoc +++ b/docs/ua/modules/arch/pages/architecture/platform-technologies.adoc @@ -1,5 +1,4 @@ = Технологічний стек Платформи - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] @@ -62,6 +61,9 @@ image::architecture/ddm-platform-tech-view.svg[] |[[postgresql]]https://www.postgresql.org/[PostgreSQL]|14.5.0|https://opensource.org/licenses/postgresql[The PostgreSQL Licence]|Об'єктно реляційна система керування базами даних |[[redis]]https://redis.io/[Redis]|6.0.8|https://redis.io/docs/about/license/[Three clause BSD license]|Розподілене сховище пар ключ-значення, які зберігаються в оперативній пам'яті |[[ceph]]https://ceph.io/en/[Ceph]|6.2.0-152|https://github.com/ceph/ceph/blob/main/COPYING[LGPL-2.1, LGPL-3, BSD 3-clause, Apache-2.0, MIT License, Boost Software License, Version 1.0, BSD 3-clause, CC0, Boost Software License, Version 1.0, GNU Affero General Public License, Version 3, ]|Розподілена файлова система +|[[noobaa]]https://noobaa.io[Multo Cloud Gateway (NooBaa)]|4.0.2|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Розширення для інтеграції об’єктного сховища з OpenShift, що дозволяє підключатися до сховищ з різних хмарних провайдерів, та забезпечує простий доступ до даних з різноманітних джерел. + + |=== === Розширення @@ -146,7 +148,7 @@ image::architecture/ddm-platform-tech-view.svg[] |=== |Технологія|Версія|Ліцензія|Опис -|[[keycloak]]https://www.keycloak.org/[Keycloak]|15 -> 20|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Система для управління користувачами та їх доступом, автентифікації, інтеграції з зовнішніми Identity провайдерами +|[[keycloak]]https://www.keycloak.org/[Keycloak]|20.0.3|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Система для управління користувачами та їх доступом, автентифікації, інтеграції з зовнішніми Identity провайдерами |=== === Оператори @@ -243,8 +245,9 @@ image::architecture/ddm-platform-tech-view.svg[] |=== |Оператор|Версія|Ліцензія|Опис -|[[ext-secrets-operator]]https://external-secrets.io/[External Secrets Operator]|0.7.0|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Operator для забезпечення інтеграції Hashicorp Vault з Kubernetes Secrets -|[[reloader]]https://github.com/stakater/Reloader[Reloader]|1.0.25|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Operator для спостереження за змінами в ConfigMaps та Secrets та їх оновлення на подах компонентів реєстру +|[[ext-secrets-operator]]https://external-secrets.io/[External Secrets Operator]|0.7.0|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Оператор для забезпечення інтеграції Hashicorp Vault з Kubernetes Secrets +|[[reloader]]https://github.com/stakater/Reloader[Reloader]|1.0.25|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Оператор для спостереження за змінами в ConfigMaps та Secrets та їх оновлення на подах компонентів реєстру +|[[cert-manager]]https://cert-manager.io/[cert-manager]|1.6.3|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Керує сертифікатами та видавцями сертифікатів як типами ресурсів у кластерах Kubernetes та OKD, спрощує процес отримання, поновлення та використання сертифікатів |=== == Управління бізнес-процесами @@ -386,8 +389,8 @@ image::architecture/ddm-platform-tech-view.svg[] |=== |Технологія|Версія|Ліцензія|Опис -|[[kiali]]https://kiali.io/[Kiali]|1.35.0|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]| UI застосунок для Istio Service Mesh -|[[jaeger]]https://www.jaegertracing.io/[Jaeger]|1.24.0|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]| Система для забезпечення розподіленого трейсингу сервісів платформи +|[[kiali]]https://kiali.io/[Kiali]|1.67.0|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]| UI застосунок для Istio Service Mesh +|[[jaeger]]https://www.jaegertracing.io/[Jaeger]|1.39.0|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]| Система для забезпечення розподіленого трейсингу сервісів платформи |[[grafana]]https://grafana.com/[Grafana]|7.4.5|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Перегляд та аналіз метрик системи, налаштування нотифакацій по метрикам |[[prometheus]]https://prometheus.io/[Prometheus]|2.24.0|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Timeseries база данних для збереження метрик платформи та query engine по цим даним |=== diff --git a/docs/ua/modules/arch/pages/architecture/platform/administrative/config-management/overview.adoc b/docs/ua/modules/arch/pages/architecture/platform/administrative/config-management/overview.adoc index 4f44f29de7..2837dd75d0 100644 --- a/docs/ua/modules/arch/pages/architecture/platform/administrative/config-management/overview.adoc +++ b/docs/ua/modules/arch/pages/architecture/platform/administrative/config-management/overview.adoc @@ -39,6 +39,13 @@ image::architecture/platform/administrative/config-management/config-mgmt.drawio |https://github.com/epam/edp-ddm-control-plane-jenkins[github:/epam/edp-ddm-control-plane-jenkins] |Програмний комплекс, що забезпечує автоматизацію в життєвому циклі Платформи та Реєстрів. Виконує фактичне розгортання Реєстру, конфігурування, оновлення та безліч інших автоматизованих задач в Платформі. +|_Агент сервісу розгортання конфігурації_ +|`control-plane` +|— +|origin +|https://github.com/epam/edp-ddm-infrastructure-jenkins-agent[github:/epam/edp-ddm-infrastructure-jenkins-agent] +|Jenkins агент, що використовується для виконання задач розгортання, налаштування та оновлення Платформи та Реєстрів. + |_Сховище артефактів Платформи_ |`control-plane-nexus` |`nexus` diff --git a/docs/ua/modules/arch/pages/architecture/platform/administrative/config-management/registry-platform-keys.adoc b/docs/ua/modules/arch/pages/architecture/platform/administrative/config-management/registry-platform-keys.adoc index f5bc32bf09..6d4aca956f 100644 --- a/docs/ua/modules/arch/pages/architecture/platform/administrative/config-management/registry-platform-keys.adoc +++ b/docs/ua/modules/arch/pages/architecture/platform/administrative/config-management/registry-platform-keys.adoc @@ -1,5 +1,4 @@ = Оновлення платформних та реєстрових ключів та конфігурації сервісу цифрового підпису - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] @@ -9,9 +8,9 @@ include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Загальні положення * Адміністратор за допомогою Адміністративного інтерфейсу управління платформою може редагувати реєстрові або платформні ключі цифрового підпису. -* Веб-інтерфейс управління платформою зберігає внесені адміністратором зміни в сервіс HashiCorp Vault підсистеми управління секретами та +* Вебінтерфейс управління платформою зберігає внесені адміністратором зміни в сервіс HashiCorp Vault підсистеми управління секретами та шифруванням або в сервіс Gerrit підсистеми розгортання та налаштування Платформи та реєстрів. -* Веб-інтерфейс управління платформою відображає шлях до значень та файлів у відповідних values.yaml. +* Вебінтерфейс управління платформою відображає шлях до значень та файлів у відповідних values.yaml. * Пайплайн забирає необхідні дані з HashiCorp Vault або Gerrit та створює необхідні секрети в OpenShift. == Верхньорівневий технічний дизайн diff --git a/docs/ua/modules/arch/pages/architecture/platform/administrative/control-plane/configuration-structure/platform-configuration-structure.adoc b/docs/ua/modules/arch/pages/architecture/platform/administrative/control-plane/configuration-structure/platform-configuration-structure.adoc index 6c4b1fb071..b35066b22f 100644 --- a/docs/ua/modules/arch/pages/architecture/platform/administrative/control-plane/configuration-structure/platform-configuration-structure.adoc +++ b/docs/ua/modules/arch/pages/architecture/platform/administrative/control-plane/configuration-structure/platform-configuration-structure.adoc @@ -113,6 +113,36 @@ TIP: Для зручної навігації по ієрархії специф |✅ |Налаштування доступів до Платформних сервісів. +|`demoRegistryName` +|string +|❌ +|✅ +|Визначає який з присутніх реєстрів на Платформі є демонстраційним. + +|`language` +|string +|❌ +|✅ +|Визначає мову Платформи. + +|`logosPath` +|string +|"configmap:platform-logos-default" +|✅ +|Визначає шлях до конфігураційного файлу з логотипами Платформи. + +|`platformName` +|string +|Адміністративна панель керування Платформою та реєстрами. +|✅ +|Визначає назву Платформи реєстрів. + +|`region` +|string +|ua +|✅ +|Визначає регіон в якому працює Платформа реєстрів. + |=== === Параметри налаштувань доступів до Платформних сервісів diff --git a/docs/ua/modules/arch/pages/architecture/platform/administrative/control-plane/configuration-structure/registry-configuration-structure.adoc b/docs/ua/modules/arch/pages/architecture/platform/administrative/control-plane/configuration-structure/registry-configuration-structure.adoc index 620caa42c7..d2ed7cad46 100644 --- a/docs/ua/modules/arch/pages/architecture/platform/administrative/control-plane/configuration-structure/registry-configuration-structure.adoc +++ b/docs/ua/modules/arch/pages/architecture/platform/administrative/control-plane/configuration-structure/registry-configuration-structure.adoc @@ -598,6 +598,18 @@ dso: |=== |Назва|Тип|Значення за замовчуванням|Обовʼязкове|Призначення +|`<>` +|object +|❌ +|❌ +|Загальні налаштування контейнерів для компонентів реєстру. + +|`<>` +|object +|❌ +|❌ +|Загальні налаштування Istio для компонента реєстру. + |`<>` |object |❌ @@ -610,12 +622,6 @@ dso: |✅ |Налаштування режиму розгортання реєстру. Детальніше див. xref:registry-develop:registry-admin/change-dev-prod-mode.adoc[Налаштування режиму розгортання реєстру]. -|`disableRequestsLimits` -|bool -|true -|✅ -|Визначає чи ввімкнені Requests/Limits для компонентів реєстру. - |`<>` |object |❌ @@ -626,7 +632,7 @@ dso: |[]object |[""] |❌ -|Перелік користувацьких порталів, що не будуть розгортатись в реєстрі. Доступні значення в переліку `officer-portal`, `citizen-portal` або `admin-portal`. +|Перелік користувацьких порталів, що не будуть розгортатись в реєстрі. Доступні значення в переліку `officer`, `citizen` або `admin`. |`<>` |object @@ -640,6 +646,12 @@ dso: |✅ |Налаштувань підсистеми управління реляційними базами даних. +|`geoServerEnabled` +|bool +|false +|✅ +|Визначає наявніть або відсутність підсистеми управління геоданими. + |`<>` |object |❌ @@ -670,6 +682,18 @@ dso: |✅ |Налаштування registry regulation management сервісів. +|`language` +|string +|uk +|❌ +|Налаштування мови реєстру. + +|`region` +|string +|ua +|❌ +|Визначає регіон в якому працює реєстр. Залежить від регіону Платформи. + |=== === Параметри налаштувань реєстрових компонентів @@ -681,155 +705,151 @@ dso: |=== |Назва|Тип|Значення за замовчуванням|Обовʼязкове|Призначення -|`<>` -|object -|❌ -|✅ -|Визначає загальні налаштування компонента `geo-server` реєстру. - -|`<>` -|object -|❌ -|❌ -|Визначає загальні налаштування компонента `bpms` реєстру. - -|`<>` +|`< >>` |object |❌ |❌ -|Визначає загальні налаштування компонента `digital-document-service` реєстру. +|Визначає загальні налаштування конкретного компонента реєстру. -|`<>` -|object -|❌ -|❌ -|Визначає загальні налаштування компонента `digital-signature-ops` реєстру. +|=== -|`<>` -|object -|❌ -|❌ -|Визначає загальні налаштування компонента `registry-kafka-api` реєстру. +[[component]] +[cols="20%,10%,5%,5%,60%",options="header",caption=] +.global.registry.component | <> +|=== +|Назва|Тип|Значення за замовчуванням|Обовʼязкове|Призначення -|`<>` -|object -|❌ +|`replicas` +|int +|1 |❌ -|Визначає загальні налаштування компонента `kong-kong` реєстру. +|Налаштування кількості реплік. Поле доступне для редагування для всіх сервісів, крім geoServer, але має ефект лише для сервісів, що можуть горизонтально маштабуватись. -|`<>` +|<> |object |❌ |❌ -|Визначає загальні налаштування компонента `redis` реєстру. +|Налаштування Istio Sidecar для компонента реєстру. -|`<>` +|<> |object |❌ |❌ -|Визначає загальні налаштування компонента `registry-rest-api` реєстру. +|Налаштування ресурсів контейнера компонента реєстру. -|`<>` -|object +|datasource.maxPoolSize +|string |❌ |❌ -|Визначає загальні налаштування компонента `redis-sentinel` реєстру. +|Налаштування максимального розміру пулу для. Застосовується тільки до компонента `restApi`. -|`<>` -|object -|❌ -|❌ -|Визначає загальні налаштування компонента `registry-soap-api` реєстру. +|=== -|`<>` -|object -|❌ -|❌ -|Визначає загальні налаштування компонента `user-process-management` реєстру. +[[istio]] +[cols="20%,10%,5%,5%,60%",options="header",caption=] +.global.registry.component.istio | <> +|=== +|Назва|Тип|Значення за замовчуванням|Обовʼязкове|Призначення -|`<>` +|<> |object |❌ |❌ -|Визначає загальні налаштування компонента `user-task-management` реєстру. +|Налаштування Istio Sidecar для компонента реєстру. |=== -[[geoServer]] +[[sidecar]] [cols="20%,10%,5%,5%,60%",options="header",caption=] -.global.registry.geoServer | <> +.global.registry.component.istio.sidecar | <> |=== |Назва|Тип|Значення за замовчуванням|Обовʼязкове|Призначення -|`enabled` +|<> +|object +|❌ +|❌ +|Визначає кількість ресурсів виділених для Istio Sidecar. + +|enabled |bool |❌ -|✅ -|Визначає наявніть або відсутність підсистеми управління геоданими. +|❌ +|Вмикає або вимикає Istio Sidecar з поди компонента реєстру. |=== -[[component]] +[[resources]] [cols="20%,10%,5%,5%,60%",options="header",caption=] -.global.registry.component | <> +.global.registry.component.istio.sidecar.resources | <> |=== |Назва|Тип|Значення за замовчуванням|Обовʼязкове|Призначення -|`replicas` -|int +|<> +|object |❌ |❌ -|Налаштування кількості реплік. +|Визначає гранично допустимі ресурси, що може споживати пода компонента реєстру. -|<> +|<> |object |❌ |❌ -|Налаштування Horizontal Pod Autoscaler для компонента реєстру. +|Визначає кількість ресурсів, що резервуються та доступні компоненту реєстру безумовно і одразу від старту. -|<> -|object +|=== + +[[container]] +[cols="20%,10%,5%,5%,60%",options="header",caption=] +.global.registry.component.container | <> +|=== +|Назва|Тип|Значення за замовчуванням|Обовʼязкове|Призначення + +|<> +|[]object |❌ |❌ -|Налаштування Requests/Limits для компонента реєстру. +|Налаштування змінних оточення для контейнера компонента реєстру. -|<> +|<> |object |❌ |❌ -|Налаштування Istio Sidecar для компонента реєстру. +|Налаштування ресурсів для контейнера компонента реєстру. -|<> -|object +|=== + +[[envVars]] +[cols="20%,10%,5%,5%,60%",options="header",caption=] +.global.registry.component.container.envVars | <> +|=== +|Назва|Тип|Значення за замовчуванням|Обовʼязкове|Призначення + +| +|string |❌ |❌ -|Налаштування ресурсів контейнера компонента реєстру. +|Key - назва змінної, value - значення. |=== -[[hpa]] +[[limitsrequests]] [cols="20%,10%,5%,5%,60%",options="header",caption=] -.global.registry.component.hpa | <> +.global.registry.component.container/sidecar.resources.limits/requests |=== |Назва|Тип|Значення за замовчуванням|Обовʼязкове|Призначення -|`enabled` -|bool -|false +|cpu +|string |❌ -|Визначає ввімкнене чи вимкнене автоматичне масштабування. - -|`minReplicas` -|integer -|1 |❌ -|Визначає мінімальну кількість реплік компонента. +|Визначає кількість виданого процесорного часу, задається в millicores (див. https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#meaning-of-cpu[CPU resource units]) -|`maxReplicas` -|integer -|3 +|memory +|string |❌ -|Визначає максимальну кількість реплік компонента. +|❌ +|Визначає кількість виданого ресурсу оперативної памʼяті (див. https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#meaning-of-cpu[Memory resource units]) |=== @@ -976,6 +996,12 @@ dso: |=== |Назва|Тип|Значення за замовчуванням|Обовʼязкове|Призначення +|`replicationFactor` +|int +|1 +|✅ +|Налаштовує фактор реплікації Kafka що визначає кількість копій даних, які зберігаються в кількох брокерах Kafka. + |`<>` |object |❌ @@ -996,6 +1022,13 @@ dso: |✅ |Налаштування сховища підсистеми асинхронного обміну повідомленнями. +|`<>` +|object +|❌ +|✅ +|Налаштування Kafka Zookeeper. + + |=== [[kafka]] @@ -1012,6 +1045,20 @@ dso: |=== +[[zookeeper]] +[cols="20%,10%,5%,5%,60%",options="header",caption=] +.global.kafkaOperator.storage.zookeeper | <> +|=== +|Назва|Тип|Значення за замовчуванням|Обовʼязкове|Призначення + +|`size` +|string +|5Gi +|✅ +|Визначає розмір сховища Kafka Zookeeper. + +|=== + === Параметри налаштувань registry regulation management сервісів `regulationManagement` містить налаштування сервісів registry regulation management. @@ -1029,6 +1076,40 @@ dso: |=== +=== Параметри загальних налаштувань контейнерів для компонентів реєстру +`container` містить налаштування контейнерів для компонентів реєстру. + +[[global.container]] +[cols="20%,10%,5%,5%,60%",options="header",caption=] +.global.container | <> +|=== +|Назва|Тип|Значення за замовчуванням|Обовʼязкове|Призначення + +|`requestsLimitsEnabled` +|bool +|true +|❌ +|Визначає чи ввімкнені Requests/Limits для компонентів реєстру. + +|=== + +=== Параметри загальних налаштувань Istio для компонентів реєстру +`istio` містить налаштування контейнерів для компонентів реєстру. + +[[global.istio]] +[cols="20%,10%,5%,5%,60%",options="header",caption=] +.global.istio | <> +|=== +|Назва|Тип|Значення за замовчуванням|Обовʼязкове|Призначення + +|`sidecar.requestsLimitsEnabled` +|bool +|true +|❌ +|Визначає чи ввімкнені Requests/Limits для Istio Sidecar компонентів реєстру. + +|=== + === Параметри налаштувань підсистеми управління реляційними базами даних `crunchyPostgres` містить налаштування сервісу управління виконанням бізнес-процесів. @@ -1299,11 +1380,11 @@ global: ---- global: computeResources: - instanceCount: 3 - awsInstanceType: "r5.2xlarge" - awsSpotInstance: false - awsInstanceVolumeType: "gp3" - awsInstanceVolumeSize: 80 + instanceCount: 3 + awsInstanceType: "r5.2xlarge" + awsSpotInstance: false + awsInstanceVolumeType: "gp3" + awsInstanceVolumeSize: 80 ---- [source,yaml] @@ -1311,9 +1392,12 @@ global: ---- global: kafkaOperator: + replicationFactor: 1 storage: kafka: size: 20Gi + zookeeper: + size: 5Gi ---- [source,yaml] @@ -1351,6 +1435,7 @@ global: requests: cpu: 350m memory: 128Mi + replicas: 1 ---- [source,yaml] @@ -1359,7 +1444,7 @@ global: global: deploymentMode: production excludePortals: - - "admin-portal" + - "admin" regulationManagement: maxCandidateVersions: 10 whiteListIP: @@ -1396,6 +1481,12 @@ global: |✅ |Визначає порт програмно-апаратного криптомодуля "Гряда". +|`url` +|string +|❌ +|✅ +|Визначає url програмно-апаратного криптомодуля "Гряда". + |=== [source,yaml] @@ -1940,13 +2031,13 @@ external-systems: |=== |Назва| **Тип** | **Значення за замовчуванням** | **Обовʼязкове** | **Призначення** -|`<>` +|`<>` |object |❌ |✅ |Налаштування кабінету отримувача послуг. -|`<>` +|`<>` |object |❌ |✅ @@ -1954,9 +2045,29 @@ external-systems: |=== -[[portals-spec]] +[[citizen-spec]] +[cols="20%,15%,7%,7%,60%",options="header",caption=] +.portals.citizen | <> +|=== +|Назва| **Тип** | **Значення за замовчуванням** | **Обовʼязкове** | **Призначення** + +|`<>` +|object +|❌ +|❌ +|Налаштування власних DNS-імен для кабінетів користувачів. + +|`<>` +|object +|❌ +|✅ +|Налаштування IIT-віджету автентифікації для кабінетів користувачів. + +|=== + +[[officer-spec]] [cols="20%,15%,7%,7%,60%",options="header",caption=] -.portals. | <> +.portals.officer | <> |=== |Назва| **Тип** | **Значення за замовчуванням** | **Обовʼязкове** | **Призначення** @@ -1972,6 +2083,12 @@ external-systems: |✅ |Налаштування IIT-віджету автентифікації для кабінетів користувачів. +|`individualAccessEnabled` +|bool +|❌ +|❌ +|Визначає можливість використовування кабінету надавача послуг фізичною особою + |=== [[customdns-spec]] @@ -2198,12 +2315,6 @@ IMPORTANT: Власноруч вносити зміни в цей файл не |✅ |Налаштування Redis. -|`<>` -|object -|❌ -|✅ -|Налаштування Redis Sentinel. - |=== [[tech-registry-redis]] @@ -2212,12 +2323,6 @@ IMPORTANT: Власноруч вносити зміни в цей файл не |=== |Назва|Тип|Значення за замовчуванням|Обовʼязкове|Призначення -|`replicas` -|string -|❌ -|✅ -|Визначає кількість екземплярів Redis. - |`<>` |string |❌ @@ -2288,12 +2393,6 @@ IMPORTANT: Власноруч вносити зміни в цей файл не |=== |Назва|Тип|Значення за замовчуванням|Обовʼязкове|Призначення -|`<>` -|object -|❌ -|✅ -|Містить налаштування екземплярів підсистеми управління реляційними базами даних. - |`<>` |object |❌ @@ -2302,40 +2401,6 @@ IMPORTANT: Власноруч вносити зміни в цей файл не |=== -[[instances]] -[cols="20%,15%,5%,5%,60%",options="header",caption=] -.global.crunchyPostgresOperator.instances | <> -|=== -|Назва|Тип|Значення за замовчуванням|Обовʼязкове|Призначення - -|`<>` -|object -|❌ -|✅ -|Містить налаштування операційних екземплярів БД підсистеми управління реляційними базами даних. - -|`<>` -|object -|❌ -|✅ -|Містить налаштування аналітичних екземплярів БД підсистеми управління реляційними базами даних. - -|=== - -[[replicas]] -[cols="20%,15%,5%,5%,60%",options="header",caption=] -.global.crunchyPostgresOperator.instances.operational (analytical) | <> -|=== -|Назва|Тип|Значення за замовчуванням|Обовʼязкове|Призначення - -|`replicas` -|int -|❌ -|✅ -|Визначає кількість екземплярів відповідних БД підсистеми управління реляційними базами даних. - -|=== - [[minioConf]] [cols="20%,15%,5%,5%,60%",options="header",caption=] .global.crunchyPostgresOperator.minioConf | <> @@ -2362,30 +2427,6 @@ IMPORTANT: Власноруч вносити зміни в цей файл не |=== |Назва|Тип|Значення за замовчуванням|Обовʼязкове|Призначення -|`<>` -|object -|❌ -|✅ -|Містить налаштування сховища сервісу асинхронного обміну повідомленнями. - -|`kafkaBrokers` -|int -|3 -|✅ -|Визначає кількість екземплярів Kafka брокерів. - -|`zookeepers` -|int -|3 -|✅ -|Визначає кількість екземплярів Zookeepers. - -|`replicationFactor` -|int -|3 -|✅ -|Налаштовує фактор реплікації Kafka що визначає кількість копій даних, які зберігаються в кількох брокерах Kafka. - |`kafkaCentralNamespace` |string |❌ @@ -2394,34 +2435,6 @@ IMPORTANT: Власноруч вносити зміни в цей файл не |=== -[[kafka-storage]] -[cols="20%,15%,5%,5%,60%",options="header",caption=] -.kafkaOperator.storage | <> -|=== -|Назва|Тип|Значення за замовчуванням|Обовʼязкове|Призначення - -|`<>` -|object -|❌ -|✅ -|Містить налаштування Kafka Zookeeper. - -|=== - -[[kafka-storage-zookeper]] -[cols="20%,15%,5%,5%,60%",options="header",caption=] -.kafkaOperator.storage.zookeeper | <> -|=== -|Назва|Тип|Значення за замовчуванням|Обовʼязкове|Призначення - -|`size` -|string -|5Gi -|✅ -|Визначає розмір сховища Kafka Zookeeper. - -|=== - [[platform]] [cols="20%,15%,5%,5%,60%",options="header",caption=] .platform | <> diff --git a/docs/ua/modules/arch/pages/architecture/platform/administrative/control-plane/platform-evolution/control-plane-localization/control-plane-localization.adoc b/docs/ua/modules/arch/pages/architecture/platform/administrative/control-plane/platform-evolution/control-plane-localization/control-plane-localization.adoc new file mode 100644 index 0000000000..b64f8f7a80 --- /dev/null +++ b/docs/ua/modules/arch/pages/architecture/platform/administrative/control-plane/platform-evolution/control-plane-localization/control-plane-localization.adoc @@ -0,0 +1,131 @@ += Локалізація control-plane + +== Загальний опис + +Адміністратор повинен мати можливість обрати мову для інтерфейсів платформи. Наразі це тільки control-plane-console. + +== Актори та ролі користувачів + +* Адміністратор платформи +* Технічний адміністратор реєстру + +== Функціональні сценарії + +* Управління налаштуванням мови платформи. +* Перегляд та використання інтерфейсу control plane console у обраній мові. + +== Загальні принципи та положення + +* Мову обирає адміністратор платформи для всіх користувачів control-plane-console. +* Користувачі control-plane-console не можуть змінювати себе мову індивідуально. +* Застосування змін потребує оновлення файлів (helm конфігурація) у git та пере-розгортання cp консолі +* Зараз необхідно додати дві мови - англійську та українську +* За замовчуванням обрано англійську +** Для існуючих екземплярів платформи значення мови не буде обрано. Необхідно інтерпретувати це значення як українську для зворотної сумісності. +* Кожній мові відповідає своя локаль. Локаль впливає на формати дат тощо. +** Для української мови - Україна. +** Для англійської - Сполучені Штати. +* Переклади зберігаються у вигляді файлів у JSON-форматі стандартизованої структури + +== Компоненти системи та їх призначення в рамках дизайну рішення + +У даному розділі наведено перелік компонент системи, які задіяні або потребують змін в рамках реалізації функціональних вимог. + +|=== +|Підсистема|Компонент|Опис змін + +.2+|Підсистема управління Платформою та Реєстрами +|*control-plane-console* +|Розширення інтерфейсу управління платформою налаштуванням мови. Додавання механізму зміни мови у *control-plane-console*. Фактичний переклад на дві мови - англійська та українська. + +|=== + +== Сценарії використання (user flow) + +=== Зміна мови платформи + +- перехід у налаштування платформи +- перехід на вкладку Загальне +- на цій вкладці обрати нову мову із запропонованих та зберегти зміни +- прийняти зміни та дочекатись редеплою control-plane-console з новою env змінною. +- сторінки тепер завантажуються новою мовою + +=== Інтерфейси адміністратора + +Зміна мови платформи: + +image::architecture-workspace/platform-evolution/localization/platform_locale_edit.png[] + +Перегляд мови платформи + +image::architecture-workspace/platform-evolution/localization/platform_locale_view.png[] + +== Міграція існуючих платформ при оновленні + +Усі існуючи екземпляри платформи не будуть мати змінної у `values.yaml`. Для цього випадку значення за замовчуванням - українська мова (`uk`). Таким чином ніяких змін для міграції вносити не потрібно. + +== Технічне рішення + +=== Експертизи + +* Devops +* BE (_Go_) +* FE + +=== Технології + +* `goi18n` для перекладу golang частини та її шаблонів +* `vue-i18n` для перекладу у vue додатку + +=== Високорівневий дизайн рішення + +.Передача мови платформи +image::arch:architecture-workspace/platform-evolution/localization/localization_platform.svg[] + +[source,yaml] +.cluster-mgmt/deploy-templates/values.yaml +---- +global: + language: uk +---- + +[source,yaml] +.control-plane-console/deploy-templates/templates/admin_console_deployment.yaml +---- +env: + - name: LANGUAGE + value: {{ .Values.global.language }} +---- + +=== План розробки + +* Додати нову вкладку в налаштування платформи - `Загальне` +* Додати на цю вкладку можливість вибору мови та обробити запит на оновлення цієї змінної (у `values.yaml`) +** Доступні дві мови - English (en) та Українська (uk) +** Зберігати необхідно саме https://www.w3schools.com/tags/ref_language_codes.asp[HTML language codes] +* Зробити змінну обраної мови доступною для control-plane-console як environment variable (control-plane-console вже зараз пере розгортається після змін у gerrit платформи). +* Для кожної мови використовувати відповідну локаль (uk - Україна, en - United States) +* Значення мови за замовчуванням у разі порожнього значення env змінної - `uk` +* З використанням бібліотеки `goi18n` додати механізм перемикання мов у golang додаток. Файли перекладів зберігаються у json. +* Трансформувати усі тексти які бачить користувач у селектори перекладу. Перетворення стосується як запитів на golang backend так і сторінок які рендеряться з використанням шаблонізатора `go` +* Додати у vue frontend бібліотеку перекладу (`vue-i18n`) та механізм перемикання перекладів на основі обраної мови (потрапляє у додаток із шаблонізатора `go`). Json файли перекладів ті ж самі що і для golang. +* Трансформувати усі тексти vue frontend які бачить користувач у селектори перекладу. + +=== Особливості файлів з перекладом + +- Бекенд та фронтенд використовують одні й ті самі файли перекладу у форматі JSON. +- Файли зберігаються у репозиторії *control-plane-console* +- Файли перекладу потрапляють в артефакт vue додатку +- Мова передається у vue додаток через go template variable + +== Поза скоупом + +* Адміністратор платформи чи адміністратор реєстру обирає свою індивідуальну мову інтерфейсу + +== Відмінності реалізації від дизайну + +Логіка вибору і застосування мови при операціях з платформою: + +- при розгортанні платформи з нуля мова обирається шляхом сетапу енв змінної з мовою *PLATFORM_LANGUAGE*, після цього виконується пуш в репозиторій *cluster-mgmt* +- при апдейті платформи використовується поточне значення мови з values чарту *control-plane-console* +- отримані значення записуються у *customValues.yaml* файл + перевикористовується існуючий підхід по передачі значень з цього файлу в деплоймент *control-plane* diff --git a/docs/ua/modules/arch/pages/architecture/platform/administrative/control-plane/platform-evolution/demo-registry/demo-registry.adoc b/docs/ua/modules/arch/pages/architecture/platform/administrative/control-plane/platform-evolution/demo-registry/demo-registry.adoc index e1ebfcc585..0ebdfaf1f5 100644 --- a/docs/ua/modules/arch/pages/architecture/platform/administrative/control-plane/platform-evolution/demo-registry/demo-registry.adoc +++ b/docs/ua/modules/arch/pages/architecture/platform/administrative/control-plane/platform-evolution/demo-registry/demo-registry.adoc @@ -1,5 +1,4 @@ = Розгортання демо реєстру з прикладами як правильно моделювати бізнес-процеси - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] diff --git a/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/documentation-variables/documentation-variables.adoc b/docs/ua/modules/arch/pages/architecture/platform/administrative/control-plane/platform-evolution/documentation-variables/documentation-variables.adoc similarity index 89% rename from docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/documentation-variables/documentation-variables.adoc rename to docs/ua/modules/arch/pages/architecture/platform/administrative/control-plane/platform-evolution/documentation-variables/documentation-variables.adoc index 8386bfec2d..04d9b71844 100644 --- a/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/documentation-variables/documentation-variables.adoc +++ b/docs/ua/modules/arch/pages/architecture/platform/administrative/control-plane/platform-evolution/documentation-variables/documentation-variables.adoc @@ -125,7 +125,7 @@ https://nexus-{{{cluster-name}}}.{{{dns-wildcard}}}/ footnote:[cluster-name -- - Назва параметра - `registry-name` - Зміни цього `values.yaml` вже перерозгортають документацію тому додатково змін до цього процесу не передбачується -image::architecture-workspace/platform-evolution/documentation-variables/demo_default.png[] +image::architecture/platform/administrative/control-plane/documentation-variables/demo_default.png[] [NOTE] ==== @@ -134,4 +134,12 @@ image::architecture-workspace/platform-evolution/documentation-variables/demo_de Помилка у разі того, якщо обраний раніше демо реєстр вже не актуальний: -image::architecture-workspace/platform-evolution/documentation-variables/demo_missing.png[] +image::architecture/platform/administrative/control-plane/documentation-variables/demo_missing.png[] + +''' + +== Зміни у дизайні після реалізації + +1. Було виявлено, що документація не розгорталась у *cluster-mgmt*. Тому процес її розгортання був перенесений туди для того, щоб запропонований дизайн став можливим. +2. Змінено шлях зберігання імені реєстру у `values.yaml` - на `global.demoRegistryName`. +3. Було виявлено, що деяким посиланням потрібна четверта змінна - stageName. Поки що прийнято рішення використовувати у посиланнях значення main, бо тільки воно наразі використовується на target cluster. Створення механізму заміни через змінну винесено в окрему задачу. diff --git a/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/individual-officer-access/individual-officer-access.adoc b/docs/ua/modules/arch/pages/architecture/platform/administrative/control-plane/platform-evolution/individual-officer-access.adoc similarity index 75% rename from docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/individual-officer-access/individual-officer-access.adoc rename to docs/ua/modules/arch/pages/architecture/platform/administrative/control-plane/platform-evolution/individual-officer-access.adoc index b5cb58b5b7..78c2ed031e 100644 --- a/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/individual-officer-access/individual-officer-access.adoc +++ b/docs/ua/modules/arch/pages/architecture/platform/administrative/control-plane/platform-evolution/individual-officer-access.adoc @@ -1,10 +1,5 @@ = Управління доступом користувачів до _Кабінету надавача послуг_ з використанням _КЕП Фізичної Особи_ -[IMPORTANT] --- -Сторінка технічної документації є баченням майбутньої реалізації, актуальність якого може бути застарілою. --- - == Загальний опис На рівні реєстру, необхідно забезпечити можливість технічному адміністратору налаштовувати доступ користувачів до кабінету надавачів послуг з використанням _КЕП ФО_, в якому, відповідно, відсутній ЄДРПОУ організації. Це пов'язано зі складністю отримання _КЕП ФОП_ або представника юридичної особи з огляду на необхідність фізичної присутності. @@ -73,7 +68,7 @@ * _com.epam.digital.data.platform.keycloak.idgovua.officer.authenticator.IdGovUaOfficerAuthenticator_ .Блок-схема процесу автентифікації -image::arch:architecture-workspace/platform-evolution/individual-officer-access/individual-officer-auth.svg[individual-officer-auth, 500] +image::architecture/platform/administrative/control-plane/individual-officer-access/individual-officer-auth.svg[individual-officer-auth, 500] === Валідація підпису надавача послуг з _КЕП ФО_ @@ -83,7 +78,7 @@ image::arch:architecture-workspace/platform-evolution/individual-officer-access/ * _com.epam.digital.data.platform.dso.config.IsolationConfig#getOfficerValidator_ .Блок-схема процесу валідації цифрового підпису -image::arch:architecture-workspace/platform-evolution/individual-officer-access/individual-officer-signature-validation.svg[individual-officer-signature-validation, 500] +image::architecture/platform/administrative/control-plane/individual-officer-access/individual-officer-signature-validation.svg[individual-officer-signature-validation, 500] == Управління конфігурацією реєстру @@ -107,27 +102,8 @@ portals: В рамках реалізації функціональних вимог, необхідно розширити екран управління налаштуваннями автентифікації надавачів послуг реєстру додатковою секцією зі збереженням значення на рівні конфігурації реєстру в `portals.officer.individualAccessEnabled`. .Управління доступом користувачів з КЕП Фізичної Особи -image::arch:architecture-workspace/platform-evolution/individual-officer-access/control-plane-officer-individual-access-control.png[control-plane-officer-individual-access-control, 500] +image::architecture/platform/administrative/control-plane/individual-officer-access/control-plane-officer-individual-access-control.png[control-plane-officer-individual-access-control, 500] == Міграція існуючих реєстрів при оновленні -Не потребує окремих процедур міграції, у разі відсутності налаштування на рівні конфігурації реєстру зберігається поведінка за замовчуванням - відсутність доступу користувачам з _КЕП ФО_ до кабінету отримувача послуг реєстру, доки технічний адміністратор явним чином не внесе зміни через _Веб-інтерфейс управління Платформою та реєстрами_. - -== Високорівневий план розробки - -=== Технічні експертизи - -* BE (_Java_, _Go_) -* DevOps - -=== План розробки - -* Розширення шаблону конфігурації реєстру додатковим налаштуванням -* Розширення _Веб-інтерфейсу управління Платформою та реєстрами_ секцією управління налаштуванням -* Розширення механізму застосування змін конфігурації реєстру до відповідних _KeycloakAuthFlow_-ресурсів -* Розширення механізму застосування змін конфігурації реєстру до конфігурації компоненти *digital-signature-ops* -* Розширення автентифікації та самореєстрації підтримкою надавачів послуг з _КЕП ФО_ у разі відповідного налаштування на рівні конфігурації реєстру -* Розширення механізму валідації підпису підтримкою надавачів послуг з _КЕП ФО_ у разі відповідного налаштування на рівні конфігурації реєстру -* Розробка референтних прикладів: -** Самореєстрація надавачів послуг _ФО_ з підтвердженням відповідальною посадовою особою -** Внесення даних в реєстр з накладанням цифрового підпису з використанням _КЕП ФО_ \ No newline at end of file +Не потребує окремих процедур міграції, у разі відсутності налаштування на рівні конфігурації реєстру зберігається поведінка за замовчуванням - відсутність доступу користувачам з _КЕП ФО_ до кабінету отримувача послуг реєстру, доки технічний адміністратор явним чином не внесе зміни через _Веб-інтерфейс управління Платформою та реєстрами_. \ No newline at end of file diff --git a/docs/ua/modules/arch/pages/architecture/platform/administrative/control-plane/platform-evolution/platform-logo/platform-logo.adoc b/docs/ua/modules/arch/pages/architecture/platform/administrative/control-plane/platform-evolution/platform-logo/platform-logo.adoc new file mode 100644 index 0000000000..392bb7ca49 --- /dev/null +++ b/docs/ua/modules/arch/pages/architecture/platform/administrative/control-plane/platform-evolution/platform-logo/platform-logo.adoc @@ -0,0 +1,150 @@ += Налаштування назви та логотипу платформи + +== Загальний опис + +Адміністратор повинен мати можливість обрати назву для платформи, а також логотип для платформи. + +== Актори та ролі користувачів + +* Адміністратор платформи +* Технічний адміністратор реєстру + +== Функціональні сценарії + +* Зміна назви платформи у налаштуваннях control-plane-console. +* Зміна логотипів платформи у налаштуваннях control-plane-console. + +== Загальні принципи та положення + +* Логотип на control-plane-console має застосовуватись у наступних контекстах: +** Логотип у навігаційному меню +** Логотип у вкладці браузера (favicon) +** Логотип у лоадеру (поки не буде застосовуватись саме на control-plane-console) +* Логотипи у всіх трьох випадках - різні. Навіть їх формат різний. Тому необхідно надати можливість додавати окремі іконки у якості цих логотипів +** Формат головного логотипу - svg +** Формат логотипу лоадера - svg +** Формат favicon - png, 32*32 px. Всі сучасні браузери підтримують цей формат та розмір. +* Формат svg обраний для адаптивності та можливості легкого темування. + +== Компоненти системи та їх призначення в рамках дизайну рішення + +У даному розділі наведено перелік компонент системи, які залучені або потребують змін в рамках реалізації функціональних вимог. + +|=== +|Підсистема|Компонент|Опис змін + +|Підсистема управління Платформою та Реєстрами +|*control-plane-console* +|Розширення інтерфейсу управління реєстру налаштуванням назви платформи та логотипів платформи. + +|=== + +== Сценарії використання (user flow) + +=== Зміна назви платформи + +- перехід у налаштування платформи +- перехід на вкладку Загальне +- на цій вкладці обрати нову назву платформи +- прийняти зміни та дочекатись редеплою платформи з новою env змінною. + +=== Зміна логотипів платформи + +* перехід у налаштування платформи +* перехід на вкладку Загальне +* на цій вкладці обрати нові файли для логотипів платформи +** Окреме поле для головного логотипу +** Окреме поле для логотипу лоадера +** Окреме поле для favicon +* прийняти зміни та дочекатись редеплою платформи з новою Config Map + +=== Інтерфейси адміністратора + +Зміна лого на платформі: + +image::architecture-workspace/platform-evolution/logo/platform_logo.png[] + +== Міграція існуючих реєстрів при оновленні + +Усі існуючи екземпляри платформи отримають назву платформи та логотипи у рамках оновлення у якості значень за замовчуванням. + +== Технічне рішення + +=== Експертизи + +* Devops +* BE (_Go_) +* FE (vue) + +=== Високорівневий дизайн рішення + +.Передача назви платформи та логотипів +image::arch:architecture-workspace/platform-evolution/logo/logo_platform.svg[] + +[source,yaml] +.cluster-mgmt/deploy-templates/values.yaml +---- +global: + platformName: test + logosPath: "configmap:platform-logos:" +---- + +[source,yaml] +.cluster-mgmt/deploy-templates/platform-logos.yaml +---- +kind: ConfigMap +name: platform-logos +data: + logoMain: base64 + logoLoader: base64 + logoFavicon: base64 +---- + +[source,yaml] +.control-plane-console/deploy-templates/templates/admin_console_deployment.yaml +---- +env: + - name: PLATFORM_NAME + value: {{ .Values.global.platformName }} +---- + +=== План розробки + +==== Вибір параметрів + +* Додати у control-plane-console на вкладку `Загальне` налаштувань платформи: +** поле для вводу імені платформи +** поле для завантаження файлу головного логотипу +** поле для завантаження файлу логотипу лоадера +** поле для завантаження файлу favicon +* Файли повинні перетворюватись на base64 текст та у цьому вигляді зберігатись через go backend +* Додати валідацію для файлів: +** `*.svg` для головного логотипу +** `*.svg` для логотипу лоадера +** `*.png` для файлу favicon. Розмір у px не валідується. +* Ім'я платформи зберегти у `values.yaml` - у полі `global.platformName`. +* platformName у вигляді environment змінних потрапляють у control-plane-console (Devops) +* Файли логотипів у вигляді base64 зберегти у Config Map `platform-logos` +* Використати логотипи з Config Map *platform-logos* у *control-plane-console* через прямий виклик з golang частини (так само як у швидких посиланнях) +* Додати існуючи логотипи та назву у якості значень за замовчуванням у `cluster-mgmt/deploy-templates/values.yaml` та Config Map `platform-logos`. + + +==== Використання параметрів + +* Змінна імені платформи використовується при відмальовуванні `golang` шаблону заголовку сторінки +* Змінна головного логотипу використовується при відмальовуванні `golang` шаблону заголовку сторінки +* Додати favicon до control-plane-console (наразі не має ніякого) та брати його значення з параметра + +== Поза скоупом + +* Лоадер для control-plane-console + +== Відмінності реалізації від дизайну + +Дефолтні значення логотипів отримуються з конфігмапи *platform-logos-default*, при оновленні логотипів створюються конфігмапи *platform-logos-TIMESTAMP* і виконується коміт з актуальною назвою конфігмапи у values.yaml cluster-mgmt + +Логіка вибору і застосування мови при операціях з платформою: + +- при розгортанні платформи назва конфігмапи з логотипами обирається шляхом сетапу енв змінної зі шляхом до логотипу *LOGOS_PATH*, після цього виконується пуш в репозиторій *cluster-mgmt* +- при апдейті платформи використовується поточне значення з values чарту *control-plane-console* +- отримані значення записуються у *customValues.yaml* файл + перевикористовується існуючий підхід по передачі значень з цього файлу в деплоймент *control-plane* diff --git a/docs/ua/modules/arch/pages/architecture/platform/operational/distributed-data-storage/overview.adoc b/docs/ua/modules/arch/pages/architecture/platform/operational/distributed-data-storage/overview.adoc index 44e8b61329..8eb762943b 100644 --- a/docs/ua/modules/arch/pages/architecture/platform/operational/distributed-data-storage/overview.adoc +++ b/docs/ua/modules/arch/pages/architecture/platform/operational/distributed-data-storage/overview.adoc @@ -1,5 +1,4 @@ = Підсистема розподіленого зберігання даних - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] @@ -49,7 +48,7 @@ MDS Map:: Cтруктура даних у ceph, що містить інформ |openshift-storage |rook-ceph-dashboard |3rd-party -.14+|https://github.com/red-hat-storage/ocs-operator[github:/red-hat-storage/ocs-operator] +.15+|https://github.com/red-hat-storage/ocs-operator[github:/red-hat-storage/ocs-operator] https://github.com/rook/rook[github:/rook-operator] @@ -122,7 +121,31 @@ https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/rep |openshift-storage |ocs-metrics-exporter |3rd-party -|Компонент Rook Ceph Crash Collector слугує для збирання та агрегування інформації про аварійні завершення в Ceph +|Компонент Rook Ceph Crash Collector слугує для збирання та агрегування інформації про аварійні завершення в Ceph. + +|_Noobaa Operator_ +|openshift-storage +|noobaa-operator +|3rd-party +|Допоміжне програмне забезпечення, що виконує функції розгортання та оркестрування компонентів NooBaa Multicloud Object Gateway. + +|_Noobaa Core_ +|openshift-storage +|noobaa-core +|3rd-party +|Компонент що направляє запит до відповідної системи зберігання, такої як Ceph або публічного хмарного провайдера. + +|_Noobaa Database_ +|openshift-storage +|noobaa-db-pg +|3rd-party +|NooBaa DB зберігає метадані про об'єкти та сховища даних. + +|_Noobaa Endpoint_ +|openshift-storage +|noobaa-endpoint +|3rd-party +|Керує трафіком, обробляє запити від клієнтів та надає доступ до даних. |=== @@ -169,6 +192,7 @@ https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/rep * xref:arch:architecture/platform-technologies.adoc#ceph[Ceph] * xref:arch:architecture/platform-technologies.adoc#rook-operator[Rook] * xref:arch:architecture/platform-technologies.adoc#okd[okd] +* xref:arch:architecture/platform-technologies.adoc#noobaa[noobaa] == Атрибути якості підсистеми diff --git a/docs/ua/modules/arch/pages/architecture/platform/operational/mail-delivery/overview.adoc b/docs/ua/modules/arch/pages/architecture/platform/operational/mail-delivery/overview.adoc index 2ff973c545..2ba385a0f2 100644 --- a/docs/ua/modules/arch/pages/architecture/platform/operational/mail-delivery/overview.adoc +++ b/docs/ua/modules/arch/pages/architecture/platform/operational/mail-delivery/overview.adoc @@ -1,7 +1,8 @@ = Підсистема поштових повідомлень -include::platform:ROOT:partial$templates/document-attributes/arch-set-en.adoc[] -include::platform:ROOT:partial$admonitions/language-en.adoc[] +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Загальний опис diff --git a/docs/ua/modules/arch/pages/architecture/platform/operational/secret-management/overview.adoc b/docs/ua/modules/arch/pages/architecture/platform/operational/secret-management/overview.adoc index aa3b2d999e..06b884a6a8 100644 --- a/docs/ua/modules/arch/pages/architecture/platform/operational/secret-management/overview.adoc +++ b/docs/ua/modules/arch/pages/architecture/platform/operational/secret-management/overview.adoc @@ -39,6 +39,14 @@ _Підсистема управління секретами та шифрув |3rd-party |https://github.com/epam/edp-ddm-platform-vault[github:/epam/edp-ddm-platform-vault] |Інструмент для безпечного управління секретами та захисту доступу до конфіденційної інформації в обчислювальних середовищах. + +|_Сервіс управління сертифікатами_ +|`cert-manager` +|`cert-manager` +|3rd-party +|https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/infrastructure/service-mesh[gerrit:/mdtu-ddm/infrastructure/service-mesh] +|Інструмент керування сертифікатами та видавцями сертифікатів як типами ресурсів у кластерах Kubernetes та OKD. Використовується підсистемою трасування запитів. + |=== == Технологічний стек @@ -46,6 +54,7 @@ _Підсистема управління секретами та шифрув При проектуванні та розробці підсистеми, були використані наступні технології: * xref:arch:architecture/platform-technologies.adoc#vault[HashiCorp Vault] +* xref:arch:architecture/platform-technologies.adoc#cert-manager[cert-manager] == Атрибути якості підсистеми diff --git a/docs/ua/modules/arch/pages/architecture/platform/operational/user-management/overview.adoc b/docs/ua/modules/arch/pages/architecture/platform/operational/user-management/overview.adoc index f1287458d2..fd1b9a8388 100644 --- a/docs/ua/modules/arch/pages/architecture/platform/operational/user-management/overview.adoc +++ b/docs/ua/modules/arch/pages/architecture/platform/operational/user-management/overview.adoc @@ -57,7 +57,8 @@ https://github.com/epam/edp-ddm-user-management[github:/epam/edp-ddm-user-manage |`user-management` |`keycloak-operator` |epam-origin -|https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/devops/keycloak[gerrit:/mdtu-ddm/devops/keycloak] +a|* https://github.com/epam/edp-keycloak-operator[github:/epam/edp-keycloak-operator] +* https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/devops/keycloak[gerrit:/mdtu-ddm/devops/keycloak] |Управління налаштуваннями сервісу аутентифікації |_OpenShift OAuth_ @@ -77,6 +78,13 @@ a|https://github.com/redhat-cop/group-sync-operator[github:/redhat-cop/group-syn https://github.com/epam/edp-ddm-user-management[github:/epam/edp-ddm-user-management] |Синхронізація користувачів та ролей між платформою оркестрації OpenShift та Keycloak +|_Експортер метрик_ +|`user-management` +|`prometheus-postgres-exporter` +|3rd-party +|https://github.com/epam/edp-ddm-pg-exporter-chart[github:/epam/edp-ddm-pg-exporter-chart] +|Збір та виставлення метрик postgresql для їх подальшого збору підсистемою моніторингу подій та сповіщення + |=== == Технологічний стек diff --git a/docs/ua/modules/arch/pages/architecture/registry/administrative/ext-api-management/overview.adoc b/docs/ua/modules/arch/pages/architecture/registry/administrative/ext-api-management/overview.adoc index 7a85e8a588..7fa1339665 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/administrative/ext-api-management/overview.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/administrative/ext-api-management/overview.adoc @@ -28,7 +28,7 @@ image::architecture/registry/administrative/ext-api-management/registry-admin-ex |_Зовнішній API-шлюз адміністративної зони_ |`kong-admintools-kong` |3rd-party -|https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/general/kong-admin-tools[gerrit:/mdtu-ddm/general/kong-admin-tools] +|https://github.com/epam/edp-ddm-kong-admin-tools[github:/epam/edp-ddm-kong-admin-tools] |Забезпечує керування трафіком, авторизацію, контроль доступу до API, балансування навантаження, перетворення запитів/відповідей та аналітику/моніторинг. diff --git a/docs/ua/modules/arch/pages/architecture/registry/administrative/ext-api-management/redis-storage.adoc b/docs/ua/modules/arch/pages/architecture/registry/administrative/ext-api-management/redis-storage.adoc index 43dd89e6ce..483ed0cdfd 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/administrative/ext-api-management/redis-storage.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/administrative/ext-api-management/redis-storage.adoc @@ -1,4 +1,7 @@ = Нереляційне сховище даних +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Загальний опис diff --git a/docs/ua/modules/arch/pages/architecture/registry/administrative/ext-api-management/registry-admin-routes.yaml.adoc b/docs/ua/modules/arch/pages/architecture/registry/administrative/ext-api-management/registry-admin-routes.yaml.adoc index 7f2d0c7b94..048624f03f 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/administrative/ext-api-management/registry-admin-routes.yaml.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/administrative/ext-api-management/registry-admin-routes.yaml.adoc @@ -1,4 +1,7 @@ = Структура маршрутів зовнішнього Kong API Gateway для адміністративних ендпоінтів +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] Цей документ містить інформацію про загальні положення при формуванні зовнішніх точок доступу адміністративних ендпоінтів. diff --git a/docs/ua/modules/arch/pages/architecture/registry/administrative/operational-maintenance/services/business-process-administration-portal/building-blocks.adoc b/docs/ua/modules/arch/pages/architecture/registry/administrative/operational-maintenance/services/business-process-administration-portal/building-blocks.adoc index 833be19aed..2403f53662 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/administrative/operational-maintenance/services/business-process-administration-portal/building-blocks.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/administrative/operational-maintenance/services/business-process-administration-portal/building-blocks.adoc @@ -3,14 +3,14 @@ include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] -== Взаємодія з сервісами платформи +== Взаємодія із сервісами Платформи image::arch:architecture/registry/administrative/operational-maintenance/services/business-process-administration-portal/business-process-administration-portal.svg[] -.Критичні залежності: -* *База даних Postgres* - яка піднята у іншій поді (citus-master), впливає на весь функціонал веб-сервісу. +[NOTE,caption="Критичні залежності"] +_База даних Postgres_, піднята на іншому поді (`citus-master`), впливає на всю функціональність вебсервісу. -== Модульна / структурна діаграма +== Модульна/структурна діаграма image::arch:architecture/registry/administrative/operational-maintenance/services/business-process-administration-portal/microservice-internals.svg[] @@ -26,4 +26,4 @@ image::arch:architecture/registry/administrative/operational-maintenance/service * SLF4J/Log4J - логування [NOTE] -Більш детальніше ознайомитися зі стеком технологій можна xref:arch:architecture/registry/administrative/operational-maintenance/services/business-process-administration-portal/technologies.adoc[тут] +Детальніше ознайомитися зі стеком технологій можна на сторінці xref:arch:architecture/registry/administrative/operational-maintenance/services/business-process-administration-portal/technologies.adoc[Технологічний стек]. diff --git a/docs/ua/modules/arch/pages/architecture/registry/administrative/operational-maintenance/services/business-process-administration-portal/development.adoc b/docs/ua/modules/arch/pages/architecture/registry/administrative/operational-maintenance/services/business-process-administration-portal/development.adoc index 02519a204f..31ac6eb002 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/administrative/operational-maintenance/services/business-process-administration-portal/development.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/administrative/operational-maintenance/services/business-process-administration-portal/development.adoc @@ -3,18 +3,24 @@ include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] -== Стартова сторінка сервісу адміністрування бізнес-процесів: +== Стартова сторінка сервісу адміністрування бізнес-процесів image::arch:architecture/registry/administrative/operational-maintenance/services/business-process-administration-portal/camunda-welcome.svg[] -.Сервіс надає наступний функціонал: -- Camunda Cockpit https://business-proc-admin-lowcode-dev-dev.apps.cicd2.mdtu-ddm.projects.epam.com/camunda/app/cockpit/default/#/dashboard[lowcode-dev-cicd2-env-cockpit] - дозволяє відстежувати робочі процеси і рішення у виробництві, щоб виявляти, аналізувати і вирішувати технічні проблеми. Більш детальніше можна ознайомитися https://docs.camunda.org/manual/7.14/webapps/cockpit/[тут] -- Camunda Admin https://business-proc-admin-lowcode-dev-dev.apps.cicd2.mdtu-ddm.projects.epam.com/camunda/app/admin/default/#/[lowcode-dev-cicd2-env-admin] - надає можливість налаштовувати користувачів і групи. Більш детальніше можна ознайомитися https://docs.camunda.org/manual/7.14/webapps/admin/[тут] -- Camunda Tasklist https://business-proc-admin-lowcode-dev-dev.apps.cicd2.mdtu-ddm.projects.epam.com/camunda/app/tasklist/default/#/?searchQuery=%5B%5D[lowcode-dev-cicd2-env-tasklist] - дозволяє кінцевим користувачам працювати над призначеними на них задачами. Більш детальніше можна ознайомитися https://docs.camunda.org/manual/7.14/webapps/tasklist/[тут] +Сервіс надає наступну функціональність: :: +* *Camunda Cockpit*: +//https://business-proc-admin-lowcode-dev-dev.apps.cicd2.mdtu-ddm.projects.epam.com/camunda/app/cockpit/default/#/dashboard[lowcode-dev-cicd2-env-cockpit] +дозволяє відстежувати робочі процеси і рішення у виробництві, щоб виявляти, аналізувати й розв'язувати технічні проблеми. Детальніше про сервіс читайте на https://docs.camunda.org/manual/7.14/webapps/cockpit/[офіційному ресурсі]. +* *Camunda Admin*: +//https://business-proc-admin-lowcode-dev-dev.apps.cicd2.mdtu-ddm.projects.epam.com/camunda/app/admin/default/#/[lowcode-dev-cicd2-env-admin] +надає можливість налаштовувати користувачів і групи. Детальніше про сервіс читайте на https://docs.camunda.org/manual/7.14/webapps/admin/[офіційному ресурсі]. +* *Camunda Tasklist*: +//https://business-proc-admin-lowcode-dev-dev.apps.cicd2.mdtu-ddm.projects.epam.com/camunda/app/tasklist/default/#/?searchQuery=%5B%5D[lowcode-dev-cicd2-env-tasklist] - +дозволяє кінцевим користувачам працювати над призначеними на них задачами. Детальніше про сервіс читайте на https://docs.camunda.org/manual/7.14/webapps/tasklist/[офіційному ресурсі] -== Основні сценарії: +== Основні сценарії -=== Надання прав доступу користувачу у Camunda Admin +=== Надання прав доступу користувачу в Camunda Admin - У головному вікні Camunda Admin потрібно перейти на вкладку `Authorizations` @@ -39,7 +45,7 @@ image::arch:architecture/registry/administrative/operational-maintenance/service [NOTE] Більш детально про управління авторизацією можна ознайомитися https://docs.camunda.org/manual/7.14/webapps/admin/authorization-management/#application-access[тут] -=== Призначення задачі користувачу у Camunda Cockpit +=== Призначення задачі користувачу в Camunda Cockpit - На головній сторінці Camunda Cockpit потрібно перейти на вкладку `Processes` @@ -65,7 +71,7 @@ image::arch:architecture/registry/administrative/operational-maintenance/service image::arch:architecture/registry/administrative/operational-maintenance/services/business-process-administration-portal/cockpit-task-assign-result.svg[] -=== Призупинення бізнес-процесу у Camunda Cockpit +=== Призупинення бізнес-процесу в Camunda Cockpit - На головній сторінці Camunda Cockpit потрібно перейти на вкладку `Processes` diff --git a/docs/ua/modules/arch/pages/architecture/registry/administrative/operational-maintenance/services/business-process-administration-portal/summary.adoc b/docs/ua/modules/arch/pages/architecture/registry/administrative/operational-maintenance/services/business-process-administration-portal/summary.adoc index e28d8b50bd..fdf5bf01c9 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/administrative/operational-maintenance/services/business-process-administration-portal/summary.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/administrative/operational-maintenance/services/business-process-administration-portal/summary.adoc @@ -4,17 +4,15 @@ include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] - --------------------------------------- - == Загальний опис -Cервіс для адміністрування та технічного моніторингу виконання бізнес-процесів. +Сервіс призначений для адміністрування та технічного моніторингу виконання бізнес-процесів. -.Сервіс надає наступний функціонал: -- здійснювати моніторинг працюючих бізнес-процесів. -- надає можливість налаштовувати користувачів і групи. -- дозволяє призначати задачі кінцевим користувачам +Сервіс надає наступні функціональні можливості: :: + +- здійснення моніторингу запущених бізнес-процесів; +- налаштовування користувачів і груп; +- призначення задач кінцевим користувачам. == Загальні принципи @@ -27,6 +25,7 @@ Cервіс для адміністрування та технічного мо - Візуалізація хіт-мапи бізнес-процесу - Візуалізація графіків ефективності процесів на базі зібраних метрик -.Ролі користувачів: -* *Адміністратор регламенту* -* *Адміністратор платформи* +== Ролі користувачів + +* Адміністратор регламенту +* Адміністратор Платформи diff --git a/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/business-processes/bpmn-modeler.adoc b/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/business-processes/bpmn-modeler.adoc index 12e51c0e48..ef85e17077 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/business-processes/bpmn-modeler.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/business-processes/bpmn-modeler.adoc @@ -1,4 +1,7 @@ = Моделювання бізнес-процесів за допомогою вебредактора +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Функціональні сценарії @@ -28,7 +31,7 @@ |https://bpmn.io/toolkit/bpmn-js/walkthrough/ |Бібліотека _bpmn-js_ допомагає взаємодіяти з BPMN діаграмами у браузері -|https://...[bpmn-js-properties-panel] +|https://github.com/bpmn-io/bpmn-js-properties-panel[bpmn-js-properties-panel] |1.1.1 |MIT |https://github.com/bpmn-io/bpmn-js-properties-panel diff --git a/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/data-model/admin-portal-data-model-json-schema-description.adoc b/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/data-model/admin-portal-data-model-json-schema-description.adoc index 0ddff0b3de..6004726401 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/data-model/admin-portal-data-model-json-schema-description.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/data-model/admin-portal-data-model-json-schema-description.adoc @@ -1,5 +1,7 @@ ==== DataModelSnapshot +include::ROOT:partial$admonitions/language-ua.adoc[] + ===== Table JsonSchema [source,json] ---- diff --git a/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/data-model/admin-portal-data-model-management.adoc b/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/data-model/admin-portal-data-model-management.adoc index 5608d48bdb..601798cf33 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/data-model/admin-portal-data-model-management.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/data-model/admin-portal-data-model-management.adoc @@ -1,4 +1,7 @@ = Управління структурами таблиць моделі даних реєстру +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] include::admin-portal-data-model-problem-description.adoc[] diff --git a/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/data-model/admin-portal-data-model-xml-changelog-serialization.adoc b/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/data-model/admin-portal-data-model-xml-changelog-serialization.adoc index cd744cd198..99fd2ed4f9 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/data-model/admin-portal-data-model-xml-changelog-serialization.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/data-model/admin-portal-data-model-xml-changelog-serialization.adoc @@ -1,8 +1,11 @@ = Механізм перетворення моделі структури БД у вигляді Liquibase ChangeSet +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Функціональні сценарії -- Створення _Diff Document_ на основі _DataModelSnapshot_ бази даних (поточна версія та версія змін) в форматі _.json_ відповідно до xref:architecture/registry/administrative/regulation-management/admin-portal/data-model/admin-portal-data-model-management.adoc#_допустимі_операції_з_обєктами_доменної_моделі_що_ввійшли_в_попередній_реліз[вимог]. +- Створення _Diff Document_ на основі _DataModelSnapshot_ бази даних (поточна версія та версія змін) у форматі _.json_ відповідно до xref:architecture/registry/administrative/regulation-management/admin-portal/data-model/admin-portal-data-model-management.adoc#_допустимі_операції_з_обєктами_доменної_моделі_що_ввійшли_в_попередній_реліз[вимог]. - Створення _Xml liquibase Changesets_ на основі згенерованого _Diff Document_. == Out of scope @@ -186,12 +189,6 @@ TIP: Підрахунок різниці між двома станами стр } ---- -[NOTE] --- -TODO: необхідно реалізувати _Json_ схему опису _Diff Document_. --- - - == Компонент _LiquibaseDataModelSerializer_ Компонент _LiquibaseDataModelSerializer_ на основі _Diff Document_ генерує _Liquibase XML-Changelog_ за наступним алгоритмом: diff --git a/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/data-model/data-model-version-candidate/data-model-version-candidate.adoc b/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/data-model/data-model-version-candidate/data-model-version-candidate.adoc index 37341923d1..c9b1d762e1 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/data-model/data-model-version-candidate/data-model-version-candidate.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/data-model/data-model-version-candidate/data-model-version-candidate.adoc @@ -1,4 +1,7 @@ = Перегляд переліку таблиць моделі даних реєстру у режимі читання для версії-кандидата +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Загальний опис Розробка регламенту реєстру передбачає розробку моделі даних реєстру. Адміністративний портал надає функціонал по перегляду переліку таблиць моделі даних реєстру та їх структури. diff --git a/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/data-model/data-model-version-candidate/edit-data-model-tables.adoc b/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/data-model/data-model-version-candidate/edit-data-model-tables.adoc index caca166c4a..b332fa28c1 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/data-model/data-model-version-candidate/edit-data-model-tables.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/data-model/data-model-version-candidate/edit-data-model-tables.adoc @@ -1,10 +1,13 @@ -= Внесення змін до файлу описів структур таблиць моделі даних реєстру через веб-редактор коду += Внесення змін до файлу описів структур таблиць моделі даних реєстру через вебредактор коду +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Загальний опис -Розробка регламенту реєстру включає в себе розробку моделі даних реєстру. Адміністративний портал надає функціонал по перегляду моделі даних реєстру. Необхідно забезпечити можливість редагування моделі даних регламенту реєстру. +Розробка регламенту реєстру включає розробку моделі даних реєстру. Адміністративний портал надає функціонал по перегляду моделі даних реєстру. Необхідно забезпечити можливість редагування моделі даних регламенту реєстру. == Опис проблеми -Адмін портал має функціональність по перегляду стану моделі даних регламенту реєстру. Існуючий підхід передбачає внесення змін у Gerrit до відповідного MR версії-кандидату під час розробки моделі даних регламенту реєстру. +Адмін портал має функціональність по перегляду стану моделі даних регламенту реєстру. Наявний підхід передбачає внесення змін у Gerrit до відповідного MR версії-кандидату під час розробки моделі даних регламенту реєстру. == Актори - Розробник регламенту реєстру @@ -63,9 +66,6 @@ image::architecture/registry/administrative/regulation-management/admin-portal/d Для редагування моделі даних регламенту реєстру необхідно створити нову перспективу редагування. Всі операції, пов'язані з переглядом стану моделі даних (наявні та майбутні) виокремлюються в перспективу перегляду -[NOTE] -TODO: add screenshots when will be ready - === Діаграма послідовності [plantuml, edit-data-model edit-data-model-tables-sequence, svg] diff --git a/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/forms/form-modeler.adoc b/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/forms/form-modeler.adoc index 582f3e82bd..fa33e00501 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/forms/form-modeler.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/forms/form-modeler.adoc @@ -1,4 +1,7 @@ -= Моделювання UI-форм за допомогою веб-редактора += Моделювання UI-форм за допомогою вебредактора +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Функціональні сценарії diff --git a/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/regulation-repository/gitflow/gitflow-description.adoc b/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/regulation-repository/gitflow/gitflow-description.adoc index 1058a0bc90..da2e40089d 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/regulation-repository/gitflow/gitflow-description.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/admin-portal/regulation-repository/gitflow/gitflow-description.adoc @@ -1,5 +1,7 @@ = Організація роботи з git репозиторіями під час роботи з декількома версіями регламенту реєстру -NOTE: 🌐 Цей документ доступний українською та англійською мовами. Використовуйте перемикач у правому верхньому куті, щоб змінити версію. +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Базові принципи - Backend admin-portal service використовує в якості сховища даних: gerrit (git) та файлову систему (persistent volume) diff --git a/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/bp-groups.adoc b/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/bp-groups.adoc index e9ce6c3459..8fdb4cb562 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/bp-groups.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/bp-groups.adoc @@ -1,6 +1,3 @@ -//:imagesdir: ..\..\..\images\ -//:includedir: ..\..\..\partials\ - = Категоризація доступних послуг в кабінеті користувача include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] diff --git a/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/bp-script-groovy-editor.adoc b/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/bp-script-groovy-editor.adoc index c1a4145ff9..b1c47e714e 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/bp-script-groovy-editor.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/bp-script-groovy-editor.adoc @@ -1,16 +1,17 @@ -= Редагування groovy скриптів бізнес-процесів в admin-portal += Редагування groovy скриптів бізнес-процесів в адмін-порталі +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Загальний опис проблеми та рішення -Розробка бізнес-процесів регламенту реєстру включає в себе розробку Groovy скриптів, що відображають логіку роботи кроків бізнес-процесу. Адмін-портал дозволяє проводити розробку бізнес-процесів регламенту реєстру. -Набагато ефективніше вести розробку Groovy скриптів в спеціалізованих засобах розробки, таких як IDE (Desktop або Web версії). +Розробка бізнес-процесів регламенту реєстру передбачає розробку Groovy-скриптів, що відображають логіку роботи кроків бізнес-процесу. Адмін-портал дозволяє проводити розробку бізнес-процесів регламенту реєстру. +Набагато ефективніше вести розробку Groovy-скриптів у спеціалізованих засобах розробки, таких як IDE (Desktop або Web версії). -Розширення адмін-порталу використанням rich веб редакторів редагування Groovy скриптів покращить user experience до рівня використання Desktop IDE інструментів, а також зменшить час на постійне переміщення скриптів в Desktop IDE для редагування та назад в BPMN.IO візуальний конструктор бізнес-процесів +Розширення адмін-порталу використанням _rich_ вебредакторів редагування Groovy-скриптів покращить користувацький досвід до рівня використання настільних IDE-інструментів, а також зменшить час на постійне переміщення скриптів до Desktop IDE для редагування та назад -- до BPMN.IO-візуального конструктора бізнес-процесів. [NOTE] -xref:architecture-workspace/research/admin-portal/code-editor-language-server-protocol.adoc[Результати POC] для ознайомлення з LSP протоколом та веб-редактором коду MonacoEditor +xref:architecture-workspace/research/admin-portal/code-editor-language-server-protocol.adoc[Результати POC] для ознайомлення з LSP протоколом та вебредактором коду MonacoEditor. == Глосарій @@ -20,37 +21,39 @@ xref:architecture-workspace/research/admin-portal/code-editor-language-server-pr - WSS - WebSocket Secure == Актори + - Розробник регламенту реєстру == Функціональні можливості редактору [NOTE] -Наступні функціональні можливості в рівній мірі використовуються для двох функціональних сценаріїв: створення нового кроку бізнес-процесу та редагування або перегляд існуючого. +Наступні функціональні можливості в рівній мірі використовуються для двох функціональних сценаріїв: створення нового кроку бізнес-процесу та редагування або перегляд наявного. -- Автодоповнення у вигляді випадаючого списку варіантів виклику +- Автодоповнення у вигляді випадного списку варіантів виклику - Відображення результату аналізу коду на наявність помилок за допомогою language server -- Показ Hoover тултипу з javadoc інформацією +- Показ Hoover-підказки (hoover tooltip) з javadoc-інформацією - Використання різних кольорів при перегляді коду -- Автодоповнення для DDM JUEL функцій: -** initiator -** completer -** system_user -** submission -** sign_submission -** get_variable -** set_variable -** set_transient_variable -** process_caller -** message_payload +- Автодоповнення для DDM JUEL-функцій: + +** `initiator` +** `completer` +** `system_user` +** `submission` +** `sign_submission` +** `get_variable` +** `set_variable` +** `set_transient_variable` +** `process_caller` +** `message_payload` == Основні принципи -- Monaco editor в якості Web інструменту розробки groovy скриптів -- Використання сторонніх Language Server's (LS's) для отримання підказок, переліку для автодоповнення та результату помилок семантичного аналізу Groovy скриптів +- Monaco editor як вебінструмент розробки groovy-скриптів +- Використання сторонніх Language Server's (LS's) для отримання підказок, переліку для автодоповнення та результату помилок семантичного аналізу Groovy-скриптів - Використання Language Server Protocol для комунікації між Language Server та Monaco editor - Використання lsp4j для менеджменту (orchestration) LS's -- Транспортний протокол комунікації між Monaco editor та LS - WebSocket over HTTP (HTTPS) -- Логічний протокол комунікації (структура payload в повідомленнях транспортного протоколу) між Monaco editor та LS - Json-RPC +- Транспортний протокол комунікації між Monaco editor та LS -- `WebSocket over HTTP (HTTPS)`. +- Логічний протокол комунікації (структура payload у повідомленнях транспортного протоколу) між Monaco editor та LS -- `Json-RPC`. == Високорівневий дизайн @@ -61,52 +64,52 @@ image::architecture/registry/administrative/regulation-management/bpmnio-groovy- |=== |Назва|Мова програмування|Опис -|https://microsoft.github.io/monaco-editor/[Monaco editor] | JavaScript | Візуальний веб-редактор коду +|https://microsoft.github.io/monaco-editor/[Monaco editor] | JavaScript | Візуальний вебредактор коду |Remote LS's | Java, LSP4J | Екземпляри LS сервісів, що реалізує LSP протокол та виконують перевірку клієнтського коду з поверненням результатів перевірки в форматі Json-RPC(LSP). -|LS Manager, Websocket Manager|Java, Spring|Spring boot web controller. Створює необхідні екземпляри LS. Створює WebSocket та використовує відповідний LS екземпляр для аналізу та перевірки коду з візуального редактору клієнту. +|LS Manager, Websocket Manager|Java, Spring|Spring boot web controller. Створює необхідні екземпляри LS. Створює WebSocket та використовує відповідний LS-екземпляр для аналізу та перевірки коду з візуального редактора клієнту. |=== === LSP комунікація -- В якості транспортного протоколу використовується WSS протокол -- В якості RPC взаємодії використовується https://microsoft.github.io/language-server-protocol/specifications/lsp/3.17/specification/[LSP] протокол версії 3.17 +- Як транспортний протокол використовується `WSS`-протокол +- Як RPC-взаємодія використовується https://microsoft.github.io/language-server-protocol/specifications/lsp/3.17/specification/[LSP]-протокол версії `3.17`. -==== WebSocket комунікація +==== WebSocket-комунікація image::architecture/registry/administrative/regulation-management/bpmnio-groovy-editor/web-sockets-diagram.svg[] -- В якості транспортного протоколу використовується WSS -- Для налаштування Web-socket зв'язку зі сторони UI layer використовується https://www.npmjs.com/package/monaco-languageclient[monaco-languageclient]. -- Для організації websocket backend частини використовується spring-websocket. +- Як транспортний протокол використовується `WSS` +- Для налаштування Web-socket зв'язку зі сторони візуального рівня (UI layer) використовується https://www.npmjs.com/package/monaco-languageclient[monaco-languageclient]. +- Для організації частини websocket backend використовується spring-websocket. ==== Кількість екземплярів LS image::architecture/registry/administrative/regulation-management/bpmnio-groovy-editor/web-sockets-concurrency-diagram.svg[] -- Кожне вікно з monaco editor використовує свій окремий web-socket instance для з'єднання з LS +- Кожне вікно з monaco editor використовує свій окремий web-socket instance для з'єднання з LS. - Кожний web-socket використовує окремий екземпляр LS. -- Всі LS екземпляри знаходяться в одному JVM екземплярі. Технічно кожний екземпляр LS це новий екземпляр з інтерфейсом `org.eclipse.lsp4j.services.LanguageServer`. +- Усі LS-екземпляри знаходяться в одному JVM-екземплярі. Технічно кожний екземпляр LS -- це новий екземпляр з інтерфейсом `org.eclipse.lsp4j.services.LanguageServer`. [plantuml,bp-script-editing ls-communication-sequence,svg] ---- include::partial$architecture/registry/administrative/regulation-management/bpmnio-groovy-editor/language-server-communication-sequence.puml[ls-communication-sequence] ---- -== Розгортання компоненту +== Розгортання компонента image::architecture/registry/administrative/regulation-management/bpmnio-groovy-editor/ls-deployment.svg[] == Масштабування В поточній версії розгортання сервісу пропонується використовувати лише вертикальне масштабування (RAM, CPU). -Оскільки використовується підхід розміщення всіх LS в рамках однієї JVM, тому не очікується значного збільшення використання обчислювальних ресурсів під час збільшення кількості одночасно працюючих кліентів LS. +Оскільки використовується підхід розміщення всіх LS в рамках однієї JVM, тому не очікується значного збільшення використання обчислювальних ресурсів під час збільшення кількості одночасно запущених клієнтів LS. [TIP] -Горизонтальне маштабування можливе шляхом додавання Load Balancer для LSP (WebSocket JSON-RPC) трафіку. +Горизонтальне масштабування можливе шляхом додавання *Load Balancer* для LSP (WebSocket JSON-RPC) трафіку. Out of scope. == Моделювання загроз @@ -118,7 +121,7 @@ Out of scope. | Авторизація під час handshake процесу| Поточна авторизація на admin kong. `GET /groovy` повинен бути доступним тільки авторизованим користувачам через admin realm | -| Максимальний розмір запиту| Ліміт для payload всередині LSP (JSON-RPC). Використати https://docs.konghq.com/hub/kong-inc/request-size-limiting/[Request Size Limiting] | 65kb (30kb after SC) +| Максимальний розмір запита| Ліміт для payload всередині LSP (JSON-RPC). Використати https://docs.konghq.com/hub/kong-inc/request-size-limiting/[Request Size Limiting] | 65kb (30kb after SC) | Socket timeout| Idle time для сокету, через який він автоматично закривається. Необхідна конфігурація як на BE так і на FE side. Kong config property `proxy_read_timeout`| 60s (should be by default) @@ -136,7 +139,7 @@ Out of scope. |=== |Назва|Версія|Ліцензія|Опис -|https://microsoft.github.io/monaco-editor/[Monaco editor] |0.34.1|https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt[MIT] | Візуальний веб-редактор коду +|https://microsoft.github.io/monaco-editor/[Monaco editor] |0.34.1|https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt[MIT] | Візуальний вебредактор коду |https://www.npmjs.com/package/monaco-languageclient[monaco-languageclient]|4.0.3|https://github.com/TypeFox/monaco-languageclient/blob/master/License.txt[MIT]|Language server клієнт, що підключається до Monaco editor та використовується для з'єднання з віддаленими language серверами використовуючи LSP протокол) @@ -148,15 +151,15 @@ Out of scope. |https://github.com/spring-projects/spring-boot[Spring Boot]|2.6.1|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Розширення до Spring Framework для спрощення побудови аплікацій на базі Spring завдяки автоматичній конфігурації та наявності spring boot стартерів -|https://spring.io/guides/gs/messaging-stomp-websocket/[spring-boot-starter-websocket]|2.6.1|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Розширення для Spring для менеджменту веб-сокетів в серверних додатках (використовує https://mvnrepository.com/artifact/org.springframework/spring-websocket/5.3.13[spring-websocket:5.3.13]) +|https://spring.io/guides/gs/messaging-stomp-websocket/[spring-boot-starter-websocket]|2.6.1|https://www.apache.org/licenses/LICENSE-2.0[APACHE LICENSE, v2.0]|Розширення для Spring для менеджменту вебсокетів в серверних додатках (використовує https://mvnrepository.com/artifact/org.springframework/spring-websocket/5.3.13[spring-websocket:5.3.13]) |=== == Інтерфейс управління -BPMN.io буде розширено додатковою кнопкою визову модального вікна редагування groovy скриптів. +BPMN.io буде розширено додатковою кнопкою виклику модального вікна редагування groovy скриптів. -.Вікно визову редактору скриптів бізнес-процесів +.Вікно виклику редактору скриптів бізнес-процесів image::architecture/registry/administrative/regulation-management/bpmnio-groovy-editor/bp-groovy-script-open-window.svg[] .Вікно редагування скрипта в Monaco Editor @@ -173,7 +176,7 @@ image::architecture/registry/administrative/regulation-management/bpmnio-groovy- ==== Backend Java activities -- Створити Spring Boot based backend service ddm-language-server +- Створити Spring Boot-based backend service ddm-language-server - Розробити WebSocket proxy component - Підвищити версію LSP4J до 0.19 для GroovyLanguageServer @@ -184,20 +187,22 @@ image::architecture/registry/administrative/regulation-management/bpmnio-groovy- ==== DevOps activities -- Onboard https://github.com/GroovyLanguageServer/groovy-language-server: add codebase into gerrit and create pipeline around -- Створити deploy-templates та Dockerfile для service ddm-language-server (openjdk based image) -- Конфігурація AdminKong для пропускання трафіку в ddm-language-server. Додати websocket proxy headers в конфігурацію Kong -- Конфігурація плагінів Kong для перевірки security лімітів -- Додати в `environment-js` змінну `languageServerUrl` з відносною адресою ddm-laguage-server +- Впровадити https://github.com/GroovyLanguageServer/groovy-language-server: підготувати кодову базу (codebase) в gerrit та створити пов'язаний Jenkins-пайплайн. +- Створити deploy-templates та Dockerfile для service `ddm-language-server` (openjdk based image). +- Конфігурація AdminKong для пропускання трафіку до `ddm-language-server`. Додати websocket проксі заголовки до конфігурації Kong. +- Конфігурація плагінів Kong для перевірки лімітів безпеки (security limits). +- Додати в `environment-js` змінну `languageServerUrl` з відносною адресою `ddm-laguage-server`. == Безпека === Бізнес Дані + |=== |Категорія Даних|Опис|Конфіденційність|Цілісність|Доступність |Проміжні дані бізнес-процесів, що містять відкриту інформацію|Дані бізнес форм та процесів що не містять інформацію з обмеженим доступом|Низька|Висока|Середня -|Операційні журнали|Списки зафіксованих/залогованих звернень до сервісу та журнали його роботи|Середня|Висока|Висока +|Операційні журнали|Списки зафіксованих (logged) звернень до сервісу та журнали його роботи|Середня|Висока|Висока |=== + === Спрощена модель загроз image::architecture/registry/administrative/regulation-management/bpmnio-groovy-editor/groovy_TM.svg[] @@ -208,27 +213,27 @@ image::architecture/registry/administrative/regulation-management/bpmnio-groovy- | Ризик | Засоби контролю безпеки | Реалізація | Пріорітет | Порушення цілісності та конфіденційності даних при передачі | Використання HTTPS та WSS | Враховано в початковому дизайні | Високий | Небезпечне завершення сеансу на стороні сервера | Під час виходу з системи ініційованого користувачем або при автоматичному закінченні терміну дії сесії будь-яка комунікація з веб сокетом повинна бути зупинена | Не враховано в початковому дизайні | Високий -| Відмова в обслуговуванні через вичерпання обчислювальних ресурсів (DOS) спричинине відсутністю обмежень для веб сокетів +| Відмова в обслуговуванні через вичерпання обчислювальних ресурсів (DOS), спричинена відсутністю обмежень для вебсокетів a| - Впровадження ліміту на максимальний розмір запиту на рівні 30 kb -- Час очікування сокету: 60s +- Час очікування сокета: 60s - Обмеження кількості відкритих сокетів на рівні 10 сокетів для одного користувача протягом хвилини |Враховано в початковому дизайні | Високий -| Відмова в обслуговуванні через вичерпання обчислювальних ресурсів (DOS) спричинине відсутністю обмежень для сервісу на рівні опеншифту +| Відмова в обслуговуванні через вичерпання обчислювальних ресурсів (DOS), спричинена відсутністю обмежень для сервісу на рівні OpenShift. a| -- Обмеження споживання оперативної памяті. Сам ліміт повинен бути прорахований після проведення тестування. +- Обмеження споживання оперативної пам'яті. Сам ліміт повинен бути прорахований після проведення тестування. - Обмеження споживання часу процесора. Сам ліміт повинен бути прорахований після проведення тестування. -- Налаштувати механізм перезапуска сервісу в разі надмірного використання ресурсів. +- Налаштувати механізм перезапуску сервісу при надмірному використанні ресурсів. | Враховано в початковому дизайні | Високий -| Відмова в обслуговуванні через вичерпання обчислювальних ресурсів (DOS) спричинине відсутністю обмежень для HTTP запитів на рівні інгрес контролеру Kong +| Відмова в обслуговуванні через вичерпання обчислювальних ресурсів (DOS), спричинена відсутністю обмежень для HTTP запитів на рівні вхідного (ingress) контролера Kong. a| -- Обмеження сокету та кількості запитів має бути налаштований окремо на /groovy ендпоінт. Тобто плагін рейт лімітів для Kong має бути налаштований на /groovy +- Обмеження сокета та кількості запитів має бути налаштований окремо на /groovy ендпоінт. Тобто плагін рейт лімітів для Kong має бути налаштований на /groovy | Не враховано в початковому дизайні | Високий -| Ризик бекдору у компоненті language-server +| Ризик бекдору (backdoor) у компоненті `language-server` a| -- Вбудувати усі необхідні ресурси та мовні словники для розбору AST в імедж ddm-language-server для запобігання будь-яких звернень цього сервісу до зовнішніх джерел -- Заборонити на рівні мережевих політик openshift будь яке спілкування сервісу ddm-language-server з зовнішніми ресурсами і дозволити комунікацію з сервісом логування та сервісами задіяними згідно бізнес логіки. -| Частково враховано в початковому дизайні. Неодхідно повністю ізолювати сервіс ddm-language-server від зовнішньої мережі | Високий +- Вбудувати усі необхідні ресурси та мовні словники для розбору AST в образі `ddm-language-server` для запобігання будь-яких звернень цього сервісу до зовнішніх джерел +- Заборонити на рівні мережевих політик openshift будь-яке спілкування сервісу ddm-language-server з зовнішніми ресурсами й дозволити комунікацію з сервісом логування та сервісами залученими відповідно до бізнес-логіки. +| Частково враховано в початковому дизайні. Необхідно повністю ізолювати сервіс ddm-language-server від зовнішньої мережі | Високий | Ризик виконання вразливості інтерактивних інформаційних систем (XSS) a| - Налатування CORS @@ -237,8 +242,8 @@ a| a| - Сервіс має віддавати загальну помилку при появі проблем. - Сервіс повинен мати механізм "last resort" який опрацює будь-які помилки які не були опрацьовані до цього. -- Переконатись що режим DEBUG вимкнений на усіх рівнях у пре-продакшн та продакшн середовищах. -- language-server не віддає свою версію та будь-яку технічну та/або системну інформацію у HTTP відповіді. +- Переконатись що режим DEBUG вимкнений на усіх рівнях у пре-продакшн та промислових середовищах. +- `language-server` не віддає свою версію та будь-яку технічну та/або системну інформацію у HTTP-відповіді. | Не враховано в початковому дизайні | Середній | Десеріалізація ненадійних даних @@ -249,16 +254,16 @@ a| | Ризик появи групи веб вразливостей та відповідність вимогам безпеки a| -- Переконатись, що запити, які містять неочікувані або відсутні Content Types, відхиляються відповідними заголовками (статус відповіді HTTP 406 Неприйнятний або 415 Непідтримуваний тип медіа). -- Веб сервер приймає тільки затверджені HTTP методи. -- Переконатись що HTTP відповідь має загловок Content-Type а також безпечний набір символів (наприклад, UTF-8, ISO-8859-1). +- Переконатись, що запити, які містять неочікувані або відсутні Content Types, відхиляються відповідними заголовками (статус відповіді `HTTP 406` Неприйнятний або `415` Непідтримуваний тип медіа). +- Вебсервер приймає тільки затверджені HTTP методи. +- Переконатись що HTTP-відповідь має заголовок `Content-Type`, а також безпечний набір символів. Наприклад, `UTF-8`, `ISO-8859-1`. - Веб сторінка з Монако редактором має містити налаштовані заголовки Content Security Policy (CSP). -- Веб сторінка з Монако редактором має містити заголовок X-Content-Type-Options: nosniff +- Вебсторінка з Монако редактором має містити заголовок `X-Content-Type-Options: nosniff` | Не враховано в початковому дизайні | Середній | Ризик закріплення в системі при експлуатації вразливості до системного рівня та подальший бічний рух. Відповідність вимогам. a| -- Системний сервіс не повинен отримувати ключ сервіс аккаунту від openshift (якщо це не являється вимогою) та повинен бути запущенний від не привілейованого системного користувача. +- Системний сервіс не повинен отримувати ключ сервісного облікового запису від `openshift` (якщо це не є вимогою) та повинен бути запущений від не привілейованого системного користувача. | Не враховано в початковому дизайні | Середній | Недостатнє журналювання та відповідність вимогам безпеки @@ -266,22 +271,26 @@ a| - Цільовий сервіс має логувати усі запити та надсилати їх до централізованої системи логування та моніторингу. - Переконатись що усі неуспішні запити та помилки при виконанні операцій будуть залоговані. - Система логування має використовувати уніфікований час та часову зону. -- Логи мають бути у уніфікованому форматі та містити усю необхідну інформацію для розслідування інцидентів безпеки. +- Логи мають бути в уніфікованому форматі та містити усю необхідну інформацію для розслідування інцидентів безпеки. - Логи не мають містити чутливої інформації або вона повинна бути заплутана (obfuscated) відповідним чином | Не враховано в початковому дизайні | Низький -| Місконфігурація сервісу та/або фреймфорку +| Неправильна конфігурація сервісу та/або фреймфорку a| -- Переконатись, що конфігурація сервера захищена відповідно до рекомендацій сервера додатків і фреймворків, які використовуються.(web server/app server/framework hardening) +- Переконатися, що конфігурація сервера захищена відповідно до рекомендацій сервера додатків і фреймворків, які використовуються (web server/app server/framework hardening). | Не враховано в початковому дизайні | Низький |=== -=== Система тестування комплексу засобів захисту (КСЗ) -. Репозиторій з вихідним кодом повинен бути заонборджений до системи керування вразливостями та проходити регулярне тестування -. Базовий імедж сервісу повинен бути просканований та не містити не вирішенних критичних вразливостей -. Базовий імедж повинен бути розміщений в довіреному сховищі підконтрольному організації -. Технологія language-server повинна бути додана до переліку 3rd party продуктів які використовуються (inventory) +=== Система тестування комплексу засобів захисту (КЗЗ) + +. Репозиторій з вихідним кодом повинен бути впроваджений до системи керування вразливостями та проходити регулярне тестування. + +. Базовий образ (image) сервісу повинен бути просканований та не повинен містити не розв'язаних критичних вразливостей. + +. Базовий образ (image) повинен бути розміщений у довіреному сховищі, підконтрольному організації. + +. Технологія `language-server` повинна бути додана до переліку сторонніх продуктів, які використовуються (inventory). diff --git a/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/ceph-storage.adoc b/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/ceph-storage.adoc index fa665e9739..08071dd9c9 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/ceph-storage.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/ceph-storage.adoc @@ -1,4 +1,7 @@ = Об'єктне сховище даних +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Загальний опис diff --git a/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/overview.adoc b/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/overview.adoc index 96c811453e..e7cd9069f0 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/overview.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/overview.adoc @@ -1,5 +1,4 @@ = Підсистема моделювання регламенту реєстру - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] @@ -14,7 +13,7 @@ xref:architecture/registry/administrative/regulation-management/registry-regulat * Моделювання xref:architecture/registry/administrative/regulation-management/registry-regulation/registry-regulation.adoc[складових регламенту реєстру] -за принципами _Lowcode_ +за принципами _Low-code_ * Пакетне завантаження користувачів * Внесення змін у декларативний опис регламенту реєстру * Версіонування регламенту реєстру з історією внесення змін @@ -36,9 +35,9 @@ image::architecture/registry/administrative/regulation-management/regulation-man Події відправки повідомлень користувачам системою фіксуються у журналі аудиту з повним контекстом. |=== -|Тип події|Службова назва|Опис +|Тип події|Спосіб фіксації|Службова назва|Опис -|SYSTEM_EVENT|USER_CREATE|Подія створення нового користувача під час імпорту. +|SYSTEM_EVENT|Під час виникнення|USER_CREATE|Подія створення нового користувача під час імпорту. |=== [NOTE] @@ -52,13 +51,13 @@ xref:arch:architecture/registry/operational/audit/overview.adoc[за посил |=== |Назва компоненти|Представлення в реєстрі|Походження|Репозиторій|Призначення -|_Веб-інтерфейс моделювання регламенту_ +|_Вебінтерфейс моделювання регламенту_ |`admin-portal` |origin -|https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/low-code-platform/platform/frontend/applications/common-web-app[github:/mdtu-ddm/low-code-platform/platform/frontend/applications/common-web-app] +|https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/low-code-platform/platform/frontend/applications/common-web-app[gerrit:/mdtu-ddm/low-code-platform/platform/frontend/applications/common-web-app] |Клієнтський вебдодаток для моделювання регламенту реєстру за принципами _Lowcode_ -|_Веб-інтерфейс моделювання звітів_ +|_Вебінтерфейс моделювання звітів_ a| * `redash-admin` * `redash-admin-adhocworker` @@ -67,8 +66,8 @@ a| * `redash-admin-redis-master` |fork a| -* https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/data-architecture/devops-application/redash-chart[gerrit:/mdtu-ddm/data-architecture/devops-application/redash-chart] -* https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/data-architecture/application/redash[gerrit:/mdtu-ddm/data-architecture/application/redash] +* https://github.com/epam/edp-ddm-redash-chart[github:/epam/edp-ddm-redash-chart] +* https://github.com/epam/edp-ddm-redash[github:/epam/edp-ddm-redash] * https://github.com/getredash/redash[github:/getredash/redash] |Клієнтський вебдодаток для створення та налаштування аналітичних звітів та дашбордів @@ -78,7 +77,7 @@ a| * `gerrit-operator` |3rd-party a| -* https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/devops/operators/gerrit-operator[gerrit:/mdtu-ddm/devops/operators/gerrit-operator] +* https://github.com/epam/edp-ddm-gerrit-operator[github:/epam/edp-ddm-gerrit-operator] * https://gerrit.googlesource.com/gerrit/[gerrit:/googlesource/gerrit] |Програмний інструмент, що дозволяє зберігати та керувати версіями регламентів реєстрів. @@ -91,7 +90,7 @@ a| |_Language сервер_ |`ddm-language-server` |origin -|https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/low-code-platform/platform/backend/applications/ddm-language-server[gerrit:/mdtu-ddm/low-code-platform/platform/backend/applications/ddm-language-server] +|https://github.com/epam/edp-ddm-language-server[github:/epam/edp-ddm-language-server] |Сервіс який надає функціональність підказок, автодоповнення функцій та перевірки при редагуванні коду у _Вебінтерфейсі моделювання регламенту_ diff --git a/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/platform-evolution/form-scripts/form-scripts.adoc b/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/platform-evolution/form-scripts/form-scripts.adoc index 3cc8061499..dffc64e23f 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/platform-evolution/form-scripts/form-scripts.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/platform-evolution/form-scripts/form-scripts.adoc @@ -1,14 +1,18 @@ = Екстерналізація скриптів UI-форм +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Загальний опис -При моделюванні форм для задач часто виникає необхідність використовувати одні й ті самі Javascript функції які доводиться дублювати. Це стосується як функцій актуальних для будь-якого реєстру, так і тих які мають сенс перевикористовувати саме у рамках конкретного регламенту або навіть бізнес процесу. +При моделюванні форм для задач часто виникає необхідність використовувати одні й ті самі Javascript функції які доводиться дублювати. Це стосується як функцій актуальних для будь-якого реєстру, так і тих які мають сенс перевикористовувати саме у рамках конкретного регламенту або навіть бізнес-процесу. Для обробки всіх цих сценаріїв пропонується використовувати збереження окремих javascript файлів *на рівні регламенту*. Ці файли доступні через API у form-schema-provider та використовуються при виконанні задач. +[user-roles] === Ролі користувачів -- Розробник регламенту +* Розробник регламенту == Функціональні сценарії diff --git a/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/platform-evolution/master-development/master-development.adoc b/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/platform-evolution/master-development/master-development.adoc index abf0df1874..10fb5a1a53 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/platform-evolution/master-development/master-development.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/platform-evolution/master-development/master-development.adoc @@ -1,4 +1,7 @@ = Розробка регламенту у майстер-версії для форм та процесів: спрощення моделювання та захист від перезапису +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Загальний опис В процесі розробки або виправлення незначних помилок які не потребують значних змін в регламенті розробнику все одно diff --git a/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/platform-evolution/redash-localization/redash-localization.adoc b/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/platform-evolution/redash-localization/redash-localization.adoc new file mode 100644 index 0000000000..0ab36a470f --- /dev/null +++ b/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/platform-evolution/redash-localization/redash-localization.adoc @@ -0,0 +1,201 @@ += Локалізація Redash Admin та Redash Viewer + +[IMPORTANT] +-- +Сторінка технічної документації є баченням майбутньої реалізації, актуальність якого може бути застарілою. +-- + +== Загальний опис +Необхідно реалізувати можливість підтримки декількох мов інтерфейсу перегляду звітів для посадових осіб (Redash Viewer) та інтерфейсу для створення та налаштування аналітичних звітів та дашбордів (Redash Admin) в залежності від обраної мови реєстру. + +== Актори та ролі користувачів +* Технічний адміністратор Платформи +* Технічний адміністратор реєстру (користувач Admin Portal, а саме Redash Admin) +* Посадова особа (користувач Office Portal, а саме Redash Viewer) + +== Функціональні сценарії +* Cтворення та налаштування аналітичних звітів та інформаційних панелей мовою реєстра. +* Перегляд та маніпуляція відображенням даних реєстру на інформаційних панелях мовою реєстра. +* Перегляд та аналіз даних журналу подій аудиту реєстру на інформаційних панелях мовою реєстра. + +== Поточна реалізація +Кожен екземпляр сервісу аналітичної звітності реєстру Redash (Viewer та Admin) розгортається українською мовою без можливості зміни при розгортанні. +Вихідний Redash докер образ збирається англійською мовою. +Локалізація українською мовою відбувається на етапі збірки `redash-chart` за допомогою додаткового `main.py` скрипта та заготовленого файлу з перекладом слів та словосполучень `redash_localization_words.csv`. + +Така поточна реалізація не дозволяє встановити залежність між обраною мовою реєстру з розділу Керування реєстрами у адмінпанель Control Plane та процесом розгортання екземплярів Redash (Viewer та Admin). + +== Загальні принципи та положення +* Redash не локалізується українською на етапі збірки `redash-chart`. +* Існуючий файл `redash_localization_words.csv` з перекладом слів перейменовується у `uk.csv` і пакується в папку `locales` докер образа `redash-chart` на етапі збірки. +* Дії по локалізації Redash виносяться з існуючого `redash-chart/main.py` у новий `redash-chart/translate.py`, що пакується в докер образ `redash-chart` на етапі збірки. +* В `values` `redash-chart` додається `global.language` змінна, що визначає змінну оточення `LANGUAGE` темплейту розгортання Redash екземпляру. +* Скрипт `translate.py` параметризується таким чином, щоб визначати шлях до файлу з перекладом визначеної мови локалізації на основі змінної оточення `LANGUAGE`. +* Скрипт `translate.py` модифікується так, щоб не виконувати переклад, якщо `LANGUAGE = "en"`, лишаючи Redash не локалізованим. +* По можливості доповнити та виправити поточний український переклад. + +== Цільовий дизайн +=== Збірка +Наразі процес локалізації відбувається за допомогою запуску `redash-chart/main.py` скрипта на етапі збірки `redash-chart` докер образу через інструкції: + +.Dockerfile +[source,bash] +---- +FROM .../redash-master:version as source + +FROM python:3.9.6 as local +COPY --from=source /app/client/dist/app.*.js /app/ +... + +COPY . /app +WORKDIR /app +RUN pip install pipenv +RUN pipenv install +RUN pipenv run python main.py + +FROM source +COPY --from=local /app/app.*.js /app/client/dist/. +... +---- + +Необхідно винести процес локалізації в окремий `translate.py` скрипт. Відповідно видаливши з `main.py`. + +.translate.py +[source,python] +---- +import ... + +def load_excel_to_dict(): +... + +def wrap_as_variable(str): +... + +def wrap_as_tag(str): +... + +def localize(dict): +... + +translations = load_excel_to_dict() +localize(translations) +---- + +Та додатково запакувати `translate.py` скрипт в `redash-chart` докер образ для подальшого виклику при розгортанні: + +.Dockerfile +[source,bash] +---- +COPY translate.py /app/ +---- + +Видалити обробку `app.*.js` файлів з `Dockerfile`. + +Перейменувати існуючий файл `redash_localization_words.csv` в `uk.csv` та також запакувати в `redash-chart` докер образ у новостворену папку `locales`: + +.Dockerfile +[source,bash] +---- +COPY uk.csv /app/locales/ +---- + +Модифікувати `translate.py` скрипт, а саме: + +* Привести шляхи до фалів до актуального стану. +* Параметризувати скрипт таким чином, щоб шлях до `locales/uk.csv` файлу з перекладом визначався енв змінною, наприклад, `LANGUAGE`. +* Додати вхідну умову, що переклад здійснюється лише у випадку, коли `LANGUAGE != "en"` +* Додати вхідну умову, що у випадку якщо `LANGUAGE` не визначена, тобто `global.language` була не задана, переклад здійснюється українською. + +=== Розгортання +Мова визначатиметься через змінну `global.language` у `values.yaml` кожного реєстру, що наразі матиме допустимі значення `uk` та `en` та задаватиметься через Адмінпанель Control Plane. +У шаблон розгортання реєстру у `control-plane-gerrit`, а також `redash-chart` значення за замовчуванням не виноситься, при необхідності задається пустим. + +Скрипт по обробці файлу з перекладом запускається в процесі розгортання екземпляру Redash при старті відповідного контейнеру, наприклад, таким чином: + +.admin-server-deployment.yaml +[source,yaml] +---- +apiVersion: apps/v1 +kind: Deployment +... +spec: +... + containers: + - name: ... + ... + command: ["/bin/sh"] + args: ["-c", "python ./translate.py && . /config/dynamicenv.sh && /app/bin/docker-entrypoint server"] +---- + +Також необхідно передавати значення змінної `global.language` у енв змінні темплейту розгортання екземпляру Redash для подальшого використання скриптом перекладу `translate.py` з метою визначення шляху до файлу з перекладом `locales/uk.csv`. Наприклад: + +.admin-server-deployment.yaml +[source,yaml] +---- +apiVersion: apps/v1 +kind: Deployment +... +spec: +... + containers: + - name: ... + ... + env: + - name: LANGUAGE + value: {{ .Values.global.language }} +---- + +=== Зміни на UI +В Control Plane в табі Реєстри на сторінці Загальні налаштування в розділі "Локалізація" під текстом "Кабінет адміністратора регламенту" додати фразу "Веб-інтерфейс моделювання звітів" згідно мокапів. + +Отже, при зміні мови реєстру через Адмінпанель Control Plane буде створений новий запит на оновлення, що призведе до зміни параметру `global.language` у `values.yaml` та перерозгорне екземпляри `redash-admin` та `redash-viewer` із актуальним значенням змінної оточення `LANGUAGE`. Що в свою чергу визначить режим роботи `translate.py` скрипта, який виконає або ні переклад, згідно обраного `csv` файлу. + +== Компоненти системи та їх призначення в рамках дизайну рішення +У даному розділі наведено перелік компонент системи, які задіяні або потребують змін в рамках реалізації дизайну. + +|=== +|Підсистема|Компонент|Опис змін + +|Підсистема аналітичної звітності реєстру +|*redash-viewer* +.2+|Винесення скриптів локалізації з процесу збірки докер образа на рівень розгортання. Опрацювання варіантів ввімкнення і вимкнення локалізації. Виправлення помилок поточного перекладу. + +|Підсистема моделювання регламенту реєстру +|*redash-admin* + +|Підсистема управління Платформою та Реєстрами +|*control-plane-console* +|Розширення інтерфейсу управління реєстру коментарем. + +|=== + +== Підтримка зворотної сумісності +За замовчуванням мова локалізації не визначається ні на рівні шаблону реєстру, ні у `redash-chart`. При необхідності значення `global.language` може бути виставлене в `""` або `null`. +Для існуючих реєстрів, що не потребують переключення на англійську мову, це буде реалізовано в скрипті `translate.py` умовою запускати переклад `uk` в разі пустого значення змінної середовища `LANGUAGE`. +Додаткових кроків для міграції реєстрів і їх компонент не потребується. + +== Високорівневий план розробки +=== Технічні експертизи +* _DevOps_ +* _FE_ + +=== Попередній план розробки +* Винести процес локалізації в окремий `translate.py` скрипт та запакувати в `redash-chart` докер образ. +* Запакувати `uk.csv` файл локалізації в `redash-chart` докер образ. +* Прибрати обробку `app.*.js` файлів з `Dockerfile`. +* Параметризувати скрипт `translate.py` для визначення мови перекладу та власне запуску процесу перекладу в залежності від змінної оточення `LANGUAGE`. +* Запускати скрипт `translate.py` через `command.args` в темплейтах розгортання `redash-admin` та `redash-viewer`. +* В Control Plane в табі Реєстри на сторінці Загальні налаштування в розділі "Локалізація" під текстом "Кабінет адміністратора регламенту" додати фразу: Веб-інтерфейс моделювання звітів. +* По можливості доповнити та виправити поточний український переклад. + +== Опційно +Стандартизувати процес інтернаціоналізації та локалізації, використовуючи для зберігання слів перекладу json формат. Для цього: + +* Cконвертувати файли перекладу `csv` у `json`, формату `{"en_word" : "uk_word", ...}`. +* Замінити `load_excel_to_dict()` на читання перекладів згідно цільового формату, наприклад, `json.load()`. + +== Поза скоупом +* Адміністратор платформи чи адміністратор реєстру обирає для Redash Admin та/або Viewer мову, відмінну, від мови реєстру. +* Адміністратор платформи чи адміністратор реєстру обирає свою індивідуальну мову інтерфейсу. +* Визначення мови користувача в "Accept-Language" заголовку запиту або у разі відсутності перекладів для мови - використання налаштувань за замовчуванням обраних на етапі встановлення екземпляру Платформи. +* Локалізація елементів, недоступних для зміни після збірки Redash компонента. diff --git a/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/platform-evolution/registry-logo/registry-logo.adoc b/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/platform-evolution/registry-logo/registry-logo.adoc new file mode 100644 index 0000000000..ec16b263a7 --- /dev/null +++ b/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/platform-evolution/registry-logo/registry-logo.adoc @@ -0,0 +1,100 @@ += Налаштування логотипу реєстру + +== Загальний опис + +Необхідно надати можливість налаштовувати логотипи у хедері сторінок, логотип лоадера, favicon для окремого реєстру. +Обрані логотипи платформи мають відображатись у всіх кабінетах. + +== Актори та ролі користувачів + +* Моделювальник реєстру +* Посадова особа +* Користувач порталів + +== Функціональні сценарії + +* Перегляд логотипів у порталах реєстру (officer, citizen, admin). +* Оновлення логотипів для окремого реєстру + +== Загальні принципи та положення + +* Налаштування логотипів відбувається на рівні регламенту реєстру +* Моделювальник може вказати наступні логотипи: +** Логотип у навігаційному меню +** Логотип у вкладці браузера (favicon) +** Логотип у лоадеру +* За замовчуванням використовуються поточні українські логотипи та іконки + +== Високорівневий дизайн рішення + +На рівні регламенту з'являється нова папка _assets_, яка міститиме необхідні файли + +Структура папки: + +* ./assets +** ./header-logo.svg +** ./loader-logo.svg +** ./favicon.png + +Файли з цієї папки читаються на рівні пайплайну публікації регламенту і перетворюються на base64 рядки. + +Після цього вони: + +* додаються до конфігмапи *registry-logos*, дана конфігмапа маунтиться до порталів +* додаються до keycloak auth flow для оновлення на сторінках автентифікації + +Найближчий приклад - _UpdateRegistrySettings.groovy_ у репозиторії пайплайну публікації регламенту + +[source,yaml] +.deployments/officer-portal +---- +volumeMounts: + - name: registry-logos + mountPath: /usr/share/nginx/html/portal-officer/logos/registry-logos +---- + +[source,yaml] +.Вміст конфігмапи +---- +logoHeader: base64File +logoLoader: base64File +logoFavicon: base64File +---- + +== Компоненти системи та їх призначення в рамках дизайну рішення + +У даному розділі наведено перелік компонент системи, які залучені або потребують змін в рамках реалізації функціональних вимог. + +|=== +|Підсистема|Компонент|Опис змін + +|Підсистема кабінетів +|*common-web-app* +|Додати обробку логотипів, які передаються у форматі base64 тексту, у порталах та на сторінках автентифікації +|Підсистема розгортання регламенту +|*registry-regulation-publication-pipeline* +|Додати стейдж обробки логотипів з регламенту і оновлення конфігмапи та кіклок ресурсів +|Підсистема розгортання регламенту +|*registry-regulation-validator* +|Додати перевірку наявності та не пустоти трьох нових файлів +|Підсистема розгортання та налаштування Платформи та реєстрів +|*registry-configuration* +|Додати створення конфігмапи _registry-logos_ з дефолтними контентом для подальшого оновлення пайплайном публікації, додати створення дефолтних значень для нових полів автентифікаторів кіклока +|Підсистема управління користувачами та ролями +|*keycloak-ds-officer-authenticator* +|Додати обробку параметрів з логотипами на сторінках автентифікації (_FormParam.java_, _DsoOfficerAuthenticator.java_, _DsoOfficerAuthenticatorFactory.java_, _IdGovUaOfficerAuthenticator.java_, _IdGovUaOfficerAuthenticatorFactory.java_) +|Підсистема управління користувачами та ролями +|*keycloak-ds-citizen-authenticator* +|Додати обробку параметрів з логотипами на сторінках автентифікації (_FormParam.java_, _DsoCitizenAuthenticator.java_, _DsoCitizenAuthenticatorFactory.java_) + +|=== + +=== Експертизи + +* DevOps +* BE +* FE (react) + +== Міграція існуючих реєстрів при оновленні + +Необхідний міграційний скрипт, який до усіх існуючих реєстрів додасть файли з дефолтними українськими логотипами diff --git a/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/platform-evolution/regulations-integrity/regulations-integrity.adoc b/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/platform-evolution/regulations-integrity/regulations-integrity.adoc index 014c77c5e9..f20ee698f0 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/platform-evolution/regulations-integrity/regulations-integrity.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/platform-evolution/regulations-integrity/regulations-integrity.adoc @@ -1,4 +1,5 @@ -= Перевірка цілісності запиту на внесення змін до регламенту реєстру += Перевірка цілісності запита на внесення змін до регламенту реєстру +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] == Загальний опис Складові xref:architecture/registry/administrative/regulation-management/registry-regulation/registry-regulation.adoc[Цифрового регламенту реєстру] мають внутрішні зв'язки між собою, які в поточній реалізації diff --git a/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/platform-evolution/sc-where-logic-operators.adoc b/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/platform-evolution/sc-where-logic-operators.adoc index 8b04798c59..d5b04746d8 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/platform-evolution/sc-where-logic-operators.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/platform-evolution/sc-where-logic-operators.adoc @@ -1,6 +1,7 @@ - - = Керування логічними операторами у критеріях пошуку +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Загальний опис У цій статті буде розглянута реалізація можливості моделювальника керувати яким логічним оператором, OR чи AND, будуть об'єднуватись параметри пошуку та в якому порядку вони будуть визначатися. diff --git a/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/platform-evolution/sign-validation/sign-validation.adoc b/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/platform-evolution/sign-validation/sign-validation.adoc index 5849b02feb..5f17dae6b6 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/platform-evolution/sign-validation/sign-validation.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/platform-evolution/sign-validation/sign-validation.adoc @@ -1,6 +1,7 @@ - - = Перевірка підпису КЕП та підписанта у контенті бізнес-процесу через API +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Загальний опис @@ -302,7 +303,7 @@ IntStream.rangeClosed(0, endUser.ASiCGetSignsCount(data)) Для даних в форматі CAdES використовується `EndUser::VerifyInternal(base64Data)` та повертається деталі з об'єкту `EndUserSignInfo` як єдиний елемент в масиві. -== signature_content((, ) +== signature_content(, ) === JUEL функція diff --git a/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/platform-evolution/template-validation/template-validation.adoc b/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/platform-evolution/template-validation/template-validation.adoc index 708ecb9c90..e40a7c30a9 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/platform-evolution/template-validation/template-validation.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/platform-evolution/template-validation/template-validation.adoc @@ -1,4 +1,5 @@ = Валідація порожніх обов'язкових полів на рівні шаблонів у бізнес-процесі +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] diff --git a/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/registry-regulation/registry-regulation.adoc b/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/registry-regulation/registry-regulation.adoc index 3458f56b58..b8f5336762 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/registry-regulation/registry-regulation.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/registry-regulation/registry-regulation.adoc @@ -1,8 +1,11 @@ = Цифровий регламент реєстру +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Загальний опис -_Регламент реєстру_ - це цифрове представлення важливих аспектів функціонування реєстру, що складається з декларативних описів організаційної структури, моделі даних, інформаційних та адміністративних послуг, прав доступу, шаблонів витягів та повідомлень, налаштувань інтеграцій з зовнішніми системами, тощо. +_Регламент реєстру_ -- це цифрове представлення важливих аспектів функціонування реєстру, що складається з декларативних описів організаційної структури, моделі даних, інформаційних та адміністративних послуг, прав доступу, шаблонів витягів та повідомлень, налаштувань інтеграцій з зовнішніми системами тощо. _Регламент реєстру_ разом з _операційною конфігурацією реєстру_ складають необхідний та достатній опис функціональних можливостей, які реалізує реєстр та налаштувань для забезпечення відповідного рівня якості їх надання кінцевим користувачам. @@ -52,6 +55,7 @@ image::architecture/registry/administrative/regulation-management/registry-regul +++ <&file> ... ++ <&folder> roles +++ <&file> citizen.yml ++++ <&file> external-system.yml +++ <&file> officer.yml ++ <&folder> bp-auth +++ <&file> citizen.yml @@ -96,6 +100,10 @@ image::architecture/registry/administrative/regulation-management/registry-regul ++ <&folder> mock-integrations +++ <&file> .json +++ <&file> ... +++ <&folder> assets ++++ <&file> favicon.png ++++ <&file> header-logo.svg ++++ <&file> loader-logo.svg ++ <&folder> autotests +++ <&file> ... ++ <&file> settings.yml @@ -219,6 +227,7 @@ ungrouped: Дана складова частина регламенту відповідає за налаштування ролей користувачів реєстру та представлена в репозиторії окремою директорією з двома файлами налаштувань в _YAML_-форматі: - `./roles/citizen.yml` - містить перелік ролей отримувачів послуг реєстру +- `./roles/external-system.yml` - містить перелік ролей зовнішніх систем реєстру - `./roles/officer.yml` - містить перелік ролей надавачів послуг реєстру .Формат визначення регламентних ролей реєстру в _YAML_-форматі: @@ -356,6 +365,14 @@ trembita: * xref:arch:architecture/registry/operational/external-integrations/overview.adoc[] -- +=== Зображення реєстру + +Дана складова частина регламенту відповідає за налаштування зображень, що будуть відображатись користувачам в процесі роботи з реєстром через кабінети: + +- `./assets/favicon.png` - файл з іконкою сайту для адресного рядку (favicon) +- `./assets/header-logo.png` - файл з логотипом, що відображатиметься в хедер елементі кабінетів (вгорі сторінки, поряд з меню) +- `./assets/loader-logo.png` - файл з логотипом, що відображатиметься при завантаженні сторінок кабінетів + === Тестування регламенту реєстру Дана складова частина регламенту відповідає за налаштування симуляції API зовнішніх систем та набір автоматизованих тестів. Представлена двома директоріями: diff --git a/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/user-import.adoc b/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/user-import.adoc index 2b95cb8c0c..7c9c82b788 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/user-import.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-management/user-import.adoc @@ -1,19 +1,5 @@ -:important-caption: ВАЖЛИВО -:note-caption: ПРИМІТКА -:tip-caption: ПІДКАЗКА -:warning-caption: ПОПЕРЕДЖЕННЯ -:caution-caption: УВАГА -:example-caption: Приклад -:figure-caption: Зображення -:table-caption: Таблиця -:appendix-caption: Додаток -:table-caption: Таблиця -:experimental: -:sectanchors: -:sectlinks: -:partnums: - = Механізм імпорту користувачів до Keycloak +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] diff --git a/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-publication/cd-process.adoc b/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-publication/cd-process.adoc index 88d962ae22..e6c81cdfed 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-publication/cd-process.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-publication/cd-process.adoc @@ -1,7 +1,12 @@ += CD-процеси +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] + == EDP flow === Бібліотека -Най простіший CI процес який зводиться до створення jar файлу та публікації його в Nexus +Найпростіший CI процес який зводиться до створення jar файлу та публікації його в Nexus image::architecture/registry/administrative/regulation-publication/edp-lib-pipeline.svg[] diff --git a/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-publication/data-api-versioning-decommission.adoc b/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-publication/data-api-versioning-decommission.adoc index a28261fe18..64ba646276 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-publication/data-api-versioning-decommission.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-publication/data-api-versioning-decommission.adoc @@ -1,4 +1,7 @@ = Відмова від збереження попередніх версій сервісів API фабрики даних +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Загальний опис diff --git a/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/regulation-deployment/idempotent-run.adoc b/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-publication/idempotent-run.adoc similarity index 72% rename from docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/regulation-deployment/idempotent-run.adoc rename to docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-publication/idempotent-run.adoc index 008d8c50b6..97d5140d0d 100644 --- a/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/regulation-deployment/idempotent-run.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-publication/idempotent-run.adoc @@ -1,10 +1,5 @@ = Ідемпотентне розгортання регламенту -[IMPORTANT] --- -Сторінка технічної документації є баченням майбутньої реалізації, актуальність якого може бути застарілою. --- - == Загальний опис На етапі розгортання регламенту кроки запускаються лише якщо було внесено зміни в рамках останнього коміту. Таким чином якщо при попередньому запуску пайплайна крок був не успішним, а в поточному коміті зміни не було внесено, то крок буде проігноровано і відмічено як успішний. @@ -54,7 +49,8 @@ registry-regulations-cli [plan|save] [parameter] [options] Приймає як параметер, логічна назва складової регламенту. OPTIONS: - -f --file - перелік папок і файлів [Обовʼязковий] + --file - перелік папок і файлів + --file-detailed - перелік папок і файлів з детальною інформацією про них ---- === Перевірка стану регламенту і необхідності запуску кроку розгортання @@ -62,10 +58,11 @@ OPTIONS: .Приклад використання на пайплайні розгортання [source, bash] ---- -registry-regulations-cli plan data-model -f registry-regulations/data-model/ registry-regulations/settings.yaml +registry-regulations-cli plan data-model --file registry-regulations/data-model/ registry-regulations/settings.yaml ---- -Вихідним параметром виконання команди є _boolean_ флаг чи відрізняються файли які були використанні при виконанні даного кроку від поточного стану. +Вихідним параметром виконання команди з флагом --file є _boolean_ флаг чи відрізняються файли які були використанні при виконанні даного кроку від поточного стану. +Вихідним параметром виконання команди з флагом --file-detailed є список файлів з переданого списку, які відрізняються від поточного стану. Правила коли необхідно повторно виконати крок: @@ -78,74 +75,31 @@ registry-regulations-cli plan data-model -f registry-regulations/data-model/ reg .Формат виклику команди збереження стану файлів для кроку розгортання регламенту. [source, bash] ---- -registry-regulations-cli save ${group-name} -f %{dir1} %{dir2/subDir1} ${fileName} +registry-regulations-cli save ${group-name} --file %{dir1} %{dir2/subDir1} ${fileName} ---- .Приклад [source, bash] ---- -registry-regulations-cli save data-model -f registry-regulations/data-model/ registry-regulations/settings.yaml +registry-regulations-cli save data-model --file registry-regulations/data-model/ registry-regulations/settings.yaml ---- -у разі успішного виконання кроку стан зберігається в секреті `registry-regulation-state` +у разі успішного виконання кроку стан зберігається в секреті `registry-regulation-state` у форматі +data.group-name: {value json} .Структура збереження стану регламенту в секреті. -[source, json] +[source, yaml] ---- -{ - "redash-roles": { - "registry-regulations/roles": "...:SHA256" - }, - "roles": { - "registry-regulations/roles": "...:SHA256" - }, - "data-model": { - "registry-regulations/data-model": "...:SHA256", - "registry-regulations/settings.yaml": "...:SHA256" - }, - "reports": { - "registry-regulations/reports": "...:SHA256" - }, - "notifications": { - "registry-regulations/notifications": "...:SHA256" - }, - "excerpts": { - "registry-regulations/excerpts-csv": "...:SHA256", - "registry-regulations/excerpts-docx": "...:SHA256", - "registry-regulations/excerpts": "...:SHA256" - }, - "bp-grouping": { - "registry-regulations/bp-grouping": "...:SHA256" - }, - "geoserver-configuration": { - "registry-regulations/data-model": "...:SHA256" - }, - "forms": { - "registry-regulations/forms": "...:SHA256" - }, - "global-vars": { - "registry-regulations/global-vars": "...:SHA256" - }, - "theme": { - "registry-regulations/global-vars": "...:SHA256" - }, - "trembita-integrations": { - "registry-regulations/bp-trembita": "...:SHA256" - }, - "bpmn-dmn": { - "registry-regulations/bpmn": "...:SHA256", - "registry-regulations/dmn": "...:SHA256" - }, - "bp-auth": { - "registry-regulations/bp-auth": "...:SHA256" - }, - "autotests": { - "registry-regulations/autotests": "...:SHA256" - }, - "settings": { - "registry-regulations/settings": "...:SHA256" - } -} +data: + upload-global-vars-changes: '{ "global-vars" : "...(SHA256)"}' + create-keycloak-roles: '{ + "roles/officer.yml" : "...(SHA256)", + "roles/citizen.yml" : "...(SHA256)" + }' + upload-business-process-changes: '{ + "bpmn/bp-1.bpmn" : "...(SHA256)", + "bpmn/bp-2.bpmn" : "...(SHA256)"}' + other-steps: '...' ---- Для підрахунку чексуми файлів використовується алгоритм _SHA256_ `MessageDigest digest = MessageDigest.getInstance("SHA-256");` diff --git a/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-publication/overview.adoc b/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-publication/overview.adoc index 714eafbb7a..dcea4745cd 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-publication/overview.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-publication/overview.adoc @@ -1,5 +1,4 @@ = Підсистема розгортання регламенту реєстру - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] @@ -14,8 +13,8 @@ include::platform:ROOT:partial$admonitions/language-ua.adoc[] * Валідація цілісності регламенту реєстру * Розгортання тимчасових баз даних для версій кандидатів * Застосування змін до схеми бази даних реєстру -* Генерація коду сервісів доступу до даних реєстру -* Розгортання сервісів доступу до даних реєстру +* Генерація коду сервісів реєстру +* Розгортання сервісів реєстру * Розгортання змін до бізнес-процесів та UI-форм * Створення ролей користувачів реєстру * Налаштування прав доступу до бізнес-процесів @@ -46,7 +45,7 @@ a| * `jenkins-operator` |3rd-party a| -* https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/devops/operators/jenkins-operator[gerrit:/mdtu-ddm/.../jenkins-operator] +* https://github.com/epam/edp-ddm-jenkins-operator[github:/epam/edp-ddm-jenkins-operator] * https://github.com/jenkinsci/jenkins[github:/jenkinsci/jenkins] |Програмний комплекс, що забезпечує автоматизацію в життєвому циклі розгортання регламенту Реєстру @@ -56,15 +55,15 @@ a| * `registry-regulations-publication-stages` (DEPRECATED) |origin a| -* https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/devops/registry-regulations-publications/registry-regulations-publication-pipelines[gerrit:/mdtu-ddm/.../registry-regulations-publication-pipelines] -* https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/devops/registry-regulations-publications/registry-regulations-publication-stages[gerrit:/mdtu-ddm/.../registry-regulations-publication-stages] +* https://github.com/epam/edp-ddm-registry-regulations-publication-pipeline[github:/epam/edp-ddm-registry-regulations-publication-pipeline] +* https://github.com/epam/edp-ddm-registry-regulations-publication-stages[github:/epam/edp-ddm-registry-regulations-publication-stages] | Groovy пайплайни для виконання різноманітних кроків підсистеми розгортання регламенту. Побудовано на базі https://epam.github.io/edp-install/user-guide/pipeline-framework/[EDP Pipeline Framework] |_Агент розгортання регламенту_ |`dataplatform-jenkins-agent` |origin -|https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/data-architecture/devops-application/dataplatform-jenkins-agent[gerrit:/mdtu-ddm/.../dataplatform-jenkins-agent] +|https://github.com/epam/edp-ddm-dataplatform-jenkins-agent[github:/epam/edp-ddm-dataplatform-jenkins-agent] |Jenkins агент, який використовується для запуску пайплайнів підсистеми розгортання регламенту і містить всі необхідні залежності для цього. Детальніше з концепцією Jenkins агентів можна ознайомитись https://www.jenkins.io/doc/book/using/using-agents[в офіційній документації] @@ -72,50 +71,50 @@ https://epam.github.io/edp-install/user-guide/pipeline-framework/[EDP Pipeline F |`nexus` |3rd-party a| -* https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/data-architecture/devops-application/nexus[gerrit:/mdtu-ddm/data-architecture/devops-application/nexus] +* https://github.com/epam/edp-ddm-nexus[github:/epam/edp-ddm-nexus] * https://github.com/sonatype/nexus-public[github:/sonatype/nexus-public] |Збереження згенерованих в підсистемі артефактів |_Утиліта валідації регламенту_ |`registry-regulations-validator-cli` |origin -| https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/low-code-platform/platform/backend/utilities/registry-regulations-validator-cli[gerrit:/mdtu-ddm/.../registry-regulations-validator-cli] +| https://github.com/epam/edp-ddm-registry-regulations-validator-cli[github:/epam/edp-ddm-registry-regulations-validator-cli] |_Command line interface (CLI)_ для валідації складників регламенту на етапі перевірки потенційних змін |_Утиліта генерації сервісів доступу до даних реєстру_ |`service-generation-utility` |origin -| https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/data-architecture/libraries/service-generation-utility[gerrit:/mdtu-ddm/.../service-generation-utility] -|_CLI_ для генерації коду сервісів доступу до даних реєстру на основі опису _Liqubase_ скриптів +| https://github.com/epam/edp-ddm-service-generation-utility[github:/epam/edp-ddm-service-generation-utility] +|_CLI_ для генерації коду сервісів доступу до даних реєстру на основі опису _Liqubase_-скриптів |_Утиліта публікації аналітичних звітів та витягів_ |`report-publisher` |origin -| https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/data-architecture/libraries/report-publisher[gerrit:/mdtu-ddm/.../report-publisher] +| https://github.com/epam/edp-ddm-report-publisher[github:/epam/edp-ddm-report-publisher] |_CLI_ для публікації аналітичних звітів та витягів у відповідні підсистеми |_Утиліта управління доступом до БП_ |`camunda-auth-cli` |origin -| https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/low-code-platform/platform/backend/utilities/camunda-auth-cli[gerrit:/mdtu-ddm/.../camunda-auth-cli] +| https://github.com/epam/edp-ddm-camunda-auth-cli[github:/epam/edp-ddm-camunda-auth-cli] |_CLI_ для налаштування прав доступу до БП для відповідних ролей користувачів |_Утиліта публікації шаблонів нотифікацій_ |`notification-template-publisher` |origin -| https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/data-architecture/libraries/notification-template-publisher[gerrit:/mdtu-ddm/.../notification-template-publisher] +| https://github.com/epam/edp-ddm-notification-template-publisher[github:/epam/edp-ddm-notification-template-publisher] |_CLI_ для публікації шаблонів нотифікацій у відповідну підсистему |_Утиліта завантаження геошарів_ |`geoserver-publisher` |origin -| https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/data-architecture/libraries/geoserver-publisher[gerrit:/mdtu-ddm/.../geoserver-publisher] +| https://github.com/epam/edp-ddm-geoserver-publisher[github:/epam/edp-ddm-geoserver-publisher] |_CLI_ для налаштування підсистеми управління геоданими |_Тимчасові бази даних реєстру_ |`operational:registry-dev-*` |origin -| https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/gitweb?p=mdtu-ddm/devops/registry-regulations-publications/registry-regulations-publication-pipeline.git;a=blob;f=src/com/epam/digital/data/platform/pipelines/stages/impl/dataplatform/CreateSchemaVersionCandidate.groovy;h=38bb68710a40a192bc52a9620aa249cd6d3010bd;hb=refs/heads/master[gerrit:/mdtu-ddm/.../dataplatform/CreateSchemaVersionCandidate.groovy] +| https://github.com/epam/edp-ddm-registry-regulations-publication-pipeline[github:/epam/edp-ddm-registry-regulations-publication-pipeline/.../dataplatform/CreateSchemaVersionCandidate.groovy] |Тимчасові бази даних реєстру для версій-кандидатів, які використовуються при моделюванні регламенту для перевірки потенційних змін у _Liquibase_ скриптах diff --git a/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-publication/services/camunda-auth-cli/summary.adoc b/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-publication/services/camunda-auth-cli/summary.adoc index 4715e3a265..25ce701723 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-publication/services/camunda-auth-cli/summary.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/administrative/regulation-publication/services/camunda-auth-cli/summary.adoc @@ -1,5 +1,4 @@ -Camunda-auth-cli інструмент командного рядка -------------------------------------------- += Camunda-auth-cli: інструмент командного рядка == Загальний опис diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/audit/audit-db.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/audit/audit-db.adoc index 14151f729f..6dbda9e3c0 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/audit/audit-db.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/audit/audit-db.adoc @@ -1,5 +1,4 @@ = Операційна БД подій аудиту - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/audit/overview.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/audit/overview.adoc index 4398381a7f..b43fd8937c 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/audit/overview.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/audit/overview.adoc @@ -1,12 +1,11 @@ = Підсистема журналювання подій аудиту - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Загальний опис -Підсистема, призначенням якої є отримання та обробка повідомлень про виникнення значущих подій в системі з їх послідуючою гарантованою фіксацією в журналі аудиту для довготривалого зберігання та аналізу. +Підсистема, призначенням якої є отримання та обробка повідомлень про виникнення значущих подій в системі з їх наступною гарантованою фіксацією в журналі аудиту для довготривалого зберігання та аналізу. == Функції підсистеми @@ -20,9 +19,17 @@ include::platform:ROOT:partial$admonitions/language-ua.adoc[] image::architecture/registry/operational/audit/audit-overview.svg[float="center",align="center",width=600] -_Підсистема журналювання подій аудиту_ надає асинхронний _API_ у вигляді _Kafka_-топіка `audit-events` для публікації повідомлень про події аудиту цільовими підсистемами згідно визначеної схеми та використовує для зберігання даних в _Операційну БД подій аудиту_ механізм, який базується на https://kafka.apache.org/documentation.html#connect[Kafka Connect API] для забезпечення `exactly once` семантики обробки повідомлень. +_Підсистема журналювання подій аудиту_ надає асинхронний _API_ у вигляді _Kafka_-топіка `audit-events` для публікації повідомлень про події аудиту цільовими підсистемами згідно з визначеною схемою та використовує для зберігання даних в _Операційну БД подій аудиту_ механізм, який базується на https://kafka.apache.org/documentation.html#connect[Kafka Connect API] для забезпечення `exactly once` семантики обробки повідомлень. + + +Фіксація подій відбувається за допомогою _бібліотеки аудиту_ і передбачено два механізми: + +- Створення індивідуальної аудит-події. + +(_Приклади подій: спроба відправки повідомлення в сервісі нотифікацій користувачів, зміна статусу задач та процесів в сервісі фіксації історичних подій БП_) +- Створення пари подій до дії та після дії з відповідним типом (_BEFORE_, _AFTER_) + +(_Приклади подій: фіксація HTTP запиту до сервісу синхронного управлення даними реєстру, операції звернення до БД в сервісах синхронного та асинхронного управління даними реєстру_) -Функції перегляду журналу аудиту доступні адміністраторам через веб-інтерфейс _Підсистеми аналітичної звітності_ у вигляді набору службових дашбордів, які створюються під час розгортання реєстру xref:arch:architecture/platform/administrative/overview.adoc[Підсистемою розгортання та налаштування Платформи та реєстрів]. +Функції перегляду журналу аудиту доступні адміністраторам через вебінтерфейс _Підсистеми аналітичної звітності_ у вигляді набору службових дашбордів, які створюються під час розгортання реєстру xref:arch:architecture/platform/administrative/overview.adoc[Підсистемою розгортання та налаштування Платформи та реєстрів]. [TIP] -- @@ -37,13 +44,13 @@ _Підсистема журналювання подій аудиту_ нада |_Сервіс збереження схем повідомлень подій аудиту_ |`kafka-schema-registry` |3rd-party -|https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/data-architecture/devops-application/kafka-schema-registry[gerrit:/mdtu-ddm/data-architecture/devops-application/kafka-schema-registry] +|https://github.com/epam/edp-ddm-kafka-schema-registry[github:/epam/edp-ddm-kafka-schema-registry] |Перевірка відповідності структури повідомлення поточній схемі |_Сервіс збереження подій аудиту_ |`kafka-connect-cluster-connect` |3rd-party -|https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/data-architecture/devops-application/strimzi-kafka-operator[gerrit:/mdtu-ddm/data-architecture/devops-application/strimzi-kafka-operator] +|https://github.com/epam/edp-ddm-strimzi-kafka-operator[github:/epam/edp-ddm-strimzi-kafka-operator] |Збереження повідомлень в базу даних |_xref:arch:architecture/registry/operational/audit/audit-db.adoc[Операційна БД подій аудиту]_ @@ -102,7 +109,7 @@ _Підсистема журналювання подій аудиту_ нада == Технологічний стек -При проектуванні та розробці підсистеми, були використані наступні технології: +При проєктуванні та розробці підсистеми, були використані наступні технології: * xref:arch:architecture/platform-technologies.adoc#kafka[Kafka] * xref:arch:architecture/platform-technologies.adoc#kafka-schema-registry[Kafka Schema Registry] @@ -110,11 +117,6 @@ _Підсистема журналювання подій аудиту_ нада == Атрибути якості підсистеми -[NOTE] --- -Секція потребує допрацювання... --- - === _Security_ Використання автентифікації за допомогою TLS для підключення до брокера повідомлень з боку додатка, унеможливлює здійснення атак типу `людина посередині` (`Man in the middle`). @@ -139,4 +141,4 @@ _Підсистема журналювання подій аудиту_ нада Цілісність та незмінність даних гарантована незмінністю повідомлень Kafka та обмеженням доступу на операції запису до БД. === _Data Retention and Archiving_ -Політики збереження та архівування реалізовано за рахунок налаштувань вбудованих механізмів збереження даних повідомлень Kafka та бекапування БД. \ No newline at end of file +Політики збереження та архівування реалізовано за допомогою налаштувань вбудованих механізмів збереження даних повідомлень Kafka та бекапування БД. \ No newline at end of file diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/bpm-history.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/bpm-history.adoc index ca4b8096a3..791efdb0a2 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/bpm-history.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/bpm-history.adoc @@ -1,4 +1,7 @@ = Історичність виконання бізнес-процесів +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Загальний контекст diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/bpm-interim-data-storage.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/bpm-interim-data-storage.adoc index f2f8aaa291..52b4c4dd8f 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/bpm-interim-data-storage.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/bpm-interim-data-storage.adoc @@ -1,5 +1,4 @@ = Проміжні дані бізнес-процесів - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/bpm-save-ext-documents.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/bpm-save-ext-documents.adoc index 51e4774789..1618c885d4 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/bpm-save-ext-documents.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/bpm-save-ext-documents.adoc @@ -1,5 +1,4 @@ -= Скриптування вивантаження файлів за віддаленою адресою з послідуючим збереженням до реєстру у бізнес-процесі - += Скриптування вивантаження файлів за віддаленою адресою зі збереженням до реєстру у бізнес-процесі include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/bpm-save-interim-form-submission.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/bpm-save-interim-form-submission.adoc index 65fd0ff1ce..cc6dda01ff 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/bpm-save-interim-form-submission.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/bpm-save-interim-form-submission.adoc @@ -1,5 +1,4 @@ = Проміжне збереження даних, внесених через UI-форми задач бізнес-процесів - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/camunda-db.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/camunda-db.adoc index e1eabaf7aa..9d314de7b8 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/camunda-db.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/camunda-db.adoc @@ -1,5 +1,4 @@ = Операційна БД бізнес-процесів - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/ceph-storage.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/ceph-storage.adoc index d775f306c8..7c4c6c3678 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/ceph-storage.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/ceph-storage.adoc @@ -1,5 +1,4 @@ = Об'єктне сховище даних - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/digital-documents.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/digital-documents.adoc index 3926927876..a52cab4d52 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/digital-documents.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/digital-documents.adoc @@ -1,14 +1,15 @@ -= Робота з цифровими документами у кабінеті користувача - += Робота з цифровими документами у Кабінеті користувача include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] Поточний технічний дизайн сфокусований на загальних аспектах реалізації вимог щодо роботи із файлами через Кабінети користувача та на особливостях взаємодії між підсистемами "_Lowcode_" та "_Дата Фабрика_" в цьому контексті. +//// [NOTE] Детальніше з дизайном компоненти "_Сервіс цифрових документів_" підсистеми "_Lowcode_" можна ознайомитися xref:digital-document-service:digital-document-service.adoc[за посиланням] +//// == Функціональні можливості diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/overview.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/overview.adoc index 8d4124807a..c69a578486 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/overview.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/overview.adoc @@ -1,5 +1,4 @@ = Підсистема виконання бізнес-процесів - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] @@ -36,12 +35,12 @@ image::architecture/registry/operational/bpms/bpms-subsystem-design.svg[] -- |=== -|Тип події|Службова назва|Опис +|Тип події|Спосіб фіксації|Службова назва|Опис -|_USER_EVENT_|TASK_CREATED|Нова задача збережена -|_USER_EVENT_|TASK_UPDATED|Існуючу задачу було змінено -|_USER_EVENT_|PROCESS_CREATED|Новий процес збережено -|_USER_EVENT_|PROCESS_UPDATED|Існуючий процес було змінено +|_USER_EVENT_|Під час виникнення|TASK_CREATED|Нова задача збережена +|_USER_EVENT_|Під час виникнення|TASK_UPDATED|Існуючу задачу було змінено +|_USER_EVENT_|Під час виникнення|PROCESS_CREATED|Новий процес збережено +|_USER_EVENT_|Під час виникнення|PROCESS_UPDATED|Існуючий процес було змінено |=== [NOTE] diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/process_history-db.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/process_history-db.adoc index 7ff132d860..72c85ab32b 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/process_history-db.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/process_history-db.adoc @@ -1,5 +1,4 @@ = Операційна БД історичних даних бізнес-процесів - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/redis-storage.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/redis-storage.adoc index 428b2f6b36..5c8f1a6e30 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/redis-storage.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/redis-storage.adoc @@ -1,5 +1,4 @@ = Нереляційне сховище даних - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/services/bpms/summary.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/services/bpms/summary.adoc index 0a5d0adc46..43bf794cc9 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/services/bpms/summary.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/services/bpms/summary.adoc @@ -1,4 +1,5 @@ = Сервіс виконання бізнес-процесів +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] == Загальний опис diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/services/digital-document-service/digital-document-service.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/services/digital-document-service/digital-document-service.adoc index 2b9d1c7c1c..0675902611 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/services/digital-document-service/digital-document-service.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/services/digital-document-service/digital-document-service.adoc @@ -1,4 +1,5 @@ = Сервіс цифрових документів +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] == Загальний опис @@ -91,11 +92,19 @@ include::partial$architecture/registry/operational/bpms/services/digital-documen Згідно прийнятої конвенції генерації, всі вони зберігаються у вигляді об'єктів, ключі яких мають вигляд _process/{processInstanceId}/{id}_. -Для забезпечення видалення файлів при завершенні бізнес-процесу, розроблено окремий _ExecutionListener_ який реагує на відповідну подію та проводить видалення об'єктів з бакету для яких виконується умова наявності у ключі _префікса_ вигляду _process/{processInstanceId}, де _processInstanceId_ - це ідентифікатор екземпляра процесу, який підлягає завершенню з будь-якої з наступних причин: +Для забезпечення видалення файлів при завершенні бізнес-процесу, розроблено окремий _ExecutionListener_ який реагує на відповідну подію та проводить видалення об'єктів з бакету для яких виконується умова наявності у ключі _префікса_ вигляду _process/{processInstanceId}, де _processInstanceId_ - це ідентифікатор екземпляра процесу, який підлягає завершенню. -- _COMPLETED_ -- _INTERNALLY_TERMINATED_ -- _EXTERNALLY_TERMINATED_ +Для забезпечення безперебійного видалення файлів бізнес-процесу використовується Kafka топік _bpm-lowcode-file-storage-cleanup_. + +image::architecture/registry/operational/bpms/services/digital-document-service/lowcode-file-storage-cleanup.svg[] + +.Приклад тіла повідомлення про необхідність видалення файлів: +[source, json] +---- +{ + "processInstanceId": "{processInstanceId}" +} +---- === Структура Ceph-об'єкту для збереження цифрового документа diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/services/form-submission-validation/development/development.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/services/form-submission-validation/development/development.adoc index c5b2e79828..a1b503b3d1 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/services/form-submission-validation/development/development.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/services/form-submission-validation/development/development.adoc @@ -1,4 +1,5 @@ = Розробка +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] Репозиторій налаштовано для використання у середовищі NodeJS LTS-версій (від 16.3.0 або 18.x.x) разом із npm версій 8+. Основною мовою програмування є TypeScript. diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/services/form-submission-validation/summary.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/services/form-submission-validation/summary.adoc index d38dc6a56d..a0a17f329c 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/services/form-submission-validation/summary.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/services/form-submission-validation/summary.adoc @@ -1,10 +1,12 @@ = Сервіс валідації даних форми +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] == Загальний опис *Сервіс валідації даних форми* використовується для валідації даних, що були надіслані у відповідь на форму, відносно схеми форми із визначеними правилами компонентів. -=== Основний функціонал +[main-functions] +=== Основна функціональність * Валідація надісланих даних форми * Валідація мета-даних надісланого файлу відносно правил відповідного компоненту форми diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/services/user-task-management/summary.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/services/user-task-management/summary.adoc index 046e6cb9f6..f2571d9b33 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/services/user-task-management/summary.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/services/user-task-management/summary.adoc @@ -1,4 +1,4 @@ -Сервіс управління задачами користувача += Сервіс управління задачами користувача -------------------------------------- == Загальний опис diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/soap-connector.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/soap-connector.adoc index f43684bfcd..0ee2709bc7 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/soap-connector.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/soap-connector.adoc @@ -1,4 +1,5 @@ = Універсальний SOAP-конектор для взаємодії з учасниками інформаційного обміну через ШБО "Трембіта" +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] == Загальний опис diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/trembita-rest-connector.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/trembita-rest-connector.adoc index 5b490a2659..c6bc7733c6 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/trembita-rest-connector.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/bpms/trembita-rest-connector.adoc @@ -1,4 +1,5 @@ = Універсальний конектор для виклику Trembita Rest API +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] == Загальний опис diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/digital-signatures/overview.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/digital-signatures/overview.adoc index ef44466c15..3c3ca2206b 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/digital-signatures/overview.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/digital-signatures/overview.adoc @@ -1,5 +1,4 @@ = Підсистема цифрових підписів - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/digital-signatures/services/dso/eseal.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/digital-signatures/services/dso/eseal.adoc index d14f54e187..d13aa1827a 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/digital-signatures/services/dso/eseal.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/digital-signatures/services/dso/eseal.adoc @@ -1,5 +1,4 @@ -= Робота з цифровою печаткою - += Робота з цифровою печаткою include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/digital-signatures/services/dso/esignature.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/digital-signatures/services/dso/esignature.adoc index 73d235d9ca..d1ea5f7f24 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/digital-signatures/services/dso/esignature.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/digital-signatures/services/dso/esignature.adoc @@ -1,5 +1,5 @@ -Робота з цифовим підписом ------------------------- += Робота з цифровим підписом +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/digital-signatures/services/dso/index.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/digital-signatures/services/dso/index.adoc index 913a1551dd..db60976c95 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/digital-signatures/services/dso/index.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/digital-signatures/services/dso/index.adoc @@ -1,8 +1,9 @@ -= Сервіс КЕП операцій += Сервіс КЕП-операцій +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] == Загальний опис -Метою сервісу є валідація цифрового підпису отриманого від клієнтів сервісу а також накладання системного цифрового підпису на отримані дані. Базується сервіс на "IIT Java digital signature" бібліотеці від ІІТ. +Метою сервісу є валідація цифрового підпису отриманого від клієнтів сервісу, а також накладання системного цифрового підпису на отримані дані. Базується сервіс на "IIT Java digital signature" бібліотеці від ІІТ. Сервіс надає наступний функціонал: diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/excerpts/ceph-storage.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/excerpts/ceph-storage.adoc index 47c685554a..4936f66c99 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/excerpts/ceph-storage.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/excerpts/ceph-storage.adoc @@ -1,5 +1,4 @@ = Об'єктне сховище даних - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/excerpts/excerpt-db.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/excerpts/excerpt-db.adoc index 5552dc8364..9fa9457f6e 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/excerpts/excerpt-db.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/excerpts/excerpt-db.adoc @@ -1,5 +1,4 @@ = Операційна БД витягів - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/excerpts/excerpt-generation.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/excerpts/excerpt-generation.adoc index 1e54cfd1d6..a172634c5a 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/excerpts/excerpt-generation.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/excerpts/excerpt-generation.adoc @@ -1,5 +1,4 @@ -== Генерація витягів з кабінету користувача - += Генерація витягів з кабінету користувача include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/excerpts/excerpt.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/excerpts/excerpt.adoc index 49fbf2a7ef..3023b7b98e 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/excerpts/excerpt.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/excerpts/excerpt.adoc @@ -1,5 +1,4 @@ = Формування витягів - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/excerpts/overview.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/excerpts/overview.adoc index ee71c3bc81..3e952dfe69 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/excerpts/overview.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/excerpts/overview.adoc @@ -1,5 +1,4 @@ = Підсистема формування витягів реєстру - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] @@ -89,11 +88,10 @@ https://github.com/epam/edp-ddm-history-excerptor-chart[github:/epam/edp-ddm-his Події системи витягів фіксуються системою у журналі аудиту з повним контекстом. |=== -|Тип події|Службова назва|Опис +|Тип події|Спосіб фіксації|Службова назва|Опис -|_USER_EVENT_|GENERATE EXCERPT CALL|Отримання запита на генерацію витягу -|_USER_EVENT_|EXCERPT GENERATION|Генерація відповідного витягу -|_USER_EVENT_|RETRIEVE EXCERPT CALL|Отримання згенерованого витягу +|_USER_EVENT_|До та після події|EXCERPT GENERATION|Генерація відповідного витягу +|_USER_EVENT_|До та після події|RETRIEVE EXCERPT CALL|Отримання згенерованого витягу |=== == Технологічний стек diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/ext-api-management/api-gateway/kong-oidc.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/ext-api-management/api-gateway/kong-oidc.adoc index d87f97b951..072501648a 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/ext-api-management/api-gateway/kong-oidc.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/ext-api-management/api-gateway/kong-oidc.adoc @@ -1,6 +1,5 @@ -include::ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] - = OIDC-розширення для Kong API Gateway +include::ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::ROOT:partial$admonitions/language-ua.adoc[] diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/ext-api-management/overview.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/ext-api-management/overview.adoc index 8d81bfabd3..ac65b66e65 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/ext-api-management/overview.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/ext-api-management/overview.adoc @@ -1,5 +1,4 @@ = Підсистема управління зовнішнім трафіком операційної зони реєстру - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/ext-api-management/redis-storage.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/ext-api-management/redis-storage.adoc index d37d0fca8e..b62770a60d 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/ext-api-management/redis-storage.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/ext-api-management/redis-storage.adoc @@ -1,5 +1,4 @@ = Нереляційне сховище даних - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/ext-api-management/routes.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/ext-api-management/routes.adoc index d102a036a6..7a6425ea2a 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/ext-api-management/routes.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/ext-api-management/routes.adoc @@ -1,5 +1,4 @@ -== Структура маршрутів зовнішнього Kong API Gateway - += Структура маршрутів зовнішнього Kong API Gateway include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] @@ -8,7 +7,7 @@ include::platform:ROOT:partial$admonitions/language-ua.adoc[] фунционалу платформи за допомогою REST API. Даний документ містить інформацію про загальні положення при формуванні зовнішніх точок доступ та перелік доступних для використання методів. -=== Загальні положення +== Загальні положення * Усі зовнішні ендпоінти викликаються через Kong API Gateway * Усі виклики API повинні мати авторизаційний токен (зберігається в сессії Kong) @@ -26,7 +25,7 @@ include::platform:ROOT:partial$admonitions/language-ua.adoc[] вказаному патерну. Наприклад, ендпоінт */api/tasks* надає в тому числі до методу POST */api/tasks/{id}/complete* -=== Перелік ендпоінтів в системі (to be) +== Перелік ендпоінтів в системі (to be) |=== |Route name |Route host |Route path |Service name |Service Path diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/ext-systems-simulation/custom-mocking-wiremock.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/ext-systems-simulation/custom-mocking-wiremock.adoc index 94cdf4028a..94b0960ed3 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/ext-systems-simulation/custom-mocking-wiremock.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/ext-systems-simulation/custom-mocking-wiremock.adoc @@ -1,5 +1,4 @@ = Декларативний підхід до налаштування емуляторів зовнішніх систем для спрощення тестування зовнішніх інтеграцій реєстру - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/ext-systems-simulation/overview.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/ext-systems-simulation/overview.adoc index dfafb93231..ab75ef33b5 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/ext-systems-simulation/overview.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/ext-systems-simulation/overview.adoc @@ -1,5 +1,4 @@ = Підсистема симуляції API зовнішніх систем - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] @@ -8,16 +7,16 @@ include::platform:ROOT:partial$admonitions/language-ua.adoc[] _Підсистема симуляції API зовнішніх систем_ забезпечує можливості по розробці та тестуванню реєстру в ізоляції від зовнішніх систем. -Налаштування правил симуляції згідно вимог реєстру доступне через службовий веб-інтерфейс xref:arch:architecture/registry/administrative/regulation-management/overview.adoc[Підсистеми моделювання регламенту реєстру]. Управління використанням симуляції зовнішніх інтеграцій та використанням реальних систем доступне через веб-інтерфейс налаштування _операційної конфігурації реєстру_ xref:arch:architecture/platform/administrative/control-plane/overview.adoc[Підсистеми управління Платформою та Реєстрами]. +Налаштування правил симуляції згідно з вимогами реєстру доступне через службовий вебінтерфейс xref:arch:architecture/registry/administrative/regulation-management/overview.adoc[Підсистеми моделювання регламенту реєстру]. Управління використанням симуляції зовнішніх інтеграцій та використанням реальних систем доступне через вебінтерфейс налаштування _операційної конфігурації реєстру_ xref:arch:architecture/platform/administrative/control-plane/overview.adoc[Підсистеми управління Платформою та Реєстрами]. == Функції підсистеми * Симуляція API зовнішніх систем в рамках виконання бізнес-процесів -* Симуляція віджету підпису даних в функціональних сценаріях накладання підпису та автентифікації користувачів кабінетів +* Симуляція віджета підпису даних в функціональних сценаріях накладання підпису та автентифікації користувачів кабінетів == Технічний дизайн підсистеми -На даній діаграмі зображено компоненти, які входять в _Підсистема симуляції API зовнішніх систем_ та їх взаємодію з іншими підсистемами в рамках реалізації функціональних сценаріїв. +На даній діаграмі зображено компоненти, які входять у _Підсистему симуляції API зовнішніх систем_ та їх взаємодію з іншими підсистемами в рамках реалізації функціональних сценаріїв. image::arch:architecture/registry/operational/ext-systems-simulation/ext-systems-simulation-design.svg[float="center",align="center"] @@ -34,13 +33,13 @@ _Підсистема симуляції API зовнішніх систем_ п |_Віджет симуляції підпису даних_ |`sign-widget-mock` |origin -|https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/low-code-platform/mock/sign-widget-mock[gerrit:/mdtu-ddm/low-code-platform/mock/sign-widget-mock] -|Статична копія віджету підпису +|https://github.com/epam/edp-ddm-sign-widget-mock[github:/epam/edp-ddm-sign-widget-mock] +|Статична копія віджета підпису |_Сервер симуляції API зовнішніх систем_ |`wiremock` |3rd-party -|https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/general/wiremock[gerrit:/mdtu-ddm/general/wiremock] +|https://github.com/epam/edp-ddm-wiremock[github:/epam/edp-ddm-wiremock] |Сервер мокування API зовнішніх систем з підтримкою декларативного підходу до опису контрактів |_Мок-сервіс інтеграції з ЄДР_ diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/external-integrations/api-access-from-trembita.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/external-integrations/api-access-from-trembita.adoc index ce854a9730..ada3d11e07 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/external-integrations/api-access-from-trembita.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/external-integrations/api-access-from-trembita.adoc @@ -1,4 +1,5 @@ = Обмеження доступу до SOAP інтерфейсів з ШБО Трембіта +include::ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] Як адміністратор реєстру, я хочу обмежувати доступ до SOAP API інтерфейсів, що використовуються ШБО Трембіта @@ -7,7 +8,9 @@ призначені для виклику тільки через ШБО Трембіта. Для безпечного використання SOAP API інтерфейсів, адміністратору необхідно надати можливість дозволяти комунікацію тільки з обмеженого переліку IP-адрес. +[user-roles] === Ролі користувачів + * Технічний адміністратор реєстру == Функціональні сценарії diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/external-integrations/cross-registry.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/external-integrations/cross-registry.adoc index c4a9a69543..82dbf1709e 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/external-integrations/cross-registry.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/external-integrations/cross-registry.adoc @@ -1,6 +1,7 @@ -= Міжреєстрова взаємодія без Трембіта += Міжреєстрова взаємодія без "Трембіта" +include::ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] -Задля зменшення надлишкового використання обчислювальних потужностей, зовнішнього трафіка та часу відповді при інтеграції між реєстрами без використання Трембіта. +Задля зменшення надлишкового використання обчислювальних потужностей, зовнішнього трафіку та часу відповіді при інтеграції між реєстрами без використання "Трембіта". Виділяється три сценарії використання інтероперабельності реєстрів. * За умови що реєстри належать одному клієнту, є спорідненими (Група реєстрів) diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/external-integrations/diia-integration.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/external-integrations/diia-integration.adoc index 066177a5f3..8da80b76dc 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/external-integrations/diia-integration.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/external-integrations/diia-integration.adoc @@ -1,4 +1,5 @@ = Рекомендації щодо інтеграції екосистеми Дії та платформи реєстрів +include::ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] == Глосарій diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/external-integrations/external-systems-access-separation.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/external-integrations/external-systems-access-separation.adoc new file mode 100644 index 0000000000..3065a8b744 --- /dev/null +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/external-integrations/external-systems-access-separation.adoc @@ -0,0 +1,241 @@ += Розмежування доступу зовнішніх систем до API бізнес процесів + +== Загальний опис + +Наразі у Платформі не існує можливості контролювати доступ окремих зовнішніх систем до виклику окремих бізнес процесів через Трембіту та без Трембіти. +В поточній реалізації зовнішні системи можуть отримати права або на виклик усіх бізнес процесів, дозволених для зовнішніх систем, або на виклик жодного з них. +Водночас, у користувачів з'явилась потреба більш гранулярного керування доступом до виклику бізнес процесів різними зовнішніми системами + +== Актори та ролі користувачів +* Технічний адміністратор реєстру +* Моделювальник реєстру +* Зовнішні системи + +== Функціональні сценарії +* Створення ролей для зовнішніх систем +* Застосування ролей до сервісних акаунтів Кіклока +* Керування доступом зовнішньої системи до окремих бізнес процесів через Трембіту +* Керування доступом зовнішньої системи до окремих бізнес процесів без Трембіти + +== Поточна реалізація + +Для надання можливості виконати бізнес процес зовнішньою системою, моделювальнику необхідно виконати декілька кроків. + +* прописати бізнес-процеси, доступні для зовнішніх систем, у файлі _/bp-trembita/external-system.yml_. + +.Приклад файлу регламенту +[source, yaml] +---- +trembita: + process_definitions: + - process_definition_id: 'some-bp' + start_vars: + - edrpou + return_vars: [] +---- +* прописати необхідні авторизації для зовнішніх систем, у файлі _/bp-auth/external-system.yml_. + +.Приклад файлу регламенту +[source, yaml] +---- +authorization: + realm: 'external-system' + process_definitions: + - process_definition_id: 'some-bp' + process_name: "Створення нової школи з підписом за замовченням" + process_description: "Створення нової школи з підписом за замовченням" + roles: + - 'trembita-invoker' +---- + +У полі _roles_ моделювальник, найімовірніше, додасть лише роль *trembita-invoker*, оскільки вона є дефолтною для усіх зовнішніх систем + + +=== Сценарій через Трембіту + +Для запитів через Трембіту у Кіклоці створюється окремий клієнт *trembita-invoker* у рілмі *external-system*. + +Трембіта підтримує налаштування прав доступу для підсистем на рівні SOAP-ендпоінту. +xref:registry-develop:registry-admin/external-integration/api-publish/trembita-data-invoking.adoc[Приклад налаштування для пошукових запитів]. + +Через _bp-webservice-gateway_ наразі виставляється 1 соап ендпоінт *start-bp* + +.Сніпет згенерованого wsdl +[source, xml] +---- + + + + + + +---- + +Внаслідок цього, зараз на рівні Трембіти існує можливість налаштувати для клієнта лише доступ до ендпоінта *startBp*, через який клієнт має можливість викликати будь-який бізнес процес, позначений в регламенті як доступний для external-system. + +=== Сценарій через API без Трембіти + +Для запитів без Трембіти на рівні Контрол Плейну необхідно налаштувати інтеграцію з типом _Зовнішня система_ + +.Скріншот налаштованої системи +image::architecture-workspace/platform-evolution/external-systems-access-separation/cp-ext-system-config.png[] + +В результаті для кожної налаштованої зовнішньої системи у Кіклоці створюється сервісний акаунт з дефолтною роллю *trembita-invoker*. + +Розмежування доступів у даному сценарії відбувається саме на рівні окремих сервіс акаунтів. + +Адміністратор реєстру має можливість вручну створити додаткові ролі, необхідні для розмежування доступу різних зовнішніх систем, та призначити ці ролі відповідним сервіс акаунтам. В такому випадку адміністратор повинен через Camunda Cockpit налаштувати необхідні авторизації для бізнес процесів, щоб гранулярно керувати доступом різних ролей. + +Можливість створити ролі вручну і прописати необхідні авторизації на рівні регламенту - забороняється _Утилітою валідації регламенту_. + +Через _bp-webservice-gateway_ наразі виставляється 1 REST-ендпоінт _/start-bp_, що не є проблемою для сценарію розділення доступів, але може завадити встановлювати інші обмеження (наприклад, в такому сценарії неможливо використати url-based рейт-лімітинг і обмежити кількість запитів до одного бізнес процесу однією зовнішньою системою) + +== Загальні принципи та положення + +* Для обох сценаріїв виклику БП зовнішніми системами повинне існувати розділення на N ендпоінтів, кожен з яких використовується для запуску окремого БП +* Старі ендпоінти залишаються для зворотньої сумісності та для використання у сценаріях, які не вимагають гранулярного керування запуском БП різними зовнішніми системами +* Адміністратор регламенту повинен мати можливість вказувати необхідні ролі для зовнішніх систем у регламенті реєстру +* Адміністратор реєстру керує ролями сервісних користувачів вручну +* Для розмежування доступу до БП використовуються існуючі механізми авторизації + +== Високорівневий дизайн рішення + +=== Генерація необхідних SOAP та REST ендпоінтів + +Поточна імплементація _bp-webservice-gateway_ не дозволяє порівняно просто розширити сервіс для динамічної генерації необхідних SOAP-ендпоінтів. + +Усі необхідні класи для коректного створення wsdl-файлу та обробки вхідних запитів мають існувати на момент запуску застосунку. + +Можливість динамічно створювати необхідні обробники, базуючись на контенті вхідного файлу _/bp-trembita/external-system.yml_, є важко здійснюваною. + +У зв'язку з цим, кращою опцією є розширення існуючої утиліти _service-generation-utility_ та генерація усього необхідного для _bp-webservice-gateway_ коду на етапі публікації регламенту, за прикладом дата-сервісів _rest-api_, _kafka-api_ і т.д. + +[#_необхідні_зміни_для_переносу_створення_soap_ендпоінтів_до_service_generation_utility] +=== Необхідні зміни для переносу створення SOAP-ендпоінтів до service-generation-utility + +У bp-webservice-gateway + +* перейменувати репозиторій _bp-webservice-gateway_ на _bp-webservice-gateway-core-image_ +* за прикладом _rest-api-core-base-image_ залишити у _bp-webservice-gateway-core-image_ код, який не потребує генерації +* все, що стосується запуску застосунку (ресурси для хелм чарта, appliation.yaml, Main клас застосунку) перенести до _service-generation-utility_ у папку resources/META-INF/templates/bp-webservice-gateway + +У service-generation-utility + +* шаблонізувати необхідні для генерації SOAP-ендпоінтів ресурси +* додати новий параметр `--module=bp-webservice-gateway` до виклику _service-generation-utility_ + +У registry-regulation-publication-pipeline + +* додати стейджі генерації, білда та деплою _bp-webservice-gateway_ за прикладом дата-сервісів +* на стейджі генерації викликати _service-generation-utility_ з параметрами `--module=bp-webservice-gateway -Dbp-trembita-external-file=/bp-trembita/external-system.yml` + +==== Очікуваний результат + +.Сніпет згенерованого wsdl +[source, xml] +---- + + + + + + + + + + + + + + +---- + +=== Необхідні зміни для генерації REST-ендпоінтів + +Буде створено новий ендпоінт + +.Приклад запиту і тіла +[source, httprequest] +---- +POST /start-bp/{process-definition-id} + +{ + "start-variables": {} +} +---- + +Формат відповіді і обробка помилок залишаться такими ж, як і в існуючому ендпоінті _/start-bp_ + +=== Управління ролями сервісних користувачів + +Для коректного та зручного управління ролями, необхідними для сервісних користувачів, необхідні: + +* розширення регламенту реєстру файлом _/roles/external-system.yml_ + +.Можливий контент файлу +[source, yaml] +---- +roles: + - name: role-for-subsystem-in-business-group-1 + description: Available business processes 1, 2, 3 + - name: role-for-subsystem-in-business-group-2 + description: Available business processes 3, 4, 5 +---- + +* розширення пайплайну публікації регламенту (крок *create-keycloak-roles*) створенням ролей у рілмі *external-system* + +За умови викидання даного пункту зі скоупу - розглянути можливість прибрати з валідації регламенту перевірки BpAuthToBpmnRoleExistenceValidator (перевірка валідності ролей, що використовуються у bp-auth) + +== Компоненти системи та їх призначення в рамках дизайну рішення + +У даному розділі наведено перелік компонент системи, які потребують змін в рамках реалізації дизайну. + +|=== +|Підсистема|Компонент|Опис змін + +|Підсистема моделювання регламенту реєстру +|*service-generation-utility* +|Генерація необхідних SOAP-ендпоінтів і коду, що необхідний для запуску _bp-webservice-gateway_ + +|Підсистема зовнішніх інтеграцій +|*bp-webservice-gateway* +|Обробка нових REST та SOAP-ендпоінтів + +|Підсистема моделювання регламенту реєстру +|*registry-regulations-publications-pipelines* +|Генерація та деплой _bp-webservice-gateway_, створення ролей для _external-system_ рілма + +|Підсистема моделювання регламенту реєстру +|*registry-regulations-сli* +|Валідація нового файлу реєстру (або вимкнення існуючих валідацій для проходження пайплайну публікації) +|=== + +== Міграція + +* Додати до існуючих реєстрів _/roles/external-system.yml_ + +[source, yaml] +---- +roles: [] +---- + +* Тригернути пайплайн публікації зміною файлу _/bp-trembita/external-system.yml_ + +== Підтримка зворотної сумісності + +Усі існуючі ендпоінти, ролі, папки в регламенті залишаються валідними + +== Високорівневий план розробки + +=== Технічні експертизи + +* _BE_ +* _DevOps_ + +=== Попередній план розробки + +. xref:_необхідні_зміни_для_переносу_створення_soap_ендпоінтів_до_service_generation_utility[зміни], необхідні для пересення генерації та деплою _bp-webservice-gateway_ до пайплайну публікації +. Розширення регламенту створенням ролей для зовнішніх систем +. Розробка міграційних апгрейд-скриптів +. Інструкція розмежування доступу до API БП на рівні Трембіти (можливо, перевикористати інструкцію для розмежування доступу для критеріїв пошуку) +. Інструкція розмежування доступу до API БП без Трембіти diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/external-integrations/overview.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/external-integrations/overview.adoc index c853308e83..0ca63e0403 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/external-integrations/overview.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/external-integrations/overview.adoc @@ -1,4 +1,7 @@ = Підсистема зовнішніх інтеграцій +include::ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] + +include::ROOT:partial$admonitions/language-ua.adoc[] == Загальний опис @@ -47,10 +50,10 @@ _Реєстр споживач даних_ - реєстр якому було н Окрім подій xref:arch:architecture/registry/operational/registry-management/overview.adoc#_аудит_та_журналювання_подій[підсистеми управління даними реєстру] фіксуються додатково наступні події: |=== -|Тип події|Службова назва|Опис +|Тип події|Спосіб фіксації|Службова назва|Опис -|_USER_EVENT_|SOAP request. Method: ${methodName}|Запит на читання даних з фіксацією конкретного методу. -|_USER_EVENT_|EXCEPTION|Помилка отримання даних. +|_USER_EVENT_|До та після події|SOAP request. Method: ${methodName}|Запит на читання даних з фіксацією конкретного методу. +|_USER_EVENT_|Під час виникнення|EXCEPTION|Помилка отримання даних. |=== [NOTE] @@ -67,7 +70,9 @@ xref:arch:architecture/registry/operational/audit/overview.adoc[за посил |_API-шлюз для викликів БП зовнішніми системами_ |`bp-webservice-gateway` |origin -| https://github.com/epam/edp-ddm-bp-webservice-gateway[github:/epam/edp-ddm-bp-webservice-gateway] +a|https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/data-architecture/libraries/bp-webservice-gateway-core-image[gerrit:/bp-webservice-gateway-core-image] + +https://github.com/epam/edp-ddm-service-generation-utility[github:/epam/edp-ddm-service-generation-utility] |Шлюз надання доступу для виклику бізнес процесів сторонніми системами через _ШБО Трембіта_ та напряму через _Підсистему управління зовнішнім трафіком_. diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/external-integrations/trembita/authz.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/external-integrations/trembita/authz.adoc index 8843d13a5e..52e1fa6dd7 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/external-integrations/trembita/authz.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/external-integrations/trembita/authz.adoc @@ -1,4 +1,5 @@ = Розмежування прав доступу до бізнес-процесів для зовнішніх клієнтів +include::ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] Даний документ розширює загальний xref:architecture/registry/operational/external-integrations/trembita/consumers.adoc[дизайн по роботі з зовнішніми клієнтами] в контексті автентифікації diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/external-integrations/trembita/camunda-connectors.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/external-integrations/trembita/camunda-connectors.adoc index b8e7d27a1b..bfae0662e0 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/external-integrations/trembita/camunda-connectors.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/external-integrations/trembita/camunda-connectors.adoc @@ -1,4 +1,5 @@ = Дизайн моделювання зовнішніх інтеграційних розширень на інші реєстри +include::ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] == Призначення При моделюванні та виконанні бізнес-процесів необхідно мати можливість читати дані з зовнішніх реєстрів через інтеграцію з системою електронної взаємодії державних електронних інформаційних ресурсів "Трембіта". diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/external-integrations/trembita/consumers.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/external-integrations/trembita/consumers.adoc index 03137ac43c..f7c3cdf39b 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/external-integrations/trembita/consumers.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/external-integrations/trembita/consumers.adoc @@ -1,4 +1,5 @@ = Керування зовнішніми клієнтами в системі +include::ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] == Базові принципи * Зовнішні системи мають можливість інтегруватись з платформою через ШБО Трембіта diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/external-integrations/trembita/external-invocation.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/external-integrations/trembita/external-invocation.adoc index 064e55b7ce..a2b47549f5 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/external-integrations/trembita/external-invocation.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/external-integrations/trembita/external-invocation.adoc @@ -1,4 +1,5 @@ = Дизайн обробки запитів на ініціювання бізнес-процесів зовнішніми системами через Трембіту +include::ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] == Призначення Зовнішні системи повинні мати можливість ініціювати бізнес-процес через Трембіту. diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/external-integrations/trembita/service-registration.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/external-integrations/trembita/service-registration.adoc index 672ee1fa80..d5665ece7c 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/external-integrations/trembita/service-registration.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/external-integrations/trembita/service-registration.adoc @@ -1,4 +1,6 @@ = Реєстрація SOAP-сервісу в системі Трембіта +include::ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] + 1) Відкрити інтерфейс адміністрування сервісу безпеки, далі обираємо клієнта та відкриваємо його soap сервіси: image::architecture/registry/operational/external-integrations/trembita/service-registration/step1.png[] diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/geo/geoserver-rls.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/geo/geoserver-rls.adoc index ff4888d5d5..64b76c3b39 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/geo/geoserver-rls.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/geo/geoserver-rls.adoc @@ -1,4 +1,7 @@ = Застосування правил RLS до модуля ГІС +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Загальний опис diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/geo/gis.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/geo/gis.adoc index c915f60133..2427b47d1d 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/geo/gis.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/geo/gis.adoc @@ -1,4 +1,7 @@ = Модуль ГІС +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Загальні вимоги diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/geo/overview.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/geo/overview.adoc index b9eda57f3b..430d2238c8 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/geo/overview.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/geo/overview.adoc @@ -1,5 +1,4 @@ = Підсистема управління геоданими - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/messaging/overview.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/messaging/overview.adoc index 2828d1364d..828e5f13b6 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/messaging/overview.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/messaging/overview.adoc @@ -1,5 +1,4 @@ = Підсистема асинхронного обміну повідомленнями - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] @@ -66,6 +65,21 @@ _Підсистема асинхронного обміну повідомлен |`strimzi-drain-cleaner` |3rd-party |Бере на себе управління поетапним оновленням під час процесу переносу подів Kafka кластеру між вузлами кластера OpenShift, забезпечуючи переміщення відповідних подів Kafka по одному зі збереженням бажаного рівня реплікації та доступності. + +|Реєстрова конфігурація Kafka +|Реєстр +|— +|origin +|https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/devops/operators/kafka-operator[gerrit:/mdtu-ddm/devops/operators/kafka-operator] +|Налаштовує реєстровий екземпляр Kafka + +|Платформна конфігурація Kafka +|kafka-operator +|— +|origin +|https://github.com/epam/edp-ddm-cluster-kafka-operator[github:/epam/edp-ddm-cluster-kafka-operator] +|Налаштовує Платформний екземпляр Kafka + |=== == Технологічний стек @@ -114,4 +128,4 @@ _Підсистема асинхронного обміну повідомлен === _Reliability_ Kafka забезпечує надійну доставку повідомлень, зберігаючи їх на диску та реплікуючи на кілька брокерів. Це дозволяє уникнути втрати даних навіть при відмовах окремих компонентів системи. -xref:architecture/platform/operational/backup-recovery/overview.adoc[Підсистема резервного копіювання та відновлення] включає у себе резервне копіювання файлових систем брокерів Kafka. \ No newline at end of file +xref:architecture/platform/operational/backup-recovery/overview.adoc[Підсистема резервного копіювання та відновлення] включає у себе резервне копіювання файлових систем брокерів Kafka. diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/nonrelational-data-storage/overview.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/nonrelational-data-storage/overview.adoc index da7460c674..367cd87f6c 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/nonrelational-data-storage/overview.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/nonrelational-data-storage/overview.adoc @@ -1,5 +1,4 @@ = Підсистема управління нереляційними базами даних - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] @@ -52,8 +51,8 @@ _Redis Sentinel_ надає наступні можливості: | _Сервіс Sentinel_ |`rfs-redis-sentinel` |3rd-party -|https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/infrastructure/redis-sentinel[gerrit:/mdtu-ddm/infrastructure/redis-sentinel] -|Керування високою доступністю та автоматичним переключенням між серверами Redis +|https://github.com/epam/edp-ddm-redis-sentinel[github:/epam/edp-ddm-redis-sentinel] +|Керування високою доступністю та автоматичним перемиканням між серверами Redis | _Key-value сховище Redis_ |`rfr-redis-sentinel` diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/notifications/diia-notifications-api.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/notifications/diia-notifications-api.adoc index 1b083f1995..4ba0a38ef2 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/notifications/diia-notifications-api.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/notifications/diia-notifications-api.adoc @@ -1,4 +1,5 @@ = API відправки push-нотифікацій у мобільний додаток "Дія" +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] Платформа "_Дія_" надає авторизованим партнерам окремий _REST API_ для відправки _push_-нотифікацій користувачам у мобільний застосунок. Наразі підтримуються наступні сценарії: diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/notifications/notification-service-design.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/notifications/notification-service-design.adoc index a6c122a0b0..98c7e991e1 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/notifications/notification-service-design.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/notifications/notification-service-design.adoc @@ -1,5 +1,4 @@ = Сервіс повідомлень користувачів - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/notifications/notifications-api.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/notifications/notifications-api.adoc index aa6af123ae..d67fb78c19 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/notifications/notifications-api.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/notifications/notifications-api.adoc @@ -1,5 +1,4 @@ = API управління повідомленнями - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::ROOT:partial$admonitions/language-ua.adoc[] diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/notifications/notifications-audit.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/notifications/notifications-audit.adoc index 9c22d9e736..706cdc80c2 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/notifications/notifications-audit.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/notifications/notifications-audit.adoc @@ -1,5 +1,4 @@ = Аудит та журналювання подій - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/notifications/notifications-database-schema.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/notifications/notifications-database-schema.adoc index e577589639..b6f78ccf9b 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/notifications/notifications-database-schema.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/notifications/notifications-database-schema.adoc @@ -1,5 +1,4 @@ = Фізична модель збереження зберігання даних - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::ROOT:partial$admonitions/language-ua.adoc[] diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/notifications/notifications-db.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/notifications/notifications-db.adoc index c0d0084ef1..56b52d08a6 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/notifications/notifications-db.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/notifications/notifications-db.adoc @@ -1,5 +1,4 @@ = Операційна БД нотифікацій - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/notifications/notifications-design.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/notifications/notifications-design.adoc index 51a8061ec3..3d3773a86c 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/notifications/notifications-design.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/notifications/notifications-design.adoc @@ -1,5 +1,4 @@ = Технічний дизайн рішення - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] @@ -10,7 +9,7 @@ include::platform:ROOT:partial$admonitions/language-ua.adoc[] image::architecture/registry/operational/notifications/notifications-design.svg[notifications-design,700] -== Задіяні сервіси та їх призначення в рамках дизайну рішення +== Залучені сервіси та їх призначення в рамках дизайну рішення У даному розділі наведено перелік компонент системи, які задіяні або потребують змін/створення в рамках реалізації функціональних вимог згідно технічного дизайну рішення. diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/notifications/notifications-integration.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/notifications/notifications-integration.adoc index 6a407a8ab4..6d5b90b515 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/notifications/notifications-integration.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/notifications/notifications-integration.adoc @@ -1,5 +1,4 @@ = Інтеграція з сервісом повідомлень - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::ROOT:partial$admonitions/language-ua.adoc[] diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/notifications/notifications-migration.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/notifications/notifications-migration.adoc index 041253ced0..c4426dee92 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/notifications/notifications-migration.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/notifications/notifications-migration.adoc @@ -1,5 +1,4 @@ = Оновлення реєстрів - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/notifications/notifications-modelling.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/notifications/notifications-modelling.adoc index 4072d77a04..b3c2592291 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/notifications/notifications-modelling.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/notifications/notifications-modelling.adoc @@ -1,5 +1,4 @@ = Моделювання регламенту - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/notifications/notifications-overview.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/notifications/notifications-overview.adoc index 3a51b1aa4b..80b630be93 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/notifications/notifications-overview.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/notifications/notifications-overview.adoc @@ -1,5 +1,4 @@ = Відправлення повідомлень користувачам - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::ROOT:partial$admonitions/language-ua.adoc[] diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/notifications/overview.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/notifications/overview.adoc index efbcbb2dc4..5592203469 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/notifications/overview.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/notifications/overview.adoc @@ -1,5 +1,4 @@ = Підсистема нотифікацій користувачів - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] @@ -26,9 +25,9 @@ image::arch:architecture/registry/operational/notifications/notifications-subsys Події відправки повідомлень користувачам системою фіксуються у журналі аудиту з повним контекстом. |=== -|Тип події|Службова назва|Опис +|Тип події|Спосіб фіксації|Службова назва|Опис -|_SYSTEM_EVENT_|SEND_USER_NOTIFICATION|Спроба відправки повідомлення з результатом операції +|_SYSTEM_EVENT_|Під час виникнення|SEND_USER_NOTIFICATION|Спроба відправки повідомлення з результатом операції |=== [NOTE] diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/overview.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/overview.adoc index aaae924322..143a8b9602 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/overview.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/overview.adoc @@ -1,12 +1,11 @@ = Операційна зона реєстру - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Загальний опис -_Операційна зона Реєстру_ - це сукупність підсистем, що забезпечують обслуговування кінцевих користувачів реєстру (_надавачів послуг_ та _отримувачів послуг_) та інтеграцію з зовнішніми системами згідно розробленого цифрового регламенту. +_Операційна зона Реєстру_ - це сукупність підсистем, що забезпечують обслуговування кінцевих користувачів реєстру (_надавачів послуг_ та _отримувачів послуг_) та інтеграцію з зовнішніми системами згідно з розробленим цифровим регламентом. [TIP] -- diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/portals/overview.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/portals/overview.adoc index e18d4681fa..853241e549 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/portals/overview.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/portals/overview.adoc @@ -1,5 +1,4 @@ = Підсистема кабінетів користувачів - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/registry-management/ceph-storage.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/registry-management/ceph-storage.adoc index c048daa1d0..efddcd62af 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/registry-management/ceph-storage.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/registry-management/ceph-storage.adoc @@ -1,4 +1,7 @@ = Об'єктне сховище даних +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Загальний опис diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/registry-management/data-provenance.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/registry-management/data-provenance.adoc new file mode 100644 index 0000000000..3913a14a6f --- /dev/null +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/registry-management/data-provenance.adoc @@ -0,0 +1,24 @@ +//:imagesdir: ../../../images += Облік джерел походження даних реєстру + +image::architecture/registry/operational/registry-management/data-provenance.drawio.svg[width=640,float="center",align="center"] + +* **JSON документ форми**: документ який містить дані які були внесені та підписані на формі бізнес-процесу. Бізнес-процес що змінює дані може бути як користувацьким так і автоматичним. В разі якщо зміна відбулась в результаті роботи користувацького бізнес-процесу, дані підписує користувач своїм КЕП та цей підпис зберігається в документі. В разі якщо дані міняє автоматичний бізнес-процес то ці дані підписуються системним підписом який так само зберігається в документі. +* **JSON документ API**: похідний від _JSON документу форми_ документ, дані в якому відповідають контракту API підсистеми управління даними реєстру. Створюється автоматично в результаті трансформації структури даних з _JSON документу форми_ в формат сумісний з API. Один _JSON документу форми_ може породити декілька _JSON документів API_ вразі якщо на формі було внесено інформацію яка зберігається в декількох таблицях. Всі дані в цьому документі підписано системним підписом. +* **Первинне завантаження**: частина регламенту реєстру яка містить дані та правила для первинного завантаження. Зберігаються як файли в герріт репозиторії регламенту реєстру, який зберігає інформацію про користувача який створив або змінив ці файли. +* **Історія запису таблиці реєстру**: запис який створюється при кожній зміні даних реєстру. В ній зберігається стан запису реєстру на момент зміни. Також вона містить посилання на процес який зробив цю зміну, це може бути або бізнес-процес, або процес первинного завантаження. В разі якщо зміна відбулася в результаті роботи бізнес процесу зберігається посилання на бізнес-процес, _JSON документ форми_ та _JSON документ API_. В разі якщо зміна відбулася в результаті роботи первинного завантаження, зберігається лише інформація про те що джерело даних initial load (первинне завантаження). +* **Запис таблиці реєстру**: запис в якому зберігається актуальний стан запису реєстру. +* **Файли**: вкладені цифрові документи реєстру (файли). Посилання на ці файли разом з контрольною сумою є частиною даних реєстру, які підписуються згідно з описаними вище правилами. + +== Інформація про походження в залежності від джерела + +[cols="h,^.^,^.^,^.^"] +|=== +| |Користувацький бізнес-процес|Автоматичний бізнес-процес|Первинне завантаження + +|Документ джерело|✓|✓|✓ +|Інформація про автора|✓|✓|✓ +|Документ підписано системою|✓|✓|✕ +|Документ підписано користувачем|✓|✕|✕ + +|=== \ No newline at end of file diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/registry-management/file-upload.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/registry-management/file-upload.adoc index fd6091370d..5d0f4b204a 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/registry-management/file-upload.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/registry-management/file-upload.adoc @@ -1,4 +1,7 @@ = Завантаження файлів +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Контекст @@ -6,7 +9,7 @@ image::architecture/registry/operational/registry-management/file-upload.drawio. Збереження файлів в Дата Фабриці відбувається за принципом id reference де безпосередньо файл зберігається в "бакеті" Ceph, а ключ файлу і його контрольна сума в реляційній БД реєстру. -== Взаємодія з Low-Code +== Взаємодія з Low Code Читання та повернення файлів в систему Low-Code відбувається за рахунок читання або запису файлу в доступний для Low-Code "бакет" Ceph. diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/registry-management/modify-bulk-load.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/registry-management/modify-bulk-load.adoc index d630f47692..b691164928 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/registry-management/modify-bulk-load.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/registry-management/modify-bulk-load.adoc @@ -1,5 +1,4 @@ -= Зміна налаштувань поведінки API які вказуються на рівні структури створення таблиці - += Зміна налаштувань поведінки API, які вказуються на рівні структури створення таблиці include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/registry-management/overview.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/registry-management/overview.adoc index 6e71f3d301..56e4f9e257 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/registry-management/overview.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/registry-management/overview.adoc @@ -1,5 +1,7 @@ -//:imagesdir: ../../../../../images = Підсистема управління даними реєстру +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Загальний опис @@ -24,32 +26,32 @@ image::architecture/registry/operational/registry-management/registry-management Події маніпуляцій з даними реєстру фіксуються у журналі аудиту з повним контекстом. |=== -|Тип події|Службова назва|Опис +|Тип події|Спосіб фіксації|Службова назва|Опис // REST API Service -|USER_ACTION|SEARCH ENTITY|Надходження запиту про пошук даних до _Сервіс синхронного управління даними реєстру_ -|USER_ACTION|SEARCH|Надходження запиту про пошук даних до _Сервіс синхронного управління даними реєстру_ -|USER_ACTION|READ ENTITY|Надходження запиту про отримання даних за ідентифікатором до _Сервіс синхронного управління даними реєстру_ -|USER_ACTION|UPDATE ENTITY|Надходження запиту про внесення змін до _Сервіс синхронного управління даними реєстру_ -|USER_ACTION|UPSERT ENTITY|Надходження запиту про внесення створення або зміну сутності до _Сервіс синхронного управління даними реєстру_ -|USER_ACTION|DELETE ENTITY|Надходження запиту про видалення запису до _Сервіс синхронного управління даними реєстру_ -|USER_ACTION|SELECT FROM TABLE|Операція пошуку даних в БД +|USER_ACTION|До та після події|SEARCH ENTITY|Надходження запиту про пошук даних до _Сервіс синхронного управління даними реєстру_ +|USER_ACTION|До та після події|SEARCH|Надходження запиту про пошук даних до _Сервіс синхронного управління даними реєстру_ +|USER_ACTION|До та після події|READ ENTITY|Надходження запиту про отримання даних за ідентифікатором до _Сервіс синхронного управління даними реєстру_ +|USER_ACTION|До та після події|UPDATE ENTITY|Надходження запиту про внесення змін до _Сервіс синхронного управління даними реєстру_ +|USER_ACTION|До та після події|UPSERT ENTITY|Надходження запиту про внесення створення або зміну сутності до _Сервіс синхронного управління даними реєстру_ +|USER_ACTION|До та після події|DELETE ENTITY|Надходження запиту про видалення запису до _Сервіс синхронного управління даними реєстру_ +|USER_ACTION|До та після події|SELECT FROM TABLE|Операція пошуку даних в БД // Kafka API Service -|USER_ACTION|KAFKA_REQUEST_UPDATE|Надходження запиту про внесення змін до _Сервіс асинхронного управління даними реєстру_ -|USER_ACTION|KAFKA REQUEST CREATE|Надходження запиту про створення нового запису до _Сервіс асинхронного управління даними реєстру_ -|USER_ACTION|KAFKA REQUEST DELETE|Надходження запиту про видалення запису до _Сервіс асинхронного управління даними реєстру_ -|USER_ACTION|UPDATE TABLE|Операція внесення змін в БД -|USER_ACTION|DELETE FROM TABLE|Операція видалення запису з БД -|USER_ACTION|INSERT INTO TABLE|Операція створення нового запису до БД -|USER_ACTION|CONSTRAINT ERROR|Збереження або зміна даних порушують наявні обмеження БД -|USER_ACTION|CLIENT ERROR|Клієнтська помилка при синхронному запиті -|USER_ACTION|RUNTIME ERROR|Помилка в процесі опрацювання запита -|USER_ACTION|INVALID_HEADER_VALUE|Недопустиме значення заголовків синхронного запиту -|USER_ACTION|HEADERS_ARE_MISSING|Один або декілько обов'язкових заголовків відсутні -|USER_ACTION|LIST_SIZE_VALIDATION_ERROR|Кількість елементів для завантаження перевищено -|USER_ACTION|VALIDATION_ERROR|Помилка вхідних даних при синхронному запиті -|USER_ACTION|PROCEDURE_ERROR|Помилка виклику процедури -|USER_ACTION|THIRD_PARTY_SERVICE_UNAVAILABLE|При опрацюванні запитів одна з систем Платформи не була доступна -|USER_ACTION|NOT_FOUND|При пошуку сутності по ідентифікатору, сутність не було знайдено. +|USER_ACTION|До та після події|KAFKA_REQUEST_UPDATE|Надходження запиту про внесення змін до _Сервіс асинхронного управління даними реєстру_ +|USER_ACTION|До та після події|KAFKA REQUEST CREATE|Надходження запиту про створення нового запису до _Сервіс асинхронного управління даними реєстру_ +|USER_ACTION|До та після події|KAFKA REQUEST DELETE|Надходження запиту про видалення запису до _Сервіс асинхронного управління даними реєстру_ +|USER_ACTION|До та після події|UPDATE TABLE|Операція внесення змін в БД +|USER_ACTION|До та після події|DELETE FROM TABLE|Операція видалення запису з БД +|USER_ACTION|До та після події|INSERT INTO TABLE|Операція створення нового запису до БД +|USER_ACTION|Під час виникнення|CONSTRAINT ERROR|Збереження або зміна даних порушують наявні обмеження БД +|USER_ACTION|Під час виникнення|CLIENT ERROR|Клієнтська помилка при синхронному запиті +|USER_ACTION|Під час виникнення|RUNTIME ERROR|Помилка в процесі опрацювання запита +|USER_ACTION|Під час виникнення|INVALID_HEADER_VALUE|Недопустиме значення заголовків синхронного запиту +|USER_ACTION|Під час виникнення|HEADERS_ARE_MISSING|Один або декілько обов'язкових заголовків відсутні +|USER_ACTION|Під час виникнення|LIST_SIZE_VALIDATION_ERROR|Кількість елементів для завантаження перевищено +|USER_ACTION|Під час виникнення|VALIDATION_ERROR|Помилка вхідних даних при синхронному запиті +|USER_ACTION|Під час виникнення|PROCEDURE_ERROR|Помилка виклику процедури +|USER_ACTION|Під час виникнення|THIRD_PARTY_SERVICE_UNAVAILABLE|При опрацюванні запитів одна з систем Платформи не була доступна +|USER_ACTION|Під час виникнення|NOT_FOUND|При пошуку сутності по ідентифікатору, сутність не було знайдено. |=== @@ -149,4 +151,29 @@ _Підсистема управління даними реєстру_ фікс === _Security_ -В _Підсистемі управління даними реєстру_ всі запити до сервісів які безпосередньо здійснюють операції над даними реєстру вимагають автентифікацію. Сервіси підсистеми доступні лише у внутрішній мережі реєстру. \ No newline at end of file +// В _Підсистемі управління даними реєстру_ всі запити до сервісів які безпосередньо здійснюють операції над даними реєстру вимагають автентифікацію. Сервіси підсистеми доступні лише у внутрішній мережі реєстру. + +Автентифікація запитів відбувається на рівні KeyCloak xref:arch:architecture/platform/operational/user-management/overview.adoc[підсистемою управління користувачами та ролями]. + +Механізм авторизації включає в себе розмежування прав xref:arch:architecture/registry/operational/registry-management/rbac.adoc#_процес_перевірки_рівня_доступу[доступу до даних на основі ролей (RBAC)]. + +За втілення підходу найменший привілеїв відповідає адміністратор реєстру який повинен налаштувати таблиця ролей відповідним чином після створення регламенту реєстру. Процес зміни прав доступу описаний у xref:arch:architecture/registry/operational/registry-management/rbac.adoc#_процес_зміни_прав_доступу[статі]. + +Задля забезпечення стійкості системи та запобігання зловживанню сервісами підсистема надає xref:arch:architecture/registry/operational/registry-management/platform-evolution/public-api/public-api.adoc[механізм керування рейт лімітами для публічного REST API]. Встановлення рейт лімітів може обмежити зловмисне або неправомірне використання сервісів, наприклад, запобігаючи автоматизованому збору даних (web scraping) або спаму, брутфорс, сканування на вразливості, зменшення навантаження та DDoS. + +Підсистема являється учасником Service Mesh та відповідно усі мережеві взаємодії контролюються _Підсистемою управління міжсервісною взаємодією_. На іншому рівні мережеве спілкування з підсистемою також контролюється мережевими політиками Openshift. + +Дані під час внутрішньої комунікації на рівні платформи а також з зовнішніми системами через REST API захищені надійним шифруванням каналу звязку яке використовує надійний протокол TLS 1.2. Підсистема не зберігає дані а лише оброблює їх відповідно шифрування при зберігання не використовується. + +Компоненти підсистеми підлягають моніторингу та логуванню згідно вимог безпеки. + +_Підсистема журналювання подій аудиту_ зберігає події доступу до та модифікації даних. Події аудиту місять інформацію про користувача, який ініціював подію, або про систему, з якої було здійснено запит. Події аудиту забезпечують достатній рівень деталізації з яких можна зрозуміти що відбувалося в системі включно з результатами виконання запитів або відповіді від систем. + +Для забезпечення характеристики невід’ємності події аудиту логують результат виконання дії з повним контекстом тож існує достатньо доказів того, що певна подія відбулася, і заперечити це неможливо. + +[TIP] +-- +Детальніше з принципами _безпечного_ дизайну можна ознайомитись у відповідних розділах: + +* xref:arch:architecture/security/secure-design-principles.adoc[] +-- \ No newline at end of file diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/registry-management/personal-data.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/registry-management/personal-data.adoc index 801eb8e8d7..8ee21e5891 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/registry-management/personal-data.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/registry-management/personal-data.adoc @@ -1,4 +1,5 @@ = Персональні та чутливі дані +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] [IMPORTANT] -- diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/registry-management/platform-evolution/async-load/async-load.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/registry-management/platform-evolution/async-load/async-load.adoc index 02526010b1..bf845d7961 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/registry-management/platform-evolution/async-load/async-load.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/registry-management/platform-evolution/async-load/async-load.adoc @@ -1,4 +1,7 @@ = Асинхронне завантаження даних +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Загальний опис diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/registry-management/platform-evolution/public-api/public-api.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/registry-management/platform-evolution/public-api/public-api.adoc index d684cc2b49..8f5ff6e8d2 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/registry-management/platform-evolution/public-api/public-api.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/registry-management/platform-evolution/public-api/public-api.adoc @@ -1,4 +1,7 @@ = Публічний API та рейт-ліміти на читання даних реєстру +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Загальний опис diff --git a/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/rest-file-transfer/rest-file-transfer.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/registry-management/platform-evolution/rest-file-transfer/rest-file-transfer.adoc similarity index 88% rename from docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/rest-file-transfer/rest-file-transfer.adoc rename to docs/ua/modules/arch/pages/architecture/registry/operational/registry-management/platform-evolution/rest-file-transfer/rest-file-transfer.adoc index f742d54b37..172fcc22f8 100644 --- a/docs/ua/modules/arch/pages/architecture-workspace/platform-evolution/rest-file-transfer/rest-file-transfer.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/registry-management/platform-evolution/rest-file-transfer/rest-file-transfer.adoc @@ -2,11 +2,6 @@ = Доступ до контенту файлів реєстру через зовнішні API -[IMPORTANT] --- -Сторінка технічної документації є баченням майбутньої реалізації, актуальність якого може бути застарілою. --- - == Загальний опис У цій статті буде розглянута реалізація можливості віддавати контент файлів збережених у реєстрі через зовнішні API. Наразі ця можливість відсутня і контент файлів можливо отримати тільки з бізнес процесу який є частиною реєстру в якому зберігається файл. @@ -164,6 +159,19 @@ Content-Disposition: attachment; filename="petro_passport.pdf" ... (binary PDF data) ---- +==== Виставлення точок інтеграції які повертають файли для публічного доступу + +У випадку з наданням доступу до публічних даних, передбачено надання доступу до індивідуальних ресурсів з встановленням лімітів. +Оскільки доступ надається індивідуально то в загальному вигляді заборонено використання _wildcard_ `*` у шляхах. Разом з тим для файлів у відповідності до найкращих практик побудови _REST API_ використовується _path_variable_, тому передбачено окремий тип точок інтеграції який дозволяє використовувати _wildcard_ але строго в заздалегіть визначеному шаблоні. + +[source, httprequest] +---- +GET /api/data-factory/files/${tableName}/*/${column}/* +---- + +.Інтерфейс для надання публічного доступу до файлів +image::architecture/registry/operational/registry-management/platform-evolution/rest-file-transfer/control-plane-public-files.png[] + == Високорівневий план розробки === Технічні експертизи diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/registry-management/platform-evolution/sc-post-migration/sc-post-migration.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/registry-management/platform-evolution/sc-post-migration/sc-post-migration.adoc index c7fa75dfbc..e59e883176 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/registry-management/platform-evolution/sc-post-migration/sc-post-migration.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/registry-management/platform-evolution/sc-post-migration/sc-post-migration.adoc @@ -1,5 +1,4 @@ = Додавання генерації POST-методів для пошуку даних - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/registry-management/rbac.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/registry-management/rbac.adoc index 6929d77711..b3a869cd3a 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/registry-management/rbac.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/registry-management/rbac.adoc @@ -1,4 +1,5 @@ = Розмежування прав доступу до даних, RBAC +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] == Опис рішення //[%collapsible] diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/registry-management/registry-db.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/registry-management/registry-db.adoc index 179a5fbd0c..e387b92cc1 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/registry-management/registry-db.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/registry-management/registry-db.adoc @@ -1,4 +1,7 @@ = Операційна БД реєстру +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Загальний опис diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/registry-management/sc-pagination-count.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/registry-management/sc-pagination-count.adoc index 902547ef00..64c970a2ba 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/registry-management/sc-pagination-count.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/registry-management/sc-pagination-count.adoc @@ -1,5 +1,4 @@ = Повернення інформації про загальну кількість записів при пагінації критеріїв пошуку - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/registry-management/versioning.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/registry-management/versioning.adoc index bc8d32f2b9..db9b94b4b1 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/registry-management/versioning.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/registry-management/versioning.adoc @@ -1,6 +1,7 @@ -== Версіонування дата фабрики += Версіонування дата фабрики +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] -=== Структура версій +== Структура версій Версія складається з трьох розрядів 1 - нова версія платформи + @@ -14,7 +15,7 @@ Оскільки для Дата Фабрики значушими є тільки перші два розряди то в середині фабрики для версіонування використовуються тільки вони -=== Версіонування репозиторіїв +== Версіонування репозиторіїв Для забезпечення відслідковування змін/еволюції регламентів кожна критична зміна зберігається в окремому репозиторії з суфіксом версії. Всі три компоненти мають бути узгоджені - використовувати ту саму версію. Приклад: @@ -29,11 +30,11 @@ labaratory-kafka-api-1.1 labaratory-model-1.1 ---- -=== Версіонування артифактів +== Версіонування артефактів Всі артіфакти після компіляції відправляються в nexus. Версіонування відбувається в рамках group id та artifact id. В image registry артіфакти викоритовують той самий image stream. -=== Версіонування БД +== Версіонування БД Об'єкти які не містять дані такі як searchCondition перестворюються. Таблиці з даними мігруються відповідними інструментами liquibase Для зміни дата вмістних структур дозволяється додавання колонок до існуючих таблиць. У такому випадку операційна таблиця буде змінена. Поточна історична таблиця буде збережена з вказанням версії регламенту, а для нової версії буде створена нова історична таблиця до якої буде зкопійовано останні записи пов'язані з усіма існуючими записами операційної таблиці. Данна міграція відбувається на рівні БД. @@ -58,7 +59,7 @@ WARNING: Новостворена історична таблиця має мі При необхідності видалення колонки з таблиці маює бути створена нова таблиця без відповідної колонки, а дані повторно завантажені -Переіменування колонок або таблиць - заборонено оскільки унеможливлює подальшу підтримку походження даних і не має практичного застосування. +Перейменування колонок або таблиць - заборонено оскільки унеможливлює подальшу підтримку походження даних і не має практичного застосування. Модифікація типів та накладання додаткових constrains можливе якщо не вимагає модифікацію даних при цьому. @@ -72,7 +73,7 @@ WARNING: Новостворена історична таблиця має мі tableName="laboratory"/> ---- -=== Версіонування черг +== Версіонування черг Для відслідковування версійності черг та структур даних які були асоційовані з даною версією черг до назви черг має додаватись перші два розряди Приклад: @@ -86,7 +87,7 @@ create-labaratory-1.1-inbound create-labaratory-1.1-outbound ---- -=== Версіонування cервісів розгортання (Deployments) +== Версіонування сервісів розгортання (Deployments) Розгорнутим в реєстрі одночасно може бути тільки одна версія окремого регламенту. Для забезпечення версіонування та змін регламенту кожна наступна версія розгортається як Helm chart з новою версією контейнера (image). Версія також проставляється в якості додаткового ярлика (label) в кожному ресурсі K8s що створюється за допомогою цього Helm chart. diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/relational-data-storage/databases.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/relational-data-storage/databases.adoc index 8c52fe21f9..d3af59647a 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/relational-data-storage/databases.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/relational-data-storage/databases.adoc @@ -1,5 +1,4 @@ = Бази даних - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/relational-data-storage/db-roles.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/relational-data-storage/db-roles.adoc index 316762f928..c40546de0e 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/relational-data-storage/db-roles.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/relational-data-storage/db-roles.adoc @@ -1,5 +1,4 @@ = Користувачі бази даних реєстру та їх привілеї - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/relational-data-storage/overview.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/relational-data-storage/overview.adoc index abe96dde35..866643785a 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/relational-data-storage/overview.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/relational-data-storage/overview.adoc @@ -1,5 +1,4 @@ = Підсистема управління реляційними базами даних - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] @@ -76,7 +75,7 @@ NOTE: На розгорнутому оточенні імена ресурсів |`operational` + `operational-pool` |3rd-party -.4+|https://github.com/epam/edp-ddm-registry-postgres[github:/epam/edp-ddm-registry-postgres] +.3+|https://github.com/epam/edp-ddm-registry-postgres[github:/epam/edp-ddm-registry-postgres] |Екземпляр СКБД що обробляє операційні запити сервісів. Містить операційні бази сервісів та операційну базу реєстру. |_Аналітичний екземпляр СКБД_ @@ -93,6 +92,7 @@ NOTE: На розгорнутому оточенні імена ресурсів |`pgo` + `pgo-upgrade` |3rd-party +|https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/devops/operators/postgres-operator[gerrit:/mdtu-ddm/devops/operators/postgres-operator] |Відповідальний за розгортання та конфігурацію екземплярів кластерів _PostgreSQL_ |=== diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/relational-data-storage/rdbms-analytical-workload.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/relational-data-storage/rdbms-analytical-workload.adoc index 473981e46f..0b39304092 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/relational-data-storage/rdbms-analytical-workload.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/relational-data-storage/rdbms-analytical-workload.adoc @@ -1,5 +1,4 @@ = Обробка аналітичних запитів - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/relational-data-storage/rdbms-backup-recovery.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/relational-data-storage/rdbms-backup-recovery.adoc index 7f32843996..0e711f4585 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/relational-data-storage/rdbms-backup-recovery.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/relational-data-storage/rdbms-backup-recovery.adoc @@ -1,5 +1,4 @@ = Резервне копіювання та відновлення - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/relational-data-storage/rdbms-gis.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/relational-data-storage/rdbms-gis.adoc index 53818d69e6..ef9994a00a 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/relational-data-storage/rdbms-gis.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/relational-data-storage/rdbms-gis.adoc @@ -1,5 +1,4 @@ = Географічні об'єкти та геолокаційні запити - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/relational-data-storage/rdbms-horizontal-scaling.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/relational-data-storage/rdbms-horizontal-scaling.adoc index 2774b87659..f3b2150745 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/relational-data-storage/rdbms-horizontal-scaling.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/relational-data-storage/rdbms-horizontal-scaling.adoc @@ -1,5 +1,4 @@ = Горизонтальне масштабування - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/relational-data-storage/rdbms-user-schema-management.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/relational-data-storage/rdbms-user-schema-management.adoc index 635df5e427..5814f1ba85 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/relational-data-storage/rdbms-user-schema-management.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/relational-data-storage/rdbms-user-schema-management.adoc @@ -1,5 +1,4 @@ = Керування користувачами та схемами БД - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/reporting/kong-redash.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/reporting/kong-redash.adoc index 83ebaf04e1..fbf8d9a9d5 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/reporting/kong-redash.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/reporting/kong-redash.adoc @@ -1,5 +1,4 @@ -= Розміщення сервіса публікування аналітичної звітності Redash за Kong - += Розміщення сервісу публікування аналітичної звітності Redash за Kong include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] @@ -9,10 +8,10 @@ include::platform:ROOT:partial$admonitions/language-ua.adoc[] В поточній версії Платформи публічний доступ до Redash відбувається через OpenShift HAProxy. Це спричиняє дві проблеми: * Потенційна вразливіть сервіса публікування Redash, коли він розміщений поза виокремленого API шлюзу для зовнішнього трафіку -* При налаштуванні власного xref:admin:registry-management/control-plane-custom-dns.adoc[DNS-імені для Кабінетів] +* При налаштуванні власного xref:admin:registry-management/custom-dns/cp-custom-dns-portals.adoc[DNS-імені для Кабінетів] зʼявляється потреба в налаштуванні також і окремого імені для сервіса публікування аналітичної звітності Redash. -Внесення Redash за Kong вирішить ці проблеми. +Внесення Redash за Kong розв'яже ці проблеми. == Ролі користувачів diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/reporting/overview.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/reporting/overview.adoc index 429880a817..f5ffc6c80b 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/reporting/overview.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/reporting/overview.adoc @@ -1,5 +1,4 @@ = Підсистема аналітичної звітності реєстру - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] @@ -55,9 +54,8 @@ image::architecture/registry/operational/reporting/reporting.drawio.svg[float="c | _Redash Server_ |`redash-viewer` | 3rd-party -.7+a|https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/data-architecture/application/redash[gerrit:/mdtu-ddm/data-architecture/application/redash] - -https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/data-architecture/devops-application/redash-chart[gerrit:/mdtu-ddm/data-architecture/devops-application/redash-chart] +.7+a| * https://github.com/epam/edp-ddm-redash-chart[github:/epam/edp-ddm-redash-chart] +* https://github.com/epam/edp-ddm-redash[github:/epam/edp-ddm-redash] | Надання користувацького Web UI та адміністративного API | _Redash Worker_ diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/secret-management/overview.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/secret-management/overview.adoc index 8d69f45244..e4337158c8 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/secret-management/overview.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/secret-management/overview.adoc @@ -1,5 +1,4 @@ = Підсистема управління секретами та шифруванням - include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] @@ -26,7 +25,7 @@ image::architecture/registry/operational/secret-management/secret-and-cipher-man |_Сервіс управління секретами та шифруванням_ |`hashicorp-vault` |3rd-party -|https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/admin/repos/mdtu-ddm/devops/hashicorp-vault[gerrit:/mdtu-ddm/devops/hashicorp-vault] +|https://github.com/epam/edp-ddm-hashicorp-vault[github:/epam/edp-ddm-hashicorp-vault] |Безпечне зберігання ключів шифрування для використання іншими підсистемами для підтримки процесів шифрування та дешифрування даних |_Сервіс синхронізації секретів із платформної підсистеми управління секретами в OpenShift_ @@ -45,7 +44,7 @@ image::architecture/registry/operational/secret-management/secret-and-cipher-man == Технологічний стек -При проектуванні та розробці підсистеми, були використані наступні технології: +При проєктуванні та розробці підсистеми, були використані наступні технології: * xref:arch:architecture/platform-technologies.adoc#vault[HashiCorp Vault] * xref:arch:architecture/platform-technologies.adoc#reloader[Reloader] @@ -60,8 +59,8 @@ image::architecture/registry/operational/secret-management/secret-and-cipher-man Підсистема записує детальну інформацію про спроби аутентифікації, отримання секретів та інші операції, що дозволяє дотримуватися вимог відповідності. -Також, підсистема управління користувачами та ролями підтримує журналювання вхідних запитів та збір метрик продуктивності -для подальшого аналізу через веб-інтерфейси відповідних підсистем Платформи. +Також, підсистема підтримує журналювання вхідних запитів та збір метрик продуктивності +для подальшого аналізу через вебінтерфейси відповідних підсистем Платформи. [TIP] -- diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/user-settings/overview.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/user-settings/overview.adoc index 18dd1fcc20..3ff5007036 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/user-settings/overview.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/user-settings/overview.adoc @@ -1,4 +1,7 @@ = Підсистема управління налаштуваннями користувачів +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Загальний опис @@ -38,10 +41,9 @@ image::arch:architecture/registry/operational/user-settings/user-settings-overvi Події активації/деактивації каналів зв'язку фіксуються у журналі аудиту з повним контекстом. |=== -|Тип події|Службова назва|Опис +|Тип події|Спосіб фіксації|Службова назва|Опис -.2+|_USER_EVENT_|USER_NOTIFICATION_CHANNEL_ACTIVATION|Активація каналу зв'язку -|USER_NOTIFICATION_CHANNEL_DEACTIVATION|Деактивація каналу зв'язку +.2+|_USER_EVENT_|Під час виникнення|USER_NOTIFICATION_CHANNEL_ACTIVATION|Активація каналу зв'язку |Під час виникнення|USER_NOTIFICATION_CHANNEL_DEACTIVATION|Деактивація каналу зв'язку |=== [NOTE] diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/user-settings/redis-storage.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/user-settings/redis-storage.adoc index 5fafba3726..74ce1f7b57 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/user-settings/redis-storage.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/user-settings/redis-storage.adoc @@ -1,8 +1,11 @@ = Нереляційне сховище даних +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Загальний опис -_xref:arch:architecture/registry/operational/user-settings/overview.adoc[Підсистема управління налаштуваннями користувачів]_ використовує розподілену _in-memory_ базу даних xref:arch:architecture/platform-technologies.adoc#redis[Redis] з xref:arch:architecture/registry/operational/nonrelational-data-storage/overview.adoc[_Підсистеми управління нереляційними базами даних_] для зберігання автоматично згенерованих _OTP_-кодів (_One-Time Password_) зі встановленим _Time-To-Live_ для записів згідно налаштувань реєстру. +_xref:arch:architecture/registry/operational/user-settings/overview.adoc[Підсистема управління налаштуваннями користувачів]_ використовує розподілену _in-memory_ базу даних xref:arch:architecture/platform-technologies.adoc#redis[Redis] з xref:arch:architecture/registry/operational/nonrelational-data-storage/overview.adoc[_Підсистеми управління нереляційними базами даних_] для зберігання автоматично згенерованих _OTP_-кодів (_One-Time Password_) зі встановленим _Time-To-Live_ для записів згідно з налаштуваннями реєстру. Дані зберігаються у вигляді _Hash_-таблиці з сегрегацією об’єктів на рівні префіксів в ідентифікаторах (_:_). diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/user-settings/settings-db.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/user-settings/settings-db.adoc index 6a2eb657e6..489ca2fa21 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/user-settings/settings-db.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/user-settings/settings-db.adoc @@ -1,4 +1,7 @@ = Операційна БД налаштувань користувачів +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Загальний опис diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/user-settings/user-channel-settings.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/user-settings/user-channel-settings.adoc index 7bc9a64b88..f17ae91492 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/user-settings/user-channel-settings.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/user-settings/user-channel-settings.adoc @@ -1,4 +1,5 @@ = Управління каналами зв'язку користувача +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] == Загальний опис diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/user-settings/user-contact-confirmation.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/user-settings/user-contact-confirmation.adoc index 5860628ee5..74f24c1594 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/user-settings/user-contact-confirmation.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/user-settings/user-contact-confirmation.adoc @@ -1,4 +1,5 @@ -= Підтвердження каналу зв`язку з користувачем += Підтвердження каналу зв'язку з користувачем +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] == Загальний контекст diff --git a/docs/ua/modules/arch/pages/architecture/registry/operational/user-settings/user-settings.adoc b/docs/ua/modules/arch/pages/architecture/registry/operational/user-settings/user-settings.adoc index 023bb36f06..adbe1b00c0 100644 --- a/docs/ua/modules/arch/pages/architecture/registry/operational/user-settings/user-settings.adoc +++ b/docs/ua/modules/arch/pages/architecture/registry/operational/user-settings/user-settings.adoc @@ -1,4 +1,7 @@ = Управління налаштуваннями користувача +include::platform:ROOT:partial$templates/document-attributes/arch-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] Налаштування користувача зберігаються у фабриці даних та можуть бути змінені користувачем в процесі роботи одним з наведених засобів: diff --git a/docs/ua/modules/arch/partials/architecture-workspace/nav.adoc b/docs/ua/modules/arch/partials/architecture-workspace/nav.adoc index 25d21d683a..dc03c225b1 100644 --- a/docs/ua/modules/arch/partials/architecture-workspace/nav.adoc +++ b/docs/ua/modules/arch/partials/architecture-workspace/nav.adoc @@ -11,4 +11,6 @@ include::arch:partial$architecture-workspace/platform-evolution/nav.adoc[] // Дослідження та прототипування include::arch:partial$architecture-workspace/research/nav.adoc[] // Архітектура безпеки -include::arch:partial$architecture-workspace/security/nav.adoc[] \ No newline at end of file +include::arch:partial$architecture-workspace/security/nav.adoc[] +// Тестування продуктивності +include::arch:partial$architecture-workspace/performance/nav.adoc[] \ No newline at end of file diff --git a/docs/ua/modules/arch/partials/architecture-workspace/performance/nav.adoc b/docs/ua/modules/arch/partials/architecture-workspace/performance/nav.adoc new file mode 100644 index 0000000000..b9f650f8f5 --- /dev/null +++ b/docs/ua/modules/arch/partials/architecture-workspace/performance/nav.adoc @@ -0,0 +1,5 @@ +*** xref:arch:architecture-workspace/performance/overview.adoc[Тестування продуктивності] +**** xref:arch:architecture-workspace/performance/admin-services-resource-management.adoc[Управління ресурсами сервісів адміністративної зони реєстру] +**** xref:arch:architecture-workspace/performance/performance-baseline.adoc[Поточний стан тестування навантаження системи] +**** xref:arch:architecture-workspace/performance/performance-preparation.adoc[Підготовка оточення для запуску тестування навантаження] +**** xref:arch:architecture-workspace/performance/performance-tc-convention.adoc[Конвенція іменування кроків тест-кейсів] \ No newline at end of file diff --git a/docs/ua/modules/arch/partials/architecture-workspace/platform-evolution/nav.adoc b/docs/ua/modules/arch/partials/architecture-workspace/platform-evolution/nav.adoc index dfa2d30ae0..fe4d6640a9 100644 --- a/docs/ua/modules/arch/partials/architecture-workspace/platform-evolution/nav.adoc +++ b/docs/ua/modules/arch/partials/architecture-workspace/platform-evolution/nav.adoc @@ -1,10 +1,16 @@ *** xref:arch:architecture-workspace/platform-evolution/overview.adoc[Еволюція Платформи] **** xref:arch:architecture-workspace/platform-evolution/registry-settings/registry-settings.adoc[Управління налаштуваннями реєстру на рівні регламенту] **** xref:arch:architecture/registry/operational/portals/platform-evolution/bp-url.adoc[Можливість запуску БП за прямим посиланнями для надавачів і отримувачів послуг] -**** xref:arch:architecture-workspace/platform-evolution/documentation-variables/documentation-variables.adoc[Використання змінних у документації] -**** xref:arch:architecture-workspace/platform-evolution/regulation-deployment/idempotent-run.adoc[Ідемпотентне розгортання регламенту] -**** xref:arch:architecture-workspace/platform-evolution/rest-file-transfer/rest-file-transfer.adoc[Доступ до контенту файлів реєстру через зовнішні API] **** xref:arch:architecture-workspace/platform-evolution/rest-api/rest-api.adoc[Генерація і підтримка REST API документації сервісів системи] -**** xref:arch:architecture-workspace/platform-evolution/individual-officer-access/individual-officer-access.adoc[Управління доступом користувачів до _Кабінету надавача послуг_ з використанням КЕП Фізичної Особи] **** xref:arch:architecture-workspace/platform-evolution/citizen-id-gov-ua/citizen-id-gov-ua.adoc[Можливість налаштовувати сервіс id.gov.ua як спосіб автентифікації для отримувачів послуг на рівні реєстру] -**** xref:arch:architecture-workspace/platform-evolution/redas-analytical-postgres.adoc[Використання Redash аналітичної бази даних реєстру] +**** xref:arch:architecture-workspace/platform-evolution/redash-analytical-db/redash-analytical-postgres.adoc[Використання Redash аналітичної бази даних реєстру] +**** xref:arch:architecture-workspace/platform-evolution/optional-registry-nexus/optional-registry-nexus.adoc[Використання платформного Nexus замість реєстрового при створенні реєстру] +**** Локалізація +***** xref:arch:architecture-workspace/platform-evolution/admin-portal-localization/admin-portal-localization.adoc[Локалізація Порталу Адміністрування] +***** xref:arch:architecture-workspace/platform-evolution/portals-localization/portals-localization.adoc[Локалізація порталів користувачів] +**** xref:arch:architecture-workspace/platform-evolution/initial-load/inital-load.adoc[] +**** xref:arch:architecture-workspace/platform-evolution/auto-remove-on-deploy.adoc[] +include::arch:partial$architecture-workspace/platform-evolution/universal-installer/nav.adoc[] +**** xref:arch:architecture-workspace/platform-evolution/dso-cert-mng/dso-cert-mng.adoc[Керування сертифікатами АЦСК для Сервісу цифрових підписів] +**** xref:arch:architecture-workspace/platform-evolution/graalvm-migration.adoc[Перехід до GraalVM images та оновлення Spring Boot] +**** xref:arch:architecture-workspace/platform-evolution/typical-registry-configuration/typical-registry-configuration.adoc[Типові конфігурації реєстру] diff --git a/docs/ua/modules/arch/partials/architecture-workspace/platform-evolution/universal-installer/nav.adoc b/docs/ua/modules/arch/partials/architecture-workspace/platform-evolution/universal-installer/nav.adoc new file mode 100644 index 0000000000..23b06a3389 --- /dev/null +++ b/docs/ua/modules/arch/partials/architecture-workspace/platform-evolution/universal-installer/nav.adoc @@ -0,0 +1,13 @@ +**** xref:arch:architecture-workspace/platform-evolution/universal-installer/universal-installer.adoc[] +***** xref:arch:architecture-workspace/platform-evolution/universal-installer/platform-installer.adoc[] +***** xref:arch:architecture-workspace/platform-evolution/universal-installer/registry-regulation-template.adoc[] +***** xref:arch:architecture-workspace/platform-evolution/universal-installer/conditional-defaults.adoc[] +***** xref:arch:architecture-workspace/platform-evolution/universal-installer/platform-control-plane.adoc[] +***** xref:arch:architecture-workspace/platform-evolution/universal-installer/platform-config-management.adoc[] +***** xref:arch:architecture-workspace/platform-evolution/universal-installer/platform-user-management.adoc[] +***** xref:arch:architecture-workspace/platform-evolution/universal-installer/registry-portals.adoc[] +***** xref:arch:architecture-workspace/platform-evolution/universal-installer/registry-digital-signatures.adoc[] +***** xref:arch:architecture-workspace/platform-evolution/universal-installer/regulation-management.adoc[] +***** xref:arch:architecture-workspace/platform-evolution/universal-installer/regulation-publication.adoc[] +***** xref:arch:architecture-workspace/platform-evolution/universal-installer/ext-systems-simulation.adoc[] +***** xref:arch:architecture-workspace/platform-evolution/universal-installer/demo-regulation-global.adoc[] \ No newline at end of file diff --git a/docs/ua/modules/arch/partials/architecture-workspace/research/nav.adoc b/docs/ua/modules/arch/partials/architecture-workspace/research/nav.adoc index fb8b8fbbde..5cd6bbd8ca 100644 --- a/docs/ua/modules/arch/partials/architecture-workspace/research/nav.adoc +++ b/docs/ua/modules/arch/partials/architecture-workspace/research/nav.adoc @@ -5,6 +5,7 @@ **** xref:arch:architecture-workspace/research/openshift/openshift-update-4-12.adoc[Оновлення OpenShift до 4.12] **** xref:arch:architecture-workspace/research/control-plane/control-plane-configuration.adoc[Інсталятор Платформи] **** xref:arch:architecture-workspace/research/state-of-the-art/other-egov-initiatives.adoc[] +**** xref:arch:architecture-workspace/research/data-retention.adoc[] **** Адміністративний портал ***** xref:arch:architecture-workspace/research/admin-portal/general/admin-portal.adoc[Бачення розвитку архітектури] ****** xref:arch:architecture-workspace/research/admin-portal/general/admin-portal-roadmap.adoc[План розвитку] diff --git a/docs/ua/modules/arch/partials/architecture-workspace/security/nav.adoc b/docs/ua/modules/arch/partials/architecture-workspace/security/nav.adoc index b900dbbf74..7bc664f5ca 100644 --- a/docs/ua/modules/arch/partials/architecture-workspace/security/nav.adoc +++ b/docs/ua/modules/arch/partials/architecture-workspace/security/nav.adoc @@ -1,3 +1,4 @@ *** xref:arch:architecture-workspace/security/overview.adoc[Архітектура безпеки] +**** xref:arch:architecture-workspace/security/ssdlc.adoc[] **** xref:arch:architecture-workspace/security/iso/iso.adoc[Співставлення контролів з безпеки стандарту ISO 27001:2022 до стандарту OWASP ASVS та моделі OWASP SAMM] **** xref:arch:architecture-workspace/security/asvs.adoc[Відповідність вимогам OWASP ASVS] \ No newline at end of file diff --git a/docs/ua/modules/arch/partials/architecture/platform-api/nav.adoc b/docs/ua/modules/arch/partials/architecture/platform-api/nav.adoc index 0a4e68a2c0..c19703c014 100644 --- a/docs/ua/modules/arch/partials/architecture/platform-api/nav.adoc +++ b/docs/ua/modules/arch/partials/architecture/platform-api/nav.adoc @@ -1,4 +1,4 @@ -*** xref:arch:architecture/platform-api/overview.adoc[API документація Платформи] +*** xref:arch:architecture/platform-api/overview.adoc[API-документація Платформи] **** xref:arch:architecture/platform-api/services/keycloak-rest-api-ext.adoc[Розширення для Кейклоака для додаткового REST API] **** xref:arch:architecture/platform-api/services/bpms.adoc[Сервіс виконання бізнес-процесів] **** xref:arch:architecture/platform-api/services/platform-gateway.adoc[API-шлюз міжреєстрової взаємодії] diff --git a/docs/ua/modules/arch/partials/architecture/platform-installer/nav.adoc b/docs/ua/modules/arch/partials/architecture/platform-installer/nav.adoc index 339f450d2b..f9b1b6539a 100644 --- a/docs/ua/modules/arch/partials/architecture/platform-installer/nav.adoc +++ b/docs/ua/modules/arch/partials/architecture/platform-installer/nav.adoc @@ -1,4 +1,5 @@ *** xref:arch:architecture/platform-installer/overview.adoc[Компонент керування станом ресурсів Платформи] **** Ключові аспекти компоненту ***** xref:arch:architecture/platform-installer/installer-structure.adoc[Опис та структура інсталятора] +***** xref:arch:architecture/platform-installer/installer-build.adoc[Збірка інсталятора] ***** xref:arch:architecture/platform-installer/installation-process.adoc[Процес інсталяції та оновлення Платформи Реєстрів] \ No newline at end of file diff --git a/docs/ua/modules/arch/partials/architecture/platform-system-requirements/nav.adoc b/docs/ua/modules/arch/partials/architecture/platform-system-requirements/nav.adoc index d30b9e168a..cd2017e134 100644 --- a/docs/ua/modules/arch/partials/architecture/platform-system-requirements/nav.adoc +++ b/docs/ua/modules/arch/partials/architecture/platform-system-requirements/nav.adoc @@ -1,2 +1,3 @@ -*** xref:arch:architecture/platform-system-requirements/overview.adoc[Системні вимоги Платформи] -**** xref:arch:architecture/platform-system-requirements/registry-cost.adoc[Розрахунок вартості реєстру] \ No newline at end of file +*** xref:arch:architecture/platform-system-requirements/overview.adoc[Системні вимоги] +**** xref:arch:architecture/platform-system-requirements/platform-requirements.adoc[Системні вимоги до екземпляра Платформи] +**** xref:arch:architecture/platform-system-requirements/registry-requirements.adoc[Системні вимоги до екземпляра реєстру] \ No newline at end of file diff --git a/docs/ua/modules/arch/partials/architecture/platform/administrative/control-plane/nav.adoc b/docs/ua/modules/arch/partials/architecture/platform/administrative/control-plane/nav.adoc index 79890840d9..9d5b8fcaed 100644 --- a/docs/ua/modules/arch/partials/architecture/platform/administrative/control-plane/nav.adoc +++ b/docs/ua/modules/arch/partials/architecture/platform/administrative/control-plane/nav.adoc @@ -2,10 +2,14 @@ ****** xref:arch:architecture/platform/administrative/control-plane/configuration-structure/platform-configuration-structure.adoc[Структура конфігурації Платформи] ****** xref:arch:architecture/platform/administrative/control-plane/configuration-structure/registry-configuration-structure.adoc[Структура конфігурації Реєстру] ****** Еволюція підсистеми -******* xref:architecture/platform/administrative/control-plane/platform-evolution/backup-schedule.adoc[Керування розкладом та часом зберігання резервних копій реєстру] -******* xref:architecture/platform/administrative/control-plane/platform-evolution/update-certs-without-keys.adoc[Розділення процесу оновлення сертифікатів надавачів послуг та процесу оновлення ключів] -******* xref:architecture/platform/administrative/control-plane/platform-evolution/keycloak-custom-url.adoc[Конфігурація Custom URL для сервісу управління користувачами та ролями Keycloak] -******* xref:architecture/platform/administrative/control-plane/platform-evolution/handling-cp-console-versions.adoc[Надання можливості редагувати параметри реєстру в залежності від його версії] -******* xref:architecture/platform/administrative/control-plane/platform-evolution/registry-regulation-secrets.adoc[Управління налаштуваннями та секретами зовнішніх інтеграцій] +******* xref:arch:architecture/platform/administrative/control-plane/platform-evolution/backup-schedule.adoc[Керування розкладом та часом зберігання резервних копій реєстру] +******* xref:arch:architecture/platform/administrative/control-plane/platform-evolution/update-certs-without-keys.adoc[Розділення процесу оновлення сертифікатів надавачів послуг та процесу оновлення ключів] +******* xref:arch:architecture/platform/administrative/control-plane/platform-evolution/keycloak-custom-url.adoc[Конфігурація Custom URL для сервісу управління користувачами та ролями Keycloak] +******* xref:arch:architecture/platform/administrative/control-plane/platform-evolution/handling-cp-console-versions.adoc[Надання можливості редагувати параметри реєстру в залежності від його версії] +******* xref:arch:architecture/platform/administrative/control-plane/platform-evolution/registry-regulation-secrets.adoc[Управління налаштуваннями та секретами зовнішніх інтеграцій] ******* xref:arch:architecture/platform/administrative/control-plane/platform-evolution/demo-registry/demo-registry.adoc[Розгортання демо реєстру з прикладами як правильно моделювати бізнес-процеси] -******* xref:architecture/platform/administrative/control-plane/platform-evolution/single-registry-template.adoc[Мінімізація кількості шаблонів розгортання реєстру] +******* xref:arch:architecture/platform/administrative/control-plane/platform-evolution/single-registry-template.adoc[Мінімізація кількості шаблонів розгортання реєстру] +******* xref:arch:architecture/platform/administrative/control-plane/platform-evolution/documentation-variables/documentation-variables.adoc[Використання змінних у документації] +******* xref:arch:architecture/platform/administrative/control-plane/platform-evolution/individual-officer-access.adoc[Управління доступом користувачів до _Кабінету надавача послуг_ з використанням КЕП Фізичної Особи] +******* xref:arch:architecture/platform/administrative/control-plane/platform-evolution/control-plane-localization/control-plane-localization.adoc[Локалізація control-plane] +******* xref:arch:architecture/platform/administrative/control-plane/platform-evolution/platform-logo/platform-logo.adoc[Налаштування назви та логотипу платформи] \ No newline at end of file diff --git a/docs/ua/modules/arch/partials/architecture/registry/administrative/regulation-management/nav.adoc b/docs/ua/modules/arch/partials/architecture/registry/administrative/regulation-management/nav.adoc index 34e020a334..cee9cb0d73 100644 --- a/docs/ua/modules/arch/partials/architecture/registry/administrative/regulation-management/nav.adoc +++ b/docs/ua/modules/arch/partials/architecture/registry/administrative/regulation-management/nav.adoc @@ -8,6 +8,8 @@ ******* xref:arch:architecture/registry/administrative/regulation-management/platform-evolution/sc-where-logic-operators.adoc[Управління типом логічного оператора в критеріях пошуку] ******* xref:arch:architecture/registry/administrative/regulation-management/platform-evolution/sign-validation/sign-validation.adoc[Можливість перевіряти валідність підпису КЕП і ким підписано контент, що прийшов в бізнес процес по API] ******* xref:arch:architecture/registry/administrative/regulation-management/platform-evolution/regulations-integrity/regulations-integrity.adoc[Перевірка цілісності запиту на внесення змін до регламенту реєстру] +******* xref:arch:architecture/registry/administrative/regulation-management/platform-evolution/redash-localization/redash-localization.adoc[Локалізація Redash Admin та Redash Viewer] +******* xref:arch:architecture/registry/administrative/regulation-management/platform-evolution/registry-logo/registry-logo.adoc[Налаштування логотипу реєстру] ****** Архітектура підсистеми ******* Управління версіями регламенту реєстру ******** xref:arch:architecture/registry/administrative/regulation-management/admin-portal/regulation-repository/gitflow/gitflow-description.adoc[Організація роботи з git репозиторіями під час роботи з декількома версіями регламенту реєстру] diff --git a/docs/ua/modules/arch/partials/architecture/registry/administrative/regulation-publication/nav.adoc b/docs/ua/modules/arch/partials/architecture/registry/administrative/regulation-publication/nav.adoc index 6abb6ea6a5..3cf392f949 100644 --- a/docs/ua/modules/arch/partials/architecture/registry/administrative/regulation-publication/nav.adoc +++ b/docs/ua/modules/arch/partials/architecture/registry/administrative/regulation-publication/nav.adoc @@ -2,6 +2,7 @@ ****** Еволюція підсистеми ******* xref:arch:architecture/registry/administrative/regulation-publication/data-api-versioning-decommission.adoc[Відмова від збереження попередніх версій сервісів API фабрики даних] ******* xref:arch:architecture/registry/administrative/regulation-publication/cd-process.adoc[Процеси CD] +******* xref:arch:architecture/registry/administrative/regulation-publication/idempotent-run.adoc[Ідемпотентне розгортання регламенту] ****** Сервіси підсистеми include::arch:partial$architecture/registry/administrative/regulation-publication/services/camunda-auth-cli/nav.adoc[] include::arch:partial$architecture/registry/administrative/regulation-publication/services/generator/nav.adoc[] \ No newline at end of file diff --git a/docs/ua/modules/arch/partials/architecture/registry/operational/external-integrations/nav.adoc b/docs/ua/modules/arch/partials/architecture/registry/operational/external-integrations/nav.adoc index 80f01b8339..45b9edc734 100644 --- a/docs/ua/modules/arch/partials/architecture/registry/operational/external-integrations/nav.adoc +++ b/docs/ua/modules/arch/partials/architecture/registry/operational/external-integrations/nav.adoc @@ -3,6 +3,7 @@ ******* xref:arch:architecture/registry/operational/external-integrations/diia-integration.adoc[Інтеграція Платформи Реєстрів та Дії] ******* xref:arch:architecture/registry/operational/external-integrations/api-access-from-trembita.adoc[Обмеження доступа до SOAP інтерфейсів з ШБО Трембіта] ******* xref:arch:architecture/registry/operational/external-integrations/cross-registry.adoc[Міжреєстрова взаємодія без Трембіта] +******* xref:arch:architecture/registry/operational/external-integrations/external-systems-access-separation.adoc[Розмежування доступу зовнішніх систем до API бізнес процесів] ******* Інтеграція з зовнішніми системами через ШБО Трембіта ******** xref:arch:architecture/registry/operational/external-integrations/trembita/camunda-connectors.adoc[Дизайн моделювання зовнішніх інтеграційних розширень на інші реєстри] ******** xref:arch:architecture/registry/operational/external-integrations/trembita/external-invocation.adoc[Дизайн обробки запитів на ініціювання бізнес-процесів зовнішніми системами через Трембіту] diff --git a/docs/ua/modules/arch/partials/architecture/registry/operational/registry-management/nav.adoc b/docs/ua/modules/arch/partials/architecture/registry/operational/registry-management/nav.adoc index b4a43e223a..996c57506d 100644 --- a/docs/ua/modules/arch/partials/architecture/registry/operational/registry-management/nav.adoc +++ b/docs/ua/modules/arch/partials/architecture/registry/operational/registry-management/nav.adoc @@ -1,6 +1,7 @@ ***** xref:arch:architecture/registry/operational/registry-management/overview.adoc[Підсистема управління даними реєстру] ****** xref:arch:architecture/registry/operational/registry-management/ceph-storage.adoc[Об'єктне сховище даних] ****** xref:arch:architecture/registry/operational/registry-management/registry-db.adoc[] +****** xref:arch:architecture/registry/operational/registry-management/data-provenance.adoc[] ****** Еволюція підсистеми ******* xref:arch:architecture/registry/operational/registry-management/file-upload.adoc[Збереження файлів] ******* xref:arch:architecture/registry/operational/registry-management/personal-data.adoc[Робота з персональними даними] @@ -11,6 +12,7 @@ ******* xref:arch:architecture/registry/operational/registry-management/platform-evolution/public-api/public-api.adoc[Публічний API та рейт-ліміти на читання даних реєстру] ******* xref:arch:architecture/registry/operational/registry-management/platform-evolution/async-load/async-load.adoc[Асинхронне завантаження даних] ******* xref:arch:architecture/registry/operational/registry-management/platform-evolution/sc-post-migration/sc-post-migration.adoc[Додавання генерації POST-методів для пошуку даних] +******* xref:arch:architecture/registry/operational/registry-management/platform-evolution/rest-file-transfer/rest-file-transfer.adoc[Доступ до контенту файлів реєстру через зовнішні API] ****** Сервіси підсистеми include::arch:partial$architecture/registry/operational/registry-management/services/rest-api/nav.adoc[] include::arch:partial$architecture/registry/operational/registry-management/services/kafka-api/nav.adoc[] diff --git a/docs/ua/modules/arch/partials/architecture/registry/operational/reporting/nav.adoc b/docs/ua/modules/arch/partials/architecture/registry/operational/reporting/nav.adoc index 5723152228..8eba95534f 100644 --- a/docs/ua/modules/arch/partials/architecture/registry/operational/reporting/nav.adoc +++ b/docs/ua/modules/arch/partials/architecture/registry/operational/reporting/nav.adoc @@ -1,3 +1,4 @@ ***** xref:arch:architecture/registry/operational/reporting/overview.adoc[Підсистема аналітичної звітності реєстру] ****** Еволюція підсистеми -******* xref:arch:architecture/registry/operational/reporting/kong-redash.adoc[Розміщення сервіса публікування аналітичної звітності Redash за Kong] \ No newline at end of file +******* xref:arch:architecture/registry/operational/reporting/kong-redash.adoc[Розміщення сервіса публікування аналітичної звітності Redash за Kong] +******* xref:arch:architecture/registry/administrative/regulation-management/platform-evolution/redash-localization/redash-localization.adoc[Локалізація Redash Admin та Redash Viewer] diff --git a/docs/ua/modules/faq/pages/faq.adoc b/docs/ua/modules/faq/pages/faq.adoc index 0b59b8feb2..5694c85af8 100644 --- a/docs/ua/modules/faq/pages/faq.adoc +++ b/docs/ua/modules/faq/pages/faq.adoc @@ -21,6 +21,7 @@ Пропонуємо ознайомитися з відповідями на найбільш поширені запитання з боку користувачів Платформи. +[#get-date-time-entity-creation] == Як отримати дату та час створення сутності у БД? За фіксацію дати та часу додавання та оновлення сутності в БД відповідають системні поля `ddm_created_at` та `ddm_updated_at`. diff --git a/docs/ua/modules/registry-develop/attachments/bp-modeling/bp/message-event/Process_checkIntermediateThrowEvent.bpmn b/docs/ua/modules/registry-develop/attachments/bp-modeling/bp/message-event/Process_checkIntermediateThrowEvent.bpmn deleted file mode 100644 index f62f90c1bb..0000000000 --- a/docs/ua/modules/registry-develop/attachments/bp-modeling/bp/message-event/Process_checkIntermediateThrowEvent.bpmn +++ /dev/null @@ -1,446 +0,0 @@ - - - - - - - - - - - - Flow_02k45h7 - Flow_0ebb8og - Flow_1dwiaw0 - - - Flow_053ktbo - - - Flow_12tejpl - Flow_02k45h7 - - - - Flow_0hemcnj - Flow_053ktbo - Flow_12tejpl - - - Flow_0hemcnj - - - - Flow_0wp2cew - - - - - ${payload} - - - - - - Flow_0w1ev3m - Flow_0wp2cew - - - Flow_1rervg7 - - - - - - ${payload} - - - - - - Flow_0ulzqsi - Flow_1rervg7 - - - Flow_0qsotid - Flow_0w1ev3m - set_transient_variable('payload',S(['textfield':okMessageVariable], 'application/json')) - - - Flow_1dwiaw0 - Flow_0qsotid - - - - Flow_0te1l0i - Flow_0ulzqsi - set_transient_variable('payload',S(['notOkMessageVariable':notOkMessageVariable], 'application/json')) - - - Flow_0ebb8og - Flow_0te1l0i - - - - - - - - - - - - - - - - запуск со стартовой формы - - - - - - - - - Flow_01y9b4g - - - - - - - ${name=='nameInValid'} - - - - - ${name=='nameValid'} - - - - Flow_0lhxdg7 - - - - - ${process_caller().id} - - - ${submission('user_form_3').formData.prop('notOkMessageVariable').value()} - - - - - Flow_1p6erfx - Flow_0lhxdg7 - - - - - - - - ${submission('user_form_2').formData.prop('textfield').value()} - - - ${process_caller().id} - - - Flow_08mtvyp - - - - - - - - - - - - Flow_0mcz6df - Flow_1p6erfx - - - - - - - - - - - Flow_1ll4ull - Flow_08mtvyp - - - Flow_1lp0jxr - Flow_0mcz6df - Flow_1ll4ull - - - Flow_1hi5sv2 - Flow_1lp0jxr - execution.setVariable('name','nameValid') - - - - - - - - - - - Flow_0o0bi1f - Flow_1hi5sv2 - - - - - receivedMessageIntermediateEvent - - - Flow_01y9b4g - Flow_0o0bi1f - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/docs/ua/modules/registry-develop/attachments/registry-admin-study/add-registry-users/Key-6.dat b/docs/ua/modules/registry-develop/attachments/registry-admin-study/add-registry-users/Key-6.dat new file mode 100644 index 0000000000..31f1033c80 Binary files /dev/null and b/docs/ua/modules/registry-develop/attachments/registry-admin-study/add-registry-users/Key-6.dat differ diff --git a/docs/ua/modules/registry-develop/attachments/registry-admin-study/task-12-dns/admin-taskkey.pem b/docs/ua/modules/registry-develop/attachments/registry-admin-study/task-12-dns/admin-taskkey.pem new file mode 100644 index 0000000000..6b61ed94d3 --- /dev/null +++ b/docs/ua/modules/registry-develop/attachments/registry-admin-study/task-12-dns/admin-taskkey.pem @@ -0,0 +1,91 @@ +-----BEGIN PRIVATE KEY----- +MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgN6EM4aK3bKhJrD6A +TphUZ3gFYaNCDec9KvVI9OYJM3KhRANCAAQ2J8GiyowuY7xX80GhoYx16SNIK3tF +aw+mJhsXiqgtzOKA4zcnDE0RwitHiY7tYLJou8Aw7k9rw9nd+7cDIViR +-----END PRIVATE KEY----- +-----BEGIN CERTIFICATE----- +MIIELjCCAxagAwIBAgISBJ8vWKDIi8GZpuswXo9hpnT8MA0GCSqGSIb3DQEBCwUA +MDIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQD +EwJSMzAeFw0yMzA5MjUwNzE2MzVaFw0yMzEyMjQwNzE2MzRaMCIxIDAeBgNVBAMM +FyouYWRtaW4tdGFzay5jbG91ZG5zLnBoMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcD +QgAENifBosqMLmO8V/NBoaGMdekjSCt7RWsPpiYbF4qoLczigOM3JwxNEcIrR4mO +7WCyaLvAMO5Pa8PZ3fu3AyFYkaOCAhcwggITMA4GA1UdDwEB/wQEAwIHgDAdBgNV +HSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAdBgNVHQ4E +FgQUKM8oQxNago12GwAGS7K7jcw7UlUwHwYDVR0jBBgwFoAUFC6zF7dYVsuuUAlA +5h+vnYsUwsYwVQYIKwYBBQUHAQEESTBHMCEGCCsGAQUFBzABhhVodHRwOi8vcjMu +by5sZW5jci5vcmcwIgYIKwYBBQUHMAKGFmh0dHA6Ly9yMy5pLmxlbmNyLm9yZy8w +IgYDVR0RBBswGYIXKi5hZG1pbi10YXNrLmNsb3VkbnMucGgwEwYDVR0gBAwwCjAI +BgZngQwBAgEwggECBgorBgEEAdZ5AgQCBIHzBIHwAO4AdQC3Pvsk35xNunXyOcW6 +WPRsXfxCz3qfNcSeHQmBJe20mQAAAYrLaWKRAAAEAwBGMEQCIGoCr5vZKZwro6or +5PdOHHdZZJDqQO0GDOjnuBq3TM/DAiBZcqxgXBB38A4nXvHjrJ2Mq0E1HjSNDbkJ +bQvdlPBzhgB1AHoyjFTYty22IOo44FIe6YQWcDIThU070ivBOlejUutSAAABistp +YqMAAAQDAEYwRAIgSK8lnV39VFQ9030NFFpDsJrquKqGsNaqXC0YK7mXNNQCIB0h +FrbjTcpCj/E6Aw8Ucp1sVWIMWHz92x7eTkyQgh87MA0GCSqGSIb3DQEBCwUAA4IB +AQCf7+f4shXREb+Y2ykT2VITuslbs7jusW85N4R03tc/PBcuV7q1pH9SCiDZYEY7 +4w7LQROg+QYXVC5ElVjNtLCvEQBvTLwLifumpMQ7X2cWQQ12AZWIdZKWDqwa7Fqt +xnbItjNuysFUq4daw2Zbx2vMr5+goTbWYEsdpPlYxjob68ThX4C49+fwBOBVAGeD +75wQPt9XZukMg1bYA/8YFbuynplvk0R+lKS5Bb4uc39h6hcP+j5zesaEtgy1ltOm +3v+Y7A/l39ROjwJ7tRZ9rLAk7mpTzTdc70KDssuNGsTDsRa168J1EgTuxKy3gz+r +O4oF3V0zgPEHYLRTqnhN0QAf +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIFFjCCAv6gAwIBAgIRAJErCErPDBinU/bWLiWnX1owDQYJKoZIhvcNAQELBQAw +TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh +cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjAwOTA0MDAwMDAw +WhcNMjUwOTE1MTYwMDAwWjAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg +RW5jcnlwdDELMAkGA1UEAxMCUjMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK +AoIBAQC7AhUozPaglNMPEuyNVZLD+ILxmaZ6QoinXSaqtSu5xUyxr45r+XXIo9cP +R5QUVTVXjJ6oojkZ9YI8QqlObvU7wy7bjcCwXPNZOOftz2nwWgsbvsCUJCWH+jdx +sxPnHKzhm+/b5DtFUkWWqcFTzjTIUu61ru2P3mBw4qVUq7ZtDpelQDRrK9O8Zutm +NHz6a4uPVymZ+DAXXbpyb/uBxa3Shlg9F8fnCbvxK/eG3MHacV3URuPMrSXBiLxg +Z3Vms/EY96Jc5lP/Ooi2R6X/ExjqmAl3P51T+c8B5fWmcBcUr2Ok/5mzk53cU6cG +/kiFHaFpriV1uxPMUgP17VGhi9sVAgMBAAGjggEIMIIBBDAOBgNVHQ8BAf8EBAMC +AYYwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMBIGA1UdEwEB/wQIMAYB +Af8CAQAwHQYDVR0OBBYEFBQusxe3WFbLrlAJQOYfr52LFMLGMB8GA1UdIwQYMBaA +FHm0WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcw +AoYWaHR0cDovL3gxLmkubGVuY3Iub3JnLzAnBgNVHR8EIDAeMBygGqAYhhZodHRw +Oi8veDEuYy5sZW5jci5vcmcvMCIGA1UdIAQbMBkwCAYGZ4EMAQIBMA0GCysGAQQB +gt8TAQEBMA0GCSqGSIb3DQEBCwUAA4ICAQCFyk5HPqP3hUSFvNVneLKYY611TR6W +PTNlclQtgaDqw+34IL9fzLdwALduO/ZelN7kIJ+m74uyA+eitRY8kc607TkC53wl +ikfmZW4/RvTZ8M6UK+5UzhK8jCdLuMGYL6KvzXGRSgi3yLgjewQtCPkIVz6D2QQz +CkcheAmCJ8MqyJu5zlzyZMjAvnnAT45tRAxekrsu94sQ4egdRCnbWSDtY7kh+BIm +lJNXoB1lBMEKIq4QDUOXoRgffuDghje1WrG9ML+Hbisq/yFOGwXD9RiX8F6sw6W4 +avAuvDszue5L3sz85K+EC4Y/wFVDNvZo4TYXao6Z0f+lQKc0t8DQYzk1OXVu8rp2 +yJMC6alLbBfODALZvYH7n7do1AZls4I9d1P4jnkDrQoxB3UqQ9hVl3LEKQ73xF1O +yK5GhDDX8oVfGKF5u+decIsH4YaTw7mP3GFxJSqv3+0lUFJoi5Lc5da149p90Ids +hCExroL1+7mryIkXPeFM5TgO9r0rvZaBFOvV2z0gp35Z0+L4WPlbuEjN/lxPFin+ +HlUjr8gRsI3qfJOQFy/9rKIJR0Y/8Omwt/8oTWgy1mdeHmmjk7j1nYsvC9JSQ6Zv +MldlTTKB3zhThV1+XWYp6rjd5JW1zbVWEkLNxE7GJThEUG3szgBVGP7pSWTUTsqX +nLRbwHOoq7hHwg== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIFYDCCBEigAwIBAgIQQAF3ITfU6UK47naqPGQKtzANBgkqhkiG9w0BAQsFADA/ +MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT +DkRTVCBSb290IENBIFgzMB4XDTIxMDEyMDE5MTQwM1oXDTI0MDkzMDE4MTQwM1ow +TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh +cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwggIiMA0GCSqGSIb3DQEB +AQUAA4ICDwAwggIKAoICAQCt6CRz9BQ385ueK1coHIe+3LffOJCMbjzmV6B493XC +ov71am72AE8o295ohmxEk7axY/0UEmu/H9LqMZshftEzPLpI9d1537O4/xLxIZpL +wYqGcWlKZmZsj348cL+tKSIG8+TA5oCu4kuPt5l+lAOf00eXfJlII1PoOK5PCm+D +LtFJV4yAdLbaL9A4jXsDcCEbdfIwPPqPrt3aY6vrFk/CjhFLfs8L6P+1dy70sntK +4EwSJQxwjQMpoOFTJOwT2e4ZvxCzSow/iaNhUd6shweU9GNx7C7ib1uYgeGJXDR5 +bHbvO5BieebbpJovJsXQEOEO3tkQjhb7t/eo98flAgeYjzYIlefiN5YNNnWe+w5y +sR2bvAP5SQXYgd0FtCrWQemsAXaVCg/Y39W9Eh81LygXbNKYwagJZHduRze6zqxZ +Xmidf3LWicUGQSk+WT7dJvUkyRGnWqNMQB9GoZm1pzpRboY7nn1ypxIFeFntPlF4 +FQsDj43QLwWyPntKHEtzBRL8xurgUBN8Q5N0s8p0544fAQjQMNRbcTa0B7rBMDBc +SLeCO5imfWCKoqMpgsy6vYMEG6KDA0Gh1gXxG8K28Kh8hjtGqEgqiNx2mna/H2ql +PRmP6zjzZN7IKw0KKP/32+IVQtQi0Cdd4Xn+GOdwiK1O5tmLOsbdJ1Fu/7xk9TND +TwIDAQABo4IBRjCCAUIwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw +SwYIKwYBBQUHAQEEPzA9MDsGCCsGAQUFBzAChi9odHRwOi8vYXBwcy5pZGVudHJ1 +c3QuY29tL3Jvb3RzL2RzdHJvb3RjYXgzLnA3YzAfBgNVHSMEGDAWgBTEp7Gkeyxx ++tvhS5B1/8QVYIWJEDBUBgNVHSAETTBLMAgGBmeBDAECATA/BgsrBgEEAYLfEwEB +ATAwMC4GCCsGAQUFBwIBFiJodHRwOi8vY3BzLnJvb3QteDEubGV0c2VuY3J5cHQu +b3JnMDwGA1UdHwQ1MDMwMaAvoC2GK2h0dHA6Ly9jcmwuaWRlbnRydXN0LmNvbS9E +U1RST09UQ0FYM0NSTC5jcmwwHQYDVR0OBBYEFHm0WeZ7tuXkAXOACIjIGlj26Ztu +MA0GCSqGSIb3DQEBCwUAA4IBAQAKcwBslm7/DlLQrt2M51oGrS+o44+/yQoDFVDC +5WxCu2+b9LRPwkSICHXM6webFGJueN7sJ7o5XPWioW5WlHAQU7G75K/QosMrAdSW +9MUgNTP52GE24HGNtLi1qoJFlcDyqSMo59ahy2cI2qBDLKobkx/J3vWraV0T9VuG +WCLKTVXkcGdtwlfFRjlBz4pYg1htmf5X6DYO8A4jqv2Il9DjXA6USbW1FzXSLr9O +he8Y4IWS6wY7bCkjCWDcRQJMEhg76fsO3txE+FiYruq9RUWhiF1myv4Q6W+CyBFC +Dfvp7OOGAN6dEOM4+qR9sdjoSYKEBpsr6GtPAQw4dy753ec5 +-----END CERTIFICATE----- diff --git a/docs/ua/modules/registry-develop/attachments/registry-admin-study/task-3-update-registry-keys/allowed-keys.yml b/docs/ua/modules/registry-develop/attachments/registry-admin-study/task-3-update-registry-keys/allowed-keys.yml new file mode 100644 index 0000000000..f47f4e7dd8 --- /dev/null +++ b/docs/ua/modules/registry-develop/attachments/registry-admin-study/task-3-update-registry-keys/allowed-keys.yml @@ -0,0 +1,5 @@ +allowed-keys: + - issuer: O=АТ "ІІТ";OU=Тестовий ЦСК;CN=Тестовий ЦСК АТ "ІІТ";Serial=UA-22723472;C=UA;L=Харків;ST=Харківська + serial: 5B63D88375D920180400000059B2050078740C00 + - issuer: O=ДП "ДІЯ" (ТЕСТ);CN=Адміністратор ІТС ЦЗО (CA TEST);Serial=UA-43395033-2101;C=UA;L=Київ;OI=NTRUA-43395033 + serial: 363043803E9A341C04000000E30000002C070000 \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/attachments/registry-admin-study/task-3-update-registry-keys/key-6.dat b/docs/ua/modules/registry-develop/attachments/registry-admin-study/task-3-update-registry-keys/key-6.dat new file mode 100644 index 0000000000..31f1033c80 Binary files /dev/null and b/docs/ua/modules/registry-develop/attachments/registry-admin-study/task-3-update-registry-keys/key-6.dat differ diff --git a/docs/ua/modules/registry-develop/attachments/registry-admin/auth-setup/registry-federation/DsoOfficerAuthFlow.yaml b/docs/ua/modules/registry-develop/attachments/registry-admin/auth-setup/registry-federation/DsoOfficerAuthFlow.yaml new file mode 100644 index 0000000000..e9d614bdec --- /dev/null +++ b/docs/ua/modules/registry-develop/attachments/registry-admin/auth-setup/registry-federation/DsoOfficerAuthFlow.yaml @@ -0,0 +1,33 @@ +apiVersion: v1.edp.epam.com/v1alpha1 +kind: KeycloakAuthFlow +metadata: + name: {{ .Values.registryFederation.name }}-dso-officer-auth-flow + annotations: + "helm.sh/resource-policy": keep +spec: + alias: dso-officer-auth-flow + authenticationExecutions: + - authenticator: ds-officer-authenticator + requirement: ALTERNATIVE + priority: 1 + authenticatorConfig: + alias: ds-officer-authenticator-configuration + config: + dsoUrl: 'http://digital-signature-ops:8080/api/esignature/owner' + widgetUrl: '{{ .Values.registryFederation.widgetUrl }}' + widgetHeight: '{{ .Values.registryFederation.widgetHeight }}' + selfRegistrationEnabled: '{{ .Values.registryFederation.selfRegistrationEnabled }}' + {{ if eq .Values.registryFederation.selfRegistrationEnabled "true" }} + selfRegistrationDefaultRoles: 'default-roles-registry-federation-{{ .Values.registryFederation.name }}' + {{- else -}} + selfRegistrationDefaultRoles: '' + {{- end }} + startPageUrl: 'https://{{ .Values.keycloak.host }}' + themeFile: white-theme.js + - authenticator: auth-cookie + requirement: ALTERNATIVE + priority: 0 + builtIn: false + providerId: basic-flow + realm: registry-federation-{{ .Values.registryFederation.name }} + topLevel: true \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/attachments/registry-admin/auth-setup/registry-federation/FederationClient.yaml b/docs/ua/modules/registry-develop/attachments/registry-admin/auth-setup/registry-federation/FederationClient.yaml new file mode 100644 index 0000000000..c97f28f9cd --- /dev/null +++ b/docs/ua/modules/registry-develop/attachments/registry-admin/auth-setup/registry-federation/FederationClient.yaml @@ -0,0 +1,133 @@ +{{- define "federation-secret-value" }} + {{- $secretName := .secretName }} + {{- $namespace := .namespace }} + {{- $secret := (lookup "v1" "Secret" $namespace $secretName) }} + {{- if $secret }} + {{- $secret.data.clientSecret }} + {{- else }} + {{- uuidv4 | b64enc }} + {{- end }} + {{- end }} + +{{- $root := .Values }} +{{- $release := .Release }} +{{- range $registry := $root.registryFederation.registries }} +--- +{{- $secretName := (printf "%s-federation-client-secret" $registry.name) }} +{{- $secretValue := include "federation-secret-value" (dict "secretName" $secretName "namespace" "user-management") }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ $secretName }} + annotations: + "helm.sh/resource-policy": keep +type: Opaque +data: + clientSecret: {{ $secretValue | squote }} +--- +apiVersion: v1.edp.epam.com/v1alpha1 +kind: KeycloakClient +metadata: + name: {{ $registry.name }}-federation-client + annotations: + "helm.sh/resource-policy": keep +spec: + clientId: {{ $registry.name }}-client + public: false + directAccess: false + audRequired: false + serviceAccount: + enabled: true + secret: {{ $secretName }} + targetRealm: registry-federation-{{ $root.registryFederation.name }} + protocolMappers: + - config: + jsonType.label: String + name: drfo + multivalued: 'false' + userinfo.token.claim: 'true' + aggregate.attrs: 'false' + id.token.claim: 'true' + user.attribute: drfo + claim.name: drfo + access.token.claim: 'true' + name: drfo + protocol: openid-connect + protocolMapper: oidc-usermodel-attribute-mapper + - config: + jsonType.label: String + name: fullName + multivalued: 'false' + userinfo.token.claim: 'true' + aggregate.attrs: 'false' + id.token.claim: 'true' + user.attribute: fullName + claim.name: fullName + access.token.claim: 'true' + name: fullName + protocol: openid-connect + protocolMapper: oidc-usermodel-attribute-mapper + - config: + jsonType.label: String + name: edrpou + multivalued: 'false' + userinfo.token.claim: 'true' + aggregate.attrs: 'false' + id.token.claim: 'true' + user.attribute: edrpou + claim.name: edrpou + access.token.claim: 'true' + name: edrpou + protocol: openid-connect + protocolMapper: oidc-usermodel-attribute-mapper +--- +apiVersion: v1.edp.epam.com/v1alpha1 +kind: KeycloakRealmIdentityProvider +metadata: + name: federation-idp + annotations: + "helm.sh/resource-policy": keep + namespace: {{ $registry.name }} +spec: + realm: officer-portal + alias: federation-idp + authenticateByDefault: true + enabled: true + firstBrokerLoginFlowAlias: "registry-federation-authenticator" + providerId: "keycloak-oidc" + config: + clientId: {{ $registry.name }}-client + backchannelSupported: "true" + clientSecret: {{ $secretValue | b64dec }} + clientAuthMethod: "client_secret_post" + authorizationUrl: https://{{ $root.keycloak.host }}/auth/realms/registry-federation-{{ $root.registryFederation.name }}/protocol/openid-connect/auth + userInfoUrl: https://{{ $root.keycloak.host }}/auth/realms/registry-federation-{{ $root.registryFederation.name }}/protocol/openid-connect/userinfo + tokenUrl: https://{{ $root.keycloak.host }}/auth/realms/registry-federation-{{ $root.registryFederation.name }}/protocol/openid-connect/token + logoutUrl: https://{{ $root.keycloak.host }}/auth/realms/registry-federation-{{ $root.registryFederation.name }}/protocol/openid-connect/logout + issuer: https://{{ $root.keycloak.host }}/auth/realms/registry-federation-{{ $root.registryFederation.name }} + mappers: + - identityProviderMapper: "oidc-user-attribute-idp-mapper" + name: "drfo" + config: + claim: "drfo" + "user.attribute": "drfo" + syncMode: "INHERIT" + - identityProviderMapper: "oidc-user-attribute-idp-mapper" + name: "edrpou" + config: + claim: "edrpou" + "user.attribute": "edrpou" + syncMode: "INHERIT" + - identityProviderMapper: "oidc-user-attribute-idp-mapper" + name: "fullName" + config: + claim: "fullName" + "user.attribute": "fullName" + syncMode: "INHERIT" + - identityProviderMapper: "oidc-user-attribute-idp-mapper" + name: "realm" + config: + claim: "realm" + "user.attribute": "oidc-realm" + syncMode: "INHERIT" +{{- end }} \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/attachments/registry-admin/auth-setup/registry-federation/FederationRealm.yaml b/docs/ua/modules/registry-develop/attachments/registry-admin/auth-setup/registry-federation/FederationRealm.yaml new file mode 100644 index 0000000000..09c2e401d9 --- /dev/null +++ b/docs/ua/modules/registry-develop/attachments/registry-admin/auth-setup/registry-federation/FederationRealm.yaml @@ -0,0 +1,15 @@ +apiVersion: v1.edp.epam.com/v1alpha1 +kind: KeycloakRealm +metadata: + annotations: + "helm.sh/resource-policy": keep + name: registry-federation-{{ .Values.registryFederation.name }} +spec: + keycloakOwner: main + realmName: registry-federation-{{ .Values.registryFederation.name }} + ssoRealmEnabled: false + themes: + loginTheme: dso-officer-login-theme + browserSecurityHeaders: + contentSecurityPolicy: "frame-src 'self' https://{{ (urlParse .Values.registryFederation.widgetUrl).host }}; frame-ancestors 'self'; object-src 'none';" + browserFlow: dso-officer-auth-flow \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/attachments/registry-admin/auth-setup/registry-federation/RegistryFederationAuthFlow.yaml b/docs/ua/modules/registry-develop/attachments/registry-admin/auth-setup/registry-federation/RegistryFederationAuthFlow.yaml new file mode 100644 index 0000000000..3027dc0d93 --- /dev/null +++ b/docs/ua/modules/registry-develop/attachments/registry-admin/auth-setup/registry-federation/RegistryFederationAuthFlow.yaml @@ -0,0 +1,27 @@ +{{- $root := .Values }} +{{- $release := .Release }} +{{- range $registry := $root.registryFederation.registries }} +--- +apiVersion: v1.edp.epam.com/v1alpha1 +kind: KeycloakAuthFlow +metadata: + name: registry-federation-authenticator + annotations: + helm.sh/resource-policy: keep + namespace: {{ $registry.name }} +spec: + alias: registry-federation-authenticator + authenticationExecutions: + - authenticator: registry-federation-authenticator + requirement: ALTERNATIVE + priority: 0 + authenticatorConfig: + alias: registry-federation-authenticator + config: + selfRegistrationEnabled: '{{ $registry.selfRegistrationEnabled }}' + selfRegistrationDefaultRoles: unregistered-officer + builtIn: false + providerId: basic-flow + realm: officer-portal + topLevel: true +{{- end }} \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-and-or-single-table/bp-and-or-single-table-001.png b/docs/ua/modules/registry-develop/images/best-practices/bp-and-or-single-table/bp-and-or-single-table-001.png new file mode 100644 index 0000000000..7dbd834324 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-and-or-single-table/bp-and-or-single-table-001.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-and-or-single-table/bp-and-or-single-table-002.png b/docs/ua/modules/registry-develop/images/best-practices/bp-and-or-single-table/bp-and-or-single-table-002.png new file mode 100644 index 0000000000..ae1ce30c17 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-and-or-single-table/bp-and-or-single-table-002.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-and-or-single-table/bp-and-or-single-table-003.png b/docs/ua/modules/registry-develop/images/best-practices/bp-and-or-single-table/bp-and-or-single-table-003.png new file mode 100644 index 0000000000..176d0cd4ef Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-and-or-single-table/bp-and-or-single-table-003.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-and-or-single-table/bp-and-or-single-table-004.png b/docs/ua/modules/registry-develop/images/best-practices/bp-and-or-single-table/bp-and-or-single-table-004.png new file mode 100644 index 0000000000..30a5136d4f Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-and-or-single-table/bp-and-or-single-table-004.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-and-or-single-table/bp-and-or-single-table-005.png b/docs/ua/modules/registry-develop/images/best-practices/bp-and-or-single-table/bp-and-or-single-table-005.png new file mode 100644 index 0000000000..529b50a096 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-and-or-single-table/bp-and-or-single-table-005.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-and-or-single-table/bp-and-or-single-table-01.png b/docs/ua/modules/registry-develop/images/best-practices/bp-and-or-single-table/bp-and-or-single-table-01.png new file mode 100644 index 0000000000..c585852a82 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-and-or-single-table/bp-and-or-single-table-01.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-and-or-single-table/bp-and-or-single-table-02.png b/docs/ua/modules/registry-develop/images/best-practices/bp-and-or-single-table/bp-and-or-single-table-02.png new file mode 100644 index 0000000000..17f9297fb6 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-and-or-single-table/bp-and-or-single-table-02.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-and-or-single-table/bp-and-or-single-table-1.png b/docs/ua/modules/registry-develop/images/best-practices/bp-and-or-single-table/bp-and-or-single-table-1.png new file mode 100644 index 0000000000..59b555b3b0 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-and-or-single-table/bp-and-or-single-table-1.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-and-or-single-table/bp-and-or-single-table-10.png b/docs/ua/modules/registry-develop/images/best-practices/bp-and-or-single-table/bp-and-or-single-table-10.png new file mode 100644 index 0000000000..9bfdbbfaba Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-and-or-single-table/bp-and-or-single-table-10.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-and-or-single-table/bp-and-or-single-table-11.png b/docs/ua/modules/registry-develop/images/best-practices/bp-and-or-single-table/bp-and-or-single-table-11.png new file mode 100644 index 0000000000..c30fb20176 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-and-or-single-table/bp-and-or-single-table-11.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-and-or-single-table/bp-and-or-single-table-2.png b/docs/ua/modules/registry-develop/images/best-practices/bp-and-or-single-table/bp-and-or-single-table-2.png new file mode 100644 index 0000000000..b54dccb0fc Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-and-or-single-table/bp-and-or-single-table-2.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-and-or-single-table/bp-and-or-single-table-3.png b/docs/ua/modules/registry-develop/images/best-practices/bp-and-or-single-table/bp-and-or-single-table-3.png new file mode 100644 index 0000000000..fb435757c7 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-and-or-single-table/bp-and-or-single-table-3.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-and-or-single-table/bp-and-or-single-table-4.png b/docs/ua/modules/registry-develop/images/best-practices/bp-and-or-single-table/bp-and-or-single-table-4.png new file mode 100644 index 0000000000..727edac9d6 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-and-or-single-table/bp-and-or-single-table-4.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-and-or-single-table/bp-and-or-single-table-5.png b/docs/ua/modules/registry-develop/images/best-practices/bp-and-or-single-table/bp-and-or-single-table-5.png new file mode 100644 index 0000000000..bc9cb41639 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-and-or-single-table/bp-and-or-single-table-5.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-and-or-single-table/bp-and-or-single-table-6.png b/docs/ua/modules/registry-develop/images/best-practices/bp-and-or-single-table/bp-and-or-single-table-6.png new file mode 100644 index 0000000000..e83645c033 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-and-or-single-table/bp-and-or-single-table-6.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-and-or-single-table/bp-and-or-single-table-7.png b/docs/ua/modules/registry-develop/images/best-practices/bp-and-or-single-table/bp-and-or-single-table-7.png new file mode 100644 index 0000000000..1b5198809c Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-and-or-single-table/bp-and-or-single-table-7.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-and-or-single-table/bp-and-or-single-table-8.png b/docs/ua/modules/registry-develop/images/best-practices/bp-and-or-single-table/bp-and-or-single-table-8.png new file mode 100644 index 0000000000..f760012cc9 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-and-or-single-table/bp-and-or-single-table-8.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-and-or-single-table/bp-and-or-single-table-9.png b/docs/ua/modules/registry-develop/images/best-practices/bp-and-or-single-table/bp-and-or-single-table-9.png new file mode 100644 index 0000000000..ce02abf130 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-and-or-single-table/bp-and-or-single-table-9.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-assign-role-via-url/assign-role-via-url-01.png b/docs/ua/modules/registry-develop/images/best-practices/bp-assign-role-via-url/assign-role-via-url-01.png new file mode 100644 index 0000000000..52850cf9b1 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-assign-role-via-url/assign-role-via-url-01.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-assign-role-via-url/assign-role-via-url-02.png b/docs/ua/modules/registry-develop/images/best-practices/bp-assign-role-via-url/assign-role-via-url-02.png new file mode 100644 index 0000000000..e90eb1e6b3 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-assign-role-via-url/assign-role-via-url-02.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-assign-role-via-url/assign-role-via-url-03.png b/docs/ua/modules/registry-develop/images/best-practices/bp-assign-role-via-url/assign-role-via-url-03.png new file mode 100644 index 0000000000..932e57e8df Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-assign-role-via-url/assign-role-via-url-03.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-assign-role-via-url/assign-role-via-url-04.png b/docs/ua/modules/registry-develop/images/best-practices/bp-assign-role-via-url/assign-role-via-url-04.png new file mode 100644 index 0000000000..5e6ed81021 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-assign-role-via-url/assign-role-via-url-04.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-assign-role-via-url/assign-role-via-url-05.png b/docs/ua/modules/registry-develop/images/best-practices/bp-assign-role-via-url/assign-role-via-url-05.png new file mode 100644 index 0000000000..fdb6ee97a8 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-assign-role-via-url/assign-role-via-url-05.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-assign-role-via-url/assign-role-via-url-06.png b/docs/ua/modules/registry-develop/images/best-practices/bp-assign-role-via-url/assign-role-via-url-06.png new file mode 100644 index 0000000000..8071443e2b Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-assign-role-via-url/assign-role-via-url-06.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-assign-role-via-url/assign-role-via-url-1.png b/docs/ua/modules/registry-develop/images/best-practices/bp-assign-role-via-url/assign-role-via-url-1.png new file mode 100644 index 0000000000..346aa7cf8e Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-assign-role-via-url/assign-role-via-url-1.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-assign-role-via-url/assign-role-via-url-10.png b/docs/ua/modules/registry-develop/images/best-practices/bp-assign-role-via-url/assign-role-via-url-10.png new file mode 100644 index 0000000000..5511c0247f Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-assign-role-via-url/assign-role-via-url-10.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-assign-role-via-url/assign-role-via-url-2.png b/docs/ua/modules/registry-develop/images/best-practices/bp-assign-role-via-url/assign-role-via-url-2.png new file mode 100644 index 0000000000..62a9bc429a Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-assign-role-via-url/assign-role-via-url-2.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-assign-role-via-url/assign-role-via-url-3.png b/docs/ua/modules/registry-develop/images/best-practices/bp-assign-role-via-url/assign-role-via-url-3.png new file mode 100644 index 0000000000..09e2ab36d4 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-assign-role-via-url/assign-role-via-url-3.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-assign-role-via-url/assign-role-via-url-4.png b/docs/ua/modules/registry-develop/images/best-practices/bp-assign-role-via-url/assign-role-via-url-4.png new file mode 100644 index 0000000000..3b2123f731 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-assign-role-via-url/assign-role-via-url-4.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-assign-role-via-url/assign-role-via-url-5.png b/docs/ua/modules/registry-develop/images/best-practices/bp-assign-role-via-url/assign-role-via-url-5.png new file mode 100644 index 0000000000..a87fada193 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-assign-role-via-url/assign-role-via-url-5.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-assign-role-via-url/assign-role-via-url-6.png b/docs/ua/modules/registry-develop/images/best-practices/bp-assign-role-via-url/assign-role-via-url-6.png new file mode 100644 index 0000000000..9d0b1c075f Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-assign-role-via-url/assign-role-via-url-6.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-assign-role-via-url/assign-role-via-url-7.png b/docs/ua/modules/registry-develop/images/best-practices/bp-assign-role-via-url/assign-role-via-url-7.png new file mode 100644 index 0000000000..1686271224 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-assign-role-via-url/assign-role-via-url-7.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-assign-role-via-url/assign-role-via-url-8.png b/docs/ua/modules/registry-develop/images/best-practices/bp-assign-role-via-url/assign-role-via-url-8.png new file mode 100644 index 0000000000..00cd66299d Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-assign-role-via-url/assign-role-via-url-8.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-assign-role-via-url/assign-role-via-url-9.png b/docs/ua/modules/registry-develop/images/best-practices/bp-assign-role-via-url/assign-role-via-url-9.png new file mode 100644 index 0000000000..8fbe1bc7f6 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-assign-role-via-url/assign-role-via-url-9.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-iban-update/bp-iban-update-1.png b/docs/ua/modules/registry-develop/images/best-practices/bp-iban-update/bp-iban-update-1.png new file mode 100644 index 0000000000..4dea8565b7 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-iban-update/bp-iban-update-1.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-iban-update/bp-iban-update-2.png b/docs/ua/modules/registry-develop/images/best-practices/bp-iban-update/bp-iban-update-2.png new file mode 100644 index 0000000000..67f14044c6 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-iban-update/bp-iban-update-2.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-iban-update/bp-iban-update-3.png b/docs/ua/modules/registry-develop/images/best-practices/bp-iban-update/bp-iban-update-3.png new file mode 100644 index 0000000000..2b3c48516b Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-iban-update/bp-iban-update-3.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-iban-update/bp-iban-update-4.png b/docs/ua/modules/registry-develop/images/best-practices/bp-iban-update/bp-iban-update-4.png new file mode 100644 index 0000000000..d0a35b1fc4 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-iban-update/bp-iban-update-4.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-iban-update/bp-iban-update-5.png b/docs/ua/modules/registry-develop/images/best-practices/bp-iban-update/bp-iban-update-5.png new file mode 100644 index 0000000000..69f4241848 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-iban-update/bp-iban-update-5.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-iban-update/bp-iban-update-6.png b/docs/ua/modules/registry-develop/images/best-practices/bp-iban-update/bp-iban-update-6.png new file mode 100644 index 0000000000..2d9f6aa2ca Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-iban-update/bp-iban-update-6.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-1.png b/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-1.png new file mode 100644 index 0000000000..644a382d07 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-1.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-10.png b/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-10.png new file mode 100644 index 0000000000..b89676dfd3 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-10.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-11.png b/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-11.png new file mode 100644 index 0000000000..45aa994301 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-11.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-12.png b/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-12.png new file mode 100644 index 0000000000..88429e82d9 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-12.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-13.png b/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-13.png new file mode 100644 index 0000000000..8ff1b8703f Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-13.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-14.png b/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-14.png new file mode 100644 index 0000000000..90fe728f76 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-14.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-15.png b/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-15.png new file mode 100644 index 0000000000..c0344140b0 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-15.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-16.png b/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-16.png new file mode 100644 index 0000000000..2dd4275cd3 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-16.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-17.png b/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-17.png new file mode 100644 index 0000000000..895701de6a Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-17.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-18.png b/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-18.png new file mode 100644 index 0000000000..c7244023a9 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-18.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-19.png b/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-19.png new file mode 100644 index 0000000000..1f4cb38a8a Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-19.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-2.png b/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-2.png new file mode 100644 index 0000000000..7b73b4e6f4 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-2.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-20.png b/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-20.png new file mode 100644 index 0000000000..a394c8f9d5 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-20.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-21.png b/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-21.png new file mode 100644 index 0000000000..566e1cd718 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-21.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-22.png b/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-22.png new file mode 100644 index 0000000000..b882886927 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-22.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-23.png b/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-23.png new file mode 100644 index 0000000000..04d4da113a Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-23.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-24.png b/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-24.png new file mode 100644 index 0000000000..1d0c49247f Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-24.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-25.png b/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-25.png new file mode 100644 index 0000000000..756d62be23 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-25.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-26.png b/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-26.png new file mode 100644 index 0000000000..25f46e9b93 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-26.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-3.png b/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-3.png new file mode 100644 index 0000000000..88797fcf78 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-3.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-4.png b/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-4.png new file mode 100644 index 0000000000..aca09e2760 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-4.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-5.png b/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-5.png new file mode 100644 index 0000000000..c028bc3350 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-5.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-6.png b/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-6.png new file mode 100644 index 0000000000..60ecb63e34 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-6.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-7.png b/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-7.png new file mode 100644 index 0000000000..31ba71e50e Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-7.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-8.png b/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-8.png new file mode 100644 index 0000000000..132b271449 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-8.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-9.png b/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-9.png new file mode 100644 index 0000000000..4612631786 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-9.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-send-notifications-blacklist/bp-send-notifications-blacklist-1.png b/docs/ua/modules/registry-develop/images/best-practices/bp-send-notifications-blacklist/bp-send-notifications-blacklist-1.png new file mode 100644 index 0000000000..db944a71ce Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-send-notifications-blacklist/bp-send-notifications-blacklist-1.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-send-notifications-blacklist/bp-send-notifications-blacklist-2.png b/docs/ua/modules/registry-develop/images/best-practices/bp-send-notifications-blacklist/bp-send-notifications-blacklist-2.png new file mode 100644 index 0000000000..9cff934d23 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-send-notifications-blacklist/bp-send-notifications-blacklist-2.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-send-notifications-blacklist/bp-send-notifications-blacklist-3.png b/docs/ua/modules/registry-develop/images/best-practices/bp-send-notifications-blacklist/bp-send-notifications-blacklist-3.png new file mode 100644 index 0000000000..c666169ef0 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-send-notifications-blacklist/bp-send-notifications-blacklist-3.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-send-notifications-blacklist/bp-send-notifications-blacklist-4.png b/docs/ua/modules/registry-develop/images/best-practices/bp-send-notifications-blacklist/bp-send-notifications-blacklist-4.png new file mode 100644 index 0000000000..8f4d643c8d Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-send-notifications-blacklist/bp-send-notifications-blacklist-4.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-send-notifications-blacklist/bp-send-notifications-blacklist-5.png b/docs/ua/modules/registry-develop/images/best-practices/bp-send-notifications-blacklist/bp-send-notifications-blacklist-5.png new file mode 100644 index 0000000000..33c02f1010 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-send-notifications-blacklist/bp-send-notifications-blacklist-5.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-send-notifications-blacklist/bp-send-notifications-blacklist-6.png b/docs/ua/modules/registry-develop/images/best-practices/bp-send-notifications-blacklist/bp-send-notifications-blacklist-6.png new file mode 100644 index 0000000000..536d53ebb2 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-send-notifications-blacklist/bp-send-notifications-blacklist-6.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-send-notifications-blacklist/bp-send-notifications-blacklist-7.png b/docs/ua/modules/registry-develop/images/best-practices/bp-send-notifications-blacklist/bp-send-notifications-blacklist-7.png new file mode 100644 index 0000000000..506479f832 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-send-notifications-blacklist/bp-send-notifications-blacklist-7.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-send-notifications-blacklist/bp-send-notifications-blacklist-8.png b/docs/ua/modules/registry-develop/images/best-practices/bp-send-notifications-blacklist/bp-send-notifications-blacklist-8.png new file mode 100644 index 0000000000..6628c3ee50 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-send-notifications-blacklist/bp-send-notifications-blacklist-8.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-sign-validate/bp-sign-validate-01.png b/docs/ua/modules/registry-develop/images/best-practices/bp-sign-validate/bp-sign-validate-01.png new file mode 100644 index 0000000000..adf8688891 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-sign-validate/bp-sign-validate-01.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-sign-validate/bp-sign-validate-02.png b/docs/ua/modules/registry-develop/images/best-practices/bp-sign-validate/bp-sign-validate-02.png new file mode 100644 index 0000000000..bf9235cde7 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-sign-validate/bp-sign-validate-02.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-sign-validate/bp-sign-validate-03.png b/docs/ua/modules/registry-develop/images/best-practices/bp-sign-validate/bp-sign-validate-03.png new file mode 100644 index 0000000000..8a91a2468e Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-sign-validate/bp-sign-validate-03.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-sign-validate/bp-sign-validate-1.png b/docs/ua/modules/registry-develop/images/best-practices/bp-sign-validate/bp-sign-validate-1.png new file mode 100644 index 0000000000..fe700335e8 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-sign-validate/bp-sign-validate-1.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-sign-validate/bp-sign-validate-10.png b/docs/ua/modules/registry-develop/images/best-practices/bp-sign-validate/bp-sign-validate-10.png new file mode 100644 index 0000000000..3f98d7d47a Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-sign-validate/bp-sign-validate-10.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-sign-validate/bp-sign-validate-11.png b/docs/ua/modules/registry-develop/images/best-practices/bp-sign-validate/bp-sign-validate-11.png new file mode 100644 index 0000000000..9b5012c91b Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-sign-validate/bp-sign-validate-11.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-sign-validate/bp-sign-validate-12.png b/docs/ua/modules/registry-develop/images/best-practices/bp-sign-validate/bp-sign-validate-12.png new file mode 100644 index 0000000000..edad85d265 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-sign-validate/bp-sign-validate-12.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-sign-validate/bp-sign-validate-2.png b/docs/ua/modules/registry-develop/images/best-practices/bp-sign-validate/bp-sign-validate-2.png new file mode 100644 index 0000000000..afd25642a9 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-sign-validate/bp-sign-validate-2.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-sign-validate/bp-sign-validate-3-1.png b/docs/ua/modules/registry-develop/images/best-practices/bp-sign-validate/bp-sign-validate-3-1.png new file mode 100644 index 0000000000..874636bb30 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-sign-validate/bp-sign-validate-3-1.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-sign-validate/bp-sign-validate-3.png b/docs/ua/modules/registry-develop/images/best-practices/bp-sign-validate/bp-sign-validate-3.png new file mode 100644 index 0000000000..e544dce9f5 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-sign-validate/bp-sign-validate-3.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-sign-validate/bp-sign-validate-4.png b/docs/ua/modules/registry-develop/images/best-practices/bp-sign-validate/bp-sign-validate-4.png new file mode 100644 index 0000000000..6b6d08f08d Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-sign-validate/bp-sign-validate-4.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-sign-validate/bp-sign-validate-5.png b/docs/ua/modules/registry-develop/images/best-practices/bp-sign-validate/bp-sign-validate-5.png new file mode 100644 index 0000000000..7849679ad8 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-sign-validate/bp-sign-validate-5.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-sign-validate/bp-sign-validate-6.png b/docs/ua/modules/registry-develop/images/best-practices/bp-sign-validate/bp-sign-validate-6.png new file mode 100644 index 0000000000..54abb04976 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-sign-validate/bp-sign-validate-6.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-sign-validate/bp-sign-validate-7.png b/docs/ua/modules/registry-develop/images/best-practices/bp-sign-validate/bp-sign-validate-7.png new file mode 100644 index 0000000000..322c4fc881 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-sign-validate/bp-sign-validate-7.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-sign-validate/bp-sign-validate-8.png b/docs/ua/modules/registry-develop/images/best-practices/bp-sign-validate/bp-sign-validate-8.png new file mode 100644 index 0000000000..1453a5ea08 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-sign-validate/bp-sign-validate-8.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/bp-sign-validate/bp-sign-validate-9.png b/docs/ua/modules/registry-develop/images/best-practices/bp-sign-validate/bp-sign-validate-9.png new file mode 100644 index 0000000000..a96c7c9a61 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/bp-sign-validate/bp-sign-validate-9.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-1.png b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-1.png new file mode 100644 index 0000000000..4da89c7e09 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-1.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-10.png b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-10.png new file mode 100644 index 0000000000..a606300a3a Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-10.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-11.png b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-11.png new file mode 100644 index 0000000000..77502d11eb Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-11.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-12.png b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-12.png new file mode 100644 index 0000000000..5eee4daa2f Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-12.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-13.png b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-13.png new file mode 100644 index 0000000000..f014a806d6 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-13.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-14.png b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-14.png new file mode 100644 index 0000000000..738cc6f29b Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-14.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-2.png b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-2.png new file mode 100644 index 0000000000..cf84613686 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-2.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-3.png b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-3.png new file mode 100644 index 0000000000..6bd64eb3eb Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-3.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-4.png b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-4.png new file mode 100644 index 0000000000..14cc4e7ef1 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-4.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-5.png b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-5.png new file mode 100644 index 0000000000..4667bd6177 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-5.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-6-1.png b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-6-1.png new file mode 100644 index 0000000000..cb703e39b4 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-6-1.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-6.png b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-6.png new file mode 100644 index 0000000000..cabf521f7c Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-6.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-7.png b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-7.png new file mode 100644 index 0000000000..18aca03ff5 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-7.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-8.png b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-8.png new file mode 100644 index 0000000000..47e17c42d9 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-8.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-9.png b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-9.png new file mode 100644 index 0000000000..112f37ad0e Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-9.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-year-1.png b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-year-1.png new file mode 100644 index 0000000000..d2d68cf2c8 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-year-1.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-year-2.png b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-year-2.png new file mode 100644 index 0000000000..eb00e70cf2 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-year-2.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-year-3.png b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-year-3.png new file mode 100644 index 0000000000..f137ab6f20 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-year-3.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-year-4.png b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-year-4.png new file mode 100644 index 0000000000..fec667728a Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-year-4.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-year-5.png b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-year-5.png new file mode 100644 index 0000000000..1e13479aed Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-date/enter-date-year-5.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/forms/enter-phone-number/enter-phone-number-01.png b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-phone-number/enter-phone-number-01.png new file mode 100644 index 0000000000..be549924a3 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-phone-number/enter-phone-number-01.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/forms/enter-phone-number/enter-phone-number-02.png b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-phone-number/enter-phone-number-02.png new file mode 100644 index 0000000000..70ff204418 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-phone-number/enter-phone-number-02.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/forms/enter-phone-number/enter-phone-number-03.png b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-phone-number/enter-phone-number-03.png new file mode 100644 index 0000000000..1e72e4b72c Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-phone-number/enter-phone-number-03.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/forms/enter-phone-number/enter-phone-number-04.png b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-phone-number/enter-phone-number-04.png new file mode 100644 index 0000000000..606a3fefb9 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-phone-number/enter-phone-number-04.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/forms/enter-phone-number/enter-phone-number-05.png b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-phone-number/enter-phone-number-05.png new file mode 100644 index 0000000000..bb3c0a61a2 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-phone-number/enter-phone-number-05.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/forms/enter-phone-number/enter-phone-number-1.png b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-phone-number/enter-phone-number-1.png new file mode 100644 index 0000000000..02f9093d3a Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-phone-number/enter-phone-number-1.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/forms/enter-phone-number/enter-phone-number-2.png b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-phone-number/enter-phone-number-2.png new file mode 100644 index 0000000000..e08de52e09 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-phone-number/enter-phone-number-2.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/forms/enter-phone-number/enter-phone-number-3.png b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-phone-number/enter-phone-number-3.png new file mode 100644 index 0000000000..20c019018e Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-phone-number/enter-phone-number-3.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/forms/enter-phone-number/enter-phone-number-4.png b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-phone-number/enter-phone-number-4.png new file mode 100644 index 0000000000..3a6924ba51 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-phone-number/enter-phone-number-4.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/forms/enter-phone-number/enter-phone-number-5.png b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-phone-number/enter-phone-number-5.png new file mode 100644 index 0000000000..a5d432995c Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/forms/enter-phone-number/enter-phone-number-5.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/officer-auto-register/combined-moderation/officer-self-register-combined-1.png b/docs/ua/modules/registry-develop/images/best-practices/officer-auto-register/combined-moderation/officer-self-register-combined-1.png new file mode 100644 index 0000000000..98306185fa Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/officer-auto-register/combined-moderation/officer-self-register-combined-1.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/officer-auto-register/combined-moderation/officer-self-register-combined-2.png b/docs/ua/modules/registry-develop/images/best-practices/officer-auto-register/combined-moderation/officer-self-register-combined-2.png new file mode 100644 index 0000000000..09e00e86b2 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/officer-auto-register/combined-moderation/officer-self-register-combined-2.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/officer-auto-register/combined-moderation/officer-self-register-combined-3.png b/docs/ua/modules/registry-develop/images/best-practices/officer-auto-register/combined-moderation/officer-self-register-combined-3.png new file mode 100644 index 0000000000..31b5fb76b1 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/officer-auto-register/combined-moderation/officer-self-register-combined-3.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/officer-auto-register/combined-moderation/officer-self-register-combined-4.png b/docs/ua/modules/registry-develop/images/best-practices/officer-auto-register/combined-moderation/officer-self-register-combined-4.png new file mode 100644 index 0000000000..18acc6d471 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/officer-auto-register/combined-moderation/officer-self-register-combined-4.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/officer-auto-register/combined-moderation/officer-self-register-combined-5.png b/docs/ua/modules/registry-develop/images/best-practices/officer-auto-register/combined-moderation/officer-self-register-combined-5.png new file mode 100644 index 0000000000..984b2810b7 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/officer-auto-register/combined-moderation/officer-self-register-combined-5.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/officer-auto-register/combined-moderation/officer-self-register-combined-6.png b/docs/ua/modules/registry-develop/images/best-practices/officer-auto-register/combined-moderation/officer-self-register-combined-6.png new file mode 100644 index 0000000000..7c29dbc4e4 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/officer-auto-register/combined-moderation/officer-self-register-combined-6.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/officer-auto-register/combined-moderation/officer-self-register-combined-7.png b/docs/ua/modules/registry-develop/images/best-practices/officer-auto-register/combined-moderation/officer-self-register-combined-7.png new file mode 100644 index 0000000000..66a50dc0f0 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/officer-auto-register/combined-moderation/officer-self-register-combined-7.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-001.png b/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-001.png new file mode 100644 index 0000000000..4abb2502d6 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-001.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-002.png b/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-002.png new file mode 100644 index 0000000000..ec1743b82b Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-002.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-01.png b/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-01.png new file mode 100644 index 0000000000..33c7670f7f Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-01.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-02.png b/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-02.png new file mode 100644 index 0000000000..a38fd26394 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-02.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-1.png b/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-1.png new file mode 100644 index 0000000000..367137bef0 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-1.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-10.png b/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-10.png new file mode 100644 index 0000000000..861ac44fef Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-10.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-2.png b/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-2.png new file mode 100644 index 0000000000..d7f23b5dd5 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-2.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-3-1.png b/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-3-1.png new file mode 100644 index 0000000000..b08a3dbda9 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-3-1.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-3-2.png b/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-3-2.png new file mode 100644 index 0000000000..db7813d7b6 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-3-2.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-3-3.png b/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-3-3.png new file mode 100644 index 0000000000..dd1b4380f5 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-3-3.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-3-4.png b/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-3-4.png new file mode 100644 index 0000000000..79ceebb97a Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-3-4.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-3-5.png b/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-3-5.png new file mode 100644 index 0000000000..3e436333ce Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-3-5.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-3-6.png b/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-3-6.png new file mode 100644 index 0000000000..e15736c1e0 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-3-6.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-3-7.png b/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-3-7.png new file mode 100644 index 0000000000..dbef39d779 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-3-7.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-3-8.png b/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-3-8.png new file mode 100644 index 0000000000..49caaf3ceb Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-3-8.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-3.png b/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-3.png new file mode 100644 index 0000000000..f5fac593d7 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-3.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-4-1.png b/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-4-1.png new file mode 100644 index 0000000000..5fc9bb8b96 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-4-1.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-4-2.png b/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-4-2.png new file mode 100644 index 0000000000..6334d7bb6d Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-4-2.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-4.png b/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-4.png new file mode 100644 index 0000000000..27a62eaa68 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-4.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-5.png b/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-5.png new file mode 100644 index 0000000000..ebf9bcebbc Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-5.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-6.png b/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-6.png new file mode 100644 index 0000000000..ea44e3b765 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-6.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-7.png b/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-7.png new file mode 100644 index 0000000000..8721dcc905 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-7.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-8.png b/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-8.png new file mode 100644 index 0000000000..823e56c6e3 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-8.png differ diff --git a/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-9.png b/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-9.png new file mode 100644 index 0000000000..f19acbce4d Binary files /dev/null and b/docs/ua/modules/registry-develop/images/best-practices/view-object-creator-editor/bp-view-object-creator-editor-9.png differ diff --git a/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-00-1.png b/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-00-1.png new file mode 100644 index 0000000000..3caef34081 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-00-1.png differ diff --git a/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-00-2.png b/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-00-2.png new file mode 100644 index 0000000000..86bcdaf5c1 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-00-2.png differ diff --git a/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-00-3.png b/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-00-3.png new file mode 100644 index 0000000000..576900d0cb Binary files /dev/null and b/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-00-3.png differ diff --git a/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-00-4.png b/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-00-4.png new file mode 100644 index 0000000000..193d49d3ba Binary files /dev/null and b/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-00-4.png differ diff --git a/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-00-5.png b/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-00-5.png new file mode 100644 index 0000000000..a9977e99d7 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-00-5.png differ diff --git a/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-00.png b/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-00.png new file mode 100644 index 0000000000..95901cf8b2 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-00.png differ diff --git a/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-01.png b/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-01.png new file mode 100644 index 0000000000..67926852da Binary files /dev/null and b/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-01.png differ diff --git a/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-02-1.png b/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-02-1.png new file mode 100644 index 0000000000..07a6429971 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-02-1.png differ diff --git a/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-02.png b/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-02.png new file mode 100644 index 0000000000..78c1d1ba6e Binary files /dev/null and b/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-02.png differ diff --git a/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-03-1.png b/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-03-1.png new file mode 100644 index 0000000000..5637ca90c3 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-03-1.png differ diff --git a/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-03.png b/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-03.png new file mode 100644 index 0000000000..bcda3f12d8 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-03.png differ diff --git a/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-04.png b/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-04.png new file mode 100644 index 0000000000..94b0bc880d Binary files /dev/null and b/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-04.png differ diff --git a/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-05.png b/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-05.png new file mode 100644 index 0000000000..0f829495f0 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-05.png differ diff --git a/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-06.png b/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-06.png new file mode 100644 index 0000000000..23bc92253f Binary files /dev/null and b/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-06.png differ diff --git a/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-07-1.png b/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-07-1.png new file mode 100644 index 0000000000..cf3ec0b825 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-07-1.png differ diff --git a/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-07-2.png b/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-07-2.png new file mode 100644 index 0000000000..fbfc12b9bf Binary files /dev/null and b/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-07-2.png differ diff --git a/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-07.png b/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-07.png new file mode 100644 index 0000000000..26dc32d409 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-07.png differ diff --git a/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-08-1.png b/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-08-1.png new file mode 100644 index 0000000000..6ecb165531 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-08-1.png differ diff --git a/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-08.png b/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-08.png new file mode 100644 index 0000000000..9c98a9d6d7 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-08.png differ diff --git a/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-09.png b/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-09.png new file mode 100644 index 0000000000..4f23859e7f Binary files /dev/null and b/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-09.png differ diff --git a/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-10.png b/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-10.png new file mode 100644 index 0000000000..45d7509c70 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/bp-modeling/bp/bp-async-data-load/bp-async-load-10.png differ diff --git a/docs/ua/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-08.png b/docs/ua/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-08.png deleted file mode 100644 index 089a0d33ef..0000000000 Binary files a/docs/ua/modules/registry-develop/images/bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-08.png and /dev/null differ diff --git a/docs/ua/modules/registry-develop/images/bp-modeling/forms/components/edit-grid/hide-view-button/edit-grid-hide-view-button-1.png b/docs/ua/modules/registry-develop/images/bp-modeling/forms/components/edit-grid/hide-view-button/edit-grid-hide-view-button-1.png new file mode 100644 index 0000000000..ba09efad7e Binary files /dev/null and b/docs/ua/modules/registry-develop/images/bp-modeling/forms/components/edit-grid/hide-view-button/edit-grid-hide-view-button-1.png differ diff --git a/docs/ua/modules/registry-develop/images/bp-modeling/forms/components/edit-grid/hide-view-button/edit-grid-hide-view-button-2.png b/docs/ua/modules/registry-develop/images/bp-modeling/forms/components/edit-grid/hide-view-button/edit-grid-hide-view-button-2.png new file mode 100644 index 0000000000..7f7f7e78b5 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/bp-modeling/forms/components/edit-grid/hide-view-button/edit-grid-hide-view-button-2.png differ diff --git a/docs/ua/modules/registry-develop/images/bp-modeling/forms/components/edit-grid/hide-view-button/edit-grid-hide-view-button-3.png b/docs/ua/modules/registry-develop/images/bp-modeling/forms/components/edit-grid/hide-view-button/edit-grid-hide-view-button-3.png new file mode 100644 index 0000000000..24e8b4fb73 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/bp-modeling/forms/components/edit-grid/hide-view-button/edit-grid-hide-view-button-3.png differ diff --git a/docs/ua/modules/registry-develop/images/bp-modeling/forms/components/edit-grid/hide-view-button/edit-grid-hide-view-button-4.png b/docs/ua/modules/registry-develop/images/bp-modeling/forms/components/edit-grid/hide-view-button/edit-grid-hide-view-button-4.png new file mode 100644 index 0000000000..d26e9fdd20 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/bp-modeling/forms/components/edit-grid/hide-view-button/edit-grid-hide-view-button-4.png differ diff --git a/docs/ua/modules/registry-develop/images/bp-modeling/forms/components/edit-grid/hide-view-button/edit-grid-hide-view-button-5.png b/docs/ua/modules/registry-develop/images/bp-modeling/forms/components/edit-grid/hide-view-button/edit-grid-hide-view-button-5.png new file mode 100644 index 0000000000..397fcb37a9 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/bp-modeling/forms/components/edit-grid/hide-view-button/edit-grid-hide-view-button-5.png differ diff --git a/docs/ua/modules/registry-develop/images/bp-modeling/forms/components/edit-grid/hide-view-button/edit-grid-hide-view-button-6.png b/docs/ua/modules/registry-develop/images/bp-modeling/forms/components/edit-grid/hide-view-button/edit-grid-hide-view-button-6.png new file mode 100644 index 0000000000..f8366dfa53 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/bp-modeling/forms/components/edit-grid/hide-view-button/edit-grid-hide-view-button-6.png differ diff --git a/docs/ua/modules/registry-develop/images/bp-modeling/forms/components/edit-grid/hide-view-button/edit-grid-hide-view-button-bp.png b/docs/ua/modules/registry-develop/images/bp-modeling/forms/components/edit-grid/hide-view-button/edit-grid-hide-view-button-bp.png new file mode 100644 index 0000000000..4d0ae99fd1 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/bp-modeling/forms/components/edit-grid/hide-view-button/edit-grid-hide-view-button-bp.png differ diff --git a/docs/ua/modules/registry-develop/images/bp-modeling/forms/components/edit-grid/submit-data-as-array/edit-grid-submit-data-as-array-4.png b/docs/ua/modules/registry-develop/images/bp-modeling/forms/components/edit-grid/submit-data-as-array/edit-grid-submit-data-as-array-4.png index b79b066795..17f78ecc87 100644 Binary files a/docs/ua/modules/registry-develop/images/bp-modeling/forms/components/edit-grid/submit-data-as-array/edit-grid-submit-data-as-array-4.png and b/docs/ua/modules/registry-develop/images/bp-modeling/forms/components/edit-grid/submit-data-as-array/edit-grid-submit-data-as-array-4.png differ diff --git a/docs/ua/modules/registry-develop/images/bp-modeling/forms/components/edit-grid/submit-data-as-array/edit-grid-submit-data-as-array-5.png b/docs/ua/modules/registry-develop/images/bp-modeling/forms/components/edit-grid/submit-data-as-array/edit-grid-submit-data-as-array-5.png new file mode 100644 index 0000000000..3a92af2674 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/bp-modeling/forms/components/edit-grid/submit-data-as-array/edit-grid-submit-data-as-array-5.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-2/task-2-02-administrator-details.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-2/task-2-02-administrator-details.png index e3d86daaae..5d0d04e6a6 100644 Binary files a/docs/ua/modules/registry-develop/images/registry-admin-study/task-2/task-2-02-administrator-details.png and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-2/task-2-02-administrator-details.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-2/task-2-10-sign-in.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-2/task-2-10-sign-in.png index dede2a6285..3c00252ba8 100644 Binary files a/docs/ua/modules/registry-develop/images/registry-admin-study/task-2/task-2-10-sign-in.png and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-2/task-2-10-sign-in.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-2/task-2-31.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-2/task-2-31.png new file mode 100644 index 0000000000..e2c6442972 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-2/task-2-31.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-2/task-2-32.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-2/task-2-32.png new file mode 100644 index 0000000000..5560809e4c Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-2/task-2-32.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-01.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-01.png new file mode 100644 index 0000000000..10c2a4f7dd Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-01.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-02.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-02.png new file mode 100644 index 0000000000..77021bc287 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-02.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-03.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-03.png new file mode 100644 index 0000000000..65c38774ae Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-03.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-04.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-04.png new file mode 100644 index 0000000000..729d724a1e Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-04.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-05.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-05.png new file mode 100644 index 0000000000..cbbb08c6fb Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-05.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-06.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-06.png new file mode 100644 index 0000000000..09a5fced84 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-06.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-07-cronitor.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-07-cronitor.png deleted file mode 100644 index c596815c12..0000000000 Binary files a/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-07-cronitor.png and /dev/null differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-07.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-07.png new file mode 100644 index 0000000000..cb1e60a19b Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-07.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-08.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-08.png new file mode 100644 index 0000000000..75a0310a79 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-08.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-09.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-09.png new file mode 100644 index 0000000000..0cbeaee5e9 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-09.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-10.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-10.png new file mode 100644 index 0000000000..31b1c8a31c Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-10.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-11.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-11.png new file mode 100644 index 0000000000..61fa8fce7b Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-11.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-12.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-12.png new file mode 100644 index 0000000000..ddc678ce43 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-12.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-13.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-13.png new file mode 100644 index 0000000000..ce5d246847 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-13.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-14.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-14.png new file mode 100644 index 0000000000..6babfd9109 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-14.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-15.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-15.png new file mode 100644 index 0000000000..6ca166e332 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-15.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-add-registry-users/01-operational-platform-zone.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-add-registry-users/01-operational-platform-zone.png new file mode 100644 index 0000000000..36cf37a23f Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-add-registry-users/01-operational-platform-zone.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-add-registry-users/02-keycloak-openshift-sso.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-add-registry-users/02-keycloak-openshift-sso.png new file mode 100644 index 0000000000..ed76601c67 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-add-registry-users/02-keycloak-openshift-sso.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-add-registry-users/03-keycloak-administration-console.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-add-registry-users/03-keycloak-administration-console.png new file mode 100644 index 0000000000..7ed1dbb352 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-add-registry-users/03-keycloak-administration-console.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-add-registry-users/04-keycloak-add-users.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-add-registry-users/04-keycloak-add-users.png new file mode 100644 index 0000000000..2b54c59cc0 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-add-registry-users/04-keycloak-add-users.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-add-registry-users/05-keycloak-role-mapping.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-add-registry-users/05-keycloak-role-mapping.png new file mode 100644 index 0000000000..738844586b Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-add-registry-users/05-keycloak-role-mapping.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-add-registry-users/06-keycloak-attributes.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-add-registry-users/06-keycloak-attributes.png new file mode 100644 index 0000000000..4444f248ca Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-add-registry-users/06-keycloak-attributes.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-add-registry-users/07-officer-portal.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-add-registry-users/07-officer-portal.png new file mode 100644 index 0000000000..d1a330c06e Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-add-registry-users/07-officer-portal.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-add-registry-users/08-user-portal.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-add-registry-users/08-user-portal.png new file mode 100644 index 0000000000..dbe5931378 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-add-registry-users/08-user-portal.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-add-registry-users/10-user-authentication-2.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-add-registry-users/10-user-authentication-2.png new file mode 100644 index 0000000000..e0763c3eb8 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-add-registry-users/10-user-authentication-2.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-add-registry-users/11-user-authentication-3.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-add-registry-users/11-user-authentication-3.png new file mode 100644 index 0000000000..b60541e214 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-add-registry-users/11-user-authentication-3.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-add-registry-users/12-success authentication.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-add-registry-users/12-success authentication.png new file mode 100644 index 0000000000..9f2f581130 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-add-registry-users/12-success authentication.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-add-registry-users/13-sign-off.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-add-registry-users/13-sign-off.png new file mode 100644 index 0000000000..93e0cf4ded Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-add-registry-users/13-sign-off.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-add-registry-users/14-keycloak-delete-user.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-add-registry-users/14-keycloak-delete-user.png new file mode 100644 index 0000000000..edf452c7f2 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-add-registry-users/14-keycloak-delete-user.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-add-registry-users/15-pop-up-delete-user.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-add-registry-users/15-pop-up-delete-user.png new file mode 100644 index 0000000000..ade1b97124 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-add-registry-users/15-pop-up-delete-user.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-add-registry-users/16-1-momentary-green-message.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-add-registry-users/16-1-momentary-green-message.png new file mode 100644 index 0000000000..7ab5428510 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-add-registry-users/16-1-momentary-green-message.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-add-registry-users/16-authentication-failed.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-add-registry-users/16-authentication-failed.png new file mode 100644 index 0000000000..2caf104f2c Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-add-registry-users/16-authentication-failed.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-authentication-setup/01-edit-registry.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-authentication-setup/01-edit-registry.png new file mode 100644 index 0000000000..01f23997ce Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-authentication-setup/01-edit-registry.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-authentication-setup/02-keycloak-role.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-authentication-setup/02-keycloak-role.png new file mode 100644 index 0000000000..dba446557a Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-authentication-setup/02-keycloak-role.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-authentication-setup/03-check-data.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-authentication-setup/03-check-data.png new file mode 100644 index 0000000000..7640007fb6 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-authentication-setup/03-check-data.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-authentication-setup/04-keycloak-attributes.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-authentication-setup/04-keycloak-attributes.png new file mode 100644 index 0000000000..07cfb78828 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-authentication-setup/04-keycloak-attributes.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-authentication-setup/05-sign-in-with-digital-signature.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-authentication-setup/05-sign-in-with-digital-signature.png new file mode 100644 index 0000000000..7c5ffc5a56 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-authentication-setup/05-sign-in-with-digital-signature.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-authentication-setup/06-sign-in-with-digital-signature.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-authentication-setup/06-sign-in-with-digital-signature.png new file mode 100644 index 0000000000..ba2c84fe0f Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-authentication-setup/06-sign-in-with-digital-signature.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-authentication-setup/07-check-data.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-authentication-setup/07-check-data.png new file mode 100644 index 0000000000..c660c35b94 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-authentication-setup/07-check-data.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-01-backup-name.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-backup-restore/01-backup-name.png similarity index 100% rename from docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-01-backup-name.png rename to docs/ua/modules/registry-develop/images/registry-admin-study/task-backup-restore/01-backup-name.png diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-02-create-merge-request.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-backup-restore/02-create-merge-request.png similarity index 100% rename from docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-02-create-merge-request.png rename to docs/ua/modules/registry-develop/images/registry-admin-study/task-backup-restore/02-create-merge-request.png diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-03-create-form.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-backup-restore/03-create-form.png similarity index 100% rename from docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-03-create-form.png rename to docs/ua/modules/registry-develop/images/registry-admin-study/task-backup-restore/03-create-form.png diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-04-add-file-field.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-backup-restore/04-add-file-field.png similarity index 100% rename from docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-04-add-file-field.png rename to docs/ua/modules/registry-develop/images/registry-admin-study/task-backup-restore/04-add-file-field.png diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-05-form-added.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-backup-restore/05-form-added.png similarity index 100% rename from docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-05-form-added.png rename to docs/ua/modules/registry-develop/images/registry-admin-study/task-backup-restore/05-form-added.png diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-backup-restore/06-01-restore.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-backup-restore/06-01-restore.png new file mode 100644 index 0000000000..428b04c2dc Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-backup-restore/06-01-restore.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-backup-restore/06-02-jenkins.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-backup-restore/06-02-jenkins.png new file mode 100644 index 0000000000..36e6c0293e Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-backup-restore/06-02-jenkins.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-06-restore-pipeline-success.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-backup-restore/06-restore-pipeline-success.png similarity index 100% rename from docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-06-restore-pipeline-success.png rename to docs/ua/modules/registry-develop/images/registry-admin-study/task-backup-restore/06-restore-pipeline-success.png diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-backup-restore/07-cronitor.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-backup-restore/07-cronitor.png new file mode 100644 index 0000000000..ac9e6c5ab4 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-backup-restore/07-cronitor.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-08-configure-backup-pipeline.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-backup-restore/08-configure-backup-pipeline.png similarity index 100% rename from docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-08-configure-backup-pipeline.png rename to docs/ua/modules/registry-develop/images/registry-admin-study/task-backup-restore/08-configure-backup-pipeline.png diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-09-build-triggers.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-backup-restore/09-build-triggers.png similarity index 100% rename from docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-09-build-triggers.png rename to docs/ua/modules/registry-develop/images/registry-admin-study/task-backup-restore/09-build-triggers.png diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-10-started-by-timer.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-backup-restore/10-started-by-timer.png similarity index 100% rename from docs/ua/modules/registry-develop/images/registry-admin-study/task-3/task-3-10-started-by-timer.png rename to docs/ua/modules/registry-develop/images/registry-admin-study/task-backup-restore/10-started-by-timer.png diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-event-logging-kibana/01-index-pattern-step-1.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-event-logging-kibana/01-index-pattern-step-1.png new file mode 100644 index 0000000000..a6bb3a9b32 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-event-logging-kibana/01-index-pattern-step-1.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-event-logging-kibana/02-index-pattern-step-2.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-event-logging-kibana/02-index-pattern-step-2.png new file mode 100644 index 0000000000..8a72ee7255 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-event-logging-kibana/02-index-pattern-step-2.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-event-logging-kibana/03-time-range.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-event-logging-kibana/03-time-range.png new file mode 100644 index 0000000000..5d1f00aa14 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-event-logging-kibana/03-time-range.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-event-logging-kibana/04-add-filters-1.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-event-logging-kibana/04-add-filters-1.png new file mode 100644 index 0000000000..dd4ca48f44 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-event-logging-kibana/04-add-filters-1.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-event-logging-kibana/05-add-filters-2.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-event-logging-kibana/05-add-filters-2.png new file mode 100644 index 0000000000..92732e968c Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-event-logging-kibana/05-add-filters-2.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-event-logging-kibana/06-filter-result.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-event-logging-kibana/06-filter-result.png new file mode 100644 index 0000000000..d9ae88988e Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-event-logging-kibana/06-filter-result.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-event-logging-kibana/07-visualize.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-event-logging-kibana/07-visualize.png new file mode 100644 index 0000000000..90586eb48c Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-event-logging-kibana/07-visualize.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-event-logging-kibana/08-new-visualization.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-event-logging-kibana/08-new-visualization.png new file mode 100644 index 0000000000..cab541fffb Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-event-logging-kibana/08-new-visualization.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-event-logging-kibana/09-search-source.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-event-logging-kibana/09-search-source.png new file mode 100644 index 0000000000..d0d708bd69 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-event-logging-kibana/09-search-source.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-event-logging-kibana/10-visualization-results.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-event-logging-kibana/10-visualization-results.png new file mode 100644 index 0000000000..d2fdccce27 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-event-logging-kibana/10-visualization-results.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-platform-metrics-monitoring-grafana/01-grafana.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-platform-metrics-monitoring-grafana/01-grafana.png new file mode 100644 index 0000000000..c2f28a1399 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-platform-metrics-monitoring-grafana/01-grafana.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-platform-metrics-monitoring-grafana/02-manage-dashboard.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-platform-metrics-monitoring-grafana/02-manage-dashboard.png new file mode 100644 index 0000000000..87eff58881 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-platform-metrics-monitoring-grafana/02-manage-dashboard.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-platform-metrics-monitoring-grafana/03-manage-dashboard.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-platform-metrics-monitoring-grafana/03-manage-dashboard.png new file mode 100644 index 0000000000..8b176125e5 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-platform-metrics-monitoring-grafana/03-manage-dashboard.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-platform-metrics-monitoring-grafana/04-sprint-boot-dashboard.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-platform-metrics-monitoring-grafana/04-sprint-boot-dashboard.png new file mode 100644 index 0000000000..ac3db7e37a Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-platform-metrics-monitoring-grafana/04-sprint-boot-dashboard.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-platform-metrics-monitoring-grafana/05-sprint-boot-dashboard.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-platform-metrics-monitoring-grafana/05-sprint-boot-dashboard.png new file mode 100644 index 0000000000..b198fd7207 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-platform-metrics-monitoring-grafana/05-sprint-boot-dashboard.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-platform-metrics-monitoring-grafana/06-heap-statistics.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-platform-metrics-monitoring-grafana/06-heap-statistics.png new file mode 100644 index 0000000000..8d7b83fd47 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-platform-metrics-monitoring-grafana/06-heap-statistics.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-platform-metrics-monitoring-grafana/07-postgresql-details.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-platform-metrics-monitoring-grafana/07-postgresql-details.png new file mode 100644 index 0000000000..8166fc65b7 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-platform-metrics-monitoring-grafana/07-postgresql-details.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-platform-metrics-monitoring-grafana/08-wal.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-platform-metrics-monitoring-grafana/08-wal.png new file mode 100644 index 0000000000..d64d9709b6 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-platform-metrics-monitoring-grafana/08-wal.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-platform-metrics-monitoring-grafana/09-sign-in-grafana.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-platform-metrics-monitoring-grafana/09-sign-in-grafana.png new file mode 100644 index 0000000000..0e792a45f6 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-platform-metrics-monitoring-grafana/09-sign-in-grafana.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-platform-metrics-monitoring-grafana/10-sign-in-openshift.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-platform-metrics-monitoring-grafana/10-sign-in-openshift.png new file mode 100644 index 0000000000..5a48345fa0 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-platform-metrics-monitoring-grafana/10-sign-in-openshift.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-platform-metrics-monitoring-grafana/11-dashboards.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-platform-metrics-monitoring-grafana/11-dashboards.png new file mode 100644 index 0000000000..037b5ecc86 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-platform-metrics-monitoring-grafana/11-dashboards.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-platform-metrics-monitoring-grafana/12-dashboards.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-platform-metrics-monitoring-grafana/12-dashboards.png new file mode 100644 index 0000000000..e876562815 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-platform-metrics-monitoring-grafana/12-dashboards.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-platform-metrics-monitoring-grafana/13-spring-boot-dashboard.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-platform-metrics-monitoring-grafana/13-spring-boot-dashboard.png new file mode 100644 index 0000000000..989b873953 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-platform-metrics-monitoring-grafana/13-spring-boot-dashboard.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-platform-metrics-monitoring-grafana/14-postgresql-dashboard.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-platform-metrics-monitoring-grafana/14-postgresql-dashboard.png new file mode 100644 index 0000000000..925b7c44a8 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-platform-metrics-monitoring-grafana/14-postgresql-dashboard.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-resources-management/01-check-current state.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-resources-management/01-check-current state.png new file mode 100644 index 0000000000..0cd64747c4 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-resources-management/01-check-current state.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-resources-management/02-check-istio-availability.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-resources-management/02-check-istio-availability.png new file mode 100644 index 0000000000..2d8d1ecd5b Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-resources-management/02-check-istio-availability.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-resources-management/03-registry-resources-editing.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-resources-management/03-registry-resources-editing.png new file mode 100644 index 0000000000..d4c8b4413a Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-resources-management/03-registry-resources-editing.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-resources-management/04-istio-enabled.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-resources-management/04-istio-enabled.png new file mode 100644 index 0000000000..079197bf1c Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-resources-management/04-istio-enabled.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-resources-management/05-change-request-confirming.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-resources-management/05-change-request-confirming.png new file mode 100644 index 0000000000..50a38815fd Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-resources-management/05-change-request-confirming.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-resources-management/06-configuration.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-resources-management/06-configuration.png new file mode 100644 index 0000000000..68f40c5336 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-resources-management/06-configuration.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-resources-management/07-jenkins.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-resources-management/07-jenkins.png new file mode 100644 index 0000000000..956126ae82 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-resources-management/07-jenkins.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-resources-management/08-check-success-status.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-resources-management/08-check-success-status.png new file mode 100644 index 0000000000..9b9d73e550 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-resources-management/08-check-success-status.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-resources-management/09-okd-console.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-resources-management/09-okd-console.png new file mode 100644 index 0000000000..31c39dd221 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-resources-management/09-okd-console.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-resources-management/10-check-containers.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-resources-management/10-check-containers.png new file mode 100644 index 0000000000..58af780b69 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-resources-management/10-check-containers.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-1/task-1-01-registry-version.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-update/01-registry-version.png similarity index 100% rename from docs/ua/modules/registry-develop/images/registry-admin-study/task-1/task-1-01-registry-version.png rename to docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-update/01-registry-version.png diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-1/task-1-02-registry-update-confirm.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-update/02-registry-update-confirm.png similarity index 100% rename from docs/ua/modules/registry-develop/images/registry-admin-study/task-1/task-1-02-registry-update-confirm.png rename to docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-update/02-registry-update-confirm.png diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-1/task-1-03-registry-update-gerrit.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-update/03-registry-update-gerrit.png similarity index 100% rename from docs/ua/modules/registry-develop/images/registry-admin-study/task-1/task-1-03-registry-update-gerrit.png rename to docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-update/03-registry-update-gerrit.png diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-1/task-1-04-jenkins-build-success.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-update/04-jenkins-build-success.png similarity index 100% rename from docs/ua/modules/registry-develop/images/registry-admin-study/task-1/task-1-04-jenkins-build-success.png rename to docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-update/04-jenkins-build-success.png diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-1/task-1-05-okd-machinesets-search.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-update/05-okd-machinesets-search.png similarity index 100% rename from docs/ua/modules/registry-develop/images/registry-admin-study/task-1/task-1-05-okd-machinesets-search.png rename to docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-update/05-okd-machinesets-search.png diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-1/task-1-06-okd-fields.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-update/06-okd-fields.png similarity index 100% rename from docs/ua/modules/registry-develop/images/registry-admin-study/task-1/task-1-06-okd-fields.png rename to docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-update/06-okd-fields.png diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-1/task-1-07-quick-links-gerrit.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-update/07-quick-links-gerrit.png similarity index 100% rename from docs/ua/modules/registry-develop/images/registry-admin-study/task-1/task-1-07-quick-links-gerrit.png rename to docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-update/07-quick-links-gerrit.png diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-1/task-1-08-gerrit-sign-in.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-update/08-gerrit-sign-in.png similarity index 100% rename from docs/ua/modules/registry-develop/images/registry-admin-study/task-1/task-1-08-gerrit-sign-in.png rename to docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-update/08-gerrit-sign-in.png diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-1/task-1-09-gerrit-merged-changes.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-update/09-gerrit-merged-changes.png similarity index 100% rename from docs/ua/modules/registry-develop/images/registry-admin-study/task-1/task-1-09-gerrit-merged-changes.png rename to docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-update/09-gerrit-merged-changes.png diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-1/task-1-10-gerrit-change-update.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-update/10-gerrit-change-update.png similarity index 100% rename from docs/ua/modules/registry-develop/images/registry-admin-study/task-1/task-1-10-gerrit-change-update.png rename to docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-update/10-gerrit-change-update.png diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-1/task-1-11-gerrit-helmfile-location.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-update/11-gerrit-helmfile-location.png similarity index 100% rename from docs/ua/modules/registry-develop/images/registry-admin-study/task-1/task-1-11-gerrit-helmfile-location.png rename to docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-update/11-gerrit-helmfile-location.png diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-1/task-1-12-helmfile-bpms.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-update/12-helmfile-bpms.png similarity index 100% rename from docs/ua/modules/registry-develop/images/registry-admin-study/task-1/task-1-12-helmfile-bpms.png rename to docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-update/12-helmfile-bpms.png diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-1/task-1-13-helmfile-digital-signature-ops.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-update/13-helmfile-digital-signature-ops.png similarity index 100% rename from docs/ua/modules/registry-develop/images/registry-admin-study/task-1/task-1-13-helmfile-digital-signature-ops.png rename to docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-update/13-helmfile-digital-signature-ops.png diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-1/task-1-14-helmfile-registry-regulation-management.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-update/14-helmfile-registry-regulation-management.png similarity index 100% rename from docs/ua/modules/registry-develop/images/registry-admin-study/task-1/task-1-14-helmfile-registry-regulation-management.png rename to docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-update/14-helmfile-registry-regulation-management.png diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-1/task-1-15-okd-pods-project.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-update/15-okd-pods-project.png similarity index 100% rename from docs/ua/modules/registry-develop/images/registry-admin-study/task-1/task-1-15-okd-pods-project.png rename to docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-update/15-okd-pods-project.png diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-1/task-1-16-okd-pods-bpms.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-update/16-okd-pods-bpms.png similarity index 100% rename from docs/ua/modules/registry-develop/images/registry-admin-study/task-1/task-1-16-okd-pods-bpms.png rename to docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-update/16-okd-pods-bpms.png diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-1/task-1-17-okd-pods-bpms-version.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-update/17-okd-pods-bpms-version.png similarity index 100% rename from docs/ua/modules/registry-develop/images/registry-admin-study/task-1/task-1-17-okd-pods-bpms-version.png rename to docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-update/17-okd-pods-bpms-version.png diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-1/task-1-18-task-result.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-update/18-task-result.png similarity index 100% rename from docs/ua/modules/registry-develop/images/registry-admin-study/task-1/task-1-18-task-result.png rename to docs/ua/modules/registry-develop/images/registry-admin-study/task-registry-update/18-task-result.png diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-set-file-upload-restrictions/01-edit-registry.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-set-file-upload-restrictions/01-edit-registry.png new file mode 100644 index 0000000000..361f875f53 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-set-file-upload-restrictions/01-edit-registry.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-set-file-upload-restrictions/02-set-values.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-set-file-upload-restrictions/02-set-values.png new file mode 100644 index 0000000000..09dc3c60f8 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-set-file-upload-restrictions/02-set-values.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-set-file-upload-restrictions/03-check-values.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-set-file-upload-restrictions/03-check-values.png new file mode 100644 index 0000000000..dda0e42765 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-set-file-upload-restrictions/03-check-values.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-set-up-dns-name/01-edit-registry.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-set-up-dns-name/01-edit-registry.png new file mode 100644 index 0000000000..92fb168be9 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-set-up-dns-name/01-edit-registry.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-set-up-dns-name/02-update-request.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-set-up-dns-name/02-update-request.png new file mode 100644 index 0000000000..50fa2876c4 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-set-up-dns-name/02-update-request.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-set-up-dns-name/03-openshift-console.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-set-up-dns-name/03-openshift-console.png new file mode 100644 index 0000000000..5a725a8e9e Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-set-up-dns-name/03-openshift-console.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin-study/task-set-up-dns-name/04-user-portal.png b/docs/ua/modules/registry-develop/images/registry-admin-study/task-set-up-dns-name/04-user-portal.png new file mode 100644 index 0000000000..f46d0bc14b Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin-study/task-set-up-dns-name/04-user-portal.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/admin-portal/version-control/regulations-integrity/regulations-integrity-1.png b/docs/ua/modules/registry-develop/images/registry-admin/admin-portal/version-control/regulations-integrity/regulations-integrity-1.png new file mode 100644 index 0000000000..fd125d792c Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin/admin-portal/version-control/regulations-integrity/regulations-integrity-1.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/admin-portal/version-control/regulations-integrity/regulations-integrity-2.png b/docs/ua/modules/registry-develop/images/registry-admin/admin-portal/version-control/regulations-integrity/regulations-integrity-2.png new file mode 100644 index 0000000000..70a2eb7a0a Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin/admin-portal/version-control/regulations-integrity/regulations-integrity-2.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/admin-portal/version-control/regulations-integrity/regulations-integrity-3.png b/docs/ua/modules/registry-develop/images/registry-admin/admin-portal/version-control/regulations-integrity/regulations-integrity-3.png new file mode 100644 index 0000000000..4b76419f0e Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin/admin-portal/version-control/regulations-integrity/regulations-integrity-3.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/admin-portal/version-control/regulations-integrity/regulations-integrity-4.png b/docs/ua/modules/registry-develop/images/registry-admin/admin-portal/version-control/regulations-integrity/regulations-integrity-4.png new file mode 100644 index 0000000000..8ee63ab0bd Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin/admin-portal/version-control/regulations-integrity/regulations-integrity-4.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/admin-portal/version-control/regulations-integrity/regulations-integrity-5.png b/docs/ua/modules/registry-develop/images/registry-admin/admin-portal/version-control/regulations-integrity/regulations-integrity-5.png new file mode 100644 index 0000000000..ecb3cf7493 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin/admin-portal/version-control/regulations-integrity/regulations-integrity-5.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/admin-portal/version-control/regulations-integrity/regulations-integrity-6.png b/docs/ua/modules/registry-develop/images/registry-admin/admin-portal/version-control/regulations-integrity/regulations-integrity-6.png new file mode 100644 index 0000000000..f2edf311b9 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin/admin-portal/version-control/regulations-integrity/regulations-integrity-6.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/api-rate-limits/Rate-limit-configuration.drawio.png b/docs/ua/modules/registry-develop/images/registry-admin/api-rate-limits/Rate-limit-configuration.drawio.png index f43b0c611e..ba2402b529 100644 Binary files a/docs/ua/modules/registry-develop/images/registry-admin/api-rate-limits/Rate-limit-configuration.drawio.png and b/docs/ua/modules/registry-develop/images/registry-admin/api-rate-limits/Rate-limit-configuration.drawio.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/auth-setup/registry-federation/01-registry-federation.png b/docs/ua/modules/registry-develop/images/registry-admin/auth-setup/registry-federation/01-registry-federation.png new file mode 100644 index 0000000000..c058beca3c Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin/auth-setup/registry-federation/01-registry-federation.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/auth-setup/registry-federation/02-registry-federation.png b/docs/ua/modules/registry-develop/images/registry-admin/auth-setup/registry-federation/02-registry-federation.png new file mode 100644 index 0000000000..b29b22b796 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin/auth-setup/registry-federation/02-registry-federation.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/auth-setup/registry-federation/03-registry-federation.png b/docs/ua/modules/registry-develop/images/registry-admin/auth-setup/registry-federation/03-registry-federation.png new file mode 100644 index 0000000000..da59928b5c Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin/auth-setup/registry-federation/03-registry-federation.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/auth-setup/registry-federation/04-registry-federation.png b/docs/ua/modules/registry-develop/images/registry-admin/auth-setup/registry-federation/04-registry-federation.png new file mode 100644 index 0000000000..8a9cea29c5 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin/auth-setup/registry-federation/04-registry-federation.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/auth-setup/registry-federation/05-registry-federation.png b/docs/ua/modules/registry-develop/images/registry-admin/auth-setup/registry-federation/05-registry-federation.png new file mode 100644 index 0000000000..307f41fe09 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin/auth-setup/registry-federation/05-registry-federation.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/auth-setup/registry-federation/06-registry-federation.png b/docs/ua/modules/registry-develop/images/registry-admin/auth-setup/registry-federation/06-registry-federation.png new file mode 100644 index 0000000000..6aa2c882a1 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin/auth-setup/registry-federation/06-registry-federation.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/auth-setup/registry-federation/07-registry-federation.png b/docs/ua/modules/registry-develop/images/registry-admin/auth-setup/registry-federation/07-registry-federation.png new file mode 100644 index 0000000000..994bd13ca6 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin/auth-setup/registry-federation/07-registry-federation.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/auth-setup/registry-federation/08-registry-federation.png b/docs/ua/modules/registry-develop/images/registry-admin/auth-setup/registry-federation/08-registry-federation.png new file mode 100644 index 0000000000..3336564a3a Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin/auth-setup/registry-federation/08-registry-federation.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/auth-setup/registry-federation/09-registry-federation.png b/docs/ua/modules/registry-develop/images/registry-admin/auth-setup/registry-federation/09-registry-federation.png new file mode 100644 index 0000000000..a4db175cca Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin/auth-setup/registry-federation/09-registry-federation.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/auth-setup/registry-federation/10-registry-federation.png b/docs/ua/modules/registry-develop/images/registry-admin/auth-setup/registry-federation/10-registry-federation.png new file mode 100644 index 0000000000..de62f10b3c Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin/auth-setup/registry-federation/10-registry-federation.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/auth-setup/registry-federation/11-registry-federation.png b/docs/ua/modules/registry-develop/images/registry-admin/auth-setup/registry-federation/11-registry-federation.png new file mode 100644 index 0000000000..e2cb0193f3 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin/auth-setup/registry-federation/11-registry-federation.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/auth-setup/registry-federation/12-registry-federation.png b/docs/ua/modules/registry-develop/images/registry-admin/auth-setup/registry-federation/12-registry-federation.png new file mode 100644 index 0000000000..4158b6c7e1 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin/auth-setup/registry-federation/12-registry-federation.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/auth-setup/registry-federation/13-registry-federation.png b/docs/ua/modules/registry-develop/images/registry-admin/auth-setup/registry-federation/13-registry-federation.png new file mode 100644 index 0000000000..97da373ed9 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin/auth-setup/registry-federation/13-registry-federation.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/auth-setup/registry-federation/14-registry-federation.png b/docs/ua/modules/registry-develop/images/registry-admin/auth-setup/registry-federation/14-registry-federation.png new file mode 100644 index 0000000000..6418749fec Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin/auth-setup/registry-federation/14-registry-federation.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/auth-setup/registry-federation/15-registry-federation.png b/docs/ua/modules/registry-develop/images/registry-admin/auth-setup/registry-federation/15-registry-federation.png new file mode 100644 index 0000000000..37827eff41 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin/auth-setup/registry-federation/15-registry-federation.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/auth-setup/registry-federation/16-registry-federation.png b/docs/ua/modules/registry-develop/images/registry-admin/auth-setup/registry-federation/16-registry-federation.png new file mode 100644 index 0000000000..e2f2a9cf18 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin/auth-setup/registry-federation/16-registry-federation.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/auth-setup/registry-federation/17-registry-federation.png b/docs/ua/modules/registry-develop/images/registry-admin/auth-setup/registry-federation/17-registry-federation.png new file mode 100644 index 0000000000..b2f4e4c0c1 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin/auth-setup/registry-federation/17-registry-federation.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/auth-setup/registry-federation/18-registry-federation.png b/docs/ua/modules/registry-develop/images/registry-admin/auth-setup/registry-federation/18-registry-federation.png new file mode 100644 index 0000000000..75ba7be000 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin/auth-setup/registry-federation/18-registry-federation.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/config-smtp-server/config-smtp-server-03-ua.png b/docs/ua/modules/registry-develop/images/registry-admin/config-smtp-server/config-smtp-server-03-ua.png new file mode 100644 index 0000000000..f50c127b19 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin/config-smtp-server/config-smtp-server-03-ua.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/config-smtp-server/config-smtp-server-03.png b/docs/ua/modules/registry-develop/images/registry-admin/config-smtp-server/config-smtp-server-03.png deleted file mode 100644 index 1d92350d21..0000000000 Binary files a/docs/ua/modules/registry-develop/images/registry-admin/config-smtp-server/config-smtp-server-03.png and /dev/null differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/config-smtp-server/config-smtp-server-04-ua.png b/docs/ua/modules/registry-develop/images/registry-admin/config-smtp-server/config-smtp-server-04-ua.png new file mode 100644 index 0000000000..d2b87d646e Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin/config-smtp-server/config-smtp-server-04-ua.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/config-smtp-server/config-smtp-server-04.png b/docs/ua/modules/registry-develop/images/registry-admin/config-smtp-server/config-smtp-server-04.png deleted file mode 100644 index fa430e530d..0000000000 Binary files a/docs/ua/modules/registry-develop/images/registry-admin/config-smtp-server/config-smtp-server-04.png and /dev/null differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/cp-auth-setup-citizens/cp-auth-setup-citizens-01.png b/docs/ua/modules/registry-develop/images/registry-admin/cp-auth-setup-citizens/cp-auth-setup-citizens-01.png new file mode 100644 index 0000000000..7f19ecefe3 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin/cp-auth-setup-citizens/cp-auth-setup-citizens-01.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/cp-auth-setup-citizens/cp-auth-setup-citizens-02.png b/docs/ua/modules/registry-develop/images/registry-admin/cp-auth-setup-citizens/cp-auth-setup-citizens-02.png new file mode 100644 index 0000000000..bdfc687f30 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin/cp-auth-setup-citizens/cp-auth-setup-citizens-02.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/cp-auth-setup-citizens/cp-auth-setup-citizens-03.png b/docs/ua/modules/registry-develop/images/registry-admin/cp-auth-setup-citizens/cp-auth-setup-citizens-03.png new file mode 100644 index 0000000000..7c738ef86d Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin/cp-auth-setup-citizens/cp-auth-setup-citizens-03.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/cp-auth-setup-citizens/cp-auth-setup-citizens-04.png b/docs/ua/modules/registry-develop/images/registry-admin/cp-auth-setup-citizens/cp-auth-setup-citizens-04.png new file mode 100644 index 0000000000..b6ac8cdf9c Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin/cp-auth-setup-citizens/cp-auth-setup-citizens-04.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/cp-auth-setup-citizens/cp-auth-setup-citizens-05.png b/docs/ua/modules/registry-develop/images/registry-admin/cp-auth-setup-citizens/cp-auth-setup-citizens-05.png new file mode 100644 index 0000000000..411effa5d1 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin/cp-auth-setup-citizens/cp-auth-setup-citizens-05.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/cp-auth-setup-citizens/cp-auth-setup-citizens-06.png b/docs/ua/modules/registry-develop/images/registry-admin/cp-auth-setup-citizens/cp-auth-setup-citizens-06.png new file mode 100644 index 0000000000..bed89d5715 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin/cp-auth-setup-citizens/cp-auth-setup-citizens-06.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/cp-auth-setup-citizens/cp-auth-setup-citizens-07.png b/docs/ua/modules/registry-develop/images/registry-admin/cp-auth-setup-citizens/cp-auth-setup-citizens-07.png new file mode 100644 index 0000000000..90508e23cf Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin/cp-auth-setup-citizens/cp-auth-setup-citizens-07.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/cp-auth-setup-citizens/cp-auth-setup-citizens-08.png b/docs/ua/modules/registry-develop/images/registry-admin/cp-auth-setup-citizens/cp-auth-setup-citizens-08.png new file mode 100644 index 0000000000..1525a5082c Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin/cp-auth-setup-citizens/cp-auth-setup-citizens-08.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/cp-auth-setup-citizens/cp-auth-setup-citizens-09.png b/docs/ua/modules/registry-develop/images/registry-admin/cp-auth-setup-citizens/cp-auth-setup-citizens-09.png new file mode 100644 index 0000000000..1a1b4b7a2b Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin/cp-auth-setup-citizens/cp-auth-setup-citizens-09.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/cp-auth-setup-officers/self-registration/cp-officer-self-register-1.png b/docs/ua/modules/registry-develop/images/registry-admin/cp-auth-setup-officers/self-registration/cp-officer-self-register-1.png deleted file mode 100644 index 39ee3ef285..0000000000 Binary files a/docs/ua/modules/registry-develop/images/registry-admin/cp-auth-setup-officers/self-registration/cp-officer-self-register-1.png and /dev/null differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/cp-auth-setup-officers/self-registration/cp-officer-self-register-ua-1.png b/docs/ua/modules/registry-develop/images/registry-admin/cp-auth-setup-officers/self-registration/cp-officer-self-register-ua-1.png new file mode 100644 index 0000000000..481b5f0ebc Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin/cp-auth-setup-officers/self-registration/cp-officer-self-register-ua-1.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-10.png b/docs/ua/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-10.png new file mode 100644 index 0000000000..6f856b421c Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-10.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-11-1.png b/docs/ua/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-11-1.png new file mode 100644 index 0000000000..6202df1ed9 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-11-1.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-11-2.png b/docs/ua/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-11-2.png new file mode 100644 index 0000000000..cbbcebab13 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-11-2.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-11.png b/docs/ua/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-11.png new file mode 100644 index 0000000000..c5998ec3aa Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-11.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-5.png b/docs/ua/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-5.png new file mode 100644 index 0000000000..2b6c612fff Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-5.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-6-1.png b/docs/ua/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-6-1.png new file mode 100644 index 0000000000..13aafa0fe9 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-6-1.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-6.png b/docs/ua/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-6.png new file mode 100644 index 0000000000..1129a2eeed Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-6.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-7-1.png b/docs/ua/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-7-1.png new file mode 100644 index 0000000000..73183786c2 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-7-1.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-7-2.png b/docs/ua/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-7-2.png new file mode 100644 index 0000000000..f9e19611b3 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-7-2.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-7.png b/docs/ua/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-7.png new file mode 100644 index 0000000000..cda969b13d Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-7.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-8.png b/docs/ua/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-8.png new file mode 100644 index 0000000000..a885fcd65d Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-8.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-9.png b/docs/ua/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-9.png new file mode 100644 index 0000000000..3a4e902790 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin/external-integration/api-publish/public-api/expose-public-api-9.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/import-users(officer)/import-users(officer).jpg b/docs/ua/modules/registry-develop/images/registry-admin/import-users(officer)/import-users(officer).jpg deleted file mode 100644 index 8c68bd0f19..0000000000 Binary files a/docs/ua/modules/registry-develop/images/registry-admin/import-users(officer)/import-users(officer).jpg and /dev/null differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/import-users(officer)/import-users-officer.svg b/docs/ua/modules/registry-develop/images/registry-admin/import-users(officer)/import-users-officer.svg new file mode 100644 index 0000000000..ee7b51ec09 --- /dev/null +++ b/docs/ua/modules/registry-develop/images/registry-admin/import-users(officer)/import-users-officer.svg @@ -0,0 +1,4 @@ + + + +
Імпорт користувачів через файл
Імпорт користувачів через файл
Адміністратор регламенту виконує бізнес-процес імпорту користувачів в Адміністративному порталі
Адміністратор регламенту виконує бізнес-процес імпорту користувачів в Адміністративному порталі
Адміністратор додає файл із користувачами
Адміністратор додає файл із користувачами
Виконується валідація файлу
Виконується валідація файлу
Ні
Ні
Так
Так
Формат файлу *.csv?
Формат файлу *.csv?
Помилка: Невідповідний формат файлу
Помилка: Невідповідний формат файлу
Так
Так
Ні
Ні
Розмір файлу НЕ перевищує 30 МБ?
Розмір файлу НЕ перевищує 30 МБ?
Ні
Ні
Так
Так
Кодування файлу UTF-8?
Кодування файлу UTF-8?
Помилка: Файл занадто великого розміру
Помилка: Файл занадто великого розміру
Помилка: Файл невідповідного кодування
Помилка: Файл невідповідного кодування
Виконується валідація даних файлу
Виконується валідація даних файлу
Так
Так
Ні
Ні
Хоча б одне 
з обов'язкових полів порожнє 
або складається лише з пробілів
 або має кілька значень через кому
замість одного?
Хоча б одне...
Помилка про відсутність обов'язкового атрибута
Помилка про відсутність обов'язкового атрибута
Так
Так
Ні
Ні
Поле edrpou містить недопустимі 
символи (не цифри)?
Поле edrpou містить недопустимі...
Помилка про присутність неприпустимих символів
Помилка про присутність неприпустимих символів
Ні
Ні
Так
Так
Вказані ролі є у переліку 
наявних ролей у Keycloak?
Вказані ролі є у переліку...
Помилка про відсутність вказаної ролі
Помилка про відсутність вказаної ролі
Ні
Ні
Так
Так
Структура файлу відповідає заданій?
Структура файлу відповідає заданій?
Помилка про невідповідність 
файлу заданій структурі
Помилка про невідповідність...
Ні
Ні
Так
Так
Користувач із таким username
й атрибутами (drfo, edrpou, fullName)
вже є у Keycloak?
Користувач із таким username...
Ні
Ні
Так
Так
Користувач із таким username, 
але з іншими атрибутами 
вже є у Keycloak?
Користувач із таким username,...
Ні
Ні
Так
Так
Користувач із такими атрибутами, 
але з іншим username вже є у Keycloak?
Користувач із такими атрибутами,...
Ні
Ні
Так
Так
Користувач із такими атрибутами 
вже зустрівся раніше у CSV-файлі?
Користувач із такими атрибутами...
Виконується процес імпорту користувачів
Виконується процес імпорту користувачів
Користувач пропускається, запис із відповідною причиною фіксується в логах Kibana (Skipped)
Користувач пропускається, запис із відповідною причиною фіксується в логах Kibana (Skipped)
Ні
Ні
Так
Так
У процесі імпорту виникла 
помилка в Keycloak?
У процесі імпорту виникла...
Фіксується запис про успішну обробку загальної кількості користувачів у логах Kibana (Successfully imported)
Фіксується запис про успішну обробку загальної кількості користувачів у логах Kibana (Successfully imported)
Записи користувачів, що були успішно оброблені, додаються до системи Keycloak
Записи користувачів, що були успішно оброблені, додаються до системи Keycloak
Процес імпорту користувачів успішно завершено
Процес імпорту користувачів успішно завершено
Користувач пропускається, запис із відповідною причиною фіксується в логах Kibana (Failed to import)
Користувач пропускається, запис із відповідною причиною фіксується в логах Kibana (Failed to import)
Записи користувачів із помилками Failed to import та Skipped не додаються до системи Keycloak
Записи користувачів із помилками Failed to import та Skipped не додаються до системи Keycloak
Процес імпорту користувачів не виконується
Процес імпорту користувачів не виконується Text is not SVG - cannot display \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/images/registry-admin/regulations-deploy/idempotant-deployment/idempotant-deployment-1.png b/docs/ua/modules/registry-develop/images/registry-admin/regulations-deploy/idempotant-deployment/idempotant-deployment-1.png new file mode 100644 index 0000000000..1a6c256593 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin/regulations-deploy/idempotant-deployment/idempotant-deployment-1.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/regulations-deploy/idempotant-deployment/idempotant-deployment-2.png b/docs/ua/modules/registry-develop/images/registry-admin/regulations-deploy/idempotant-deployment/idempotant-deployment-2.png new file mode 100644 index 0000000000..ab7ae81e83 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin/regulations-deploy/idempotant-deployment/idempotant-deployment-2.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/regulations-deploy/idempotant-deployment/idempotant-deployment-3.png b/docs/ua/modules/registry-develop/images/registry-admin/regulations-deploy/idempotant-deployment/idempotant-deployment-3.png new file mode 100644 index 0000000000..eef659834b Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin/regulations-deploy/idempotant-deployment/idempotant-deployment-3.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/regulations-deploy/idempotant-deployment/idempotant-deployment-4.png b/docs/ua/modules/registry-develop/images/registry-admin/regulations-deploy/idempotant-deployment/idempotant-deployment-4.png new file mode 100644 index 0000000000..e4cd50abf3 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin/regulations-deploy/idempotant-deployment/idempotant-deployment-4.png differ diff --git a/docs/ua/modules/registry-develop/images/registry-admin/regulations-deploy/idempotant-deployment/idempotant-deployment-5.png b/docs/ua/modules/registry-develop/images/registry-admin/regulations-deploy/idempotant-deployment/idempotant-deployment-5.png new file mode 100644 index 0000000000..173640bfcf Binary files /dev/null and b/docs/ua/modules/registry-develop/images/registry-admin/regulations-deploy/idempotant-deployment/idempotant-deployment-5.png differ diff --git a/docs/ua/modules/registry-develop/images/study-project/task-6/dashboard-naming/dashnoard-naming-2-ua.png b/docs/ua/modules/registry-develop/images/study-project/task-6/dashboard-naming/dashnoard-naming-2-ua.png new file mode 100644 index 0000000000..8b60a6803c Binary files /dev/null and b/docs/ua/modules/registry-develop/images/study-project/task-6/dashboard-naming/dashnoard-naming-2-ua.png differ diff --git a/docs/ua/modules/registry-develop/images/study-project/task-6/dashboard-naming/dashnoard-naming-2.png b/docs/ua/modules/registry-develop/images/study-project/task-6/dashboard-naming/dashnoard-naming-2.png deleted file mode 100644 index 8725be3c52..0000000000 Binary files a/docs/ua/modules/registry-develop/images/study-project/task-6/dashboard-naming/dashnoard-naming-2.png and /dev/null differ diff --git a/docs/ua/modules/registry-develop/images/study-project/task-6/dashboard-naming/dashnoard-naming-3-ua.png b/docs/ua/modules/registry-develop/images/study-project/task-6/dashboard-naming/dashnoard-naming-3-ua.png new file mode 100644 index 0000000000..cf28383598 Binary files /dev/null and b/docs/ua/modules/registry-develop/images/study-project/task-6/dashboard-naming/dashnoard-naming-3-ua.png differ diff --git a/docs/ua/modules/registry-develop/images/study-project/task-6/dashboard-naming/dashnoard-naming-3.png b/docs/ua/modules/registry-develop/images/study-project/task-6/dashboard-naming/dashnoard-naming-3.png deleted file mode 100644 index 8ef959e5d1..0000000000 Binary files a/docs/ua/modules/registry-develop/images/study-project/task-6/dashboard-naming/dashnoard-naming-3.png and /dev/null differ diff --git a/docs/ua/modules/registry-develop/images/study-project/task-6/dashboard-naming/dashnoard-naming-4.png b/docs/ua/modules/registry-develop/images/study-project/task-6/dashboard-naming/dashnoard-naming-4.png index 74cfae895b..24462c042c 100644 Binary files a/docs/ua/modules/registry-develop/images/study-project/task-6/dashboard-naming/dashnoard-naming-4.png and b/docs/ua/modules/registry-develop/images/study-project/task-6/dashboard-naming/dashnoard-naming-4.png differ diff --git a/docs/ua/modules/registry-develop/images/study-project/task-6/dashboard-naming/dashnoard-naming-5.png b/docs/ua/modules/registry-develop/images/study-project/task-6/dashboard-naming/dashnoard-naming-5.png index 95b679bc9d..28bf7742e2 100644 Binary files a/docs/ua/modules/registry-develop/images/study-project/task-6/dashboard-naming/dashnoard-naming-5.png and b/docs/ua/modules/registry-develop/images/study-project/task-6/dashboard-naming/dashnoard-naming-5.png differ diff --git a/docs/ua/modules/registry-develop/images/study-project/task-6/task-6-12-01-redash.png b/docs/ua/modules/registry-develop/images/study-project/task-6/task-6-12-01-redash.png new file mode 100644 index 0000000000..66fecf1bce Binary files /dev/null and b/docs/ua/modules/registry-develop/images/study-project/task-6/task-6-12-01-redash.png differ diff --git a/docs/ua/modules/registry-develop/images/study-project/task-6/task-6-12-redash.png b/docs/ua/modules/registry-develop/images/study-project/task-6/task-6-12-redash.png deleted file mode 100644 index 250e1e4146..0000000000 Binary files a/docs/ua/modules/registry-develop/images/study-project/task-6/task-6-12-redash.png and /dev/null differ diff --git a/docs/ua/modules/registry-develop/pages/best-practices/best-practices-overview.adoc b/docs/ua/modules/registry-develop/pages/best-practices/best-practices-overview.adoc index 5d601d0c22..f70ca2c7f9 100644 --- a/docs/ua/modules/registry-develop/pages/best-practices/best-practices-overview.adoc +++ b/docs/ua/modules/registry-develop/pages/best-practices/best-practices-overview.adoc @@ -5,7 +5,7 @@ include::platform:ROOT:partial$admonitions/language-ua.adoc[] -+++Найкращі практики Платформи реєстрів+++ -- це суміш наших внутрішніх знань та досвіду в моделюванні процесів, управлінні реєстрами та розробці регламентів. Ми також інтегруємо знання, засновані на світових тенденціях та порадах від інших розробників. Ці найкращі практики створені з урахуванням потреб команд, що займаються розробкою та супроводом реєстрів, вони відображають наш досвід, отриманий у процесі тісної співпраці з клієнтами та з урахуванням їх побажань. +*_Найкращі практики Платформи реєстрів_* -- це суміш наших внутрішніх знань та досвіду в моделюванні процесів, управлінні реєстрами та розробці регламентів. Ми також інтегруємо знання, засновані на світових тенденціях та порадах від інших розробників. Ці найкращі практики створені з урахуванням потреб команд, що займаються розробкою та супроводом реєстрів, вони відображають наш досвід, отриманий у процесі тісної співпраці з клієнтами та з урахуванням їх побажань. У цих практиках містяться приклади моделювання процесів, рекомендації щодо управління реєстрами, зразки UI-форм для бізнес-процесів, моделі даних, поради щодо налаштування реєстрів та регламенту, а також рекомендації щодо використання інструментів розробника. @@ -19,5 +19,18 @@ include::platform:ROOT:partial$admonitions/language-ua.adoc[] * Самостійна реєстрація користувачів ** xref:registry-develop:best-practices/bp-officer-self-register-auto.adoc[] ** xref:registry-develop:best-practices/bp-officer-self-register-manual.adoc[] +** xref:registry-develop:best-practices/bp-officer-self-register-combined.adoc[] * xref:registry-develop:best-practices/edit-grid-rows-action.adoc[] -* xref:registry-develop:best-practices/bp-upload-edit-file.adoc[] \ No newline at end of file +* xref:registry-develop:best-practices/bp-upload-edit-file.adoc[] +* xref:registry-develop:best-practices/bp-sign-validate-asics-cades.adoc[Перевірка підписаних даних, отриманих зі сторонньої системи] +* xref:registry-develop:best-practices/bp-iban-update.adoc[] +* xref:registry-develop:best-practices/bp-officers-simultaneous-tasks.adoc[] +* xref:registry-develop:best-practices/bp-view-object-creator-editor.adoc[] +* xref:registry-develop:best-practices/bp-and-or-single-table.adoc[] +* xref:registry-develop:best-practices/bp-send-notifications-blacklist.adoc[] +* xref:registry-develop:best-practices/bp-launch-via-url.adoc[] + +=== Референтні приклади UI-форм + +* xref:best-practices/forms/text-field-enter-phone-number.adoc[] +* xref:registry-develop:best-practices/forms/date-time-enter-date.adoc[] \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/pages/best-practices/bp-and-or-single-table.adoc b/docs/ua/modules/registry-develop/pages/best-practices/bp-and-or-single-table.adoc new file mode 100644 index 0000000000..f228a43ec4 --- /dev/null +++ b/docs/ua/modules/registry-develop/pages/best-practices/bp-and-or-single-table.adoc @@ -0,0 +1,515 @@ += Референтний бізнес-процес: управління логічними операторами `AND` та `OR` в рамках однієї таблиці +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +== Проблематика + +У традиційному підході до формування пошукових запитів, параметри об'єднувалися виключно за допомогою логічного оператора `AND`. Це створювало обмеження, оскільки не давало можливості використовувати гнучкіші умови об'єднання параметрів, такі як `OR`. Тепер користувачі можуть обирати між `AND` та `OR`, забезпечуючи гнучкість у порядку застосування цих операторів. + +== Загальний опис + +Моделювальники регламенту мають змогу деталізувати та оптимізувати пошукові запити завдяки тегу *``*. Цей тег є ключовим елементом у створенні більш гнучких і ефективних умов пошуку в базах даних. + +Особливості та можливості тегу ``: + +. *Підтримка різних логічних операторів*: + +* Наразі `` підтримує два основні типи логічних операторів: `AND` та `OR`. +* Це розширення дозволяє створювати складніші та точні умови пошуку, адаптуючи запити до конкретних потреб користувачів. + +. *Гнучкість при моделюванні запитів*: + +* З використанням ``, моделювальники можуть визначити, чи мають умови в таблиці об'єднуватися через `AND` (всі умови повинні бути виконані), або через `OR` (достатньо виконання будь-якої з умов). + +. *Вкладеність та комбінації умов*: + +* Тег дозволяє використовувати вкладені структури, комбінуючи `AND` і `OR` для створення складніших логічних умов. +* Це значно розширює можливості моделювання запитів, дозволяючи враховувати різноманітні сценарії та бізнес-вимоги. + +TIP: Більше про моделювання структур даних із тегом `` читайте на сторінці xref:data-modeling/data/physical-model/sc/operators/logical/manage-logical-operators-and-or.adoc[]. + +== Референтні приклади моделювання регламенту + +Ми розробили референтні приклади моделювання регламенту, зокрема схеми даних, референтний процес та UI-форми до нього, які наочно продемонструють використання функціональності у реєстрах. + +=== Моделювання структур даних + +Розгляньмо референтний приклад критерію пошуку, який демонструє управління логічними операторами `AND` та `OR` у контексті однієї таблиці, використовуючи тег `ext:logicOperator`. + +TIP: Використовуйте ChangeSet із регламенту демо-реєстру. Модель буде доступна за шляхом: _data-model/reference/search-type-or/main.xml_. + +.Референтна XML-схема з використанням `AND` та `OR` +==== +[source,xml] +---- + + + + + + + + + + + + + +---- +==== + +Ця XML-схема використовує вкладені теги `` для моделювання складних умов пошуку в межах однієї таблиці. У цьому прикладі, `OR` використовується для створення двох різних умов пошуку: одна з комбінацією `AND`, що включає поля `name` та `active`, та інша для поля `build_type_id`. + +.Опис таблиці `build_type` +[cols="2,5", options="header"] +|=== +| Стовпець | Опис + +| `name` +| Назва типу будівлі, яка використовується для пошуку з оператором `startsWith`. + +| `active` +| Статус активності типу будівлі, який використовується для точного пошуку з оператором `equal`. + +| `build_type_id` +| Унікальний ідентифікатор типу будівлі, який використовується для точного пошуку з оператором `equal`. +|=== + +У цьому SQL-скрипті ми використовуємо комбінацію логічних операторів `AND` та `OR` для створення складних умов пошуку в таблиці `build_type`. Скрипт виконує пошук за двома різними наборами критеріїв: + +. *Комбінація `AND`*: + +* `name LIKE 'desired_name%'`: шукаємо записи, де назва типу будівлі починається з певної фрази (`desired_name`). Використання оператора `LIKE` з символом відсотка (`%`) дозволяє знаходити всі записи, які починаються з цієї фрази. +* `AND active = true`: Додатково фільтруємо записи, щоб вони відповідали тим, де поле `active` дорівнює `true`, тобто тип будівлі є активним. + +. *Оператор `OR`*: + +* `OR build_type_id = specific_id`: окрім вищевказаних умов, цей запит також включає до вибірки записи, де ідентифікатор типу будівлі (`build_type_id`) точно дорівнює конкретному значенню (`specific_id`). + +Отже, цей запит вибере всі записи, що задовольняють або першій комбінації умов (`AND`), або другій умові (`OR`). Це дозволяє отримати більш гнучкі та цілеспрямовані результати пошуку. + +.SQL-скрипт (пошуковий запит) +==== +[source,sql] +---- +SELECT * FROM build_type +WHERE (name LIKE 'desired_name%' AND active = true) + OR build_type_id = specific_id +---- +==== + +Такий підхід дозволяє здійснити більш точний пошук, наприклад, вибрати всі активні типи будівель із певною назвою або конкретний тип будівлі за його унікальним ідентифікатором. + +=== Довідник типів будівель + +У дата-фабриці, де зберігається довідник _Типів будівель_, ви маєте п'ять різних типів будівель. З цих п'яти типів, перші чотири позначені як активні. Це означає, що при використанні вашого пошукового запита, ви зможете легко ідентифікувати ці чотири активні типи будівель. + +image:best-practices/bp-and-or-single-table/bp-and-or-single-table-02.png[] + +Розглянемо, як це впливає на роботу SQL-скрипта, який ми розглядали вище. + +.SQL-скрипт (пошуковий запит) +==== +[source,sql] +---- +SELECT * FROM build_type +WHERE (name LIKE 'desired_name%' AND active = true) + OR build_type_id = specific_id +---- +==== + +У цьому запиті: + +1. Умова `name LIKE 'desired_name%' AND active = true` дозволить вам вибрати всі активні типи будівель (перші чотири з п'яти), які відповідають певному критерію за назвою. Це може бути корисним для знаходження специфічних активних типів будівель. + +2. Умова `OR build_type_id = specific_id` дає можливість включити в результати пошуку також той тип будівлі, який має відповідний унікальний ідентифікатор (`specific_id`), незалежно від його активності. Це означає, що якщо п'ятий тип будівлі має цей ідентифікатор, він також буде включений у результати пошуку, навіть якщо він не активний. + +Таким чином, ваш пошуковий запит ефективно допомагає управляти та фільтрувати інформацію про типи будівель у вашій дата-фабриці, надаючи гнучкість для отримання даних як про активні, так і про специфічні типи будівель. + +=== Моделювання бізнес-процесу + +[TIP] +==== +[%collapsible] +.Де можна знайти приклад референтного бізнес-процесу? +===== +include::partial$snippets/demo-reg-reference-examples-ua.adoc[] + +Приклад BPMN-схеми процесу буде доступний у регламенті демо-реєстру за пошуком по ключовим словам -- *_reference-search-type-or_*. + +Назви форм ви можете знайти всередині відповідних користувацьких задач (User Task) бізнес-процесу у полі *`Form key`*: + +* _reference-search-type-or-add-new-info-build.json_ +* _reference-search-type-or-sign-act-build.json_ +* _reference-search-type-or-sign-act-build-update.json_ +* _reference-search-type-update-build-info.json_ + +У Кабінеті користувача процес буде доступний у папці *_Референтні бізнес-процеси > Пошук даних в дата-фабриці за типом OR_*. + +image:best-practices/bp-and-or-single-table/bp-and-or-single-table-01.png[] +===== +==== + +.Загальний вигляд бізнес-процесу у Кабінеті адміністратора регламентів +image::best-practices/bp-and-or-single-table/bp-and-or-single-table-2.png[] + +==== Користувацька задача для внесення даних про об'єкт + +На першій користувацькій формі налаштуйте можливість введення даних про об’єкт та вибору типу цього об'єкта з довідника _Типів будівель_. Для цього: + +. Створіть *User Task* та застосуйте шаблон делегата *User Form*. +. У полі *Name* введіть назву задачі. +. В полі *Form key* вкажіть службову назву форми. +. У полі *Assignee* вкажіть `${initiator}`, щоб призначити задачу користувачеві, який ініціював виконання цього бізнес-процесу. + +image:best-practices/bp-and-or-single-table/bp-and-or-single-table-2.png[] + +==== Користувацька задача для підписання даних КЕП + +Створіть користувацьку задачу для підписання даних за допомогою *User Task* та шаблону делегата *Officer Sign Task*. + +. У полі *Name* введіть назву задачі. +. У полі *Form key* вкажіть службову назву форми для підписання даних. +. У полі *Assignee* вкажіть `${initiator}`, щоб призначити задачу користувачеві, який ініціював виконання цього бізнес-процесу. +. У полі *Form data pre-population* вкажіть змінну `${submission('UserTask_AddDataBuildInfo').formData}` для автоматичного заповнення форми даними, що зібрані в попередній користувацькій задачі. + +image:best-practices/bp-and-or-single-table/bp-and-or-single-table-3.png[] + +==== Скрипт підготування даних для запису до БД + +Створіть задачу скриптування (*Script Task*) для підготовки даних до запису у Фабрику даних. + +image:best-practices/bp-and-or-single-table/bp-and-or-single-table-4.png[] + +. У полі *Name* введіть назву задачі. +. Натисніть кнопку *Open script editor* та внесіть наступний скрипт: + +[source,groovy] +---- +def formDataForm = submission('UserTask_SignDataBuildInfo').formData + +def buildTypeId = formDataForm.prop('buildType').prop("buildTypeId").value() + +def data = [:] +data['buildType'] = buildTypeId; +data['buildNumber'] = formDataForm.prop('buildNumber').value() +data['sectionNumber'] = formDataForm.prop('sectionNumber').value() +data['flatNumber'] = formDataForm.prop('flatNumber').value() + +def payload = S(data, 'application/json') +set_transient_variable('payload', payload) +---- + +Цей скрипт забирає дані з попередньої користувацької задачі, формує вихідні дані у форматі JSON і зберігає їх як тимчасову змінну `'payload'`. Використання Groovy дозволяє гнучко маніпулювати даними й підготувати їх для подальшого запису в базу даних. + +Розгляньмо скрипт більш детально: :: + +. *Отримання даних з форми:* ++ +[source,groovy] +---- +def formDataForm = submission('UserTask_SignDataBuildInfo').formData` +---- ++ +Цей рядок витягує дані з форми, які були підписані користувачем на попередній користувацькій задачі (`UserTask_SignDataBuildInfo`). + +. *Витягнення конкретних даних:* ++ +[source,groovy] +---- +def buildTypeId = formDataForm.prop('buildType').prop("buildTypeId").value() +---- ++ +Тут витягується ідентифікатор типу будівлі (`buildTypeId`) з даних форми. + +. *Формування об'єкта даних:* + +* Створюється новий об'єкт `data` типу *Map* (у Groovy це визначається як `[:]`). +* Далі до об'єкта `data` додаються різні властивості, такі як `buildType`, `buildNumber`, `sectionNumber`, `flatNumber`, кожна з яких отримує своє значення з даних форми. + +. *Формування JSON Payload:* ++ +---- +def payload = S(data, 'application/json') +---- ++ +Цей рядок конвертує об'єкт `data` в JSON-рядок, готовий для відправлення або обробки як частина запита до Фабрики даних. + +. *Зберігання даних для використання у подальших задачах:* ++ +---- +set_transient_variable('payload', payload) +---- ++ +Останній рядок зберігає JSON-рядок в тимчасову змінну `payload`, яка може бути використана в подальших задачах або процесах. + +==== Сервісна задача для підписання даних системним ключем + +Для забезпечення безпеки та автентичності даних у вашому бізнес-процесі важливо використовувати сервісну задачу для підписання даних системним ключем. Це можна зробити за допомогою наступних кроків: + +. *Створіть сервісну задачу (Service Task)* та застосуйте шаблон делегата *Digital signature by DSO service*. + +. Налаштуйте параметри задачі: +.. У полі *Name* задайте назву задачі, яка чітко відображає її мету, наприклад: `Підписання даних системним ключем`. +.. Застосуйте шаблон делегата *Digital signature by DSO service*, який забезпечить потрібну функціональність для підписання. +.. У полі *Payload* вкажіть вхідні дані: `${payload}`. Це забезпечує передачу даних, які потребують підписання, у задачу. +.. У полі *X-Access-Token source* вкажіть токен доступу: `${completer('UserTask_SignDataBuildInfo').accessToken}`. Цей токен визначає виконавця останньої користувацької задачі, який має право підписати дані. +.. У полі *Result variable* задайте змінну, яка буде містити результат підписання: `system_signature_key`. Це дозволить зберігати ключ підписання для подальшого використання або перевірки. + ++ +image:best-practices/bp-and-or-single-table/bp-and-or-single-table-5.png[] + +==== Сервісна задача для збереження даних до БД + +Створення сервісної задачі для збереження даних до бази даних в бізнес-процесі вимагає ретельного планування та налаштування. Ось кроки, які необхідно виконати: + +. *Створіть сервісну задачу (Service Task)* та застосуйте шаблон делегата *Create entity in data factory*. + +. *Налаштування задачі:* + +.. У полі *Name* вкажіть назву задачі, що чітко відображає її мету, наприклад, `Збереження даних до БД`. +.. У полі *Resource* вкажіть ресурс або назву ендпоінту для таблиці, куди будуть зберігатися дані. +.. В полі *Payload* введіть дані для створення запису: `${payload}`. Це забезпечить передачу необхідних даних у задачу. +.. У полі *X-Access-Token* вкажіть токен доступу користувача, під яким виконується операція: `${completer('UserTask_SignDataBuildInfo').accessToken}`. Це забезпечить авторизацію користувача при збереженні даних. +.. У полі *X-Digital-Signature source* вкажіть джерело цифрового підпису: `${sign_submission('UserTask_SignDataBuildInfo').signatureDocumentId}`. Це ідентифікує документ із цифровим підписом, який був створений на попередніх етапах. +.. В полі *X-Digital-Signature-Derived source* вкажіть змінну, яка містить ключ цифрового підпису: `${system_signature_key}`. +.. В полі *Result variable* задайте ім'я для змінної, в якій буде зберігатися відповідь від операції збереження, наприклад, `response`. + ++ +image:best-practices/bp-and-or-single-table/bp-and-or-single-table-6.png[] + +==== Користувацька задача для оновлення даних про будівлю + +Для демонстрації можливості відображення усіх активних та неактивних типів будівель у випадку, коли використовуються обидва оператори пошуку – `AND` та `OR`, необхідно створити користувацьку задачу. Виконайте наступні кроки: + +. *Створіть користувацьку задачу (User Task)* та застосуйте шаблон делегата *User Form*. + +. *Налаштування задачі:* + +.. У полі *Name* введіть назву задачі, наприклад, `Оновлення даних про будівлю`. +.. У полі *Form key* вкажіть службову назву форми. Наприклад, `building-type-update-form`, що відповідатиме формі для оновлення даних. +.. У полі *Assignee* вкажіть ім'я користувача, який підписав дані на попередній задачі: `${completer('UserTask_SignDataBuildInfo').userName}`. Це забезпечить, що задачу буде виконувати той же користувач, який брав участь у попередніх етапах процесу. + ++ +image:best-practices/bp-and-or-single-table/bp-and-or-single-table-7.png[] + +==== Користувацька задача для підписання оновлених даних КЕП + +Підписання оновлених даних є важливим етапом у забезпеченні цілісності та автентичності інформації в рамках бізнес-процесу. Виконайте наступні кроки для створення користувацької задачі з використанням форми для підписання даних: + +. *Створіть користувацьку задачу (User Task)* та застосуйте шаблон делегата *Officer Sign Task*. +. *Налаштування параметрів задачі:* + +.. У полі *Name* введіть назву задачі, яка чітко описує її мету. Наприклад, `Підписання оновлених даних`. +.. У полі *Form key* вкажіть службову назву форми для підписання даних. Це може бути, наприклад, `signature-update-form`. +.. У полі *Assignee* вкажіть користувача, який вніс останні оновлення: `${completer('UserTask_UpdateBuildInfo').userName}`. Це забезпечить, що підписання буде виконуватися користувачем, відповідальним за останні зміни. +.. У полі *Form data pre-population* вкажіть змінну: `${submission('UserTask_UpdateBuildInfo').formData}`. Це автоматично заповнить форму підписання необхідними даними. + +image:best-practices/bp-and-or-single-table/bp-and-or-single-table-8.png[] + +==== Скрипт підготування даних для оновлення сутності у БД + +Створіть задачу скриптування (*Script Task*) для підготовки даних до запису у Фабрику даних. + +image:best-practices/bp-and-or-single-table/bp-and-or-single-table-9.png[] + +. У полі *Name* введіть назву задачі. +. Натисніть кнопку *`Open script editor`* та внесіть наступний скрипт: + +[source,groovy] +---- +def formDataForm = submission('UserTask_SignUpdateBuildInfo').formData + +def buildTypeId = formDataForm.prop('buildType').prop("buildTypeId").value() + +def data = [:] +data['buildType'] = buildTypeId; +data['buildNumber'] = formDataForm.prop('buildNumber').value() +data['sectionNumber'] = formDataForm.prop('sectionNumber').value() +data['flatNumber'] = formDataForm.prop('flatNumber').value() +data['autoGeneratedNumber'] = formDataForm.prop('building').prop('autoGeneratedNumber').value() + +def payload = S(data, 'application/json') +set_transient_variable('payload', payload) +---- + +Скрипт ефективно підготовлює дані, забезпечуючи їхню відповідність формату, необхідному для оновлення сутностей у базі даних. + +Розгляньмо цей скрипт більш детально: :: ++ +. Отримує дані з форми, які були заповнені у попередній користувацькій задачі з ідентифікатором `UserTask_SignUpdateBuildInfo`. ++ +[source,groovy] +---- +def formDataForm = submission('UserTask_SignUpdateBuildInfo').formData +---- + +. Витягує конкретне значення `buildTypeId` з отриманих даних форми. `buildTypeId` може бути, наприклад, унікальним ідентифікатором типу будівлі. ++ +[source,groovy] +---- +def buildTypeId = formDataForm.prop('buildType').prop("buildTypeId").value() +---- + +. Створює об'єкт `data`, який є словником (або мапою) у Groovy. Ключами словника є назви полів, а значеннями є дані, витягнуті з форми. Цей об'єкт містить всі необхідні дані для оновлення запису в базі даних. ++ +[source,groovy] +---- +def data = [:] +data['buildType'] = buildTypeId; +data['buildNumber'] = formDataForm.prop('buildNumber').value() +data['sectionNumber'] = formDataForm.prop('sectionNumber').value() +data['flatNumber'] = formDataForm.prop('flatNumber').value() +data['autoGeneratedNumber'] = formDataForm.prop('building').prop('autoGeneratedNumber').value() +---- + +. Наступний рядок конвертує об'єкт `data` у JSON-рядок. `S(data, 'application/json')` є вбудованою функцією в Groovy, яка виконує серіалізацію об'єкта в JSON. ++ +[source,groovy] +---- +def payload = S(data, 'application/json') +---- + +. Останній рядок зберігає JSON-рядок у тимчасову змінну `payload`. Ця змінна потім може бути використана в інших частинах бізнес-процесу, наприклад, у сервісних задачах, які відповідають за взаємодію з базою даних. ++ +[source,groovy] +---- +set_transient_variable('payload', payload) +---- + +==== Сервісна задача для підписання оновлених даних системним ключем + +Сервісна задача для автоматичного підписання оновлених даних системним ключем є важливою частиною забезпечення цілісності та безпеки даних у бізнес-процесі. Щоб налаштувати цю задачу, слід виконати наступні кроки: + +. *Створіть сервісну задачу (Service Task)* та застосуйте шаблон делегата *Digital signature by DSO service*. + +. *Налаштування задачі:* + +.. У полі *Name* введіть назву задачі. Назва має чітко відображати мету задачі, наприклад, `Підписання даних системним ключем`. + +.. У полі *payload* вкажіть змінну `${payload}`, що містить дані для підписання. Це вхідні дані, які були підготовлені попередніми задачами скриптування. + +.. У полі *X-Access-Token source* вкажіть токен виконавця останньої користувацької задачі: `${completer('UserTask_SignUpdateBuildInfo').accessToken}`. Цей токен забезпечить автентифікацію та авторизацію для підписання даних. + +.. У полі *Result variable* вкажіть ім'я змінної, в якій буде збережено ключ підпису, наприклад, `system_signature_key`. + +image:best-practices/bp-and-or-single-table/bp-and-or-single-table-10.png[] + +==== Сервісна задача для оновлення сутності у БД + +Сервісна задача для оновлення сутності в базі даних відіграє ключову роль у процесі оновлення даних, забезпечуючи їхню актуалізацію та синхронізацію. Щоб налаштувати цю задачу, слід виконати наступні кроки: + +. *Створіть сервісну задачу (Service Task)* та застосуйте шаблон делегата *Update entity in data factory*. +. *Налаштування параметрів задачі:* + +.. У полі *Name* введіть назву задачі, яка відображатиме її функцію, наприклад, `Оновлення сутності у БД`. + +.. У полі *Resource* вкажіть назву ендпоінту або ресурсу, де буде відбуватися оновлення сутності. +.. У полі *Resource id* використовуйте `${submission('UserTask_SignUpdateBuildInfo').formData.prop('building').prop('entityId').value()}` для визначення ідентифікатора оновлюваної сутності. + +.. У полі *Payload* введіть `${payload}`. Це забезпечить передачу даних, які необхідно оновити. + +.. У полі *X-Access-Token* зазначте токен доступу користувача: `${completer('UserTask_SignUpdateBuildInfo').accessToken}`. +.. У полях *X-Digital-Signature source* та *X-Digital-Signature-Derived source* вкажіть джерела цифрових підписів. Це забезпечить автентичність та відповідність даних стандартам безпеки. + +.. У полі *Result variable* вкажіть назву змінної для збереження результату, наприклад, `response`. Це дозволить відстежувати результат операції оновлення. + ++ +image:best-practices/bp-and-or-single-table/bp-and-or-single-table-11.png[] + +=== Моделювання UI форм + +==== Створення першої форми для внесення даних про будівлю + +Створення форми для внесення даних про будівлю є першим кроком у реалізації бізнес-процесу в реєстрі. Ця форма дозволяє зібрати інформацію про новий об'єкт, включаючи його тип, номер будинку, корпус/секцію та номер квартири/офісу. + +У демо-реєстрі референтна форма буде доступна за назвою `reference-search-type-or-add-new-info-build`. + +. Створіть UI-форму. + +. *Налаштування текстових полів:* + +* Додайте поля `Номер будинку`, `Корпус/Секція` та `Номер квартири/офісу`. Це текстові поля (компонент *Text Field*), які дозволяють користувачеві ввести відповідну інформацію про будівлю. + ++ +TIP: Детальніше про компонент *Text Field*, читайте на сторінці xref:registry-develop:bp-modeling/forms/components/text-field.adoc[Text Field]. + ++ +image:best-practices/bp-and-or-single-table/bp-and-or-single-table-001.png[] + +. *Конфігурація випадного списку для типу будівлі:* + +.. Додайте поле *Тип будівлі* за допомогою компонента *Select*. Це поле дозволить користувачам вибирати тип будівлі з попередньо визначеного переліку. ++ +TIP: Детальніше про компонент *Select*, читайте на сторінці xref:registry-develop:bp-modeling/forms/components/select/select-overview.adoc[Select]. + +.. На вкладці *Data* налаштуйте параметри для випадного списку: +... У полі *Data Source Type* оберіть `URL`. +... У полі *Data Source URL* вкажіть шлях до критерію пошуку. Наприклад, використовуйте `/api/data-factory/search-build-type-active-or-id`. +... У полі `Search Query Name` вкажіть параметр `name`. +... У полі `Filter Query` введіть `?active=true`, щоб вибирати лише активні типи будівель. +... У полі `Item Template` введіть `{{ item.name }}`, щоб відображати імена типів будівель. + +Ця форма є важливою частиною процесу збору даних та внесення інформації про нові об'єкти в систему. Вона дозволяє користувачам легко вибирати типи будівель із довідника, забезпечуючи точність та зручність введення даних. + +image:best-practices/bp-and-or-single-table/bp-and-or-single-table-002.png[] + +==== Створення форми для підписання даних КЕП + +Створення форми для підписання даних КЕП, внесених на першій формі. + +У демо-реєстрі референтна форма буде доступна за назвою `reference-search-type-or-sign-act-build`. + +Форма складається з усіх полів попередньої форми у "Disabled"-вигляді. + +[CAUTION] +==== +Наполегливо рекомендуємо: :: +При моделюванні UI-форм для підписання даних КЕП, налаштовуйте їх так, щоб користувачі _лише переглядали_ дані, й не могли їх змінювати. Для цього активуйте опцію *Disabled* (*Disable the form input*) на вкладці *Display* для кожного xref:bp-modeling/forms/components/index.adoc[компонента], залученого у моделюванні. +==== + +image:best-practices/bp-and-or-single-table/bp-and-or-single-table-003.png[] + +==== Створення форми для оновлення даних про будівлю + +У процесі роботи над реєстром, форма для оновлення даних про будівлю забезпечує важливу функцію -- вона дозволяє користувачам оновлювати інформацію про об'єкти, включаючи їх тип, використовуючи складні критерії пошуку. У демо-реєстрі форма доступна під назвою `reference-search-type-or-update-build-info`. + +. *Створіть UI-форму.* + +. *Налаштування випадного списку "Будівля":* + +.. Додайте поле *Будівля* з типом за допомогою компонента *Select* для пошуку даних про будівлю, внесених на попередній формі. ++ +TIP: Детальніше про компонент *Select*, читайте на сторінці xref:registry-develop:bp-modeling/forms/components/select/select-overview.adoc[Select]. + +.. Налаштуйте параметри випадного списку на вкладці *Data*: + +... У полі *Data Source Type* оберіть `URL`. +... У полі *Data Source URL* вкажіть шлях до критерію пошуку, наприклад, `/api/data-factory/search-build-acts-with-type`. +... У полі *Limit* вкажіть `100`. +... У полі *Item Template* введіть `Будинок {{ item.buildNumber }}, секція {{ item.sectionNumber }}, квартира/офіс {{ item.flatNumber }}`. + ++ +image:best-practices/bp-and-or-single-table/bp-and-or-single-table-004.png[] + +. *Налаштування випадного списку "Тип будівлі" (Select):* + +.. У полі *Тип будівлі* вкладки `Data`: + +... Для *Data Source Type* оберіть `URL`. +... У полі *Data Source URL* вкажіть шлях до критерію пошуку, наприклад, `/api/data-factory/search-build-type-active-or-id`. +... У полі `Search Query Name` вкажіть `name`. +... У полі `Filter Query` введіть `?buildTypeId={{data.building?.buildType?.buildTypeId}}&active=false`. +... У полі `Limit` вкажіть `100`. +... У полі `Item Template` введіть `{{ item.name }}`. + ++ +image:best-practices/bp-and-or-single-table/bp-and-or-single-table-005.png[] + +Ця форма використовує функціональність логічних операторів `AND` та `OR` для відображення у полі *Тип будівлі* типів, що відповідають двом параметрам: _АБО_ `id` будівлі, створеному після внесення даних на першій формі, _АБО_ статусу будівлі як "неактивний". + +Такий підхід дозволяє користувачам виконувати детальніші та гнучкіші пошукові запити, що значно підвищує зручність роботи з реєстром. + +== Пов'язані сторінки + +* xref:data-modeling/data/physical-model/sc/operators/logical/manage-logical-operators-and-or.adoc[] +* xref:data-modeling/data/physical-model/liquibase-ddm-ext.adoc[] \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/pages/best-practices/bp-iban-update.adoc b/docs/ua/modules/registry-develop/pages/best-practices/bp-iban-update.adoc new file mode 100644 index 0000000000..84fa5f6bef --- /dev/null +++ b/docs/ua/modules/registry-develop/pages/best-practices/bp-iban-update.adoc @@ -0,0 +1,103 @@ += Оновлення сутностей в асинхронному режимі (оновлення IBAN) +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +== Загальний опис + +На цій сторінці представлено приклад асинхронного бізнес-процесу з оновленням сутностей. +Ми розробили референтний процес, щоб допомогти розробникам та моделювальникам регламентів оптимізувати використання асинхронних процесів у Camunda BPM. + +== Моделювання структур даних + +Створіть модель даних реєстру за прикладом нижче. + +. Створіть таблицю та критерій пошуку. ++ +Ця модель даних створює таблицю, а також визначає критерій пошуку. ++ +._Базова модель даних для нашого прикладу_ +[%collapsible] +==== +[source,xml] +---- + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +---- +==== + +== Моделювання бізнес процесу + +.Загальний вигляд бізнес-процесу, який працює в асинхронному режимі +image::best-practices/bp-iban-update/bp-iban-update-1.png[] + +. Створіть стартову подію (*Start event*) та виконайте наступні налаштування для секції *Execution listeners*: ++ +image::best-practices/bp-iban-update/bp-iban-update-2.png[] ++ +[TIP] +==== +Опція *`Script`* дозволяє використати функцію `set_variable()` для збереження змінної `limit`, яка буде використана для обмеження кількості сутностей під часу пошуку у Фабриці даних. +==== + +. Додайте послідовний цикл, всередині якого буде виконуватись асинхронний пошук та обробка партій акаунтів. Використайте *Expanded subprocess* із наступними налаштуваннями у секції *Multi-instance*: ++ +image::best-practices/bp-iban-update/bp-iban-update-3.png[] ++ +Цей приклад використовує максимальне значення *Integer* для налаштування *Loop cardinality*. Цикл завершиться, коли кількість акаунтів, яку буде знайдено у Фабриці даних, стане меншою за встановлений ліміт: ++ +---- +${accountSCResponse.value.responseBody.elements().size() < limit} +---- + +. Створіть стартову подію (*Start event*), яка буде запускатися в асинхронному режимі. Для цього виконайте наступні налаштування у секції *Asynchronous continuations*: ++ +image::best-practices/bp-iban-update/bp-iban-update-4.png[] ++ +Це означає, що після запуску цієї події процес продовжує виконуватися, не очікуючи завершення всіх ітерацій циклу у підпроцесі. + +. Після стартової події додайте сервісну задачу пошуку партії аккаунтів: ++ +image::best-practices/bp-iban-update/bp-iban-update-5.png[] ++ +[TIP] +==== +У цьому процесі для поля *X-Access-Token* використовується токен системного користувача в усіх сервісних задачах, де це необхідно: +---- +${system_user().accessToken} +---- +==== + +. Наступним кроком йде оновлення кожного акаунту з отриманої партії за рахунок послідовного циклу. Дані для циклу передаються у секції *Multi-instance*-підпроцесу у полі *Collection*: ++ +---- +${accountSCResponse.value.responseBody.elements()} +---- +image::best-practices/bp-iban-update/bp-iban-update-6.png[] + diff --git a/docs/ua/modules/registry-develop/pages/best-practices/bp-launch-via-url.adoc b/docs/ua/modules/registry-develop/pages/best-practices/bp-launch-via-url.adoc new file mode 100644 index 0000000000..5902e33243 --- /dev/null +++ b/docs/ua/modules/registry-develop/pages/best-practices/bp-launch-via-url.adoc @@ -0,0 +1,341 @@ += Призначення ролей та запуск бізнес-процесу за прямим посиланням +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +== Загальний опис + +Для ефективного управління доступом користувачів до Кабінетів надавача та отримувача послуг, Платформа підтримує функціональність використання прямих посилань. Ця можливість забезпечує, що навіть неавтентифіковані користувачі можуть успішно пройти процес автореєстрації, отримуючи відповідну роль у реєстрі для доступу до необхідних бізнес-процесів. + +TIP: *_Пряме посилання на бізнес-процес_* -- посилання для запуску бізнес-процесу через `GET`-запит та можливості передачі даних стартової форми у посиланні. + +Основні положення: :: + +* *Використання прямих посилань*: прямі посилання можна сформувати для будь-якого доступного користувачу бізнес-процесу. + +* *Процес надання ролей*: ролі користувачам призначаються через відповідні бізнес-процеси. + +* *Контроль запуску бізнес-процесів*: для уникнення несанкціонованого запуску бізнес-процесів, запуск відбувається через стартову форму з можливістю її автоматичного передзаповнення. + +* *Рекомендація по розробці бізнес-процесів*: рекомендується розробляти бізнес-процеси для зміни ролей як ідемпотентні. + +* *Гнучкість використання*: прямі посилання та процеси онбордингу або самореєстрації можуть застосовуватися як окремо, так і у поєднанні в рамках реєстру, відповідно до встановлених обмежень. + +[TIP] +==== +* *Онбординг отримувачів послуг:* детальніше про процес онбордингу користувачів можна знайти за посиланням: xref:arch:architecture/platform/operational/user-management/citizen-onboarding.adoc[]. + +* *Самостійна реєстрація надавачів послуг:* інформацію про процес самостійної реєстрації надавачів послуг дивіться на сторінках: + +** xref:best-practices/bp-officer-self-register-auto.adoc[] +** xref:best-practices/bp-officer-self-register-manual.adoc[] +==== + +Особливості моделювання процесу: :: + +Моделювальники регламенту мають змогу ефективно передавати ключову інформацію через спеціалізований роут у посиланні для входу в різні Кабінети. Це включає передачу `processKey`, який являє собою назву цільового бізнес-процесу, а також додаткових параметрів (query parameters) в форматі `Base64`. Ці параметри можуть включати призначену роль користувача серед інших важливих деталей. Попри те, що ці параметри не є обов'язковими, вони забезпечують додаткову гнучкість, оскільки автоматично інтегруються на стартову форму відповідного бізнес-процесу, полегшуючи навігацію та персоналізацію взаємодії користувачів з системою. + +NOTE: Різниці у поведінці між кабінетами немає, за винятком методів формування прямих посилань. Опис налаштувань цієї функціональності буде зосереджений на прикладі для надавачів послуг. + +== Референтний приклад бізнес-процесу + +[TIP] +==== +[%collapsible] +.Де можна знайти приклад бізнес-процесу? +===== +include::partial$snippets/demo-reg-reference-examples-ua.adoc[] + +Приклад BPMN-схеми процесу буде доступний у регламенті демо-реєстру за пошуком по ключовим словам -- *_reference-assign-role-officer_ та _reference-assign-role_*. + +Назви форм ви можете знайти всередині відповідних користувацьких задач (User Task) бізнес-процесів у полі *`Form key`*: + +* _reference-assign-role-start-form.json_ +* _reference-role-assigned-info-form.json_ +* _reference-role-not-assigned-error-info-form.json_ + +У Кабінеті користувача бізнес-процес буде доступний у розділі *Доступні послуги* > 📂 _Бізнес-процеси по призначенню ролей через спеціальні посилання_. + +image::best-practices/bp-assign-role-via-url/assign-role-via-url-06.png[] +===== +==== + +.Загальний вигляд референтного бізнес-процесу +image::best-practices/bp-assign-role-via-url/assign-role-via-url-1.png[] + +=== Моделювання стартової події та форми (Start Event) + +Налаштування бізнес-процесу: :: + +Для початку, змоделюйте стартову подію (*Start Event*) вашого бізнес-процесу. Під час розробки бізнес-процесу, на який буде сформовано унікальне посилання, важливо включити використання стартової форми. ++ +. У полі `Form key` введіть службову назву форми -- `reference-assign-role-start-form`. + +. У полі *Initiator* вкажіть `initiator`. Це забезпечить правильну ініціацію процесу. + ++ +image:best-practices/bp-assign-role-via-url/assign-role-via-url-2.png[] + +Налаштування UI-форми: :: +Тепер перейдемо до моделювання стартової форми. Це важливо, адже саме тут будуть передзаповнені певні параметри, такі як роль, що призначається користувачу. ++ +У налаштуваннях компонента *Text Field*, на вкладці *API*, заповніть поле *Property Name* значенням `role`. Цей параметр пізніше буде використано для створення JSON із параметрами "ключ-дані", де ключ відповідає назві компонента, що потрібно передзаповнити, а дані -- це відповідне значення для передзаповнення. + ++ +image:best-practices/bp-assign-role-via-url/assign-role-via-url-01.png[] ++ +image:best-practices/bp-assign-role-via-url/assign-role-via-url-02.png[] + +=== Сервісна задача для отримання системних та реєстрових ролей + +Далі, потрібно отримати визначені ролі користувача із Keycloak. У цьому процесі використовується сервісна задача із застосуванням типового розширення делегата *Get keycloak roles from user*. + +Налаштування сервісної задачі: :: + +- Вкажіть назву задачі. Наприклад, `Отримання системних і реєстрових ролей користувача`. + +Налаштування делегата: :: + +. У полі *Realm* з випадного списку оберіть `Officer` для надавачів послуг або `Citizen` для отримувачів послуг. + +. *Username*: встановіть значення `${initiator}`, таким чином вказавши ініціатора процесу. +. *Role Type*: виберіть тип ролей: `REGISTRY ROLES`, `PLATFORM ROLES`, або `ALL ROLES`. ++ +*Role Type* визначає, які саме ролі користувача повертати -- чи то всі (системні та реєстрові), лише системні, чи лише реєстрові. + +. Вкажіть змінну процесу, куди буде поміщено відповідь (`rolesResponse`), яка буде тимчасовою (transient). + +Такі налаштування дозволяють моделювальникам регламенту гнучко управляти ролями користувачів, використовуючи специфічні для реєстру налаштування. Це включає можливість вибору між системними ролями, що вбудовані в систему, та додатковими реєстровими ролями, що можуть бути визначені моделювальниками. + +image:best-practices/bp-assign-role-via-url/assign-role-via-url-3.png[] + +=== XOR-шлюз та потоки процесу + +Використовуючи XOR-шлюз, ви зможете ефективно змоделювати розгалуження шляху токена. XOR-шлюз використовується для визначення того, чи вже призначена певна роль користувачу на основі даних з URL. + +*Умови розгалуження:* + +. *Альтернативна гілка (роль вже призначена):* + +* Умова виконується, коли користувач вже має призначену роль. +* *Condition* > *Type*: `Expression`. +* *Condition Expression*: ++ +---- +${rolesResponse.value.contains(submission('StartFormData').formData.prop('role').stringValue())} +---- + +* У цьому випадку процес завершується, оскільки роль вже наявна у користувача. + ++ +image:best-practices/bp-assign-role-via-url/assign-role-via-url-4.png[] + +. *Основна гілка (роль ще не призначена):* + +* Умова задовольняється, коли роль ще не призначена користувачу. +* *Condition* > *Type*: `Expression`. +* *Condition Expression*: ++ +---- +${!rolesResponse.value.contains(submission('StartFormData').formData.prop('role').stringValue())} +---- + +* Якщо роль не призначена, потік рухається до наступної скрипт-задачі, де відбувається підготовка до призначення ролей користувачу. + ++ +image:best-practices/bp-assign-role-via-url/assign-role-via-url-5.png[] + +Цей підхід забезпечує гнучке управління ролями в рамках бізнес-процесу, дозволяючи реагувати на зміни в статусі ролей користувача й адаптувати подальші дії відповідно до цих змін. Використання XOR-шлюзу допомагає уникнути зайвих операцій, спрямовуючи процес у правильне річище залежно від наявності чи відсутності вже призначених ролей. + +=== Скрипт для підготування ролей користувача + +. Створіть *Script Task*. +. У полі `Name` вкажіть назву задачі. +. Натисніть кнопку *`Open script editor`* та внесіть скрипт. ++ +image:best-practices/bp-assign-role-via-url/assign-role-via-url-6.png[] ++ +.Скрипт для підготування ролей користувача +[source,groovy] +---- +def rolesList = [] +rolesResponse.each { + rolesList << it +} +def roleFromStartForm = submission('StartFormData').formData.prop('role').stringValue() +rolesList << roleFromStartForm + +rolesList.each { + println "RolesToAdd: " + it +} + +set_transient_variable('rolesToAdd', rolesList) +---- ++ +Цей скрипт забезпечує збір та обробку інформації про ролі, які необхідно додати у контексті бізнес-процесу. Він інтегрує дані як з зовнішнього відповіді, так і з інтерактивної форми, забезпечуючи гнучке управління ролями користувачів у процесі. + +Розгляньмо детально поданий скрипт: :: + +. *Ініціалізація списку ролей*: +* Створюється порожній список `rolesList`, який буде використовуватися для зберігання ролей. + +. *Заповнення списку із відповіді:* +* Виконується ітерація через об'єкт `rolesResponse`, який містить набір ролей. +* Кожна роль із `rolesResponse` додається до `rolesList` за допомогою оператора `<<` (який у Groovy використовується для додавання елементів у список). + +. *Отримання ролі зі стартової форми:* +* Отримується роль `roleFromStartForm` з початкової форми процесу (`StartFormData`), зокрема з властивості `role`. + +. *Додавання отриманої ролі до списку:* +* Додана роль з початкової форми також включається до `rolesList`. + +. *Виведення ролей на екран:* +* Виконується ітерація через `rolesList`, і кожна роль виводиться на екран (або консоль) за допомогою `println`. Це дозволяє побачити, які ролі були додані до списку. + +. *Встановлення змінної процесу:* +* Список ролей `rolesList` зберігається як тимчасова змінна `rolesToAdd`. Це дає можливість використовувати список ролей в інших частинах бізнес-процесу. + +=== Сервісна задача для додавання ролі з URL користувачу + +Далі створіть сервісну задачу (*Service Task*), застосуйте та налаштуйте шаблон делегата для додавання ролей користувачу -- *Save user roles*. + +image:best-practices/bp-assign-role-via-url/assign-role-via-url-7.png[] + +TIP: Детальніше про делегат читайте на сторінці xref:bp-modeling/bp/element-templates/service-task-templates/save-user-roles.adoc[]. + +=== Подія "Помилка" + +Для впровадження належного оброблення помилок у вашому бізнес-процесі, наступним кроком буде налаштування події помилки. Ви також додасте користувацьку задачу з формою для інформування користувачів про помилки. + +. *Створення Error Boundary Event:* + +* У бізнес-процесі створіть елемент *Error Boundary Event*. +* У полі *Code* вкажіть код для виключення (exception): `java.lang.IllegalArgumentException`. Це дозволить визначити специфічну ситуацію помилки, яка може виникнути в процесі. + ++ +image:best-practices/bp-assign-role-via-url/assign-role-via-url-8.png[] + ++ +TIP: Щоб отримати більше інформації про подію "Помилка", перегляньте документацію тут: xref:bp-modeling/bp/bpmn/events/error-event.adoc[]. + +. *Інформування користувачів про помилку:* + +* Розробіть користувацьку задачу з формою для відображення повідомлень про помилки. Це допоможе користувачам зрозуміти, що сталася помилка, і які дії вони можуть вжити для її вирішення. + +. Оброблення неавтентифікованих користувачів:* + +* У випадку, коли користувачі переходять на стартову форму бізнес-процесу за посиланням для неавтентифікованих користувачів, то після автентифікації, система автоматично перенаправляє їх на відповідну стартову форму. + ++ +image:best-practices/bp-assign-role-via-url/assign-role-via-url-03.png[] + + +=== Користувацька задача про успішне набуття ролі користувачем + +Для інформування користувачів про успішне призначення ролі та необхідність повторної автентифікації в Кабінеті, ви можете створити користувацьку задачу (*User Task*) з відповідною формою. + +Застосуйте шаблон делегата *User Form*. + +. У полі Form key вкажіть службову назву форму. +. У полі *Assignee* вкажіть `${initiator}`. Це означає, що задача буде призначена особі, яка ініціювала бізнес-процес. + +image:best-practices/bp-assign-role-via-url/assign-role-via-url-9.png[] + +image:best-practices/bp-assign-role-via-url/assign-role-via-url-04.png[] + +== Формування посилання та відображення у Кабінетах користувачів + +На порталах існує спеціальний маршрут (route), через який можна передати ідентифікатор бізнес-процесу (Business Process, BP) через параметр у посиланні (path parameters) та додаткові дані стартової форми через параметри запита (query parameters). + +=== Шаблони побудови прямих посилань + +.Стандартний шаблон для надавачів послуг +---- +https://officer-portal-./officer/process-list//start-form?data= +---- + +.Стандартний шаблон для отримувачів послуг +---- +https://citizen-portal-./process-list//start-form?data= +---- + +.Пояснення до шаблонів посилань +[cols="2,3", options="header"] +|=== +| Частина URL | Пояснення + +| `https://officer-portal-.[]` +a| * `officer-portal-`/`citizen-portal-` -- стандартний префікс, вказує на Кабінет. +* `` -- змінна, замінюється на назву конкретного реєстру чи системи. +* `` -- змінна, доменне ім'я або піддомен, що використовується. + +| `/officer/process-list//start-form` + +або + +`/process-list//start-form` + +a| * `/officer/process-list/` -- шлях до списку бізнес-процесів для надавачів послуг. ++ +АБО `/process-list/` -- шлях до списку бізнес-процесів для отримувачів послуг. +* `` -- змінна, ключ конкретного бізнес-процесу. +* `/start-form` - шлях до стартової форми бізнес-процесу. + +| `?data=` +a| * `?data=` -- частина URL, ключ для передачі додаткових даних. +* `` -- змінна, дані у форматі `Base64URL`, для автоматичного заповнення полів на стартовій формі. Можуть включати різні параметри. +|=== + +=== Процес кодування даних + +Для формування посилань із параметрами, що передзаповнюють форму, необхідно використовувати кодування `Base64URL`. Це можна зробити за допомогою сторонніх сервісів, наприклад https://www.base64encode.org/[]. + +.JSON із переданою роллю користувача +[source,json] +---- +{"role": "op-role-to-assign-first"} +---- + +.Закодований JSON у `base64URL` +---- +eyJyb2xlIjogIm9wLXJvbGUtdG8tYXNzaWduLWZpcnN0In0 +---- + +NOTE: Рекомендовано обирати формат `Base64URL` при кодуванні. + +image:release-notes:wn-1-9-7/wn-1-9-7-24.png[] + +=== Формування кінцевих посилань (на прикладі бізнес-процесу у демо-реєстрі) + +*Стандартне посилання до Кабінету користувача*: `https://officer-portal-./officer/login`. Воно приводить на сторінку логіну. + +При створенні посилання на бізнес-процес із можливістю передзаповнення форми певним параметром необхідно змінити `/login` на: + +* реалм `officer`, `/process-list`, назву бізнес-процесу, стартову форму та додаткові параметри в кодуванні `Base64`. + +У нашому прикладі, щоб передати параметр певної ролі, необхідно сформувати JSON із параметрами ключ-дані, де ключ -- назва компонента (`role`), який необхідно передзаповнити, а дані -- це значення для передзаповнення -- ``, тобто назва ролі. + +Після кодування даних у `Base64URL`, їх необхідно додати до посилання. В результаті, посилання з параметром ролі `op-role-to-assign-first` буде виглядати так: + +[cols="2,3", options="header"] +|=== +| Категорія (Кабінет) | Приклад посилання + +| Для надавачів послуг (officer-portal) +a| `https://officer-portal-{{{registry-name}}}.{{{dns-wildcard}}}/officer/process-list/reference-assign-role-officer/start-form?data=eyJyb2xlIjogIm9wLXJvbGUtdG8tYXNzaWduLWZpcnN0In0` + +| Для отримувачів послуг (citizen-portal) +a| `https://citizen-portal-{{{registry-name}}}.{{{dns-wildcard}}}/process-list/reference-assign-role-officer/start-form?data=eyJyb2xlIjogIm9wLXJvbGUtdG8tYXNzaWduLWZpcnN0In0` +|=== + +image:release-notes:wn-1-9-7/wn-1-9-7-25.png[] + +image:release-notes:wn-1-9-7/wn-1-9-7-26.png[] + +=== Відображення результатів у Кабінеті + +Після переходу за посиланням, користувач бачить форму з інформацією про успішне набуття ролі та необхідність повторної автентифікації. На сторінці *Доступні послуги* відображаються бізнес-процеси, доступні згідно з новою роллю користувача. + +image:best-practices/bp-assign-role-via-url/assign-role-via-url-05.png[] + +Після вказаних дій, користувачу на сторінці *Доступні послуги* відображаються ті бізнес-процеси, які доступні йому згідно з призначеними ролями. + +NOTE: У випадку повторного переходу за посиланням, після виконання процесу, користувача одразу буде перенаправлено на вкладку *Надані послуги*. diff --git a/docs/ua/modules/registry-develop/pages/best-practices/bp-officer-self-register-combined.adoc b/docs/ua/modules/registry-develop/pages/best-practices/bp-officer-self-register-combined.adoc new file mode 100644 index 0000000000..636fd4b904 --- /dev/null +++ b/docs/ua/modules/registry-develop/pages/best-practices/bp-officer-self-register-combined.adoc @@ -0,0 +1,77 @@ += Самостійна реєстрація для надавачів послуг, які автентифікуються з ключем ФОП або юридичної особи +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +== Загальний опис + +Ця сторінка описує комбінований бізнес-процес самореєстрації для посадових осіб, який забезпечує різні підходи залежно від типу ключа, який використовується для автентифікації в Кабінеті користувача. + +Основна мета цього процесу -- автоматизувати процедуру самореєстрації для посадових осіб, які автентифікуються з ключем ФОП або юридичної особи. У такому випадку процес проходить автоматично. Проте, якщо посадова особа автентифікується з ключем фізичної особи (ФО), процес передбачає ручну модерацію. + +Процес побудований як комбінований, на базі двох інших процесів: + +* xref:best-practices/bp-officer-self-register-manual.adoc[] +* xref:best-practices/bp-officer-self-register-auto.adoc[] + +NOTE: Використовуйте цей комбінований бізнес-процес самореєстрації у випадках, коли у вас вже налаштовано відповідні параметри в Control Plane-консолі. Для отримання додаткової інформації щодо цих налаштувань зверніться до розділу xref:registry-admin/cp-auth-setup/officer-portal-access-individual-qes.adoc[]. + +[TIP] +==== +[%collapsible] +.Де можна знайти приклад референтного бізнес-процесу? +===== +include::partial$snippets/demo-reg-reference-examples-ua.adoc[] + +Приклад BPMN-схеми процесу буде доступний у регламенті демо-реєстру за пошуком по ключовим словам -- *_reference-officer-selfregistration-combined-bp_*. Назви форм ви можете знайти всередині відповідних користувацьких задач (User Task) бізнес-процесу у полі *`Form key`*. +===== +==== + +== Моделювання процесу + +Використовує бізнес-процес самостійної реєстрації з ручною модерацією. + +.Загальний вигляд схеми бізнес-процесу з фокусом на основному учаснику +image::best-practices/officer-auto-register/combined-moderation/officer-self-register-combined-3.png[] + +Після Start Event додайте скриптову задачу для перевірки наявності параметра *ЄДРПОУ* в КЕП посадової особи. + +.Приклад скрипту для перевірки +[source,groovy] +---- +set_transient_variable('edrpou', initiator().getEdrpou()) +---- + +image::best-practices/officer-auto-register/combined-moderation/officer-self-register-combined-2.png[] + +Для оптимізації процесу самореєстрації включіть XOR-шлюз з наступними налаштуваннями умов на стрілках: + +. *Автоматична модерація*: якщо в КЕП присутній параметр ЄДРПОУ, користувач направляється на бізнес-процес (БП) самореєстрації з автоматичною модерацією. ++ +[source,groovy] +---- +Condition Expression: `${initiator().edrpou != null}` +---- ++ +.XOR-шлюз +image::best-practices/officer-auto-register/combined-moderation/officer-self-register-combined-1.png[] ++ +.Стрілка умови наявності атрибута `edrpou` в КЕП +image::best-practices/officer-auto-register/combined-moderation/officer-self-register-combined-4.png[] ++ +.Перехід до процесу з автоматичною модерацією +image::best-practices/officer-auto-register/combined-moderation/officer-self-register-combined-5.png[] + +. *Ручна модерація*: на іншій стрілці встановіть умову, що якщо параметр ЄДРПОУ відсутній в КЕП, користувач направляється на БП самореєстрації з ручною модерацією виконаною іншою уповноваженою особою. ++ +.Умова для переходу до процесу з ручною модерацією +[source,groovy] +---- +Condition Expression: `${initiator().edrpou == null}` +---- ++ +Це означає, що обидва БП самореєстрації комбіновані в один загальний процес, на початку якого виконується перевірка на наявність параметра ЄДРПОУ в КЕП посадової особи. ++ +.Стрілка умови відсутності атрибута `edrpou` в КЕП +image::best-practices/officer-auto-register/combined-moderation/officer-self-register-combined-6.png[] ++ +.Перехід до процесу із ручною модерацією +image::best-practices/officer-auto-register/combined-moderation/officer-self-register-combined-7.png[] \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/pages/best-practices/bp-officer-self-register-manual.adoc b/docs/ua/modules/registry-develop/pages/best-practices/bp-officer-self-register-manual.adoc index 4fa5380ced..9d917a834a 100644 --- a/docs/ua/modules/registry-develop/pages/best-practices/bp-officer-self-register-manual.adoc +++ b/docs/ua/modules/registry-develop/pages/best-practices/bp-officer-self-register-manual.adoc @@ -9,7 +9,7 @@ include::platform:ROOT:partial$admonitions/language-ua.adoc[] Бізнес-процес складається з двох пулів, що представляють двох учасників: посадову особу-заявника, яка самореєструється, та модератора, який перевіряє дані. Обмін інформацією між учасниками здійснюється через події повідомлень (*Message events*). -Заявник вводить особисті дані на формі, які надсилаються модератору для перевірки. Модератор має певний час (_тут -- 2 хвилини_) на прийняття рішення, контрольоване таймером (*Timer boundary event*). Якщо рішення не прийнято вчасно, процес іде за альтернативним потоком та завершується, а користувач не реєструється. +Заявник вводить особисті дані на формі, які надсилаються модератору для перевірки. Модератор має певний час (_тут -- 2 хвилини_) на прийняття рішення, контрольоване таймером (*Timer boundary event*). Якщо рішення не прийнято вчасно, процес іде за альтернативним потоком та завершується, а користувач не реєструється і бачить сторінку з інформацією, що час на погодження вийшов. У разі позитивного рішення, дані підписуються КЕП і системним ключем, після чого зберігаються до системної таблиці (_тут_ -- `officer`) бази даних реєстру, відповідно до створеної попередньо моделі даних. Інформація про рішення надсилається заявнику через подію повідомлення. Якщо рішення негативне, процес іде за альтернативним потоком, і користувача не реєструють. @@ -600,6 +600,13 @@ TIP: Детальніше про делегат ви можете перегля image:best-practices/officer-auto-register/manual-moderation/officer-self-register-manual-mod-20.png[] +[TIP] +==== +На формі `selfregistration-success` вказано, що користувачам потрібно виконати повторний вхід, щоб побачити оновлений список бізнес-процесів у доступних послугах. Втім, ми впровадили 2-хвилинний таймер, який дозволяє автоматично оновити інформацію на формі без необхідності повторного входу. Це гарантує, що інформація залишається актуальною, якщо процес погодження виконується швидко, наприклад, протягом вказаних 2 хвилин. + +Однак, якщо час на погодження значно перевищує встановлений у таймері часовий поріг (_наприклад, понад 30 хвилин_), користувач автоматично вважатиметься таким, що "увійшов повторно" при наступному вході на форму, і інформація на ній вже не буде актуальною. У таких випадках ми рекомендуємо не використовувати User Form для повторного входу. Натомість краще змоделювати відправлення нотифікації до inbox Кабінету користувача із результатами погодження реєстрації. Для отримання додаткової інформації та деталей з цього приводу, будь ласка, зверніться до розділу xref:registry-admin/user-notifications/inbox/inbox-bp-notification.adoc[]. +==== + === Встановлення результату виконання та завершення процесу У наступних задачах встановіть результат виконання процесу, використавши для цього сервісну задачу та делегат *Define business process status*, та закінчіть процес подією завершення (*End event*). diff --git a/docs/ua/modules/registry-develop/pages/best-practices/bp-officers-simultaneous-tasks.adoc b/docs/ua/modules/registry-develop/pages/best-practices/bp-officers-simultaneous-tasks.adoc new file mode 100644 index 0000000000..f6439c9cc0 --- /dev/null +++ b/docs/ua/modules/registry-develop/pages/best-practices/bp-officers-simultaneous-tasks.adoc @@ -0,0 +1,700 @@ += Моделювання паралельного виконання задач надавачами послуг із різними ролями +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +== Загальний опис + +Ми розробили референтний приклад бізнес-процесу, який є відмінною ілюстрацією моделювання складних процесів, де залучені посадові особи з різними ролями. Основні аспекти та можливості цього бізнес-процесу включають: + +. *Паралельне виконання задач*: + +* Процес розроблено таким чином, що дозволяє одночасне виконання задач різними посадовими особами. Це забезпечує ефективність та оптимізацію часу, оскільки декілька етапів процесу можуть виконуватися паралельно. + +. *Урахування різного часу на опрацювання задач для різних ролей*: + +* У моделі процесу передбачено, що різні ролі мають різний час для опрацювання своїх задач. Це дозволяє керувати очікуваннями та завданнями відповідно до специфіки кожної ролі. + +. *Надсилання нагадувань про необхідність прийняття задачі для опрацювання*: + +* Для кожної ролі передбачені механізми надсилання нагадувань, коли час на прийняття задачі закінчується. Це забезпечує, що задачі не залишаються без уваги та сприяє своєчасному їх виконанню. + +. *Використання ексклюзивних та паралельних шлюзів*: + +* У процесі використовуються ексклюзивні шлюзи для рішень (_наприклад, погодження чи відхилення заявки_) та паралельні шлюзи для синхронізації потоків процесу. Це забезпечує гнучкість у прийнятті рішень та координацію дій між різними учасниками процесу. + +. *Інтеграція сервісних задач для автоматизації процесів*: + +* Процес включає сервісні задачі для автоматизованого підписання даних, надсилання нагадувань та збереження інформації в базі даних, що підвищує його ефективність та знижує ризик людської помилки. + +== Моделювання бізнес-процесу + +[TIP] +==== +[%collapsible] +.Де можна знайти приклад референтного бізнес-процесу? +===== +include::partial$snippets/demo-reg-reference-examples-ua.adoc[] + +Приклад BPMN-схеми процесу буде доступний у регламенті демо-реєстру за пошуком по ключовим словам -- *_reference-parallel-tasks-officers-diff-rls_*. Назви форм ви можете знайти всередині відповідних користувацьких задач (User Task) бізнес-процесу у полі *`Form key`*. + +У Кабінеті отримувача послуг процес буде доступний користувачам з роллю `cp-reference` у папці *_Референтні бізнес-процеси_*. +===== +==== + +=== Скрипт передзаповнення даних на формі ініціатора + +Бізнес-процес змодельовано таким чином, що для спрощення на формі у його ініціатора (отримувача послуг) автоматично заповнюються дані з його ключа (ПІБ та РНОКПП). Для цього перед користувацькою задачею створіть задачу скриптування для підготовки даних до виведення на форму: + +. Створіть *Script Task*. +. У полі `Name` вкажіть назву задачі. +. Натисніть кнопку *`Open script editor`* та внесіть скрипт. ++ +image:best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-1.png[] ++ +.Groovy-скрипт для передзаповнення даних на формі ініціатора +[source,groovy] +---- +def initiatorData = S([:], 'application/json') +initiatorData.prop('fullName', initiator().fullName) +initiatorData.prop('drfo', initiator().drfo) +set_transient_variable('initiatorData', initiatorData) +---- ++ +Цей скрипт отримує та структурує інформацію про користувача або ініціатора бізнес-процесу, а потім зберігає ці дані для подальшого використання. ++ +Розглянемо скрипт більш детально: :: ++ +-- +.. *Створення об'єкта `initiatorData`*: + +* `S([:], 'application/json')` ініціює новий об'єкт `initiatorData`. `S` -- функція, що створює новий об'єкт, серіалізований як JSON. `[:]` означає порожній словник (або асоціативний масив), що вказує на створення нового об'єкта без початкових значень. + +.. *Заповнення об'єкта `initiatorData` властивостями*: + +* `initiatorData.prop('fullName', initiator().fullName)` встановлює властивість `fullName` для об'єкта `initiatorData`. Це робиться шляхом взяття `fullName` з об'єкта, поверненого функцією `initiator()`. Функція `initiator()` повертає об'єкт, який містить інформацію про особу, яка запустила або ініціювала процес. + +* `initiatorData.prop('drfo', initiator().drfo)` аналогічно встановлює властивість `drfo` для `initiatorData`, використовуючи значення `drfo` з об'єкта, поверненого функцією `initiator()`. + +.. *Збереження `initiatorData` у тимчасову змінну*: + +* `set_transient_variable('initiatorData', initiatorData)` зберігає об'єкт `initiatorData` у тимчасову змінну під назвою `initiatorData`, яка буде використана для тимчасового зберігання даних в рамках поточного процесу. +-- + +=== Користувацька задача для внесення даних + +. Створіть *User Task* та застосуйте шаблон делегата *User Form*. +. У полі *Name* вкажіть назву задачі. +. Вкажіть *ID* задачі: `UserTask_FillInititorData`. Надалі ви зможете використати цей ідентифікатор у процесі. Наприклад, у наступній задачі для підпису даних КЕП. +. У полі *Form key* вкажіть службову назву форми: `reference-create-permission-request`. +. У полі *Assignee* вкажіть користувача, який ініціював виконання цього бізнес-процесу: `${initiator}`. +. У полі *Form data pre-population* вкажіть змінну для використання даних з попередньої задачі скриптування: `${initiatorData}`. + +image:best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-2.png[] + +=== Користувацька задача для підписання даних КЕП + +Створіть користувацьку задачу з використанням форми для підписання даних КЕП. + +. Створіть *User Task* та застосуйте шаблон делегата *Officer Sign Task*. +. У полі *Name* вкажіть назву задачі. +. Вкажіть *ID* задачі: `UserTask_SignInititorData`. + +. У полі *Name* вкажіть назву задачі. +. У полі *Form key* вкажіть службову назву форми для підписання даних КЕП: `reference-sign-permission-request`. +. У полі *Assignee* вкажіть користувача, який ініціював виконання цього бізнес-процесу: `${initiator}`. +. У полі *Form data pre-population* вкажіть дані, якими необхідно передзаповнити форму. Передайте їх через JUEL-функцію `submission()`, вказавши *ID* попередньої користувацької задачі: ++ +---- +${submission('UserTask_FillInititorData').formData}` +---- + +image:best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-3.png[] + +=== Скрипт для відображення даних на формах у надавачів послуг + +Після підписання задачі створена заявка повинна бути одночасно відправлена посадовим особам з різними ролями. Тому наступним кроком буде створення задачі скриптування для подальшого відображення даних на формах у посадових осіб. + +. Створіть *Script Task*. +. У полі `Name` вкажіть назву задачі. +. Натисніть кнопку *`Open script editor`* та внесіть скрипт. ++ +image:best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-4.png[] ++ +.Groovy-скрипт для формування даних +[source,groovy] +---- +def citizenFormData = submission('UserTask_SignInititorData').formData +set_variable('citizenFormData', citizenFormData) +---- ++ +Цей скрипт бере дані, які користувач підписав на попередній задачі, і робить ці дані доступними для подальшого відображення на формах у посадових осіб з різними ролями. Таким чином різні ролі матимуть доступ до одних і тих же даних для різних цілей, наприклад, для перевірки, затвердження, або подальшої обробки. ++ +Розглянемо скрипт більш детально: :: ++ +-- +.. *Зчитування даних форми*: + +* `def citizenFormData = submission('UserTask_SignInititorData').formData`: + +** Цей рядок коду створює змінну `citizenFormData`. +** `submission('UserTask_SignInititorData')` отримує дані із задачі підписання даних користувачем. +** `formData` є властивістю або методом, який повертає дані форми, які були введені або підтверджені на цьому етапі. + +.. *Збереження даних форми у змінну процесу*: + +* `set_variable('citizenFormData', citizenFormData)`: +** Ця команда зберігає дані, взяті з форми, у змінну процесу під назвою `citizenFormData`. +** Таким чином, дані, зібрані на певному етапі процесу, стають доступними для інших етапів або задач в рамках цього ж процесу. +-- + +=== Створення паралельного шлюзу + +Додайте паралельний шлюз, щоб створити два токена доступу. + +image:best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-5.png[] + +[#user-task-officer-first-rank] +=== Користувацька задача для відображення даних посадовій особі з роллю officer-first-rank + +Створіть користувацьку задачу, щоб відобразити дані, внесені ініціатором, посадовій особі з роллю `officer-first-rank`. + +. Створіть *User Task*, застосуйте шаблон *User Form* і забезпечте її належну конфігурацію: + +.. У полі *Name* вкажіть унікальну та описову назву задачі. Ця назва повинна чітко відображати її мету та функцію. +.. У полі *Form key* вкажіть службову назву форми, яка буде використана в цій задачі: `reference-1-st-approve-of-permission-request`. Ця форма буде забезпечувати інтерфейс для відображення даних. + +. Налаштуйте доступ до задачі: + +* У полі *Candidate roles* вкажіть `officer-first-rank`. Це гарантує, що задача буде доступна всім посадовим особам, які мають цю роль. Таким чином, задача потрапляє в чергу цих посадових осіб. + +. Налаштуйте попереднє заповнення даних форми: + +* У полі *Form data pre-population* використайте вираз `${submission('UserTask_SignInititorData').formData}`. Це забезпечить автоматичне заповнення форми даними, які були введені на попередній користувацькій задачі `UserTask_SignInititorData`. Це забезпечує зв'язок між діями ініціатора і цією задачею. + +image:best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-6.png[] + +[#add-timer-user-task] +=== Додавання таймера до користувацької задачі + +Для ефективного управління часом виконання користувацької задачі та забезпечення своєчасної реакції посадових осіб, необхідно додати до задачі не переривальний таймер -- *Timer boundary event (non-interrupting)*. + +. Інтегруйте таймер з вашою користувацькою задачею: + +* Виберіть та прикріпіть таймер до вашої користувацької задачі у діаграмі процесу. Цей таймер буде діяти як не переривальна подія, яка активується після заданого часового інтервалу. + +. Налаштуйте таймер: + +* Оберіть тип таймера зі списку: *Duration*. + +* У полі *Value* встановіть часовий інтервал для таймера. Наприклад, введіть `PT30S`, що вказує на тридцять секунд. Це значення визначає час, протягом якого задача повинна бути почата, перш ніж таймер спрацює. + +. Розуміння поведінки таймера: + +* Якщо задача не була взята в обробку протягом цих 30 секунд, таймер активізує подію, яка надішле нагадування усім посадовим особам з відповідною роллю. Це нагадування буде відправлено до їхньої скриньки вхідних повідомлень у Кабінеті користувача, що забезпечує своєчасну реакцію на задачу. + +Таке додавання таймера забезпечує, що задачі не залишаться без уваги й сприяє швидшому розв'язанню процесу, мінімізуючи затримки у робочому потоці. + +image:best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-7.png[] + +[TIP] +==== +Більш детально із налаштуваннями таймерів ви можете ознайомитися на сторінках: + +* xref:bp-modeling/bp/bpmn/events/timer-event.adoc[] +* xref:best-practices/bp-timer-launch.adoc[] +==== + +[#script-get-info-task-assignment] +=== Скрипт отримання інформації про призначення задачі + +Від таймера створіть задачу скриптування для того, щоб визначити перелік посадових осіб з роллю `officer-first-rank`. + +. Створіть *Script Task*. +. У полі `Name` вкажіть назву задачі. +. Натисніть кнопку *`Open script editor`* та внесіть скрипт. ++ +image:best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-8.png[] ++ +[source,groovy] +---- +def taskService = execution.getProcessEngineServices().getTaskService() +def tasks = taskService.createTaskQuery().taskDefinitionKey('UserTask_DoFirstExclusion').list() +def task = tasks.find{it.getProcessInstanceId().equals(execution.getProcessInstanceId())} +def notifyPayload = [:] +notifyPayload.role = 'officer-first-rank' +notifyPayload.assignee = task.getAssignee() +set_transient_variable('notifyPayload1', S(notifyPayload, 'application/json')) +---- + ++ +Цей скрипт використовується для ідентифікації та підготовки даних для сповіщення посадових осіб з певною роллю (`officer-first-rank`) про задачі, які потребують їх уваги, особливо в контексті задач, пов'язаних з таймером. ++ +Розглянемо скрипт більш детально: :: ++ +-- +.. *Отримання сервісу задач*: + +* `def taskService = execution.getProcessEngineServices().getTaskService()`: Ця команда ініціалізує змінну `taskService`, отримуючи доступ до сервісу задач процесу. Це дає можливість працювати з конкретними задачами в рамках процесу. + +.. *Запит на отримання списку задач*: + +* `def tasks = taskService.createTaskQuery().taskDefinitionKey('UserTask_DoFirstExclusion').list()`: Ця команда створює запит для отримання списку всіх задач з визначеним ключем `UserTask_DoFirstExclusion`. Вона повертає список задач, що відповідають заданому критерію. + +.. *Визначення Конкретної Задачі*: + +* `def task = tasks.find{it.getProcessInstanceId().equals(execution.getProcessInstanceId())}`: Ця команда використовується для пошуку конкретної задачі зі списку, яка належить до поточного екземпляра процесу. `getProcessInstanceId()` порівнюється з ID поточного екземпляра виконання, щоб знайти задачу, пов'язану з цим конкретним екземпляром. + +.. *Створення payload для сповіщення*: + +* `def notifyPayload = [:]`: Ініціалізація порожнього словника (map) для зберігання даних сповіщення. +* `notifyPayload.role = 'officer-first-rank'`: Встановлення ролі, яка буде використана для ідентифікації отримувачів сповіщення. +* `notifyPayload.assignee = task.getAssignee()`: Встановлення відповідальної особи за задачу як одержувача сповіщення. + +.. *Збереження payload як тимчасової змінної*: + +* `set_transient_variable('notifyPayload1', S(notifyPayload, 'application/json'))`: Команда зберігає інформацію про сповіщення (`notifyPayload`) у тимчасову змінну `notifyPayload1`, серіалізуючи її в форматі JSON. Це дозволяє використовувати дані в інших частинах процесу. +-- + +[#call-activity-role-two] +=== Додавання Call Activity для відправлення нагадувань + +У рамках вашого бізнес-процесу потрібно інтегрувати Call Activity для відправлення нагадувань у вигляді вхідних повідомлень до скриньки Кабінету посадовим особам. Ось як ви можете це зробити: + +. Ініціюйте *Call Activity*: + +* Виберіть опцію для створення нової *Call Activity* у вашій діаграмі бізнес-процесу. Це дозволить вам викликати інший залежний підпроцес з вашого поточного процесу. + +. Налаштуйте параметри Call Activity: + +* У полі *Name* вкажіть назву цієї Call Activity, наприклад, `Відправка нагадування посадовим особам`. Ця назва повинна чітко описувати її функцію в контексті бізнес-процесу. +* У полі *Called Element* вкажіть `reference-send-notification-to-user-with-role`. Це значення ідентифікує процес, який буде викликаний і призначений для відправки повідомлень користувачам з певною роллю. + +. Вкажіть дані для входу та виходу: + +* У полі *Input data* вкажіть `${notifyPayload1}`. Це означає, що дані, підготовлені в попередній задачі скриптування та збережені у змінній `notifyPayload1`, будуть передані у викликану активність як вхідні дані. +* У полі *Output variable name* встановіть `output`. Це визначить назву змінної, в якій будуть збережені результати або вихідні дані цієї Call Activity. + +Ці кроки дозволять вам автоматично викликати процес або функцію для відправки нагадувань посадовим особам, заснованих на визначених критеріях та даних, зібраних у попередніх етапах бізнес-процесу. + +image:best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-9.png[] + +==== Моделювання підпроцесу, викликаного з Call Activity + +2.9 Моделювання Підпроцесу, Викликаного з Call Activity + +Для налаштування підпроцесу, який буде викликаний через Call Activity у вашому бізнес-процесі, виконайте наступні кроки: + +. Створіть *Participant* для підпроцесу. Для цього оберіть опцію *Create Pool/Participant*. + +. Налаштування властивостей підпроцесу: + +* У полях *Participant Name* та *Process name* введіть назву задачі Call Activity. Це забезпечує однозначне визначення та асоціацію підпроцесу з відповідною Call Activity у вашому основному процесі. +* У полі *Process ID* вкажіть `reference-send-notification-to-user-with-role`. Це значення ідентифікує конкретний підпроцес, який буде викликатися, і повинно відповідати значенню, зазначеному у властивості *Called Element* вашої Call Activity. + +image:best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-10.png[] + +==== Створення XOR-шлюзу (Exclusive Gateway) + +Для управління потоком рішень у вашому бізнес-процесі, ви можете додати exclusive-шлюз (XOR-шлюз), який дозволить розгалужувати процес на основі певних умов. Ось як це зробити: + +. Додавання Exclusive-шлюзу: + +* Після стартової події у вашому бізнес-процесі додайте Exclusive-шлюз. Цей шлюз служитиме точкою рішення, яка керуватиме потоком процесу на основі заданих умов. + +. Налаштування умов для першої гілки: + +.. Для першої гілки, яка виходить з XOR-шлюзу, встановіть назву гілки, наприклад, "Ні". Це допомагає ідентифікувати шлях рішення в діаграмі бізнес-процесу. + +.. У полі *Condition Expression* цієї гілки встановіть умову `${inputPayload.getValue().prop('assignee').value() == null}`. Ця умова перевіряє, чи порожнє значення змінної `assignee` в `inputPayload`. Якщо `assignee` не має значення (тобто порожнє), це означає, що задача ще не була взята в роботу, і процес повинен іти цією гілкою. + +. Налаштування подальшого потоку процесу: + +* Залежно від результату умови в XOR-шлюзі, процес буде спрямовано відповідною гілкою. Вам потрібно забезпечити, що для кожної з можливих гілок налаштовані відповідні елементи процесу (задачі, події тощо), що відображають логіку вашого бізнес-процесу. + +XOR-шлюз важливий для ефективного управління бізнес-процесами, де рішення базуються на даних або станах, що можуть змінюватися. Він дозволяє створити гнучкі, адаптивні процеси, які можуть реагувати на різні сценарії в робочому потоці. + +image:best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-11.png[] + +==== Налаштування другої гілки XOR-шлюзу + +Після налаштування першої гілки XOR-шлюзу, важливо правильно сконфігурувати другу гілку для забезпечення відповідного потоку процесу. Ось кроки для налаштування другої гілки: + +. Конфігурація умови для другої гілки: + +.. Налаштуйте назву другої гілки, що виходить з XOR-шлюзу, як `Так`. Це дозволяє чітко ідентифікувати шлях рішення, який буде використовуватися, якщо умова задовольняється. + +.. У полі *Condition Expression* цієї гілки встановіть умову `${inputPayload.getValue().prop('assignee').value() != null}`. Ця умова перевіряє, чи має змінна `assignee` у `inputPayload` непорожнє значення. Якщо вона має таке значення, це означає, що задача вже прийнята в обробку, і процес повинен іти цією гілкою. + +. Налаштування логіки завершення для Call Activity: + +* У контексті цієї гілки, якщо умова задовольняється (тобто `assignee` має значення), процес досягає Call Activity, яка буде в цьому випадку завершена. Це означає, що немає потреби в надсиланні нагадувань або інших дій, оскільки задача вже обробляється. + +. Організація потоку процесу: + +* Після налаштування умов на обох гілках XOR-шлюзу, важливо забезпечити, що подальший потік процесу в кожній гілці відповідає очікуваному сценарію. У випадку гілки `Так`, потрібно впевнитися, що процес логічно завершується або переходить до наступної відповідної задачі. + +Це налаштування другої гілки XOR-шлюзу забезпечує, що бізнес-процес може адекватно реагувати на різні стани задач, спрямовуючи потік відповідно до стану обробки задачі. + +image:best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-12.png[] + +==== Створення cервісної задачі для Гілки "Ні" + +Для гілки з назвою "Ні" у вашому бізнес-процесі, необхідно створити сервісну задачу, яка відповідатиме за отримання переліку користувачів з роллю `officer-first-rank`. Ось кроки для налаштування цієї сервісної задачі: + +. Створення сервісної задачі: + +* У контексті гілки "Ні" додайте нову сервісну задачу. Ця задача буде автоматично виконувати дії, необхідні для отримання інформації про користувачів. + +. Налаштування параметрів сервісної задачі: + +.. У полі *Name* вкажіть зрозумілу та відповідну назву для задачі. Назва повинна відображати її функцію, наприклад, `Отримання користувачів з відповідною роллю`. + +.. Застосуйте шаблон делегата *Get users by role from keycloak*. + +.. У полі *Role name (optional)* вкажіть вираз `${inputPayload.getValue().prop('role').value()}`. Це дозволить динамічно отримувати назву ролі (у цьому випадку `officer-first-rank`) із вхідних даних процесу. Такий підхід гнучко адаптується до змін у вхідних даних. +.. У полі *Result variable* вкажіть `officerUsers`. Ця змінна буде використовуватися для зберігання результатів виконання сервісної задачі, тобто переліку користувачів, які мають роль `officer-first-rank`. + +Ця сервісна задача забезпечує автоматизацію процесу отримання інформації про певні групи користувачів, що є важливим для ефективного управління ресурсами та прийняття рішень у рамках бізнес-процесу. + +image:best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-13.png[] + +==== Створення паралельного вбудованого підпроцесу + +Для створення вбудованого підпроцесу, який виконується паралельно, виконайте наступні кроки: + +. Ініціація вбудованого підпроцесу: + +* Створіть новий вбудований підпроцес у вашій діаграмі бізнес-процесу. Вбудований підпроцес є процесом, що виконується в межах більшого процесу, і часто використовується для модулярності та кращої організації процесу. ++ +TIP: Детальніше про вбудований підпроцес див. на сторінці xref:bp-modeling/bp/bpmn/subprocesses/embedded-subprocess.adoc[]. + +. Налаштування типу підпроцесу -- *Паралельний*: + +* За допомогою інструментів моделювання процесу вкажіть, що тип вбудованого підпроцесу -- *Паралельний*. Це означає, що всі шляхи в межах цього підпроцесу будуть виконуватися одночасно. + +. Налаштування параметрів для виконання підпроцесу: + +- У полі *Collection* вкажіть `${officerUsers}`. Це означає, що підпроцес буде ітерувати через колекцію користувачів, яку містить змінна `officerUsers`. Кожна ітерація підпроцесу буде обробляти одного користувача з цієї колекції. +- У полі *Element variable* вкажіть `officer`. Це означає, що поточний елемент колекції `officerUsers` буде доступний всередині кожної ітерації підпроцесу під назвою змінної `officer`. + +image:best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-14.png[] + +==== Налаштування відправлення повідомлень + +У вбудованому підпроцесі налаштуйте відправлення повідомлень користувачам згідно з інструкцією xref:registry-develop:registry-admin/user-notifications/inbox/inbox-bp-notification.adoc[]. + +=== Створення користувацької задачі для підписання даних (1-й висновок) + +Для створення користувацької задачі з метою підписання даних у вашому основному бізнес-процесі, слід виконати наступні кроки: + +. Створення користувацької задачі: + +* В основному бізнес-процесі ініціюйте створення нової користувацької задачі. Це буде інтерактивна задача, що дозволить користувачам виконувати дії з підписання даних КЕП. + +. Налаштування параметрів задачі: + +.. У полі *Name* вкажіть назву задачі. Назва повинна чітко відображати її мету, наприклад, `Підписання даних` або щось схоже, що дозволяє користувачам легко ідентифікувати ціль задачі. + +.. Вкажіть ID задачі. Наприклад, `UserTask_FirstSignInititorData`. + +.. Застосуйте шаблон делегата *Officer Sign Task*. + +.. У полі *Form key* вкажіть службову назву форми, яка буде використана для підписання даних: `reference-sign-1-st-approve-of-permission-request`. Ця назва повинна відповідати формі, що вже існує у вашій системі та призначена для цього типу задачі. +.. У полі *Assignee* вкажіть `${completer('UserTask_DoFirstExclusion').userName}`. Це вираз визначає, що користувачем, якому буде призначена задача, є той, хто завершив попередню задачу `UserTask_DoFirstExclusion`. + +.. У полі *Form data pre-population* вкажіть змінну `${submission('UserTask_DoFirstExclusion').formData}`. Цей вираз означає, що форма буде попередньо заповнена даними, які були введені на формі попередньої задачі `UserTask_DoFirstExclusion`. Це забезпечує послідовність та цілісність даних у процесі. + +Ця користувацька задача дозволяє залучити користувачів до активної участі в процесі та забезпечує необхідний рівень взаємодії для підписання та затвердження документів або даних. + +image:best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-15.png[] + +=== Створення блоку задач для надавачів послуг із другою роллю + +За аналогією до кроків, описаних у наступних розділах, створіть блок задач для посадових осіб із другою роллю -- `officer-second-rank`: + +* xref:#user-task-officer-first-rank[Зробити 1-й висновок] +* xref:#add-timer-user-task[] +* xref:#script-get-info-task-assignment[Отримання інформації про призначення задачі] +* xref:#call-activity-role-two[Call Activity для виклику підпроцесу] + +=== Додавання "збирального" паралельного шлюзу + +У вашому бізнес-процесі, "збиральний" паралельний шлюз використовується для синхронізації двох або більше паралельних шляхів. Ось як його додати та налаштувати: + +. Ініціація паралельного шлюзу: + +* Виберіть місце у вашому бізнес-процесі, де потрібно додати "збиральний" паралельний шлюз. Це повинна бути точка, де паралельні шляхи зустрічаються для того, щоб процес міг продовжити свій потік. + +. Налаштування шлюзу: + +.. Додайте новий елемент шлюзу на вашу діаграму бізнес-процесу і встановіть його тип як паралельний шлюз (*Parallel Gateway*). +.. Назва цього шлюзу не є обов'язковою, але ви можете дати йому описову назву для зручності, наприклад, `Збиральний паралельний шлюз`. + +. Логіка роботи шлюзу: + +* "Збиральний" паралельний шлюз призначений для того, щоб чекати на надходження токенів з усіх паралельних шляхів, які виходять з попереднього паралельного шлюзу. Лише після отримання токенів з усіх цих шляхів процес може продовжити свій рух далі. +* У вашому випадку, шлюз буде чекати, поки обидва токени, створені після першого паралельного шлюзу, досягнуть цього "збирального" шлюзу. Це забезпечує синхронізацію та координацію між різними частинами процесу. + +Додавання "збирального" паралельного шлюзу є важливим для гарантування того, що всі паралельні частини процесу були завершені, перш ніж продовжувати до наступних етапів. Це дозволяє забезпечити узгоджену та контрольовану обробку в складних процесах. + +image:best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-16.png[] + +=== Скрипт для відображення даних на формі з фінальним висновком + +Розробіть скрипт для відображення даних на формі, що використовуватиметься посадовою особою з третьою роллю для фінального розгляду заявки: + +. Створіть *Script Task*. +. У полі `Name` вкажіть назву задачі. +. Натисніть кнопку *`Open script editor`* та внесіть скрипт. ++ +image:best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-17.png[] ++ +.Groovy-скрипт +[source,groovy] +---- +def finalData = S([:], 'application/json') +def firstFormData = submission('UserTask_FirstSignInititorData').formData +def secondFormData = submission('UserTask_SecondSignInititorData').formData + +if (firstFormData) { + finalData.prop('fullName', firstFormData.prop('fullName').value()) + finalData.prop('drfo', firstFormData.prop('drfo').value()) + finalData.prop('organizationEdrpou', firstFormData.prop('organizationEdrpou').value()) + finalData.prop('maxDate', firstFormData.prop('maxDate').value()) +} else { + println '1-st form null' +} + +if (secondFormData) { + finalData.prop('isBranchesExists', secondFormData.prop('isBranchesExists').value()) +} else { + println '2-nd form null' +} + +set_transient_variable('finalData', finalData) +---- ++ +Цей скрипт збирає та об'єднує важливі дані з двох попередніх етапів процесу. Він забезпечує, що всі необхідні дані будуть доступні для використання на наступних етапах, зокрема для фінального розгляду заявки посадовою особою з третьою роллю. Відповідна організація та структурування даних є критично важливими для забезпечення ефективності та точності бізнес-процесів. ++ +Розглянемо скрипт більш детально: :: ++ +-- +.. *Створення JSON-об'єкта `finalData`*: + +* `def finalData = S([:], 'application/json')` ініціює новий JSON-об'єкт `finalData` з порожнім словником. Це означає, що `finalData` буде використовуватись для зберігання даних у форматі JSON. + +.. *Отримання даних з попередніх форм*: + +* `def firstFormData = submission('UserTask_FirstSignInititorData').formData` та `def secondFormData = submission('UserTask_SecondSignInititorData').formData` отримують дані форм з попередніх користувацьких задач. Ці задачі, ідентифіковані як `UserTask_FirstSignInititorData` та `UserTask_SecondSignInititorData`, містять дані, підписані користувачами на попередніх етапах процесу. + +.. *Перевірка та додавання даних із першої форми*: + +* Скрипт перевіряє, чи існують дані у `firstFormData`. Якщо дані існують, вони додаються до `finalData`. Це включає такі поля, як `fullName`, `drfo`, `organizationEdrpou`, та `maxDate`. +* Якщо `firstFormData` порожня, виводиться повідомлення `'1-st form null'`, що слугує для дебагінгу або журналювання. + +.. *Перевірка та додавання даних із другої форми*: + +* Аналогічна перевірка виконується для `secondFormData`. Якщо дані присутні, поле `isBranchesExists` додається до `finalData`. +* За відсутності даних у `secondFormData`, виводиться повідомлення `'2-nd form null'`. + +.. *Зберігання `finalData` як тимчасової змінної*: + +* `set_transient_variable('finalData', finalData)` зберігає підготовлені дані у `finalData` як тимчасову змінну для подальшого використання в процесі. +-- + +=== Користувацька задача для винесення фінального висновку + +Для створення користувацької задачі у вашому бізнес-процесі, що вимагає внесення даних, слід виконати наступні дії: + +. Створення задачі: + +* Ініціюйте створення нової користувацької задачі (*User Task*) в рамках вашого процесу. Це буде інтерактивна задача, яка дозволить визначеним користувачам вносити або переглядати дані. + +. Налаштування параметрів задачі: + +.. У полі *Name* вкажіть назву задачі. Виберіть назву, яка чітко відображає мету задачі, наприклад, `Внесення даних щодо фінального розгляду`. +.. Вкажіть ID задачі: `UserTask_MakeConclusion`. +.. Застосуйте шаблон делегата *User Form*. +.. У полі *Form key* вкажіть службову назву форми, яка буде використана в задачі. Це повинна бути назва наявної форми у системі, призначеної для внесення або перегляду даних. +.. У полі *Assignee* встановіть `${initiator}`. Це означає, що задачу буде призначено користувачу, який ініціював цей бізнес-процес. +.. У полі *Candidate roles* вкажіть `hierarchy-registry-manager`. Це забезпечить, що задача з'явиться в черзі усіх посадових осіб, які мають роль `hierarchy-registry-manager`. +.. У полі *Form data pre-population* вкажіть `${finalData}`. Це означає, що форма буде попередньо заповнена даними, зібраними на попередніх етапах і збереженими у змінній `finalData`. + +Ця користувацька задача є ключовою для забезпечення ефективної участі різних ролей у процесі обробки та перевірки інформації, а також для забезпечення цілісності та доступності даних на різних етапах бізнес-процесу. + +image:best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-18.png[] + +=== Користувацька задача для підписання фінального висновку КЕП + +. Налаштування параметрів задачі: + +.. Застосуйте шаблон делегата *Officer Sign Task*. + +Щоб створити користувацьку задачу для підписання даних у вашому бізнес-процесі, слід виконати наступні кроки: + +. Створення задачі: + +* Додайте нову користувацьку задачу (*User Task*) у вашому бізнес-процесі. Ця задача буде використовувати форму для підписання даних, що забезпечує важливий етап у валідації та затвердженні інформації. + +. Налаштування параметрів задачі: + +.. У полі *Name* вкажіть назву задачі. Назва повинна чітко відображати її мету, наприклад, `Підписання фінальних даних`. +.. У полі *Form key* вкажіть службову назву форми, яка буде використана для підписання даних. Це має бути назва відповідної форми, яка вже налаштована у вашій системі. +.. У полі *Assignee* встановіть `${completer('UserTask_MakeConclusion').userName}`. Це означає, що задача буде автоматично призначена користувачу, який завершив попередню задачу `UserTask_MakeConclusion`. +.. У полі *Form data pre-population* вкажіть змінну `${submission('UserTask_MakeConclusion').formData}`. Це забезпечить, що дані, введені користувачем на попередній задачі, будуть автоматично використані для заповнення цієї форми. + +Ця користувацька задача є ключовою для забезпечення належного підписання та затвердження інформації, важливої для бізнес-процесу, та гарантує, що всі необхідні процедури перевірки та валідації виконані належним чином. + +image:best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-19.png[] + +=== Скрипт для підготовки даних до збереження у БД + +Створіть скрипт-задачу та напишіть Groovy-скрипт для підготовки даних до збереження у БД. + +. Створіть *Script Task*. +. У полі `Name` вкажіть назву задачі. +. Натисніть кнопку *`Open script editor`* та внесіть скрипт. ++ +image:best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-20.png[] ++ +.Groovy-скрипт для підготовки даних до збереження у БД +[source,groovy] +---- +def formData = submission('UserTask_FinalSignInititorData').formData +def organization_activity_approval = [:] + +organization_activity_approval.fullName = formData.prop('fullName').value() +organization_activity_approval.drfo = formData.prop('drfo').value() +organization_activity_approval.organizationEdrpou = formData.prop('organizationEdrpou').value() +organization_activity_approval.isBranchesExists = formData.prop('isBranchesExists').value() +organization_activity_approval.maxDate = formData.prop('maxDate').value() +organization_activity_approval.isFinallyApproved = formData.prop('isFinallyApproved').value() + +set_transient_variable('organization_activity_approval', S(organization_activity_approval, 'application/json')) +---- ++ +Цей скрипт є важливою частиною процесу обробки даних, забезпечуючи їхню адекватну підготовку та форматування перед фінальним збереженням до БД. Це дозволяє забезпечити цілісність та коректність даних, які вносяться до системи. + +Розглянемо цей скрипт більш детально: :: + +.. *Отримання даних з попередньої форми*: + +* `def formData = submission('UserTask_FinalSignInititorData').formData` зчитує підписані дані із задачі `UserTask_FinalSignInititorData`. + +.. *Створення словника для збереження даних*: + +* `def organization_activity_approval = [:]` ініціалізує порожній словник (map) під назвою `organization_activity_approval`, який буде використовуватися для зберігання даних перед їхнім записом до БД. + +.. *Заповнення словника даними*: + +* Скрипт заповнює `organization_activity_approval` відповідними даними з `formData`, включаючи поля `fullName`, `drfo`, `organizationEdrpou`, `isBranchesExists`, `maxDate` та `isFinallyApproved`. Кожне поле отримує своє значення з відповідного властивості `formData`. + +.. *Збереження даних як тимчасової змінної*: + +* `set_transient_variable('organization_activity_approval', S(organization_activity_approval, 'application/json'))` конвертує словник `organization_activity_approval` у формат JSON та зберігає його як тимчасову змінну. Це робить дані доступними для використання в подальших частинах бізнес-процесу, зокрема для збереження в БД. + +=== Створення сервісної задачі для підписання даних системним ключем + +Для створення сервісної задачі, яка займатиметься підписанням даних системним ключем у вашому бізнес-процесі, слід виконати наступні кроки: + +. Створення сервісної задачі: + +* Додайте нову сервісну задачу (*Service Task*) у вашому бізнес-процесі. Ця задача використовуватиметься для автоматичного підписання даних системним ключем. + +. Налаштування параметрів задачі: + +.. У полі *Name* вкажіть назву задачі. Назва повинна чітко вказувати на її мету, наприклад, `Підписання даних системним ключем`. +.. Застосуйте шаблон делегата *System signature by DSO service*. +.. У полі *Payload* передайте вхідні дані: `${submission('signDecisionActivity').formData}`. Цей вираз передає дані, зібрані з попередньої користувацької задачі `'signDecisionActivity'`, для їхнього підписання. +.. У полі *X-Access-Token source* передайте токен виконавця останньої користувацької задачі у бізнес-процесі: `${completer('UserTask_FinalSignInititorData').accessToken}`. Цей токен забезпечує аутентифікацію виконавця процесу та його повноваження щодо підписання даних. +.. У полі *Result variable* внесіть значення `systemSignatureKey`. Це змінна, де буде зберігатися результат підписання даних системним ключем. + +Ця сервісна задача є важливою частиною бізнес-процесу, оскільки вона забезпечує захист та автентичність даних шляхом їхнього підписання системним ключем. Це підвищує рівень безпеки та довіри до процесу обробки даних. + +image:best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-21.png[] + +=== Створення сервісної задачі для збереження даних + +Для створення сервісної задачі, що зберігатиме дані до БД, виконайте наступні кроки: + +. Створення задачі: + +* Додайте нову сервісну задачу (*Service Task*) у вашому бізнес-процесі. Ця задача буде відповідати за збереження оброблених та підписаних даних. + +. Налаштування параметрів задачі: + +.. У полі *Name* вкажіть назву задачі, яка відображатиме її функцію, наприклад, `Збереження оброблених даних`. +.. Застосуйте шаблон делегата *Create entity in data factory*. +.. У полі *Resource* вкажіть ресурс або назву API-ендпоінту, через який будуть зберігатися дані. Наприклад, `organization-activity-approval`. +.. У полі *Payload* вкажіть тіло запита: `${organization_activity_approval}`. Це передає дані, які необхідно зберегти, і які були підготовлені на попередніх етапах. +.. У полі *X-Access-Token* вкажіть `${completer('UserTask_FinalSignInititorData').accessToken}`. Це токен доступу користувача, що забезпечує авторизацію для здійснення операції збереження. +.. У полі *X-Digital-Signature source* вкажіть `${sign_submission('UserTask_FinalSignInititorData').signatureDocumentId}`. Це ідентифікатор документа, який містить цифровий підпис. +.. У полі *X-Digital-Signature-Derived source* вкажіть `${systemSignatureKey}`. Це посилання на ключ цифрового підпису, отриманого від системи. +.. У полі *Result variable* вкажіть назву для вихідного параметра, наприклад, `response`. Це буде змінна, в якій зберігатиметься результат операції збереження. + +Ця сервісна задача забезпечує ефективне та безпечне збереження оброблених даних, забезпечуючи їхню доступність та цілісність у майбутньому. Вона відіграє ключову роль у забезпеченні успішної реалізації бізнес-процесу. + +image:best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-22.png[] + +=== Створення ексклюзивного шлюзу із двома гілками для погодження або відхилення повноважень + +Для відображення сценаріїв погодження або відхилення заявки посадовою особою з третьою роллю, потрібно створити ексклюзивний шлюз (*Exclusive Gateway*) з двома гілками у бізнес-процесі. Ось як це можна зробити: + +. Створення ексклюзивного шлюзу: + +* Додайте ексклюзивний шлюз у відповідну частину вашої діаграми бізнес-процесу. Цей шлюз дозволить розгалузити потік процесу на основі умови, яка буде визначатися результатом рішення третьої посадової особи. + +. Налаштування гілок шлюзу: + +.. Налаштуйте дві гілки, що виходять з ексклюзивного шлюзу, кожна з яких відображатиме один із можливих результатів: погодження або відхилення заявки. +.. Для гілки погодження можна встановити умову, яка відповідає логіці "якщо заявка погоджена", наприклад, використовуючи вираз, який перевіряє відповідну змінну процесу або поле у формі. +.. Для гілки відхилення встановіть умову, яка відповідає логіці "якщо заявка відхилена". Ця умова також базуватиметься на даних, які вказують на відхилення заявки. + +. Зв'язування шлюзу з наступними етапами процесу: + +* Переконайтеся, що кожна гілка шлюзу правильно веде до наступних відповідних етапів процесу. Наприклад, після гілки погодження може бути задача або подія, яка відображає завершення процесу з позитивним результатом, тоді як гілка відхилення може вести до дій або сповіщень, що повідомляють про відхилення. + +Ця конфігурація ексклюзивного шлюзу забезпечує гнучкість у виборі різних шляхів бізнес-процесу на основі рішень, прийнятих посадовою особою, і є ключовою для керування різними сценаріями, що можуть виникнути під час процесу розгляду заявок. + +image:best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-23.png[] + +=== Налаштування умов для ексклюзивного шлюзу + +Для налаштування умов ексклюзивного шлюзу, які визначають, чи заявка була погоджена або відхилена, слід виконати наступні кроки: + +Умова для Гілки "Так" (Заявка погоджена): :: ++ +* Для гілки, яка відповідає погодженню заявки, встановіть умову в полі *Condition Expression*. ++ +[source,groovy] +---- +${submission('UserTask_FinalSignInitiatorData').formData.prop('isFinallyApproved').value().equals('true')} +---- + +* Ця умова перевіряє, чи поле `isFinallyApproved` у даних, внесених у форму `UserTask_FinalSignInititorData`, має значення `true`, що означає, що заявка була погоджена. + ++ +image:best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-24.png[] + +Умова для Гілки "Ні" (Заявка відхилена): :: ++ +* Для гілки, яка відповідає відхиленню заявки, встановіть умову в полі *Condition Expression*: ++ +[source,groovy] +---- +${submission('UserTask_FinalSignInititorData').formData.prop('isFinallyApproved').value().equals('false')} +---- + +* Ця умова перевіряє, чи поле `isFinallyApproved` у даних, внесених у форму `UserTask_FinalSignInititorData`, має значення `false`, що означає, що заявка була відхилена. + ++ +image:best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-25.png[] + +Ці умови дозволяють бізнес-процесу адекватно реагувати на рішення посадової особи з третьою роллю та спрямовувати потік процесу відповідно до результату розгляду заявки. Вони є ключовими для забезпечення правильного руху процесу та впровадження відповідних дій на наступних етапах. + +=== Встановлення результатів виконання та завершення бізнес-процесу + +Для кожної з гілок, залежно від визначеної умови, встановіть результат виконання бізнес-процесу. Для цього створіть відповідні сервісні задачі та застосуйте шаблон делегата *Define business process status*. + +image:best-practices/bp-officer-simultaneous-tasks/bp-officer-simultaneous-tasks-26.png[] + +Опісля закінчіть процес подією завершення (*End Event*). \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/pages/best-practices/bp-send-notifications-blacklist.adoc b/docs/ua/modules/registry-develop/pages/best-practices/bp-send-notifications-blacklist.adoc new file mode 100644 index 0000000000..dd82667d24 --- /dev/null +++ b/docs/ua/modules/registry-develop/pages/best-practices/bp-send-notifications-blacklist.adoc @@ -0,0 +1,360 @@ += Відправлення сповіщень на електронні адреси з фільтрацією Blacklist +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +== Загальний опис + +Розширений модуль відправлення нотифікацій з фільтрацією Blacklist є значним вдосконаленням для регламентування процесу відправлення електронних повідомлень у бізнес-сфері. Основна його функція полягає у наданні моделювальникам регламенту можливості відправляти нотифікації на будь-які електронні адреси. Ці адреси можуть бути введені вручну, автоматично імпортовані з баз даних або отримані із зовнішніх систем. + +Особливістю модуля є його інтегрований механізм фільтрації, який перевіряє всі електронні адреси на наявність їх доменів у чорному списку (blacklist). Цей список включає домени, заборонені для використання на території України. Фільтрація відбувається як на етапі введення даних на формі задачі, так і на етапі обробки даних делегатом бізнес-процесу. + +Цей модуль покращує ефективність комунікацій, дозволяючи цілеспрямовано звертатися до власників різних електронних адрес, при цьому забезпечуючи дотримання нормативних обмежень щодо використання певних доменів. + +== Валідаційні правила для електронної пошти та обробка помилок + +Валідаційні правила для електронної пошти включають наступні аспекти: + +=== Валідація за регулярним виразом + +Валідація електронної адреси відбувається за допомогою спеціально розробленого регулярного виразу. Цей вираз перевіряє структуру електронної адреси, щоб вона відповідала загальноприйнятим стандартам форматування. + +Регулярний вираз, що використовується, виглядає так: + +.regex +==== +[source,regexp] +---- +{{/^(([^<>()[\]\\.,;:\s@\"]+(\.[^<>()[\]\\.,;:\s@\"]+)*)|(\".+\"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$/}} +---- +==== + +Цей вираз перевіряє елементи, як-от: + +* Наявність символу `@`. +* Валідність частини адреси _до_ та _після_ `@`. +* Коректність доменних імен та доменів верхнього рівня. + +=== Валідація згідно з blacklist + +Цей аспект валідації перевіряє, чи не належить електронна адреса до списку заборонених доменів. Зокрема, перевіряються адреси, які належать до доменів компаній, які підпадають під санкції. До таких доменів належать: + +* *`mail.ru`* і його різновиди, такі як `internet.ru`, `list.ru`, `bk.ru`, `inbox.ru`, `mail.ua`, а також регіональні домени `mail.kz` та `mail.md`. +* *`yandex`* та його домени, включаючи `yandex.ru`, `yandex.ua`, `mail.yandex.ru`, `mail.yandex.ua`, `ya.ru`, `ya.ua`, а також регіональні та міжнародні домени `yandex.kz`, `yandex.by`, та `yandex.com`. + +=== Обробка валідаційних помилок + +* *Неуспішна валідація*: у випадку, коли валідація не проходить, делегат віддає подію-помилку (error event), яка містить опис помилки у форматі, зрозумілому для користувача, для подальшого відображення на формі. + +* *Подвійна невідповідність*: Якщо електронна адреса не відповідає як патерну, так і перебуває у blacklist, делегат повертає помилку валідації, яку моделювальник може використати для подальших кроків у бізнес-процесі. + +== Референтний бізнес-процес відправлення повідомлень на довільні електронні адреси + +. *Розробка та інтеграція бізнес-процесу:* + +* Створено виконуваний референтний бізнес-процес, який зосереджений на відправленні нотифікацій на довільні електронні адреси. Цей процес було додано до демонстраційного реєстру. +* Ключовим компонентом цього процесу є відправлення повідомлень за допомогою делегата `SendUserNotificationByAddress`, що містить функціональність валідації електронних адрес. + +. *Розробка структури даних:* + +* У демо реєстрі таблицю `animals` розширено стовпцем `owner_email`. Цей стовпець містить електронні адреси власників тварин. + +* Принаймні один запис у цій таблиці містить значення `owner_email`, яке не відповідає валідаційним правилам, демонструючи роботу механізму валідації. + +. *Шаблон повідомлення:* + +* Шаблон повідомлення, який використовується у цьому БП, містить текст: ++ +---- +Вітаємо! Візьміть до уваги, що змінилася форма ветеринарного паспорту тварини. Для переоформлення паспорту зверніться в найближчу ветеринарну клініку. +---- + +=== Моделювання структур даних + +Модель даних, представлена у демо-реєстрі, дозволяє ефективно зберігати, пов'язувати та обробляти дані про тварин, їхніх власників, а також інформацію про ліцензію та профіль тварин. Особливість цієї моделі полягає у впровадженні механізму валідації електронних адрес, який є важливим для забезпечення правильності комунікації з власниками тварин. + +Модель містить декілька основних changesets, які відображають етапи розвитку та розширення структури даних. Розгляньмо приклади більш детально. + +[TIP] +==== +[%collapsible] +.Де можна знайти приклади моделі даних? +===== +Приклади змодельованих структур даних ви зможете переглянути у регламенті демо-реєстру за шляхом: + +* _data-model/feature/tablesConsent.xml_ +* _data-model/feature/createSearchConditions.xml_ +===== +==== + +.Створення таблиці `animals` +==== +[source,xml] +---- + + + + + + + + + + + + + + + +---- +==== + +Цей changeset відповідає за створення основної таблиці `animals`. Вона включає наступні стовпці: + +[cols="3*^", options="header"] +|=== +| Назва стовпця | Тип даних | Опис + +| `animal_id` +| `UUID` +| Унікальний ідентифікатор тварини, є первинним ключем таблиці. + +| `animal_license_id` +| `UUID` +| Ідентифікатор ліцензії тварини, пов'язаний з таблицею `animal_license`. + +| `animal_profile_id` +| `UUID` +| Ідентифікатор профілю тварини, пов'язаний з таблицею `animal_profile`. + +| `receipt` +| `File` +| Поле, призначене для зберігання файлів, які можуть містити документацію. + +| `menu` +| `File[]` +| Поле для зберігання масиву файлів, що може включати різноманітні документи. +|=== + +.Створення композитної сутності `nested_animals` +==== +[source,xml] +---- + + + + + + + + + + +---- +==== + +Цей changeset створює композитну сутність `nested_animals`, яка включає в себе три вкладені сутності: `animals`, `license`, та `profile`. Вона дозволяє організувати зв'язки між різними таблицями, забезпечуючи легкий доступ до пов'язаної інформації. + +.Додавання стовпця `owner_email` до таблиці `animals` +==== +[source,xml] +---- + + + + + + +---- +==== + +У цьому changeset до таблиці `animals` додається новий стовпець `owner_email`. Це поле містить електронні адреси власників тварин і має тип `varchar(50)`. Цей стовпець є важливим для реалізації функціональності відправлення електронних повідомлень власникам тварин та демонструє валідацію електронних адрес згідно зі встановленими правилами. + +.Додавання умови пошуку за стовпцем `owner_email` у таблиці `animals`. +==== +[source,xml] +---- + + CREATE search condition search_user_email_from_animals + + + + + + +---- +==== + +Цей changeset включає створення критерію пошуку (Search Condition, SC) під назвою `search_user_email_from_animals`. Основна мета цієї умови пошуку полягає у забезпеченні можливості пошуку за стовпцем `owner_email` у таблиці `animals`. + +Умова пошуку `search_user_email_from_animals` дозволяє виконувати пошук даних у таблиці `animals` за електронними адресами власників тварин. Це значно спрощує процес виявлення конкретних записів, особливо у випадках, коли потрібно ідентифікувати власників на основі їх електронної пошти, як-то для відправлення спеціалізованих повідомлень чи нотифікацій. + +=== Моделювання бізнес-процесу + +==== Передумови + +. Детально ознайомтеся з інструкцією xref:registry-admin/user-notifications/email/e-mail-notification.adoc[]. + +. Скористайтеся референтними прикладами моделювання регламенту. ++ +[TIP] +==== +[%collapsible] +.Де можна знайти приклад бізнес-процесу? +===== +include::partial$snippets/demo-reg-reference-examples-ua.adoc[] + +Приклад BPMN-схеми процесу буде доступний у регламенті демо-реєстру за пошуком по ключовим словам -- *_feature-send-message-to-n-users-by-address_*. + +Назви форм ви можете знайти всередині відповідних користувацьких задач (User Task) бізнес-процесу у полі *`Form key`*. +===== +==== + +. Виконайте підготовчі кроки. ++ +[NOTE] +==== +Перед початком роботи з моделюванням бізнес-процесу відправлення електронних повідомлень, моделювальнику необхідно виконати наступні підготовчі кроки: + +. *Налаштування поштового сервера:* + +.. *Налаштування внутрішнього SMTP-сервера:* конфігурація внутрішнього SMTP-сервера, який буде займатися обробкою та відправленням електронних повідомлень (_див. детальніше -- xref:admin:installation/internal-smtp-server-setup.adoc[]_). + +.. Налаштування підключення до поштового сервера:* встановіть та налаштуйте з'єднання із зовнішнім поштовим сервером, що буде використовуватися для відправлення електронних повідомлень (_див. детальніше -- xref:registry-admin/user-notifications/email/config-smtp-server.adoc[]_). + +. *Налаштування шаблону повідомлення:* + +* *Налаштування шаблону повідомлення:* визначте та налаштуйте шаблон для електронних повідомлень, що включає текст, форматування та інші важливі параметри, які будуть використовуватися при відправленні повідомлень (_див. детальніше -- xref:registry-admin/user-notifications/email/e-mail-notification.adoc#email-notification-temp[Налаштування шаблону повідомлення]_). +==== + +==== Процес + +У цьому бізнес-процесі ми застосовуємо вже відомий нам підхід до відправлення повідомлень кільком користувачам, перевикористовуючи наявну функціональність системи (_для глибшого розуміння, ознайомтеся з розділом xref:registry-admin/user-notifications/email/e-mail-notification.adoc#send-many-user-notifications[Відправка повідомлень багатьом користувачам]_). + +Включіть у свій бізнес-процес вже випробувані механізми відправлення електронних повідомлень, адаптуючи їх до потреб вашого конкретного процесу. + +===== Моделювання форми для внесення адрес + +Додайте користувацьку задачу, яка дозволить учасникам процесу на формі вводити довільні електронні адреси для відправлення повідомлень. Забезпечте, щоб форма була інтуїтивно зрозумілою та зручною для користувача. + +image:best-practices/bp-send-notifications-blacklist/bp-send-notifications-blacklist-1.png[] + +===== Сервісна задача для отримання сутностей у Фабриці даних + +Додавання сервісної задачі: :: + +У бізнес-процесі додайте нову сервісну задачу, використовуючи шаблон делегата *Search for entities in data factory*. ++ +TIP: Детальніше про налаштування типового розширення для пошуку сутностей див. на сторінці xref:bp-modeling/bp/element-templates/service-task-templates/search-entities-in-data-factory.adoc[]. + +Результати отримання сутностей: :: + +По завершенні цієї сервісної задачі, ви отримаєте перелік усіх наявних електронних адрес із вашої бази даних. Це дозволяє бізнес-процесу відправляти повідомлення не лише на адреси, внесені користувачами через форму, але й на ті, що вже збережені в базі даних. + +image:best-practices/bp-send-notifications-blacklist/bp-send-notifications-blacklist-2.png[] + +===== Скрипт для формування переліку адрес + +Для забезпечення ефективного відправлення повідомлень до широкого кола одержувачів, наступним кроком у вашому бізнес-процесі буде додавання скриптової задачі. Ця задача має на меті створення єдиної змінної, яка об'єднує всі адреси електронної пошти, внесені користувачами через форму, а також ті, що вже існують у базі даних. + +image:best-practices/bp-send-notifications-blacklist/bp-send-notifications-blacklist-3.png[] + +[source,groovy] +---- +def addressList = [] + +def email = submission('UserTask_FillingEmails').formData.prop('emailLatest').value() +def email1 = submission('UserTask_FillingEmails').formData.prop('emailLatest1').value() + +addressList.add(email) +addressList.add(email1) + +def ownerEmails = animalOwnerResponse.responseBody.elements() +ownerEmails.each { + addressList.add(it.prop('ownerEmail').value()) +} + +set_transient_variable('hasNotificationErrors', false) +set_transient_variable('addressListVariable', S(addressList, 'application/json')) +---- + +Цей скрипт використовується для збору електронних адрес з різних джерел (форма задачі та відповідь API) для їх подальшого використання у процесах відправлення електронних повідомлень. Він забезпечує централізований збір та обробку адрес, а також установлює необхідні змінні для контролю та взаємодії в контексті бізнес-процесу. + +Розглянемо цей скрипт детальніше: :: + +. **Ініціалізація списку адрес:** +- Створюється порожній список `addressList` для зберігання електронних адрес. + +. **Отримання електронних адрес із форми:** +- Витягується електронна адреса `email` з форми, що відповідає задачі `UserTask_FillingEmails`, конкретно властивості `emailLatest`. +- Аналогічно витягується друга електронна адреса `email1`, але з властивості `emailLatest1`. + +. **Додавання адрес до списку:** +- Обидві отримані адреси (`email` та `email1`) додаються до списку `addressList`. + +. **Отримання електронних адрес власників тварин:** +- Виконується звернення до відповіді `animalOwnerResponse`, з якої отримується список об'єктів `ownerEmails`. +- Для кожного елемента в цьому списку витягується властивість `ownerEmail` та додається до `addressList`. + +. **Встановлення змінних процесу:** +- Установлюється тимчасова змінна `hasNotificationErrors` зі значенням `false`, що може використовуватися для відстеження помилок відправлення повідомлень. +- Список `addressList` конвертується у формат JSON та зберігається у тимчасову змінну `addressListVariable`. + +===== Моделювання підпроцесу та делегата для надсилання повідомлень + +Після формування змінної з усіма електронними адресами, наступним кроком у бізнес-процесі є моделювання підпроцесу. Цей підпроцес залучений до послідовного відправлення повідомлень на адреси, підготовлені у скриптовій задачі. + +. *Налаштування Sequential Multi-Instance:* + +* Налаштуйте підпроцес як sequential multi-instance, щоб забезпечити послідовну обробку кожної електронної адреси. + ++ + +image:best-practices/bp-send-notifications-blacklist/bp-send-notifications-blacklist-4.png[] + +. *Використання типового розширення Send user notifications by address*: + +* У підпроцесі застосуйте шаблон делегата *Send user notifications by address*. +* Необхідно додати та налаштувати обов'язкові поля для цього розширення: + +** *Notification channel*: Встановіть `email` як єдиний доступний канал, обраний за замовчуванням. +** *Notification address*: Вкажіть ідентифікатор адреси, який завжди буде електронною поштою для каналу EMAIL. + +. *Заповнення додаткових полів:* +* Заповніть також поля *Notification message template* та *Notification template model* для забезпечення правильної відправки повідомлень. + ++ +image:best-practices/bp-send-notifications-blacklist/bp-send-notifications-blacklist-5.png[] + +Цей підхід до моделювання підпроцесу дозволяє точно та ефективно відправляти повідомлення на численні електронні адреси, забезпечуючи, що кожен одержувач отримає відповідне сповіщення. Використання sequential multi-instance гарантує, що кожна адреса буде оброблена окремо, тим самим забезпечуючи високу точність відправлення повідомлень. + +===== Користувацька задача з формою для заборонених адрес + +Змоделюйте користувацьку задачу з формою, яка буде відображена у випадку, коли електронні адреси отримувачів нотифікації належать до переліку заборонених для використання на території України. + +image:best-practices/bp-send-notifications-blacklist/bp-send-notifications-blacklist-6.png[] + +== Відображення у Кабінеті користувача + +NOTE: До бази даних заздалегідь були додані електронні адреси, домени яких входять у перелік заборонених для використання в Україні. + +Після успішної автентифікації в Кабінеті Користувача, користувач ініціює бізнес-процес під назвою *Відправка повідомлення на N emails*. У ході цього процесу на формі користувачу відображаються поля для введення електронних адрес, на які будуть відправлені повідомлення. + +NOTE: Коли користувач вводить електронні адреси, активується клієнтська валідація, що перевіряє, чи не належать домени цих адрес до переліку заборонених на території України. + +image:best-practices/bp-send-notifications-blacklist/bp-send-notifications-blacklist-7.png[] + +Після натискання на кнопку *`Далі`*, користувачеві відображається інформаційна форма, на якій вказується, що повідомлення не були відправлені на деякі адреси з бази даних, оскільки вони належать до доменів, заборонених для використання в Україні. + +image:release-notes:wn-1-9-7/wn-1-9-7-15.png[] + +image:best-practices/bp-send-notifications-blacklist/bp-send-notifications-blacklist-8.png[] + +Тим часом одержувачі, чиї електронні адреси не входять до забороненого переліку, успішно отримують нотифікації на свої електронні адреси. Це забезпечує ефективну та цілеспрямовану комунікацію, відсіюючи адреси, які не можуть бути використані через обмеження. + +image:release-notes:wn-1-9-7/wn-1-9-7-16.png[] \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/pages/best-practices/bp-sign-validate-asics-cades.adoc b/docs/ua/modules/registry-develop/pages/best-practices/bp-sign-validate-asics-cades.adoc new file mode 100644 index 0000000000..fa6a5f61c8 --- /dev/null +++ b/docs/ua/modules/registry-develop/pages/best-practices/bp-sign-validate-asics-cades.adoc @@ -0,0 +1,589 @@ += Перевірка підписаних даних, отриманих зі сторонньої системи: валідація КЕП та ідентифікація підписантів у файлах ASICS/CADES +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +== Загальний опис + +Під час інтеграції зі сторонніми системами на рівні бізнес-процесів потрібно обробляти підписані файли, які надходять від цих систем. Важливо забезпечити цілісність цих файлів, перевіряючи накладений на них цифровий підпис, отримати дані про підписанта для подальшої обробки або внесення в реєстри, а також мати можливість доступу до вмісту файлів-контейнерів. + +TIP: Про особливості завантаження підписаних файлів до системи, див. на сторінці xref:user:bp-files/upload-multiple-files-p7s-asic.adoc[]. + +=== Основні функціональні сценарії + +Перевірка цілісності :: +Для забезпечення автентичності й цілісності даних, підписи перевіряються відповідно до типу контейнера. + +Ідентифікація підписанта :: +Система дозволяє отримувати інформацію про всіх підписантів даних, що допомагає в трасуванні джерела й авторства. + +Доступ до контенту :: +Можливість видобування контенту прямо з підписаного масиву даних. + +=== Важливі аспекти + +* Обробка даних відбувається безпосередньо в скрипт-задачах бізнес-процесу. +* Для передачі байтових даних між системами використовується кодування `Base64`. +* За замовчуванням використовується формат `CAdES-X-Long`. +* Дані та підпис _завжди_ передаються разом в одному масиві. +* Робота з підписами реалізована з допомогою `ІІТ`-бібліотеки. + +=== Визначення й термінологія цифрового підпису + +_Контейнер_ -- це результатний файл, який містить підписані дані. Існують різні типи контейнерів: + +.Типи контейнерів +[cols="15%,60%,25%",options="header"] +|=== +| Контейнер | Опис | Підтримується Платформою + +| *CAdES (p7s)* +| Загальний формат для цифрових підписів +| Так + +| *ASiC (asic)* +| Сучасний контейнер, який рекомендується для використання. Особливість: архів для зберігання декількох файлів різних форматів +| Так + +| *XAdES (xml)* +| Формат, що базується на XML +| Ні + +| *PAdES (pdf)* +| Використовується для підпису PDF документів +| Ні + +|=== + +TIP: Див. детальніше про підтримувані типи цифрового контенту на сторінці xref:bp-modeling/forms/components/file/component-file-multiple-values.adoc[]. + +_Формат підпису_ -- це конкретний алгоритм або набір правил, які використовуються при створенні цифрового підпису. Наприклад, `CAdES-X-Long` -- це рекомендований формат. Саме такий формат використовує Платформа за замовчуванням. + +_Тип підпису_ може бути: + +* _Відокремлений (*detached*)_ -- підпис і дані зберігаються окремо. +* _Вбудований (*enveloped*)_ -- підпис включений безпосередньо в документ або дані. + +У цьому контексті терміни "файл" та "дані" є взаємозамінними й означають одне й те ж. + +[TIP] +==== +.Як працює підписання цифрових документів за допомогою контейнерів різних форматів? +[%collapsible] +===== +Розглянемо детальний опис типів контейнерів на прикладі офіційного ресурсу https://id.gov.ua/sign[]. + +. Автентифікуйтеся за допомогою КЕП. +. Перейдіть на форму підписання та збереження документів. ++ +image:best-practices/bp-sign-validate/bp-sign-validate-01.png[] + +. Оберіть формат підпису документа (тип контейнера). ++ +image:best-practices/bp-sign-validate/bp-sign-validate-02.png[] ++ +image:best-practices/bp-sign-validate/bp-sign-validate-03.png[] + +. Завантажте файл, який необхідно підписати. + +Надалі підписаний таким чином файл можна буде використовувати у бізнес-процесах реєстру. +===== +==== + +== Моделювання процесу валідації підписаного файлу з даними про домашніх тварин + +Цей розділ містить референтний приклад моделювання процесу перевірки підписаних файлів, що містять інформацію про домашніх тварин. + +[TIP] +==== +[%collapsible] +.Де можна знайти приклади референтних бізнес-процесів? +===== +include::partial$snippets/demo-reg-reference-examples-ua.adoc[] + +Приклад BPMN-схеми процесу буде доступний у регламенті демо-реєстру за пошуком по ключовим словам -- *_checking-signed-data_*. Назви форм ви можете знайти всередині відповідних користувацьких задач бізнес-процесу у полі *`Form key`*. +===== +==== + +=== Передумови + +Користувач завантажує до зовнішньої системи фотографії тварин, які супроводжуються підписами форматів `asics` або `CAdES`. + +Платформа надалі зможе автоматично інтегруватися з цією зовнішньою системою, забирає файли, відокремлює від них цифрові підписи, а потім проводити перевірку валідності кожного підпису. + +=== Процес моделювання + +==== Користувацька задача (User Task) для пошуку даних + +Створіть користувацьку задачу для пошуку інформації про тварину за номером чіпа. Виконайте наступні налаштування: + +. Оберіть *Template* > *User form*. +. У полі *Name* введіть назву задачі. +. У полі *Form key* вкажіть назву задачі. Ключ форми поєднує змодельовану користувацьку задачу зі службовою назвою UI-форми введення даних. +. У полі *Assignee* вкажіть значення `${initiator}`, яке представляє користувача, що ініціював цей бізнес-процес. + +image:best-practices/bp-sign-validate/bp-sign-validate-1.png[] + +==== Скриптова задача (Script Task) для отримання підписаних документів від зовнішніх систем + +Змоделюйте скриптову задачу для отримання підписаних даних від зовнішньої системи. + +TIP: Розгляньте опис варіанту налаштування скриптів для отримання документів від зовнішніх систем: xref:registry-develop:bp-modeling/bp/save-digital-doc-remote-url.adoc#[]. + +. Створіть скриптову задачу (*Script Task*). +. Відкрийте редактор скриптів -- `*Open script editor*`. + ++ +image:best-practices/bp-sign-validate/bp-sign-validate-2.png[] + +. Використайте референтний приклад скрипту. ++ +[NOTE] +==== +У цьому випадку показано емуляцію запита до зовнішньої системи за допомогою сервісу Wiremock. + +Детальніше про емуляцію API див. xref:registry-develop:registry-admin/external-integration/cp-mock-integrations.adoc[]. +==== + ++ +.Референтний приклад скрипту для отримання підписаних даних із зовнішньої системи +[source,groovy] +---- +import okhttp3.OkHttpClient +import okhttp3.Request + +def chipNumber = submission('UserTask_EnterAnimalChipNumber') + .formData.prop('chipNumber') + .value() + +def okHttpClient = new OkHttpClient().newBuilder().build() + +def requestToAnimal = new Request.Builder() + .url('http://wiremock:9021/animals?chipNumber='.concat(chipNumber)) + .get() + .build() + +def animalResponse = okHttpClient.newCall(requestToAnimal).execute() +def animalResponseBodyString = animalResponse.body().string() +def animalResponseBodySpinJson = S(animalResponseBodyString, 'application/json') + +set_variable('animalResponse', animalResponseBodySpinJson) +---- + ++ +_Розгляньмо покроково поданий скрипт_: + +.. Імпорт необхідних бібліотек для роботи із HTTP-запитами. ++ +[source,groovy] +---- +import okhttp3.OkHttpClient +import okhttp3.Request +---- + +.. Отримання номера мікрочипа. ++ +[source,groovy] +---- +def chipNumber = submission('UserTask_EnterAnimalChipNumber') + .formData.prop('chipNumber') + .value() +---- +Скрипт отримує номер мікрочипа, введений користувачем у задачі `UserTask_EnterAnimalChipNumber`, і зберігає його в змінній `chipNumber`. + +.. Створення клієнта для HTTP-запитів. ++ +[source,groovy] +---- +def okHttpClient = new OkHttpClient().newBuilder().build() +---- +Тут ми створюємо новий об'єкт `OkHttpClient`, який буде відповідати за відправлення HTTP-запитів. + +.. Формування запита. ++ +[source,groovy] +---- +def requestToAnimal = new Request.Builder() + .url('http://wiremock:9021/animals?chipNumber='.concat(chipNumber)) + .get() + .build() +---- +Ми формуємо HTTP GET-запит до URL `'http://wiremock:9021/animals'` із параметром `chipNumber`. Тобто, ми запитуємо інформацію про тварину, яка має заданий номер мікрочипа. + +.. Відправлення запита та отримання відповіді. ++ +[source,groovy] +---- +def animalResponse = okHttpClient.newCall(requestToAnimal).execute() +---- +За допомогою створеного раніше `OkHttpClient`, ми відправляємо наш запит і отримуємо відповідь у формі об'єкта `animalResponse`. + +.. Конвертація відповіді в рядок. ++ +[source,groovy] +---- +def animalResponseBodyString = animalResponse.body().string() +---- +Відповідь перетворюється в рядок (`String`) для подальшої обробки. + +.. Перетворення рядка в JSON. ++ +[source,groovy] +---- +def animalResponseBodySpinJson = S(animalResponseBodyString, 'application/json') +---- +Скрипт використовує функцію `S()` для перетворення рядка відповіді на об'єкт Spin JSON, який дозволить легко працювати з JSON-даними. + +.. **Збереження результату**: ++ +[source,groovy] +---- +set_variable('animalResponse', animalResponseBodySpinJson) +---- +Отриманий об'єкт Spin JSON зберігається у змінну `animalResponse` для подальшого використання у бізнес-процесі. + ++ +[NOTE] +==== +Отже, загалом скрипт виконує наступні дії: + +* Отримує номер мікрочипа тварини, введений користувачем. +* Відправляє HTTP `GET`-запит до зовнішнього API, щоб отримати дані про тварину за її номером мікрочипа. +* Зберігає отриману відповідь як JSON-об'єкт у змінну `animalResponse` для подальшого використання. + + +Цей скрипт імітує надсилання відповіді з файлами фотографій тварини. Відповідь включає поле `mainPhoto`, де розміщена основна фотографія тварини в контейнері CAdES, та поле `photos`, що містить додаткові знімки, закодовані в `Base64` у форматі `asics` (_див. нижче_). +==== + +==== Сервісна задача для перевірки підпису (Service Task) + +//TODO Add to delegates list + +Створіть сервісну задачу для перевірки валідності підпису у файлах. Використайте кастомний делегат *Signature validation by DSO service*. + +.Короткі відомості про делегат +|=== +|Назва | Пояснення + +|Бізнес-назва +|*Signature validation by DSO service* + +|Службова назва +|*`${digitalSignatureValidateDelegate}`* + +|Назва файлу у бібліотеці розширень +|*_digitalSignatureValidateDelegate.json_* +|=== + +. Відкрийте бізнес-процес та створіть *Service Task*. +. Натисніть кнопку *Open Catalog*. +. Зі списку делегатів оберіть *Signature validation by DSO service* та підтвердіть свій вибір, натиснувши *`Apply`*. +. У полі *Name* введіть зрозумілу назву задачі, яка відображатиме її суть. +. У полі *Data* вкажіть змінну, де зберігається підпис у форматі Base64 для подальшої обробки. Наприклад: `${animalResponse.prop('photos').value()}`. +. Встановіть необхідний тип контейнера у полі *Container*. Можливі варіанти: `ASIC`, `CADES`, або `ALL` (_якщо потрібно автоматично визначити формат вхідних даних_). + ++ +.Перевірка підпису. Автоматичне визначення формату вхідних даних +image::best-practices/bp-sign-validate/bp-sign-validate-3.png[] ++ +.Перевірка підпису. Контейнер CADES +image::best-practices/bp-sign-validate/bp-sign-validate-3-1.png[] + ++ +[NOTE] +==== +У цьому бізнес-процесі використано дві сервісні задачі з типовим розширенням *Signature validation by DSO service*, в якому налаштовано різні типи контейнерів. В одній сервісній задачі перевіряється валідність підпису головного фото, яке було отримано в контейнері Asic, а в другій -- додаткових фото, які були отримані в контейнері CAdES. +==== + +. У полі *X-Access-Token* вкажіть JWT-токен доступу користувача, від імені якого виконується операція. Наприклад, використаємо токен виконавця останньої задачі: `${completer('UserTask_EnterAnimalChipNumber').accessToken}`. +. У полі *Result variable* вкажіть змінну, до якої необхідно зберегти результат. Наприклад, `validationAsicResult` або `validationCadesResult`. + +=== Умови для перевірки підписів + +Далі змоделюйте будь-які умови для перевірки підписів. У даному прикладі змодельована перевірка щодо валідності обидвох підписів -- як для головного фото, так і для додаткових. + +.XOR-шлюз перевірки валідності підписів +image::best-practices/bp-sign-validate/bp-sign-validate-4.png[] + +=== Скриптова задача для отримання даних про підписантів та перевірки на збіг персональних даних + +Змоделюйте Script Task та використайте скрипт, що збиратиме інформацію про підписантів отриманих файлів та виконуватиме перевірку на збіги персональних даних. Використайте у скрипті JUEL-функцію `signature_details()`. + +image::best-practices/bp-sign-validate/bp-sign-validate-5.png[] + +._Скрипт отримання деталей цифрового підпису_ +[%collapsible] +==== +[source,groovy] +---- +var asicSignInfo = signature_details(animalResponse.prop('photos').value(), + validationAsicResult.container).getSignInfo() +var cadesSignInfo = signature_details(animalResponse.prop('mainPhoto').value(), + validationCadesResult.container).getSignInfo() + +var isEqualFullName = asicSignInfo.getSubjFullName() + .equalsIgnoreCase(cadesSignInfo.getSubjFullName()) + +def signerPayload = S([:], 'application/json') +signerPayload.prop('fullName', cadesSignInfo.getSubjFullName()) +signerPayload.prop('drfo', cadesSignInfo.getSubjDRFOCode()) +signerPayload.prop('edrpou', cadesSignInfo.getSubjEDRPOUCode()) + + +set_transient_variable('isEqualFullName', isEqualFullName) +set_transient_variable('signerPayload', signerPayload) +set_variable('validationCadesRes', validationCadesResult) +set_variable('validationAsicRes', validationAsicResult) +---- +==== + +Поданий скрипт спрямований на роботу з деталями цифрового підпису і робить наступне: + +* Отримує деталі цифрових підписів для фотографій тварини. +* Порівнює повні імена осіб, які підписали обидва документи. +* Формує JSON-об'єкт з деталями підпису. +* Зберігає отримані дані в змінних для подальшого використання. + +Функція `signature_details(...)` приймає два аргументи: контент, що підписується, та контейнер підпису. Вона повертає деталі про підпис (як про особу, яка підписала, так і технічні деталі підпису). + +Розглянемо скрипт докладно: + +. *Використання функції `signature_details(...)`*: ++ +-- +* *asicSignInfo*: ++ +[source,groovy] +---- +var asicSignInfo = signature_details(animalResponse.prop('photos').value(), + validationAsicResult.container).getSignInfo() +---- ++ +Функція `signature_details(...)` приймає два аргументи: контент для підпису (_у цьому випадку -- це фотографії тварини_) та контейнер підпису. Ця функція повертає деталі про цифровий підпис `ASIC`. Після цього за допомогою методу `.getSignInfo()` ми отримуємо інформацію про підпис. + +* *cadesSignInfo*: ++ +[source,groovy] +---- +var cadesSignInfo = signature_details(animalResponse.prop('mainPhoto').value(), + validationCadesResult.container).getSignInfo() +---- ++ +Аналогічно попередньому пункту, але тут ми працюємо з основною фотографією тварини та контейнером підпису `CADES`. +-- ++ +IMPORTANT: Функція `signature_details(...)` приймає лише контейнери `ASIC` та `CAdES`. + +. Порівняння імен у підписах: ++ +[source,groovy] +---- +var isEqualFullName = asicSignInfo.getSubjFullName() + .equalsIgnoreCase(cadesSignInfo.getSubjFullName()) +---- ++ +Скрипт порівнює повні імена суб'єктів (_людей, які підписали документи_) в обох підписах (`ASIC` та `CADES`) і перевіряє, чи вони збігаються. Результат порівняння зберігається у змінній `isEqualFullName`. + +. Формування JSON-об'єкта з деталями підпису: ++ +[source,groovy] +---- +def signerPayload = S([:], 'application/json') +signerPayload.prop('fullName', cadesSignInfo.getSubjFullName()) +signerPayload.prop('drfo', cadesSignInfo.getSubjDRFOCode()) +signerPayload.prop('edrpou', cadesSignInfo.getSubjEDRPOUCode()) +---- ++ +Тут ми створюємо порожній JSON-об'єкт (`signerPayload`) та наповнюємо його даними з підпису `CADES`: повне ім'я, код `DRFO` та код `EDRPOU`. + +. Збереження змінних: ++ +[source,groovy] +---- +set_transient_variable('isEqualFullName', isEqualFullName) +set_transient_variable('signerPayload', signerPayload) +set_variable('validationCadesRes', validationCadesResult) +set_variable('validationAsicRes', validationAsicResult) +---- ++ +Результати обробки зберігаються у змінних, які будуть доступні для подальшого використання в бізнес-процесі. + +=== Перегляд даних про підписанта + +Змоделюйте користувацьку задачу для перегляду даних про підписанта на формі. + +image:best-practices/bp-sign-validate/bp-sign-validate-6.png[] + +=== Скриптова задача для отримання переліку підписаних файлів + +Змоделюйте скриптову задачу та використайте у скрипті JUEL-функцію `signature_content()`, яка отримує перелік файлів, що були підписані. + +image::best-practices/bp-sign-validate/bp-sign-validate-7.png[] + +._Скрипт для обробки контенту цифрового підпису та його збереження_ +[%collapsible] +==== +[source,groovy] +---- +var asicContent = signature_content(animalResponse.prop('photos').value(), + validationAsicRes.container).getAllContent() +var cadesContent = signature_content(animalResponse.prop('mainPhoto').value(), + validationCadesRes.container).getContent() + +def photos = [] +asicContent.each { + def decodedAsicContent = Base64.getDecoder().decode(it.getData()) + def asicFileMetadata = save_digital_document(decodedAsicContent, it.getName()) + def photo = [:] + photo.id = asicFileMetadata.getId() + photo.checksum = asicFileMetadata.getChecksum() + photos << photo + } + +def mainPhotos = [] +def decodedCadesContent = Base64.getDecoder().decode(cadesContent.getData()) +def cadesFileMetadata = save_digital_document(decodedCadesContent, cadesContent.getName().concat('.png')) +def mainPhoto = [:] +mainPhoto.id = cadesFileMetadata.getId() +mainPhoto.checksum = cadesFileMetadata.getChecksum() +mainPhotos << mainPhoto + +def contentsPayload = S([:], 'application/json') + +contentsPayload.prop('name', animalResponse.prop('name').value()) +contentsPayload.prop('chipNumber', animalResponse.prop('chipNumber').value()) +contentsPayload.prop('photos', S(photos, 'application/json')) +contentsPayload.prop('mainPhoto', S(mainPhotos, 'application/json')) + +set_transient_variable('contentsPayload', contentsPayload) +---- +==== + +Цей скрипт зосереджений на обробці контенту цифрового підпису та його збереженні. Він виконує наступні дії: + +* Отримує контент цифрових підписів для фотографій тварини. +* Декодує, зберігає та обробляє ці фотографії. +* Формує JSON-об'єкт з деталями контенту. +* Зберігає JSON-об'єкт в змінній для подальшого використання. + +Функція `signature_content(...)` приймає два аргументи: контент, що підписується, та контейнер підпису. Вона повертає деталі контенту підпису. + +Розглянемо скрипт докладніше: + +. *Використання функції `signature_content(...)`*: ++ +-- +- *asicContent*: ++ +[source,groovy] +---- +var asicContent = signature_content(animalResponse.prop('photos').value(), + validationAsicRes.container).getAllContent() +---- ++ +Функція `signature_content(...)` приймає два аргументи: контент для підпису (у цьому випадку це фотографії тварини) та контейнер підпису ASIC. Метод `.getAllContent()` повертає усі частини цього контенту. + +- *cadesContent*: ++ +[source,groovy] +---- +var cadesContent = signature_content(animalResponse.prop('mainPhoto').value(), + validationCadesRes.container).getContent() +---- ++ +Аналогічно попередньому, але для основної фотографії тварини та підпису CADES. +-- ++ +IMPORTANT: Функція `signature_content(...)` працює виключно з контейнерами цифрових підписів двох типів: `ASIC` і `CAdES`. Щоб вона функціонувала коректно, потрібно спочатку встановити або визначити тип контейнера, з яким вона буде працювати, безпосередньо в налаштуваннях цієї функції. + +. *Обробка та збереження фотографій з контенту ASIC*: ++ +[source,groovy] +---- +def photos = [] +asicContent.each { + def decodedAsicContent = Base64.getDecoder().decode(it.getData()) + def asicFileMetadata = save_digital_document(decodedAsicContent, it.getName()) + def photo = [:] + photo.id = asicFileMetadata.getId() + photo.checksum = asicFileMetadata.getChecksum() + photos << photo +} +---- ++ +Цей блок коду декодує кожну частину контенту ASIC з Base64, зберігає її за допомогою функції `save_digital_document(...)`, а потім зберігає метадані цих файлів у список `photos`. + +. *Обробка та збереження основної фотографії з контенту CADES*: ++ +[source,groovy] +---- +def mainPhotos = [] +def decodedCadesContent = Base64.getDecoder().decode(cadesContent.getData()) +def cadesFileMetadata = save_digital_document(decodedCadesContent, cadesContent.getName().concat('.png')) +def mainPhoto = [:] +mainPhoto.id = cadesFileMetadata.getId() +mainPhoto.checksum = cadesFileMetadata.getChecksum() +mainPhotos << mainPhoto +---- ++ +Аналогічно попередньому блоку коду, але обробляється лише одна фотографія (основна). + +. *Формування JSON-об'єкта з деталями контенту*: ++ +[source,groovy] +---- +def contentsPayload = S([:], 'application/json') +contentsPayload.prop('name', animalResponse.prop('name').value()) +contentsPayload.prop('chipNumber', animalResponse.prop('chipNumber').value()) +contentsPayload.prop('photos', S(photos, 'application/json')) +contentsPayload.prop('mainPhoto', S(mainPhotos, 'application/json')) +---- ++ +Тут ми створюємо порожній JSON-об'єкт (`contentsPayload`) та наповнюємо його даними: ім'ям тварини, номером чипа, списком фотографій та основною фотографією. + +. *Збереження JSON-об'єкта*: ++ +[source,groovy] +---- +set_transient_variable('contentsPayload', contentsPayload) +---- ++ +Сформований JSON-об'єкт `contentsPayload` зберігається як тимчасова змінна для подальшого використання в бізнес-процесі. + +=== Підписання даних та збереження їх до БД + +Змоделюйте кроки з підписання даних та їх збереження до БД реєстру. + +image::best-practices/bp-sign-validate/bp-sign-validate-8.png[] + +[TIP] +==== +* Загальний опис та поради для моделювання містяться на сторінці xref:bp-modeling/bp/bp-modeling-instruction.adoc[]. +* Відвідайте розділ xref:bp-modeling/bp/element-templates/element-templates-overview.adoc[] +* Ознайомтеся також з іншими свіжими референтними прикладами моделювання: xref:best-practices/best-practices-overview.adoc[]. +==== + +== Використання у Кабінеті користувача + +Розглянемо приклад, як виглядатимуть користувацькі UI-форми з підписаними цифровими документами, отриманими із зовнішньої системи. Також оглянемо отриману інформацію про підписанта для подальшої обробки або внесення в реєстри, а також вміст файлів-контейнерів. + +. Увійдіть до _Кабінету користувача_. +. Запустіть змодельований бізнес-процес. ++ +image::best-practices/bp-sign-validate/bp-sign-validate-9.png[] + +. Введіть номер чипа тварини. ++ +image::best-practices/bp-sign-validate/bp-sign-validate-10.png[] + +. Перегляньте дані про підписанта на формі. ++ +image::best-practices/bp-sign-validate/bp-sign-validate-11.png[] + +. Далі перевірте ім'я та номер чипа тварини, а також основне та додаткові фото, які можна вивантажити на свій пристрій та переглянути. ++ +image::best-practices/bp-sign-validate/bp-sign-validate-12.png[] + +. Підпишіть дані на формі за допомогою КЕП та завершіть бізнес-процес. + +== Пов'язані сторінки + +* xref:arch:architecture/registry/administrative/regulation-management/platform-evolution/sign-validation/sign-validation.adoc[] \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/pages/best-practices/bp-timer-launch.adoc b/docs/ua/modules/registry-develop/pages/best-practices/bp-timer-launch.adoc index d19a45232e..d0ec98fc7c 100644 --- a/docs/ua/modules/registry-develop/pages/best-practices/bp-timer-launch.adoc +++ b/docs/ua/modules/registry-develop/pages/best-practices/bp-timer-launch.adoc @@ -1,34 +1,26 @@ -:toc-title: ЗМІСТ -:toc: auto -:toclevels: 5 -:experimental: -:important-caption: ВАЖЛИВО -:note-caption: ПРИМІТКА -:tip-caption: ПІДКАЗКА -:warning-caption: ПОПЕРЕДЖЕННЯ -:caution-caption: УВАГА -:example-caption: Приклад -:figure-caption: Зображення -:table-caption: Таблиця -:appendix-caption: Додаток -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Запуск бізнес-процесу за таймером +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Загальний опис -Ця сторінка демонструє приклад реалізації та запуску бізнес-процесу, який автоматично активується відповідно до графіка, використовуючи Camunda BPM. Процес самостійно ініціюється у визначений час та виконує задачі відповідно до встановленої послідовності. +Ця сторінка демонструє приклад реалізації та запуску бізнес-процесу, який автоматично активується відповідно до графіка, визначеного у BPMN-елементі *Timer*. Процес самостійно ініціюється у визначений час та виконує задачі відповідно до встановленої послідовності. -Було створено референтний бізнес-процес, який має на меті допомогти розробникам та моделювальникам регламентів краще розуміти та ефективно використовувати таймери в Camunda BPM. +Було створено референтний бізнес-процес, який має на меті допомогти розробникам та моделювальникам регламентів краще розуміти та ефективно використовувати таймери. == Референтний приклад -TIP: Приклад _.bpmn_-моделі процесу ви можете знайти за назвою _automatic-external-system-data-saving.bpmn_ у регламенті демо-реєстру *_consent-data_* за посиланням: -https://admin-tools-consent-data.apps.envone.dev.registry.eua.gov.ua/gerrit. +[TIP] +==== +[%collapsible] +.Де можна знайти приклад референтного бізнес-процесу? +===== +include::partial$snippets/demo-reg-reference-examples-ua.adoc[] + +Приклад BPMN-схеми процесу буде доступний у регламенті демо-реєстру за пошуком по ключовим словам -- *_automatic-external-system-data-saving_*. Назви форм ви можете знайти всередині відповідних користувацьких задач (User Task) бізнес-процесу у полі *`Form key`*. +===== +==== === Короткий огляд компонентів процесу та їх призначення @@ -289,8 +281,27 @@ image:best-practices/bp-timer-launch/bp-timer-launch-6.png[] . Застосуйте внесені зміни до майстер-гілки, щоб опублікувати процес у регламенті. + -TIP: Див. детальніше -- на сторінці xref:registry-admin/admin-portal/version-control/overview-new-change-request.adoc[]. +TIP: Див. детальніше -- на сторінці xref:registry-admin/admin-portal/version-control/candidate/overview-new-change-request.adoc[]. == Використання у Кабінеті користувача -Бізнес-процес, який було змодельовано та опубліковано в регламенті, стає доступним у Кабінеті посадової особи за посиланням `https://officer-portal-<назва-реєстру>.apps.<назва-кластера>.dev.registry.eua.gov.ua`. Цей процес можна знайти у розділі [.underline]#Доступні послуги > Референтні бізнес-процеси#. Він буде запускатися та виконуватися відповідно до встановленого графіку. \ No newline at end of file +Бізнес-процес, який було змодельовано та опубліковано в регламенті, стає доступним у _Кабінеті посадової особи_. + +Цей процес можна знайти у розділі [.underline]#Доступні послуги > Референтні бізнес-процеси#. Він буде запускатися та виконуватися відповідно до встановленого графіку. + +[TIP] +==== +_Кабінет користувача_ (*`officer-portal`*) доступний за шаблонним посиланням: + +---- +https://officer-portal--main. +---- + +де `` -- назва вашого реєстру, а `` вказує на доменні та піддоменні імена для інстансу Платформи. + +Наприклад, для демо-реєстру, який розгорнуто на екземплярі Платформи `example.com`, посилання до сервісу *`officer-portal`* виглядатиме так: + +https://officer-portal-demo-registry-main.example.com + +//https://officer-portal-{{{registry-name}}}-main.{{{dns-wildcard}}} +==== \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/pages/best-practices/bp-view-object-creator-editor.adoc b/docs/ua/modules/registry-develop/pages/best-practices/bp-view-object-creator-editor.adoc new file mode 100644 index 0000000000..a59fa84659 --- /dev/null +++ b/docs/ua/modules/registry-develop/pages/best-practices/bp-view-object-creator-editor.adoc @@ -0,0 +1,677 @@ += Відображення інформації про автора створення та редагування об'єктів +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +== Загальні відомості + +Команда Платформи розробила референтні приклади моделювання бізнес-процесів для можливості відображення інформації про особу, яка створила та останньою редагувала сутність в певній таблиці бази даних реєстру: + +* Бізнес-процес зі створення та редагуванню сутності. +* Бізнес-процес отримання витягу у форматі PDF. +* Відображення даних про сутність в аналітичному представленні Redash Viewer (сервіс перегляду звітів). + +== Бізнес-процес створення та редагування сутності + +=== Передумови + +==== Референтні приклади моделювання регламенту + +Скористайтеся референтними прикладами моделювання регламенту. + +[TIP] +==== +[%collapsible] +.Де можна знайти приклад референтного бізнес-процесу? +===== +include::partial$snippets/demo-reg-reference-examples-ua.adoc[] + +Приклад BPMN-схеми процесу буде доступний у регламенті демо-реєстру за пошуком по ключовим словам -- *_reference-create-factor_*. + +Назви форм ви можете знайти всередині відповідних користувацьких задач (User Task) бізнес-процесу у полі *`Form key`*: + +* _reference-view-factors.json_ +* _reference-create-factor.json_ +* _reference-create-factor-sign.json_ +* _reference-edit-factor.json_ +* _reference-edit-factor-sign.json_ + +У Кабінеті користувача процес буде доступний у папці *_Референтні бізнес-процеси з відображенням автора та часу змін_ > Створення та редагування фактора_*. + +image:best-practices/view-object-creator-editor/bp-view-object-creator-editor-01.png[] +===== +==== + +==== Моделювання структури даних + +Змоделюйте Liquibase ChangeSet для створення таблиці відповідно до вашої логічної моделі даних. Використовуйте ChangeSet `20490-2` із регламенту демо-реєстру. Модель буде доступна за шляхом: _data-model/reference/entity-creator-updater-information/main.xml_. + +.ERD-діаграма референтної логічної моделі +[plantuml] +---- +@startuml +!define TABLE(x) class x << (T,orchid) >> +!define PRIMARY_KEY(x) x +!define NOT_NULL(x) x + +package "Your Database" { + TABLE(factor_names) { + PRIMARY_KEY(id) : uuid + NOT_NULL(name) : text + NOT_NULL(creator_full_name) : text + NOT_NULL(updater_full_name) : text + } +} +@enduml +---- + +.XML-схема референтної фізичної моделі +[source,xml] +---- + + + + + + + + + + +---- + +У цій моделі: + +* `factor_names` -- назва таблиці. +* `id` визначено як первинний ключ типу uuid. +* `name`, `creator_full_name` і `updater_full_name` є полями типу `text` і є обов'язковими для заповнення (`NOT NULL`). + +.Вихідний SQL-синтаксис для створення таблиці +[source,sql] +---- +CREATE TABLE factor_names ( + id UUID PRIMARY KEY, + name TEXT NOT NULL, + creator_full_name TEXT NOT NULL, + updater_full_name TEXT NOT NULL +); +---- + +Цей SQL-код створює таблицю `factor_names` з чотирма колонками. Тип `UUID` використовується для `id`, а `TEXT` для інших колонок. Всі поля крім `id` позначені як `NOT NULL`, що означає обов'язкове заповнення цих полів. + +TIP: Ви можете додатково вказати атрибути відображення дати та часу створення сутності. Як це зробити, дивіться у розділі xref:faq:faq.adoc#get-date-time-entity-creation[Як отримати дату та час створення сутності у БД?] + +==== Моделювання бізнес-процесу + +Змоделюйте власний бізнес-процес за наведеними прикладом нижче. + +=== Опис референтного процесу + +==== Загальний вигляд бізнес-процесу створення та редагування сутності + +Референтний бізнес-процес у моделері адміністративного порталу виглядатиме наступним чином: + +image::best-practices/view-object-creator-editor/bp-view-object-creator-editor-1.png[] + +==== Сервісна задача для пошуку сутностей у БД + +. Змоделюйте сервісну задачу (*Service Task*). +. Використайте шаблон делегата *Search for entities in data factory* та вкажіть у полі *Resource* назву таблиці для пошуку всіх сутностей (у цьому прикладі -- `factor-names-all`), відповідно до створеної фізичної моделі даних. ++ +TIP: Детальніше про пошук сутностей у БД ви можете переглянути на сторінці xref:bp-modeling/bp/element-templates/service-task-templates/search-entities-in-data-factory.adoc[] + +image::best-practices/view-object-creator-editor/bp-view-object-creator-editor-2.png[] + +==== Скрипт для показу даних на формі + +Змоделюйте скрипт-задачу (*Script Task*) та сформуйте скрипт для подальшого відображення сутностей на формі. + +[source,groovy] +---- +def factorResponseBody = factorNameResponse.responseBody +def payload = S([:], 'application/json') + +payload.prop('factorData', factorResponseBody) +set_transient_variable('existingFactors', payload) +---- + +Цей скрипт забезпечує чітке та ефективне управління даними, отриманими від сервісної задачі, для їх подальшого використання у процесі. + +У цьому скрипті: :: + +* `factorResponseBody` зберігає тіло відповіді, отримане від сервісної задачі. +* Ініціалізується новий об'єкт `payload` з порожнім словником (`[:]`) і типом даних `application/json`. +* В `payload` додається властивість `factorData`, яка містить дані з `factorResponseBody`. +* Встановлюється тимчасова змінна `existingFactors`, що дозволяє використовувати дані `payload` у наступних кроках бізнес-процесу. + +==== Користувацька задача для перегляду факторів, отриманих із БД + +Налаштування бізнес-процесу: :: + +. Змоделюйте користувацьку задачу (*User Task*). +. Застосуйте шаблон делегата (*User Form*). +. У полі *Form key* вкажіть службову назву UI-форми (_тут_ -- `reference-view-factors`). + +Налаштування UI-форми задачі: :: + +. Змоделюйте компонент *Edit Grid*. + +.. У рамках Edit Grid додайте три текстових поля за допомогою компонента *Text Field* для відображення даних сутностей, які отримано з БД. +.. Назви трьох полів у *Text Field* у нашому прикладі: *Назва фактора*, *Створив* та *Редагував*. ++ +image::best-practices/view-object-creator-editor/bp-view-object-creator-editor-3.png[] + +.. У налаштуваннях *Edit Grid*, на вкладці *Display*, активуйте параметри *Read only* та *Quick Search*. ++ +image::best-practices/view-object-creator-editor/bp-view-object-creator-editor-3-1.png[] + +.. На вкладці *Logic* додайте *Action*: `edit`. Це поле відповідає за навігаційну дію по редагуванню сутності, відповідно до визначеної умови (*Condition*), налаштованої на відповідній гілці xref:#xor-gw[XOR-шлюзу] (_див. нижче_). ++ +image::best-practices/view-object-creator-editor/bp-view-object-creator-editor-3-2.png[] + +. Змоделюйте компонент *Button*. +* На вкладці *Display* встановіть наступні параметри: + +** *Action*: `Navigation` +** *Action code*: `create`. Це поле відповідає за навігаційну дію зі створення сутності, відповідно до логіки умови (*Condition*), налаштованої на відповідній гілці XOR-шлюзу (_див. нижче_). + ++ +image::best-practices/view-object-creator-editor/bp-view-object-creator-editor-3-3.png[] + ++ +[TIP] +==== +Основний референтний сценарій: :: + +У цьому референтному процесі для редагування сутності використано логіку налаштування дії над рядком таблиці через контекстне меню "три крапки" з опцією редагування відповідно, для якої й налаштовується *Action*: `edit`. ++ +image::best-practices/view-object-creator-editor/bp-view-object-creator-editor-3-4.png[] ++ +Детально про це описано у xref:best-practices/edit-grid-rows-action.adoc[]. ++ +Для створення сутності використано кнопку (компонент *Button*) з опцією створення відповідно, для якої налаштовується Action code: `create`. ++ +image::best-practices/view-object-creator-editor/bp-view-object-creator-editor-3-5.png[] + +Додатковий сценарій: :: + +Ви можете також розглянути альтернативний варіант редагування записів у вашій таблиці -- через додавання окремої кнопки (компонент *Button*) та додавання Action code: `edit` безпосередньо для цього компонента. ++ +image::best-practices/view-object-creator-editor/bp-view-object-creator-editor-3-6.png[] ++ +У такому випадку, щоб обрати потрібні записи для редагування не з контекстного меню, потрібно активувати опцію `Multiple-record selection`, яка дозволяє користувачам вибирати кілька записів в таблиці одночасно. Тобто ви оберете кілька записів, натиснете кнопку *`Редагувати`* і згідно з налаштованим *Action code* та умовою XOR-шлюзу (*Condition Expression*), процес перейде до задачі редагування цих записів. ++ +image::best-practices/view-object-creator-editor/bp-view-object-creator-editor-3-7.png[] + ++ +В такому сценарії налаштування у вас буде дві кнопки (компоненти *Button*), які матимуть налаштовані коди дії (action codes). ++ +image::best-practices/view-object-creator-editor/bp-view-object-creator-editor-3-8.png[] + +==== + ++ +[TIP] +==== +Більш детально з моделюванням форм ви можете ознайомитися на сторінках: + +* xref:bp-modeling/forms/registry-admin-modelling-forms.adoc[] +* xref:bp-modeling/forms/components/index.adoc[] +* xref:bp-modeling/forms/components/edit-grid/edit-grid.adoc[] +==== + +[#xor-gw] +==== Створення XOR-шлюзу (Exclusive Gateway) та відповідних гілок процесу + +Для управління потоком рішень у вашому бізнес-процесі, ви можете додати exclusive-шлюз (XOR-шлюз), який дозволить розгалужувати процес на основі певних умов. + +image::best-practices/view-object-creator-editor/bp-view-object-creator-editor-4.png[] + +Налаштуйте події, щоб керувати процесом залежно від введених даних чи станів сутностей. Використання XOR-шлюзу дозволяє гнучко маніпулювати ходом процесу, використовуючи умови, що залежать від дій користувача або системних параметрів. + +Гілка створення сутності :: ++ +. *Налаштування умови для створення*: + +.. Використайте поле *Type* для вибору `Expression`. +.. У полі *Condition Expression* задайте JUEL-функцію `submission()` для перевірки дії користувача. ++ +[source,groovy] +---- +${submission('UserTask_ViewFactorData').formData.prop('_action_code').value().equals('create')} +---- ++ +Цей вираз перевіряє, чи дія користувача полягає у створенні нової сутності. Якщо так, процес буде спрямований гілкою створення. + ++ +image::best-practices/view-object-creator-editor/bp-view-object-creator-editor-4-1.png[] + +Гілка редагування сутності :: + +. *Налаштування умови для редагування*: + +.. Знову використайте поле *Type* для вибору `Expression`. +.. У полі *Condition Expression* використайте JUEL-функцію `submission()` для перевірки дії користувача. ++ +[source,groovy] +---- +${submission('UserTask_ViewFactorData').formData.prop('_action_code').value().equals('edit')} +---- ++ +Цей вираз перевіряє, чи користувач обрав дію редагування наявної сутності. У разі позитивної відповіді, процес буде спрямований гілкою редагування. + ++ +image::best-practices/view-object-creator-editor/bp-view-object-creator-editor-4-2.png[] + +==== Користувацька задача для створення фактора + +Налаштування бізнес-процесу: :: + +. Змоделюйте користувацьку задачу (*User Task*). +. Застосуйте шаблон делегата (*User Form*). +. У полі *Form key* вкажіть службову назву UI-форми (_тут_ -- `reference-create-factor`). + ++ +image::best-practices/view-object-creator-editor/bp-view-object-creator-editor-5.png[] + +Налаштування UI-форми задачі: :: + +. Змоделюйте компонент *Text Field*. +. У полі *Label* вкажіть назву поля -- *Назва фактора*. +. Перейдіть до вкладки *Validation* та активуйте параметр *Required*, який вимагатиме обов'язкового заповнення цього поля на формі. + ++ +image::best-practices/view-object-creator-editor/bp-view-object-creator-editor-6.png[] + ++ +[TIP] +==== +Більш детально з моделюванням форм ви можете ознайомитися на сторінках: + +* xref:bp-modeling/forms/registry-admin-modelling-forms.adoc[] +* xref:bp-modeling/forms/components/index.adoc[] +* xref:bp-modeling/forms/components/text-field.adoc[] +==== + +==== Користувацька задача для підписання даних КЕП + +. Створіть користувацьку задачу (*User Task*) і застосуйте шаблон делегата *Officer Sign Task*. +. Заповніть необхідні поля, зокрема у полі *Form key* вкажіть службову назву форми для підписання даних КЕП (_тут_ -- `reference-create-factor-sign`). ++ +image::best-practices/view-object-creator-editor/bp-view-object-creator-editor-7.png[] + +TIP: Детальніше про моделювання форм для підписання даних див. xref:bp-modeling/forms/registry-admin-modelling-forms.adoc#form-sign-task[Створення форми для підписання даних КЕП]. + +==== Скрипт підготування даних для збереження до БД + +Для ефективного оброблення та збереження даних, використовуйте скрипт-задачу, що дозволяє підготувати дані перед їх записом у базу даних. Цей процес включає отримання даних від користувача, їх обробку та формування відповідного формату для збереження. + +[source,groovy] +---- +def factorName = submission('UserTask_SignData').formData.prop('name').value() +def username = completer('UserTask_SignData').fullName +def factor = [:] + +factor['name'] = factorName +factor['creatorFullName'] = username + +set_transient_variable('payload', S(factor, 'application/json')) +---- + +У цьому скрипті: + +* `factorName` отримує значення назви фактора з форми `UserTask_SignData`. +* `username` визначає повне ім'я користувача, який є виконавцем задачі. +* Ініціалізується порожній словник `factor`, де зберігаються дані для запису. + +Скрипт виконує наступні дії: + +* Присвоює отримане ім'я фактора (`factorName`) та ім'я користувача (`username`) до словника `factor`. +* Встановлює тимчасову змінну `payload`, використовуючи функцію `set_transient_variable`, для передачі оброблених даних у форматі `application/json`. + +==== Сервісна задача для підпису даних системним ключем + +Для забезпечення безпеки та автентичності даних у вашому бізнес-процесі, ви можете використовувати сервісну задачу, яка дозволяє підписати дані системним ключем. Це важлива частина процесу, що забезпечує цілісність та незмінність інформації. Ось як це можна зробити: + +. Створення сервісної задачі: + +.. Додайте нову сервісну задачу (*Service Task*) у вашому бізнес-процесі. Ця задача використовуватиметься для автоматичного підписання даних системним ключем. + +.. Використовуйте шаблон делегата *System signature by DSO service* для реалізації процесу підпису. + +. Передача даних для підпису: + +* У полі *Payload* вкажіть дані, які необхідно підписати, використовуючи змінну `${payload}`. Ця змінна містить дані, отримані з попередньої скрипт-задачі. + +. *Налаштування токена підписанта*: + +* У полі *X-Access-Token source* внесіть токен підписанта, отриманий з останньої користувацької задачі: `${completer('UserTask_SignData').accessToken}`. Для цього використайте функцію `completer()`, якій передайте ID задачі, а також застосуйте метод `accessToken`. Цей токен забезпечує аутентифікацію виконавця процесу та його повноваження щодо підписання даних. + +. *Збереження результату підпису*: + +* У полі *Result variable* внесіть значення `systemSignatureKey`. Це змінна, де буде зберігатися результат підписання даних системним ключем + +Ця сервісна задача є ключовим елементом у забезпеченні безпеки даних. Вона дозволяє використовувати сучасні механізми шифрування та підпису, забезпечуючи, що дані, які переміщуються через різні етапи бізнес-процесу, залишаються захищеними та недоступними для несанкціонованого доступу. + +image::best-practices/view-object-creator-editor/bp-view-object-creator-editor-8.png[] + +==== Сервісна задача для збереження даних до БД + +Збережіть дані до постійного сховища. Для створення сервісної задачі, що зберігатиме дані до БД, виконайте наступні кроки: + +. Створення задачі: + +* Додайте нову сервісну задачу (*Service Task*) у вашому бізнес-процесі. Ця задача буде відповідати за збереження оброблених та підписаних даних. + +. Налаштування параметрів задачі: + +.. У полі *Name* вкажіть назву задачі, яка відображатиме її функцію, наприклад, `Збереження оброблених даних`. +.. Застосуйте шаблон делегата *Create entity in data factory*. +.. У полі *Resource* вкажіть ресурс або назву API-ендпоінту, через який будуть зберігатися дані. У нашому випадку -- `factor-names`. +.. У полі *Payload* вкажіть тіло запита: `${payload}`. Це передає дані, які необхідно зберегти, і які були підготовлені на попередніх етапах. +.. У полі *X-Access-Token* вкажіть `${completer('UserTask_SignData').accessToken}`. Це токен доступу користувача, що забезпечує авторизацію для здійснення операції збереження. +.. У полі *X-Digital-Signature source* вкажіть `${sign_submission('UserTask_SignData').signatureDocumentId}`. Це ідентифікатор документа, який містить цифровий підпис. +.. У полі *X-Digital-Signature-Derived source* вкажіть `${system_signature_ceph_key}`. Це посилання на ключ цифрового підпису, отриманого від системи. +.. У полі *Result variable* вкажіть назву для вихідного параметра, наприклад, `response`. Це буде змінна, в якій зберігатиметься результат операції збереження. + +image::best-practices/view-object-creator-editor/bp-view-object-creator-editor-9.png[] + +==== Опис гілки для редагування факторів + +Після відпрацювання логіки, налаштованої на гілках XOR-шлюзу, бізнес-процес може піти по шляху редагування сутності. + +Створіть ланцюг задач для редагування сутності, подібно до описаних вище налаштувань для створення факторів. + +==== Оновлення сутності у базі даних + +Для забезпечення можливості оновлення відредагованих даних сутності у вашій базі даних, використовуйте сервісну задачу, що дозволяє впроваджувати зміни в постійне сховище даних. Цей процес є важливим для підтримання актуальності та цілісності інформації. Ось як ви можете це реалізувати: + +. *Створення сервісної задачі*: + +.. Додайте нову сервісну задачу (*Service Task*) у бізнес-процес. +.. Використайте типове розширення *Update entity in Data factory* для оновлення сутності в базі даних. + +. *Налаштування параметрів задачі*: + +.. У полі *Resource* вкажіть `factor-names` для ідентифікації таблиці, де буде оновлюватися сутність. +.. У полі *Resource id* використовуйте наступне значення для визначення ідентифікатора сутності, що оновлюється: ++ +[source,groovy] +---- +${submission('UserTask_ViewFactorData').formData.prop('factorData').elements().get(0).prop('id').value()}`. +---- ++ +[TIP] +==== +[%collapsible] +.Деталі використання виразу +===== + +. **`submission('UserTask_ViewFactorData')`**: + +* Ця функція звертається до даних, які були введені користувачем у попередній користувацькій задачі з назвою `UserTask_ViewFactorData`. +* Вона використовується для доступу до відповіді, яка містить дані, заповнені користувачем у формі. + +. **`.formData.prop('factorData')`**: + +* Це дозволяє вибрати конкретне поле форми, яке містить дані про сутність. У цьому випадку, поле називається `factorData`. +* `formData` є об'єктом, що містить всі дані форми, а `prop('factorData')` вибирає властивість `factorData` з цих даних. + +. **`.elements().get(0)`**: + +* Якщо `factorData` містить список елементів (наприклад, якщо це масив або колекція), цей вираз вибирає перший елемент цього списку. +* `get(0)` позначає перший елемент, де індексація починається з 0. + +. **`.prop('id').value()`**: + +* Цей рядок витягує значення властивості `id` з обраного елемента (`factorData[0]`). +* `prop('id')` звертається до поля `id` в даних елемента, а `.value()` отримує його значення. +===== +==== + +.. У полі *Payload* передайте `${payload}`, що містить дані сутності для оновлення. + +. *Налаштування авторизації та підпису*: + +.. У полі *X-Access-Token* вкажіть `${completer('UserTask_EditFactorSign').accessToken}` для авторизації доступу до операції оновлення. +.. У полі *X-Digital-Signature source* задайте `${sign_submission('UserTask_EditFactorSign').signatureDocumentId}` для визначення цифрового підпису документа. +.. У полі *X-Digital-Signature-Derived source* вкажіть `${system_signature_ceph_key}`, що вказує на ключ цифрового підпису. + +. **Запис результату операції**: + +* Встановіть змінну *Result variable* як `response`. Це забезпечує збереження відповіді від сервісної задачі для подальшого використання у процесі. + +Ця задача є критично важливою для підтримки актуальності бази даних та забезпечення цілісності відредагованих даних. Завдяки цьому механізму оновлення, бізнес-процес стає більш надійним та ефективним у управлінні даними. + +image::best-practices/view-object-creator-editor/bp-view-object-creator-editor-10.png[] + +==== Завершення процесу та результат + +Додайте *End Event* для завершення бізнес-процесу. + +У результаті користувачу на формі бізнес-процесу, в таблиці будуть відображені назви сутностей, автор створення та останній, хто редагував певну сутність. + +image:release-notes:wn-1-9-7/wn-1-9-7-13.png[] + +== Формування витягу у форматі PDF з інформацією про автора створення та редагування сутності + +=== Моделювання витягів + +. Ознайомтеся з процесом моделювання витягів на сторінках: + +* xref:registry-admin/registry-admin-reports-pdf-docx-csv.adoc[] +* xref:registry-develop:bp-modeling/bp/excerpts/bp-modeling-excerpt-csv-docx.adoc[] + +. Виконайте кроки з формування шаблону витягу. + +=== Приклади моделювання регламенту + +Скористайтеся референтними прикладами моделювання регламенту. + +[TIP] +==== +[%collapsible] +.Де можна знайти приклад бізнес-процесу? +===== +include::partial$snippets/demo-reg-reference-examples-ua.adoc[] + +Приклад BPMN-схеми процесу буде доступний у регламенті демо-реєстру за пошуком по ключовим словам -- *_feature-zvit-pdf-bp_*. + +Назви форм ви можете знайти всередині відповідних користувацьких задач (User Task) бізнес-процесу у полі *`Form key`*: *_feature-read-factor-data-zvit.json_* + +У Кабінеті отримувача послуг процес буде доступний користувачам у папці *_Референтні бізнес-процеси з відображенням автора та часу змін > Формування звіту по факторах у форматі pdf_*. + +image:best-practices/view-object-creator-editor/bp-view-object-creator-editor-02.png[] +===== +==== + +[TIP] +==== +.Референтний приклад шаблону формування витягу +[%collapsible] +===== +Референтний приклад шаблону формування витягу буде доступний у регламенті демо-реєстру за шляхом: _excerpts/reference-factor-names-excerpt/index.html.ftl_. + +[source,html] +---- + + + + + + +
+ +
+

+ ДЕРЖАВНА СЛУЖБА УКРАЇНИ З ПИТАНЬ ПРАЦІ +
+ + (ДЕРЖПРАЦІ) + +

+ +

+ ВИТЯГ +
+ з Інформаційного переліку факторів +

+
+ + + + + + + + + + + + +
Дата, час формування[=.now?string('dd.MM.yyyy HH:mm:ss')]
+ +

+ Параметри запита +

+ + + + + + + + + + + + +
Тип витягуПро надання інформації щодо факторів виробничого середовища і трудового процесу
+ +

+ Актуальна інформація про фактори +

+ +

+ Згідно рішення про внесення до інформаційного переліку наступні фактори виробничого середовища і трудового процесу: + + + + + + + [#list factors as factor] + + + + + + [/#list] +
НазваСтворивРедагував
[=factor.name][=factor.creatorFullName][=factor.updaterFullName?default('')]
+

+

+ Інформацію про фактори виробничого середовища і трудового процесу внесено до інформаційного переліку та розміщено на офіційному вебсайті Держпраці. +

+ + +---- +===== +==== + +=== Відображення інформації у витягу для користувача + +Після проходження бізнес-процесу, користувачу в pdf форматі витягу відобразяться відповідні сутності з ПІБ того, хто створив сутність, та ПІБ того, хто останній редагував сутність у базі даних реєстру. + +image:release-notes:wn-1-9-7/wn-1-9-7-12.png[] + +== Створення та відображення звіту в Redash з інформацією про автора створення та редагування сутності + +=== Передумови + +. Ознайомтеся з особливостями звітності на сторінці xref:data-modeling/reports/reports-overview.adoc[]. + +. Скористайтеся докладною інструкцією на сторінці xref:study-project/study-tasks/task-6-registry-reports-modeling.adoc[Розробка аналітичної звітності: покрокове керівництво], яка охоплює всі аспекти розробки та перегляду аналітичної звітності від початку до кінця. + + +=== Створення аналітичного представлення + +. Створіть аналітичне представлення. ++ +-- +* Назва аналітичного представлення: `report_factors` +* Інформація з таблиці: `factor_names` +-- ++ +TIP: Для аналітичних представлень створіть окремий файл. Наприклад, _createAnalyticsViews.xml_. + ++ +TIP: Приклад аналітичного представлення "Звіт по факторам" міститься у регламенті демо-реєстру у файлі _createViewsForAnalytics.xml_ за шляхом: +_/data-model/reference/entity-creator-updater-information/createViewsForAnalytics.xml_. + ++ +.XML-шаблон створення аналітичного представлення +[source,xml] +---- + + + + + + + + + + + + +---- + ++ +TIP: Читайте також: xref:registry-develop:data-modeling/data/physical-model/liquibase-ddm-ext.adoc#create-analytical-views[Керування аналітичними представленнями]. + +. Надайте права доступу до цього аналітичного представлення. ++ +.XML-шаблон видачі прав доступу до аналітичного представлення для ролі analytics_officer +[source,xml] +---- + + + + + + + +---- ++ +TIP: Читайте також: xref:registry-develop:data-modeling/data/physical-model/liquibase-ddm-ext.adoc#manage-access-to-analytical-data[Керування доступом до аналітичних даних]. + +. У файлі _main-liquibase.xml_ додайте тег `**` з обов'язковим вказанням атрибута `file="data-model/createAnalyticsViews.xml"` у кінці тегу ``: ++ +[source,xml] +---- + + + +---- + +. Застосуйте зміни до мастер-версії регламенту в Gerrit (`git commit`, `git push`). +. Проведіть процедуру рецензування коду вашого commit. За відсутності прав, попросіть про це відповідальну особу. +. Дочекайтеся виконання *Jenkins*-пайплайну *MASTER-Build-registry-regulations*. + +=== Створення звіту в Redash + +. Створіть новий запит для визначеного вище аналітичного представлення. +. Натисніть на вкладку *Запити* > *`Новий запит`*. Ви побачите створений раніше запит до представлення `report_factors_v`. ++ +image:best-practices/view-object-creator-editor/bp-view-object-creator-editor-001.png[] + +. Створіть нову інформаційну панель (*Dashboard*). Створений дашборд буде доступний для перегляду та міститиме такі поля: ++ +-- +* Назва +* Автор створення об'єкта +* Автор редагування об'єкта +* (_Додатково_) Дата створення та дата останнього редагування разом з міткою часу виконання дій над сутністю +-- ++ +image:best-practices/view-object-creator-editor/bp-view-object-creator-editor-002.png[] ++ +image:release-notes:wn-1-9-7/wn-1-9-7-11.png[] diff --git a/docs/ua/modules/registry-develop/pages/best-practices/edit-grid-rows-action.adoc b/docs/ua/modules/registry-develop/pages/best-practices/edit-grid-rows-action.adoc index dcbef66579..750f7ca4ff 100644 --- a/docs/ua/modules/registry-develop/pages/best-practices/edit-grid-rows-action.adoc +++ b/docs/ua/modules/registry-develop/pages/best-practices/edit-grid-rows-action.adoc @@ -1,23 +1,7 @@ -:toc-title: ЗМІСТ -:toc: auto -:toclevels: 5 -:experimental: -:important-caption: ВАЖЛИВО -:note-caption: ПРИМІТКА -:tip-caption: ПІДКАЗКА -:warning-caption: ПОПЕРЕДЖЕННЯ -:caution-caption: УВАГА -:example-caption: Приклад -:figure-caption: Зображення -:table-caption: Таблиця -:appendix-caption: Додаток -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Вибір та виконання дій з одного чи декількох рядків у таблиці +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Моделювання структур даних @@ -25,14 +9,19 @@ [TIP] ==== -Приклад _.xml_-схем та пов'язаних CSV-файлів для створення моделі даних ви можете знайти у регламенті демо-реєстру *_consent-data_* за посиланням: -https://admin-tools-consent-data.apps.envone.dev.registry.eua.gov.ua/gerrit. +[%collapsible] +.Де можна знайти референтні приклади моделювання даних? +===== +include::partial$snippets/demo-reg-reference-examples-ua.adoc[] + +Приклад _.xml_-схем та пов'язаних CSV-файлів для створення моделі даних ви можете знайти у регламенті демо-реєстру за пошуком по ключовим словам. Схема для створення таблиць та критеріїв пошуку буде доступна за назвою *_licenseTable.xml_*. Файл-довідник CSV із даними для імпорту в БД буде доступний за назвою *_licences.csv_*. Файл для заповнення таблиці licences даними буде доступний за назвою *_populateLicenses.xml_*. +===== ==== . Створіть новий тип даних, таблицю та критерій пошуку. @@ -152,17 +141,18 @@ BPMN-діаграма містить основний процес та два [TIP] ==== -Приклад _.bpmn_-моделі процесу із виконанням дії над багатьма рядками таблиці, а також користувацькі _.json_-форми до нього ви можете знайти у регламенті демо-реєстру *_consent-data_* за посиланням: -https://admin-tools-consent-data.apps.envone.dev.registry.eua.gov.ua/gerrit. - -Процес буде доступний за назвою *_edit-grid-rows-action.bpmn_*. Назви форм ви можете знайти всередині відповідних користувацьких задач бізнес-процесу у полі *`Form key`*. +[%collapsible] +.Де можна знайти приклади референтних бізнес-процесів? +===== +include::partial$snippets/demo-reg-reference-examples-ua.adoc[] -Споріднена модель процесу із виконанням дії над одним рядком таблиці буде доступний за назвою *_bp-action-one-row-grid.bpmn_*. +Приклади BPMN-схеми процесу буде доступний у регламенті демо-реєстру за пошуком по ключовим словам -- *_edit-grid-rows-action_*. Назви форм ви можете знайти всередині відповідних користувацьких задач бізнес-процесу у полі *`Form key`*. +===== ==== === Вибір усіх органів ліцензування з БД через критерій пошуку -Змоделюйте сервісну задача (Service Task) та використайте делегат *Search entities in data factory*. +Змоделюйте сервісну задача (Service Task) та використайте делегат *Search for entities in data factory*. На основі створеної моделі даних, ця задача відповідає за пошук та вибірку ліцензій з таблиці *`licenses`*. Таблиця *`licenses`* містить наступні стовпці: @@ -303,7 +293,7 @@ image:best-practices/edit-grid-rows-action/edit-grid-rows-action-4-2.png[] Детальніше про Call Activity та особливості їх застосування ви можете переглянути на сторінках: * xref:bp-modeling/bp/element-templates/bp-element-templates-installation-configuration.adoc[] -* xref:bp-modeling/bp/bpmn/subprocesses/overview.adoc[] +* xref:bp-modeling/bp/bpmn/subprocesses/subprocess-overview.adoc[] ==== Виконайте наступні налаштування: :: @@ -446,6 +436,7 @@ set_transient_variable('canceledLicense', canceledLicense) TIP: Приклади моделювання таких задач ви можете переглянути на сторінці xref:best-practices/bp-officer-self-register-manual.adoc[]. +[#update-entity-in-db] === Зберегти оновлені дані обраного рядка у таблиці на формі до БД Змоделюйте сервісну задачу, яка виконає операцію оновлення даних за обраним записом у БД. @@ -459,7 +450,7 @@ TIP: Приклади моделювання таких задач ви може Детальніше про це див. на сторінці xref:bp-modeling/bp/element-templates/bp-element-templates-installation-configuration.adoc[]. ==== -. Вкажіть *`resource`*, що вказує на ресурс, тобто таблицю яку потрібно оновити, у цьому випадку -- *`licenses`*. +. Вкажіть *resource*, що вказує на ресурс, тобто таблицю яку потрібно оновити, у цьому випадку -- *`licenses`*. . Вкажіть `Resource id`, що визначає ідентифікатор ліцензії, яку потрібно оновити. Наприклад: + @@ -546,7 +537,7 @@ image:best-practices/edit-grid-rows-action/forms/edit-grid-rows-action-form-3.pn + image:best-practices/edit-grid-rows-action/forms/edit-grid-rows-action-form-4.png[] -. Змоделюйте компонент *Button* для додаткової двох додаткових кнопок, щоб мати можливість виконувати дії над декількома рядками таблиці одночасно, коли активована опція `Multiple-record selection` в Edit Grid. +. Змоделюйте компонент *Button* для двох додаткових кнопок, щоб мати можливість виконувати дії над декількома рядками таблиці одночасно, коли активована опція `Multiple-record selection` в Edit Grid. * Додайте кнопку оновлення терміну дії ліцензії (для одного і більше записів у таблиці, за умови використання чекбоксу `Multiple-record selection` в Edit Grid). + @@ -566,7 +557,24 @@ TIP: Читайте про можливості Edit Grid у розділі до == Використання у Кабінетах користувачів -Змодельований бізнес-процес можна буде знайти у списку доступних послуг Кабінету посадової особи у демо-реєстрі _consent-data_. +Змодельований бізнес-процес можна буде знайти у списку доступних послуг _Кабінету користувача_ у демо-реєстрі. + +[TIP] +==== +_Кабінет користувача_ (*`officer-portal`*) доступний за шаблонним посиланням: + +---- +https://officer-portal--main. +---- + +де `` -- назва вашого реєстру, а `` вказує на доменні та піддоменні імена для інстансу Платформи. + +Наприклад, для демо-реєстру, який розгорнуто на екземплярі Платформи `example.com`, посилання до сервісу *`officer-portal`* виглядатиме так: + +https://officer-portal-demo-registry-main.example.com + +//https://officer-portal-{{{registry-name}}}-main.{{{dns-wildcard}}} +==== .Бізнес-процес у Кабінеті image::release-notes:wn-1-9-4/whats-new-1-9-4-8.png[] @@ -577,7 +585,7 @@ image::release-notes:wn-1-9-4/whats-new-1-9-4-5.png[] .Виконання дії над декількома рядками у таблиці image::release-notes:wn-1-9-4/whats-new-1-9-4-9.png[] +== Пов'язані сторінки - - - +* xref:best-practices/edit-grid-rows-action.adoc[] +* xref:bp-modeling/forms/components/edit-grid/edit-grid-hide-view-button.adoc[] diff --git a/docs/ua/modules/registry-develop/pages/best-practices/forms/date-time-enter-date.adoc b/docs/ua/modules/registry-develop/pages/best-practices/forms/date-time-enter-date.adoc new file mode 100644 index 0000000000..f9f72ddb37 --- /dev/null +++ b/docs/ua/modules/registry-develop/pages/best-practices/forms/date-time-enter-date.adoc @@ -0,0 +1,173 @@ += Моделювання компонента Date/Time для вводу дати (Україна) +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +== Загальний опис + +У цій статті розглянемо декілька прикладів того, яким чином налаштувати компонент *Date/Time* у форматі для України, залежно від потреб реєстру. + +NOTE: Згідно з українським законодавством, цифровий формат дати -- це один рядок у наступній послідовності: *день місяця*, *місяць*, *рік*. Значення розділені крапкою. Наприклад, `04.04.2002`. + +[TIP] +==== +[%collapsible] +.Де можна знайти приклад референтного бізнес-процесу? +===== +include::registry-develop:partial$snippets/demo-reg-reference-examples-ua.adoc[] + +Приклад BPMN-схеми процесу буде доступний у регламенті демо-реєстру за пошуком по ключовим словам -- *_reference-date-component-examples_*. Назви форм ви можете знайти всередині відповідних користувацьких задач (User Task) бізнес-процесу у полі *`Form key`*. + +.Загальний вигляд референтного процесу у Кабінеті адміністратора регламентів +image::best-practices/forms/enter-phone-number/enter-phone-number-1.png[] +===== +==== + +== Налаштування компонента Date/Time + +Розглянемо різні способи використання компонента *Date/Time*. + +=== Вибір дати: попередні та поточні + +Розглянемо налаштування для вибору попередніх і поточних дат через UI. + +. У *Кабінеті адміністратора регламентів*, створіть нову форму та оберіть компонент *Date/Time*. ++ +image:best-practices/forms/enter-date/enter-date-1.png[] + +. У полі *Format* вкажіть український формат дати, а також, для зручності, у полі *Placeholder* пропишіть підказку щодо формату для користувачів. ++ +image:best-practices/forms/enter-date/enter-date-2.png[] + +. На вкладці *Date* знайдіть розділ *Custom disabled dates* на вкажіть наступний скрипт: ++ +[source,js] +---- +moment(date).isSameOrAfter(moment(), 'day') +---- ++ +image:best-practices/forms/enter-date/enter-date-3.png[] + +. У *Кабінеті користувача* поле виглядатиме наступним чином: при натисканні на календар, для внесення доступні лише попередні дати. ++ +image:best-practices/forms/enter-date/enter-date-4.png[] + +=== Вибір дати: обмежені періоди + +Розглянемо налаштування для вибору дат із певного діапазону. + +. У *Кабінеті адміністратора регламентів*, на формі додайте новий компонент *Date/Time*. ++ +image:best-practices/forms/enter-date/enter-date-1.png[] + +. На вкладці *Date*, у полях *Use calendar to set minDate* та *Use calendar to set maxDate* вкажіть мінімально та максимально допустимі дати для вибору. ++ +image:best-practices/forms/enter-date/enter-date-5.png[] + +. У *Кабінеті користувача* поле виглядатиме наступним чином: дати, доступні для вибору, обмежені значеннями, що вніс моделювальник форми. ++ +image:best-practices/forms/enter-date/enter-date-6.png[] ++ +image:best-practices/forms/enter-date/enter-date-6-1.png[] + +=== Вибір Дати: лише через календар + +Розглянемо налаштування, де дата може бути обрана лише через календар. + +. У *Кабінеті адміністратора регламентів*, на формі додайте новий компонент *Date/Time*. ++ +image:best-practices/forms/enter-date/enter-date-1.png[] + +. На вкладці *Display* вимкніть чек-бокс *Allow Manual Input*. За замовчуванням він увімкнений. ++ +image:best-practices/forms/enter-date/enter-date-7.png[] + +. У Кабінеті користувача, поле буде недоступним для ручного редагування, натомість користувачі зможуть обирати значення з календаря. ++ +image:best-practices/forms/enter-date/enter-date-8.png[] + +=== Вибір дати: лише ручне внесення + +Розглянемо налаштування для введення дати вручну, без використання календаря. + +. У *Кабінеті адміністратора регламентів*, на формі додайте новий компонент *Date/Time*. ++ +image:best-practices/forms/enter-date/enter-date-1.png[] + +. На вкладці *Date* вимкніть чек-бокс *Enable Date Input*. За замовчуванням він увімкнений. ++ +image:best-practices/forms/enter-date/enter-date-9.png[] + +. У Кабінеті користувача буде доступним лише поле для внесення дати, натомість календар -- недоступний для використання. ++ +image:best-practices/forms/enter-date/enter-date-10.png[] ++ +NOTE: Якщо користувач внесе невалідне значення в полі, то при натисканні курсором поза межами цього поля, воно стане порожнім. Тому радимо при моделюванні робити його обов'язковим, щоб користувач не міг підтвердити форму з некоректним значенням. + +=== Вибір попередньої дати за замовчуванням + +Розглянемо налаштування, що автоматично відображають попередньо встановлену дату за замовчуванням. + +. У *Кабінеті адміністратора регламентів*, на формі додайте новий компонент *Date/Time*. ++ +image:best-practices/forms/enter-date/enter-date-1.png[] + +. На вкладці *Data* знайдіть поле *Default Value* та визначте довільне значення, яке відображатиметься на формі як значення за замовчуванням для цього поля. ++ +image:best-practices/forms/enter-date/enter-date-11.png[] + +. У *Кабінеті користувача* поле виглядатиме наступним чином: ++ +image:best-practices/forms/enter-date/enter-date-12.png[] ++ +TIP: За потреби, значення у полі можна змінювати. + +=== Вибір поточної дати за замовчуванням + +Розглянемо налаштування, що автоматично відображають поточну дату за замовчуванням. + +. У *Кабінеті адміністратора регламентів*, на формі додайте новий компонент *Date/Time*. ++ +image:best-practices/forms/enter-date/enter-date-1.png[] + +. На вкладці *Data* знайдіть розділ *Custom Default Value* та вкажіть наступний скрипт: ++ +[source,js] +---- +value = moment().format() +---- ++ +image:best-practices/forms/enter-date/enter-date-13.png[] ++ +У результаті при кожному відображенні змодельованої форми Кабінету, поле матиме встановлену поточну дату за замовчуванням. + +. У *Кабінеті користувача* поле виглядатиме наступним чином: ++ +image:best-practices/forms/enter-date/enter-date-14.png[] ++ +TIP: За потреби, значення у полі можна змінювати. + +[#select-year-in-calendar] +== Вибір року у календарі компонента Date/Time + +Надавачі та отримувачі послуг можуть легко та зручно вибирати потрібний рік під час визначення дати. Ця функція особливо корисна, коли потрібно вказати дату, яка значно відрізняється від поточної, наприклад, дату народження. Така можливість робить процес вибору дати більш зручним та ефективним. + +[date-time-set-year-officer-portal] +=== Перегляд компонента у Кабінеті користувача + +При використанні компонента *Date/Time* у процесі моделювання, користувачам у Кабінеті надається зручна функція вибору року. Для демонстрації цієї можливості, запустіть бізнес-процес під назвою *Стилізований компонент Date/Time*. Ви знайдете його у папці *Бізнес-процеси зі стилізованими компонентами*, доступний для користувачів з роллю `op-regression`. + +image:best-practices/forms/enter-date/enter-date-year-1.png[] + +Натиснувши на іконку біля року у полі вибору дати, відкриється перелік, де доступні попередні та наступні роки для швидкого вибору. Це забезпечує користувачам можливість легко переміщатися по роках, перегортаючи сторінки вперед чи назад, для вибору потрібного року. + +Зображення, що демонструють цей процес: :: ++ +image:best-practices/forms/enter-date/enter-date-year-2.png[] ++ +image:best-practices/forms/enter-date/enter-date-year-3.png[] ++ +image:best-practices/forms/enter-date/enter-date-year-4.png[] ++ +image:best-practices/forms/enter-date/enter-date-year-5.png[] + + + diff --git a/docs/ua/modules/registry-develop/pages/best-practices/forms/text-field-enter-phone-number.adoc b/docs/ua/modules/registry-develop/pages/best-practices/forms/text-field-enter-phone-number.adoc new file mode 100644 index 0000000000..2d1ee33ad0 --- /dev/null +++ b/docs/ua/modules/registry-develop/pages/best-practices/forms/text-field-enter-phone-number.adoc @@ -0,0 +1,196 @@ += Моделювання компонента Textfield для вводу номера телефону (Україна) +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +== Загальний опис + +Компонент *Textfield* розширено та оптимізовано спеціально для введення номерів телефону в українському форматі. + +Тепер користувачам реєстрів доступні такі функції: :: + +* [*] _Референтний приклад із маскою для телефонів_: Тепер моделювальники регламенту можуть використовувати референтний приклад для створення полів введення з готовою маскою номера телефону, що відповідає українському формату: `+380(00)123-4567`. + +* [*] _Видалення службових символів_: компонент *Textfield* тепер можна налаштувати таким чином, щоб він автоматично видаляв всі службові символи та розділові знаки, передаючи лише чисті цифри. + +Ці зміни не лише роблять процес введення номерів телефону зручнішим та інтуїтивнішим, але й підвищують точність обробки даних. + +Також ми розробили спеціалізований приклад для моделювання форм з полями вводу номерів телефонів у форматі, що використовується в Україні. Це забезпечує швидше та зручніше створення користувацьких інтерфейсів. Також ми впровадили функціонал, який дозволяє розробникам обирати формат відображення та відправлення введених номерів з UI-форми до Фабрики даних. + +== Налаштування форми з маскою номера телефону та форматом відправлення даних + +. Увійдіть до *Кабінету адміністратора регламентів*. +. Відрийте розділ UI-форми та створіть нову або відредагуйте наявну форму. +. У налаштуваннях форми відкрийте вкладку *Конструктор* та знайдіть *Оновлені* компоненти. +. Перетягніть до панелі моделювання та налаштуйте компонент *Text Field*. ++ +TIP: Детальніше про налаштування компонента *Text Field* ви можете знайти на сторінці xref:registry-develop:bp-modeling/forms/components/text-field.adoc[]. ++ +image:bp-modeling/forms/components/textfield/trim-spaces/text-field-trim-spaces-1.png[] + +. На вкладці *Display* налаштуйте наступні параметри: + +.. У полі *Label* введіть назву поля користувацької форми -- `Номер телефону`. +.. У полі *Placeholder* встановіть плейсхолдер для поля *Номер телефону*. Цей плейсхолдер буде показаний, коли поле порожнє. +.. У полі *Input Mask* введіть маску вводу для номера телефону. Наприклад: ++ +---- ++380(99)999-9999 +---- ++ +* `+380()` -- незмінна частина маски вводу. +* Решта символів будуть заповнюватися користувачами при введенні номера. ++ +[TIP] +==== +[%collapsible] +.Що таке Input mask? +===== +*_Input mask_* (_українською -- "маска вводу"_) -- це функціональність, яка допомагає користувачам при введенні даних, забезпечуючи дотримання попередньо визначеного формату. Це особливо корисно при введенні даних, які вимагають строгої структури, таких як дати, числові значення, номери телефонів та інше. Маска вводу спрощує процес заповнення форм, оскільки користувачі можуть бачити візуальні підказки щодо очікуваного формату даних, що зменшує ймовірність помилок та покращує загальний досвід користувача. +===== +==== ++ +image:best-practices/forms/enter-phone-number/enter-phone-number-01.png[] ++ +При наведенні на підказку до поля, можна побачити опис налаштувань маски. ++ +image:best-practices/forms/enter-phone-number/enter-phone-number-02.png[] ++ +. Перевірте, як виглядатиме поле перед відправленням до БД. + +.. Користувачі бачитимуть поле вводу наступним чином: ++ +image:best-practices/forms/enter-phone-number/enter-phone-number-03.png[] + +.. При заповненні значення і підтвердженні форми, значення номера телефону буде передано Фабриці даних у наступному вигляді: ++ +image:best-practices/forms/enter-phone-number/enter-phone-number-04.png[] ++ +.Запит з UI-форми до Фабрики даних. Передача номера у форматі зі спецсимволами +[source,json] +---- +{ + "phoneNumber": "+380(50)123-4578", + "submit": true +} +---- + +. Для видалення спецсимволів з номера перед відправленням, перейдіть на вкладку *Data* й активуйте параметр *Phone Input*. ++ +NOTE: За замовчуванням параметр *Phone Input* вимкнений. ++ +image:best-practices/forms/enter-phone-number/enter-phone-number-05.png[] ++ +Активувавши чек-бокс, після введення даних і підтвердження відправлення форми, значення номера телефону буде передано Фабриці даних у наступному вигляді: ++ +.Запит з UI-форми до Фабрики даних. Передача номера у форматі без спецсимволів +[source,json] +---- +{ + "phoneNumber": "380501234578", + "submit": true +} +---- ++ +NOTE: Це налаштування необхідно використовувати, якщо дані, внесені на формі, надалі будуть опрацьовувати інші бізнес-процеси або зовнішні системи. + +== Референтний бізнес-процес + +[TIP] +==== +[%collapsible] +.Де можна знайти приклад референтного бізнес-процесу? +===== +include::registry-develop:partial$snippets/demo-reg-reference-examples-ua.adoc[] + +Приклад BPMN-схеми процесу буде доступний у регламенті демо-реєстру за пошуком по ключовим словам -- *_reference-ua-phone-number_*. Назви форм ви можете знайти всередині відповідних користувацьких задач (User Task) бізнес-процесу у полі *`Form key`*. + +.Загальний вигляд референтного процесу у Кабінеті адміністратора регламентів +image::best-practices/forms/enter-phone-number/enter-phone-number-1.png[] +===== +==== + +Розгляньмо референтний приклад бізнес-процесу для внесення та перегляду номерів телефону за визначеною маскою. Ми не будемо детально зупинятися на моделюванні, адже процес є доволі простим, натомість пропонуємо розглянути, як працює змодельована функціональність з погляду кінцевих користувачів. Для цього: + +. Увійдіть до *Кабінету користувача*. +. Відкрийте *Доступні послуги* > *Бізнес-процеси зі стилізованими компонентами для України* > *Моделювання номера телефону для України*. ++ +image:best-practices/forms/enter-phone-number/enter-phone-number-2.png[] + +. Запустіть бізнес-процес. ++ +Ви побачите форму для внесення двох номерів телефону в заданому форматі. Для кожного з полів в *Input Mask* встановлено український формат номера, але чек-бокс *Phone Input* активовано лише для першого поля. + +. Внесіть довільні дані натисніть *`Далі`*. Наприклад: ++ +---- ++380(50)114-4777 ++380(67)114-4255 +---- + +. У результаті формується наступний `POST`-запит на ресурс: ++ +.Запит (Request) форми із введеними номерами +==== + +.Хост (Host) +---- +test.domain.com +---- + +.URL запита +---- +POST /officer/api/user-task-management/task/15eac83c-ceea-467b-87e3-06962787e1a0/complete +---- + +* `15eac83c-ceea-467b-87e3-06962787e1a0` -- ID користувацької задачі у бізнес-процесі. + +.Тіло запита (Request body) +[source,json] +---- +{ + "data": { + "phoneNumber": "380501144777", + "additionalPhoneNumber": "+380(67)114-4255", + "submit": true + } +} +---- +==== ++ +.Відповідь (Response) +==== + +.Status +---- +200 OK +---- + +.Тіло відповіді (Response body) +[source,json] +---- +{ + "id": "15eac83c-ceea-467b-87e3-06962787e1a0", + "processInstanceId": "861fa6bc-8eb5-11ee-8566-06962787e1a0", + "rootProcessInstanceId": "861fa6bc-8eb5-11ee-06962787e1a0", + "rootProcessInstanceEnded": false, + "variables": {} +} +---- +==== ++ +image:best-practices/forms/enter-phone-number/enter-phone-number-3.png[] ++ +Зіставимо значення, введені на формі, із параметрами запита до Фабрики даних. Бачимо, що для першого номера з форми відправляються лише цифри, для другого -- цифри зі спецсимволами. + +. На наступній формі підпишіть введені дані КЕП. + +. Далі бізнес-процес зберігає дані до БД за допомогою делегата *Create entity in data factory*. ++ +image:best-practices/forms/enter-phone-number/enter-phone-number-4.png[] + +. На наступній формі ви отримаєте значення номерів, збережене до Фабрики даних із попередньої форми. Для першого поля, з якого в запиті відправлялись лише цифри, налаштовано маску та активовано чек-бокс *Phone Input*. Тому тепер на формі бачимо, що обидва значення, збережені у різному вигляді, відображаються в українському форматі номера телефону. ++ +image:best-practices/forms/enter-phone-number/enter-phone-number-5.png[] + +== Пов'язані сторінки + +* xref:registry-develop:bp-modeling/forms/components/text-field.adoc[] \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/pages/bp-modeling/bp/access/bp-limiting-access-keycloak-attributes.adoc b/docs/ua/modules/registry-develop/pages/bp-modeling/bp/access/bp-limiting-access-keycloak-attributes.adoc index 260d6e57b2..d75b47b35c 100644 --- a/docs/ua/modules/registry-develop/pages/bp-modeling/bp/access/bp-limiting-access-keycloak-attributes.adoc +++ b/docs/ua/modules/registry-develop/pages/bp-modeling/bp/access/bp-limiting-access-keycloak-attributes.adoc @@ -328,7 +328,7 @@ image:bp-modeling/bp/keycloak-attributes-access/bp-keycloak-attributes-access-11 * `-citizen-portal` * `-external-system`. -TIP: Детальніше про створення користувачів та надання їм прав доступу -- за xref:admin:user-management-auth/keycloak-create-users.adoc[посиланням]. +TIP: Детальніше про створення користувачів та надання їм прав доступу -- за xref:registry-admin/create-users/overview.adoc[посиланням]. CAUTION: Список користувачів за атрибутами необхідно отримати із реалму `-officer-portal`, адже доступ до задачі надається користувачам із роллю "Посадова особа". diff --git a/docs/ua/modules/registry-develop/pages/bp-modeling/bp/bp-alternative-branches.adoc b/docs/ua/modules/registry-develop/pages/bp-modeling/bp/bp-alternative-branches.adoc index 8d8b5a407e..2149d36092 100644 --- a/docs/ua/modules/registry-develop/pages/bp-modeling/bp/bp-alternative-branches.adoc +++ b/docs/ua/modules/registry-develop/pages/bp-modeling/bp/bp-alternative-branches.adoc @@ -67,7 +67,7 @@ image:bp-modeling/forms/admin-portal-form-modeling-step-1.png[] . Перейдіть до сервісу моделювання UI-форм для бізнес-процесів. + -image:bp-modeling/forms/admin-portal-form-modeling-step-2.png[] +image:registry-admin/admin-portal/ui-forms/ui-forms-1.png[] . Створіть нову форму для підпису даних КЕП, або відкрийте одну зі змодельованих попередньо. + diff --git a/docs/ua/modules/registry-develop/pages/bp-modeling/bp/bp-async-data-load.adoc b/docs/ua/modules/registry-develop/pages/bp-modeling/bp/bp-async-data-load.adoc new file mode 100644 index 0000000000..111e4cedf4 --- /dev/null +++ b/docs/ua/modules/registry-develop/pages/bp-modeling/bp/bp-async-data-load.adoc @@ -0,0 +1,698 @@ += Асинхронне завантаження даних до БД +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +[#problem-statement] +== Проблематика + +У минулих реалізаціях системи процес завантаження даних з CSV-файлів виконувався синхронно. Це означає, що кожен запит на завантаження даних повинен бути оброблений і завершений в межах фіксованого часу -- максимум 30 секунд. До того ж через обмеження в комунікації між сервісами через брокера повідомлень, максимальний розмір файлу, який міг бути завантажений, становив лише 1 МБ. Це вело до додаткового обмеження: файл міг містити не більше 50 рядків. + +Такі обмеження стають значною проблемою, коли виникає потреба обробляти більші набори даних. Великі файли, які перевищують ліміт в один мегабайт або вимагають більше часу для обробки, ніж дозволений таймаут, не можуть бути ефективно завантажені та оброблені. Це обмежувало можливості використання системи для великих та складних наборів даних, зменшуючи її ефективність та масштабованість. + +== Загальний опис + +Платформа надає можливості _асинхронного завантаження даних_. Тепер користувачі отримують значно більше можливостей для ефективної роботи з великими обсягами інформації. Це особливо корисно для тих, хто потребує завантаження й обробки масивних даних, які перевищують стандартні обмеження розміру та часу обробки. + +[TIP] +==== +[%collapsible] +.Простими словами: що таке синхронне та асинхронне завантаження даних? +===== +Синхронне завантаження даних :: ++ +Уявіть, що синхронне завантаження даних -- це як замовлення кави в кафе. Ви підходите до баристи, робите замовлення і чекаєте біля стійки, поки ваше замовлення буде готове. Протягом цього часу ви не можете робити нічого іншого, окрім як чекати. Коли кава готова, ви її отримуєте і тільки тоді можете йти далі. ++ +У випадку синхронного завантаження, програма відправляє запит на завантаження даних і "замирає" в очікуванні, поки ці дані не будуть повністю оброблені та повернені. Це може зайняти час і поки цей процес не закінчено, програма не може виконувати інші завдання. + +{empty} + +Асинхронне завантаження даних :: ++ +А тепер уявіть, що асинхронне завантаження даних -- це як замовлення кави через мобільний додаток. Ви робите замовлення і можете йти займатися своїми справами. Коли кава буде готова, ви отримаєте повідомлення на телефон і можете прийти її забрати. ++ +Так само працює асинхронне завантаження: програма відправляє запит на завантаження даних, але не чекає відповіді, продовжуючи виконувати інші завдання. Коли дані будуть готові, програма отримає повідомлення (через якусь подію тощо) і може продовжити з ними роботу. Це забезпечує більш ефективне використання ресурсів, особливо при роботі з великими обсягами даних або даними, які вимагають багато часу на обробку. + +Таким чином, основна відмінність між синхронним і асинхронним завантаженням полягає у способі очікування результату: синхронне завантаження змушує "зачекати", поки асинхронне дозволяє продовжити роботу й отримати результат пізніше. +===== +==== + +[key-capabilities] +=== Ключові можливості + +Обробка великих обсягів даних :: +Завантажуйте й обробляйте файли, розмір яких значно перевищує 1 МБ, без страху перевищення таймауту обробки. + +Гнучке збереження даних :: +Зберігайте дані з одного файлу у декілька таблиць, що підвищує гнучкість управління даними. + +Ефективність та масштабованість :: +Система підтримує більш ефективну та масштабовану обробку даних, адаптовану до потреб сучасних бізнес-завдань. + +== План дій з налаштування функціональності + +[%interactive] +* [ ] Використовуйте готові референтні приклади моделювання регламенту реєстру. ++ +[NOTE,caption=Референтні приклади моделювання регламенту] +==== +[%collapsible] +.Де можна знайти референтні приклади моделювання? +===== +include::partial$snippets/demo-reg-reference-examples-ua.adoc[] + +Приклад BPMN-схеми процесу буде доступний у регламенті демо-реєстру за пошуком по ключовим словам -- *_reference-save-array-from-csv-file_*. Назви форм ви можете знайти всередині відповідних користувацьких задач бізнес-процесу у полі *`Form key`*. +===== +==== + +* [ ] xref:#data-modeling[Моделювання структур даних]: використовуйте тег *``* для асинхронного завантаження даних зі встановленим атрибутом ліміту записів -- `limit`. + +* [ ] xref:#bp-modeling[Моделювання бізнес-процесу]: налаштуйте делегат *Async Data Load Csv Delegate* для асинхронного завантаження даних до БД. + +* [ ] xref:#form-modeling[Моделювання UI форми]: використовуйте компонент *Data Import* для спрощення імпорту даних. + +* [ ] xref:#notification-templates[Налаштуйте шаблони відправлення повідомлень] зі статусом завантаження даних. + +* [ ] xref:#file-upload-restrictions[Регулюйте обмеження щодо розміру файлу] на рівні Control Plane. + +[#data-modeling] +== Моделювання структур даних + +Змоделюйте структуру даних для асинхронного завантаження сутностей до БД. Розглянемо приклад завантаження даних до таблиці `diplomas` в рамках масиву `entityList`. Також для наочності показані приклади інших таблиць і композитна сутність. + +NOTE: Атрибут `limit` є обов'язковим при створенні `createAsyncLoad`. + +.Приклад XML changeSet для асинхронного завантаження даних +[source,xml] +---- + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +---- + +Пояснення до XML-схеми: :: + +Ця структура `changeSet` відображає комплексний підхід до створення та налаштування бази даних для асинхронного завантаження даних. Особливо важливо це для сценаріїв, де необхідно ефективно обробляти великі набори даних або дані, які надходять у великій кількості та з різних джерел. + +Структура `changeSet` включає: + +. Створення таблиць (`createTable`): ++ +* `name="item"`: створює нову таблицю з назвою `item`. +* `name="demo_entity"`: створює іншу таблицю з назвою `demo_entity`. +* `name="diplomas"`: додає таблицю `diplomas`, призначену для специфічних даних, пов'язаних з дипломами. + +. Створення складної сутності (`createCompositeEntity`): + +* `name="item_with_references"`: створює складну сутність для управління взаємопов'язаними даними. + +. Визначення асинхронного завантаження (`createAsyncLoad`): + +* Набір правил для асинхронного завантаження визначається в `entityList`, включаючи ліміти для кожної сутності (`limit`). + +. Видалення налаштувань асинхронного завантаження (`deleteAsyncLoad`), за потреби. + +[TIP] +==== +* [*] Деталі створення таблиць у базі даних ви можете дізнатися у розділі xref:data-modeling/data/physical-model/liquibase-ddm-ext.adoc#createTable[Створення таблиць]. + +* [*] Більше про складні сутності ви можете дізнатися у розділі xref:data-modeling/data/physical-model/liquibase-ddm-ext.adoc#createCompositeEntity[Збереження декількох сутностей в рамках однієї транзакції]. +==== + +[#bp-modeling] +== Моделювання бізнес-процесу + +Розглянемо референтний приклад бізнес-процесу із завантаженням даних про дипломи. + +image:release-notes:wn-1-9-6/wn-1-9-6-14.png[] + +Процес складається з таких основних етапів: + +. _Створення *User Task_*: створення користувацької задачі із використанням шаблону *User Form* для завантаження CSV-файлу з даними про дипломи. + +. _Підпис файлу КЕП_: використання шаблону *Officer Sign Task* для підпису файлу. + +. _Обробка файлу_: скрипт для обробки файлу і перетворення даних. + +. _Створення сервісної задачі_: налаштування нового делегата *Async Data Load Csv Delegate* для відправлення запита на асинхронне завантаження даних. + +. _Моделювання сповіщень_ про статус виконання процедури завантаження даних: використання делегата *Send User Notification V2*. + +=== Створення User Task для завантаження даних + +. Створіть *User Task* для завантаження CSV-файлу та застосуйте шаблон *User Form*. +. Виконайте наступні налаштування: + +* *ID*: `addCsvFileActivity`. +* *Form key*: `reference-add-diplomas-data-csv-file`. + +Це ключ UI-форми, який має відповідати службовій назві форми. За цим ключем користувацька задача бізнес-процесу та UI-форма взаємодіють. + +* *Assignee*: `${initiator}`. + +Вкажіть ініціатора процесу. + +image:bp-modeling/bp/bp-async-data-load/bp-async-load-02.png[] + +=== Підпис файлу КЕП + +Змоделюйте користувацьку задачу для підпису файлу з даними про дипломи за допомогою КЕП. + +. Створіть User Task для підпису файлу та застосуйте шаблон *Officer Sign Task*. +. Виконайте наступні налаштування: + +* *Form key*: `reference-sign-diplomas-data-csv-file`. + +Це ключ UI-форми, який має відповідати службовій назві форми. За цим ключем користувацька задача бізнес-процесу та UI-форма взаємодіють. + +* *Assignee*: `${initiator}`. + +Вкажіть ініціатора процесу. + +* *Form data pre-population*: `${submission('addCsvFileActivity').formData}`. Цей параметр дозволяє передзаповнити дані на формі. Використовуйте функцію submission(), в якій передайте дані із попередньої задачі `addCsvFileActivity`. + +image:bp-modeling/bp/bp-async-data-load/bp-async-load-02-1.png[] + +=== Скрипт для обробки файлу + +. Створіть *Script Task* та застосуйте Groovy-скрипт для обробки вмісту CSV-файлу. + +. Відкрийте *Script Editor*, вставте необхідний код та натисніть `Підтвердити`. ++ +image:bp-modeling/bp/bp-async-data-load/bp-async-load-03.png[] ++ +image:bp-modeling/bp/bp-async-data-load/bp-async-load-03-1.png[] ++ +.*_Groovy-скрипт для обробки CSV-файлу_* +[%collapsible] +==== +[source,groovy] +---- +def file = submission('addCsvFileActivity').formData.prop('file').elements().get(0) +def id = file.prop('id').value(); + +def document = load_digital_document(id) +def originalMetadata = get_digital_document_metadata(id) + +def resultFile = [:] +resultFile['id'] = id +resultFile['checksum'] = originalMetadata.getChecksum() + +set_transient_variable('file', S(resultFile, 'application/json')) + +def csvData = new String(document, 'UTF-8') +def regex = /\b(\d{4}).(\d{2}).(\d{2})\b/ +def modifiedContent = csvData.replaceAll(regex) { match -> + def dateParts = match.toList() + def year = dateParts[1] + def month = dateParts[2] + def day = dateParts[3] + "${year}-${month}-${day}" +} + +def content = modifiedContent.getBytes('UTF-8') +def fileName = "derived_" + originalMetadata.getName() +def metadata = save_digital_document(content, fileName) + +def resultDerivedFile = [:] +resultDerivedFile['id'] = metadata.getId() +resultDerivedFile['checksum'] = metadata.getChecksum() + +set_transient_variable('derivedFile', S(resultDerivedFile, 'application/json')) +---- +==== +Скрипт написаний мовою програмування Groovy і призначений для обробки завантаженого CSV-файлу. Він є ключовою частиною бізнес-процесу, дозволяючи ефективно обробляти великі обсяги даних і адаптувати їх до потреб системи. ++ +Розглянемо покрокове пояснення нижче. + +[script-description] +==== Пояснення до скрипту для обробки файлу у бізнес-процесі + +Частина 1: завантаження та ідентифікація файлу :: ++ +[source,groovy] +---- +def file = submission('addCsvFileActivity').formData.prop('file').elements().get(0) +def id = file.prop('id').value(); +---- + +* `submission('addCsvFileActivity').formData`: отримання даних, введених користувачем на формі для завантаження файлу. +* `.prop('file').elements().get(0)`: вибір першого елемента із наданих файлів. +* `def id = file.prop('id').value()`: збереження ідентифікатора файлу для подальшої обробки. + ++ +TIP: Більше деталей про функцію submission() див. у розділі xref:bp-modeling/bp/modeling-facilitation/modelling-with-juel-functions.adoc#submission-fn[Функція submission()]. + +{empty} + +Частина 2: Завантаження та аналіз вмісту файлу :: ++ +[source,groovy] +---- +def document = load_digital_document(id) +def originalMetadata = get_digital_document_metadata(id) +---- + +* `load_digital_document(id)`: завантаження цифрового документа за ідентифікатором. +* `get_digital_document_metadata(id)`: отримання метаданих завантаженого документа. + ++ +[TIP] +==== +Більше деталей про відповідні JUEL-функції див. у розділах: + +* xref:bp-modeling/bp/modeling-facilitation/modelling-with-juel-functions.adoc#load-digital-document[Функція load_digital_document()] +* xref:bp-modeling/bp/modeling-facilitation/modelling-with-juel-functions.adoc#get-digital-document-metadata[Функція get_digital_document_metadata()] +==== + +{empty} + +Частина 3: створення та збереження похідного файлу :: ++ +[source,groovy] +---- +def resultFile = [:] +resultFile['id'] = id +resultFile['checksum'] = originalMetadata.getChecksum() +set_transient_variable('file', S(resultFile, 'application/json')) +---- + +* Створення нового словника `resultFile`. +* Збереження ідентифікатора та контрольної суми оригінального файлу в `resultFile`. +* Встановлення тимчасової змінної `file` для передачі даних про оригінальний файл. + +{empty} + +Частина 4: Обробка вмісту файлу :: ++ +[source,groovy] +---- +def csvData = new String(document, 'UTF-8') +def regex = /\b(\d{4}).(\d{2}).(\d{2})\b/ +def modifiedContent = csvData.replaceAll(regex) { match -> + def dateParts = match.toList() + def year = dateParts[1] + def month = dateParts[2] + def day = dateParts[3] + "${year}-${month}-${day}" +} +---- + +* `new String(document, 'UTF-8')`: конвертація вмісту файлу в рядок. +* Використання регулярного виразу для пошуку дат у форматі `YYYY.MM.DD`. +* Зміна формату дат на `YYYY-MM-DD`. + +{empty} + +Частина 5: збереження обробленого вмісту як нового файлу :: ++ +[source,groovy] +---- +def content = modifiedContent.getBytes('UTF-8') +def fileName = "derived_" + originalMetadata.getName() +def metadata = save_digital_document(content, fileName) + +def resultDerivedFile = [:] +resultDerivedFile['id'] = metadata.getId() +resultDerivedFile['checksum'] = metadata.getChecksum() +set_transient_variable('derivedFile', S(resultDerivedFile, 'application/json')) +---- + +* `getBytes('UTF-8')`: Конвертація обробленого вмісту назад у байти. +* `save_digital_document(content, fileName)`: Збереження нового вмісту як окремого файлу. +* Створення нового словника `resultDerivedFile` для збереження даних про похідний файл. +* Встановлення тимчасової змінної `derivedFile` для передачі даних про похідний файл. + ++ +TIP: Більше деталей про функцію save_digital_document() див. у розділі xref:bp-modeling/bp/modeling-facilitation/modelling-with-juel-functions.adoc#save-digital-document[Функція save_digital_document()]. + +=== Створення сервісної задачі з делегатом _Async Data Load Csv Delegate_ + +. Створіть сервісну задачу та застосуйте делегат *Async Data Load Csv Delegate* для асинхронного завантаження даних. + +. Виконайте налаштування делегата: + +* *Entity*: `diplomas`. + +Це поле відповідає назві об'єкта у базі даних -- таблиці або складного/композитного об'єкта. + +* *File*: `${file}`. + +Структура, яка представляє файл і складається з ключа до файлу і чексуми. + +* (_Опційно_) *Derived file:* `${derivedFile}`. + +У цьому полі вкажіть як змінну ключ похідного файлу та чексуму. ++ +[NOTE] +==== +Похідний файл -- структура, яка представляє файл, створений у бізнес-процесі або в результаті опрацювання оригінального файлу. + +Якщо у бізнес-процесі сформовано похідний файл, то дані до БД будуть збережені саме з нього! +==== + +* *Access token*: `${completer('signCsvFileActivity').accessToken}`. + +Вкажіть JWT-токен доступу користувача, що виконав останню користувацьку задачу. + +* *X-Digital-Signature source*: `${sign_submission('signCsvFileActivity').signatureDocumentId}`. + +У цьому полі вкажіть джерело цифрового підпису користувача. + +* *Result variable*: `result`. + +Визначте змінну, до якої необхідно зберегти результат обробки файлу. + +image:bp-modeling/bp/bp-async-data-load/bp-async-load-04.png[] + +.Приклад тіла повідомлення для збереження даних з файлу +[source,json] +---- +{ + "payload": { + "file": { + "checksum": "....", + "id": "process/bp-instance-id/uuid" + }, + "derivedFile": { + "checksum": "...", + "id": "process/bp-instance-id/uuid" + } + } +} +---- + +Результатом виконання цієї задачі буде сформований запит до Kafka API про початок завантаження даних. Після завершення завантаження бізнес-процес отримує повідомлення з відповідним статусом. + +=== Подієвий шлюз та можливі сценарії бізнес-процесу + +Змоделюйте подієвий шлюз (*Event-based gateway*) та можливі сценарії для надсилання нотифікацій щодо результату асинхронного завантаження даних. Залежно від статусу виконання операції завантаження, бізнес-процес піде за певною гілкою. + +. Змоделюйте подієвий шлюз. ++ +.Подієвий шлюз +image::bp-modeling/bp/bp-async-data-load/bp-async-load-05.png[] ++ +TIP: Детальніше див. xref:bp-modeling/bp/bpmn/gateways/event-based-gateway.adoc[]. + +. Змоделюйте чотири події для чотирьох можливих сценаріїв обробки: + +* _Таймер для повідомлення_: налаштування таймера для обробки затримки в завантаженні. ++ +.Повідомлення за таймером +image::bp-modeling/bp/bp-async-data-load/bp-async-load-06.png[] ++ +[TIP] +==== +Детальніше про таймери див. на сторінках: + +* xref:bp-modeling/bp/bpmn/events/timer-event.adoc[] +* xref:best-practices/bp-timer-launch.adoc[] +==== + +* _Повідомлення про успішне завантаження_: обробка успішного завантаження. ++ +.Повідомлення про успішне завантаження +image::bp-modeling/bp/bp-async-data-load/bp-async-load-07.png[] + +* _Повідомлення про помилку з даними_: обробка випадків, коли дані не можуть бути завантажені через порушення правил БД. ++ +.Повідомлення про помилку з даними +image::bp-modeling/bp/bp-async-data-load/bp-async-load-07-1.png[] + +* _Повідомлення про помилку з файлом_: обробка помилок, що виникають під час опрацювання файлу. ++ +.Повідомлення про помилку з файлом +image::bp-modeling/bp/bp-async-data-load/bp-async-load-07-2.png[] + +. Наступним кроком змоделюйте чотири скриптові задачі для кожного зі сценаріїв. Додайте в кожну задачу скрипт для підготовки даних до надсилання нотифікацій. ++ +image::bp-modeling/bp/bp-async-data-load/bp-async-load-08.png[] ++ +image::bp-modeling/bp/bp-async-data-load/bp-async-load-08-1.png[] ++ +.Код збереження результату у форматі JSON +[source,groovy] +---- +set_transient_variable('resultJson', S(result, 'application/json')) +---- ++ +Цей код зберігає результат у форматі JSON до тимчасової змінної `set_transient_variable('resultJson', S(result, 'application/json'))`, зокрема: + +* *`set_transient_variable`*: ця функція використовується для створення або оновлення тимчасової змінної в контексті поточного виконання бізнес-процесу. Тимчасові змінні, використовуються для зберігання даних, що є актуальними лише протягом одного виконання процесу або певної його частини. + +* *`'resultJson'`*: це назва тимчасової змінної, яку створює або оновлює ця команда. + +* *`S(result, 'application/json')`*: Цей вираз конвертує дані, що знаходяться в змінній `result`, у формат JSON. Функція `S()` є функцією конвертації, яка перетворює об'єкт `result` у рядок JSON. `'application/json'` вказує на MIME-тип даних, який у цьому випадку є JSON. + +=== Відправлення повідомлень + +. Створіть сервісну задачу та застосуйте делегат *Send User Notification V2* для надсилання повідомлень користувачам на основі різних умов і результатів асинхронного завантаження. ++ +Делегат *Send User Notification V2* використовується для відправки налаштовуваних повідомлень користувачам системи. Він дозволяє інформувати користувачів про різні події або статуси в рамках бізнес-процесу, такі як завершення задач, помилки обробки або інші важливі сповіщення. + +. Налаштуйте шаблон делегата: + +.. *Recipient* (Одержувач): +* Опис: ім'я користувача або групи користувачів, яким буде надіслано повідомлення. +* Приклад: вкажіть `${initiator().userName}` для відправки повідомлення ініціатору процесу. ++ +[TIP] +==== +Доступні опції для значень *Recipient*: + +* `${initiator().userName}` -- для відправлення повідомлення ініціатору процесу. +* `${completer('taskDefinitionId').userName}` -- для відправлення повідомлення виконавцю певної задачі. +==== + +.. *Realm* (Keycloak-реалм): + +* Опис: реалм системи автентифікації та авторизації Keycloak, в якому зареєстровано користувача. +* Приклад: Оберіть `OFFICER` зі списку ролей. Вказує на те, що повідомлення буде відправлене користувачам реалму `OFFICER`, тобто надавачам послуг/посадовим особам. ++ +[TIP] +==== +Доступні опції для значень *Realm*: + +* `OFFICER` +* `CITIZEN` +==== + +.. *Notification Message Template* (Шаблон повідомлення): + +* Опис: ідентифікатор шаблону повідомлення, який буде використано для формування тексту повідомлення. ++ +NOTE: Використайте назву шаблону, який необхідно попередньо змоделювати у регламенті реєстру (_див. xref:#notification-templates[]_). + +* Приклад: використайте шаблон `reference-async-load-csv-file-timeout` як ідентифікатор шаблону для сповіщення про таймаут завантаження файлу. + +.. *Notification Template Model* (Модель шаблону повідомлення): + +* Опис: дані, які будуть використані для заповнення шаблону повідомлення. Вкажіть дані як змінну за моделлю `${templateModel}`. +* Приклад: використайте змінну `${resultJson}` зі скрипту та передайте JSON-об'єкт із результатами операції для формування тексту повідомлення. + +image::bp-modeling/bp/bp-async-data-load/bp-async-load-09.png[] + +[NOTE] +==== +Сервісні задачі для інших можливих сценаріїв розвитку бізнес-процесу конфігуруються за аналогічним підходом, з використання делегата *Send User Notification V2*. Для кожного сценарію унікальним буде лише шаблон повідомлення -- Notification Message Template. + +Відповідно, якщо ви маєте чотири сценарії, в них застосовані чотири однакові делегати, то ви повинні створити й вказати різний шаблон повідомлення для кожного зі сценаріїв. +==== + +[#form-modeling] +== Моделювання UI-форм + +Розглянемо приклади моделювання UI-форм для завантаження CSV-файлу. + +. _Увійдіть до Кабінету адміністратора регламентів_ > _UI-форми_. ++ +image::bp-modeling/forms/form-modeling-001.png[] + +. Створіть нову форму для асинхронного завантаження даних. Це можна зробити як в окремій версії-кандидаті, так і в рамках майстер-версії регламенту. ++ +image:registry-develop:bp-modeling/forms/admin-portal-form-modeling-step-4.png[] + +.. Вкажіть назву. Наприклад, `Створення даних про дипломи з асинхронним завантаженням (csv-file)`. +.. Вкажіть службову назву -- `reference-add-diplomas-data-csv-file`. Назва відповідатиме значення поля *Form key* відповідної користувацької задачі у бізнес-процесі. + +. Перейдіть на вкладку _Конструктор_, перетягніть компонент *Data import* до панелі моделювання та налаштуйте його. ++ +image:bp-modeling/bp/bp-async-data-load/bp-async-load-00-5.png[] ++ +[TIP] +==== +* Детальний опис усіх параметрів компонента доступний на сторінці xref:bp-modeling/forms/components/data-import.adoc[]. +* Дивись також xref:bp-modeling/forms/registry-admin-modelling-forms.adoc[]. +==== + +.. Перейдіть на вкладку *File* та визначте мінімальний та максимальний розмір файлу: + +* *File Minimum Size*: `0KB`. ++ +[NOTE] +==== +* Значення має бути додатним числом. +* Використовуйте крапку як розділовий знак у випадку десяткових дробів. +* Підтримувані одиниці виміру: `В`, `КВ`, `МВ` чи `GB`. Значення без одиниці виміру буде прочитано в байтах. +* Значення не має перевищувати значення поля *File Maximum Size*. +==== + +* *File Maximum Size*: `100MB`. ++ +[NOTE] +==== +* Значення має бути додатним числом. +* Використовуйте крапку як розділовий знак у випадку десяткових дробів. +* Підтримувані одиниці виміру: `В`, `КВ`, `МВ` чи `GB`. Значення без одиниці виміру буде прочитано в байтах. +* Значення не має перевищувати значення за замовчуванням, яке встановив адміністратор реєстру (_див. детальніше -- xref:admin:registry-management/control-plane-digital-documents.adoc[]_). +==== ++ +image:bp-modeling/bp/bp-async-data-load/bp-async-load-00-1.png[] + +.. Перейдіть на вкладку *Validation*. + +* Активуйте параметр *Required*. ++ +NOTE: Обов'язкове поле має бути заповнене до того, як форму можна буде відправити. + +* У полі *Resource for validation* вкажіть, який ресурс буде використовуватися для валідації файлу. У нашому випадку -- `v2/diplomas`. ++ +TIP: Ресурсом може бути як назва однієї сутності, так і назва складної сутності пов'язаних таблиць, відносно якої й буде відбуватися валідація даних. ++ +image:bp-modeling/bp/bp-async-data-load/bp-async-load-00-2.png[] + +.. Відкрийте вкладку *API* та у полі *Property Name* вкажіть назву поля для API-ендпоінту -- `file`. ++ +image:bp-modeling/bp/bp-async-data-load/bp-async-load-00-3.png[] + +.. Натисніть `Save`, щоб зберегти зміни. + +.. Перейдіть на вкладку _Запит_ та перегляньте структуру сформованого запита до Фабрики даних. ++ +[TIP] +==== +У вас є вебформа, призначена для завантаження CSV-файлу. Користувач взаємодіє з цією формою, вибираючи файл для завантаження. + +Після вибору файлу та натискання кнопки відправки, форма генерує запит до Фабрики даних. Цей запит представлений у форматі `JSON`. +У нашому прикладі запит у режимі preview має наступний вигляд: + +[source,json] +---- +{ + "file": [], + "submit": false +} +---- +==== + +. Змоделюйте наступну UI-форму для підписання даних CSV-файлу КЕП. Використовуйте компонент *Text Field*. ++ +image:registry-develop:bp-modeling/forms/admin-portal-form-modeling-step-6.png[] ++ +[TIP] +==== +* Детальніше про форму підписання даних читайте у розділі xref:registry-develop:bp-modeling/forms/registry-admin-modelling-forms.adoc#create-sign-form[Створення форми для підписання даних КЕП]. + +* Детальніше про компонент *Text Field* див. xref:bp-modeling/forms/components/text-field.adoc[]. +==== + +. Застосуйте зміни до майстер-версії, якщо ви виконували конфігурації у версії-кандидаті. ++ +image:registry-admin/admin-portal/new-admin-portal-11.png[] ++ +[TIP] +==== +Детальніше про застосування змін див. xref:registry-admin/admin-portal/version-control/candidate/overview-new-change-request.adoc[]. +==== + +[NOTE,caption=Вимоги до файлу] +==== +Для того, щоб дані були збережені до бази даних, вам необхідно коректно заповнити CSV-файл та завантажити його на форму. + +* Формат: `CSV` | Кодування: `UTF-8`. +* Роздільник даних: крапка з комою (`;`). +* Максимально дозволена кількість записів (рядків) у файлі: кількість, зазначена у моделі даних (атрибут `limit`). +* Назви стовпців у файлі обов'язково мають збігатися з назвами стовпців у базі даних. + +.Приклад заповненого CSV-файлу +[options="header", cols="1,2,2"] +|=== +| number | date_received | full_name + +| 22978074 +| 2000-01-05 +| Петренко + +| 54642717 +| 2001-01-02 +| Сидоренко +|=== +==== + +[#notification-templates] +== Моделювання шаблонів відправлення повідомлень + +Змоделюйте шаблони надсилання сповіщень користувачам на основі різних умов і результатів завантаження даних у бізнес-процесі. Використовуйте назви шаблонів при налаштуванні делегата *Send User Notification V2*. + +У нашому прикладі бізнес-процесу передбачено чотири сценарії. Для кожного потрібно налаштувати власний шаблон повідомлення. Шаблон є окремим елементом (текою) регламенту реєстру і знаходиться під директорією *_notifications > канал зв'язку_*, наприклад, _inbox_. + +[NOTE] +==== +Тобто можна налаштувати шаблони нотифікацій для різних каналів зв'язку, за умови, що вони активні. + +Канал зв'язку _inbox_ активний за замовчуванням. Для налаштування доставлення нотифікацій на електронну пошту, необхідно активувати канал зв'язку _email_ у Кабінеті користувача. Детальніше про це читайте на сторінці xref:user:officer/officer-portal-overview.adoc[]. +==== + +Назва шаблону відповідає значенню поля *Notification Message Template* у налаштуваннях делегата для відправлення повідомлень. У нашому прикладі -- це `reference-async-load-csv-file-timeout`. + +Шаблон містить два конфігураційні файли: + +* _notification.ftl_ -- містить текст повідомлення. Наприклад: ++ +---- +Процес з асинхронним завантаженням завершився помилкою за таймаутом +---- +* _notification.yml_ -- містить заголовок повідомлення. Наприклад: ++ +[source,yaml] +---- +title: "Неуспішне завантаження даних" +---- + +image:bp-modeling/bp/bp-async-data-load/bp-async-load-00.png[] + +Застосуйте зміни до майстер-гілки регламенту реєстру. Детальніше про це можна дізнатися з інструкції xref:registry-admin/regulations-deploy/registry-admin-deploy-regulation.adoc[]. + +[#file-upload-restrictions] +== Керування обмеженнями щодо розміру файлів + +Обмеження на розмір файлів встановлює адміністратор реєстру в адмін-панелі Control Plane. Значення, які встановить розробник регламенту під час моделювання форм, не зможуть перевищити значення, встановлені адміністратором на рівні реєстру. + +image:admin:registry-management/cp-digital-docs-restrictions/cp-digital-docs-restrictions-1.png[] + +TIP: Детальніше про це описано на сторінці xref:admin:registry-management/control-plane-digital-documents.adoc[] + +== Результат + +У результаті усіх вищевказаних налаштувань надавачі послуг зможуть у Кабінеті користувача проходити відповідний бізнес-процес для асинхронного завантаження даних та отримувати сповіщення в активовані канали зв'язку про статус виконання операції завантаження (успішний, неуспішний тощо). + +Бізнес-процес можна знайти у розділі _Доступні послуги_ > _Референтні бізнес-процеси_ > _Асинхронне завантаження даних в дата-фабрику_. + +image:bp-modeling/bp/bp-async-data-load/bp-async-load-10.png[] \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/pages/bp-modeling/bp/bpmn/events/message-event.adoc b/docs/ua/modules/registry-develop/pages/bp-modeling/bp/bpmn/events/message-event.adoc index ef0a0f848e..0dc65186fe 100644 --- a/docs/ua/modules/registry-develop/pages/bp-modeling/bp/bpmn/events/message-event.adoc +++ b/docs/ua/modules/registry-develop/pages/bp-modeling/bp/bpmn/events/message-event.adoc @@ -1,27 +1,11 @@ -:toc-title: ЗМІСТ -:toc: auto -:toclevels: 5 -:experimental: -:important-caption: ВАЖЛИВО -:note-caption: ПРИМІТКА -:tip-caption: ПІДКАЗКА -:warning-caption: ПОПЕРЕДЖЕННЯ -:caution-caption: УВАГА -:example-caption: Приклад -:figure-caption: Зображення -:table-caption: Таблиця -:appendix-caption: Додаток -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - -= Подія «Повідомлення» += Подія «_Повідомлення_» +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Загальний опис -Подія «Повідомлення» (*Message Event*) -- це подія у бізнес-процесі, яка використовується для передачі інформації від одного бізнес-процесу до іншого бізнес-процесу або підпроцесу. Згенероване вихідне повідомлення (подія-відправник) активує елемент, що приймає повідомлення (подія-одержувач), який з ним пов'язаний. +_Подія «Повідомлення»_ (*Message Event*) -- це подія у бізнес-процесі, яка використовується для передачі інформації від одного бізнес-процесу до іншого бізнес-процесу або підпроцесу. Згенероване вихідне повідомлення (подія-відправник) активує елемент, що приймає повідомлення (подія-одержувач), який з ним пов'язаний. image:bp-modeling/bp/events/message-event/message-event-01.png[] @@ -116,7 +100,6 @@ image:bp-modeling/bp/events/message-event/mess1_5.png[] ==== - * При виборі типу `String or Expression`, вкажіть у полі `Variable Assignment Value` вираз змінної, що передаватиметься за допомогою JUEL-функції. + @@ -150,8 +133,17 @@ image:bp-modeling/bp/events/message-event/mess1_9.png[] image:bp-modeling/bp/events/message-event/mess1_10.png[] image:bp-modeling/bp/events/message-event/mess1_11.png[] +==== + +[TIP] +==== +[%collapsible] +.Де можна знайти приклад референтного бізнес-процесу? +===== +include::registry-develop:partial$snippets/demo-reg-reference-examples-ua.adoc[] -TIP: Скористайтеся референтним прикладом бізнес-процесу для отримання деталей: link:{attachmentsdir}/bp-modeling/bp/message-event/Process_checkIntermediateThrowEvent.bpmn[_Process_checkIntermediateThrowEvent.bpmn_]. +Приклад BPMN-схеми процесу буде доступний у регламенті демо-реєстру за пошуком по ключовим словам -- *_checkIntermediateThrowEvent_*. Назви форм ви можете знайти всередині відповідних користувацьких задач (User Task) бізнес-процесу у полі *`Form key`*. +===== ==== [#message-start-event] @@ -275,8 +267,17 @@ TIP: Налаштування input/output-параметрів делегата image:bp-modeling/bp/events/message-event/mess1_19.png[] image:bp-modeling/bp/events/message-event/mess1_20.png[] +==== + +[TIP] +==== +[%collapsible] +.Де можна знайти приклад референтного бізнес-процесу? +===== +include::registry-develop:partial$snippets/demo-reg-reference-examples-ua.adoc[] -TIP: Скористайтеся референтним прикладом бізнес-процесу для отримання деталей: link:{attachmentsdir}/bp-modeling/bp/message-event/Process_checkIntermediateThrowEvent.bpmn[_Process_checkIntermediateThrowEvent.bpmn_]. +Приклад BPMN-схеми процесу буде доступний у регламенті демо-реєстру за пошуком по ключовим словам -- *_checkIntermediateThrowEvent_*. Назви форм ви можете знайти всередині відповідних користувацьких задач (User Task) бізнес-процесу у полі *`Form key`*. +===== ==== [#message-intermediate-catch-event] diff --git a/docs/ua/modules/registry-develop/pages/bp-modeling/bp/bpmn/events/timer-event.adoc b/docs/ua/modules/registry-develop/pages/bp-modeling/bp/bpmn/events/timer-event.adoc index 464cc9d45b..1b982bcb88 100644 --- a/docs/ua/modules/registry-develop/pages/bp-modeling/bp/bpmn/events/timer-event.adoc +++ b/docs/ua/modules/registry-develop/pages/bp-modeling/bp/bpmn/events/timer-event.adoc @@ -1,10 +1,7 @@ = Подія «Таймер» -:toc: -:toc-title: ЗМІСТ -:toclevels: 5 -:sectnums: -:sectnumlevels: 5 -:sectanchors: +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Загальний опис diff --git a/docs/ua/modules/registry-develop/pages/bp-modeling/bp/bpmn/subprocesses/call-activities.adoc b/docs/ua/modules/registry-develop/pages/bp-modeling/bp/bpmn/subprocesses/call-activities.adoc index 14db3c47c3..1fab704cee 100644 --- a/docs/ua/modules/registry-develop/pages/bp-modeling/bp/bpmn/subprocesses/call-activities.adoc +++ b/docs/ua/modules/registry-develop/pages/bp-modeling/bp/bpmn/subprocesses/call-activities.adoc @@ -1,27 +1,11 @@ -:toc-title: ЗМІСТ -:toc: auto -:toclevels: 5 -:experimental: -:important-caption: ВАЖЛИВО -:note-caption: ПРИМІТКА -:tip-caption: ПІДКАЗКА -:warning-caption: ПОПЕРЕДЖЕННЯ -:caution-caption: УВАГА -:example-caption: Приклад -:figure-caption: Зображення -:table-caption: Таблиця -:appendix-caption: Додаток -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Глобальний підпроцес (Call Activity) +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Загальний опис -*Call Activity* (або підпроцес, який можна використовувати повторно) -- це стандартний елемент BPMN-моделювання, що підтримує Camunda Engine, який дозволяє викликати інший процес як частину поточного процесу. Він подібний до xref:bp-modeling/bp/bpmn/subprocesses/embedded-subprocess.adoc[вбудованого підпроцесу], але є зовнішнім, тобто змодельованим в рамках окремого пулу бізнес-процесу, і може використовуватися неодноразово та декількома різними батьківськимиfootnote:[_Батьківський_ або _основний_ процес (*Parent process*) -- процес, що ініціює запуск підпроцесу. Відносно батьківського процесу підпроцес є *Child*-процесом (*Child process*).] бізнес-процесами. +*_Call Activity_* (або _підпроцес, який можна використовувати повторно_) -- це стандартний елемент BPMN-моделювання, що підтримує Camunda Engine, який дозволяє викликати інший процес як частину поточного процесу. Він подібний до xref:bp-modeling/bp/bpmn/subprocesses/embedded-subprocess.adoc[вбудованого підпроцесу], але є зовнішнім, тобто змодельованим в рамках окремого пулу бізнес-процесу, і може використовуватися неодноразово та декількома різними батьківськимиfootnote:[_Батьківський_ або _основний_ процес (*Parent process*) -- процес, що ініціює запуск підпроцесу. Відносно батьківського процесу підпроцес є *Child*-процесом (*Child process*).] бізнес-процесами. image:bp-modeling/bp/subprocesses/call-activities/bp-call-activity-01.png[] diff --git a/docs/ua/modules/registry-develop/pages/bp-modeling/bp/bpmn/subprocesses/embedded-subprocess.adoc b/docs/ua/modules/registry-develop/pages/bp-modeling/bp/bpmn/subprocesses/embedded-subprocess.adoc index e5389f37c1..24098e64d7 100644 --- a/docs/ua/modules/registry-develop/pages/bp-modeling/bp/bpmn/subprocesses/embedded-subprocess.adoc +++ b/docs/ua/modules/registry-develop/pages/bp-modeling/bp/bpmn/subprocesses/embedded-subprocess.adoc @@ -1,10 +1,7 @@ = Вбудований підпроцес -:toc: -:toclevels: 5 -:toc-title: ЗМІСТ -:sectnums: -:sectnumlevels: 5 -:sectanchors: +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Загальний опис diff --git a/docs/ua/modules/registry-develop/pages/bp-modeling/bp/element-templates/call-activities/call-activities-overview.adoc b/docs/ua/modules/registry-develop/pages/bp-modeling/bp/element-templates/call-activities/call-activities-overview.adoc index 1a52e013ae..f94a4f7771 100644 --- a/docs/ua/modules/registry-develop/pages/bp-modeling/bp/element-templates/call-activities/call-activities-overview.adoc +++ b/docs/ua/modules/registry-develop/pages/bp-modeling/bp/element-templates/call-activities/call-activities-overview.adoc @@ -1,8 +1,17 @@ = Типові розширення для виклику глобальних підпроцесів (Call Activity) +:toclevels: 5 +:experimental: +:important-caption: ВАЖЛИВО +:note-caption: ПРИМІТКА +:tip-caption: ПІДКАЗКА +:warning-caption: ПОПЕРЕДЖЕННЯ +:caution-caption: УВАГА +:sectanchors: +:sectlinks: include::platform:ROOT:partial$admonitions/language-ua.adoc[] -NOTE: Каталог розроблених шаблонів для налаштування делегатів зберігається у сховищі коду Gerrit, в окремому репозиторії _business-process-modeler-extensions_ -> _element-templates_. +NOTE: Каталог розроблених шаблонів для налаштування делегатів зберігається у сховищі коду Gerrit, в окремому репозиторії _business-process-modeler-extensions_ > _element-templates_. TIP: Особливості використання Call Activity у бізнес-процесах дивіться за xref:bp-modeling/bp/bpmn/subprocesses/call-activities.adoc[посиланням]. @@ -10,5 +19,4 @@ TIP: Особливості використання Call Activity у бізне == Огляд секції * xref:bp-modeling/bp/element-templates/call-activities/call-activity.adoc[] - * xref:bp-modeling/bp/element-templates/call-activities/check-excerpt-status.adoc[] \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/pages/bp-modeling/bp/element-templates/element-templates-install.adoc b/docs/ua/modules/registry-develop/pages/bp-modeling/bp/element-templates/element-templates-install.adoc new file mode 100644 index 0000000000..fab276dbcb --- /dev/null +++ b/docs/ua/modules/registry-develop/pages/bp-modeling/bp/element-templates/element-templates-install.adoc @@ -0,0 +1,157 @@ += Встановлення типових розширень до бізнес-процесів (_для локальної розробки_) +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] + +Для спрощення моделювання бізнес-процесів розроблені типові розширення-конектори -- **Element Templates**. + +IMPORTANT: Якщо ви використовуєте функціональність xref:registry-admin/admin-portal/overview.adoc[Кабінету адміністратора регламентів] для розробки реєстру, вам не потрібно встановлювати типові розширення, додаткові зовнішні застосунки та плагіни. Портал містить усе необхідне вбудоване з коробки. Інструкції нижче у цьому документі призначені _ЛИШЕ_ для локальної розробки. + +[#preconditions] +== Передумови + +=== Встановлення застосунку Camunda Modeler + +. Завантажте архів із застосунком **Camunda Modeler** за link:https://downloads.camunda.cloud/release/camunda-modeler/4.8.0/[посиланням]. ++ +[NOTE] +==== +Рекомендовано використовувати версію саме 4.8.0 для стабільної роботи системи. +==== +. Оберіть продукт **Open Source Modeler** та завантажте відповідну версію, сумісну із вашою операційною системою (наприклад, `Windows 64bit`); +. Після завантаження архіву з додатком, розпакуйте його на локальній машині. ++ +[TIP] +==== +Папка із застосунком може мати, наприклад, таку назву: + +_camunda-modeler-4.8.1-win-x64_ +==== + +=== Встановлення плагіну BPMN Linter + +Встановіть плагін **BPMN Linter** для розширення функціональності Camunda та валідації ваших BPMN-діаграм. + +. Перейдіть до офіційного репозиторію за https://github.com/camunda/camunda-modeler-linter-plugin[посиланням]. + +. Натисніть кнопку `Code` -> `Download ZIP` та завантажте архів. ++ +image:bp-modeling/bp/element-temp/element-temp-install-bpmnlint.png[] + +. Після завантаження, розпакуйте вміст архіву до папки _camunda-modeler-4.8.1-win-x64\resources\plugins_ застосунку Camunda. + +. Перезапустіть додадок Camunda Modeler. +. Увімкніть плагін. Для цього натисність *Plugins* -> *BPMN Linter* -> *Toggle Linting*. ++ +Альтернативно застосуйте комбінацію клавіш `Ctrl+L`. ++ +image:bp-modeling/bp/element-temp/element-temp-turn-on-bpmnlint.png[] ++ +TIP: Плагін вмикається та вимикається однаково -- `Ctrl+L`. + +[#element-temp-install] +== Встановлення каталогу типових розширень + +[#element-temp-install-windows] +=== Встановлення каталогу типових розширень для Windows OS + +Виконайте настанови, подані нижче, для інсталювання каталогу Element Templates. + +. Завантажте каталог типових розширень одним зі способів: + +* _Спосіб 1._ + +Отримайте каталог з Github-репозиторію за https://github.com/epam/edp-ddm-business-process-modeler-extensions/tree/main/element-templates[посиланням]. + +* _Спосіб 2._ + +Отримайте каталог із захищеного сховища артефактів **Nexus** за посиланням: `https://nexus-{CP-NAMESPACE}.{DNS-WILDCARD}/[]`: ++ +[TIP] +==== +`{CP-NAMESPACE}` _та `{DNS-WILDCARD}` є змінними, де `{CP-NAMESPACE}` -- назва namespace (простору імен) у Nexus, а `{DNS-WILDCARD}` -- значення DNS wildcardfootnote:[В системі DNS можна задавати запис за замовчуванням для неоголошених піддоменів. Такий запис називається **wildcard**.]. + +Наприклад: :: https://nexus.apps.envone.dev.registry.eua.gov.ua/nexus +==== + +** знайдіть папку _business-process-modeler-extensions_; +** буде показано каталог папок типу _version.build_ (наприклад, _0.0.1-SNAPSHOT.12_); +** оберіть папку з останньою версією; +** оберіть `.zip`-файл у папці, що була відкрита (останньою версією zip може бути, наприклад, файл _business-process-modeler-extensions-1.7.0.zip_); +** на вкладці *Summary* натисніть правою кнопкою миші на посилання `Path`. Таким чином розпочнеться завантаження `.zip`-архіву; + +. Розпакуйте із заміною завантажений `.zip`-файл у підпапці _resources_ вашої локальної директорії, де зберігається додаток. Приклад шляху може бути наступним: _C:\Users\Downloads\camunda-modeler-4.8.1-win-x64\resources_. ++ +[TIP] +==== +* _camunda-modeler-4.8.1-win-x64_ -- локальна директорія, в якій зберігається додаток. +* _resources_ -- папка, що містить розширення (_element-templates_) та плагіни (_plugins_)_. +==== + +. Підсумкова структура директорії _resources_ має виглядати наступним чином: ++ +image:registry-develop:bp-modeling/bp/element-temp/bp-element-temp-02.png[] + +. Підсумкова структура директорії _element-templates_ має виглядати наступним чином: ++ +image:registry-develop:bp-modeling/bp/element-temp/bp-element-temp-03.png[] + +. Підсумкова структура директорії _plugins_ має виглядати наступним чином: ++ +image:registry-develop:bp-modeling/bp/element-temp/bp-element-temp-04.png[] + +. Перезапустіть додаток Camunda Modeler. +. Перевірте доступність розширень у каталозі при моделюванні бізнес-процесу: + +* Створіть задачу -- оберіть *Create Task*. +* Натисніть іконку ключа -- оберіть *Change Type*. +* Вкажіть тип задачі -- сервісна (*Service Task*), користувацька (*User Task*) або *Call Activity*. +* Натисніть кнопку `Open Catalog`. + +В результаті відкриється каталог розширень *Element Templates*, які можна застосувати в процесі моделювання. ++ +image:registry-develop:bp-modeling/bp/element-temp/bp-element-temp-01.png[] + +[#element-temp-install-macos] +=== Встановлення каталогу типових розширень для macOS + +Виконайте настанови, подані нижче, для інсталювання каталогу Element Templates. + +. Завантажте каталог розширень до бізнес-процесів за аналогією до пункту xref:#element-temp-install-windows[]. +. Відкрийте термінал. +. Перейдіть до локальної директорії розміщення ресурсів Camunda Modeler за допомогою команди: ++ +[source, bash] +---- +cd ~/Library/Application\ Support/camunda-modeler/resources +---- + +. Створіть нову директорію під розширення категорії `element templates` у випадку, якщо її там немає, за допомогою команди: ++ +[source, bash] +---- +mkdir element-templates +---- + +. Скопіюйте всі JSON-файли розширень із директорії `business-process-modeler-extensions` до директорії, що була створена, за допомогою команди: ++ +[source,bash] +---- +cp business-process-modeler-extensions/*.json ~/Library/Application\ Support/camunda-modeler/resources/element-templates +---- + +. Підсумкова структура директорії виглядатиме наступним чином: ++ +---- +~/Library/Application\ Support/camunda-modeler/resources/element-templates/ +---- ++ +image:registry-develop:bp-modeling/bp/element-temp/bp-element-temp-05.jpg[] + +. Перезапустіть додаток Camunda Modeler. +. Перевірте доступність розширень у каталозі при моделюванні бізнес-процесу: + +* Створіть задачу -- оберіть *Create Task*. +* Натисніть іконку ключа -- оберіть *Change Type*. +* Вкажіть тип задачі -- сервісна (*Service Task*), користувацька (*User Task*) або *Call Activity*. +* Натисніть кнопку `Open Catalog`. + +В результаті відкриється каталог розширень *Element Templates*, які можна застосувати в процесі моделювання. ++ +image:registry-develop:bp-modeling/bp/element-temp/bp-element-temp-01.png[] \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/pages/bp-modeling/bp/element-templates/element-templates-overview.adoc b/docs/ua/modules/registry-develop/pages/bp-modeling/bp/element-templates/element-templates-overview.adoc index bf61b5a913..d4d7ba7189 100644 --- a/docs/ua/modules/registry-develop/pages/bp-modeling/bp/element-templates/element-templates-overview.adoc +++ b/docs/ua/modules/registry-develop/pages/bp-modeling/bp/element-templates/element-templates-overview.adoc @@ -1,5 +1,4 @@ -:toc-title: ЗМІСТ -//:toc: auto += Типові розширення до бізнес-процесів :toclevels: 5 :experimental: :important-caption: ВАЖЛИВО @@ -7,27 +6,36 @@ :tip-caption: ПІДКАЗКА :warning-caption: ПОПЕРЕДЖЕННЯ :caution-caption: УВАГА -:example-caption: Приклад -:figure-caption: Зображення -:table-caption: Таблиця -:appendix-caption: Додаток -//:sectnums: -:sectnumlevels: 5 :sectanchors: :sectlinks: -:partnums: -= Типові розширення до бізнес-процесів +include::platform:ROOT:partial$admonitions/language-ua.adoc[] CAUTION: Розділ у процесі модернізації. Для спрощення моделювання бізнес-процесів розроблені типові інтеграційні розширення-конектори -- **Element Templates**. Вони є ланкою взаємодії між рівнем виконання бізнес-процесів та API фабрики даних. - -[overview] == Огляд секції +[%collapsible] +.*Встановлення типових розширень* +==== +* [*] xref:registry-develop:bp-modeling/bp/element-templates/element-templates-install.adoc[] +==== + +[%collapsible] +.*Каталог типових розширень* +==== * [*] xref:registry-develop:bp-modeling/bp/element-templates/user-task-templates/user-task-overview.adoc[Типові розширення для користувацьких задач (User task templates)] * [*] xref:bp-modeling/bp/element-templates/service-task-templates/service-task-overview.adoc[Типові розширення для сервісних задач (Service task templates)] * [*] xref:bp-modeling/bp/element-templates/call-activities/call-activities-overview.adoc[] -* [*] xref:bp-modeling/bp/element-templates/rest-integration-registries/rest-integration-registries-overview.adoc[Типові розширення для інтеграції з іншими реєстрами на Платформі] \ No newline at end of file +* [*] xref:bp-modeling/bp/element-templates/rest-integration-registries/rest-integration-registries-overview.adoc[Типові розширення для інтеграції з іншими реєстрами на Платформі] +==== + +[%collapsible] +.*Валідація шаблонів типових розширень* +==== +* [*] xref:bp-modeling/bp/element-templates/element-templates-validate.adoc[] +==== + + diff --git a/docs/ua/modules/registry-develop/pages/bp-modeling/bp/element-templates/element-templates-validate.adoc b/docs/ua/modules/registry-develop/pages/bp-modeling/bp/element-templates/element-templates-validate.adoc new file mode 100644 index 0000000000..5e11f95c13 --- /dev/null +++ b/docs/ua/modules/registry-develop/pages/bp-modeling/bp/element-templates/element-templates-validate.adoc @@ -0,0 +1,53 @@ += Валідація порожніх обов'язкових полів у бізнес-процесах +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +== Введення + +Ця документація описує вдосконалену функціональність валідації порожніх обов'язкових полів на рівні шаблонів елементів у бізнес-процесі. Цей процес спрямований на попередження помилок, які виникають через відсутність обов'язкових параметрів у шаблонах елементів під час моделювання бізнес-процесу. + +== Проблематика + +У минулих реалізаціях валідації бізнес-процесів були випадки, коли обов'язкові параметри шаблонів елементів не перевірялися належним чином. Це призводило до того, що розробники виявляли відсутність цих параметрів вже під час виконання бізнес-процесу, що значно ускладнювало процес розробки та відлагодження. + +== Вдосконалення валідації + +=== Застосування правил валідації + +Було внесено зміни для застосування правил валідації до всіх шаблонів елементів. Також було розроблено механізм серверної валідації для додаткового контролю. + +=== Процес валідації на вебінтерфейсі + +. *Моделювання бізнес-процесу*: створіть новий бізнес-процес у версії-кандидат, використовуючи шаблони типові розширень у задачах. Наприклад, *Search for entities in data factory*. + +. *Обов'язкові поля*: у сервісних та користувацьких формах задача заповніть обов'язкові поля, зокрема *Resource*, *X-Access-Token*, *Form key*. + ++ +image:release-notes:wn-1-9-7/wn-1-9-7-1.png[] + +. *Збереження змін і валідація*: якщо не заповнити обов'язкові поля та зберегти зміни, пайплайн перевірки регламенту покаже відповідний статус: *Процес розгортання та перевірки не успішний*. ++ +image:release-notes:wn-1-9-7/wn-1-9-7-2.png[] + +=== Використання Jenkins для виявлення помилок + +Помилки, виявлені під час валідації, можна переглянути у логах пайплайну в сервісі Jenkins, на кроці `registry-regulations-validation`. Це дозволяє ідентифікувати конкретні задачі та обов'язкові поля, де були виявлені помилки. + +.Пайплайн MASTER-Code-review-registry-regulations. Крок `registry-regulations-validation` +image::release-notes:wn-1-9-7/wn-1-9-7-3.png[] + +.Console output. Логи пайплайну валідації +image::release-notes:wn-1-9-7/wn-1-9-7-4.png[] + +=== Застосування змін до мастер версії + +При спробі застосувати зміни до мастер-версії регламенту, відображаються ідентифікатори задач із помилками про відсутність обов'язкових значень, запобігаючи передачі неперевірених змін. + +.Попередження, що процес розгортання та перевірки не завершився або завершився з помилками +image::release-notes:wn-1-9-7/wn-1-9-7-5.png[] + +.Статус публікації регламенту "Не опубліковано" +image::release-notes:wn-1-9-7/wn-1-9-7-6.png[] + +== Висновки + +Функціональність перевірки порожніх обов'язкових полів на рівні шаблонів елементів у бізнес-процесі дозволяє розробнику регламенту своєчасно виявляти та виправляти пропущені значення на етапі моделювання. Це підвищує ефективність розробки та скорочує час, витрачений на відлагодження та розгортання регламентів реєстру. \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/pages/bp-modeling/bp/element-templates/rest-integration-registries/rest-integration-registries-overview.adoc b/docs/ua/modules/registry-develop/pages/bp-modeling/bp/element-templates/rest-integration-registries/rest-integration-registries-overview.adoc index b008dd7de7..d0330eba3b 100644 --- a/docs/ua/modules/registry-develop/pages/bp-modeling/bp/element-templates/rest-integration-registries/rest-integration-registries-overview.adoc +++ b/docs/ua/modules/registry-develop/pages/bp-modeling/bp/element-templates/rest-integration-registries/rest-integration-registries-overview.adoc @@ -1,5 +1,4 @@ -:toc-title: ЗМІСТ -:toc: auto += Типові розширення для інтеграції з іншими реєстрами на Платформі :toclevels: 5 :experimental: :important-caption: ВАЖЛИВО @@ -7,25 +6,18 @@ :tip-caption: ПІДКАЗКА :warning-caption: ПОПЕРЕДЖЕННЯ :caution-caption: УВАГА -:example-caption: Приклад -:figure-caption: Зображення -:table-caption: Таблиця -:appendix-caption: Додаток -:sectnums: -:sectnumlevels: 5 :sectanchors: :sectlinks: -:partnums: -= Типові розширення для інтеграції з іншими реєстрами на Платформі +include::platform:ROOT:partial$admonitions/language-ua.adoc[] В рамках REST-взаємодії з іншими реєстрами на Платформі та бізнес-процесами, що змодельовані всередині регламентів таких реєстрів, імплементовано додаткові розширення-конектори (делегати) для передачі або отримання даних до/з цих реєстрів. На сьогодні Платформа підтримує 2 таких делегати: :: -* xref:registry-develop:bp-modeling/bp/element-templates/rest-integration-registries/start-bp-another-registry.adoc[Start business process in another registry] -- делегат для ініціювання бізнес-процесу, що змодельований в рамках регламенту іншого реєстру на Платформі. +* *Start business process in another registry* -- делегат для ініціювання бізнес-процесу, що змодельований в рамках регламенту іншого реєстру на Платформі. -* xref:registry-develop:bp-modeling/bp/element-templates/rest-integration-registries/search-for-entities-another-registry.adoc[Search for entities in another registry data factory] -- делегат для отримання даних сутностей (таблиць) у базі даних іншого реєстру, що розгорнутий на Платформі. +* *Search for entities in another registry data factory* -- делегат для отримання даних сутностей (таблиць) у базі даних іншого реєстру, що розгорнутий на Платформі. [CAUTION] ==== @@ -36,4 +28,10 @@ * Відкрити доступ до такого реєстру в адмін-консолі для керування реєстрами Control Plane (_детальну інструкцію ви можете переглянути на сторінці xref:admin:registry-management/control-plane-registry-grant-access.adoc[]_). * Надати доступ до відповідних представлень та REST API реєстру на рівні моделі даних (_детальну інструкцію ви можете переглянути на сторінці xref:data-modeling/data/physical-model/rest-api-view-access-to-registry.adoc[]_). -==== \ No newline at end of file +==== + +== Огляд секції + +* xref:registry-develop:bp-modeling/bp/element-templates/rest-integration-registries/start-bp-another-registry.adoc[] + +* xref:registry-develop:bp-modeling/bp/element-templates/rest-integration-registries/search-for-entities-another-registry.adoc[] \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/pages/bp-modeling/bp/element-templates/service-task-templates/digital-signature-by-dso-service.adoc b/docs/ua/modules/registry-develop/pages/bp-modeling/bp/element-templates/service-task-templates/digital-signature-by-dso-service.adoc index d80f65028a..80371229f2 100644 --- a/docs/ua/modules/registry-develop/pages/bp-modeling/bp/element-templates/service-task-templates/digital-signature-by-dso-service.adoc +++ b/docs/ua/modules/registry-develop/pages/bp-modeling/bp/element-templates/service-task-templates/digital-signature-by-dso-service.adoc @@ -21,7 +21,7 @@ NOTE: Перш за все, переконайтеся, що папка _/elemen . Відкрийте *Service Task* > у вікні справа натисніть кнопку `*Open Catalog*` та оберіть відповідний шаблон (Template) зі списку. . У полі *Payload* введіть дані для підпису. -. У полі *X-Access-Token source* введіть токен доступу до системи користувача, під яким виконується операція. +. У полі *X-Access-Token source* вкажіть токен доступу користувача, під яким виконується операція. . У полі *Result variable* вкажіть будь-яке ім'я для вихідного параметра (за замовчуванням -- `response`). image:registry-develop:bp-modeling/bp/element-temp/bp-element-temp-11.png[] \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/pages/bp-modeling/bp/element-templates/service-task-templates/search-entities-in-data-factory.adoc b/docs/ua/modules/registry-develop/pages/bp-modeling/bp/element-templates/service-task-templates/search-entities-in-data-factory.adoc index d5e24b75b4..27789f4a5b 100644 --- a/docs/ua/modules/registry-develop/pages/bp-modeling/bp/element-templates/service-task-templates/search-entities-in-data-factory.adoc +++ b/docs/ua/modules/registry-develop/pages/bp-modeling/bp/element-templates/service-task-templates/search-entities-in-data-factory.adoc @@ -21,15 +21,48 @@ include::platform:ROOT:partial$admonitions/language-ua.adoc[] Розширення використовується для пошуку сутностей у фабриці даних. +Розгляньмо приклад використання делегата в рамках референтного бізнес-процесу (_див. детальніше -- xref:best-practices/edit-grid-rows-action.adoc[]_). + +На основі створеної моделі даних, делегат виконуватиме пошук та вибірку ліцензій з таблиці *`licenses`*. Таблиця *`licenses`* містить наступні стовпці: + +* `license_id` -- унікальний ідентифікатор ліцензії (`UUID`). +* `number` -- номер ліцензії (`TEXT`). +* `date_received` -- дата отримання ліцензії (`DATE`). +* `date_terminated` -- дата припинення ліцензії (`DATE`). +* `full_name` -- повне ім'я органу ліцензування (`TEXT`). +* `licensing_status` -- статус ліцензії (тип даних `license_status`). + +Тип даних *`license_status`* є переліком з двома можливими значеннями: + +* *`active`* (чинна) -- ліцензія є дійсною. +* *`canceled`* (анульована) -- ліцензія скасована. + +Делегат використовує умову пошуку (*Search Condition*) *`search_licenses_by_status`*, яка дозволяє фільтрувати ліцензії в таблиці *`licenses`* за статусом ліцензування. У цьому випадку, задача шукає ліцензії зі статусом *`active`* (чинні). + +Таким чином, делегат виконує пошук активних ліцензій у таблиці *`licenses`* на основі визначених умов пошуку, передаючи системний токен доступу для авторизації запиту до бази даних. + == Налаштування шаблону у бізнес-процесі +Змоделюйте сервісну задача (*Service Task*) та використайте делегат *Search for entities in data factory*. + +Параметри які використовуються для налаштування та отримання результатів пошуку: :: +. У секції *Inputs* встановіть вхідний параметр *`resource`* як *`search-licenses-by-status`* для визначення ресурсу/API-ендпоінту, який слід використати для пошуку. ++ +TIP: Тут -- ендпоінт `search-licenses-by-status` генерується на базі критерію пошуку `search_licenses_by_status`, визначеного у моделі даних. + +. У секції *Inputs > Search variables* передайте параметри пошуку, які необхідно застосувати, як ключі-значення (*`Map`*): + +* `Key: *licensingStatus*` +* `Value: *active*` ++ +У цьому випадку, ми шукаємо ліцензії зі статусом *`active`*. -NOTE: _Перш за все, переконайтеся, що папка `/element-templates` містить файл `dataFactoryConnectorSearchDelegate.json`._ +. У секції *Inputs > X-Access-Token* передайте системний токен доступу для авторизації запита: ++ +---- +${system_user().accessToken} +---- -* Відкрийте **Service Task** -> у вікні справа натисніть кнопку `Open Catalog` та оберіть відповідний шаблон (Template) зі списку. -* У полі `Name` вкажіть назву задачі. -* У полі `Resource` вкажіть ресурс. -* У полі `Result variable` вкажіть будь-яке ім'я для вихідного параметра (за замовчуванням -- `response`. -* У полі `X-Access-Token source` вкажіть токен доступу до системи користувача, під яким виконується операція. +. У секції *Outputs > Result variable* встановіть вихідний параметр як змінну *`licensesResponse`*, до якої зберігатиметься відповідь від бази даних для подальшого використання. -image:registry-develop:bp-modeling/bp/element-temp/bp-element-temp-22.png[] +image:best-practices/edit-grid-rows-action/edit-grid-rows-action-1.png[] diff --git a/docs/ua/modules/registry-develop/pages/bp-modeling/bp/element-templates/service-task-templates/service-task-overview.adoc b/docs/ua/modules/registry-develop/pages/bp-modeling/bp/element-templates/service-task-templates/service-task-overview.adoc index 13716bf876..b120bf6868 100644 --- a/docs/ua/modules/registry-develop/pages/bp-modeling/bp/element-templates/service-task-templates/service-task-overview.adoc +++ b/docs/ua/modules/registry-develop/pages/bp-modeling/bp/element-templates/service-task-templates/service-task-overview.adoc @@ -1 +1,46 @@ -= Типові розширення для сервісних задач \ No newline at end of file += Типові розширення для сервісних задач +:toclevels: 5 +:experimental: +:important-caption: ВАЖЛИВО +:note-caption: ПРИМІТКА +:tip-caption: ПІДКАЗКА +:warning-caption: ПОПЕРЕДЖЕННЯ +:caution-caption: УВАГА +:sectanchors: +:sectlinks: + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] + +== Огляд секції + +****** Керування користувачами та ролями +******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/add-role-to-keycloak-user.adoc[] +******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/save-user-roles.adoc[] +******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/get-roles-from-keycloak.adoc[] +******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/keycloak-get-officer-users-by-attributes-equals-start-with.adoc[] +******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/remove-role-from-keycloak-user.adoc[] +****** Керування налаштування користувача +******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/read-user-settings.adoc[] +****** Створення сутностей +******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/create-entity.adoc[] +******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/create-nested-entities.adoc[] +******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/batch-creation-entities.adoc[] +******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/batch-creation-entities-v2.adoc[] +****** Читання та пошук сутностей +******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/read-entity.adoc[] +******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/batch-read-entities-from-data-factory.adoc[] +******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/search-entities-in-data-factory.adoc[] +****** Оновлення сутностей +******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/update-entity-in-data-factory.adoc[] +******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/update-entity-in-data-factory-partially.adoc[] +****** Видалення сутностей +******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/delete-entity.adoc[] +****** Моделювання цифрових підписів +******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/digital-signature-by-dso-service.adoc[] +****** Інтеграція зовнішніх систем +******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/connect-to-external-system-v2.adoc[] +****** Моделювання помилок у бізнес-процесі +******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/throw-system-error.adoc[] +******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/throw-validation-error.adoc[] +****** Моделювання статусів +******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/define-bp-status.adoc[] \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/pages/bp-modeling/bp/element-templates/user-task-templates/user-task-overview.adoc b/docs/ua/modules/registry-develop/pages/bp-modeling/bp/element-templates/user-task-templates/user-task-overview.adoc index e04b11b059..a6a6aef8c2 100644 --- a/docs/ua/modules/registry-develop/pages/bp-modeling/bp/element-templates/user-task-templates/user-task-overview.adoc +++ b/docs/ua/modules/registry-develop/pages/bp-modeling/bp/element-templates/user-task-templates/user-task-overview.adoc @@ -1,4 +1,14 @@ = Типові розширення для користувацьких задач (User task templates) +:toclevels: 5 +:experimental: +:important-caption: ВАЖЛИВО +:note-caption: ПРИМІТКА +:tip-caption: ПІДКАЗКА +:warning-caption: ПОПЕРЕДЖЕННЯ +:caution-caption: УВАГА +:sectanchors: +:sectlinks: + include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Огляд секції @@ -7,29 +17,3 @@ include::platform:ROOT:partial$admonitions/language-ua.adoc[] * xref:bp-modeling/bp/element-templates/user-task-templates/officer-sign-task.adoc[] * xref:bp-modeling/bp/element-templates/user-task-templates/user-form.adoc[] - - -//// -[#business-process-modeler-extensions-configuration] -== Налаштування типових розширень до бізнес-процесів - -Цей розділ описує налаштування типових розширень для бізнес-процесів -- **Element Templates**. - -Типи задач для застосування розширень :: - -Типові розширення **Element Templates** можуть бути застосовані до різних типів задач, наприклад: - -* xref:#element-temp-user-task[] -* xref:#element-temp-service-task[] -* xref:#element-temp-call-activity[] -* xref:#element-temp-send-task[] -* xref:#extensions-integrate-bp-another-registries[] - -[CAUTION] -==== -Налаштування типових розширень-конекторів відбувається у застосунку *Camunda Modeler*. - -Перед початком роботи переконайтеся, що виконано всі передумови, описані у розділі xref:business-process-modeler-extensions-installation[Встановлення каталогу типових розширень до бізнес-процесів]. -==== -//// - diff --git a/docs/ua/modules/registry-develop/pages/bp-modeling/bp/excerpts/bp-modeling-excerpt-csv-docx.adoc b/docs/ua/modules/registry-develop/pages/bp-modeling/bp/excerpts/bp-modeling-excerpt-csv-docx.adoc index 9059621480..14747feafd 100644 --- a/docs/ua/modules/registry-develop/pages/bp-modeling/bp/excerpts/bp-modeling-excerpt-csv-docx.adoc +++ b/docs/ua/modules/registry-develop/pages/bp-modeling/bp/excerpts/bp-modeling-excerpt-csv-docx.adoc @@ -1,24 +1,9 @@ = Моделювання бізнес-процесу з формування витягів у форматі csv та docx -:toc: -:toc-title: ЗМІСТ -:experimental: -:example-caption: Приклад -:important-caption: ВАЖЛИВО -:note-caption: ПРИМІТКА -:tip-caption: ПІДКАЗКА -:warning-caption: ПОПЕРЕДЖЕННЯ -:caution-caption: УВАГА -:figure-caption: Figure -:table-caption: Table -:appendix-caption: Appendix -:toclevels: 5 -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - -Опис механізму моделювання бізнес-процесу наведений на прикладі Реєстру атестованих лабораторій, а саме формування витягу "Звіт по лабораторіям у форматі csv". Моделювання бізнес-процесу з витягом у форматі docx є аналогічним, за винятком кроку, де зазначається формат файлу. +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] + +Опис механізму моделювання бізнес-процесу наведений на прикладі Реєстру атестованих лабораторій, а саме формування витягу "Звіт по лабораторіях у форматі csv". Моделювання бізнес-процесу з витягом у форматі docx є аналогічним, за винятком кроку, де зазначається формат файлу. [TIP] Виконайте необхідні передумови для створення бізнес-процесу, інструкція за xref:bp-modeling/bp/bp-modeling-instruction.adoc#bp-modelling-preconditions[посиланням]. @@ -260,25 +245,24 @@ set_transient_variable('excerpt', excerptInputData) + image:registry-develop:bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-07.png[] -. Додайте задачу виклику зовнішнього бізнес-процесу (Call Activity) "Підпис даних системним ключем". +. Додайте сервісну задачу для підпису даних системним ключем. + [TIP] ==== -Детальніше ознайомитися з описом делегата виклику підпроцесу для підпису даних системним ключем (`System digital signature`) ви можете за xref:bp-modeling/bp/element-templates/bp-element-templates-installation-configuration.adoc#element-temp-system-digital-signature[посиланням]. +Детальніше ознайомитися з описом делегата для підпису даних системним ключем ви можете за xref:bp-modeling/bp/element-templates/service-task-templates/digital-signature-by-dso-service.adoc[посиланням]. ==== + -Оберіть налаштований шаблон (Template) `System digital signature`. +Оберіть налаштований шаблон (Template) *Digital signature by DSO service*. + На панелі налаштувань вкажіть наступні значення: -* в полі `Name` вкажіть назву задачі `Підпис даних системним ключем`; -* в полі `Input Data` вкажіть вхідні дані, які необхідно підписати та передати бізнес-процесу, що викликається `${payload}`; -* в полі `Output variable name` вкажіть назву змінної `system_signature_ceph_key`, до якої необхідно зберегти системний ключ для підпису, отриманий в результаті виконання підпроцесу, що викликається. - -+ -image:registry-develop:bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-08.png[] +* У полі *Name* вкажіть назву задачі `Підпис даних системним ключем`. +* У полі *Payload* введіть дані для підпису -- `${payload}`. +* У полі *X-Access-Token source* вкажіть токен доступу користувача, під яким виконується операція -- `${initiator().accessToken}`. +* У полі *Result variable* вкажіть назву змінної `system_signature_ceph_key`, до якої необхідно зберегти системний ключ для підпису. == Формування звіту + [#create-service-task-1] . Створіть сервісну задачу "Запит на формування витягу-звіту". + @@ -293,7 +277,7 @@ image:registry-develop:bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-d ==== Можливість підписання даних витягів у форматі .csv і .docx системним ключем [.underline]#відсутня#, тому за замовчуванням параметр `Requires System Signature` має містити значення `false`. Якщо буде вказано значення `true`, бізнес-процес не буде працювати. _Підписання системним ключем доступно лише для формату .pdf_. ==== -* в полі `X-Access-Token` зазначте токен доступу до системи користувача, під яким виконується операція `${initiator().accessToken}`; +* в полі `X-Access-Token` зазначте токен доступу користувача, під яким виконується операція -- `${initiator().accessToken}`; * в полі `X-Digital-Signature source` вкажіть джерело цифрового підпису `${sign_submission('StartEvent_lab1').signatureDocumentId}`; * в полі `X-Digital-Signature-Derived source` вкажіть джерело системного цифрового підпису `${system_signature_ceph_key}`; * в полі `Result variable` вкажіть назву для вихідного параметра `response`. @@ -426,14 +410,11 @@ image:registry-develop:bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-d image:registry-develop:bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-12.1.png[] + - - .Бізнес процес "Перевірка статусу генерації витягу" ==== image:registry-develop:bp-modeling/bp/excerpt-csv-docx/bp-modeling-excerpt-csv-docx-13.png[] ==== - . Додайте елемент Create Intermediate/Boundary Event, визначте її тип, натиснувши іконку ключа (Change type) та обравши з меню пункт Timer Boundary Event. + [TIP] diff --git a/docs/ua/modules/registry-develop/pages/bp-modeling/bp/index.adoc b/docs/ua/modules/registry-develop/pages/bp-modeling/bp/index.adoc index 206bf8f9df..92fd1a15dd 100644 --- a/docs/ua/modules/registry-develop/pages/bp-modeling/bp/index.adoc +++ b/docs/ua/modules/registry-develop/pages/bp-modeling/bp/index.adoc @@ -1 +1,18 @@ -= Моделювання бізнес-процесів і таблиць прийняття рішень \ No newline at end of file += Моделювання бізнес-процесів і таблиць прийняття рішень +:sectanchors: +:sectlinks: + +_Бізнес-процеси (БП)_ -- це базис для всіх послуг, що надають реєстри на Платформі. Вони засновані на BPMN -- стандартизованій системі умовних позначень для представлення та моделювання бізнес-процесів, що дозволяє організаціям впорядкувати операції, а також покращити ефективність та зв'язок між надавачами та отримувачами послуг. Моделювальники процесів використовують спеціалізовані інструменти BPMN, щоб створювати, редагувати, емулювати, та виконувати бізнес-процеси. + +Моделювання БП -- великий розділ, який охоплює велику безліч сторінок. Детальніше про кожну з них ви можете дізнатися в огляді секції. + +== Огляд секції + +* [*] xref:bp-modeling/bp/what-is-bp.adoc[] +* [*] xref:bp-modeling/bp/bp-modeling-instruction.adoc[] +* [*] xref:bp-modeling/bp/element-templates/element-templates-overview.adoc[] +* [*] xref:bp-modeling/bp/bpmn/index.adoc[] +* [*] xref:bp-modeling/bp/modeling-facilitation/overview.adoc[] +* [*] xref:bp-modeling/bp/bp-alternative-branches.adoc[] +* [*] xref:bp-modeling/bp/access/roles-rbac-bp-modelling.adoc[Розмежування доступу до бізнес-процесів та задач] +* [*] xref:bp-modeling/bp/excerpts/bp-modeling-excerpt-csv-docx.adoc[] \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/pages/bp-modeling/bp/rest-connector.adoc b/docs/ua/modules/registry-develop/pages/bp-modeling/bp/rest-connector.adoc index f27fbb9f13..337abbc8fd 100644 --- a/docs/ua/modules/registry-develop/pages/bp-modeling/bp/rest-connector.adoc +++ b/docs/ua/modules/registry-develop/pages/bp-modeling/bp/rest-connector.adoc @@ -1,35 +1,7 @@ -// use these attributes to translate captions and labels to the document's language -// more information: https://asciidoctor.org/docs/user-manual/#customizing-labels -// table of contents title -:toc-title: ЗМІСТ -:toc: -:experimental: -:example-caption: Приклад -:important-caption: ВАЖЛИВО -:note-caption: ПРИМІТКА -:tip-caption: ПІДКАЗКА -:warning-caption: ПОПЕРЕДЖЕННЯ -:caution-caption: УВАГА -// captions for specific blocks -:figure-caption: Figure -:table-caption: Table -// caption for the appendix -:appendix-caption: Appendix -// how many headline levels to display in table of contents? -:toclevels: 5 -// https://asciidoctor.org/docs/user-manual/#sections-summary -// turn numbering on or off (:sectnums!:) -:sectnums: -// enumerate how many section levels? -:sectnumlevels: 5 -// show anchors when hovering over section headers -:sectanchors: -// render section headings as self referencing links -:sectlinks: -// number parts of a book -:partnums: - = Інтеграція із зовнішніми сервісами за допомогою REST-конектора +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] `REST Connector` -- це конектор для підключення до зовнішніх захищених сервісів/систем поза кластером Платформи. diff --git a/docs/ua/modules/registry-develop/pages/bp-modeling/external-integration/api-call/connectors-external-registry.adoc b/docs/ua/modules/registry-develop/pages/bp-modeling/external-integration/api-call/connectors-external-registry.adoc index 6b9faed8aa..5d91d29d5e 100644 --- a/docs/ua/modules/registry-develop/pages/bp-modeling/external-integration/api-call/connectors-external-registry.adoc +++ b/docs/ua/modules/registry-develop/pages/bp-modeling/external-integration/api-call/connectors-external-registry.adoc @@ -1,23 +1,7 @@ -:toc-title: ЗМІСТ -:toc: auto -:toclevels: 5 -:experimental: -:important-caption: ВАЖЛИВО -:note-caption: ПРИМІТКА -:tip-caption: ПІДКАЗКА -:warning-caption: ПОПЕРЕДЖЕННЯ -:caution-caption: УВАГА -:example-caption: Приклад -:figure-caption: Зображення -:table-caption: Таблиця -:appendix-caption: Додаток -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Типові інтеграційні SOAP-конектори до інших реєстрів +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Загальний опис @@ -40,7 +24,7 @@ _Детальніше про налаштування інтеграцій че == Встановлення типових розширень-конекторів -Налаштування розширень-конекторів відбувається у застосунку **Camunda Modeler**. Перед початком роботи переконайтеся, що виконано всі передумови, описані у розділі xref:bp-modeling/bp/element-templates/bp-element-templates-installation-configuration.adoc#business-process-modeler-extensions-installation[Встановлення каталогу типових розширень до бізнес-процесів]. +Налаштування розширень-конекторів відбувається у застосунку **Camunda Modeler**. Перед початком роботи переконайтеся, що виконано всі передумови, описані у розділі xref:bp-modeling/bp/element-templates/element-templates-install.adoc[]. [#edr] == Розширення-конектори для отримання даних з ЄДР @@ -753,7 +737,7 @@ NOTE: Функція *`S(edrResponseBody, 'application/xml')`* повертає . Введіть назву задачі. Наприклад, `Переглянути дані з ЄДР`. . У полі `*ID*` введіть ідентифікатор задачі (`activity_id`). Наприклад, `*writeResultForm*`. -. У полі `*Form key*` введіть службову назву UI-форми вводу даних. Наприклад, `*soap-http-connector-edrpou-edr-result-view*`. +. У полі `*Form key*` введіть службову назву UI-форми перегляду отриманих даних. Наприклад, `*soap-http-connector-edrpou-edr-result-view*`. . У полі `Assignee` введіть токен ініціатора процесу -- `${initiator}`. . У полі `*Form data pre-population*` вкажіть як змінну об'єкт із параметрами, які необхідно передати на форму, -- `*${payload}*`. + diff --git a/docs/ua/modules/registry-develop/pages/bp-modeling/forms/bp-modeling-forms-general-description.adoc b/docs/ua/modules/registry-develop/pages/bp-modeling/forms/bp-modeling-forms-general-description.adoc index 6b54f600ac..72003cd32d 100644 --- a/docs/ua/modules/registry-develop/pages/bp-modeling/forms/bp-modeling-forms-general-description.adoc +++ b/docs/ua/modules/registry-develop/pages/bp-modeling/forms/bp-modeling-forms-general-description.adoc @@ -1,10 +1,13 @@ -= Моделювання UI-форм бізнес-процесів += Моделювання UI-форм для бізнес-процесів +:sectanchors: +:sectlinks: -Моделювання форм до бізнес-процесів відбувається у **Кабінеті адміністратора регламентів**, що дозволяє забезпечити зв'язок між користувацькими формами, необхідними для внесення даних до БД, та API рівнів виконання бізнес-процесів і фабрики даних. +UI-форми у _Кабінеті адміністратора регламентів_ дозволяють вводити, зчитувати та шукати дані у реєстрах. Вони забезпечують зв'язок між користувацькими інтерфейсами та API-рівнями виконання бізнес-процесів та Фабрикою даних. -[#useful-links] -== Корисні посилання +[#section-overview] +== Огляд секції -. https://help.form.io/intro/welcome/[Офіційне джерело FormIO]. -. https://help.form.io/userguide/forms/[Форми FormIO]. -. https://help.form.io/userguide/form-components/[Компоненти форм FormIO]. \ No newline at end of file +* [*] xref:bp-modeling/forms/registry-admin-modelling-forms.adoc[] +* [*] xref:bp-modeling/forms/components/index.adoc[] +* [*] xref:registry-admin/admin-portal/overview.adoc[] +* [*] https://help.form.io/intro/welcome/[Офіційне джерело Form.io] \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/checkbox.adoc b/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/checkbox.adoc index f2926fe7fd..e1eb09eb4f 100644 --- a/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/checkbox.adoc +++ b/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/checkbox.adoc @@ -43,6 +43,9 @@ include::general/common-descriptions/api/index.adoc[] Conditions :: include::general/common-descriptions/conditional/index.adoc[] +Logic :: +include::general/common-descriptions/logic/index.adoc[] + Table :: include::general/common-descriptions/table/index.adoc[] diff --git a/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/content.adoc b/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/content.adoc index bb7f70a26b..624f3b2ada 100644 --- a/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/content.adoc +++ b/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/content.adoc @@ -54,6 +54,9 @@ API :: Conditional :: include::general/common-descriptions/conditional/index.adoc[] +Logic :: +include::general/common-descriptions/logic/index.adoc[] + ==== == Формат даних diff --git a/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/date-time.adoc b/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/date-time.adoc index 69ae15dfa3..117885d331 100644 --- a/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/date-time.adoc +++ b/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/date-time.adoc @@ -52,6 +52,9 @@ include::general/common-descriptions/api/index.adoc[] Conditions :: include::general/common-descriptions/conditional/index.adoc[] +Logic :: +include::general/common-descriptions/logic/index.adoc[] + Table :: include::general/common-descriptions/table/index.adoc[] diff --git a/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/edit-grid/edit-grid-hide-view-button.adoc b/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/edit-grid/edit-grid-hide-view-button.adoc new file mode 100644 index 0000000000..f6e3770a53 --- /dev/null +++ b/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/edit-grid/edit-grid-hide-view-button.adoc @@ -0,0 +1,89 @@ += Керування опцією "Переглянути" в табличному компоненті EditGrid +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +== Проблематика + +Раніше опція "Переглянути" відображалася за замовчуванням у контекстному меню рядка таблиці при активованому режимі перегляду таблиці *Read Only*. Це часто виявлялося незручним і плутало користувачів, оскільки не завжди вона була необхідною для виконання робочих процесів. Таке стандартне включення кнопки могло перевантажувати інтерфейс непотрібними опціями, що призводило до непорозумінь та зайвих кліків, особливо у складних формах з великою кількістю даних. + +== Загальний опис + +Платформа тепер надає вам ще більше контролю над інтерфейсом користувача з новою функціональністю для компонента *Edit Grid*. Ця функціональність дозволяє приховати кнопку *`Переглянути`* у режимі "*Лише для читання*", якщо вона не є необхідною для вашого бізнес-процесу. Така гнучкість у налаштуваннях забезпечує чистіший та більш прицільний інтерфейс, дозволяючи користувачам зосередитись на важливих елементах управління. Це значно розширює можливості розробників регламентів при створенні та налаштуванні форм, підвищуючи ефективність та адаптивність робочих процесів. + +image:release-notes:wn-1-9-7/wn-1-9-7-33.png[] + +== Налаштування Edit Grid + +. У Кабінеті адміністратора регламентів створіть нову або відредагуйте наявну UI-форму із компонентом xref:bp-modeling/forms/components/edit-grid/edit-grid.adoc[EditGrid]. ++ +TIP: У нашому випадку розглянемо налаштування табличного компонента *EditGrid* на прикладі наявної в регламенті демо-реєстру форми: `feature-hide-view-button-with-record-actions`. + +. Перейдіть на вкладку *Display* та активуйте режим взаємодії з таблицею -- *Read Only*. +. Увімкніть функцію *Hide "view" button*. ++ +image:bp-modeling/forms/components/edit-grid/hide-view-button/edit-grid-hide-view-button-1.png[] + +. Відкрийте вкладку *Logic* та налаштуйте коди дії над записом таблиці, як показано на прикладі. ++ +image:bp-modeling/forms/components/edit-grid/hide-view-button/edit-grid-hide-view-button-2.png[] ++ +За таких налаштувань користувач побачить на формі бізнес-процесу в Кабінеті таблицю із контекстним меню "три крапки" (`⋮`) без елемента управління *`Переглянути`*. ++ +TIP: Більш детально про логіку роботи кодів дії у бізнес-процесах ви можете переглянути на сторінці xref:best-practices/edit-grid-rows-action.adoc[]. + +. Створіть або відредагуйте іншу форму із компонентом xref:bp-modeling/forms/components/edit-grid/edit-grid.adoc[EditGrid]. ++ +TIP: У нашому випадку розглянемо налаштування табличного компонента *EditGrid* на прикладі наявної в регламенті демо-реєстру форми: `feature-hide-view-button`. + +. Перейдіть на вкладку *Display* та активуйте режим взаємодії з таблицею -- *Read Only*. +. Увімкніть функцію *Hide "view" button*. ++ +image:bp-modeling/forms/components/edit-grid/hide-view-button/edit-grid-hide-view-button-1.png[] + +. На цій формі залиште порожніми налаштування кодів дії для контекстного меню у вкладці *Logic*. + +За таких налаштувань, таблиця із контекстним меню "три крапки" (`⋮`) в Кабінеті не буде показана взагалі. ++ +image:bp-modeling/forms/components/edit-grid/hide-view-button/edit-grid-hide-view-button-3.png[] + +== Перегляд бізнес-процесу у Кабінеті користувача + +[TIP] +==== +[%collapsible] +.Де можна знайти приклад тестового бізнес-процесу? +===== +include::registry-develop:partial$snippets/demo-reg-reference-examples-ua.adoc[] + +Приклад BPMN-схеми процесу буде доступний у регламенті демо-реєстру за пошуком по ключовим словам -- *_feature-hide-view-button_*. Назви форм ви можете також знайти всередині відповідних користувацьких задач (User Task) бізнес-процесу у полі *`Form key`*. + +.Загальний вигляд тестового процесу у Кабінеті адміністратора регламентів +image::bp-modeling/forms/components/edit-grid/hide-view-button/edit-grid-hide-view-button-bp.png[] +===== +==== + +Розгляньмо форми з описаними налаштуваннями табличного компонента на тестовому прикладі бізнес-процесу. Ми не будемо детально зупинятися на моделюванні, адже процес є доволі простим, натомість пропонуємо розглянути, як працює змодельована функціональність з погляду кінцевих користувачів. Для цього: + +. Увійдіть до *Кабінету користувача*. +. Відкрийте *Доступні послуги* > *Інші бізнес-процеси* > *Налаштування кнопки переглянути в компоненті EditGrid*. ++ +image:bp-modeling/forms/components/edit-grid/hide-view-button/edit-grid-hide-view-button-4.png[] + +. Запустіть бізнес-процес. ++ +* Ви побачите форму із налаштуваннями кнопки *`Переглянути`* у компоненті *EditGrid* з *Record Actions*. ++ +* На формі показано таблицю в режимі *Read Only*. ++ +У контекстному ви побачите лише дії з даними певного рядка, без можливості перегляду всіх даних цього рядка в окремому pop-up-вікні. ++ +image:bp-modeling/forms/components/edit-grid/hide-view-button/edit-grid-hide-view-button-5.png[] + +. Натисніть *`Далі`* та перейдіть до наступної форми. ++ +Тут ви побачите таблиці в режимі *Read Only*, але вже без контекстного меню "три крапки" (`⋮`) та, відповідно, елемента управління *`Переглянути`*. ++ +image:bp-modeling/forms/components/edit-grid/hide-view-button/edit-grid-hide-view-button-6.png[] + +== Пов'язані сторінки + +* xref:bp-modeling/forms/components/edit-grid/edit-grid.adoc[] +* xref:best-practices/edit-grid-rows-action.adoc[] \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/edit-grid/edit-grid-save-data-list.adoc b/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/edit-grid/edit-grid-save-data-list.adoc index f2d2f859c0..04335e8045 100644 --- a/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/edit-grid/edit-grid-save-data-list.adoc +++ b/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/edit-grid/edit-grid-save-data-list.adoc @@ -1,23 +1,7 @@ -:toc-title: ЗМІСТ -:toc: auto -:toclevels: 5 -:experimental: -:important-caption: ВАЖЛИВО -:note-caption: ПРИМІТКА -:tip-caption: ПІДКАЗКА -:warning-caption: ПОПЕРЕДЖЕННЯ -:caution-caption: УВАГА -:example-caption: Приклад -:figure-caption: Зображення -:table-caption: Таблиця -:appendix-caption: Додаток -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Збереження даних з форми масивом у БД +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] Завантажити дані масивом до фабрики даних можливо, якщо при моделюванні форми використати компонент *Edit Grid*. @@ -61,4 +45,7 @@ image:bp-modeling/forms/components/edit-grid/submit-data-as-array/edit-grid-subm + image:bp-modeling/forms/components/edit-grid/submit-data-as-array/edit-grid-submit-data-as-array-4.png[] -Таким чином сформується таблиця, яка складається із записів різного типу (у нашому прикладі -- *Text Field* та *Date / Time*), які об'єднані в єдиний масив під компонентом *Edit Grid*. Надалі користувачі Кабінету посадової особи зможуть в рамках проходження бізнес-процесів наповнювати змодельовані форми задач реальними даними, які, після підписання їх КЕП, зберігатимуться до відповідних таблиць бази даних. \ No newline at end of file +Таким чином сформується таблиця, яка складається зі стовпців різного типу (_у нашому прикладі -- це компоненти *Text Field* та *Date / Time_*), які об'єднані в єдиний масив під компонентом *Edit Grid*. Надалі користувачі Кабінету користувача зможуть в рамках проходження бізнес-процесів наповнювати змодельовані форми задач реальними даними, які, після підписання їх КЕП, зберігатимуться до відповідних таблиць бази даних. + +.Запит до Фабрики даних у форматі JSON +image::bp-modeling/forms/components/edit-grid/submit-data-as-array/edit-grid-submit-data-as-array-5.png[] \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/edit-grid/edit-grid.adoc b/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/edit-grid/edit-grid.adoc index e92ec15204..97865d68d0 100644 --- a/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/edit-grid/edit-grid.adoc +++ b/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/edit-grid/edit-grid.adoc @@ -9,7 +9,7 @@ include::platform:ROOT:partial$admonitions/language-ua.adoc[] Розширення стандартного компонента *Edit Grid* включає додавання додаткових опцій, які спрощують моделювання. Це дозволяє розробникам та моделювальникам регламенту використовувати цей компонент більш гнучко та підлаштувати його під специфічні потреби різноманітних бізнес-сценаріїв. -CAUTION: Використовуйте *Edit Grid* з переліку _Оновлених_ компонентів. +CAUTION: Використовуйте *Edit Grid* з переліку *_Оновлених_* компонентів. == Основні функції @@ -48,6 +48,7 @@ API :: Logic :: +include::registry-develop:bp-modeling/forms/components/general/common-descriptions/logic/index.adoc[] * *`Record Actions`*: дії, які можна виконати із записами в таблиці (максимальна кількість дій -- 5). Наприклад, можна змінити дату терміну дії ліцензії (`Action: _action_update`) або анулювати ліцензію (`Action: _action_cancel`) тощо. ==== diff --git a/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/email.adoc b/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/email.adoc index e86ed3b938..59075ce1b6 100644 --- a/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/email.adoc +++ b/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/email.adoc @@ -30,6 +30,8 @@ API :: include::general/common-descriptions/api/index.adoc[] Conditional :: include::general/common-descriptions/conditional/index.adoc[] +Logic :: +include::general/common-descriptions/logic/index.adoc[] Table :: include::general/common-descriptions/table/index.adoc[] diff --git a/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/file/file.adoc b/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/file/file.adoc index a3eb8cbb71..3cc6a3420b 100644 --- a/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/file/file.adoc +++ b/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/file/file.adoc @@ -53,6 +53,9 @@ include::../general/common-descriptions/api/index.adoc[] Conditions :: include::../general/common-descriptions/conditional/index.adoc[] +Logic :: +include::general/common-descriptions/logic/index.adoc[] + Table :: include::../general/common-descriptions/table/index.adoc[] diff --git a/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/general/common-descriptions/logic/index.adoc b/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/general/common-descriptions/logic/index.adoc new file mode 100644 index 0000000000..1b9479c77b --- /dev/null +++ b/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/general/common-descriptions/logic/index.adoc @@ -0,0 +1 @@ +include::logic.adoc[] \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/general/common-descriptions/logic/logic.adoc b/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/general/common-descriptions/logic/logic.adoc new file mode 100644 index 0000000000..ad7d99d118 --- /dev/null +++ b/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/general/common-descriptions/logic/logic.adoc @@ -0,0 +1,13 @@ +* *`Advanced Logic`*: в контексті компонентів веб-форм означає більш складні та гнучкі умови і правила, які можна встановити для взаємодії елементів форми між собою. означає, що можна налаштовувати не тільки прості відображення чи приховування полів на основі одного-двох умов, але й створювати більш складні логічні вирази, які реагують на різні стани та вхідні дані. +** *`Logic Name`*: назва логічного блоку або умови, яку ви встановлюєте. Вона використовується для ідентифікації цієї конкретної логіки або умови в межах вашої форми. +** *`Trigger`*: умова або подія, яка викликає виконання екшену (дії). Тригер може бути будь-яким станом форми (наприклад, значенням певного поля) або подією (наприклад, подія "клік" чи "введення" в конкретному полі). +*** *`Type`*: параметр, який вказує, який тип логіки ви використовуєте. +Simple: проста логіка, де ви вказуєте одну умову або правило для тригера. +Javascript: логіка з використовуванням JavaScript код для складніших умов та правил. Детальніше див. xref:bp-modeling/forms/components/general/eval.adoc[]. +*** *`When the form component`*: вказує на те, коли ця логіка або умова буде застосована. Відображається для типу Simple. +*** *`Has the value`*: вказує на конкретне значення, яке ви очікуєте від компонента форми для виконання цієї умови чи тригера. Відображається для типу Simple. +** *`Action`*: дія, яка виконується, коли відбувається тригер. Екшин може бути різними діями над формою. +*** *`Action Name`*: назва для ідентифікації цієї конкретної дії в межах вашої форми. +*** *`Type`*: тип дії, яку ви хочете виконати. Доступно Property (вказує на конкретну властивість компонента форми, яку ви хочете змінити.) +*** *`Component Property`*: вказує на конкретну властивість компонента форми, яку ви хочете змінити. Відображається для типу Property. +Disabled: заблокований стан компонента. Можливо встановити true або false. diff --git a/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/index.adoc b/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/index.adoc index bc6f0e5f92..286fecc176 100644 --- a/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/index.adoc +++ b/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/index.adoc @@ -3,16 +3,16 @@ include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc include::platform:ROOT:partial$admonitions/language-ua.adoc[] -Цей розділ надає загальний огляд +++оновлених компонентів+++ для моделювання UI-форм. Ми рекомендуємо використовувати ці компоненти для підвищення ефективності процесу розробки регламенту та покращення користувацького досвіду. Оновлені компоненти стандартного сету *Form IO* надають більше гнучкості та розширюють функціональні можливості. +Цей розділ надає загальний огляд *_Оновлених_* компонентів для моделювання UI-форм. Ми рекомендуємо використовувати ці компоненти для підвищення ефективності процесу розробки регламенту та покращення користувацького досвіду. Оновлені компоненти стандартного сету *Form IO* надають більше гнучкості та розширюють функціональні можливості. image:registry-develop:bp-modeling/forms/components/components-panel.png[] -Ви можете використовувати функціональність у +++Кабінеті адміністратора регламентів+++ > +++UI-форми+++ (_режим створення або редагування форми_) > +++Конструктор+++ > +++Оновлені+++. +Ви можете використовувати функціональність у *Кабінеті адміністратора регламентів* > *UI-форми* (_режим створення або редагування форми_) > *Конструктор* > *Оновлені*. .Опис оновлених компонентів для моделювання UI-форм [cols="1,2",options="header"] |=== -| +++Компонент+++ | +++Опис+++ +| Компонент | Опис | xref:bp-modeling/forms/components/text-field.adoc[*Text Field*] | Компонент для введення тексту користувачем. Він може бути використаний для створення полів, таких як ім'я, адреса тощо. diff --git a/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/number.adoc b/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/number.adoc index bfa4a1b086..48306ec129 100644 --- a/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/number.adoc +++ b/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/number.adoc @@ -55,6 +55,9 @@ include::general/common-descriptions/api/index.adoc[] Conditions :: include::general/common-descriptions/conditional/index.adoc[] +Logic :: +include::general/common-descriptions/logic/index.adoc[] + Table :: include::general/common-descriptions/table/index.adoc[] diff --git a/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/radio.adoc b/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/radio.adoc index 6993d3f8f0..23d580aab1 100644 --- a/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/radio.adoc +++ b/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/radio.adoc @@ -49,6 +49,9 @@ include::general/common-descriptions/api/index.adoc[] Conditions :: include::general/common-descriptions/conditional/index.adoc[] +Logic :: +include::general/common-descriptions/logic/index.adoc[] + Table :: include::general/common-descriptions/table/index.adoc[] diff --git a/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/select/bp-select-component-form-io.adoc b/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/select/bp-select-component-form-io.adoc index 73ee8b4b92..ba1c1b2721 100644 --- a/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/select/bp-select-component-form-io.adoc +++ b/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/select/bp-select-component-form-io.adoc @@ -1,22 +1,7 @@ = Налаштування компонента Select для отримання та фільтрації даних від API-ресурсів -:toc-title: ЗМІСТ -:toc: auto -:toclevels: 5 -:experimental: -:important-caption: ВАЖЛИВО -:note-caption: ПРИМІТКА -:tip-caption: ПІДКАЗКА -:warning-caption: ПОПЕРЕДЖЕННЯ -:caution-caption: УВАГА -:example-caption: Приклад -:figure-caption: Зображення -:table-caption: Таблиця -:appendix-caption: Додаток -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] TIP: *API Endpoint (Кінцева точка інтеграційної взаємодії, ендпоінт)* -- це точка входу у сервісі для отримання даних при взаємодії двох систем. @@ -88,15 +73,35 @@ image:registry-develop:bp-modeling/forms/bp-select/bp-select-form-io-3.png[] . Перейдіть на вкладку **Data** -> далі в полі **Data Source Type** введіть значення `URL`. -. Вкажіть значення для endpoint URL у полі **Data Source URL** (наприклад, `https://user-proc-mng-lowcode-pipe-qa.apps.cicd.mdtu-ddm.projects.epam.com/api/process-instance`). +. Вкажіть значення для endpoint URL у полі **Data Source URL**. Наприклад: ++ +[source,http] +---- +https://-./api/process-instance +---- ++ +[TIP] +==== +* `` -- назва сервісу. Наприклад, `test-service`. +* `` -- Openshift namespace/проєкт. Наприклад, `test-project`. +* `` вказує на доменні та піддоменні імена для інстансу Платформи. Наприклад, `example.com`. +* `/api/process-instance` -- конкретний API-ендпоінт сервісу. + +Фінальний URL виглядатиме так: + +[source,http] +---- +https://test-service-test-project.example.com/api/process-instance +---- +==== + image:registry-develop:bp-modeling/forms/bp-select/bp-select-form-io-5.png[] . Зазначте **Value Property** у відповідному полі -- назва властивості із JSON-відповіді ендпоінту, яка зберігатиметься як значення після select (наприклад, `id`). -. Встановіть **Item Template** -- HTML-шаблон для відображення значень у селекті, як показано на прикладі нижче. +. Встановіть **Item Template** -- HTML-шаблон для відображення значень у select, як показано на прикладі нижче. + -NOTE: `processDefinitionName` _та `id` беруться із відповіді ендпоінту та відображатимуться в селекті)._ +NOTE: `processDefinitionName` _та `id` беруться із відповіді ендпоінту та відображатимуться в select)._ + .HTML-шаблон ==== @@ -137,7 +142,27 @@ image:registry-develop:bp-modeling/forms/bp-select/bp-select-form-io-2.png[] image:registry-develop:bp-modeling/forms/bp-select/bp-select-form-io-8.png[] . Перейдіть на вкладку **Data** -> далі в полі **Data Source Type** введіть значення `URL`. -. Вкажіть значення для endpoint URL у полі **Data Source URL** (наприклад, `https://user-task-mng-lowcode-pipe-qa.apps.cicd.mdtu-ddm.projects.epam.com/api/task`). +. Вкажіть значення для endpoint URL у полі **Data Source URL**. Наприклад: ++ +[source,http] +---- +https://-./api/task +---- ++ +[TIP] +==== +* `` -- назва сервісу. Наприклад, `test-service`. +* `` -- Openshift namespace/проєкт. Наприклад, `test-project`. +* `` вказує на доменні та піддоменні імена для інстансу Платформи. Наприклад, `example.com`. +* `/api/process-instance` -- конкретний API-ендпоінт сервісу. + +Фінальний URL виглядатиме так: + +[source,http] +---- +https://test-service-test-project.example.com/api/task +---- +==== + image:registry-develop:bp-modeling/forms/bp-select/bp-select-form-io-9.png[] diff --git a/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/select/select-overview.adoc b/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/select/select-overview.adoc index 78fca47a78..eb5ff9a283 100644 --- a/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/select/select-overview.adoc +++ b/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/select/select-overview.adoc @@ -25,10 +25,10 @@ Data :: * *`Multiple Values`*: дозволяє вибрати декілька значень. * *`Data Source Type`*: визначає звідки брати значення. -Щоб отримувати дані з серверу xref:bp-modeling/forms/components/select/bp-select-component-form-io.adoc[Див.] -* *`Default Values`*: визначте Value Property — назва властивості із JSON-відповіді ендпоінту, яка зберігатиметься як значення після селекту (наприклад, formKey). +Щоб отримувати дані із сервера xref:bp-modeling/forms/components/select/bp-select-component-form-io.adoc[Див.] +* *`Default Values`*: визначає Value Property -- назва властивості із JSON-відповіді ендпоінту, яка зберігатиметься як значення після селекту (наприклад, formKey). * *`Data Source Values`*: перелік значень, які відображаються в полі вибору. -* *`Item Template`*: дозволяє налаштувати вигляд кожного елемента у випадаючому списку компонента *Select*. Кожен елемент списку може включати не тільки текст, але й додаткові візуальні елементи, такі як значки, зображення або інші HTML-елементи. +* *`Item Template`*: дозволяє налаштувати вигляд кожного елемента у випадному списку компонента *Select*. Кожен елемент списку може включати не тільки текст, але й додаткові візуальні елементи, такі як значки, зображення або інші HTML-елементи. * *`Refresh Options On`*: перемальовує компонент, якщо інший компонент змінюється xref:bp-modeling/forms/components/select/select-refresh-options.adoc[Див.] * *`Refresh Options On Blur`*: контролює, коли компонент *Select* оновлює свої варіанти вибору. * *`Clear value when on refresh options`*: дозволяє визначити поведінку щодо видалення вибраного значення, коли відбувається оновлення опцій для вибору. @@ -53,11 +53,15 @@ Conditions :: * *`Advanced Conditions`*: дозволяють вам налаштовувати складні умови для компонента *Select*. Ці умови визначають, коли компонент стає видимим, доступним для вибору, або коли він повинен мати певне значення на основі умов, виразів або логіки. +Logic :: + +include::registry-develop:bp-modeling/forms/components/general/common-descriptions/logic/index.adoc[] + Table :: * *`Table View`*: визначає, чи відображувати елемент в таблиці та в *EditGrid*. * *`Table column width`*: дозволяє налаштовувати ширину стовпця у таблиці, яка відображається під час використання компонента *Select* в EditGrid. -* *`Sort As Number`*: визначає, чи сортурувати значення як строку або як число при використані *Select* в EditGrid. +* *`Sort As Number`*: визначає, чи сортувати значення як строку або як число при використанні *Select* в EditGrid. ==== diff --git a/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/text-area.adoc b/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/text-area.adoc index ec65415027..bd692a7830 100644 --- a/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/text-area.adoc +++ b/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/text-area.adoc @@ -52,6 +52,9 @@ include::general/common-descriptions/api/index.adoc[] Conditions :: include::general/common-descriptions/conditional/index.adoc[] +Logic :: +include::general/common-descriptions/logic/index.adoc[] + Table :: include::general/common-descriptions/table/index.adoc[] diff --git a/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/text-field.adoc b/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/text-field.adoc index d6162333c3..c29c15c847 100644 --- a/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/text-field.adoc +++ b/docs/ua/modules/registry-develop/pages/bp-modeling/forms/components/text-field.adoc @@ -57,6 +57,9 @@ include::general/common-descriptions/api/index.adoc[] Conditions :: include::general/common-descriptions/conditional/index.adoc[] +Logic :: +include::general/common-descriptions/logic/index.adoc[] + Table :: include::general/common-descriptions/table/index.adoc[] diff --git a/docs/ua/modules/registry-develop/pages/bp-modeling/forms/registry-admin-modelling-forms.adoc b/docs/ua/modules/registry-develop/pages/bp-modeling/forms/registry-admin-modelling-forms.adoc index 862076609b..1af1256433 100644 --- a/docs/ua/modules/registry-develop/pages/bp-modeling/forms/registry-admin-modelling-forms.adoc +++ b/docs/ua/modules/registry-develop/pages/bp-modeling/forms/registry-admin-modelling-forms.adoc @@ -42,7 +42,7 @@ image:registry-develop:bp-modeling/forms/admin-portal-form-modeling-step-1.png[] + [TIP] ==== -Див. детальніше про версії регламенту на сторінці xref:registry-admin/admin-portal/version-control/create-new-change-request.adoc[]. +Див. детальніше про версії регламенту на сторінці xref:registry-admin/admin-portal/version-control/candidate/create-new-change-request.adoc[]. ==== + Альтернативно, на власний розсуд, ви можете вносити зміни до UI-форм безпосередньо у майстер-версії. Це може бути корисно, наприклад, коли необхідно внести якісь швидкі зміни тощо. @@ -114,6 +114,7 @@ image:registry-develop:bp-modeling/forms/admin-portal-form-modeling-step-12.png[ + image:registry-develop:bp-modeling/forms/admin-portal-form-modelling-step-13.png[] +[#form-sign-task] === Створення форми для підписання даних КЕП //// @@ -213,7 +214,7 @@ NOTE: Якщо ви вносили зміни до форм одразу в ма [TIP] ==== -Детальніше про застосування змін до майстер-версії регламенту див. на сторінці xref:registry-admin/admin-portal/version-control/overview-new-change-request.adoc[]. +Детальніше про застосування змін до майстер-версії регламенту див. на сторінці xref:registry-admin/admin-portal/version-control/candidate/overview-new-change-request.adoc[]. ==== NOTE: Якщо ви працюєте над розробкою регламенту як просунутий користувач, використовуєте локальне git-середовище, інструменти Gerrit та Jenkins для публікації та розгортання змін, тоді рекомендуємо переглянути інструкцію xref:registry-admin/regulations-deploy/registry-admin-deploy-regulation.adoc[]. diff --git a/docs/ua/modules/registry-develop/pages/bp-modeling/index.adoc b/docs/ua/modules/registry-develop/pages/bp-modeling/index.adoc index 2d0c0ea1b3..cc28b107e8 100644 --- a/docs/ua/modules/registry-develop/pages/bp-modeling/index.adoc +++ b/docs/ua/modules/registry-develop/pages/bp-modeling/index.adoc @@ -1 +1,18 @@ -= Моделювальникам бізнес-процесів \ No newline at end of file += Моделювальникам бізнес-процесів + +:sectanchors: +:sectlinks: + +*_Моделювальники бізнес-процесів_* створюють ядро Платформи Реєстрів -- *бізнес-процеси (БП)*, які є фундаментом для всіх послуг. + +Використовуючи такі інструменти, як *Адміністративний портал*, Camunda Modeler, а також BPMN та DMN стандарти, моделювальники БП створюють процеси, UI-форми та інтеграції. Складні моделі часто включають Groovy-скрипти, JUEL функції та JSON структури. Моделювальники та розробники використовують REST і SOAP конектори для налаштування зв'язків із зовнішніми системами, або іншими Реєстрами на Платформі. + +Більше детальну інформацію по моделюванню бізнес-процесів можна знайти на сторінках розділу. + +== Section Overview + +* [*] xref:bp-modeling/bp/index.adoc[] +* [*] xref:bp-modeling/bp/bpmn/index.adoc[] +* [*] xref:bp-modeling/forms/bp-modeling-forms-general-description.adoc[] +* [*] xref:bp-modeling/bp/rest-connector.adoc[] +* [*] xref:bp-modeling/external-integration/api-call/connectors-external-registry.adoc[] \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/pages/data-modeling/data/physical-model/liquibase-ddm-ext.adoc b/docs/ua/modules/registry-develop/pages/data-modeling/data/physical-model/liquibase-ddm-ext.adoc index a37677134a..9b662cc3cf 100644 --- a/docs/ua/modules/registry-develop/pages/data-modeling/data/physical-model/liquibase-ddm-ext.adoc +++ b/docs/ua/modules/registry-develop/pages/data-modeling/data/physical-model/liquibase-ddm-ext.adoc @@ -1,9 +1,10 @@ = Розширення Liquibase для моделювання даних -:page-layout: swagger include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] +:page-layout: swagger + WARNING: Для опису моделі даних реєстру використовуйте кодування `*UTF-8*`. == Загальний опис @@ -308,7 +309,7 @@ Liquibase обробляє XML-модель та створює таблиці- + [source,http] ---- -https://-/search-condition-test?offset=0&limit=10. +https://api.example.com/search-condition-test?offset=0&limit=10. ---- [#createSimpleSearchCondition] @@ -396,7 +397,7 @@ columnName="type" operator="eq" value="'text'"/> * Перший тег ``, як і всі інші, в умові `` повинен містити атрибут `logicOperator`. -* Атрибут `logicOperator` приймає значення _and_ і _or_. +* Атрибут `logicOperator` приймає значення `and` і `or`. * Якщо тег `` вкладений в інший, то вони обгортаються дужками. ==== @@ -438,159 +439,15 @@ columnName="type" operator="eq" value="'text'"/> ==== Атрибути критеріїв пошуку та доступні значення [search-type-attribute-values] +[#search-type-attribute-values] ===== Атрибут searchType та доступні значення Атрибут `*searchType*` в елементі `**` вказує на тип операції, яку необхідно виконати для певної колонки при пошуку в таблиці. -_Атрибут приймає наступні значення:_ - -`*equal*`:: - -повертає значення, що мають точну відповідність (дорівнюють) заданим. -+ -.XML-схема -==== -[source, xml] ----- - - - - - - - ----- -==== - -`*startsWith*`:: - -повертає значення зі вказаним префіксом, тобто значення, які "починаються із" заданої умови. -+ -._Приклад XML-схеми_ -==== -[source, xml] ----- - - - - - - - - ----- -==== - -`*contains*`:: - -повертає значення, які мають збіги із вказаним значенням умови у будь-якому місці рядка (на початку, в середині, в кінці тощо). -+ -.XML-схема -==== -[source, xml] ----- - - - - - - - ----- -==== - -`*in*`:: - -повертає значення, що мають точну відповідність (дорівнюють) заданим значенням у масиві. Подібний до `equal`, але множинний. -+ -.XML-схема -==== -[source, xml] ----- - - - - - - - ----- -==== -+ -.HTTP-запит із використанням оператора in -==== -[source,http] ----- -https://..../findInAge?age=18,21,42 ----- -==== - -`*notIn*`:: - -повертає значення, що не мають відповідність (не дорівнюють) заданим значенням у масиві. Він є протилежним до значення `in` атрибута `searchType`. -+ -.XML-схема -==== -[source, xml] ----- - - - - - - - ----- -==== -+ -.HTTP-запит із використанням оператора notIn -==== -[source,http] ----- -https://..../findNotInAge?age=18,21,42 ----- -==== - -`*between*` :: - -повертає значення, що мають приналежність до заданого діапазону значень (в межах "з"-"до"). -+ -.XML-схема -==== -[source, xml] ----- - - - - - - - ----- -==== -+ -.HTTP-запит із використанням оператора between -==== -[source,http] ----- -https://..../findBetweenAge?ageFrom=18&ageTo=42 ----- -==== - - -//// -[options="header"] -|======================================================================= -|Значення| Опис -|`equal`|Повертає значення, що мають точну відповідність (дорівнюють) заданим -|`startsWith`|Повертає значення із вказаним префіксом, тобто значення, які "починаються із" заданої умови -|`contains`|Повертає значення, які мають збіги із вказаним значенням умови у будь-якому місці рядка (на початку, в середині, в кінці тощо) -|`in`|Повертає значення, що мають точну відповідність (дорівнюють) заданим значенням у масиві, майже те ж саме, що і "equal", але множинний -|`between`|Повертає значення, що мають приналежність до заданого діапазону значень (в межах "з"-"по") -|======================================================================= -//// +TIP: Детальну інформацію дивіться на сторінці xref:data-modeling/data/physical-model/sc/attributes/search-type/search-type-attribute.adoc[]. [limit-attribute-values] +[#limit-attribute-values] ===== Атрибут limit та доступні значення Атрибут `*limit*` визначає максимальну кількість результатів (рядків), які повертаються до API за пошуковою умовою. @@ -651,6 +508,7 @@ NOTE: Можна не вказувати цей атрибут взагалі, [returning-attribute-values] +[#returning-attribute-values] ===== Атрибут returning та доступні значення Атрибут `*returning*` вказує, чи повинно значення повертатися у відповіді до API. @@ -874,7 +732,8 @@ NOTE: За замовчуванням пагінація увімкнена і Операцію `**` можна використовувати із додатковими умовами `*and*` та `*or*`, які визначаються в рамках тегу `**` як значення атрибута `*logicOperator*`. -.Використання inner join в рамках критерію пошуку +._Використання *inner join* в рамках критерію пошуку_ +[%collapsible] ==== [source,xml] ---- @@ -900,7 +759,8 @@ NOTE: За замовчуванням пагінація увімкнена і ---- ==== -.Використання inner join з умовою AND в рамках критерію пошуку +._Використання *inner join* з умовою *AND* в рамках критерію пошуку_ +[%collapsible] ==== [source,xml] ---- @@ -927,7 +787,8 @@ NOTE: За замовчуванням пагінація увімкнена і ---- ==== -.Використання inner join з умовою OR в рамках критерію пошуку +._Використання *inner join* з умовою *OR* в рамках критерію пошуку_ +[%collapsible] ==== [source,xml] ---- @@ -959,7 +820,7 @@ NOTE: За замовчуванням пагінація увімкнена і [TIP] ==== -Більше про використання JOIN та додаткові умови дивіться на сторінці xref:data-modeling/data/physical-model/join-and-or-usage.adoc[]. +Більше про використання JOIN та додаткові умови дивіться на сторінці xref:data-modeling/data/physical-model/sc/operators/logical/join-and-or-usage.adoc[]. ==== [#dropSearchCondition] @@ -968,7 +829,7 @@ NOTE: За замовчуванням пагінація увімкнена і Назва change type: `` :: Цей тег надає можливість видалити критерій пошуку. - ++ ._Приклад XML-схеми_ [%collapsible] ==== @@ -984,27 +845,44 @@ NOTE: За замовчуванням пагінація увімкнена і ==== [#exposeSearchCondition] -=== Тег визначення точок інтеграції з іншими реєстрами, зовнішніми системами та ШБО "Трембіта" +=== Тег налаштування доступу до API реєстру -Назва change type: `` :: +*``* -- це тег, що дозволяє зробити ваш реєстр доступним для інтеграції з боку інших реєстрів, зовнішніх систем та ШБО "Трембіта". -Цей тег надає можливість визначити точки інтеграції з іншими реєстрами, зовнішніми системами та ШБО "Trembita". +==== Основні атрибути -._Приклад XML-схеми_ -[%collapsible] -==== +Тег приймає наступні атрибути: :: ++ +.Атрибути тегу +[%header,cols="3*"] +|=== +| Атрибут | Призначення | Значення за замовчуванням + +| `name` | Назва критерію пошуку | Не вказано +| `platform` | Надає доступ до представлень та REST API реєстру для іншого реєстру на Платформі | `false` +| `externalSystem` | Надає доступ до представлень та REST API реєстру для зовнішньої системи | `false` +| `trembita` | Надає доступ до представлень реєстру для сервісів-учасників СЕВ ДЕІР через інтерфейс ШБО "Трембіта" за протоколом SOAP | `false` +| `publicAccess` | Визначає, чи має бути публічний доступ до пошукового критерію/представлення | `false` +|=== + +==== Приклади + +._Приклад XML-схеми з атрибутами platform, externalSystem та trembita_ [source, XML] ---- - + +---- + +._Приклад XML-схеми з атрибутом publicAccess_ +[source,xml] +---- + ---- -==== -Тег приймає 4 атрибути: :: +==== Рекомендації -* `name` -- назва критерію пошуку (search condition); -* *`platform`* -- для надання доступу до представлень та REST API реєстру для іншого реєстру на Платформі; -* *`externalSystem`* -- для надання доступу до представлень та REST API реєстру для зовнішньої системи; -* *`trembita`* -- Надання доступу до представлень реєстру для сервісів-учасників СЕВ ДЕІР через інтерфейс ШБО "Трембіта" за протоколом SOAP. +* Усі атрибути за замовчуванням мають значення `false`. Врахуйте це, коли працюєте з тегом ``. +* Переконайтеся, що атрибут `name` завжди вказаний, оскільки він є обов'язковим для ідентифікації критерію пошуку. == Керування користувацькими типами даних @@ -1241,8 +1119,6 @@ TIP: За детальною інформацією щодо створення [#manage-access-to-analytical-data] == Керування правами доступу до аналітичних даних -TIP: За детальною інформацією щодо прав доступу до аналітичних даних зверніться до розділу xref:registry-develop:data-modeling/reports/data-analytical-data-access-rights.adoc[Права доступу до аналітичних даних] відповідного документа. - === Тег надання доступу до всіх аналітичних представлень [#grantAll] @@ -1323,6 +1199,7 @@ TIP: За детальною інформацією щодо прав досту ---- ==== +[#nested-structures] == Використання вкладених структур в таблицях БД реєстру за вказаним параметром === Тег використання вкладених структур diff --git a/docs/ua/modules/registry-develop/pages/data-modeling/data/physical-model/liquibase-introduction.adoc b/docs/ua/modules/registry-develop/pages/data-modeling/data/physical-model/liquibase-introduction.adoc index 96ade0279a..71a34abe3f 100644 --- a/docs/ua/modules/registry-develop/pages/data-modeling/data/physical-model/liquibase-introduction.adoc +++ b/docs/ua/modules/registry-develop/pages/data-modeling/data/physical-model/liquibase-introduction.adoc @@ -1,10 +1,7 @@ = Інструмент створення та керування фізичною моделлю даних Liquibase -:toc: -:toc-title: ЗМІСТ -:toclevels: 5 -:sectnums: -:sectnumlevels: 5 -:sectanchors: +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Вступ @@ -20,11 +17,11 @@ Liquibase за замовчуванням підтримує функціона NOTE: З метою безпеки, БД-розробники або інші категорії користувачів не мають прямого доступу до даних, тобто вони не зможуть виконати SQL-запит до PostgreSQL напряму. -Liquibase має набір впроваджених розширень, які: +Liquibase має набір впроваджених розширень, які: :: -1) розширюють функціональність стандартного додатка Liquibase зовнішнім модулем xref:registry-develop:data-modeling/data/physical-model/liquibase-ddm-ext.adoc[Liquibase DDM Extension]. +* Розширюють функціональність стандартного додатка Liquibase зовнішнім модулем xref:registry-develop:data-modeling/data/physical-model/liquibase-ddm-ext.adoc[Liquibase DDM Extension]. -2) розширюють систему керування змінами моделі даних Liquibase: xref:registry-develop:data-modeling/data/physical-model/liquibase-changes-management-sys-ext.adoc[Створення сценаріїв побудови фізичної моделі даних реєстру за допомогою функціональних розширень Liquibase]. +* Розширюють систему керування змінами моделі даних Liquibase: xref:registry-develop:data-modeling/data/physical-model/liquibase-changes-management-sys-ext.adoc[Створення сценаріїв побудови фізичної моделі даних реєстру за допомогою функціональних розширень Liquibase]. :sectnums: @@ -38,21 +35,39 @@ Liquibase має набір впроваджених розширень, які: ==== Локальний запуск Liquibase та розширень із командного рядка -Для того, аби запрацюв Liquibase та його розширення, необхідно запустити й сам Liquibase, і також підкласти файл з розширеннями в командному рядку. - -TIP: Приклад локального запуску Liquibase та розширень із командного рядка для ОС Windows: +Для того, аби запрацювали Liquibase та його розширення, необхідно запустити й сам Liquibase, і також підкласти файл з розширеннями в командному рядку. +.Локальний запуск Liquibase та розширень із командного рядка для різних середовищ +[tabs] +==== +Windows:: ++ +-- [source, shell script] ---- Java -jar liquibase.jar --driver=org.postgresql.Driver --classpath=postgresql-{version}.jar;liquibase-ddm-ext-{version}.jar --changeLogFile=changeLog.xml --url="jdbc:postgresql://{server_ip}:{server_port}/{db_name}" --username={username} --password={password} --labels="!citus" update -Dbname={db_name} ---- +-- -TIP: Приклад локального запуску Liquibase та розширень із командного рядка для ОС Linux: +Linux:: ++ +-- +[source, bash] +---- +Java -jar liquibase.jar --driver=org.postgresql.Driver --classpath=postgresql-{version}.jar:liquibase-ddm-ext-{version}.jar --changeLogFile=changeLog.xml --url="jdbc:postgresql://{server_ip}:{server_port}/{db_name}" --username={username} --password={password} --labels="!citus" update -Dbname={db_name} +---- +-- +macOS:: ++ +-- [source, bash] ---- Java -jar liquibase.jar --driver=org.postgresql.Driver --classpath=postgresql-{version}.jar:liquibase-ddm-ext-{version}.jar --changeLogFile=changeLog.xml --url="jdbc:postgresql://{server_ip}:{server_port}/{db_name}" --username={username} --password={password} --labels="!citus" update -Dbname={db_name} ---- +-- + +==== Оскільки це Java-застосунок, розробник повинен явно вказати наступне: diff --git a/docs/ua/modules/registry-develop/pages/data-modeling/data/physical-model/overview.adoc b/docs/ua/modules/registry-develop/pages/data-modeling/data/physical-model/overview.adoc index 40c9d5a4f5..00a368d538 100644 --- a/docs/ua/modules/registry-develop/pages/data-modeling/data/physical-model/overview.adoc +++ b/docs/ua/modules/registry-develop/pages/data-modeling/data/physical-model/overview.adoc @@ -4,7 +4,5 @@ * xref:registry-develop:data-modeling/data/physical-model/liquibase-introduction.adoc[] * xref:registry-develop:data-modeling/data/physical-model/liquibase-standard-change-types.adoc[] * xref:registry-develop:data-modeling/data/physical-model/liquibase-ddm-ext.adoc[] -* xref:registry-develop:data-modeling/data/physical-model/liquibase-changes-management-sys-ext.adoc[] * xref:registry-develop:data-modeling/data/physical-model/rest-api-view-access-to-registry.adoc[] -* xref:registry-develop:data-modeling/data/physical-model/auto-generate-number.adoc[] -* xref:registry-develop:data-modeling/data/physical-model/join-and-or-usage.adoc[] \ No newline at end of file +* xref:registry-develop:data-modeling/data/physical-model/auto-generate-number.adoc[] \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/pages/data-modeling/data/physical-model/rest-api-view-access-to-registry.adoc b/docs/ua/modules/registry-develop/pages/data-modeling/data/physical-model/rest-api-view-access-to-registry.adoc index de58d8310b..b09924b7cd 100644 --- a/docs/ua/modules/registry-develop/pages/data-modeling/data/physical-model/rest-api-view-access-to-registry.adoc +++ b/docs/ua/modules/registry-develop/pages/data-modeling/data/physical-model/rest-api-view-access-to-registry.adoc @@ -1,23 +1,7 @@ -= Налаштування атрибутів доступу до API-представлень реєстру -//:toc: -:toc-title: ЗМІСТ -:experimental: -:example-caption: Приклад -:important-caption: ВАЖЛИВО -:note-caption: ПРИМІТКА -:tip-caption: ПІДКАЗКА -:warning-caption: ПОПЕРЕДЖЕННЯ -:caution-caption: УВАГА -:example-caption: Приклад -:figure-caption: Figure -:table-caption: Table -:appendix-caption: Appendix -:toclevels: 5 -//:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: += Налаштування доступу до API-представлень реєстру +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Загальний опис @@ -29,30 +13,38 @@ TIP: Опис тегу `` ви можете також переглянути на сторінці xref:data-modeling/data/physical-model/liquibase-ddm-ext.adoc[]. -Тег *``* приймає 1 атрибут для назви критерію пошуку (search condition), а також 3 атрибути для різних сценаріїв використання: +== Основні атрибути + +Тег приймає наступні атрибути: :: ++ +.Атрибути тегу +[%header,cols="3*"] +|=== +| Атрибут | Призначення | Значення за замовчуванням -* Надання доступу до представлень та REST API реєстру для іншого реєстру на Платформі -- для цього використовується атрибут *`platform`*. -* Надання доступу до представлень та REST API реєстру для зовнішньої системи -- для цього використовується атрибут *`externalSystem`*. -* Надання доступу до представлень реєстру для сервісів-учасників СЕВ ДЕІР через інтерфейс ШБО "Трембіта" за протоколом SOAP -- для цього використовується атрибут *`trembita`*. +| `name` | Назва критерію пошуку | Не вказано +| `platform` | Надає доступ до представлень та REST API реєстру для іншого реєстру на Платформі | `false` +| `externalSystem` | Надає доступ до представлень та REST API реєстру для зовнішньої системи | `false` +| `trembita` | Надає доступ до представлень реєстру для сервісів-учасників СЕВ ДЕІР через інтерфейс ШБО "Трембіта" за протоколом SOAP | `false` +| `publicAccess` | Визначає, чи має бути публічний доступ до пошукового критерію/представлення | `false` +|=== -._Приклад XML-схеми використання тегу та його атрибутів у моделі даних_ -==== +== Приклади +._Приклад XML-схеми з атрибутами platform, externalSystem та trembita_ [source, XML] ---- - + ---- -[NOTE] -===== -* `name` -- назва представлення для критерію пошуку (search condition) -* `platform` -- для надання доступу має бути у значенні `"true"` -* `externalSystem` -- для надання доступу має бути у значенні `"true"`. -* `trembita` -- для надання доступу має бути у значенні `"true"` +._Приклад XML-схеми з атрибутом publicAccess_ +[source, XML] +---- + +---- -Якщо необхідно закрити доступ до представлень API реєстру, то відповідні атрибути мають бути у значенні `false`. +== Рекомендації -Поточний приклад конфігурації показує, що доступ до даних реєстру може бути відкритий для іншого реєстру на Платформі, а також для зовнішньої системи. Для сервісів, що отримуватимуть дані через SOAP-інтерфейс ШБО "Трембіта", доступ до даних є закритим. -===== -==== +* Усі атрибути за замовчуванням мають значення `false`. Врахуйте це, коли працюєте з тегом ``. +* Переконайтеся, що атрибут `name` завжди вказаний, оскільки він є обов'язковим для ідентифікації критерію пошуку. diff --git a/docs/ua/modules/registry-develop/pages/data-modeling/data/physical-model/sc/attributes/search-type/search-type-attribute.adoc b/docs/ua/modules/registry-develop/pages/data-modeling/data/physical-model/sc/attributes/search-type/search-type-attribute.adoc new file mode 100644 index 0000000000..e7c975194b --- /dev/null +++ b/docs/ua/modules/registry-develop/pages/data-modeling/data/physical-model/sc/attributes/search-type/search-type-attribute.adoc @@ -0,0 +1,788 @@ += Атрибут _searchType_ +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +Атрибут `*searchType*` в елементі `**` вказує на тип операції, яку необхідно виконати для певної колонки при пошуку в таблиці. + +_Атрибут приймає наступні значення:_ + +* `equal` +* `startsWith` +* `contains` +* `in` +* `notIn` +* `between` + +[#equal] +== `equal` +`equal` (рівність) повертає значення, що мають точну відповідність (дорівнюють) заданим. + +.XML-схема +[source, xml] +---- + + + + + + + +---- + +.Опис таблиці `table_one` +-- +* `name` -- назва поля +* `type` -- тип поля +* `uuid` -- унікальний ідентифікатор +-- + +[NOTE] +==== +[%collapsible] +.Для чого потрібна функція `count`? +===== +Елемент `` в XML-схемі не виконує функцію пошуку чи фільтрації даних. + +Функція `count` в SQL використовується для підрахунку кількості рядків у вибірці, яку ви отримуєте із запита. У нашому прикладі ``, функція `count` функція `count` підраховує кількість записів у стовпці `uuid` і повертає це число під псевдонімом `cnt`. + +Ось як вона працює: + +* `name="count"` вказує на те, що ви використовуєте функцію `count`. +* `alias="cnt"` вказує псевдонім для результату обчислення, який можна буде використовувати для подальших посилань на цей результат. +* `columnName="uuid"` вказує стовпець, у якому ви хочете підрахувати кількість записів. + +Наприклад, якщо у стовпці `uuid` має бути 10 записів, то результатом цієї функції буде число 10, яке можна використовувати в подальших операціях чи виводити як результат запита. +===== +==== + +.SQL-скрипт (_пошуковий запит_) +[source,sql] +---- +SELECT name, type FROM table_one +WHERE name = 'значення_пошуку' +-- Пошук за точною відповідністю у полі "name" таблиці "table_one". +---- + + +.HTTP-запит із параметром пошуку для операції `equal` +[source,bash] +---- +GET https://.../search-condition?name=значення_пошуку&type=... +---- + +Цей HTTP-запит виконує пошук у ресурсі `https://.../search-condition` за точною відповідністю назви (поля `name`) та типу (поля `type`) заданим значенням. Кожен параметр пошуку вказується як окремий параметр запита, що робить його більш інформативним та зрозумілим. + + +.HTTP-запит із референтними значеннями +[source,bash] +---- +GET https://api.example.com/search-condition?name=John&type=Employee +---- + +У цьому прикладі: + +* `https://api.example.com/search-condition` -- базовий URL та ресурсу та ендпоінт, де виконується пошук. +* `name=John` -- параметр пошуку за назвою, де шукається значення `John` у полі `name`. +* `type=Employee` -- параметр пошуку за типом, де шукається значення `Employee` у полі `type`. + +== `startsWith` + +`*startsWith*` повертає значення зі вказаним префіксом, тобто значення, які "починаються із" заданої умови. + +._XML-схема_ +[source, xml] +---- + + + + + + + + +---- + +.Опис таблиці `consent_table` +-- +* `consent_id` -- ідентифікатор згоди, який забезпечує зв'язок з іншою таблицею (_тип вибірки:_ `entity`). ++ +TIP: Детальніше про атрибут `fetchType` та сценарії його застосування див. у розділі xref:registry-develop:data-modeling/data/physical-model/liquibase-ddm-ext.adoc#nested-structures[Використання вкладених структур в таблицях БД реєстру за вказаним параметром]. +* `document_copy` -- сканована копія документа. +* `legal_entity_name` -- назва юридичної особи, яка може бути використана для пошуку за типом "починається з". +* `subject_id` -- ідентифікатор суб'єкта. +-- + + +.SQL-скрипт (_пошуковий запит_) +[source,sql] +---- +SELECT legal_entity_name FROM consent_table +WHERE legal_entity_name LIKE 'значення_пошуку%' +ORDER BY legal_entity_name ASC; +---- + +-- +У цьому запиті: + +* Вибрано назви юридичних осіб (`legal_entity_name`) з таблиці `consent_table`. +* Пошук виконується за принципом "починається з" для значення `'значення_пошуку'`. +* Результати відсортовано за назвою юридичної особи в алфавітному порядку (за зростанням). +-- + +.HTTP-запит із параметром пошуку для операції `startsWith` +[source,bash] +---- +GET https://.../subject-name-starts-with?legalEntityName=значення_пошуку +---- + +Цей HTTP-запит використовує метод GET для запиту до сервера з метою отримання результатів, які відповідають критерію пошуку "починається з" для поля `legal_entity_name`. + + +.HTTP-запит із референтними значеннями +[source,bash] +---- +GET https://api.example.com/subject-name-starts-with?legalEntityName=Corp +---- + +У цьому прикладі: + +* `https://api.example.com/subject-name-starts-with` -- це базовий URL ресурсу, де відбувається пошук. +* `legalEntityName=Corp` -- параметр запита, який вказує на пошук юридичних осіб, чиї назви починаються з `Corp`. + +== `contains` + +`*contains*` повертає значення, які мають збіги із вказаним значенням умови у будь-якому місці рядка (на початку, в середині, в кінці тощо). ++ +.XML-схема +[source, xml] +---- + + + + + + + +---- + +TIP: Детальніше про атрибут ліміт ви можете дізнатися у секції xref:registry-develop:data-modeling/data/physical-model/liquibase-ddm-ext.adoc#limit-attribute-values[Атрибут _limit_]. + +.Опис таблиці `table_two` +-- +* `name` (alias `tt_name`) -- назва елементу. +* `code` -- код елемента, який може бути використаний для пошуку за типом "містить". +* `sum` -- функція, яка підраховує суму значень у стовпці `code` і повертає це число під псевдонімом `sm`. + +[NOTE] +==== +[%collapsible] +.Для чого потрібна функція `sum`? +===== +Елемент `` в XML-схемі не виконує функцію пошуку чи фільтрації даних. + +Функція `sum` в SQL використовується для підрахунку загальної суми значень у вказаному стовпці вибірці. У нашому прикладі ``, функція `sum` підраховує загальну суму значень у стовпці `code` і повертає цю суму під псевдонімом `sm`. + +Ось як вона працює: + +* `name="sum"` вказує на те, що ви використовуєте функцію `sum`. +* `alias="sm"` вказує псевдонім для результату обчислення, який можна буде використовувати для подальших посилань на цей результат. +* `columnName="code"` вказує стовпець, у якому ви хочете підрахувати загальну суму значень. + +Наприклад, якщо у стовпці `code` є записи зі значеннями 10, 20 та 30, то результатом цієї функції буде число 60, яке можна використовувати в подальших операціях чи виводити як результат запита. +===== +==== +-- + +.SQL-скрипт (_пошуковий запит_) +[source,sql] +---- +SELECT name, code FROM table_two +WHERE code LIKE '%значення_пошуку%' +---- + +-- +У цьому запиті: + +* Вибрано назви (`name`) та коди (`code`) з таблиці `table_two`. +* Пошук виконується за типом "містить" для значення `'значення_пошуку'`, що може знаходитися в будь-якому місці рядка. +-- + +.HTTP-запит із параметром пошуку для операції `contains` +[source,bash] +---- +GET https://.../search-condition?code=значення_пошуку +---- + +Цей HTTP-запит використовує метод GET для запита до сервера з метою отримання результатів, які відповідають критерію пошуку "містить" для поля `code`. + +.HTTP-запит із референтними значеннями +[source,bash] +---- +GET https://api.example.com/search-condition?code=1234AB +---- + +У цьому прикладі: + +* `https://api.example.com/search-condition` -- це базовий URL ресурсу та ендпоінт, де відбувається пошук. +* `code=1234AB` -- параметр запита, який вказує на пошук кодів, які містять `1234AB`. + +[#in-not-in] +== `in` | `notIn` + +Оператор `*in*` повертає значення, що мають точну відповідність (дорівнюють) заданим значенням у масиві. Подібний до `equal`, але множинний. + +Оператор `*notIn*` повертає значення, що _НЕ_ дорівнюють жодному із заданих значень у масиві. Він є протилежним до значення `in` атрибута `searchType`. + +=== Проблематика + +У контексті обробки `GET`-запитів може виникати проблема, яка полягає в некоректній обробці параметрів, особливо при використанні типів пошуку `in` та `notIn`. Ця проблема впливає не лише на поточну реалізацію, але й може виникати в інших сценаріях використання `GET`-метода. + +Основна причина криється в обмеженнях, що існують у способі обробки параметрів у `GET`-запитах. Зокрема, коли значення параметрів містять спецсимволи або використовуються як роздільники, це може призвести до втрати важливої інформації або до некоректної інтерпретації даних запита. + +==== Випадки використання + +Ця секція надає детальний опис різних сценаріїв, які були виявлені під час тестування, і як кожен з них впливає на обробку запитів. + +.Сценарій 1 +==== +* Запит: `GET /findXXXInYYY?yyy=1,2,3` +* Результат: `List.of("1", "2", "3")` +* Проблема: Коли значення передається через кому, воно розглядається як множина окремих елементів. +==== + +.Сценарій 2 +==== +* Запит: `GET /findXXXInYYY?yyy=1&yyy=2&yyy=3` +* Результат: `List.of("1", "2", "3")` +* Проблема: Не виникає, оскільки кожен параметр обробляється окремо. +==== + +.Сценарій 3 +==== +* Запит: `GET /findXXXInYYY?yyy=1,2&yyy=2,3&yyy=4,5` +* Результат: `List.of("1,2", "2,3", "4,5")` +* Проблема: Кома в цьому випадку не розглядається як роздільник, а входить до складу значення. +==== + +==== Рішення та рекомендації + +Платформа підтримує вдосконалений механізм обробки запитів. Тепер система генерує два типи ендпоінтів на кожний створений критерій пошуку: + +* `GET` +* `POST` + +{empty} + +.Випадки використання методів `GET` та `POST` +[cols="3,1,5", options="header"] +|=== +| Сценарій | Метод | Рекомендації + +.2+| Виклик API зовнішніми системами +| `POST` +| Використовуйте для складних пошукових умов, зокрема у випадках з `in`/`notIn` тощо. +| `GET` +| Використовуйте для простих пошукових умов. + +.2+| Виклик публічних API реєстру +| `POST` +| Використовуйте для складних пошукових умов, зокрема у випадках з `in`/`notIn` тощо. +| `GET` +| Використовуйте для простих пошукових умов. + +| Виклик Фабрики даних із делегатів бізнес-процесу +| `POST` +| Використовуються _за замовчуванням_. На цю поведінку вплинути неможливо. + +| Виклик Фабрики даних із форм бізнес-процесу +| `GET` +| Використовуються _за замовчуванням_. На цю поведінку вплинути неможливо. +|=== + + +=== Приклади запитів + +==== Сценарій 1: простий пошук за віком + +.XML-схема +==== +[source, xml] +---- + + + + + + + +---- +==== + +Ця XML-схема визначає структуру пошукової умови для таблиці `users`, де поля `first_name`, `last_name` та `user_age` використовуються для визначення результатів пошуку. + +.Опис таблиці `users` +[cols="2,5", options="header"] +|=== +| Стовпець | Опис + +| `first_name` +| Ім'я користувача, яке повертається як результат. + +| `last_name` +| Прізвище користувача, яке також повертається як результат. + +| `user_age` +| Вік користувача, який може бути використаний для множинного пошуку за допомогою оператора `in`. +|=== + +TIP: Детальніше про атрибут `returning` ви можете дізнатися у секції xref:registry-develop:data-modeling/data/physical-model/liquibase-ddm-ext.adoc#returning-attribute-values[Атрибут _returning_]. +-- + +.SQL-скрипт (_пошуковий запит_) +==== +[source,sql] +---- +SELECT first_name, last_name FROM users +WHERE user_age IN (25, 30, 35) +---- +==== + +Цей SQL-скрипт демонструє, як виконується пошук за віком в базі даних. + +-- +У цьому запиті: :: + +* Вибрані імена (`first_name`) та прізвища (`last_name`) користувачів з таблиці `users`. +* Пошук виконується за віком (`user_age`), який повинен бути одним зі значень, вказаних у множині `(25, 30, 35)`. +-- + +.HTTP GET-запит із використанням оператора `in` +[tabs] +==== + +HTTP:: ++ +[source,http] +---- +GET /simple-age-search?userAge=25,30,35 HTTP/1.1 +Host: api.example.com +---- ++ +Цей HTTP-запит використовує метод `GET` для запита до сервера з метою отримання результатів, які відповідають критерію пошуку "знаходяться у списку" для поля `user_age`. ++ +У цьому HTTP-запиті: + +* `GET` -- метод запита, використаний для отримання даних. +* `/simple-age-search?userAge=25,30,35` -- шлях до ресурсу на сервері, включаючи параметр запита `userAge` зі значеннями `25, 30, 35`, який вказує на пошук користувачів з віком 25, 30 або 35 років. +* `HTTP/1.1` -- версія протоколу HTTP. +* `Host: api.example.com` -- заголовок, що вказує хост або домен, де знаходиться ресурс. + +cURL:: ++ +[source,curl] +---- +curl -X GET "https://api.example.com/simple-age-search?userAge=25,30,35" +---- ++ +Ця команда використовує *cURL*, утиліту командного рядка для відправки HTTP-запитів, з методом `GET` для запита даних із сервера. Вона запитує інформацію за вказаним URL, де `userAge=25,30,35` визначає параметри запита. ++ +У цьому HTTP-запиті: + +* `GET` -- метод запита, використаний для отримання даних. +* `https://api.example.com` -- це базовий URL ресурсу, де відбувається пошук. +* `/simple-age-search` -- шлях до ресурсу на сервері (ендпоінт). +* `?userAge=25,30,35` -- параметр запита `userAge` зі значеннями `25, 30, 35`, який вказує на пошук користувачів за віком 25, 30 або 35 років. +==== + + +.HTTP POST-запит із використанням оператора `in` +[tabs] +==== + +HTTP:: ++ +[source,http] +---- +POST /simple-age-search HTTP/1.1 +Host: api.example.com +Content-Type: application/json + +{ + "userAge": [25, 30, 35] +} +---- ++ +Цей HTTP-запит використовує метод `POST` для відправки даних до сервера з метою отримання результатів, які відповідають критерію пошуку "знаходяться у списку" для поля `user_age`. ++ +У цьому HTTP запиті: + +* `POST` -- метод запита, використаний для відправки даних на сервер. +* `/simple-age-search` -- шлях до ресурсу на сервері (ендпоінт). +* `HTTP/1.1` -- версія протоколу HTTP. +* `Host: api.example.com` -- заголовок, що вказує домен, де знаходиться ресурс. +* `Content-Type: application/json` -- заголовок, що вказує на тип контенту, який передається у тілі запита. +* Тіло запита містить JSON-об'єкт із масивом значень: `{"userAge": [25, 30, 35]}`. Параметри вказують на пошук користувачів з віком 25, 30 або 35 років. Такий формат дозволяє точніше визначити умови пошуку та уникнути проблем з інтерпретацією складних параметрів, на відміну від методу `GET`. + +cURL:: ++ +[source,curl] +---- +curl -X POST "https://api.example.com/simple-age-search" \ + -H "Content-Type: application/json" \ + -d '{"userAge": [25, 30, 35]}' +---- ++ +Ця команда використовує *cURL*, утиліту командного рядка для відправки HTTP-запитів, з методом `POST` для запита даних із сервера. ++ +У цій cURL-команді: + +* `-X POST` вказує на використання метода `POST`. +* `https://api.example.com` -- це базовий URL ресурсу, де відбувається пошук. +* `/simple-age-search"` -- шлях до ресурсу на сервері (ендпоінт). +* `-H "Content-Type: application/json"` додає заголовок, який вказує, що тіло запиту містить JSON. +* `-d '{"userAge": [25, 30, 35]}'` встановлює дані, які будуть відправлені у тілі запита. У цьому випадку -- це JSON-об'єкт із масивом значень для `userAge`, що вказує на пошук користувачів з віком 25, 30 або 35 років. +==== +-- + +==== Сценарій 2: складніший пошук + +.XML-схема +==== +[source, xml] +---- + + + + + + + + + +---- +==== + +.Опис таблиці `users` +[cols="2,5", options="header"] +|=== +| Стовпець | Опис + +| `first_name` +| Ім'я користувача, яке повертається як результат. + +| `last_name` +| Прізвище користувача, яке також повертається як результат. + +| `user_age` +| Вік користувача, який може бути використаний для множинного пошуку за допомогою оператора `in`. + +| `location` +| Місцеперебування користувача, яке використовується для точного пошуку. + +| `is_active` +| Статус активності користувача, який використовується для точного пошуку. +|=== + +TIP: Детальніше про атрибут `returning` ви можете дізнатися у секції xref:registry-develop:data-modeling/data/physical-model/liquibase-ddm-ext.adoc#returning-attribute-values[Атрибут _returning_]. +-- + +.SQL-скрипт (_пошуковий запит_) +==== +[source,sql] +---- +SELECT first_name, last_name FROM users +WHERE user_age IN (25, 30, 35) AND location = 'Kyiv' AND is_active = true +---- +==== + +Ця XML-схема визначає структуру пошукової умови для таблиці users, включаючи поля для віку, місцеперебування та статусу активності. + +-- +У цьому запиті: :: + +* Вибрані імена (`first_name`) та прізвища (`last_name`) користувачів з таблиці `users`. +* Пошук виконується за кількома параметрами: віком (`user_age`), який повинен бути одним зі значень у множині `(25, 30, 35)`, місцеперебування (`location`) та статусом активності (`is_active`). +-- + +.HTTP GET-запит із використанням операторів `in` та `equal` +[tabs] +==== + +HTTP:: ++ +[source,http] +---- +GET /advanced-search?userAge=25,30,35&location=Kyiv&isActive=true HTTP/1.1 +Host: api.example.com +---- ++ +Цей HTTP-запит використовує метод `GET` для запита до сервера з метою отримання результатів, які відповідають критеріям пошуку за декількома умовами: віком (`user_age`), місцеперебуванням (`location`) та статусом активності (`is_active`). ++ +У цьому прикладі: + +* `GET` -- метод запита, використаний для отримання даних. +* `/advanced-search` -- шлях до ресурсу на сервері (ендпоінт). +* `?userAge=25,30,35&location=Kyiv&isActive=true` -- параметри запита, розділені амперсандом (`&`). +* `HTTP/1.1` -- версія протоколу HTTP. +* `Host: api.example.com` -- заголовок, що вказує домен, де знаходиться ресурс. + +cURL:: ++ +[source,curl] +---- +curl -X GET "https://api.example.com/advanced-search?userAge=25,30,35&location=Kyiv&isActive=true" +---- ++ +Ця команда *cURL* використовує `-X GET` для вказівки на метод запита `GET` і включає повний URL з параметрами запита. ++ +У цій cURL-команді: + +* `-X GET` вказує на використання метода `GET`. +* `api.example.com` -- це базовий URL ресурсу, де відбувається пошук. +* `/advanced-search` -- шлях до ресурсу на сервері (ендпоінт). +* `?userAge=25,30,35&location=Kyiv&isActive=true` -- параметри запита, розділені амперсандом (`&`). +==== + +.HTTP POST-запит із використанням операторів `in` та `equal` +[tabs] +==== + +HTTP:: ++ +[source,http] +---- +POST /advanced-search HTTP/1.1 +Host: api.example.com +Content-Type: application/json + +{ + "userAge": [25, 30, 35], + "location": "Kyiv", + "isActive": true +} +---- ++ +Цей HTTP-запит використовує метод `POST` для відправки даних до сервера з метою отримання результатів, які відповідають критеріям пошуку за декількома умовами: віком (`user_age`), місцеперебуванням (`location`) та статусом активності (`is_active`). ++ +У цьому прикладі: + +* `POST` -- метод запита, використаний для відправки даних на сервер. +* `/advanced-search` -- шлях до ресурсу на сервері (ендпоінт). +* `HTTP/1.1` -- версія протоколу HTTP. +* `Host: api.example.com` -- заголовок, що вказує домен, де знаходиться ресурс. +* `Content-Type: application/json` -- заголовок, що вказує на тип контенту в тілі запита. +* Тіло запита містить JSON-об'єкт із параметрами `userAge`, `location` та `isActive`. + +cURL:: ++ +[source,curl] +---- +curl -X POST "https://api.example.com/advanced-search" \ + -H "Content-Type: application/json" \ + -d '{"userAge": [25, 30, 35], "location": "Kyiv", "isActive": true}' +---- ++ +Ця команда *cURL* використовує `-X POST` для вказівки на метод запита `POST` і включає тіло запита у форматі JSON. ++ +У цій cURL-команді: + +* `-X POST` вказує на використання метода `POST`. +* `https://api.example.com` -- базовий URL ресурсу, де відбувається пошук. +* `-H "Content-Type: application/json"` додає заголовок, що вказує на тип контенту в тілі запита. +* `-d '{"userAge": [25, 30, 35], "location": "Kyiv", "isActive": true}'` встановлює дані, які будуть відправлені у тілі запита. У цьому випадку -- це JSON-об'єкт із масивом значень для `userAge` та додатковими полями `location` та `isActive`. +==== +-- + +==== Сценарій 3: складний пошук із використанням спецсимволів та коми + +.XML-схема +==== +[source, xml] +---- + + + + + + +---- +==== + +.Опис таблиці `users` +[cols="2,5", options="header"] +|=== +| Стовпець | Опис + +| `name` +| Ім'я користувача, яке може містити спецсимволи (наприклад, апостроф) і коми, і повертається як результат. Пошук виконується за методом `in`. + +| `location` +| Місцеперебування користувача, яке використовується для точного пошуку. Пошук виконується за методом `in`. +|=== + +TIP: Цей сценарій показує як обробляються спецсимволи та коми при використанні `in/notIn`. +-- + +.SQL-скрипт (_пошуковий запит_) +==== +[source,sql] +---- +SELECT name, location FROM users +WHERE name IN ('O''Reilly, Jr.', 'Smith, Sr.') AND location IN ('New York, NY', 'Los Angeles, CA') +---- +==== + +-- +У цьому запиті: :: +Вибираються записи, де ім'я (`name`) відповідає значенням із комами та апострофами, а місцеперебування (`location`) включає коми. +-- + +.HTTP POST-запит із використанням оператора `in` для спецсимволів і ком +[tabs] +==== + +HTTP:: ++ +[source,http] +---- +POST /special-chars-in-search HTTP/1.1 +Host: api.example.com +Content-Type: application/json + +{ + "name": ["O'Reilly, Jr.", "Smith, Sr."], + "location": ["New York, NY", "Los Angeles, CA"] +} +---- ++ +Цей HTTP-запит використовує метод `POST` для відправки даних до сервера з метою отримання результатів, які відповідають критерію пошуку `in` зі спецсимволами та комами в полях `name` та `location`. ++ +У цьому прикладі: + +* `POST` -- метод запита, використаний для відправки даних на сервер. +* `/special-chars-in-search` -- шлях до ресурсу на сервері (ендпоінт). +* `HTTP/1.1` -- версія протоколу HTTP. +* `Host: api.example.com` -- заголовок, що вказує домен, де знаходиться ресурс. +* `Content-Type: application/json` -- заголовок, що вказує на тип контенту в тілі запита. +* Тіло запита містить JSON-об'єкт із параметрами `name` та `location`, які включають спецсимволи та коми. + +cURL:: ++ +[source,curl] +---- +curl -X POST "https://api.example.com/special-chars-in-search" \ + -H "Content-Type: application/json" \ + -d '{"name": ["O'Reilly, Jr.", "Smith, Sr."], "location": ["New York, NY", "Los Angeles, CA"]}' +---- ++ +Ця команда *cURL* використовує `-X POST` для вказівки на метод запита `POST` і включає тіло запиту у форматі JSON. ++ +У цій cURL-команді: + +* `-X POST` вказує на використання метода `POST`. +* `https://api.example.com` -- базовий URL ресурсу, де відбувається пошук. +* `-H "Content-Type: application/json"` додає заголовок, що вказує на тип контенту в тілі запита. +* `-d '{"name": ["O'Reilly, Jr.", "Smith, Sr."], "location": ["New York, NY", "Los Angeles, CA"]}'` встановлює дані, які будуть відправлені у тілі запита. У цьому випадку -- це JSON-об'єкт із масивом значень для `name` та `location`. +==== + +WARNING: Для складних випадків обробки, як-от цей, використовуйте `POST`-запити, інакше ви отримаєте некоректний результат. + +[IMPORTANT,caption=приклад невалідного випадку використання GET] +==== +.HTTP GET-запит із використанням оператора `in` для спецсимволів і ком +[tabs] +===== + +HTTP:: ++ +[source,http] +---- +GET /special-chars-in-search?name=O'Reilly,%20Jr.,Smith,%20Sr.&location=New%20York,%20NY,Los%20Angeles,%20CA HTTP/1.1 +Host: api.example.com +---- ++ +Цей HTTP-запит використовує метод `GET` для запита до сервера з метою отримання результатів, які відповідають критерію пошуку `in` зі спецсимволами та комами в полях `name` та `location`. ++ +У цьому прикладі: + +* `GET` -- метод запита, використаний для отримання даних. +* `/special-chars-in-search` -- шлях до ресурсу на сервері (ендпоінт). +* `?name=O'Reilly,%20Jr.,Smith,%20Sr.&location=New%20York,%20NY,Los%20Angeles,%20CA` -- параметри запита, де `%20` використовується для кодування пробілів. +* `HTTP/1.1` -- версія протоколу HTTP. +* `Host: api.example.com` -- заголовок, що вказує домен, де знаходиться ресурс. + +cURL:: ++ +[source,curl] +---- +curl -X GET "https://api.example.com/special-chars-in-search?name=O'Reilly,%20Jr.,Smith,%20Sr.&location=New%20York,%20NY,Los%20Angeles,%20CA" +---- ++ +Ця команда *cURL* використовує `-X GET` для вказівки на метод запита `GET` і включає повний URL з параметрами запита. ++ +У цій cURL-команді: + +* `-X GET` вказує на використання метода `GET`. +* `https://api.example.com` -- базовий URL ресурсу, де відбувається пошук. +* `/special-chars-in-search` -- шлях до ресурсу на сервері (ендпоінт). +* `?name=O'Reilly,%20Jr.,Smith,%20Sr.&location=New%20York,%20NY,Los%20Angeles,%20CA` -- параметри запита з кодуванням пробілів та включенням спецсимволів та ком. +===== +==== +-- + +== `between` + +`*between*` повертає значення, що належать до заданого діапазону значень (включно "від" та "до"). + +.XML-схема +[source, xml] +---- + + + + + + + +---- + +.Опис таблиці `users` +-- +* `first_name` -- ім'я користувача, яке повертається як результат. +* `last_name` -- прізвище користувача, яке також повертається як результат. +* `user_age` -- вік користувача, який може бути використаний для пошуку в межах заданого діапазону (включно) за допомогою оператора `between`. + +TIP: Детальніше про атрибут `returning` ви можете дізнатися у секції xref:registry-develop:data-modeling/data/physical-model/liquibase-ddm-ext.adoc#returning-attribute-values[Атрибут _returning_]. +-- + +.SQL-скрипт (_пошуковий запит_) +[source,sql] +---- +SELECT first_name, last_name FROM users +WHERE user_age BETWEEN значення_від AND значення_до +---- + +-- +У цьому запиті: + +* Вибрані імена (`first_name`) та прізвища (`last_name`) користувачів з таблиці `users`. +* Пошук виконується за віком (`user_age`), який повинен належати діапазону від `значення_від` до `значення_до` (включно). +-- + +.HTTP-запит із використанням оператора `between` +[source,bash] +---- +GET https://.../find-between-age?user_age_from=значення_від&user_age_to=значення_до +---- + +Цей HTTP-запит використовує метод GET для запита до сервера з метою отримання результатів, які відповідають критерію пошуку "між" для поля `user_age`. + +.HTTP-запит із референтними значеннями +[source,bash] +---- +GET https://api.example.com/find-between-age?userAgeFrom=20&userAgeTo=30 +---- + +У цьому прикладі: + +* `https://api.example.com/find-between-age` -- це базовий URL ресурсу та ендпоінт, де відбувається пошук. +* `userAgeFrom=20&userAgeTo=30` -- параметри запита, які вказують на пошук користувачів з віком від 20 до 30 років (включно). \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/pages/data-modeling/data/physical-model/join-and-or-usage.adoc b/docs/ua/modules/registry-develop/pages/data-modeling/data/physical-model/sc/joins/join-and-or-usage.adoc similarity index 100% rename from docs/ua/modules/registry-develop/pages/data-modeling/data/physical-model/join-and-or-usage.adoc rename to docs/ua/modules/registry-develop/pages/data-modeling/data/physical-model/sc/joins/join-and-or-usage.adoc diff --git a/docs/ua/modules/registry-develop/pages/data-modeling/data/physical-model/sc/operators/logical/manage-logical-operators-and-or.adoc b/docs/ua/modules/registry-develop/pages/data-modeling/data/physical-model/sc/operators/logical/manage-logical-operators-and-or.adoc new file mode 100644 index 0000000000..b0419adb13 --- /dev/null +++ b/docs/ua/modules/registry-develop/pages/data-modeling/data/physical-model/sc/operators/logical/manage-logical-operators-and-or.adoc @@ -0,0 +1,418 @@ += Оптимізація пошукових запитів: управління логічними операторами `AND` та `OR` в рамках однієї таблиці +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +== Проблематика + +У традиційному підході до формування пошукових запитів, параметри об'єднувалися виключно за допомогою логічного оператора `AND`. Це створювало обмеження, оскільки не давало можливості використовувати гнучкіші умови об'єднання параметрів, такі як `OR`. Тепер користувачі можуть обирати між `AND` та `OR`, забезпечуючи гнучкість у порядку застосування цих операторів. + +== Загальний опис + +Моделювальники регламенту мають змогу деталізувати та оптимізувати пошукові запити завдяки тегу *``*. Цей тег є ключовим елементом у створенні більш гнучких і ефективних умов пошуку в базах даних. + +Особливості та можливості тегу ``: + +. *Підтримка різних логічних операторів*: + +* Наразі `` підтримує два основні типи логічних операторів: `AND` та `OR`. +* Це розширення дозволяє створювати складніші та точні умови пошуку, адаптуючи запити до конкретних потреб користувачів. + +. *Гнучкість при моделюванні запитів*: + +* З використанням ``, моделювальники можуть визначити, чи мають умови в таблиці об'єднуватися через `AND` (всі умови повинні бути виконані), або через `OR` (достатньо виконання будь-якої з умов). + +. *Вкладеність та комбінації умов*: + +* Тег дозволяє використовувати вкладені структури, комбінуючи `AND` і `OR` для створення складніших логічних умов. +* Це значно розширює можливості моделювання запитів, дозволяючи враховувати різноманітні сценарії та бізнес-вимоги. + +TIP: Про особливості застосування функціональності у прикладах моделювання процесів читайте на сторінці xref:best-practices/bp-and-or-single-table.adoc[]. + +== Приклади моделювання + +Нижченаведені приклади демонструють, як можна використовувати тег `` для створення більш гнучких і потужних умов пошуку в базах даних, задовольняючи різні бізнес-потреби та вимоги до обробки даних. + +[NOTE] +==== +* Пошукові умови, визначені на першому рівні в `ext:table`, а також умови між різними таблицями, об'єднуються _ЛИШЕ_ оператором `AND`. Це означає, що всі критерії в різних таблицях або на першому рівні `ext:table` повинні бути виконані одночасно для включення результату в кінцевий набір даних. + +* Якщо ваші пошукові потреби вимагають лише використання `AND` між різними умовами, нема потреби явно визначати тег `` у вашому запиті. У цьому випадку система автоматично припустить, що ви використовуєте `AND` як логічний оператор за замовчуванням. +==== + +=== Сценарій 1: простий пошук за віком із використанням `AND` + +.XML-схема з використанням логічного оператора AND +==== +[source, xml] +---- + + + + + + + + + +---- +==== + +У цій XML-схемі використовується тег `` для явного зазначення, що умови пошуку по стовпцях `first_name`, `last_name` та `user_age` мають бути об'єднані за допомогою логічного оператора `AND`. + +.Опис таблиці `users` +[cols="2,5", options="header"] +|=== +| Стовпець | Опис + +| `first_name` +| Ім'я користувача, яке повертається як результат. + +| `last_name` +| Прізвище користувача, яке також повертається як результат. + +| `user_age` +| Вік користувача, який використовується для точного пошуку з оператором `equal`. +|=== + +.SQL-скрипт (_пошуковий запит_) +==== +[source,sql] +---- +SELECT first_name, last_name FROM users +WHERE first_name = 'John' AND last_name = 'Doe' AND user_age = 30 +---- +==== + +У цьому SQL-скрипті демонструється використання логічного оператора `AND` для вибірки записів, де ім'я, прізвище та вік користувача відповідають заданим критеріям. + +.HTTP GET-запит із використанням `AND` +[tabs] +==== + +HTTP:: ++ +[source,http] +---- +GET /simple-age-search?firstName=John&lastName=Doe&userAge=30 HTTP/1.1 +Host: api.example.com +---- ++ +Цей HTTP-запит використовує метод `GET` для запита до сервера, отримуючи результати, які відповідають комбінованим умовам `AND` за ім'ям, прізвищем та віком користувача. ++ +У цьому HTTP-запиті: + +* `GET` -- метод запита, використаний для отримання даних. +* `/simple-age-search?firstName=John&lastName=Doe&userAge=30` -- шлях до ресурсу на сервері, включаючи параметри запита `firstName`, `lastName` та `userAge`, які вказують на пошук користувачів з ім'ям `'John'`, прізвищем `'Doe'` та віком `30` років. +* `HTTP/1.1` -- версія протоколу HTTP. +* `Host: api.example.com` -- заголовок, що вказує хост або домен, де знаходиться ресурс. + +cURL:: ++ +[source,curl] +---- +curl -X GET "https://api.example.com/simple-age-search?firstName=John&lastName=Doe&userAge=30" +---- ++ +Ця команда використовує *cURL* для відправки HTTP-запита з методом `GET`, вказуючи на комбінацію умов `AND`. +==== + + +.HTTP POST-запит із використанням `AND` +[tabs] +==== + +HTTP:: ++ +[source,http] +---- +POST /simple-age-search HTTP/1.1 +Host: api.example.com +Content-Type: application/json + +{ + "firstName": "John", + "lastName": "Doe", + "userAge": 30 +} +---- ++ +Цей HTTP-запит використовує метод `POST` для відправки даних на сервер, вказуючи комбіновані умови `AND` у форматі JSON. ++ +У цьому HTTP запиті: + +* `POST` -- метод запита, використаний для відправки даних на сервер. +* `/simple-age-search` -- шлях до ресурсу на сервері (ендпоінт). +* `HTTP/1.1` -- версія протоколу HTTP. +* `Host: api.example.com` -- заголовок, що вказує домен, де знаходиться ресурс. +* `Content-Type: application/json` -- заголовок, що вказує на тип контенту, який передається у тілі запита. +* Тіло запита містить JSON-об'єкт з параметрами `firstName`, `lastName`, `userAge` з відповідними значеннями `John`, `Doe`, `30`. Це вказує на пошук користувачів з ім'ям `'John'`, прізвищем `'Doe'` та віком `30` років. + +cURL:: ++ +[source,curl] +---- +curl -X POST "https://api.example.com/simple-age-search" \ + -H "Content-Type: application/json" \ + -d '{"firstName": "John", "lastName": "Doe", "userAge": 30}' +---- ++ +Ця команда використовує *cURL* для відправки HTTP-запита з методом `POST`, вказуючи на комбінацію умов `AND` у форматі JSON. +==== + +=== Сценарій 2: комбінований пошук за персонажем мультфільму з використанням `AND` та `OR` + +.XML-схема з використанням логічних операторів `AND` та `OR` +==== +[source, xml] +---- + + + + + + + + + + + +---- +==== + +Ця XML-схема використовує теги `` для створення складних умов пошуку, що комбінують `AND` та `OR`. Пошук відбувається за іменем персонажа та назвою шоу (`AND`) або за характерною фразою персонажа (`OR`). + +.Опис таблиці `cartoon_characters` +[cols="2,5", options="header"] +|=== +| Стовпець | Опис + +| `character_name` +| Ім'я персонажа мультфільму для пошуку. + +| `show_title` +| Назва шоу, в якому з'являється персонаж. + +| `famous_phrase` +| Характерна фраза персонажа, яка використовується для пошуку з оператором `contains`. +|=== + +.SQL-скрипт (_пошуковий запит_) +==== +[source,sql] +---- +SELECT * FROM cartoon_characters +WHERE (character_name = 'SpongeBob' AND show_title = 'SpongeBob SquarePants') + OR famous_phrase LIKE '%I’m ready!%' +---- +==== + +Цей SQL-скрипт використовує комбіновані умови `AND` та `OR` для пошуку персонажів за іменем та шоу або за характерною фразою. + +.HTTP GET-запит із використанням `AND` та `OR` +[tabs] +==== + +HTTP:: ++ +[source,http] +---- +GET /cartoon-character-search?characterName=SpongeBob&showTitle=SpongeBob%20SquarePants&famousPhrase=I%E2%80%99m%20ready! HTTP/1.1 +Host: api.example.com +---- ++ +Цей HTTP-запит використовує метод `GET` для запита до сервера, отримуючи результати, які відповідають комбінованим умовам `AND` за іменем персонажа та шоу, або за характерною фразою. ++ +У цьому HTTP-запиті: + +* `GET` -- метод запита, використаний для отримання даних. +* `/cartoon-character-search?characterName=SpongeBob&showTitle=SpongeBob%20SquarePants&famousPhrase=I%E2%80%99m%20ready!` -- шлях до ресурсу на сервері зі вказаними параметрами для комбінованого пошуку. +* `HTTP/1.1` -- версія протоколу HTTP. +* `Host: api.example.com` -- заголовок, що вказує хост або домен, де знаходиться ресурс. + +cURL:: ++ +[source,curl] +---- +curl -X GET "https://api.example.com/cartoon-character-search?characterName=SpongeBob&showTitle=SpongeBob%20SquarePants&famousPhrase=I%E2%80%99m%20ready!" +---- ++ +Ця команда використовує *cURL* для відправки HTTP-запита з методом `GET`, вказуючи на комбіновані умови `AND` та `OR`. +==== + + +.HTTP POST-запит із використанням `AND` та `OR` +[tabs] +==== + +HTTP:: ++ +[source,http] +---- +POST /cartoon-character-search HTTP/1.1 +Host: api.example.com +Content-Type: application/json + +{ + "characterName": "SpongeBob", + "showTitle": "SpongeBob SquarePants", + "famousPhrase": "I’m ready!" +} +---- ++ +Цей HTTP-запит використовує метод `POST` для відправки даних на сервер, вказуючи комбіновані умови `AND` та `OR` у форматі JSON. ++ +У цьому HTTP запиті: + +* `POST` -- метод запита, використаний для відправки даних на сервер. +* `/cartoon-character-search` -- шлях до ресурсу на сервері (ендпоінт). +* `HTTP/1.1` -- версія протоколу HTTP. +* `Host: api.example.com` -- заголовок, що вказує домен, де знаходиться ресурс. +* `Content-Type: application/json` -- заголовок, що вказує на тип контенту, який передається у тілі запита. +* Тіло запита містить JSON-об'єкт з параметрами `characterName`, `showTitle`, `famousPhrase` з відповідними значеннями `SpongeBob`, `SpongeBob SquarePants`, `I’m ready!`. Це вказує на пошук персонажів за комбінованими умовами. + +cURL:: ++ +[source,curl] +---- +curl -X POST "https://api.example.com/cartoon-character-search" \ + -H "Content-Type: application/json" \ + -d '{"characterName": "SpongeBob", "showTitle": "SpongeBob SquarePants", "famousPhrase": "I’m ready!"}' +---- ++ +Ця команда використовує *cURL* для відправки HTTP-запита з методом `POST`, вказуючи на комбіновані умови `AND` та `OR` у форматі JSON. +==== + +=== Сценарій 3: складний комбінований пошук за автором книги з використанням вкладених операторів `AND` та `OR` + +.XML-схема з використанням вкладених логічних операторів `AND` та `OR` +==== +[source, xml] +---- + + + + + + + + + + + + + + +---- +==== + +Ця XML-схема демонструє складну структуру пошуку, що використовує вкладені `AND` та `OR` для фільтрації міжнародних авторів за національністю, жанром, нагородами або назвами книг. + +.Опис таблиці `international_authors` +[cols="2,5", options="header"] +|=== +| Стовпець | Опис + +| `nationality` +| Національність автора. + +| `genre` +| Жанр творів автора. + +| `award` +| Нагороди, отримані автором. + +| `book_title` +| Назви книг автора. +|=== + +.SQL-скрипт (_пошуковий запит_) +==== +[source,sql] +---- +SELECT * FROM international_authors +WHERE (nationality = 'Ukrainian' AND (genre = 'Fiction' OR award LIKE '%Nobel Prize%')) + OR book_title LIKE '%Independence%' +---- +==== + +Цей SQL-скрипт використовує складні умови `AND` та `OR` для пошуку українських авторів, які пишуть у жанрі художньої літератури або мають таку нагороду, як Нобелівська премія, або авторів будь-якої національності, які написали книги з назвою, що містить слово `"Independence"`. + +.HTTP GET-запит із використанням вкладених `AND` та `OR` +[tabs] +==== + +HTTP:: ++ +[source,http] +---- +GET /advanced-search?nationality=Ukrainian&genre=Fiction&award=Nobel%20Prize&bookTitle=Independence HTTP/1.1 +Host: api.example.com +---- ++ +Цей HTTP-запит використовує метод `GET` для запита до сервера, отримуючи результати, які відповідають складним умовам вибірки. ++ +У цьому HTTP-запиті: + +* `GET` -- метод запита, використаний для отримання даних. +* `/advanced-search?nationality=Ukrainian&genre=Fiction&award=Nobel%20Prize&bookTitle=Independence` -- шлях до ресурсу на сервері зі вказаними параметрами для складного комбінованого пошуку. +* `HTTP/1.1` -- версія протоколу HTTP. +* `Host: api.example.com` -- заголовок, що вказує хост або домен, де знаходиться ресурс. + +cURL:: ++ +[source,curl] +---- +curl -X GET "https://api.example.com/advanced-search?nationality=Ukrainian&genre=Fiction&award=Nobel%20Prize&bookTitle=Independence" +---- ++ +Ця команда використовує *cURL* для відправки HTTP-запита з методом `GET`, вказуючи на складну комбінацію умов. +==== + + +.HTTP POST-запит із Використанням Вкладених `AND` та `OR` +[tabs] +==== + +HTTP:: ++ +[source,http] +---- +POST /advanced-search HTTP/1.1 +Host: api.example.com +Content-Type: application/json + +{ + "nationality": "Ukrainian", + "genre": "Fiction", + "award": "Nobel Prize", + "bookTitle": "Independence" +} +---- ++ +Цей HTTP-запит використовує метод `POST` для відправки даних на сервер, вказуючи складні комбіновані умови вибірки в форматі JSON. ++ +У цьому HTTP запиті: + +* `POST` -- метод запита, використаний для відправки даних на сервер. +* `/advanced-search` -- шлях до ресурсу на сервері (ендпоінт). +* `HTTP/1.1` -- версія протоколу HTTP. +* `Host: api.example.com` -- заголовок, що вказує домен, де знаходиться ресурс. +* `Content-Type: application/json` -- заголовок, що вказує на тип контенту, який передається у тілі запита. +* Тіло запита містить JSON-об'єкт з параметрами `nationality`, `genre`, `award`, `bookTitle` з відповідними значеннями `Ukrainian`, `Fiction`, `Nobel Prize`, `Independence`. Це вказує на пошук авторів за складними комбінованими умовами. + +cURL:: ++ +[source,curl] +---- +curl -X POST "https://api.example.com/advanced-search" \ + -H "Content-Type: application/json" \ + -d '{"nationality": "Ukrainian", "genre": "Fiction", "award": "Nobel Prize", "bookTitle": "Independence"}' +---- ++ +Ця команда використовує *cURL* для відправки HTTP-запита з методом `POST`, вказуючи на складну комбінацію умов у форматі JSON. +==== + +== Пов'язані сторінки + +* xref:best-practices/bp-and-or-single-table.adoc[] +* xref:data-modeling/data/physical-model/liquibase-ddm-ext.adoc[] +* xref:registry-develop:data-modeling/data/physical-model/sc/attributes/search-type/search-type-attribute.adoc[] \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/pages/data-modeling/initial-load/data-initial-data-load-pl-pgsql.adoc b/docs/ua/modules/registry-develop/pages/data-modeling/initial-load/data-initial-data-load-pl-pgsql.adoc index b211d710d0..b40980b4b2 100644 --- a/docs/ua/modules/registry-develop/pages/data-modeling/initial-load/data-initial-data-load-pl-pgsql.adoc +++ b/docs/ua/modules/registry-develop/pages/data-modeling/initial-load/data-initial-data-load-pl-pgsql.adoc @@ -102,6 +102,7 @@ CALL p_load_table_from_csv('staff','D:\PostgreSQL\csv\staff.csv' Для завантаження даних в БД використовуємо стандартну функціональність liquibase. +[#data-load-xml-template] .Приклад XML-шаблону для завантаження даних [source, xml] ---- @@ -150,9 +151,63 @@ TIP: За детальною інформацією щодо створення == Рекомендації для завантаження великої кількості даних -Для завантаження великої кількості даних (понад 1 млн рядків) рекомендується тимчасова зміна конфігурації БД -- у файлі з налаштуваннями PostgreSQL `postgresql.conf` встановити наступні значення для часу очікування підключень між реплікою та основною (master) БД: +Для завантаження великих csv-файлів (десятки і сотні мегабайт) можна використати стандартний SQL код замість процедури. Для коректної роботи реєстру такий SQL код повинен також створити історичні дані (таблиця `\_hst`) та заповнити поля з метаданими (колонки `ddm_`), тобто повторити ті операції що процедура виконує автоматично. В прикладі наведений коректний та найбільш ефективний метод це зробити. +.Приклад SQL коду для завантаження даних +[source, sql] +---- +-- Створення тимчасової проміжної таблиці, яка +-- відповідає формату csv файлу що завантажується +CREATE TABLE account_csv_stage (username text, bank_number text); + +-- Завантаження даних із csv файлу в проміжну таблицю +COPY account_csv_stage (username,bank_number) +FROM '${dataLoadPath}account.csv' +WITH (HEADER, FORMAT CSV); + +-- Вставка даних в основну та історичну таблиці +WITH main_table_cte AS ( + INSERT INTO account ( + username + , bank_number + , ddm_created_by + , ddm_updated_by + ) + SELECT username + , bank_number + , 'admin' + , 'admin' + FROM account_csv_stage + RETURNING *) +INSERT INTO account_hst ( + id + , username + , bank_number + , ddm_created_by + , ddm_created_at + , ddm_dml_op + , ddm_system_id + , ddm_application_id + , ddm_business_process_id) +SELECT id + , username + , bank_number + , ddm_created_by + , CURRENT_TIMESTAMP + , 'I' as ddm_dml_op + , (SELECT ss.system_id + FROM ddm_source_system ss + WHERE ss.system_name ='initial load') ddm_system_id + , (SELECT sa.application_id + FROM ddm_source_application sa + WHERE sa.application_name ='initial load') ddm_application_id + , (SELECT sb.business_process_id + FROM ddm_source_business_process sb + WHERE sb.business_process_name ='initial load process') ddm_business_process_id +FROM main_table_cte; + +-- Видалення тимчасової проміжної таблиці +DROP TABLE account_csv_stage; ---- -wal_sender_timeout = 900s -wal_receiver_timeout = 900s ----- \ No newline at end of file + +Таким кодом можна замінити виклик процедури в xref:data-load-xml-template[XML-шаблоні для завантаження даних]. Для кожного завантаження файлу таким методом, варто створювати окремий ченджсет. \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/pages/data-modeling/initial-load/data-initial-data-load-prep.adoc b/docs/ua/modules/registry-develop/pages/data-modeling/initial-load/data-initial-data-load-prep.adoc index 82b173d31d..cc55d370bd 100644 --- a/docs/ua/modules/registry-develop/pages/data-modeling/initial-load/data-initial-data-load-prep.adoc +++ b/docs/ua/modules/registry-develop/pages/data-modeling/initial-load/data-initial-data-load-prep.adoc @@ -1,31 +1,12 @@ -:toc-title: ЗМІСТ -:toc: auto -:toclevels: 5 -:experimental: -:important-caption: ВАЖЛИВО -:note-caption: ПРИМІТКА -:tip-caption: ПІДКАЗКА -:warning-caption: ПОПЕРЕДЖЕННЯ -:caution-caption: УВАГА -:example-caption: Приклад -:figure-caption: Зображення -:table-caption: Таблиця -:appendix-caption: Додаток -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Підготовка даних до міграції -:sectanchors: +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Вступ Завантаження даних до системи (первинне або повторне) на цей час здійснюється за допомогою файлів формату https://uk.wikipedia.org/wiki/CSV[CSV]. Перед тим, як розпочати процес міграції даних зі старого реєстру до нового, необхідно розв'язати організаційні питання взаємодії між власником даних і розробником реєстру. -:sectnums: - -== Основні питання, на які варто звернути увагу на етапі підготовки +== Основні питання на етапі підготовки * Хто готує вихідні файли для завантаження: власник даних або розробник реєстру? * Як буде відбуватися передача файлу для завантаження: актом прийняття-передання, в робочому порядку, протоколом, супроводжувальним листом? @@ -86,20 +67,19 @@ NOTE: *[red]##Увага!##* Замовник з тих чи інших прич Для мінімізації цієї проблеми, слід заздалегідь продумати обсяги тестових вивантажень з історичних реєстрів. -[[heading,Heading]] -=== Зіставленняfootnote:[*Data mapping* -- визначення відповідності даних між потенційно різними семантиками одного об'єкта або різних об'єктів.] даних +=== Зіставлення даних -Зіставлення даних (data mapping), в загальному, — процес зіставлення даних історичних систем і нової (цільової) системи-приймача, у нашому випадку — старого реєстру і нового, тобто, вихідних даних і даних для завантаження. Етап зіставлення — найбільш трудомісткий етап і може займати понад 50% всіх робіт з міграції. На цьому етапі повною мірою залучається вся робоча група проєкту з міграції. +_Зіставлення даних або **Data mapping**_ -- це процес зіставлення даних історичних систем і нової (цільової) системи-приймача, у нашому випадку — старого реєстру і нового, тобто, вихідних даних і даних для завантаження. Етап зіставлення — найбільш трудомісткий і може займати понад 50% всіх робіт з міграції. На цьому етапі повною мірою залучається вся робоча група проєкту з міграції. -В процесі зіставлення даних необхідно виділити такі підетапи: +У процесі зіставлення даних необхідно виділити такі підетапи: -* **зіставлення таблиць**; -* **зіставлення полів**. +* _Зіставлення таблиць_ +* _Зіставлення полів_ [#tables-mapping] ==== Зіставлення таблиць -**Зіставлення таблиць** або **зіставлення шаблонів** — зіставлення таблиць вихідних даних і шаблонів даних для завантаження. Відповідність може бути як 1:1, так і N:N. В результаті такої роботи складається і підтримується реєстр зіставлення таблиць. Цей підетап є необхідним для наступного підетапу зіставлення полів та відстеження загального стану справ із зіставлення. +_Зіставлення таблиць_ або _Зіставлення шаблонів_ — зіставлення таблиць вихідних даних і шаблонів даних для завантаження. Відповідність може бути як 1:1, так і N:N. В результаті такої роботи складається і підтримується реєстр зіставлення таблиць. Цей підетап є необхідним для наступного підетапу зіставлення полів та відстеження загального стану справ із зіставлення. Приблизний вигляд реєстру зіставлення таблиць може бути, наприклад, таким: @@ -127,7 +107,7 @@ NOTE: *[red]##Увага!##* Замовник з тих чи інших прич ==== Зіставлення полів **Зіставлення полів** -- це зіставлення полів таблиць в рамках вже наявного зіставлення таблиць. Результатом цієї роботи є реєстр зіставлення полів. -Приблизний вигляд реєстру зіставлення полів може бути наступним (на прикладі Реєстру атестованих лабораторій): +Приблизний вигляд зіставлення полів може бути наступним (_на прикладі Реєстру атестованих лабораторій_): image:registry-develop:data-modeling/initial-load/data-load-prep-fields-mapping.png[] @@ -135,15 +115,17 @@ image:registry-develop:data-modeling/initial-load/data-load-prep-fields-mapping. === Підготовка правил трансформації -На підставі узгоджених реєстрів зіставлення полів, фахівці Виконавця розробляють правила трансформації даних. Цей етап може виконуватися одночасно з попереднім -- xref:fields-mapping["Зіставлення полів"]. +На підставі узгоджених реєстрів зіставлення полів, фахівці Виконавця розробляють правила трансформації даних. Цей етап може виконуватися одночасно з попереднім -- xref:fields-mapping[Зіставлення полів]. Для оперативної роботи в процесі підготовчих етапів міграції й далі, в ході самої міграції в реєстрі реалізована технічна можливість первинного завантаження. Після відпрацювання етапу зіставлення, на виході повинні з’явитися заповнені файли-шаблони відповідно до вимог заповнення та форматів полів. +[supported-files-formats] ==== Підтримувані версії та формати файлів * Для завантаження підтримуються лише файли формату `.csv`. * Зведені таблиці не підтримуються. +[file-analysis] ===== Аналіз файлів для завантаження * файли CSV підтримують лише одну таблицю на лист. @@ -188,4 +170,8 @@ TIP: За детальною специфікацією щодо формату Після завершення підсумкової міграції відповідно до завчасно визначеної стратегії міграції та плану міграції, приймається рішення щодо подальшої експлуатації історичного реєстру та процедури введення нового реєстру в експлуатацію. -CAUTION: Варто пам'ятати, що будь-який проєкт з міграції даних вимагає ретельної підготовки та повинен супроводжуватися індивідуальним планом. Однак, незалежно від типу реєстрів, що мігрують, обсягів баз даних тощо, загальна схема міграції виглядає практично ідентично. \ No newline at end of file +CAUTION: Варто пам'ятати, що будь-який проєкт з міграції даних вимагає ретельної підготовки та повинен супроводжуватися індивідуальним планом. Однак, незалежно від типу реєстрів, що мігрують, обсягів баз даних тощо, загальна схема міграції виглядає практично ідентично. + +== Пов'язані сторінки + +* xref:admin:migration/migration-overview.adoc[] \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/pages/data-modeling/reports/reports-overview.adoc b/docs/ua/modules/registry-develop/pages/data-modeling/reports/reports-overview.adoc index 0cae2b6728..698d5a29d7 100644 --- a/docs/ua/modules/registry-develop/pages/data-modeling/reports/reports-overview.adoc +++ b/docs/ua/modules/registry-develop/pages/data-modeling/reports/reports-overview.adoc @@ -20,7 +20,7 @@ image:data-modeling/reports/reports-redash-admin.png[] [TIP] ==== -Отримати доступ до +++Вебінтерфейсу моделювання звітів+++ (*Redash Admin*) можна в у розділі +++Швидкі посилання+++ в адміністративній панелі *Control Plane*. +Отримати доступ до *Вебінтерфейсу моделювання звітів* (*Redash Admin*) можна в у розділі *Швидкі посилання* в адміністративній панелі *Control Plane*. ==== == Розділення на екземпляри diff --git a/docs/ua/modules/registry-develop/pages/it-system-classes.adoc b/docs/ua/modules/registry-develop/pages/it-system-classes.adoc index 81817b3928..2c8703f58b 100644 --- a/docs/ua/modules/registry-develop/pages/it-system-classes.adoc +++ b/docs/ua/modules/registry-develop/pages/it-system-classes.adoc @@ -3,7 +3,7 @@ include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc include::platform:ROOT:partial$admonitions/language-ua.adoc[] -== Що таке платформа реєстрів? +== Що таке _Платформа реєстрів_? _Платформа реєстрів_ -- це гнучкий, безпечний цифровий low-code бекенд для побудови різних типів ІТ-систем. Розгляньмо детально. diff --git a/docs/ua/modules/registry-develop/pages/overview.adoc b/docs/ua/modules/registry-develop/pages/overview.adoc index 886bd9c367..11e4fb124e 100644 --- a/docs/ua/modules/registry-develop/pages/overview.adoc +++ b/docs/ua/modules/registry-develop/pages/overview.adoc @@ -1,20 +1,30 @@ +:sectanchors: +:sectlinks: +:note-caption: Примітка = Командам розробки та супроводу реєстрів +include::platform:ROOT:partial$admonitions/language-ua.adoc[] + Ефективна розробка та підтримка реєстрів залежать від добре організованих команд та спеціалізованих ролей. У цьому розділі ви дізнаєтеся про наступне: -* [*] _Адміністратори реєстру_: відповідальні за координацію, моніторинг та забезпечення стабільної роботи реєстру. +* [*] *_Адміністратори реєстру_*: відповідальні за координацію, моніторинг та забезпечення стабільної роботи реєстру. + +* [*] *_Моделювальники даних_*: Експерти, які займаються створенням та оптимізацією структур даних у реєстрі. -* [*] _Моделювальники даних_: Експерти, які займаються створенням та оптимізацією структур даних у реєстрі. +* [*] *_Моделювальники бізнес-процесів_*: Ключові спеціалісти, які ведуть розробку, моделювання та вдосконалюють робочі процеси реєстру. -* [*] _Моделювальники бізнес-процесів_: Ключові спеціалісти, які ведуть розробку, моделювання та вдосконалюють робочі процеси реєстру. +* [*] *_Навчання_*: Обрані ресурси та матеріали для підвищення кваліфікації адміністраторів та розробників реєстру. -* [*] _Навчання_: Обрані ресурси та матеріали для підвищення кваліфікації адміністраторів та розробників реєстру. +* [*] *_Найкращі практики_*: Перевірені часом методології та стратегії, засновані на галузевому досвіді, для забезпечення якісної розробки та підтримки реєстрів. -* [*] _Найкращі практики_: Перевірені часом методології та стратегії, засновані на галузевому досвіді, для забезпечення якісної розробки та підтримки реєстрів. +* [*] *_Аудит регламенту реєстру_*: Розділ містить перелік рекомендацій, які дозволяють оцінити якість регламенту реєстру та виявити можливі проблеми, +які можуть виникнути при його використанні. Рекомендації згруповані відповідно до структури +xref:arch:architecture/registry/administrative/regulation-management/registry-regulation/registry-regulation.adoc[Цифрового + регламенту реєстру]. Перед впровадженням регламенту в промислову експлуатацію рекомендується провести повний аудит регламенту реєстру. * [*] Додатково рекомендуємо ознайомитися із _класами IT-систем, які можна побудувати_ на Платформі реєстрів. -Запрошуємо до докладного вивчення кожного підрозділу, де розкриваються особливості та аспекти роботи з реєстрами. +Запрошуємо докладно вивчити кожний підрозділ, де розкриваються всі аспекти роботи з реєстрами. == Огляд секції @@ -24,4 +34,5 @@ * xref:registry-admin-study/registry-admin-study.adoc[] * xref:study-project/index.adoc[] * xref:best-practices/best-practices-overview.adoc[] +* xref:registry-audit-instruction/registry-audit-instruction.adoc[] * xref:registry-develop:it-system-classes.adoc[Класи IT-систем, які можна побудувати на Платформі реєстрів] \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/pages/registry-admin-study/registry-admin-profile.adoc b/docs/ua/modules/registry-develop/pages/registry-admin-study/registry-admin-profile.adoc index b6a2f458bd..bf8d72f2e8 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin-study/registry-admin-profile.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin-study/registry-admin-profile.adoc @@ -65,9 +65,6 @@ include::platform:ROOT:partial$admonitions/language-ua.adoc[] Управління налаштуваннями та лімітами доступу до внутрішніх ресурсів: :: * Конфігурування Kong API-шлюзу, включаючи налаштування лімітів на кількість запитів від клієнта (Rate Limiting). -Управління секретами: :: -* Використання Hashicorp Vault для управління секретами. - Моніторинг API-ресурсів реєстру: :: * Розуміння концептів REST API. * Знання OpenAPI Specification (OAS). @@ -78,7 +75,7 @@ include::platform:ROOT:partial$admonitions/language-ua.adoc[] * Робота з операційними та аналітичними даними реєстру за допомогою pgAdmin та подібних інструментів. Налаштування поштового сервера: :: -* Налаштування підключення до платформного поштового сервера для забезпечення обміну повідомленнями у реєстрі. +* Налаштування з'єднання із зовнішніми поштовими серверами для забезпечення обміну повідомленнями у реєстрі. == Пов'язанні сторінки diff --git a/docs/ua/modules/registry-develop/pages/registry-admin-study/study-tasks/study-tasks-overview.adoc b/docs/ua/modules/registry-develop/pages/registry-admin-study/study-tasks/study-tasks-overview.adoc index eaff33167e..ec62ec28ee 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin-study/study-tasks/study-tasks-overview.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin-study/study-tasks/study-tasks-overview.adoc @@ -5,6 +5,14 @@ == Огляд секції * xref:registry-develop:registry-admin-study/study-tasks/task-1-registry-introduction.adoc[] -* xref:registry-develop:registry-admin-study/study-tasks/task-2-manage-registry-administrators.adoc[] -* xref:registry-develop:registry-admin-study/study-tasks/task-3-registry-backup-restore.adoc[] -* xref:registry-develop:registry-admin-study/study-tasks/task-4-registry-update.adoc[] +* xref:registry-develop:registry-admin-study/study-tasks/task-2-registry-update.adoc[] +* xref:registry-develop:registry-admin-study/study-tasks/task-3-manage-registry-administrators.adoc[] +* xref:registry-develop:registry-admin-study/study-tasks/task-4-update-registry-keys.adoc[] +* xref:registry-develop:registry-admin-study/study-tasks/task-5-registry-resources-management.adoc[] +* xref:registry-develop:registry-admin-study/study-tasks/task-6-set-file-upload-restrictions.adoc[] +* xref:registry-develop:registry-admin-study/study-tasks/task-7-add-registry-users.adoc[] +* xref:registry-develop:registry-admin-study/study-tasks/task-8-event-logging-kibana.adoc[] +* xref:registry-develop:registry-admin-study/study-tasks/task-9-platform-metrics-monitoring-grafana.adoc[] +* xref:registry-develop:registry-admin-study/study-tasks/task-10-registry-backup-restore.adoc[] +* xref:registry-develop:registry-admin-study/study-tasks/task-11-setup-custom-dns.adoc[] +* xref:registry-develop:registry-admin-study/study-tasks/task-12-authentication-setup.adoc[] diff --git a/docs/ua/modules/registry-develop/pages/registry-admin-study/study-tasks/task-1-registry-introduction.adoc b/docs/ua/modules/registry-develop/pages/registry-admin-study/study-tasks/task-1-registry-introduction.adoc index e2601cd813..58d5dab328 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin-study/study-tasks/task-1-registry-introduction.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin-study/study-tasks/task-1-registry-introduction.adoc @@ -41,13 +41,13 @@ TIP: Адміністративна панель *Control Plane* -- центра === Ознайомлення з наявною інформацією про реєстр -. В інтерфейсі Control Plane відкрийте розділ +++Реєстри+++. +. В інтерфейсі Control Plane відкрийте розділ *Реєстри*. . Натисніть назву тестового реєстру, щоби відкрити сторінку з наявною інформацією про реєстр. + image:registry-develop:registry-admin-study/task-registry-introduction/control-plane-registries.png[] -. Ознайомтеся з інформацією про реєстр у вкладці +++Інформація про реєстр+++. +. Ознайомтеся з інформацією про реєстр у вкладці *Інформація про реєстр*. + image:registry-develop:registry-admin-study/task-registry-introduction/test-registry-info.png[] + @@ -57,7 +57,7 @@ image:registry-develop:registry-admin-study/task-registry-introduction/test-regi TIP: Розділ швидких посилань в інтерфейсі Control Plane містить посилання до вебінтерфейсів різних сервісів з коротким описом їх призначення. -. На сторінці відомостей про тестовий реєстр відкрийте вкладку +++Швидкі посилання+++. +. На сторінці відомостей про тестовий реєстр відкрийте вкладку *Швидкі посилання*. + image:registry-develop:registry-admin-study/task-registry-introduction/test-registry-quick-links.png[] @@ -67,9 +67,13 @@ image:registry-develop:registry-admin-study/task-registry-introduction/test-regi + TIP: За більш детальною інформацією зверніться до інструкції xref:admin:registry-management/control-plane-quick-links.adoc[]. +. Перейдіть до сервісу розгортання регламенту (Jenkins) у розділі *Адміністративна зона реєстру* Control Plane. Якщо доступ відсутній, сповістіть Адміністратора. ++ +image:registry-develop:registry-admin-study/task-2/task-2-31.png[] + === Ознайомлення з доступними для редагування налаштуваннями реєстру -. На сторінці відомостей про тестовий реєстр натисніть кнопку `+++Редагувати+++`. +. На сторінці відомостей про тестовий реєстр натисніть кнопку `*Редагувати*`. + image:registry-develop:registry-admin-study/task-registry-introduction/test-registry-edit-button.png[] + diff --git a/docs/ua/modules/registry-develop/pages/registry-admin-study/study-tasks/task-3-registry-backup-restore.adoc b/docs/ua/modules/registry-develop/pages/registry-admin-study/study-tasks/task-10-registry-backup-restore.adoc similarity index 64% rename from docs/ua/modules/registry-develop/pages/registry-admin-study/study-tasks/task-3-registry-backup-restore.adoc rename to docs/ua/modules/registry-develop/pages/registry-admin-study/study-tasks/task-10-registry-backup-restore.adoc index 0fc6a4b227..b4de389d16 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin-study/study-tasks/task-3-registry-backup-restore.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin-study/study-tasks/task-10-registry-backup-restore.adoc @@ -1,4 +1,4 @@ -= Завдання 3. Резервне копіювання та відновлення реєстру та його компонентів += Завдання 10. Резервне копіювання та відновлення реєстру та його компонентів include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] == Мета завдання @@ -35,25 +35,25 @@ NOTE: Час створення резервної копії реєстру з ==== + .Приклад Console Output: створення резервної копії для реєстру admin-test -image::registry-develop:registry-admin-study/task-3/task-3-01-backup-name.png[] +image::registry-develop:registry-admin-study/task-backup-restore/01-backup-name.png[] NOTE: Якщо процес створення резервної копії завершився успішно, зі статусом `SUCCESS`, й ви отримали її назву, це означає, що резервну копію створено у сховищі. В такому разі можна переходити до наступного розділу поточного завдання. === Внесення контрольних змін до реєстру Для перевірки результату відновлення реєстру з резервної копії, потрібно внести контрольні зміни до реєстру після того, як створено резервну копію. -Як приклад таких змін, можна створити версію-кандидат у +++Кабінеті адміністратора регламентів+++ та додати до неї просту форму. +Як приклад таких змін, можна створити версію-кандидат у *Кабінеті адміністратора регламентів* та додати до неї просту форму. -. Ознайомтеся з інструкцією xref:registry-admin/admin-portal/version-control/create-new-change-request.adoc[] та створіть нову версію-кандидат. +. Ознайомтеся з інструкцією xref:registry-admin/admin-portal/version-control/candidate/create-new-change-request.adoc[] та створіть нову версію-кандидат. + При створенні запита використовуйте наступні налаштування: + -* +++Назва версії+++: `зміна-01` -* +++Опис зміни+++: `Зміна перед відновленням резервної копії` +* *Назва версії*: `зміна-01` +* *Опис зміни*: `Зміна перед відновленням резервної копії` + -image:registry-develop:registry-admin-study/task-3/task-3-02-create-merge-request.png[] +image:registry-develop:registry-admin-study/task-backup-restore/02-create-merge-request.png[] -. У +++Кабінеті адміністратора регламентів+++ створіть форму за допомогою +++Конструктора+++. Використайте компонент *File* для моделювання. +. У *Кабінеті адміністратора регламентів* створіть форму за допомогою *Конструктора*. Використайте компонент *File* для моделювання. + [TIP] ==== @@ -65,26 +65,39 @@ image:registry-develop:registry-admin-study/task-3/task-3-02-create-merge-reques + При створенні форми використовуйте наступні налаштування: + -* +++Бізнес-назва форми+++: `форма для демонстрації процесу відновлення з бекапу` -* +++Службова назва форми+++: `restore-test-form` +* *Бізнес-назва форми*: `форма для демонстрації процесу відновлення з бекапу` +* *Службова назва форми*: `restore-test-form` + -image:registry-develop:registry-admin-study/task-3/task-3-03-create-form.png[] +image:registry-develop:registry-admin-study/task-backup-restore/03-create-form.png[] . Додайте до форми один компонент -- *File*. + -image:registry-develop:registry-admin-study/task-3/task-3-04-add-file-field.png[] +image:registry-develop:registry-admin-study/task-backup-restore/04-add-file-field.png[] . У результаті у версія-кандидат `зміна-01` матиме створену форму `restore-test-form`. + -image:registry-develop:registry-admin-study/task-3/task-3-05-form-added.png[] +image:registry-develop:registry-admin-study/task-backup-restore/05-form-added.png[] === Відновлення попередньої версії реєстру із втратою внесених змін . Ознайомтеся з інструкцією з резервного копіювання та відновленню екземпляра реєстру та виконайте кроки, описані в розділі xref:admin:backup-restore/control-plane-backup-restore.adoc#restore-registry[Відновлення реєстру (Restore)]. -. Переконайтеся, що процес *`Restore-registry-backup-test`* в Jenkins завершився успішно. +. У розділі *Швидкі посилання*, в секції *Адміністративна зона Платформи* перейдіть до *Сервісу розгортання конфігурації (Jenkins)*. + -image:registry-develop:registry-admin-study/task-3/task-3-06-restore-pipeline-success.png[] +image:registry-develop:registry-admin-study/task-backup-restore/06-02-jenkins.png[] ++ +Оберіть реєстр, який потрібно відновити та знайдіть пайплайн *Restore-registry-``*, де `` -- назва вашого реєстру. ++ +[NOTE] +==== +На кроці із вибором резервної копії, коли пайплайн буде у стані `paused`, потрібно навести курсор та натисніть на цей крок у Jenkins. У спливному вікні оберіть із випадного списку попередньо створений бекап та натисніть *`Proceed`*. + +image:registry-develop:registry-admin-study/task-backup-restore/06-01-restore.png[] +==== + +. Переконайтеся, що процес *Restore-registry-admin-test* в Jenkins завершився успішно. Для цього відкрийте лог відповідної збірки у розділі *Console Output*. Збірка має завершитися зі статусом `Finished: SUCCESS`. ++ +image:registry-develop:registry-admin-study/task-backup-restore/06-restore-pipeline-success.png[] + NOTE: Час відновлення реєстру із резервної копії залежить від обсягу даних. Наприклад, для тестового реєстру це може зайняти _від 60 до 90 хвилин_. @@ -105,13 +118,25 @@ NOTE: Час відновлення реєстру із резервної ко . Ознайомтеся з інструкцією по керуванню розкладом резервного копіювання реєстру та виконайте кроки, описані в розділі xref:admin:backup-restore/backup-schedule-registry-components.adoc#schedule-setup[Налаштування розкладу резервного копіювання]. + -При створенні розкладу додайте 20 хвилин до поточного часу та встановіть це значення для годин та хвилин у полі +++Розклад+++. +При створенні розкладу додайте 20 хвилин до поточного часу та встановіть це значення для годин та хвилин у полі *Розклад*. + [NOTE] ==== -Також зазначте, що резервування потрібно створювати лише протягом робочих днів. Приклад налаштування розкладу з *cron*: +Також зазначте, що резервні копії потрібно створювати лише протягом робочих днів. Приклад налаштування розкладу з *cron*: + +image:registry-develop:registry-admin-study/task-backup-restore/07-cronitor.png[] + +Зверніть увагу, що опція *Build Triggers* у Jenkins може використовувати _ЛИШЕ_ числові значення у полях. + +Наприклад, вам потрібно встановити такий розклад: + +_"Кожний день тижня, з вівторка по четвер, о 04:05 ранку"_. -image:registry-develop:registry-admin-study/task-3/task-3-07-cronitor.png[] +В такому разі використовуйте cron-вираз із числовими значеннями для днів тижня, тобто замість `TUE-THU` вкажіть `2-4`. Ваш фінальний вираз виглядатиме так: + +[source,cron] +---- +5 4 * * 2-4 +---- ==== . Підтвердьте зміни та застосуйте налаштування розкладу, як показано у розділах xref:admin:backup-restore/backup-schedule-registry-components.adoc#replication-schedule-backup[Резервне копіювання реплікацій об'єктів S3] та xref:admin:backup-restore/backup-schedule-registry-components.adoc#apply-schedule-configuration[Застосування конфігурації розкладу] відповідної інструкції. @@ -122,12 +147,12 @@ CAUTION: Зверніть увагу, що час для реплікації у + .. Відкрийте процес та натисніть опцію *Configure* в меню зліва. + -image:registry-develop:registry-admin-study/task-3/task-3-08-configure-backup-pipeline.png[] +image:registry-develop:registry-admin-study/task-backup-restore/08-configure-backup-pipeline.png[] .. Відкрийте вкладку *Build Triggers*. + -image:registry-develop:registry-admin-study/task-3/task-3-09-build-triggers.png[] +image:registry-develop:registry-admin-study/task-backup-restore/09-build-triggers.png[] . У визначений час (`n+20` хвилин) переконайтеся, що процес *Create-registry-backup-``* запустився відповідно до встановленого розкладу. + -image:registry-develop:registry-admin-study/task-3/task-3-10-started-by-timer.png[] \ No newline at end of file +image:registry-develop:registry-admin-study/task-backup-restore/10-started-by-timer.png[] \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/pages/registry-admin-study/study-tasks/task-11-setup-custom-dns.adoc b/docs/ua/modules/registry-develop/pages/registry-admin-study/study-tasks/task-11-setup-custom-dns.adoc new file mode 100644 index 0000000000..0a30389630 --- /dev/null +++ b/docs/ua/modules/registry-develop/pages/registry-admin-study/study-tasks/task-11-setup-custom-dns.adoc @@ -0,0 +1,73 @@ += Завдання 11. Налаштування власного DNS-імені для Кабінету посадової особи +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +== Мета завдання + +Виконання цього завдання має на меті: :: + +* [*] Навчити налаштовувати власне DNS-ім'я для _Кабінету користувача_ (`officer-portal`). + +== Передумови + +. Ознайомтеся з інструкцією +xref:admin:registry-management/custom-dns/cp-custom-dns-portals.adoc[]. + +. Завантажте SSL-сертифікат xref:attachment$/registry-admin-study/task-12-dns/admin-taskkey.pem[_admin-taskkey.pem_] та використайте тимчасовий домен `officer.admin-task.pp.ua`. ++ +[IMPORTANT] +Надані вище дані є тимчасовими як приклад для встановлення власного DNS-імені. + +== Процес виконання завдання + +[NOTE] +==== +Основний процес встановлення власного DNS-імені для Кабінету користувача: + +* Потрібно зареєструвати доменне ім'я, яке буде використовуватись для входу у _Кабінет користувача_. +* Потрібен валідний SSL-сертифікат, зокрема необхідно мати сам _ключ_, _сертифікат_ та fullchain-дані. +* Створіть `CNAME`-запис, який буде вказувати на `Load Balancer` прив'язаного до `OpenShift` роутера. +* Додайте нову адресу до списку дозволених адрес віджета. + +За необхідності, зверніться до _Технічного адміністратора інстансу_ для отримання актуальних даних. +==== + +. Перейдіть до редагування реєстру та відкрийте секцію *DNS*. ++ +image:registry-develop:registry-admin-study/task-set-up-dns-name/01-edit-registry.png[] + +. Заповніть поля наступними даними: + +* *Доменне імʼя для кабінету посадової особи:* `officer.admin-task.pp.ua`; +* *SSL-сертифікат для кабінету чиновника (розширення .pem):* Використайте завантажений файл _admin-taskkey.pem_. ++ +[IMPORTANT] +Це тимчасові дані, надані для використання як приклад для ілюстрації дій, необхідних для встановлення власного DNS-імені. + +. Натисніть `*Підтвердити*`, щоб зберегти налаштування. + +. Перевірте та застосуйте зміни у _Запитах на оновлення_. ++ +image:registry-develop:registry-admin-study/task-set-up-dns-name/02-update-request.png[] + +. Перевірте зміни в OpenShift-консолі -- запис повинен мати оновлене значення. ++ +image:registry-develop:registry-admin-study/task-set-up-dns-name/03-openshift-console.png[] ++ +[NOTE] +Зазначена адреса була попередньо додана до списку дозволених адрес віджета `eu.iit.com.ua`. +Якщо ви хочете використати іншу адресу, потрібно додати її окремо. Для цього зверніться до _служби підтримки технічного адміністратора інстансу Платформи_ через Ваш канал та залиште запит на додавання нової адреси до тестового віджета https://eu.iit.com.ua/[eu.iit.com.ua]. + +. Перейдіть за посиланням. ++ +image:registry-develop:registry-admin-study/task-set-up-dns-name/04-user-portal.png[] ++ +NOTE: Результатом виконання завдання є змога автентифікуватись у Кабінеті користувача, використовуючи власне доменне ім'я. + +[TIP] +==== +Для застосування цієї функціональності у промисловому середовищі (_поза межами завдання_) необхідно: + +. Мати `domain name` для зміни та SSL-сертифікат. +. Створити `CNAME-запис`, який буде вказувати на `Load Balancer` прив'язаного до `OpenShift` роутера; +. Додати нову адресу до списку дозволених адрес віджета eu.iit.com.ua. +==== \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/pages/registry-admin-study/study-tasks/task-12-authentication-setup.adoc b/docs/ua/modules/registry-develop/pages/registry-admin-study/study-tasks/task-12-authentication-setup.adoc new file mode 100644 index 0000000000..f209a91ce6 --- /dev/null +++ b/docs/ua/modules/registry-develop/pages/registry-admin-study/study-tasks/task-12-authentication-setup.adoc @@ -0,0 +1,128 @@ += Завдання 12. Налаштування типів автентифікації +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +== Мета завдання + +Виконання цього завдання має на меті: :: + +* [*] Навчити змінювати тип автентифікації для надавачів послуг. + +[#prerequisites] +== Передумови + +. Зверніться до адміністратора Платформи та отримайте дані, необхідні для налаштування реєстру, для зміни типу автентифікації на `id.gov.ua`: + +* Посилання на тестове середовище `id.gov.ua`. +* Ідентифікатор клієнта (`client_id`). +* Клієнтський секрет (`secret`). + +. Перед налаштуванням автентифікації завантажте архів із тестовими ключами для автентифікації: https://id.gov.ua/downloads/test_certificatesqa_2023.zip[_test-certificatesqa_2023.zip_]. + +. Ознайомтеся з документами: + +* xref:registry-develop:registry-admin/cp-auth-setup/cp-auth-setup-overview.adoc[Налаштування автентифікації користувачів] +* xref:registry-develop:registry-admin/cp-auth-setup/cp-auth-setup-officers.adoc[Налаштування автентифікації надавачів послуг] +* xref:registry-develop:registry-admin/create-users/manual-user-creation.adoc[] +* xref:user:citizen-officer-portal-auth.adoc[Автентифікація користувачів реєстру] + +== Загальний опис + +Платформа дозволяє адміністраторам налаштувати тип автентифікації для надавачів послуг, зокрема Платформа підтримує наступні налаштування: + +* Перший тип автентифікації -- *IIT-Віджет*, який встановлено за замовчуванням. Цей тип призначений для автентифікації надавачів послуг за допомогою КЕП на формі входу до _Кабінету користувача_. + +* Другий тип автентифікації -- *id.gov.ua*. Цей тип призначений для автентифікації надавачів послуг за допомогою зовнішнього постачальника ідентифікаційних даних на формі входу до _Кабінету користувача_. + +NOTE: Одночасно користувачі _Кабінету_ зможуть використовувати лише один встановлений тип автентифікації (або *IIT-віджет*, або *id.gov.ua*), але налаштування реєстру можуть співіснувати разом для обох типів. + +== Процес виконання завдання + +=== Налаштування реєстру + +Для налаштування реєстру виконайте наступні кроки: + +NOTE: _Ідентифікатор клієнта_ та _Клієнтський секрет_ -- це дані, які ви отримаєте після укладення договору на використання тестового середовища `test.id.gov.ua`. + +. Виконайте зміну типу автентифікації на *id.gov.ua*. Використовуйте дані, отримані від адміністратора Платформи (_див. xref:#prerequisites[]_): ++ +-- +* *Вкажіть тип автентифікації*: `id.gov.ua` +* *Посилання* (_Посилання на тестове середовище_ `id.gov.ua`) +* *Ідентифікатор клієнта (client_id)* +* *Клієнтський секрет (secret)* +-- ++ +image:registry-develop:registry-admin-study/task-authentication-setup/01-edit-registry.png[] + +. Підтвердьте зміни та дочекайтеся завершення Jenkins-пайплайну *MASTER-Build-``* із результатом `*SUCCESS*`. Він застосовує параметри заданої конфігурації для типу автентифікації. (_див. пункти 3.2.3-3.2.8 інструкції xref:registry-develop:registry-admin/cp-auth-setup/cp-auth-setup-officers.adoc[Налаштування автентифікації надавачів послуг]_). + +=== Створення користувача у Keycloak + +Для того, щоб користувач мав змогу автентифікуватися у _Кабінеті користувача_, потрібно створити цього користувача у _Сервісі управління користувачами та ролями (Keycloak)_. + +NOTE: Детальний опис процесу створення користувачів див. у розділі xref:registry-develop:registry-admin/create-users/manual-user-creation.adoc#create-user[Створення користувача у системі]. + +Щоб створити користувача у реєстрі, виконайте наступні кроки: + +. Перейдіть до реалму у Keycloak *``-officer-portal*, створіть користувача та використайте наступні дані: + +* *Username*: `ТЕСТ Юридична Особа` +* *Email*: test@test.com +* *First Name*: `Юридична` +* *Last Name*: `Особа` + +. Призначте роль `officer`. ++ +image:registry-develop:registry-admin-study/task-authentication-setup/02-keycloak-role.png[] + +. Додайте наступні атрибути у вкладці *Attributes*: + +* *`drfo`* -- `5544332211`; +* *`edrpou`* -- `12345678`; +* *`fullName`* -- `Юридична Особа`; ++ +NOTE: Ключі можуть періодично оновлюватися. Тому щоб отримати ці дані, використайте ключ _Юридична особа (з посадою)_ та візьміть дані звідти. ++ +TIP: Атрибут *`drfo`* -- це поле *РНОКПП*. ++ +NOTE: Перед тим, як вставляти дані у `fullName`, видаліть значення `ТЕСТ`. Наприклад: при отриманні значення `TЕСТ Юридична особа`, видаліть значення `ТЕСТ`. У результаті ви маєте отримати наступну назву: `Юридична особа`. ++ +image:registry-develop:registry-admin-study/task-authentication-setup/03-check-data.png[] ++ +image:registry-develop:registry-admin-study/task-authentication-setup/04-keycloak-attributes.png[] + +NOTE: Результатом буде додавання користувача у _Сервіс управління користувачами та ролями (Keycloak)_ зі встановленими атрибутами автентифікації. + +=== Перевірка автентифікації за допомогою _id.gov.ua_ + +Для перевірки автентифікації виконайте наступні кроки: + +. Перейдіть до _Швидких посилань_ > _Кабінет користувача_. +image:registry-develop:registry-admin-study/task-add-registry-users/07-officer-portal.png[] + +. Увійдіть до _Кабінету користувача_. ++ +image:registry-develop:registry-admin-study/task-add-registry-users/08-user-portal.png[] + +. Оберіть _Увійти за допомогою електронного підпису_. ++ +image:registry-develop:registry-admin-study/task-authentication-setup/05-sign-in-with-digital-signature.png[] ++ +NOTE: Червоне інформаційне вікно з повідомленням `Домен інформаційної системи не підключений до id.gov.ua` -- це очікуваний результат, оскільки використовується тестовий майданчик `test.id.gov.ua`, а не промисловий `id.gov.ua`. + +. Використайте наступні дані для автентифікації: + +* *Тип:* `файловий носій`; +* *Ключ:* _Key-6.day_ із папки _Юридична особа (з посадою)_ із попередньо завантаженого архіву (_див. розділ xref:#prerequisites[], крок 1_); +* *Пароль:* 12345. ++ +image:registry-develop:registry-admin-study/task-authentication-setup/06-sign-in-with-digital-signature.png[] ++ +image:registry-develop:registry-admin-study/task-authentication-setup/07-check-data.png[] + +[NOTE] +==== +Результатом виконання цього завдання буде успішна автентифікація за допомогою інтегрованої системи електронної ідентифікації (ІСЕІ) *ID.GOV.UA*. + +image::registry-develop:registry-admin-study/task-add-registry-users/12-success authentication.png[] +==== \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/pages/registry-admin-study/study-tasks/task-4-registry-update.adoc b/docs/ua/modules/registry-develop/pages/registry-admin-study/study-tasks/task-2-registry-update.adoc similarity index 81% rename from docs/ua/modules/registry-develop/pages/registry-admin-study/study-tasks/task-4-registry-update.adoc rename to docs/ua/modules/registry-develop/pages/registry-admin-study/study-tasks/task-2-registry-update.adoc index 20a9e2de15..743a27a137 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin-study/study-tasks/task-4-registry-update.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin-study/study-tasks/task-2-registry-update.adoc @@ -1,4 +1,4 @@ -= Завдання 4. Оновлення реєстру += Завдання 2. Оновлення реєстру include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] == Мета завдання @@ -20,7 +20,7 @@ NOTE: Спочатку адміністратор Платформи має ви . Перевірте поточну версію реєстру, створеного для цього завдання, в адміністративній панелі Control Plane. + -image:registry-develop:registry-admin-study/task-1/task-1-01-registry-version.png[] +image:registry-develop:registry-admin-study/task-registry-update/01-registry-version.png[] == Процес виконання завдання @@ -33,7 +33,7 @@ image:registry-develop:registry-admin-study/task-1/task-1-01-registry-version.pn + TIP: За потреби використовуйте перемикач версій у правому верхньому куті. -. Якщо документ має розділ +++Підготовка реєстру до оновлення+++, виконайте цю частину інструкцій. +. Якщо документ має розділ *Підготовка реєстру до оновлення*, виконайте цю частину інструкцій. + Якщо такого розділу для `версії n` немає, переходьте до оновлення реєстру. @@ -52,15 +52,15 @@ TIP: За потреби використовуйте перемикач вер На кроці вибору версії для оновлення виберіть `версію n`. -image:registry-develop:registry-admin-study/task-1/task-1-02-registry-update-confirm.png[] +image:registry-develop:registry-admin-study/task-registry-update/02-registry-update-confirm.png[] ==== Підтвердження запита на оновлення в Control Plane -. Відкрийте відомості про тестовий реєстр і знайдіть розділ +++Запити на оновлення+++. +. Відкрийте відомості про тестовий реєстр і знайдіть розділ *Запити на оновлення*. . Відкрийте сформований запит на оновлення версії реєстру натисканням іконки перегляду -- 👁. + -image:registry-develop:registry-admin-study/task-1/task-1-03-registry-update-gerrit.png[] +image:registry-develop:registry-admin-study/task-registry-update/03-registry-update-gerrit.png[] . Підтвердьте внесення змін до коду. @@ -74,7 +74,7 @@ TIP: Зверніть увагу на альтернативний шлях пі . Переконайтеся, що процес запустився та успішно завершився. + -image:registry-develop:registry-admin-study/task-1/task-1-04-jenkins-build-success.png[] +image:registry-develop:registry-admin-study/task-registry-update/04-jenkins-build-success.png[] TIP: Детальніше дивіться інструкцію по оновленню компонентів реєстру, розділ xref:admin:update/update-registry-components.adoc[Контроль за виконанням збірки коду в Jenkins]. @@ -87,7 +87,7 @@ TIP: Детальніше дивіться інструкцію по оновл + TIP: За потреби використовуйте перемикач версій у правому верхньому куті. -. Якщо документ має розділ +++Кроки після оновлення реєстру+++, виконайте цю частину інструкцій. +. Якщо документ має розділ *Кроки після оновлення реєстру*, виконайте цю частину інструкцій. + Якщо такого розділу для `версії n` немає, переходьте до розділу xref:#check-pod-image-versions[Перевірка версії образів для подів]. @@ -111,44 +111,44 @@ TIP: За потреби використовуйте перемикач вер ==== Ви можете знайти посилання до Gerrit у розділі швидких посилань адміністративної панелі Control Plane. -image:registry-develop:registry-admin-study/task-1/task-1-07-quick-links-gerrit.png[] +image:registry-develop:registry-admin-study/task-registry-update/07-quick-links-gerrit.png[] ==== . Виконайте вхід, якщо це не було зроблено. + -image:registry-develop:registry-admin-study/task-1/task-1-08-gerrit-sign-in.png[] +image:registry-develop:registry-admin-study/task-registry-update/08-gerrit-sign-in.png[] . Перейдіть в розділ *CHANGES* > *Merged*. + -image:registry-develop:registry-admin-study/task-1/task-1-09-gerrit-merged-changes.png[] +image:registry-develop:registry-admin-study/task-registry-update/09-gerrit-merged-changes.png[] . Знайдіть зміну з оновленням реєстру. Вона матиме назву *Update registry to ``*, де `` -- це версія, до якої ви оновлюєте реєстр. + -image:registry-develop:registry-admin-study/task-1/task-1-10-gerrit-change-update.png[] +image:registry-develop:registry-admin-study/task-registry-update/10-gerrit-change-update.png[] . Всередині зміни з оновленням реєстру знайдіть файл *_deploy-templates/helmfile.yaml_*. + -image:registry-develop:registry-admin-study/task-1/task-1-11-gerrit-helmfile-location.png[] +image:registry-develop:registry-admin-study/task-registry-update/11-gerrit-helmfile-location.png[] . Всередині _helmfile.yaml_ відшукайте зміни версій образів для наступних подів: * *`bpms`* + -image:registry-develop:registry-admin-study/task-1/task-1-12-helmfile-bpms.png[] +image:registry-develop:registry-admin-study/task-registry-update/12-helmfile-bpms.png[] * *`digital-signature-ops`* + -image:registry-develop:registry-admin-study/task-1/task-1-13-helmfile-digital-signature-ops.png[] +image:registry-develop:registry-admin-study/task-registry-update/13-helmfile-digital-signature-ops.png[] * *`registry-regulation-management`* + -image:registry-develop:registry-admin-study/task-1/task-1-14-helmfile-registry-regulation-management.png[] +image:registry-develop:registry-admin-study/task-registry-update/14-helmfile-registry-regulation-management.png[] . Перейдіть до OpenShift-консолі та відкрийте розділ *Workloads* > *Pods*. . У випадному списку *Project* оберіть проєкт із назвою реєстру, який ви оновлюєте. + -image:registry-develop:registry-admin-study/task-1/task-1-15-okd-pods-project.png[] +image:registry-develop:registry-admin-study/task-registry-update/15-okd-pods-project.png[] . Виконайте пошук по кожному поду та переконайтеся, що версія образу збігається із версією, яка вказана в оновленнях _helmfile.yaml_. + @@ -159,13 +159,13 @@ image:registry-develop:registry-admin-study/task-1/task-1-15-okd-pods-project.pn -- + -image:registry-develop:registry-admin-study/task-1/task-1-16-okd-pods-bpms.png[] +image:registry-develop:registry-admin-study/task-registry-update/16-okd-pods-bpms.png[] + -image:registry-develop:registry-admin-study/task-1/task-1-17-okd-pods-bpms-version.png[] +image:registry-develop:registry-admin-study/task-registry-update/17-okd-pods-bpms-version.png[] [[task-result]] == Результат виконання завдання Результатом виконання завдання є реєстр, оновлений до `версії n`. -image:registry-develop:registry-admin-study/task-1/task-1-18-task-result.png[] \ No newline at end of file +image:registry-develop:registry-admin-study/task-registry-update/18-task-result.png[] \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/pages/registry-admin-study/study-tasks/task-2-manage-registry-administrators.adoc b/docs/ua/modules/registry-develop/pages/registry-admin-study/study-tasks/task-3-manage-registry-administrators.adoc similarity index 82% rename from docs/ua/modules/registry-develop/pages/registry-admin-study/study-tasks/task-2-manage-registry-administrators.adoc rename to docs/ua/modules/registry-develop/pages/registry-admin-study/study-tasks/task-3-manage-registry-administrators.adoc index 145718e70b..25eef1234d 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin-study/study-tasks/task-2-manage-registry-administrators.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin-study/study-tasks/task-3-manage-registry-administrators.adoc @@ -1,4 +1,4 @@ -= Завдання 2. Створення та видалення адміністраторів реєстру += Завдання 3. Створення та видалення адміністраторів реєстру include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] == Мета завдання @@ -6,7 +6,7 @@ include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc Виконання цього завдання має на меті: :: * [*] Отримати практичні навички додавання та видалення адміністраторів реєстру. -* [*] Навчитися додавати групи та ролі для користувачів у сервісі Keycloak. +* [*] Навчити додавати групи та ролі для користувачів у сервісі Keycloak. == Передумови @@ -27,12 +27,25 @@ NOTE: Виконуйте завдання у тестовому реєстрі. При створенні адміністратора використовуйте наступні налаштування: + -- -* +++Ім'я+++: `Петр` -* +++Прізвище+++: `Петренко` -* +++Електронна пошта+++: `petr@petrenko.com` -* +++Тимчасовий пароль+++: `123` +* *Ім'я*: `Петр` +* *Прізвище*: `Петренко` +* *Електронна пошта*: `petr@petrenko.com` +* *Тимчасовий пароль*: `xd3@D7$kjQ` -- + +[NOTE] +==== +*Вимоги до пароля:* + +- Мінімум 10 символів. +- Принаймні одна мала літера. +- Принаймні одна велика літера. +- Мінімум одна цифра. +- Принаймні один спеціальний символ (`@, #, $, %, ^, &, +, =`). +- Використовуйте лише латинські літери. +- Без пробілів. +==== ++ image:registry-develop:registry-admin-study/task-2/task-2-02-administrator-details.png[] + TIP: Зверніть увагу на альтернативний шлях підтвердження змін через систему рецензування коду Gerrit. @@ -44,11 +57,11 @@ TIP: Зверніть увагу на альтернативний шлях пі Ви можете знайти посилання до *Jenkins* у наступних розділах тестового реєстру у Control Plane: * У розділі швидких посилань: -+++Адміністративна зона Платформи+++ > -+++Сервіс розгортання конфігурації (Jenkins)+++. +*Адміністративна зона Платформи* > +*Сервіс розгортання конфігурації (Jenkins)*. -* У розділі +++Інформація про реєстр+++ > -+++Конфігурація+++ > *CI*. +* У розділі *Інформація про реєстр* > +*Конфігурація* > *CI*. + image:registry-develop:registry-admin-study/task-2/task-2-04-jenkins-ci-link.png[] ==== @@ -97,7 +110,7 @@ image:registry-develop:registry-admin-study/task-2/task-2-09-login-keycloak.png[ . Введіть дані, вказані при додаванні адміністратора. + * *Username or email*: `petr@petrenko.com` -* *Password*: `123` +* *Password*: `xd3@D7$kjQ` + image:registry-develop:registry-admin-study/task-2/task-2-10-sign-in.png[] @@ -139,7 +152,7 @@ image:registry-develop:registry-admin-study/task-2/task-2-17-registry-check-edit [TIP] ==== * Ви можете знайти посилання на інтерфейс у розділі швидких посилань *Control Plane*: + -+++Адміністративна зона реєстру+++ > +++Вебінтерфейс управління виконанням бізнес-процесів (Business Process Administration Portal)+++. +*Адміністративна зона реєстру* > *Вебінтерфейс управління виконанням бізнес-процесів (Business Process Administration Portal)*. * Альтернативно використайте посилання за наступним шаблоном: + @@ -152,12 +165,28 @@ image:registry-develop:registry-admin-study/task-2/task-2-17-registry-check-edit === Додавання груп та ролей у Keycloak +[NOTE] +==== +[%collapsible] +.Для того, щоб користувач з'явився у реалмі... +===== +Для того, щоб користувач з'явився у реалмі, йому потрібно автентифікуватися в одному із сервісів, перелічених у розділі швидких посилань адміністративної зони реєстру Control Plane. +Наприклад, *Сервіс розгортання регламенту (Jenkins)*. + +image:registry-develop:registry-admin-study/task-2/task-2-31.png[] + +Виконайте автентифікацію за допомогою `openshift-sso`. + +image:registry-develop:registry-admin-study/task-2/task-2-32.png[] +===== +==== + . Перейдіть до Keycloak. + [TIP] ==== * Ви можете знайти посилання на інтерфейс у розділі швидких посилань *Control Plane*: + -+++Операційна зона Платформи+++ > +++Сервіс управління користувачами та ролями (Keycloak)+++. +*Операційна зона Платформи* > *Сервіс управління користувачами та ролями (Keycloak)*. * Альтернативно використайте посилання за наступним шаблоном: + @@ -171,9 +200,6 @@ image:registry-develop:registry-admin-study/task-2/task-2-18-camunda-admin-role. image:registry-develop:registry-admin-study/task-2/task-2-19-camunda-admin-group.png[] . Відкрийте профіль користувача petr@petrenko.com. -+ -NOTE: Для того, щоб користувач з'явився у реалмі, йому потрібно автентифікуватися в одному із сервісів, перелічених у розділі швидких посилань Control Plane. -Наприклад, +++Вебінтерфейс моделювання регламенту (Admin Portal)+++. . Переконайтеся в тому, що користувач petr@petrenko.com отримав призначені групу та роль `camunda-admin`. + @@ -197,13 +223,13 @@ NOTE: Видалення адміністратора реєстру не є о . Відкрийте консоль *Control Plane*. -. Перейдіть до редагування налаштувань тестового реєстру та відкрийте вкладку +++Адміністратори+++. +. Перейдіть до редагування налаштувань тестового реєстру та відкрийте вкладку *Адміністратори*. . Натисніть іконку видалення 🗑 поряд з адміністратором petr@petrenko.com. + image:registry-develop:registry-admin-study/task-2/task-2-24-registry-edit-administrators.png[] -. Натисніть кнопку `+++Підтвердити+++`. +. Натисніть кнопку `*Підтвердити*`. . Відкрийте запит на оновлення. + @@ -213,7 +239,7 @@ image:registry-develop:registry-admin-study/task-2/task-2-25-view-update-request + image:registry-develop:registry-admin-study/task-2/task-2-26-confirm-deletion.png[] -. Перейдіть до Jenkins за посиланням у розділі +++Інформація про реєстр+++ > +++Конфігурація+++ > стовпець *CI*. +. Перейдіть до Jenkins за посиланням у розділі *Інформація про реєстр* > *Конфігурація* > стовпець *CI*. + image:registry-develop:registry-admin-study/task-2/task-2-27-jenkins-ci-link.png[] @@ -227,7 +253,7 @@ image:registry-develop:registry-admin-study/task-2/task-2-29-pipeline-success.pn . Переконайтеся, що адміністратора було видалено. Для цього виконайте такі кроки: .. Перейдіть до консолі *Control Plane*. -.. Відкрийте тестовий реєстр та зайдіть у розділ +++Інформація про реєстр+++ > +++Загальна інформація+++. +.. Відкрийте тестовий реєстр та зайдіть у розділ *Інформація про реєстр* > *Загальна інформація*. .. У переліку адміністраторів не має бути користувача petr@petrenko.com. + diff --git a/docs/ua/modules/registry-develop/pages/registry-admin-study/study-tasks/task-4-update-registry-keys.adoc b/docs/ua/modules/registry-develop/pages/registry-admin-study/study-tasks/task-4-update-registry-keys.adoc new file mode 100644 index 0000000000..cc5b894235 --- /dev/null +++ b/docs/ua/modules/registry-develop/pages/registry-admin-study/study-tasks/task-4-update-registry-keys.adoc @@ -0,0 +1,191 @@ += Завдання 4. Оновлення ключів та сертифікатів цифрового підпису +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +== Мета завдання + +Виконання цього завдання має на меті: :: + +* [*] Навчити оновлювати ключі та сертифікати цифрового підпису для реєстру. + +== Передумови + +. Перед оновленням сертифікатів цифрового підпису завантажте необхідні файли: + +* Сертифікати АЦСК тестового середовища: https://iit.com.ua/download/productfiles/CAs.Test.All.json. +* Сертифікати АЦСК тестового середовища: https://iit.com.ua/download/productfiles/CACertificates.Test.All.p7b. + ++ +[WARNING] +====== +При завантаженні тестових файлів, ви отримаєте у назвах значення `Test.All.`. Наприклад, _CACertificates.Test.All.p7b_. + +Видаліть значення `Test.All.` для обох типів сертифікатів. В результаті ви маєте отримати наступні назви: + +* _CACertificates.p7b_ +* _CAs.json_ +====== + +. Ознайомтеся з інструкцією + xref:admin:registry-management/system-keys/control-plane-registry-keys.adoc[]. + + +== Процес виконання завдання + +=== Оновлення ключа системного підпису + +Для оновлення ключа системного підпису використовуйте інструкцію, наведену нижче інформацію та попередньо завантажені файли. + +. Заповніть наступні поля відповідними значеннями: ++ +-- +* *Тип носія*: `Файловий носій`; +* *Файловий ключ (розширення .dat)*: _key-6.dat_; +* *АЦСК, що видав ключ*: `Тестовий ЦСК АТ "ІІТ"`; +* *Пароль до файлового ключа*: `123`; +* *Перелік дозволених ключів*: заповніть, використовуючи дані з файлу _allowed-keys.yml_. + +[TIP] +==== +Завантажте наведені нижче файли та використовуйте попередньо підготовлений ключ цифрового підпису та дані про цей ключ: + +* файловий ключ для цифрового підпису для тестового користувача xref:registry-develop:attachment$registry-admin-study/task-3-update-registry-keys/key-6.dat[_key-6.dat_]; +* перелік дозволених ключів xref:attachment$registry-admin-study/task-3-update-registry-keys/allowed-keys.yml[_allowed-keys.yml_]; ++ +==== + +-- ++ +image:registry-develop:registry-admin-study/task-3/task-3-01.png[] + +. Додайте декілька дозволених ключів. Для цього натисніть кнопку +`*Додати ключ*`. ++ +image:registry-develop:registry-admin-study/task-3/task-3-03.png[] ++ +[NOTE] +==== +У *переліку дозволених ключів * +необхідно заповнити дані для усіх попередніх довірених ключів: + +* *Емітент ключа*: параметр `issuer` у файлі _allowed-keys.yml_; +* *Серійний номер ключа*: параметр `serial` у файлі _allowed-keys.yml_. + +Усі дані беруться з файлу _allowed-keys.yml_. + +image:registry-develop:registry-admin-study/task-3/task-3-02.png[] +==== ++ +NOTE: Проміжним результатом буде заповнення всіх полів та вказані 2 дозволені ключі. ++ +image:registry-develop:registry-admin-study/task-3/task-3-04.png[] + +. Підтвердьте зміни, відкрийте *Запити на оновлення* та схваліть новий запит. ++ +image:registry-develop:registry-admin-study/task-3/task-3-05.png[] ++ +NOTE: Успішним результатом буде завершення пайплайну *MASTER-Build-``* зі статусом *`SUCCESS`*, де `` -- назва вашого реєстру. ++ +image:registry-develop:registry-admin-study/task-3/task-3-06.png[] + +. Перевірте, що под *`digital-signature-ops`* знаходиться у стані `Running`. ++ +image:registry-develop:registry-admin-study/task-3/task-3-11.png[] + +. Впевніться, що дані було оновлено. Перейдіть до *Secrets* та пошуком знайдіть *`digital-signature-data`* та *`digital-signature-env-vars`*. ++ +image:registry-develop:registry-admin-study/task-3/task-3-12.png[] + +. Перейдіть до секрету *`digital-signature-data`*, натисніть *`Reveal values`*. ++ +image:registry-develop:registry-admin-study/task-3/task-3-13.png[] + +. Порівняйте вміст allowed-keys із файлом _allowed-keys.yml_. + +Перейдіть до секрету *`digital-signature-env-vars`*, натисніть *Reveal values*, та переконайтеся, що зазначені дані, відповідають тим, які ви вказали при заміні ключа. ++ +image:registry-develop:registry-admin-study/task-3/task-3-14.png[] + +[NOTE] +==== +Результатом виконання цього підзавдання буде: + +[%interactive] +* [ ] успішний білд; +* [ ] перевірка поду; +* [ ] перевірка _allowed keys.yml_. +==== + +=== Оновлення даних для перевірки підписів + +[IMPORTANT,caption=Особливості завантаження сертифікатів цифрового підпису] +==== +[%collapsible] +.Особливості завантаження сертифікатів CA та p7b +===== +При розгортанні та роботі з тестовим реєстром, використовуйте сертифікати тестового АЦСК, інакше пайплайн розгортання реєстру не пройде, а ви отримаєте помилку ініціалізації криптосервісу `digital-signature-ops`. Це станеться через те, що файли сертифікатів для виробничого середовища просто не містять даних про тестові АЦСК. + +Для промислового середовища використовуйте відповідні prod-сертифікати. + +CACertificates.p7b: :: + +* Сертифікати АЦСК тестового середовища: https://iit.com.ua/download/productfiles/CACertificates.Test.All.p7b[CACertificates.p7b]. +* Сертифікати АЦСК промислового середовища: https://iit.com.ua/download/productfiles/CACertificates.p7b[productfiles/CACertificates.p7b]. + +CAs.json: :: +* Сертифікати АЦСК тестового середовища: https://iit.com.ua/download/productfiles/CAs.Test.All.json[CAs.json]. +* Сертифікати АЦСК промислового середовища: https://iit.com.ua/download/productfiles/CAs.json[productfiles/CAs.json]. + +[WARNING] +====== +При завантаженні тестових файлів, ви отримаєте у назвах значення `Test.All`. Наприклад, _CACertificates.Test.All.p7b_. + +Видаліть значення `Test.All.` для обох типів сертифікатів. В результаті ви маєте отримати наступні назви: + +* _CACertificates.p7b_ +* _CAs.json_ +====== +===== +==== + +Щоб оновити дані для перевірки підписів, виконайте наступні кроки: + +. Перейдіть на вкладку *Дані для перевірки підписів*. + +. Оновіть дані, використовуючи попередньо завантажені файли. ++ +image:registry-develop:registry-admin-study/task-3/task-3-07.png[] ++ +-- +* У полі *Публічні сертифікати АЦСК (CACertificates.p7b)* завантажте сертифікат *_CACertificates.p7b_*. +* У полі *Перелік АЦСК (розширення .json)* завантажте сертифікат *_CAs.json_*. ++ +-- ++ +NOTE: Успішним результатом буде підвантаження двох файлів. ++ +image:registry-develop:registry-admin-study/task-3/task-3-08.png[] + +. Підтвердьте зміни, відкрийте *Запити на оновлення* та схваліть новий запит. ++ +image:registry-develop:registry-admin-study/task-3/task-3-05.png[] ++ +NOTE: Успішним результатом буде завершення пайплайну *MASTER-Build-``* зі статусом *`SUCCESS`*, де `` -- назва вашого реєстру. ++ +image:registry-develop:registry-admin-study/task-3/task-3-09.png[] ++ +image:registry-develop:registry-admin-study/task-3/task-3-10.png[] + +. Виконайте перевірку вмісту файлу *_CACertificates.p7b_*. Для цього перейдіть до секрету `*digital-signature-data*`, завантажте файл *_CACertificates.p7b_* із публічними сертифікатами АЦСК та порівняйте його з тим, який ви використали при заміні. ++ +image:registry-develop:registry-admin-study/task-3/task-3-15.png[] + +[NOTE] +==== +Результатом виконання цього підзавдання буде: + +[%interactive] +* [ ] підвантаження сертифікатів; +* [ ] успішний білд; +* [ ] перевірка вмісту файлу _CACertificates.p7b_. +==== + + diff --git a/docs/ua/modules/registry-develop/pages/registry-admin-study/study-tasks/task-5-registry-resources-management.adoc b/docs/ua/modules/registry-develop/pages/registry-admin-study/study-tasks/task-5-registry-resources-management.adoc new file mode 100644 index 0000000000..971daba3d7 --- /dev/null +++ b/docs/ua/modules/registry-develop/pages/registry-admin-study/study-tasks/task-5-registry-resources-management.adoc @@ -0,0 +1,79 @@ += Завдання 5. Керування ресурсами реєстру +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +== Мета завдання + +Виконання цього завдання має на меті: :: + +* [*] Навчити налаштовувати окремі сервіси реєстру на прикладі відключення *`sidecar`*-контейнера *`istio`* для поду криптосервісу *`digital-signature-ops`*. + +== Передумови + +. Ознайомтеся із можливими доступними для налаштування сервісами та процедурою внесення змін на сторінці + xref:admin:registry-management/control-plane-registry-resources.adoc[]. + +== Процес виконання завдання + +[configure-registry-services] +=== Налаштування сервісів реєстру + +[NOTE] +==== +Деякі ключі, особливо тестові, можуть не працювати з увімкненим `istio`, тому може виникнути необхідність вимкнути `sidecar`-контейнер `istio` для поду криптосервісу `digital-signature-ops`. + +Якщо такий контейнер не вимкнути, то не працюватиме системний підпис у бізнес-процесах, зокрема користувачі не зможуть виконувати наступні операції підпису: + +* Підписання даних, які необхідно зберегти із бізнес-процесу (BPMS) до Фабрики даних реєстру. +* Підписання даних документів, які генеруються системою, для користувачів реєстру. Наприклад, витяги тощо. + +CAUTION: Також можливе проявлення проблеми: із тестовим ключем не буде працювати авторизація у Кабінетах! + +Детальніше про типи ключів системного підпису див. на сторінці xref:admin:registry-management/system-keys/system-keys-overview.adoc[]. +==== + +Налаштуйте сервіс *`digital-signature-ops`* реєстру, використовуючи інструкцію, наведену нижче. + +. Перевірте поточний стан та наявність `sidecar`-контейнера `istio` в консолі `OKD`. ++ +image:registry-develop:registry-admin-study/task-registry-resources-management/01-check-current state.png[] ++ +image:registry-develop:registry-admin-study/task-registry-resources-management/02-check-istio-availability.png[] + +. Вимкніть `sidecar`-контейнер `istio` для поду `digital-signature-ops`. Для цього виконайте наступні кроки: + +.. Перейдіть до редагування реєстру та відкрийте вкладку *Ресурси реєстру*. ++ +image:registry-develop:registry-admin-study/task-registry-resources-management/03-registry-resources-editing.png[] + +.. Знайдіть сервіс `digital-signature-ops` та вимкніть `sidecar`-контейнер `istio`. ++ +image:registry-develop:registry-admin-study/task-registry-resources-management/04-istio-enabled.png[] + +.. Підтвердьте зміни, відкрийте *Запити на оновлення* та схваліть новий запит. ++ +image:registry-develop:registry-admin-study/task-registry-resources-management/05-change-request-confirming.png[] + +.. Перейдіть до сервісу *Jenkins* за посиланням *CI*. ++ +image:registry-develop:registry-admin-study/task-registry-resources-management/06-configuration.png[] + +.. Проконтролюйте процес виконання пайплайну *MASTER-Build-``*. ++ +image:registry-develop:registry-admin-study/task-registry-resources-management/07-jenkins.png[] + +. Після завершення процесу виконання зі статусом *`SUCCESS`*, перевірте под `digital-signature-ops` в OKD-консолі. ++ +image:registry-develop:registry-admin-study/task-registry-resources-management/08-check-success-status.png[] + +* Перейдіть до *Workloads* > *Pods* > *Pod details*> *Details* > *Containers*. ++ +image:registry-develop:registry-admin-study/task-registry-resources-management/09-okd-console.png[] ++ +image:registry-develop:registry-admin-study/task-registry-resources-management/10-check-containers.png[] + +[NOTE] +==== +Результатом цього завдання буде виконання у поді _ЛИШЕ_ основного контейнера криптосервісу `digital-signature-ops`. + + +Sidecar-контейнер `іstio` має зникнути, адже його було вимкнено. +==== diff --git a/docs/ua/modules/registry-develop/pages/registry-admin-study/study-tasks/task-6-set-file-upload-restrictions.adoc b/docs/ua/modules/registry-develop/pages/registry-admin-study/study-tasks/task-6-set-file-upload-restrictions.adoc new file mode 100644 index 0000000000..59df498170 --- /dev/null +++ b/docs/ua/modules/registry-develop/pages/registry-admin-study/study-tasks/task-6-set-file-upload-restrictions.adoc @@ -0,0 +1,67 @@ += Завдання 6. Керування обмеженнями на завантаження цифрових документів у систему +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +== Мета завдання + +Виконання цього завдання має на меті: :: + +* [*] Навчити застосовувати обмеження на завантаження (upload) цифрових документів: + +** [*] для групи файлів; +** [*] для окремих файлів. + +== Передумови + +Ознайомтеся з інструкцією на сторінці xref:admin:registry-management/control-plane-digital-documents.adoc[]. + +== Процес виконання завдання + +[set-file-upload-restrictions] +=== Застосування обмеження на завантаження цифрових документів + +Для застосування обмежень на завантаження цифрових документів слідуйте наступним крокам: + +. Перевірте поточні обмеження. Для цього у редагуванні реєстру перейдіть на вкладку *Цифрові документи*. ++ +image:registry-develop:registry-admin-study/task-set-file-upload-restrictions/01-edit-registry.png[] + +. Застосуйте наступні обмеження: + +* Максимальний розмір файлу для завантаження, MB: *20*. +* Максимальний сумарний розмір групи файлів для завантаження, MB: *80*. + +. Підтвердьте відповідні зміни. ++ +[NOTE] +==== +Результатом буде запит на оновлення конфігурації реєстру із запропонованими змінами щодо обмежень завантаження файлів. + +image:registry-develop:registry-admin-study/task-set-file-upload-restrictions/02-set-values.png[] +==== + +. Поверніться у розділ *Реєстри* > *Запити на оновлення*, знайдіть та підтвердьте необхідний запит. Для цього натисніть іконку перегляду -- 👁, далі натисніть `*Підтвердити*`. ++ +image:admin:registry-management/cp-submit-mr/cp-submit-mr-1.png[] ++ +У результаті запит набуває статусу `Підтверджено`. + +. Перейдіть до сервісу *Jenkins* за посиланням *CI*. ++ +image:registry-develop:registry-admin-study/task-registry-resources-management/06-configuration.png[] + +. Проконтролюйте процес виконання пайплайну *MASTER-Build-``*. ++ +image:registry-develop:registry-admin-study/task-registry-resources-management/07-jenkins.png[] + +. Переконайтеся, що Jenkins-процес пройшов зі статусом *`SUCCESS`* ++ +image:registry-develop:registry-admin-study/task-registry-resources-management/08-check-success-status.png[] + +[NOTE] +==== +Результатом виконання завдання будуть нові встановлені ліміти для файлів. Перевірити це можна так: + +* У редагуванні реєстру поверніться на вкладку *Цифрові документи* та _переконайтеся, що нові значення встановлено_. ++ +image:registry-develop:registry-admin-study/task-set-file-upload-restrictions/03-check-values.png[] +==== \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/pages/registry-admin-study/study-tasks/task-7-add-registry-users.adoc b/docs/ua/modules/registry-develop/pages/registry-admin-study/study-tasks/task-7-add-registry-users.adoc new file mode 100644 index 0000000000..cca3736d10 --- /dev/null +++ b/docs/ua/modules/registry-develop/pages/registry-admin-study/study-tasks/task-7-add-registry-users.adoc @@ -0,0 +1,116 @@ += Завдання 7. Внесення користувачів до реєстру +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +== Мета завдання + +Виконання цього завдання має на меті: :: + +* [*] Навчити створювати користувачів у реєстрі. +* [*] Навчити видаляти користувачів з реєстру. + +== Передумови + +. Перед внесенням користувачів до реєстру завантажте файл із ключем для автентифікації: xref:attachment$registry-admin-study/add-registry-users/Key-6.dat[_Key-6.dat_]. + +. Ознайомтеся з інструкцією +xref:registry-develop:registry-admin/create-users/manual-user-creation.adoc[]. + +== Процес виконання завдання + +[#create-user] +=== Створення користувача + +Для того, щоб користувач мав змогу автентифікуватись у _Кабінеті користувача_, потрібно створити цього користувача у _Сервісі управління користувачами та ролями (Keycloak)_. + +Щоб створити користувача у реєстрі виконайте наступні кроки: + +. Перейдіть до розділу швидких посилань реєстру в інтерфейсі `Control Plane` та оберіть _Сервіс управління користувачами та ролями (Keycloak)_. ++ +image:registry-develop:registry-admin-study/task-add-registry-users/01-operational-platform-zone.png[] + +. Увійдіть за допомогою опції `openshift-sso`. ++ +image:registry-develop:registry-admin-study/task-add-registry-users/02-keycloak-openshift-sso.png[] + +. Перейдіть до адміністративної консолі Keycloak. ++ +image:registry-develop:registry-admin-study/task-add-registry-users/03-keycloak-administration-console.png[] + +. Керуючись пунктами 1.1-1.10 інструкції +xref:registry-develop:registry-admin/create-users/manual-user-creation.adoc#create-user[Створення користувача у системі], cтворіть користувача у реалмі `-officer-portal`, де `` -- назва вашого реєстру. Наприклад, `Admin-test-officer-portal`. ++ +[TIP] +==== +Для створення користувача у п.1.2 використайте наступні значення: + +* *Username*: `Сидоренко Василь` +* *Email*: `sidorenko@vasyl.ua` +* *First Name*: `Василь` +* *Last Name*: `Сидоренко` ++ +image:registry-develop:registry-admin-study/task-add-registry-users/04-keycloak-add-users.png[] +==== + +. У п. 1.7 додайте роль `officer`. ++ +image:registry-develop:registry-admin-study/task-add-registry-users/05-keycloak-role-mapping.png[] + +. У п. 1.9 використайте наступні значення: + +* `*drfo*` - `1010101014`; +* `*edrpou*` - `34554362`; +* `*fullName*` - `Сидоренко Василь Леонідович`. ++ +image:registry-develop:registry-admin-study/task-add-registry-users/06-keycloak-attributes.png[] ++ +[TIP] +==== +Перевірте, що користувач може увійти до _Кабінету користувача_. Для цього виконайте наступні кроки: + +. Перейдіть до _Швидких посилань_ > _Кабінет користувача_. ++ +image:registry-develop:registry-admin-study/task-add-registry-users/07-officer-portal.png[] + +. Увійдіть до _Кабінету користувача_, використовуючи наступні дані: ++ +image:registry-develop:registry-admin-study/task-add-registry-users/08-user-portal.png[] ++ +-- +* *Кваліфікований надавач ел. довірчих послуг:* `Тестовий ЦСК АТ "ІІТ"`; +* *Особистий ключ:* _Key-6.dat_ +* *Пароль захисту ключа:* `123` +-- ++ +image:registry-develop:registry-admin-study/task-add-registry-users/10-user-authentication-2.png[] + +. У результаті успішного виконання, користувач має змогу автентифікуватись у _Кабінеті користувача_. ++ +image:registry-develop:registry-admin-study/task-add-registry-users/11-user-authentication-3.png[] ++ +image:registry-develop:registry-admin-study/task-add-registry-users/12-success authentication.png[] +==== + +NOTE: Результатом створення користувача є вдалий вхід у _Кабінет користувача_ після попереднього створення користувача у Keycloak. + + +=== Видалення користувача + +. Вийдіть із профілю _Кабінету користувача_. ++ +image:registry-develop:registry-admin-study/task-add-registry-users/13-sign-off.png[] + +. Видаліть щойно створеного користувача із реалму `-officer-portal`, де `` -- назва вашого реєстру. Наприклад, `-*`. ++ +image:registry-develop:registry-admin-study/task-event-logging-kibana/01-index-pattern-step-1.png[] + +* У *Step 2* встановіть `@timestamp` для фільтра за часом та натисніть *`Create index pattern`*. ++ +image:registry-develop:registry-admin-study/task-event-logging-kibana/02-index-pattern-step-2.png[] + +=== Застосування фільтрів + +. Перейдіть до вкладки *Discover* та встановіть *Time Range* -- останні 30 днів (*Last 30 days*). ++ +image:registry-develop:registry-admin-study/task-event-logging-kibana/03-time-range.png[] + +. Оберіть щойно створений індекс-паттерн `*app*--*` та створіть комбінований фільтр: + +* `Kubernetes.pod_name` `is` `external-secrets-ххххххххх-ххххх` AND `Structured.level` `is` `error` ++ +image:registry-develop:registry-admin-study/task-event-logging-kibana/04-add-filters-1.png[] ++ +image:registry-develop:registry-admin-study/task-event-logging-kibana/05-add-filters-2.png[] + +[NOTE] +У результаті комбінований фільтр покаже лише помилки у конкретному поді. + +image:registry-develop:registry-admin-study/task-event-logging-kibana/06-filter-result.png[] + +=== Створення візуалізації даних + +. Перейдіть до вкладки *Visualize* та додайте нову візуалізацію. ++ +image:registry-develop:registry-admin-study/task-event-logging-kibana/07-visualize.png[] ++ +image:registry-develop:registry-admin-study/task-event-logging-kibana/08-new-visualization.png[] + +. Оберіть індекс `*app*--*`. ++ +image:registry-develop:registry-admin-study/task-event-logging-kibana/09-search-source.png[] + +[NOTE] +==== +У результаті ви побачите загальну кількість записів за вказаний проміжок часу. + +image:registry-develop:registry-admin-study/task-event-logging-kibana/10-visualization-results.png[] +==== diff --git a/docs/ua/modules/registry-develop/pages/registry-admin-study/study-tasks/task-9-platform-metrics-monitoring-grafana.adoc b/docs/ua/modules/registry-develop/pages/registry-admin-study/study-tasks/task-9-platform-metrics-monitoring-grafana.adoc new file mode 100644 index 0000000000..7c7b7f2e27 --- /dev/null +++ b/docs/ua/modules/registry-develop/pages/registry-admin-study/study-tasks/task-9-platform-metrics-monitoring-grafana.adoc @@ -0,0 +1,99 @@ += Завдання 9. Моніторинг метрик компонентів реєстру (Grafana) +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +== Мета завдання + +Виконання цього завдання має на меті: :: + +* [*] Отримати навички роботи з *Grafana* для моніторингу метрик компонентів реєстру. + +== Процес виконання завдання + +=== Ознайомлення з наявними Dashboards + +. Перейдіть до швидких посилань та оберіть *Grafana*. ++ +image:registry-develop:registry-admin-study/task-platform-metrics-monitoring-grafana/01-grafana.png[] + +. Оберіть *Sign in with OAuth*. ++ +image:registry-develop:registry-admin-study/task-platform-metrics-monitoring-grafana/09-sign-in-grafana.png[] + +. Автентифікуйтеся як адміністратор цього реєстру та натисніть *`Sign In`*. ++ +image:registry-develop:registry-admin-study/task-platform-metrics-monitoring-grafana/10-sign-in-openshift.png[] + +. Перейдіть до *Dashboards* > *Manage* > *Dashboards*. ++ +image:registry-develop:registry-admin-study/task-platform-metrics-monitoring-grafana/02-manage-dashboard.png[] ++ +image:registry-develop:registry-admin-study/task-platform-metrics-monitoring-grafana/03-manage-dashboard.png[] + +. Ознайомтеся із наявними *Dashboards*. ++ +image:registry-develop:registry-admin-study/task-platform-metrics-monitoring-grafana/11-dashboards.png[] ++ +image:registry-develop:registry-admin-study/task-platform-metrics-monitoring-grafana/12-dashboards.png[] ++ +[NOTE] +В рамках цього завдання буде розглянуто два дашборди із загального переліку. Інші пропонується дослідити самостійно. + +=== Ознайомлення із дашбордом Spring Boot + +. Перейдіть до *Dashboards* > *Manage* > *Dashboards* > *Spring Boot*. ++ +image:registry-develop:registry-admin-study/task-platform-metrics-monitoring-grafana/13-spring-boot-dashboard.png[] + +. Оберіть `namespace` тестового реєстру та под `bpms-xxxxxxxxxx-xxxxxxxxx`. ++ +image:registry-develop:registry-admin-study/task-platform-metrics-monitoring-grafana/04-sprint-boot-dashboard.png[] ++ +NOTE: Тут ви зможете побачити метрики `java`, які знаходяться у контейнері із сервісом цього поду. ++ +image:registry-develop:registry-admin-study/task-platform-metrics-monitoring-grafana/05-sprint-boot-dashboard.png[] + ++ +Зверніть увагу на показник `heap`, це також може бути актуально і для розробників. + +`Heap` -- це ділянка пам’яті, яка використовується для зберігання об'єктів, які були створені `java`-застосунком. Його поділено на менші ділянки, які називаються `generations`. +`Heap` є значною частиною віртуальної машини `Java (JVM)`, і нею керує збирач сміття (garbage collector), який відповідає за автоматичне відновлення невикористаної пам’яті. ++ +image:registry-develop:registry-admin-study/task-platform-metrics-monitoring-grafana/06-heap-statistics.png[] ++ +[IMPORTANT] +Якщо ви бачите, що використання `heap` зростає -- це може бути приводом звернутися до розробників та повідомити, що є або витоки пам'яті, або проблеми із `garbage collection`. + +=== Ознайомлення із дашбордом PostgreSQLDetails + +. Перейдіть до *Dashboards* > *Manage* > *Dashboards* > *PostgreSQLDetails*. ++ +image:registry-develop:registry-admin-study/task-platform-metrics-monitoring-grafana/14-postgresql-dashboard.png[] + +. Оберіть операційний або аналітичний под тестового реєстру. ++ +image:registry-develop:registry-admin-study/task-platform-metrics-monitoring-grafana/07-postgresql-details.png[] ++ +Зверніть увагу на показник `WAL`. ++ +`WAL` означає `Write Ahead Logging`. Коли у базі даних відбувається зміна (_наприклад, вставка, оновлення чи видалення_), *PostgreSQL* спочатку записує зміну в логи `WAL`, які зберігаються в пам’яті та на диску. ++ +Логи `WAL` допомагають відстежувати всі зміни, внесені в рамках транзакції, навіть до того, як вони будуть записані в основні файли даних. ++ +Основна мета `WAL`-- забезпечити довговічність даних. Спочатку, реєструючи зміни в логах, *PostgreSQL* гарантує збереження даних у разі збоїв апаратного чи програмного забезпечення. Коли система відновлюється після збою, *PostgreSQL* може використовувати журнали `WAL` для повторного відтворення змін і відновлення бази даних до узгодженого стану. ++ +`WAL` дозволяє *PostgreSQL* відкладати запис змінених даних до основних файлів даних, тим самим покращує продуктивність операцій запису. Операції запису зазвичай передбачають оновлення кількох файлів даних. Записуючи зміни до `WAL`, *PostgreSQL* може мінімізувати дисковий ввід-вивід і групувати кілька записів разом, тим самим підвищуючи загальну продуктивність запису. ++ +[IMPORTANT] +`WAL` потрібно перевіряти, тому що збільшення розміру `WAL`, може вказувати на зламану реплікацію, що може призвести до переповнення диска оперативного, а згодом й аналітичного екземпляра. ++ +image:registry-develop:registry-admin-study/task-platform-metrics-monitoring-grafana/08-wal.png[] + + + + + + + + + + + diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/overview.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/overview.adoc index f39ca30fcb..f3ef725b4e 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/overview.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/overview.adoc @@ -1 +1,17 @@ -= Моделювання регламенту \ No newline at end of file += Моделювання регламенту реєстру +:sectanchors: +:sectlinks: + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] + +Розділ *_Моделювання регламенту реєстру_* надає основні інструменти та методи для ефективної розробки та управління реєстром. Він починається зі встановлення _глобальних параметрів_ і переходить до розробки _моделей бізнес-процесів_. Далі розділ заглиблюється у дизайн _форм користувацького інтерфейсу_, сприяючи взаємодії з даними. Невіддільною частиною цього процесу є _таблиці_ — основні структури, де зберігаються дані реєстру. Для тих, хто прагне до точності, моделювання структури через _редактор XML-коду_ пропонує просунутий підхід. Також цей розділ охоплює управління _шаблонами аналітичної звітності_. + +За додатковим контекстом зверніться до відповідних сторінок розділу. + +== Огляд секції + +***** xref:registry-develop:registry-admin/admin-portal/registry-modeling/registry-global-settings.adoc[] +***** xref:registry-develop:registry-admin/admin-portal/registry-modeling/process-models/process-models-overview.adoc[] +***** xref:registry-develop:registry-admin/admin-portal/registry-modeling/ui-forms/ui-forms-overview.adoc[] +***** xref:registry-develop:registry-admin/admin-portal/registry-modeling/tables/tables-overview.adoc[] +***** xref:registry-develop:registry-admin/admin-portal/registry-modeling/report-templates.adoc[] \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/components/edit-groovy-scripts.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/components/edit-groovy-scripts.adoc index 5184988597..6d4fe82377 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/components/edit-groovy-scripts.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/components/edit-groovy-scripts.adoc @@ -1,23 +1,7 @@ -:toc-title: ЗМІСТ -:toc: auto -:toclevels: 5 -:experimental: -:important-caption: ВАЖЛИВО -:note-caption: ПРИМІТКА -:tip-caption: ПІДКАЗКА -:warning-caption: ПОПЕРЕДЖЕННЯ -:caution-caption: УВАГА -:example-caption: Приклад -:figure-caption: Зображення -:table-caption: Таблиця -:appendix-caption: Додаток -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Редагування скриптів бізнес-процесів у візуальному редакторі коду +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Загальний опис diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/components/process-components-overview.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/components/process-components-overview.adoc index a19d5393fb..58b3596ad2 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/components/process-components-overview.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/components/process-components-overview.adoc @@ -1,4 +1,6 @@ = Перегляд та редагування складових бізнес-процесу +:sectanchors: +:sectlinks: Адміністратор регламенту може працювати зі складовими бізнес-процесів на відповідних вкладках [.underline]#Загальна#, [.underline]#Код# та [.underline]#Конструктор#. diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/components/tab-bpmn-editor.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/components/tab-bpmn-editor.adoc index efcb78c76a..50ac284ce2 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/components/tab-bpmn-editor.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/components/tab-bpmn-editor.adoc @@ -1,23 +1,7 @@ -:toc-title: ЗМІСТ -:toc: auto -:toclevels: 5 -:experimental: -:important-caption: ВАЖЛИВО -:note-caption: ПРИМІТКА -:tip-caption: ПІДКАЗКА -:warning-caption: ПОПЕРЕДЖЕННЯ -:caution-caption: УВАГА -:example-caption: Приклад -:figure-caption: Зображення -:table-caption: Таблиця -:appendix-caption: Додаток -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Моделювання бізнес-процесів у BPMN-редакторі +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] Кабінет адміністратора регламентів дозволяє легко та просто моделювати бізнес-процеси за допомогою вбудованого вебредактора https://bpmn.io/[BPMN.io] у вашому браузері. Інструмент дозволяє _переглядати, створювати та редагувати_ діаграми у нотації *BPMN 2.0* на базі XML. @@ -77,4 +61,4 @@ image::registry-develop:registry-admin/admin-portal/process-models/process-model Детальніше про можливості роботи з кодом процесів ви можете переглянути на сторінці xref:registry-admin/admin-portal/registry-modeling/process-models/components/tab-code.adoc[] ==== -IMPORTANT: Усі зміни на вкладках xref:registry-admin/admin-portal/registry-modeling/process-models/create-process.adoc#tab-general[[.underline]#Загальна#], xref:registry-admin/admin-portal/registry-modeling/process-models/components/tab-code.adoc[[.underline]#Код#] та [.underline]#Конструктор# синхронізуються. Тобто, якщо ви зміните елемент у конструкторі, це відобразиться й у коді й навпаки. +NOTE: Усі зміни на вкладках xref:registry-admin/admin-portal/registry-modeling/process-models/create-process.adoc#tab-general[Загальна], xref:registry-admin/admin-portal/registry-modeling/process-models/components/tab-code.adoc[Код] та xref:registry-admin/admin-portal/registry-modeling/process-models/components/tab-bpmn-editor.adoc[Конструктор] синхронізуються. Тобто, якщо ви зміните елемент у конструкторі, це відобразиться й у коді й навпаки. diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/components/tab-code.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/components/tab-code.adoc index 8722ba8d46..4a077ce1cc 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/components/tab-code.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/components/tab-code.adoc @@ -1,36 +1,14 @@ -:toc-title: ЗМІСТ -:toc: auto -:toclevels: 5 -:experimental: -:important-caption: ВАЖЛИВО -:note-caption: ПРИМІТКА -:tip-caption: ПІДКАЗКА -:warning-caption: ПОПЕРЕДЖЕННЯ -:caution-caption: УВАГА -:example-caption: Приклад -:figure-caption: Зображення -:table-caption: Таблиця -:appendix-caption: Додаток -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: - = Перегляд та редагування коду XML-представлення процесів +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] Використовуйте можливості вкладки [.underline]#Код# для моделювання бізнес-процесів. Функціональність дозволяє працювати напряму з кодом процесу, тобто його XML-представленням. .XML-представлення бізнес-процесу у на вкладці [.underline]#Код# image::registry-develop:registry-admin/admin-portal/process-models/process-models-11.png[] -[CAUTION] -==== -Редагування складових регламенту реєстру можливе лише в рамках версій-кандидатів на внесення змін. Для майстер-версії доступна лише опція перегляду. - -Детальніше про особливості роботи з версіями регламенту дивіться на сторінці: - -* xref:registry-admin/admin-portal/version-control/version-control-overview.adoc[] -==== +include::partial$snippets/admin-portal-master-candidate-edit.adoc[] Звичайно, створювати BPMN-моделі напряму у коді складно і недоречно, коли під рукою є xref:registry-admin/admin-portal/registry-modeling/process-models/components/tab-bpmn-editor.adoc[візуальний редактор]. Водночас доступ до XML-коду відкриває нові можливості та полегшує моделювання, коли потрібно, наприклад: @@ -60,5 +38,4 @@ image::registry-develop:registry-admin/admin-portal/process-models/process-model .Вставлення коду BPMN-діаграми на вкладці [.underline]#Код# image::registry-develop:registry-admin/admin-portal/process-models/process-models-12-2.png[] - -IMPORTANT: Усі зміни на вкладках xref:registry-admin/admin-portal/registry-modeling/process-models/create-process.adoc#tab-general[[.underline]#Загальна#], [.underline]#Код# та xref:registry-admin/admin-portal/registry-modeling/process-models/components/tab-bpmn-editor.adoc[[.underline]#Конструктор#] синхронізуються. Тобто, якщо ви зміните елемент у конструкторі, це відобразиться й у коді, й навпаки. +NOTE: Усі зміни на вкладках xref:registry-admin/admin-portal/registry-modeling/process-models/create-process.adoc#tab-general[Загальна], xref:registry-admin/admin-portal/registry-modeling/process-models/components/tab-code.adoc[Код] та xref:registry-admin/admin-portal/registry-modeling/process-models/components/tab-bpmn-editor.adoc[Конструктор] синхронізуються. Тобто, якщо ви зміните елемент у конструкторі, це відобразиться й у коді, й навпаки. diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/copy-process.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/copy-process.adoc index df8d17e36a..a2b07e0437 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/copy-process.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/copy-process.adoc @@ -1,23 +1,7 @@ -:toc-title: ЗМІСТ -:toc: auto -:toclevels: 5 -:experimental: -:important-caption: ВАЖЛИВО -:note-caption: ПРИМІТКА -:tip-caption: ПІДКАЗКА -:warning-caption: ПОПЕРЕДЖЕННЯ -:caution-caption: УВАГА -:example-caption: Приклад -:figure-caption: Зображення -:table-caption: Таблиця -:appendix-caption: Додаток -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Копіювання бізнес-процесів +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] Використовуйте функціональність копіювання бізнес-процесів. Це дозволяє полегшити та пришвидшити створення схем процесів. Не потрібно моделювати процеси з нуля -- просто оберіть подібну діаграму, змодельовану раніше та скопіюйте її. @@ -35,11 +19,4 @@ image:registry-develop:registry-admin/admin-portal/process-models/process-models image:registry-develop:registry-admin/admin-portal/process-models/process-models-16.png[] -[CAUTION] -==== -Редагування складових регламенту реєстру можливе лише в рамках версій-кандидатів на внесення змін. Для майстер-версії доступна лише опція перегляду. - -Детальніше про особливості роботи з версіями регламенту дивіться на сторінці: - -* xref:registry-admin/admin-portal/version-control/version-control-overview.adoc[] -==== \ No newline at end of file +include::partial$snippets/admin-portal-master-candidate-edit.adoc[] \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/create-process.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/create-process.adoc index 4097ad3ce2..9247ac860c 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/create-process.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/create-process.adoc @@ -1,23 +1,7 @@ -:toc-title: ЗМІСТ -:toc: auto -:toclevels: 5 -:experimental: -:important-caption: ВАЖЛИВО -:note-caption: ПРИМІТКА -:tip-caption: ПІДКАЗКА -:warning-caption: ПОПЕРЕДЖЕННЯ -:caution-caption: УВАГА -:example-caption: Приклад -:figure-caption: Зображення -:table-caption: Таблиця -:appendix-caption: Додаток -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Створення бізнес-процесів +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] Кабінет адміністратора регламентів дозволяє легко та просто моделювати бізнес-процеси за допомогою вбудованого вебредактора https://bpmn.io/[BPMN.io] у вашому браузері. Функціональність надає можливості _перегляду, створення та редагування_ діаграм у нотації *BPMN 2.0* на базі XML. @@ -52,10 +36,12 @@ image:registry-develop:registry-admin/admin-portal/process-models/process-models Повинна бути унікальною у межах екземпляра реєстру. Довжина 3--50 символів. + Допустимі символи: "А-Z", "a-z", "0-9", "-", "_". При цьому цифри, "-" не можуть бути на початку, або в кінці службової назви. ==== - + image:registry-develop:registry-admin/admin-portal/process-models/process-models-3.png[] ++ +NOTE: Усі зміни на вкладках xref:registry-admin/admin-portal/registry-modeling/process-models/create-process.adoc#tab-general[Загальна], xref:registry-admin/admin-portal/registry-modeling/process-models/components/tab-code.adoc[Код] та xref:registry-admin/admin-portal/registry-modeling/process-models/components/tab-bpmn-editor.adoc[Конструктор] синхронізуються. Тобто, якщо ви зміните елемент у конструкторі, це відобразиться й у коді, й навпаки. + . Перейдіть на вкладку [.underline]#Конструктор# та змоделюйте бізнес-процес у вебредакторі. + TIP: Можливості вкладки [.underline]#Конструктор# більш детально описані на сторінці xref:registry-admin/admin-portal/registry-modeling/process-models/components/tab-bpmn-editor.adoc[]. @@ -98,11 +84,4 @@ image:registry-develop:registry-admin/admin-portal/process-models/process-models ==== -[CAUTION] -==== -Створення бізнес-процесу відбувається лише у межах вашої версії-кандидата. Як створити нову версію-кандидат -- дивіться на сторінці xref:registry-admin/admin-portal/version-control/create-new-change-request.adoc[]. - -Ви можете переглянути внесені зміни та їх статус у секції [.underline]#Внесені зміни# (детальніше -- на сторінці xref:registry-admin/admin-portal/version-control/overview-new-change-request.adoc#review-changes-candidate[Перегляд переліку внесених змін]). - -Якщо ви завершили створення бізнес-процесу і хочете опублікувати зміни у регламенті Gerrit-репозиторію, необхідно застосувати зміни до майстер-версії (детальніше -- на сторінці xref:registry-admin/admin-portal/version-control/overview-new-change-request.adoc#push-changes-master[Застосування змін до майстер-версії]). -==== \ No newline at end of file +include::partial$snippets/admin-portal-master-candidate-edit.adoc[] \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/delete-process.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/delete-process.adoc index 6bf1b92865..a81d781a35 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/delete-process.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/delete-process.adoc @@ -1,23 +1,7 @@ -:toc-title: ЗМІСТ -:toc: auto -:toclevels: 5 -:experimental: -:important-caption: ВАЖЛИВО -:note-caption: ПРИМІТКА -:tip-caption: ПІДКАЗКА -:warning-caption: ПОПЕРЕДЖЕННЯ -:caution-caption: УВАГА -:example-caption: Приклад -:figure-caption: Зображення -:table-caption: Таблиця -:appendix-caption: Додаток -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Видалення бізнес-процесів +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] Видаляйте непотрібні та застарілі бізнес-процеси -- тримайте регламент в актуальному стані. @@ -33,14 +17,7 @@ image:registry-develop:registry-admin/admin-portal/process-models/process-models [IMPORTANT] ==== -Видалення процесу відбувається у межах вашої версії-кандидата на внесення змін. Якщо необхідно видалити бізнес-процес із регламенту в Gerrit-репозиторії, необхідно xref:registry-admin/admin-portal/version-control/overview-new-change-request.adoc#push-changes-master[застосувати зміни до майстер-версії]. +Видалення процесу відбувається у межах вашої версії-кандидата на внесення змін. Якщо необхідно видалити бізнес-процес із регламенту в Gerrit-репозиторії, необхідно xref:registry-admin/admin-portal/version-control/candidate/overview-new-change-request.adoc#push-changes-master[застосувати зміни до майстер-версії]. ==== -[CAUTION] -==== -Редагування складових регламенту реєстру можливе лише в рамках версій-кандидатів на внесення змін. Для майстер-версії доступна лише опція перегляду. - -Детальніше про особливості роботи з версіями регламенту дивіться на сторінці: - -* xref:registry-admin/admin-portal/version-control/version-control-overview.adoc[] -==== \ No newline at end of file +include::partial$snippets/admin-portal-master-candidate-edit.adoc[] \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/edit-process.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/edit-process.adoc index a2ae857f8f..67e250c21b 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/edit-process.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/edit-process.adoc @@ -1,23 +1,7 @@ -:toc-title: ЗМІСТ -:toc: auto -:toclevels: 5 -:experimental: -:important-caption: ВАЖЛИВО -:note-caption: ПРИМІТКА -:tip-caption: ПІДКАЗКА -:warning-caption: ПОПЕРЕДЖЕННЯ -:caution-caption: УВАГА -:example-caption: Приклад -:figure-caption: Зображення -:table-caption: Таблиця -:appendix-caption: Додаток -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Редагування бізнес-процесів +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] Кабінет адміністратора регламентів дозволяє редагувати, змінювати та розвивати наявні бізнес-процеси. Якщо моделювальник припустився помилки у назві, або хоче змінити елемент діаграми процесів, чи підправити XML-код, то він може перейти до _режиму редагування_ та внести необхідні зміни. @@ -48,12 +32,9 @@ image:registry-develop:registry-admin/admin-portal/process-models/process-models + image:registry-develop:registry-admin/admin-portal/process-models/process-models-8.png[] ++ +Ви можете переглянути зміни та їх статус у секції [.underline]#Внесені зміни# (детальніше -- на сторінці xref:registry-admin/admin-portal/version-control/candidate/overview-new-change-request.adoc#review-changes-candidate[Перегляд переліку внесених змін]). ++ +Якщо ви завершили редагування в рамках версії-кандидата і хочете опублікувати зміни у регламенті реєстру, необхідно застосувати зміни до майстер-версії (детальніше -- на сторінці xref:registry-admin/admin-portal/version-control/candidate/overview-new-change-request.adoc#push-changes-master[Застосування змін до майстер-версії]). -[CAUTION] -==== -Редагування складових бізнес-процесу стосується лише вашої версії-кандидата. Як створити нову версію-кандидат -- дивіться на сторінці xref:registry-admin/admin-portal/version-control/create-new-change-request.adoc[]. - -Ви можете переглянути зміни та їх статус у секції [.underline]#Внесені зміни# (детальніше -- на сторінці xref:registry-admin/admin-portal/version-control/overview-new-change-request.adoc#review-changes-candidate[Перегляд переліку внесених змін]). - -Якщо ви завершили редагування і хочете опублікувати зміни у регламенті Gerrit-репозиторію, необхідно застосувати зміни до майстер-версії (детальніше -- на сторінці xref:registry-admin/admin-portal/version-control/overview-new-change-request.adoc#push-changes-master[Застосування змін до майстер-версії]). -==== +include::partial$snippets/admin-portal-master-candidate-edit.adoc[] diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/process-groups.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/process-groups.adoc index 70963ec21a..316116fc4f 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/process-groups.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/process-groups.adoc @@ -1,23 +1,7 @@ -:toc-title: ЗМІСТ -:toc: auto -:toclevels: 5 -:experimental: -:important-caption: ВАЖЛИВО -:note-caption: ПРИМІТКА -:tip-caption: ПІДКАЗКА -:warning-caption: ПОПЕРЕДЖЕННЯ -:caution-caption: УВАГА -:example-caption: Приклад -:figure-caption: Зображення -:table-caption: Таблиця -:appendix-caption: Додаток -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Категоризація доступних послуг у кабінетах користувачів +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Проблематика @@ -65,7 +49,7 @@ TIP: Ви можете згрупувати бізнес-процеси, від Адміністратор регламенту може створювати, перейменовувати та видаляти групи процесів. -NOTE: Усі операції зі створення та редагування можливо виконати лише в рамках версії-кандидата на внесення змін до регламенту. Для майстер-версії доступний лише режим перегляду (_детальніше -- див. xref:registry-admin/admin-portal/version-control/version-control-overview.adoc[]_). +include::partial$snippets/admin-portal-master-candidate-edit.adoc[] [#create-group] ==== Створення групи бізнес-процесів diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/process-models-overview.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/process-models-overview.adoc index 52c9095fa2..7da5af1455 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/process-models-overview.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/process-models-overview.adoc @@ -1,57 +1,30 @@ -:toc-title: ЗМІСТ -:toc: auto -:toclevels: 5 -:experimental: -:important-caption: ВАЖЛИВО -:note-caption: ПРИМІТКА -:tip-caption: ПІДКАЗКА -:warning-caption: ПОПЕРЕДЖЕННЯ -:caution-caption: УВАГА -:example-caption: Приклад -:figure-caption: Зображення -:table-caption: Таблиця -:appendix-caption: Додаток -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Управління моделями бізнес-процесів реєстру +:sectlinks: +:sectanchors: -image:registry-develop:registry-admin/admin-portal/process-models/process-models-1.png[] - -Розділ показує функціональність моделювання та управління схемами бізнес-процесів у Кабінеті адміністратора регламентів. Функціональність дозволяє: - -* [*] xref:registry-admin/admin-portal/registry-modeling/process-models/create-process.adoc[Створювати процеси] -* [*] xref:registry-admin/admin-portal/registry-modeling/process-models/edit-process.adoc[Редагувати процеси] -* [*] xref:registry-admin/admin-portal/registry-modeling/process-models/search-process.adoc[Шукати процеси за назвою] -* [*] xref:registry-admin/admin-portal/registry-modeling/process-models/copy-process.adoc[Копіювати процеси] -* [*] xref:registry-admin/admin-portal/registry-modeling/process-models/upload-process.adoc[Завантажувати (upload) процеси] -//TODO: TBD in future: Експортувати (download) процеси -* [*] xref:registry-admin/admin-portal/registry-modeling/process-models/sorting-process.adoc[Сортувати процеси] -* [*] xref:registry-develop:registry-admin/admin-portal/registry-modeling/process-models/process-groups.adoc[Категоризувати послуги] -* [*] xref:registry-admin/admin-portal/registry-modeling/process-models/delete-process.adoc[Видаляти процеси] -* [*] xref:registry-admin/admin-portal/registry-modeling/process-models/components/process-components-overview.adoc[Переглядати та редагувати складові процесів], а саме: +include::platform:ROOT:partial$admonitions/language-ua.adoc[] -** xref:registry-admin/admin-portal/registry-modeling/process-models/create-process.adoc#tab-general[керувати назвами процесу]; -** xref:registry-admin/admin-portal/registry-modeling/process-models/components/tab-code.adoc[переглядати та редагувати код XML-представлення процесів]; -** xref:registry-admin/admin-portal/registry-modeling/process-models/components/tab-bpmn-editor.adoc[моделювати процеси у BPMN-конструкторі]. +Розділ показує функціональність моделювання та управління схемами бізнес-процесів у Кабінеті адміністратора регламентів. -[CAUTION] -==== -Редагування складових регламенту реєстру можливе лише в рамках версій-кандидатів на внесення змін. Для майстер-версії доступна лише опція перегляду. +image:registry-develop:registry-admin/admin-portal/process-models/process-models-1.png[] -У рамках майстер-версії на внесення змін моделювальник регламенту може: +Функціональність дозволяє: :: -* переглядати доступні бізнес-процеси; -* сортувати бізнес-процеси; -* переглядати складові бізнес-процесів на вкладках [.underline]#Загальна#, [.underline]#Код# та [.underline]#Конструктор#. +* Створювати процеси +* Редагувати процеси +* Шукати процеси за назвою +* Копіювати процеси +* Завантажувати (upload) процеси +* Сортувати процеси +* Категоризувати процеси +* Видаляти процеси +* Переглядати та редагувати складові процесів, зокрема: -Детальніше про особливості роботи з версіями регламенту дивіться на сторінці: +** керувати назвами процесу; +** переглядати та редагувати код XML-представлення процесів; +** моделювати процеси у BPMN-редакторі. -* xref:registry-admin/admin-portal/version-control/version-control-overview.adoc[] -==== +include::partial$snippets/admin-portal-master-candidate-edit.adoc[] [WARNING] ==== @@ -63,6 +36,18 @@ image:registry-develop:registry-admin/admin-portal/process-models/process-models * Врахуйте, що видалення або зміна об'єкта може призвести до втрати даних та порушення бізнес-процесів. ==== +== Огляд секції + +* [*] xref:registry-admin/admin-portal/registry-modeling/process-models/create-process.adoc[Створення процесів] +* [*] xref:registry-admin/admin-portal/registry-modeling/process-models/edit-process.adoc[Редагування процесів] +* [*] xref:registry-admin/admin-portal/registry-modeling/process-models/search-process.adoc[Пошук процесів] +* [*] xref:registry-admin/admin-portal/registry-modeling/process-models/copy-process.adoc[Копіювання процесів] +* [*] xref:registry-admin/admin-portal/registry-modeling/process-models/upload-process.adoc[Завантаження (upload) процесів] +* [*] xref:registry-admin/admin-portal/registry-modeling/process-models/sorting-process.adoc[Сортування процесів] +* [*] xref:registry-develop:registry-admin/admin-portal/registry-modeling/process-models/process-groups.adoc[Категоризація процесів] +* [*] xref:registry-admin/admin-portal/registry-modeling/process-models/delete-process.adoc[Видалення процесів] +* [*] xref:registry-admin/admin-portal/registry-modeling/process-models/components/process-components-overview.adoc[Перегляд та редагування складових процесу] + diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/search-process.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/search-process.adoc index 64b36346ff..de238daae9 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/search-process.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/search-process.adoc @@ -1,23 +1,7 @@ -:toc-title: ЗМІСТ -:toc: auto -:toclevels: 5 -:experimental: -:important-caption: ВАЖЛИВО -:note-caption: ПРИМІТКА -:tip-caption: ПІДКАЗКА -:warning-caption: ПОПЕРЕДЖЕННЯ -:caution-caption: УВАГА -:example-caption: Приклад -:figure-caption: Зображення -:table-caption: Таблиця -:appendix-caption: Додаток -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Пошук процесів за назвою +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] Використовуйте функціональність пошуку бізнес-процесів за назвою. Це дозволяє полегшити та пришвидшити роботу зі схемами процесів. diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/sorting-process.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/sorting-process.adoc index b0c24fec7b..aee870ed34 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/sorting-process.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/sorting-process.adoc @@ -1,23 +1,7 @@ -:toc-title: ЗМІСТ -:toc: auto -:toclevels: 5 -:experimental: -:important-caption: ВАЖЛИВО -:note-caption: ПРИМІТКА -:tip-caption: ПІДКАЗКА -:warning-caption: ПОПЕРЕДЖЕННЯ -:caution-caption: УВАГА -:example-caption: Приклад -:figure-caption: Зображення -:table-caption: Таблиця -:appendix-caption: Додаток -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Сортування бізнес-процесів +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] Використовуйте функціональність сортування бізнес-процесів. Це дозволяє упорядкувати доступні моделі процесів у висхідному `↑` та низхідному `↓` порядку, покращити користувацький досвід та досліджувати історичність створення та модифікації процесів. diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/upload-process.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/upload-process.adoc index ad61455580..218c930c69 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/upload-process.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/process-models/upload-process.adoc @@ -1,22 +1,7 @@ -:toc-title: ЗМІСТ -:toc: auto -:toclevels: 5 -:experimental: -:important-caption: ВАЖЛИВО -:note-caption: ПРИМІТКА -:tip-caption: ПІДКАЗКА -:warning-caption: ПОПЕРЕДЖЕННЯ -:caution-caption: УВАГА -:example-caption: Приклад -:figure-caption: Зображення -:table-caption: Таблиця -:appendix-caption: Додаток -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: - = Завантаження (upload) бізнес-процесів +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] Завантажити бізнес-процес до регламенту можна через копіювання та вставлення XML-схеми готового процесу на вкладці [.underline]#Код#. Пряма опція `Drag & Drop` (перетягування файлу зі схемою) недоступна. @@ -25,16 +10,7 @@ image::registry-develop:registry-admin/admin-portal/process-models/process-model TIP: Детальніше про особливості роботи з кодом бізнес-процесу -- на сторінці xref:registry-admin/admin-portal/registry-modeling/process-models/components/tab-code.adoc[]. -[CAUTION] -==== -Редагування складових регламенту реєстру можливе лише в рамках версій-кандидатів на внесення змін. Для майстер-версії доступна лише опція перегляду. - -Детальніше про особливості роботи з версіями регламенту дивіться на сторінці: - -* xref:registry-admin/admin-portal/version-control/version-control-overview.adoc[] -==== - - +include::partial$snippets/admin-portal-master-candidate-edit.adoc[] diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/registry-global-settings.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/registry-global-settings.adoc index db1927b49f..68b0ec0866 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/registry-global-settings.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/registry-global-settings.adoc @@ -1,23 +1,7 @@ -:toc-title: ЗМІСТ -:toc: auto -:toclevels: 5 -:experimental: -:important-caption: ВАЖЛИВО -:note-caption: ПРИМІТКА -:tip-caption: ПІДКАЗКА -:warning-caption: ПОПЕРЕДЖЕННЯ -:caution-caption: УВАГА -:example-caption: Приклад -:figure-caption: Зображення -:table-caption: Таблиця -:appendix-caption: Додаток -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Управління глобальними налаштуваннями реєстру +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] Платформа надає можливість керувати глобальними налаштуваннями реєстру в інтерфейсі порталу адміністратора регламенту. diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/tables/tables-data-structures.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/tables/tables-data-structures.adoc index 90db78d287..0443a7da78 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/tables/tables-data-structures.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/tables/tables-data-structures.adoc @@ -1,23 +1,7 @@ -:toc-title: ЗМІСТ -:toc: auto -:toclevels: 5 -:experimental: -:important-caption: ВАЖЛИВО -:note-caption: ПРИМІТКА -:tip-caption: ПІДКАЗКА -:warning-caption: ПОПЕРЕДЖЕННЯ -:caution-caption: УВАГА -:example-caption: Приклад -:figure-caption: Зображення -:table-caption: Таблиця -:appendix-caption: Додаток -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Таблиці моделі даних реєстру та їх структури +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] Розробка регламенту передбачає розробку моделі даних реєстру. Кабінет адміністратора регламентів дозволяє працювати із таблицями бази даних реєстру у режимі перегляду (read-only). diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/tables/tables-overview.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/tables/tables-overview.adoc index 7338abcff3..351ab4553a 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/tables/tables-overview.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/tables/tables-overview.adoc @@ -1,4 +1,8 @@ = Таблиці +:sectlinks: +:sectanchors: + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Огляд секції diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/tables/xml-editor.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/tables/xml-editor.adoc index ff62a74238..fba28c162f 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/tables/xml-editor.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/tables/xml-editor.adoc @@ -1,23 +1,7 @@ -:toc-title: ЗМІСТ -:toc: auto -:toclevels: 5 -:experimental: -:important-caption: ВАЖЛИВО -:note-caption: ПРИМІТКА -:tip-caption: ПІДКАЗКА -:warning-caption: ПОПЕРЕДЖЕННЯ -:caution-caption: УВАГА -:example-caption: Приклад -:figure-caption: Зображення -:table-caption: Таблиця -:appendix-caption: Додаток -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Моделювання структури таблиць БД реєстру в XML-редакторі коду +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Загальні положення @@ -118,7 +102,7 @@ image:registry-develop:registry-admin/admin-portal/tables-data-structures/xml-ed . Застосуйте зміни до майстер-версії регламенту. + -TIP: Детальніше дивіться на сторінці xref:registry-admin/admin-portal/version-control/overview-new-change-request.adoc[]. +TIP: Детальніше дивіться на сторінці xref:registry-admin/admin-portal/version-control/candidate/overview-new-change-request.adoc[]. [WARNING] ==== diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/copy-forms.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/copy-forms.adoc index aa6a524b44..532faf5176 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/copy-forms.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/copy-forms.adoc @@ -5,7 +5,6 @@ include::platform:ROOT:partial$admonitions/language-ua.adoc[] Розробники регламенту мають можливість створювати дублікати UI-форм, що передбачає відтворення усіх їх складових, включаючи JSON-код і компоненти моделювання. Кожна копія отримує префікс `COPY_` у своїй назві. Ця функція особливо корисна, коли потрібно розробити ряд схожих форм або використовувати наявну форму як шаблон. - Копіюйте UI-форму наступним чином: . Оберіть розділ "UI-форми" у меню зліва. diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/create-forms.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/create-forms.adoc index f26088f33c..8bc37b1a0f 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/create-forms.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/create-forms.adoc @@ -4,12 +4,9 @@ include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc include::platform:ROOT:partial$admonitions/language-ua.adoc[] Розробники регламенту можуть легко створювати UI-форми для бізнес-процесів. -[NOTE] -==== -Щоб розпочати створення форми, спершу визначтеся з версією регламенту. -Наразі розробники можуть створювати та редагувати форми як майстер-версії, так і у версії-кандидаті регламенту. -Докладніше про версії змін читайте на сторінці xref:registry-develop:registry-admin/admin-portal/version-control/version-control-overview.adoc[]. -==== + +include::partial$snippets/admin-portal-master-candidate-edit.adoc[] + Для створення форми необхідно виконати наступні кроки: . Відкрийте розділ "UI-форми" у меню зліва. diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/edit-forms.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/edit-forms.adoc index 44cbccb36b..f39b944a4f 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/edit-forms.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/edit-forms.adoc @@ -19,4 +19,6 @@ image:registry-admin/admin-portal/ui-forms/ui-forms-2.png[] image:registry-admin/admin-portal/ui-forms/ui-forms-3.png[] TIP: Ознайомтеся детальніше зі складовими UI-форми на сторінці -xref:registry-admin/admin-portal/registry-modeling/ui-forms/form-tabs.adoc[] \ No newline at end of file +xref:registry-admin/admin-portal/registry-modeling/ui-forms/form-tabs.adoc[] + +include::partial$snippets/admin-portal-master-candidate-edit.adoc[] \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/json-code-view-edit.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/json-code-view-edit.adoc index 6245d08ce7..4b02e8b9c2 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/json-code-view-edit.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/json-code-view-edit.adoc @@ -1,29 +1,13 @@ -:toc-title: ЗМІСТ -:toc: auto -:toclevels: 5 -:experimental: -:important-caption: ВАЖЛИВО -:note-caption: ПРИМІТКА -:tip-caption: ПІДКАЗКА -:warning-caption: ПОПЕРЕДЖЕННЯ -:caution-caption: УВАГА -:example-caption: Приклад -:figure-caption: Зображення -:table-caption: Таблиця -:appendix-caption: Додаток -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Перегляд та редагування коду JSON-представлення форми +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] Платформа надає можливість переглядати та редагувати JSON-представлення форми на вкладці [.underline]#Код#. Функціональність дозволяє швидко та легко внести зміни до даних форми без використання конструктора для моделювання. -CAUTION: Редагування складових регламенту реєстру можливе лише в рамках версій-кандидатів на внесення змін. Для майстер-версії доступна лише опція перегляду. +include::partial$snippets/admin-portal-master-candidate-edit.adoc[] . Увійдіть до розділу для управління UI-формами. diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/ui-forms-overview.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/ui-forms-overview.adoc index eefbaeaa9d..a06b1eb0aa 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/ui-forms-overview.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/registry-modeling/ui-forms/ui-forms-overview.adoc @@ -1,6 +1,8 @@ += Управління схемами UI-форм реєстру :sectanchors: :sectlinks: -= Управління схемами UI-форм реєстру +:warning-caption: Попередження +:note-caption: Примітка include::platform:ROOT:partial$admonitions/language-ua.adoc[] @@ -11,24 +13,27 @@ image:registry-admin/admin-portal/ui-forms/ui-forms-1.png[] Розробники регламенту можуть зручно та легко працювати з UI-формами, використовуючи наступні функціональні можливості: * [*] Створення UI-форм -* [*] Редагування UI-форм -* [*] Навігація та пошук UI-форм -* [*] Копіювання UI-форм -* [*] Завантаження UI-форм -* [*] Сортування та пагінація UI-форм -* [*] Видалення форм -* [*] Перегляд та редагування складових форми (Вкладки) +* [*] Редагування UI-форм +* [*] Навігація та пошук UI-форм +* [*] Копіювання UI-форм +* [*] Завантаження UI-форм +* [*] Сортування та пагінація UI-форм +* [*] Видалення форм +* [*] Перегляд та редагування коду JSON-представлення форми +* [*] Перегляд та редагування складових форми (Вкладки) [WARNING] ==== -Рекомендації для збереження та видалення об'єктів у Кабінеті адміністратора регламентів: +Рекомендації для збереження та видалення об'єктів у Кабінеті адміністратора регламентів: :: -* Зверніть увагу, що у Кабінеті адміністратора регламентів немає попереджувальних вікон, тому будьте особливо уважні та обережні при роботі з об'єктами. +* Зверніть увагу, що у Кабінеті адміністратора регламентів може не бути попереджувальних вікон для деяких об'єктів, тому будьте особливо уважні та обережні. * Будьте особливо обережні та уважні при збереженні або видаленні об'єктів, таких як бізнес-процеси, форми тощо. * Перед створенням або видаленням об'єкта, рекомендується перевірити його, щоб уникнути непередбачуваних наслідків. * Врахуйте, що видалення або зміна об'єкта може призвести до втрати даних та порушення бізнес-процесів. ==== +include::partial$snippets/admin-portal-master-candidate-edit.adoc[] + == Огляд секції * xref:registry-admin/admin-portal/registry-modeling/ui-forms/create-forms.adoc[Створення UI-форм] @@ -38,4 +43,5 @@ image:registry-admin/admin-portal/ui-forms/ui-forms-1.png[] * xref:registry-admin/admin-portal/registry-modeling/ui-forms/download-forms.adoc[Завантаження UI-форм] * xref:registry-admin/admin-portal/registry-modeling/ui-forms/sorting-paginating-forms.adoc[Сортування та пагінація UI-форм] * xref:registry-admin/admin-portal/registry-modeling/ui-forms/delete-forms.adoc[Видалення форм] +* xref:registry-develop:registry-admin/admin-portal/registry-modeling/ui-forms/json-code-view-edit.adoc[Перегляд та редагування коду JSON-представлення форми] * xref:registry-admin/admin-portal/registry-modeling/ui-forms/form-tabs.adoc[Перегляд та редагування складових форми (Вкладки)] \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/version-control/candidate/check-regulations-integrity.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/version-control/candidate/check-regulations-integrity.adoc new file mode 100644 index 0000000000..0be5df6941 --- /dev/null +++ b/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/version-control/candidate/check-regulations-integrity.adoc @@ -0,0 +1,73 @@ += Перевірка цілісності запитів на внесення змін до регламенту +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +== Проблематика + +Компоненти xref:arch:architecture/registry/administrative/regulation-management/registry-regulation/registry-regulation.adoc[цифрового регламенту реєстру] мають внутрішні зв'язки, які раніше перевірялись лише частково. Це викликало проблеми зі своєчасним виявленням помилок під час внесення змін у регламент. + +== Загальний опис + +Платформа підтримує систему розширеної валідації для забезпечення перевірки таких аспектів: + +* Взаємозв'язки між директоріями +* Взаємозв'язки у делегатах бізнес-процесів +* Залежності для JUEL-функцій бізнес-процесів + +[NOTE] +_Цілісний запит на внесення змін_ -- це запит на зміни, після застосування якого, всі компоненти регламенту реєстру зберігають валідні взаємозв'язки. + +Наприклад, при використанні делегата у бізнес-процесі зі створення сутності можна виконати перевірку щодо наявності відповідної таблиці у моделі даних. Якщо така таблиця відсутня, то запит на внесення змін вважається не цілісним і не може бути інтегрований до мастер-гілки регламенту. + +== Перевірка взаємозв'язків між директоріями регламенту реєстру + +У Вебінтерфейсі моделювання регламенту розробник може внести зміни до наявного бізнес-процесу або створити новий через версію-кандидат. + +Наприклад, при редагуванні форми, яка містить пошуковий запит, на вкладці *Data* компонента xref:registry-develop:bp-modeling/forms/components/select/select-overview.adoc[Select] ви внесли та зберегли неправильну назву точки інтеграції, яка відсутня у дата-моделі: + +* Правильне значення: `+++/officer/api/data-factory/factor-all+++` +* Помилкове значення: `+++/api/data-factory/folders+++`. + +image:registry-develop:registry-admin/admin-portal/version-control/regulations-integrity/regulations-integrity-1.png[] + +== Перевірка залежності для JUEL-функцій бізнес-процесів + +При використанні *Script Task* розробник може використовувати JUEL-функції у скрипті (_детальніше див. xref:bp-modeling/bp/modeling-facilitation/modelling-with-juel-functions.adoc[]_). + +Наприклад, що у такому скрипті ви передали JUEL-функції та зберегли некоректне значення ідентифікатора задачі: + +* Правильне значення: `submission('signRequest+++DataFormActivity+++')` + +* Неправильне значення: `submission('signRequest+++FolderFormActivity+++')` + +image:registry-develop:registry-admin/admin-portal/version-control/regulations-integrity/regulations-integrity-2.png[] + +== Перевірка взаємозв'язків при використанні типових розширень бізнес-процесів + +Розробник регламенту у сервісній задачі (*Service Task*) може використати типове розширення. Наприклад, *Create entity in data factory* (_детальніше про створення сутностей див. xref:bp-modeling/bp/element-templates/service-task-templates/create-entity.adoc[]_), де у полі *Resource* необхідно вказати ресурс (назву таблиці) для збереження даних. + +Наприклад, ви вказали значення, яке відсутнє у базі даних: + +image:registry-develop:registry-admin/admin-portal/version-control/regulations-integrity/regulations-integrity-3.png[] + +== Помилки валідації в логах пайплайну застосування змін до регламенту + +Під час виконання пайплайну *MASTER-Code-review-registry-regulations* проходить додатковий крок валідації, який підсвічується жовтим кольором та сигналізує про наявні помилки, деталі яких зберігаються у логах. + +image:registry-develop:registry-admin/admin-portal/version-control/regulations-integrity/regulations-integrity-4.png[] + +[NOTE] +==== +Тобто, після внесення некоректних даних до JUEL-функції, типового розширення та пошукового запита, система перевіряє ці дані та відображає ідентифікатори задач зі вказаними помилками. +==== + +image:registry-develop:registry-admin/admin-portal/version-control/regulations-integrity/regulations-integrity-5.png[] + +Така сама валідація проходить і на пайплайні *MASTER-Build-registry-regulations* при застосуванні некоректних змін до мастер-версії регламенту. + +image:registry-develop:registry-admin/admin-portal/version-control/regulations-integrity/regulations-integrity-6.png[] + +[IMPORTANT] +==== +Для релізу `1.9.7`, знайдені помилки не перешкоджають подальшому розгортанню регламенту при проходженні інших кроків пайплайну. +==== + diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/version-control/create-new-change-request.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/version-control/candidate/create-new-change-request.adoc similarity index 89% rename from docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/version-control/create-new-change-request.adoc rename to docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/version-control/candidate/create-new-change-request.adoc index 2e5ba452d3..9e92fef8da 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/version-control/create-new-change-request.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/version-control/candidate/create-new-change-request.adoc @@ -21,11 +21,11 @@ include::platform:ROOT:partial$admonitions/language-ua.adoc[] -Після розгортання регламенту реєстру, доступна лише одна версія змін -- xref:registry-admin/admin-portal/version-control/master-version-settings.adoc[майстер-версія]. +Після розгортання регламенту реєстру, доступна лише одна версія змін -- xref:registry-admin/admin-portal/version-control/master/master-version-settings.adoc[майстер-версія]. Користувач має змогу створити новий запит на внесення змін. Операція призведе до створення нового запита на внесення змін до регламенту на базі поточної майстер-версії. Кожний такий запит створює нову гілку, тобто версію-кандидат, в рамках якої вносяться зміни до регламенту. -IMPORTANT: Вносити будь-які зміни до регламенту неможливо у майстер-версії. Необхідно створити новий запит на внесення змін, в рамках якого виконувати роботу з регламентом. +include::partial$snippets/admin-portal-master-candidate-edit.adoc[] IMPORTANT: Будь-яка нова версія змін завжди створюється на базі останніх змін майстер-версії. Тобто навіть якщо ви перебуваєте на версії-кандидаті й хоче створити новий запит на внесення змін, то нова версія-кандидат однаково створюється на основі майстер-версії. @@ -62,7 +62,7 @@ image:registry-admin/admin-portal/new-admin-portal-3-1.png[] image:registry-admin/admin-portal/new-admin-portal-4.png[] -Після створення нової версії-кандидата, можна xref:registry-admin/admin-portal/version-control/overview-new-change-request.adoc[переглянути її стан та налаштування]. +Після створення нової версії-кандидата, можна xref:registry-admin/admin-portal/version-control/candidate/overview-new-change-request.adoc[переглянути її стан та налаштування]. diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/version-control/overview-new-change-request.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/version-control/candidate/overview-new-change-request.adoc similarity index 94% rename from docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/version-control/overview-new-change-request.adoc rename to docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/version-control/candidate/overview-new-change-request.adoc index 8465f1af67..d8617865cc 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/version-control/overview-new-change-request.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/version-control/candidate/overview-new-change-request.adoc @@ -1,27 +1,12 @@ -= Перегляд метаданих та управління налаштуваннями версії-кандидата -:toc-title: ЗМІСТ -:toc: auto -:toclevels: 5 -:experimental: -:important-caption: ВАЖЛИВО -:note-caption: ПРИМІТКА -:tip-caption: ПІДКАЗКА -:warning-caption: ПОПЕРЕДЖЕННЯ -:caution-caption: УВАГА -:example-caption: Приклад -:figure-caption: Зображення -:table-caption: Таблиця -:appendix-caption: Додаток -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: += Перегляд та управління налаштуваннями версії-кандидата +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] [#general-description] == Загальний опис -В результаті xref:registry-admin/admin-portal/version-control/create-new-change-request.adoc[створення нової версії-кандидата] на внесення змін до регламенту реєстру, можна переглянути її стан та налаштування. +В результаті xref:registry-admin/admin-portal/version-control/candidate/create-new-change-request.adoc[створення нової версії-кандидата] на внесення змін до регламенту реєстру, можна переглянути її стан та налаштування. Знайти нову версію-кандидат можна у лівому верхньому куті сторінки, розгорнувши випадний список для управління версіями регламенту. diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/version-control/master-version-settings.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/version-control/master/master-version-settings.adoc similarity index 79% rename from docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/version-control/master-version-settings.adoc rename to docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/version-control/master/master-version-settings.adoc index fd3ba5ffe8..772f0761e0 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/version-control/master-version-settings.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/version-control/master/master-version-settings.adoc @@ -22,4 +22,4 @@ image:registry-admin/admin-portal/new-admin-portal-1-1.png[] Надалі список налаштувань майстер-версії буде розширено. -IMPORTANT: Вносити будь-які зміни до регламенту неможливо у майстер-версії. Необхідно xref:registry-admin/admin-portal/version-control/create-new-change-request.adoc[створити новий запит на внесення змін], в рамках якого виконувати роботу з регламентом. \ No newline at end of file +include::partial$snippets/admin-portal-master-candidate-edit.adoc[] \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/version-control/version-control-overview.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/version-control/version-control-overview.adoc index 2687c6470d..2dd23775bd 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/version-control/version-control-overview.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin/admin-portal/version-control/version-control-overview.adoc @@ -1,7 +1,22 @@ = Управління версіями регламенту +Розділ зосереджується на важливості та механізмах управління різними версіями регламенту. Він детально висвітлює процеси створення, огляду, налаштування та валідації змін, забезпечуючи точне та ефективне управління регламентними версіями. + +Огляд та налаштування мастер-версії :: +Перегляд та налаштування майстер-версії змін є ключовим елементом для забезпечення стабільності та актуальності регламенту. + +Створення запитів на внесення змін :: + Запити на зміни завжди базуються на останніх змінах майстер-версії, незалежно від поточної версії-кандидата, з якою працює користувач. + +Перегляд та управління версією-кандидатом :: +Після створення нової версії-кандидата, можна переглянути її стан та налаштування, використовуючи інтуїтивний інтерфейс управління версіями. + +Перевірка цілісності запитів на внесення змін :: +Платформа використовує розширену систему валідації для забезпечення цілісності змін, перевіряючи взаємозв'язки між директоріями, у делегатах бізнес-процесів та залежності для JUEL-функцій. + == Огляд секції -* [*] xref:registry-admin/admin-portal/version-control/master-version-settings.adoc[] -* [*] xref:registry-admin/admin-portal/version-control/create-new-change-request.adoc[] -* [*] xref:registry-admin/admin-portal/version-control/overview-new-change-request.adoc[] \ No newline at end of file +* xref:registry-develop:registry-admin/admin-portal/version-control/master/master-version-settings.adoc[] +* xref:registry-develop:registry-admin/admin-portal/version-control/candidate/create-new-change-request.adoc[] +* xref:registry-develop:registry-admin/admin-portal/version-control/candidate/overview-new-change-request.adoc[] +* xref:registry-develop:registry-admin/admin-portal/version-control/candidate/check-regulations-integrity.adoc[] \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/api-rate-limits.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/api-rate-limits.adoc index 060af38074..20ec244de4 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin/api-rate-limits.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin/api-rate-limits.adoc @@ -1,29 +1,13 @@ = API Рейт-ліміти: обмеження кількості запитів за одиницю часу -:toc-title: ЗМІСТ -:toc: auto -:toclevels: 5 -:experimental: -:important-caption: ВАЖЛИВО -:note-caption: ПРИМІТКА -:tip-caption: ПІДКАЗКА -:warning-caption: ПОПЕРЕДЖЕННЯ -:caution-caption: УВАГА -:example-caption: Приклад -:figure-caption: Зображення -:table-caption: Таблиця -:appendix-caption: Додаток -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Загальний опис -____ -Рейт-лімітування (_англ. -- Rate limiting_) -- це стратегія для обмеження мережевого трафіку. -____ -_API рейт-ліміти_ (_англ. -- API Rate Limits_) -- обмеження кількості HTTP-запитів до сервісу чи маршруту за заданий період секунд, хвилин, годин, днів, місяців або років. +TIP: Рейт-лімітування (_англ. -- Rate limiting_) -- це стратегія для обмеження мережевого трафіку. + +_API рейт-ліміти_ (_англ. -- **API rate limits**_) -- обмеження кількості HTTP-запитів до сервісу чи маршруту за заданий період секунд, хвилин, годин, днів, місяців або років. Механізм рейт-лімітів реалізований на базі https://docs.konghq.com/hub/kong-inc/rate-limiting/[Rate-Limiting]-плагіну для Kong API Gateway. Якщо сервіс/маршрут не має рівня аутентифікації, ліміт буде встановлено для IP-адреси клієнта. В іншому випадку для лімітів можна використовувати значення власного заголовка запита, що містить інформацію про користувача: наприклад, ідентифікатор diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/change-dev-prod-mode.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/change-dev-prod-mode.adoc index 56601e1dff..97d5f51816 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin/change-dev-prod-mode.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin/change-dev-prod-mode.adoc @@ -74,6 +74,8 @@ global: . Виконайте `git commit` зі змінами, застосуйте зміни до `master`-гілки та запустіть розгортання реєстру. +//// + [NOTE] Налаштування *Redash admin* та *Pgadmin* є опційними й потрібні лише як додаткові кроки при виникненні проблем зі зміною режиму розгортання. Ми рекомендуємо ознайомитися з ними, але врахуйте, що вони не є обов'язковими для зміни `deploymentMode`. diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/cp-auth-setup/auth-setup-registry-federation.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/cp-auth-setup/auth-setup-registry-federation.adoc new file mode 100644 index 0000000000..a014cc5215 --- /dev/null +++ b/docs/ua/modules/registry-develop/pages/registry-admin/cp-auth-setup/auth-setup-registry-federation.adoc @@ -0,0 +1,189 @@ += Налаштування автентифікації для групи реєстрів +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] + +== Загальний опис + +Адміністратори реєстру можуть налаштувати автентифікацію для групи реєстрів, об’єднаних за визначеною ознакою. Доступ до реєстрів надається зі спрощеним механізмом автентифікації через SSO та авторизацією, яка налаштовується на рівні окремих реєстрів. + +Функціональність включає такі можливості та переваги: + +* використання master-ріалму; +* налаштуванню автентифікаторів для групи реєстрів; +* налаштуванню Identity Brokering для ріалмів реєстрів та master-ріалму, яка покриває наступні сценарії. + +== Налаштування автентифікації для групи реєстрів + +Щоб налаштувати автентифікацію для групи реєстрів, необхідно виконати наступні кроки: + +. Визначте реєстри, які повинні бути в рамках однієї групи. Наприклад: `student-reg` та `school-reg`. ++ +NOTE: В рамках однієї групи можливо налаштувати автентифікацію для двох і більше реєстрів. ++ +image:registry-develop:registry-admin/auth-setup/registry-federation/01-registry-federation.png[] + +. Увійдіть до *Control-Plane*, відкрийте Керування Платформою та перейдіть в *Gerrit*. +. Визначте з якої гілки розгортається `user-management`. Для цього: + +.. Перейдіть за шляхом *Browse* (1) > *Repositories* (2). Введіть `cluster-mgmt` у полі пошуку (3) та натисніть на репозиторій з ім’ям *_cluster-mgmt_* (4). ++ +image:registry-develop:registry-admin/auth-setup/registry-federation/02-registry-federation.png[] + +.. У новому вікні перейдіть до *Branches* (1) > `master` (2). ++ +image:registry-develop:registry-admin/auth-setup/registry-federation/03-registry-federation.png[] + +.. Перейдіть у папку *_tree_* (1) > *_properties_* (2). ++ +image:registry-develop:registry-admin/auth-setup/registry-federation/04-registry-federation.png[] + +.. Знайдіть та відкрийте файл _cluster-mgmt.yaml_. + +.. У цьому файлі знайдіть блок `user-management` та його гілку (`branch`) через пошук по сторінці kbd:[Ctrl+F]. ++ +image:registry-develop:registry-admin/auth-setup/registry-federation/05-registry-federation.png[] + +. Внесіть необхідні зміни в репозиторій *_user-management_*: + +.. Перейдіть за шляхом *Browse* (1) > *Repositories* (2). Впишіть *user-management* в полі пошуку (3) та натисніть на репозиторій з ім’ям *components/infra/user-management* (4). ++ +image:registry-develop:registry-admin/auth-setup/registry-federation/06-registry-federation.png[] + +.. Перейдіть на *Commands* (1) > *`CREATE CHANGE`* (2) у новому вікні. ++ +image:registry-develop:registry-admin/auth-setup/registry-federation/07-registry-federation.png[] + +.. У спливному вікні у полі *Select branch for new change* (1) оберіть гілку, яку визначили у пункті 2 та зазначте *Description* (2). Натисніть *`CREATE`* (3). ++ +image:registry-develop:registry-admin/auth-setup/registry-federation/08-registry-federation.png[] + +.. У новому вікні натисніть *`EDIT`*. ++ +image:registry-develop:registry-admin/auth-setup/registry-federation/09-registry-federation.png[] + +.. Створіть файл за шляхом _deploy-templates/keycloak-idps/templates/FederationRealm.yaml_. + +... Натисніть *`ADD/OPEN/UPLOAD`*. ++ +image:registry-develop:registry-admin/auth-setup/registry-federation/10-registry-federation.png[] + +... У спливному вікні впишіть шлях до файлу. ++ +image:registry-develop:registry-admin/auth-setup/registry-federation/11-registry-federation.png[] + +... Впишіть контент файлу (1) та натисніть *`SAVE`* (2). ++ +TIP: Контент файлу можна знайти у вкладенні +xref:attachment$/registry-admin/auth-setup/registry-federation/FederationRealm.yaml[_FederationRealm.yaml_]. ++ +image:registry-develop:registry-admin/auth-setup/registry-federation/12-registry-federation.png[] + +.. За аналогією створіть файл за шляхом _deploy-templates/keycloak-idps/templates/ DsoOfficerAuthFlow.yaml_. ++ +TIP: Контент файлу можна знайти у вкладенні +xref:attachment$/registry-admin/auth-setup/registry-federation/DsoOfficerAuthFlow.yaml[_DsoOfficerAuthFlow.yaml_]. + +.. За аналогією створіть файл за шляхом _deploy-templates/keycloak-idps/templates/ FederationClient.yaml_. ++ +TIP: Контент файлу можна знайти у вкладенні +xref:attachment$/registry-admin/auth-setup/registry-federation/FederationClient.yaml[_FederationClient.yaml_]. + +.. За аналогією створіть файл за шляхом _deploy-templates/keycloak-idps/templates/ RegistryFederationAuthFlow.yaml_. ++ +TIP: Контент файлу можна знайти у вкладенні +xref:attachment$/registry-admin/auth-setup/registry-federation/RegistryFederationAuthFlow.yaml[_RegistryFederationAuthFlow.yaml_]. + +.. Відредагуйте файл _deploy-templates/values.yaml_: + +... Натисніть *`ADD/OPEN/UPLOAD`*; +... У спливаючому вікні впишіть шлях _deploy-templates/values.yaml_; +... В кінці файлу додайте такі значення зі збереженням відступів, як зазначено нижче. ++ +[source,yaml] +---- +registryFederation: + name: "school-federation" + widgetUrl: 'https://eu.iit.com.ua/sign-widget/v20200922/' + widgetHeight: '720' + selfRegistrationEnabled: 'false' + registries: + - name: "school-reg" + selfRegistrationEnabled: false + - name: "student-reg" + selfRegistrationEnabled: false +---- ++ +[NOTE] +Змініть наступні значення: + +* У значенні *name* впишіть назву групи реєстрів (дозволена тільки латиниця через дефіс); +* У значенні *widgetUrl* впишіть повну URL-адресу віджету, який буде використовуватись усіма реєстрами із групи. +//TODO: url ??Віджет +* У значенні *selfRegistrationEnabled* -- впишіть `true`, якщо для групи реєстрів потрібна автореєстрація користувачів. +* У значенні *registries* -- впишіть список всіх реєстрів групи де `name` -- це назва реєстру як в `Control-Plane` та `selfRegistrationEnabled` – `true`, якщо для саме цього реєстру необхідна автореєстрація користувачів. ++ +image:registry-develop:registry-admin/auth-setup/registry-federation/13-registry-federation.png[] + +... Натисніть *`SAVE & PUBLISH`*. + +.. Після чого натисніть *START REVIEW* (1) > *Code-Review* +2 та *Verified* +1 > *`SEND AND START REVIEW`*(3). ++ +image:registry-develop:registry-admin/auth-setup/registry-federation/14-registry-federation.png[] + +.. Натисніть *`Submit`*. ++ +image:registry-develop:registry-admin/auth-setup/registry-federation/15-registry-federation.png[] + +. Перейдіть у Jenkins (з вкладки Керування платформою на Control-Plane) та запустіть збірку `cluster-mgmt`. У полі пошуку впишіть *cluster-mgmt MASTER-Build-cluster-mgmt* та натисніть *Enter* (1) > *Build with Parameters* (2) > *Build* (3). +//TODO: Build=збірка??? ++ +image:registry-develop:registry-admin/auth-setup/registry-federation/16-registry-federation.png[] + +. Перейдіть до *Gerrit* та виконайте наступні налаштування для кожного реєстру з групи. + +.. Перейдіть за шляхом *Browse* > *Repositories*. Впишіть назву реєстру в полі пошуку (так як в Control Plane). Натисніть на репозиторій з назвою реєстру (по аналогії з кроком 3.a). +//TODO: так як = за аналогією? + +.. Перейдіть на *Commands* > *`CREATE CHANGE`* (по аналогії з кроком 3.b) у новому вікні . + +.. У спливаючому вікні у полі *Select branch for new change* (1) оберіть гілку *master* та зазначте *Description* (2). Натисніть *`CREATE`* (3) (по аналогії з кроком 3.c). + +.. У новому вікні натисніть *`EDIT`* (по аналогії з кроком 3.d). + +.. Натисніть *`ADD/OPEN/UPLOAD`*. + +.. У спливаючому вікні впишіть шлях _deploy-templates/values.yaml_. + +.. У відкритому файлі знайдіть `officerAuthFlow` та під ним додайте наступне, згідно з наведеним нижче прикладом. ++ +[source,yaml] +---- +authenticators: + dsOfficerAuthenticator: + priority: 2 + federationIdpAuth: + name: identity-provider-redirector + requirement: ALTERNATIVE + priority: 1 + authenticatorConfig: + defaultProvider: "federation-idp" +---- ++ +image:registry-develop:registry-admin/auth-setup/registry-federation/17-registry-federation.png[] + +.. Натисніть *`SAVE & PUBLISH`*. + +.. Після чого натисніть *START REVIEW* > *Code-Review* +2 та *Verified* +1 > *`SEND AND START REVIEW`*. + +.. Натисніть *`Submit`*. + +. Зачекайте 10-20 хвилин поки у Jenkins не відбудеться збірка реєстрів. + +. Якщо в групі реєстрів вимкнена автореєстрація користувачів, то кожного користувача реєстру треба додати в Keycloak в реалмі `registry-federation-`, де `` -- це назва групи реєстру. + +[NOTE] +Зверніть увагу, що кнопка `+++На стартову+++` (1) на сторінці автентифікації у групі реєстрів буде повертати на головну сторінку Keycloak замість _Кабінету користувача_. Замість неї треба користуватись кнопкою `+++назад+++`, яка передбачена у браузері (2). ++ +image:registry-develop:registry-admin/auth-setup/registry-federation/18-registry-federation.png[] + diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/cp-auth-setup/cp-auth-setup-citizens.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/cp-auth-setup/cp-auth-setup-citizens.adoc index 2bacc28db8..59807f141f 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin/cp-auth-setup/cp-auth-setup-citizens.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin/cp-auth-setup/cp-auth-setup-citizens.adoc @@ -1,27 +1,12 @@ -:toc-title: ЗМІСТ -:toc: auto -:toclevels: 5 -:experimental: -:important-caption: ВАЖЛИВО -:note-caption: ПРИМІТКА -:tip-caption: ПІДКАЗКА -:warning-caption: ПОПЕРЕДЖЕННЯ -:caution-caption: УВАГА -:example-caption: Приклад -:figure-caption: Зображення -:table-caption: Таблиця -:appendix-caption: Додаток -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - -= Перевірка наявності активного запису в ЄДР для бізнес-користувачів += Налаштування автентифікації та підпису даних для отримувачів послуг +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +[#edr-check] +== Перевірка наявності активного запису в ЄДР для бізнес-користувачів WARNING: Відключення перевірки в ЄДР доступне для версій реєстру 1.9.4 і вище. -== Загальний опис +=== Загальний опис Перевірка наявності активного запису в ЄДР для бізнес-користувачів дозволяє встановити зв'язок між КЕП користувача та його юридичною особою чи фізичною особою-підприємцем, що зареєстровані в Єдиному державному реєстрі (ЄДР). Це важливий аспект безпеки та надійності системи, який допомагає забезпечити відповідність даних користувача та підтвердження їх особистості. @@ -33,7 +18,7 @@ image:release-notes:wn-1-9-4/whats-new-1-9-4-1.png[] * Впевненість у тому, що користувачі, які аутентифікуються як представники юридичних осіб або фізичних осіб-підприємців, дійсно мають повноваження діяти від імені цих осіб. * Забезпечення послідовності та актуальності даних користувачів, оскільки система автоматично порівнює дані з ЄДР під час аутентифікації. -== Налаштування +=== Налаштування Адміністратори реєстру можуть налаштовувати перевірку наявності активного запису в ЄДР для бізнес-користувачів через адміністративну панель *Control Plane*, у розділі +++ Реєстри +++ > +++Автентифікація отримувачів послуг +++. Вони можуть включити або відключити цю функціональність відповідно до вимог безпеки та політики організації. @@ -56,6 +41,9 @@ image:registry-admin/cp-auth-setup-citizens/cp-auth-setup-citizens-1.png[] Детальніше про це -- див. на сторінці xref:registry-admin/external-integration/cp-integrate-trembita.adoc[]. ==== +. Перейдіть до налаштувань автентифікації у розділі xref:#setup-auth-sign[]. + +//// . Натисніть кнопку kbd:[Підтвердити], щоб зберегти зміни. + У результаті система сформує запит на оновлення конфігурації реєстру, який необхідно підтвердити. @@ -80,10 +68,9 @@ citizenAuthFlow: edrCheck: false ---- ==== +//// -. Дочекайтеся, доки Jenkins виконає застосування конфігурації за допомогою пайплайну `MASTER-Build-<назва-реєстру>`. Це може зайняти декілька хвилин. - -== Особливості автентифікації при вході до Кабінету +=== Особливості автентифікації при вході до Кабінету При вході в Кабінет отримувача послуг як представник юридичної особи, система перевіряє наявність ЄДРПОУ цієї юридичної особи за допомогою ключа в єдиному державному реєстрі. @@ -101,3 +88,119 @@ image:registry-admin/cp-auth-setup-citizens/cp-auth-setup-citizens-4.png[] TIP: Детальніше про автентифікацію користувачів ви можете переглянути на сторінці xref:user:citizen-officer-portal-auth.adoc[]. +[#setup-auth-sign] +== Налаштування автентифікації та підпису даних в Control Plane + +Ця інструкція призначена для адміністраторів реєстру та описує процес налаштування автентифікації та підпису даних для отримувачів послуг в адміністративній панелі Control Plane. Ці налаштування забезпечують безпеку та зручність обслуговування отримувачів послуг, дозволяючи вам використовувати різні методи автентифікації та підпису даних. + +* 🧩 Використання IIT-віджета робить процес налаштування параметрів автентифікації та підпису даних простішим та ефективнішим. +* 🆔 Забезпечення підпису даних через сервіс id.gov.ua гарантує безпеку та надійність підпису. +* 📲 Автентифікація отримувачів послуг та надання розширених можливостей підпису даних можливі з використанням Дія.підпис. + +=== Налаштування типу автентифікації "IIT-віджет" + +. На вкладці _Автентифікація отримувачів послуг_, виберіть _Тип автентифікації_. +. Щоб скористатись IIT-віджетом, залиште налаштування за замовчуванням. Це дозволить автентифікацію за допомогою ІІТ-віджета та КЕП користувача. +. За необхідності, ви можете змінити посилання та висоту віджета. Наприклад, якщо ваші користувачі будуть автентифікуватись за допомогою хмарного ключа, у полі _Посилання_ необхідно прописати таке посилання, яке підтримує функцію хмарного ключа, наприклад: ++ +---- +https://eu.iit.com.ua/sign-widget/v20200922/ +---- ++ +NOTE: Якщо посилання не працює, зверніться до вашого провайдера цифрової ідентифікації. + +image:registry-admin/cp-auth-setup-citizens/cp-auth-setup-citizens-01.png[] + +TIP: Детальніше про використання IIT-віджета: xref:user:citizen-officer-portal-auth.adoc#kep-auth[Автентифікація за допомогою КЕП]. + +=== Налаштування типу автентифікації "Платформна інтеграція з id.gov.ua" + +. Як альтернатива, оберіть тип автентифікації _Платформна інтеграція з id.gov.ua_. ++ +image:registry-admin/cp-auth-setup-citizens/cp-auth-setup-citizens-02.png[] + +. При цьому виборі поля _Посилання_ та _Висота віджета_ будуть приховані, і застосовуватимуться налаштування інтеграції з `id.gov.ua` для всієї Платформи. ++ +image:registry-admin/cp-auth-setup-citizens/cp-auth-setup-citizens-03.png[] + +IMPORTANT: Якщо для надавачів послуг потрібно передбачити можливість автентифікуватись у Кабінеті за допомогою метода *Bank-ID*, то в посиланні у налаштуваннях Платформи потрібно додати таку можливість. + +[#citizens-sign-widget] +=== Налаштування віджета підпису документів + +Ви можете у Control plane на рівні реєстру налаштувати спосіб підпису даних для отримувачів послуг. Для цього: + +. На вкладці _Автентифікація отримувачів послуг_ перейдіть до _Віджет підпису документів_. +. Якщо обрано _Платформну інтеграцію з id.gov.ua_, ви зможете налаштувати посилання та висоту віджета. +. За замовчуванням, посилання встановлено на IIT-віджет, з висотою `720 px`. За потреби, ці налаштування можна змінити на `id.gov.ua`: ++ +---- +https://id.gov.ua/sign-widget/v20220527/ +---- ++ +//TODO: HERE add link +TIP: Як відображатиметься сторінка підпису даних для отримувачів послуг, описано за посиланням... ++ +image:registry-admin/cp-auth-setup-citizens/cp-auth-setup-citizens-04.png[] + +IMPORTANT: Не рекомендується використовувати посилання, яке підтримує *Bank-ID*, оскільки Bank-ID -- це лише спосіб автентифікації. + +=== Синхронізація налаштувань автентифікації та підпису + +Якщо тип автентифікації обрано як ІІТ-віджет, можна синхронізувати налаштування автентифікації та підпису. Для цього активуйте перемикач _Використовувати налаштування віджета автентифікації_. + +image:registry-admin/cp-auth-setup-citizens/cp-auth-setup-citizens-05.png[] + +Поля _Посилання_ та _Висота віджета_ будуть приховані та автоматично заповнені налаштуваннями з розділу _Тип автентифікації_. + +image:registry-admin/cp-auth-setup-citizens/cp-auth-setup-citizens-06.png[] + +Насамкінець натисніть кнопку `Підтвердити`, щоб зберегти зміни. + +У результаті сформується запит на оновлення конфігурації реєстру (_див. детальніше у розділі xref:#confirm-merge-deploy-changes[]_). + +=== Особливості автентифікації у Кабінеті отримувача послуг + +Якщо в адмін-панелі Control Plane налаштовано тип автентифікації _Віджет_, то сторінка користувача виглядатиме, наприклад, наступним чином: + +.Автентифікація через ІІТ-віджет +image::registry-admin/cp-auth-setup-citizens/cp-auth-setup-citizens-07.png[] + +TIP: Детальніше про використання IIT-віджета: xref:user:citizen-officer-portal-auth.adoc#kep-auth[Автентифікація за допомогою КЕП]. + +Якщо в Control Plane буде обрано значення _Платформна інтеграція з id.gov.ua_, користувачі Кабінету отримувача послуг бачитимуть наступну сторінку для автентифікації: + +.Автентифікація через id.gov.ua +image::registry-admin/cp-auth-setup-citizens/cp-auth-setup-citizens-08.png[] + +NOTE: Зверніть увагу, що користувач більше не може обирати спосіб автентифікації на одній сторінці. В один момент часу доступний лише один з двох способів автентифікації, налаштований адміністратором реєстру -- IIT-віджет або id.gov.ua. + +TIP: Більш детально про автентифікацію у Кабінеті отримувача послуг див. на у розділі xref:user:citizen-officer-portal-auth.adoc#citizen-portal-auth[Автентифікація отримувачів послуг]. + +=== Налаштування інтеграції із зовнішнім провайдером для адміністраторів Платформи + +Щоб забезпечити можливість інтегрувати майбутні реєстри Платформи з ID.GOV.UA, необхідно внести специфічні налаштування в Keycloak у реалмі `id.gov.ua`. Конкретно, поряд з даними *Client ID* та *Client Secret*, слід додати актуальне посилання до системи `id.gov.ua` у полі *Actual url of id.gov.ua system*. + +TIP: Більше контексту ви можете отримати на сторінці xref:admin:platform-id-gov-ua-setup.adoc[]. + +image:registry-admin/cp-auth-setup-citizens/cp-auth-setup-citizens-09.png[] + +=== Важливі зауваження + +* При використанні Bank-ID для автентифікації зверніть увагу, що це лише спосіб автентифікації, не підпису. +* Переконайтеся, що посилання для підпису даних підтримують необхідні функції. + +[#confirm-merge-deploy-changes] +== Підтвердження запита на оновлення та розгортання змін + +У результаті виконаних налаштувань у розділах xref:#edr-check[Перевірка запису в ЄДР] та xref:#setup-auth-sign[Налаштування автентифікації та підпису], система сформує запит на оновлення конфігурації реєстру, який необхідно підтвердити. Для цього: + +. Поверніться до розділу +++ Реєстри +++ > +++ Запити на оновлення +++ та перегляньте новий запит, натиснувши іконку перегляду -- 👁. ++ +image::admin:registry-management/cp-cidr/cp-cidr-8.png[] + +. У новому вікні перегляньте зміни та натисніть `Підтвердити`. ++ +NOTE: Запропоновані зміни вносяться до конфігурації реєстру у файлі *_deploy-templates/values.yaml_* у разі підтвердження. + +. Дочекайтеся, доки Jenkins виконає застосування конфігурації за допомогою пайплайну `MASTER-Build-<назва-реєстру>`. Це може зайняти декілька хвилин. \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/cp-auth-setup/cp-auth-setup-officers.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/cp-auth-setup/cp-auth-setup-officers.adoc index ad74c05bc8..1e9f799f9b 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin/cp-auth-setup/cp-auth-setup-officers.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin/cp-auth-setup/cp-auth-setup-officers.adoc @@ -216,7 +216,3 @@ image:registry-admin/cp-auth-setup-officers/cp-id-gov-ua-iit-setup-8.png[] == Пов'язані сторінки * xref:user:citizen-officer-portal-auth.adoc[] - -== Додаткові відеоматеріали - -video::QJ83n3lhyE4[youtube, width=680, height=380] diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/cp-auth-setup/cp-auth-setup-overview.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/cp-auth-setup/cp-auth-setup-overview.adoc index 5d0f6fad49..7cdb7adbef 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin/cp-auth-setup/cp-auth-setup-overview.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin/cp-auth-setup/cp-auth-setup-overview.adoc @@ -11,14 +11,15 @@ == Огляд секції [%collapsible] -.+++ Надавачі послуг +++ +.*Надавачі послуг* ==== * xref:registry-admin/cp-auth-setup/cp-auth-setup-officers.adoc[] * xref:registry-admin/cp-auth-setup/cp-officer-self-registration.adoc[] +* xref:registry-develop:registry-admin/cp-auth-setup/officer-portal-access-individual-qes.adoc[] ==== [%collapsible] -.+++Отримувачі послуг +++ +.*Отримувачі послуг* ==== * xref:registry-admin/cp-auth-setup/cp-auth-setup-citizens.adoc[] ==== \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/cp-auth-setup/cp-officer-self-registration.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/cp-auth-setup/cp-officer-self-registration.adoc index 06eea39372..8aee032e9e 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin/cp-auth-setup/cp-officer-self-registration.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin/cp-auth-setup/cp-officer-self-registration.adoc @@ -1,29 +1,13 @@ -:toc-title: ЗМІСТ -:toc: auto -:toclevels: 5 -:experimental: -:important-caption: ВАЖЛИВО -:note-caption: ПРИМІТКА -:tip-caption: ПІДКАЗКА -:warning-caption: ПОПЕРЕДЖЕННЯ -:caution-caption: УВАГА -:example-caption: Приклад -:figure-caption: Зображення -:table-caption: Таблиця -:appendix-caption: Додаток -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - -= Налаштування автореєстрації для посадових осіб += Налаштування самостійної реєстрації для надавачів послуг +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Загальний опис -Платформа надає можливість налаштування самореєстрації для посадових осіб, що спрощує процес реєстрації користувачів без необхідності залучення адміністратора. +Платформа надає можливість налаштування самостійної реєстрації для надавачів послуг, що спрощує процес реєстрації користувачів без необхідності залучення адміністратора. -image:registry-admin/cp-auth-setup-officers/self-registration/cp-officer-self-register-1.png[] +image:registry-admin/cp-auth-setup-officers/self-registration/cp-officer-self-register-ua-1.png[] Це створює ряд переваг для організацій та користувачів: :: @@ -37,23 +21,23 @@ image:registry-admin/cp-auth-setup-officers/self-registration/cp-officer-self-re == Налаштування -Адміністратори реєстру можуть налаштувати самореєстрацію для посадових осіб через адміністративну панель *Control Plane*, у розділі +++ Реєстри +++ > +++Автентифікація надавачів послуг +++. +Адміністратори реєстру можуть налаштувати самореєстрацію для надавачів послуг через адміністративну панель *Control Plane*, у розділі *Реєстри* > *Кабінет надавача послуг*. -У разі ввімкнення, посадові особи можуть автоматично реєструватись в системі управління користувачами та доступом *Keycloak*. При цьому, при першому вході користувача до Кабінету, його обліковий запис створюється із _системною роллю_ *`unregistered-officer`*, а користувач автоматично перенаправляється на бізнес-процес самореєстрації. +У разі ввімкнення, надавачі послуг можуть автоматично реєструватись в системі управління користувачами та доступом *Keycloak*. При цьому, при першому вході користувача до Кабінету, його обліковий запис створюється із _системною роллю_ *`unregistered-officer`*, а користувач автоматично перенаправляється на бізнес-процес самореєстрації. NOTE: Не рекомендовано надавати доступ для ролі *`unregistered-officer`* до жодних бізнес-процесів, крім одного з процесів самореєстрації, в авторизаційному файлі регламенту _bp-auth/officer.yml_. -У разі вимкнення самореєстрації, автентифікація посадових осіб відбувається за стандартним процесом, де користувачів необхідно спочатку створити в системі управління користувачами (_детальніше про це див. у розділі xref:registry-admin/create-users/overview.adoc[]_). +У разі вимкнення самореєстрації, автентифікація надавачів послуг відбувається за стандартним процесом, де користувачів необхідно спочатку створити в системі управління користувачами (_детальніше про це див. у розділі xref:registry-admin/create-users/overview.adoc[]_). Щоб вимкнути або увімкнути налаштування, виконайте наступні кроки: :: . Увійдіть до адміністративної панелі *Control Plane*. -. Перейдіть до розділу +++ Реєстри +++ > +++ Редагувати +++ > +++Автентифікація отримувачів послуг +++. +. Перейдіть до розділу *Реєстри* > *Редагувати* > *Кабінет надавача послуг*. . Вимкніть або увімкніть перемикач, щоб дозволити або заборонити самостійну реєстрацію. + NOTE: При вимкненні можливості, користувачі, які почали процес самореєстрації, не зможуть виконати свої задачі, якщо вони змодельовані в рамках процесу. + -image:registry-admin/cp-auth-setup-officers/self-registration/cp-officer-self-register-1.png[] +image:registry-admin/cp-auth-setup-officers/self-registration/cp-officer-self-register-ua-1.png[] + [NOTE] ==== @@ -65,15 +49,15 @@ image:registry-admin/cp-auth-setup-officers/self-registration/cp-officer-self-re * xref:best-practices/bp-officer-self-register-manual.adoc[] ==== -. Натисніть кнопку kbd:[Підтвердити], щоб зберегти зміни. +. Натисніть кнопку *`Підтвердити`*, щоб зберегти зміни. + У результаті система сформує запит на оновлення конфігурації реєстру, який необхідно підтвердити. -. Поверніться до розділу +++ Реєстри +++ > +++ Запити на оновлення +++ та перегляньте новий запит, натиснувши іконку перегляду -- 👁. +. Поверніться до розділу *Реєстри* > *Запити на оновлення* та перегляньте новий запит, натиснувши іконку перегляду -- 👁. + image::admin:registry-management/cp-cidr/cp-cidr-8.png[] -. У новому вікні перегляньте зміни та натисніть kbd:[Підтвердити]. +. У новому вікні перегляньте зміни та натисніть *`Підтвердити`*. + NOTE: Запропоновані зміни вносяться до конфігурації реєстру у файлі _deploy-templates/values.yaml_ у разі підтвердження. + @@ -95,9 +79,9 @@ keycloak: == Особливості автентифікації при вході до Кабінету -Посадові особи можуть після автентифікації у Кабінеті автоматично розпочати процес самореєстрації, якщо він попередньо змодельований у реєстрі та увімкнена автореєстрація для цього реєстру. +Надавачі послуг можуть після автентифікації у Кабінеті автоматично розпочати процес самореєстрації, якщо він попередньо змодельований у реєстрі та увімкнена автореєстрація для цього реєстру. -Після завершення реєстрації, система перенаправляє користувача на сторінку для повторного логіну з уже виданою роллю *`officer`*. Після цього посадова особа матиме доступ до послуг, доступних у реєстрі. +Після завершення реєстрації, система перенаправляє користувача на сторінку для повторного логіну з уже виданою роллю *`officer`*. Після цього надавач послуг матиме доступ до послуг, доступних у реєстрі. image:release-notes:wn-1-9-4/whats-new-1-9-4-11.png[] diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/cp-auth-setup/officer-portal-access-individual-qes.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/cp-auth-setup/officer-portal-access-individual-qes.adoc new file mode 100644 index 0000000000..c76fc93038 --- /dev/null +++ b/docs/ua/modules/registry-develop/pages/registry-admin/cp-auth-setup/officer-portal-access-individual-qes.adoc @@ -0,0 +1,79 @@ += Налаштування доступу до Кабінету надавачів послуг через КЕП фізичної особи +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +== Загальний опис + +Платформа надає адміністраторам змогу налаштувати доступ до кабінету надавачів послуг через КЕП фізичних осіб, у якому відсутній ЄДРПОУ організації. Ця функціональність дозволяє користувачам автентифікуватися та використовувати цифровий підпис за допомогою різних типів ключів, включно з файловими, апаратними та хмарними. Це розширює можливості користувачів-надавачів послуг, які не мають ключа юридичної особи, та забезпечує зручний доступ до всіх функцій Кабінету. + +Ці пункти підкреслюють важливі аспекти, на які адміністраторам необхідно звернути увагу при налаштуванні доступу до Кабінету надавачів послуг через КЕП фізичних осіб: + +. *Урахування потенційних ризиків при дозволі доступу фізичним особам*: ++ +Адміністраторам необхідно бути обережними та обачливими, коли вони надають доступ фізичним особам до Кабінету. Вони повинні аналізувати потенційні ризики, які можуть виникнути через такий доступ, і вносити відповідні зміни в правила та регламенти реєстру, щоб мінімізувати ці ризики. + +. *Ізоляція діяльності користувачів за допомогою КЕП*: ++ +КЕП (Кваліфіковані Електронні Підписи) фізичних осіб, ФОП (Фізичних Осіб-Підприємців), а також представників юридичних осіб використовуються як унікальні ідентифікатори для кожного користувача. Це означає, що діяльність кожного користувача буде відокремлена від інших, забезпечуючи безпеку та конфіденційність даних. + +. *Неможливість об'єднання облікових записів, створених через КЕП*: ++ +Кожен обліковий запис, створений за допомогою КЕП, є унікальним і не може бути об'єднаний з іншими обліковими записами. Це допомагає підтримувати чітку роздільність між різними користувачами та їх діяльністю на платформі, зберігаючи цим індивідуальну безпеку та приватність кожного користувача. + +== Налаштування в інтерфейсі Control Plane + +Адміністратори можуть налаштувати доступ до Кабінету користувача через *Вебінтерфейс управління Платформою та реєстрами* (*Control Plane*). Для цього виконайте наступні кроки: + +. Увійдіть до адміністративної панелі +include::ROOT:partial$templates/links/platform/administrative/control-plane.adoc[] +. + +. Відкрийте розділ *Реєстри*, перейдіть на вкладку *Кабінет надавача послуг* > *Управління доступом*. ++ +.Кабінет надавача послуг +image::admin:registry-management/registry-create/cp-create-registry-ua-9-1.png[] + +. Активуйте або деактивуйте перемикач *Дозволити доступ з КЕП фізичної особи*, щоб увімкнути або вимкнути функціональність (_за замовчуванням -- вимкнено_). + +. Натисніть кнопку *`Підтвердити`*, щоб зберегти зміни. ++ +У результаті система сформує запит на оновлення конфігурації реєстру, який необхідно підтвердити. + +. Поверніться до розділу *Реєстри* > *Запити на оновлення* та перегляньте новий запит, натиснувши іконку перегляду -- 👁. ++ +image::admin:registry-management/cp-cidr/cp-cidr-8.png[] + +. У новому вікні перегляньте зміни та натисніть *`Підтвердити`*. ++ +NOTE: Запропоновані зміни вносяться до конфігурації реєстру у файлі _deploy-templates/values.yaml_ у разі підтвердження. ++ +Після активації, зміни зберігаються у конфігурації реєстру в параметрі `portals.officer.individualAccessEnabled`, який може приймати 2 значення: `true` або `false`. За відсутності цього параметра, використовується значення за замовчуванням `false`. ++ +.Налаштування individualAccessEnabled: true у файлі deploy-templates/values.yaml +==== +[source,yaml] +---- +portals: + officer: + individualAccessEnabled: true # default: false +---- +==== + +. Дочекайтеся, доки Jenkins виконає застосування конфігурації за допомогою пайплайну *MASTER-Build-``*, де `` -- назва вашого реєстру. Це може зайняти декілька хвилин. + +== Додаткові опції + +На цій же сторінці, нижче, адміністратор має можливість активувати самостійну реєстрацію користувачів через перемикач *Дозволити самостійну реєстрацію* (_див. детальніше -- xref:registry-admin/cp-auth-setup/cp-officer-self-registration.adoc[]_). + +IMPORTANT: При активації обох опцій -- *Дозволити доступ з КЕП фізичної особи* та *Дозволити самостійну реєстрацію*, рекомендується використовувати додаткову модерацію для уникнення безконтрольної самореєстрації. Для цього зверніться до інструкції xref:best-practices/bp-officer-self-register-manual.adoc[]. + +== Використання у бізнес-процесі + +Для автоматизації процедури самостійної реєстрації посадових осіб, які автентифікуються з ключем ФОП або юридичної особи, передбачено референтний приклад бізнес-процесу У такому випадку процес проходить автоматично. Проте, якщо посадова особа автентифікується з ключем фізичної особи (ФО), процес передбачає ручну модерацію. + +TIP: Детальніше ви можете ознайомитися на сторінці xref:best-practices/bp-officer-self-register-combined.adoc[]. + +== Пов'язані сторінки + +* xref:registry-admin/cp-auth-setup/cp-officer-self-registration.adoc[] +* xref:best-practices/bp-officer-self-register-manual.adoc[] +* xref:best-practices/bp-officer-self-register-combined.adoc[] \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/cp-deploy-consent-data.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/cp-deploy-consent-data.adoc index 814f2e8be6..9a4dbae730 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin/cp-deploy-consent-data.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin/cp-deploy-consent-data.adoc @@ -184,7 +184,7 @@ image:registry-admin/cp-deploy-consent-data/cp-deploy-consent-data-10.png[] . Перейдіть до Кабінету адміністратора регламентів та перевірте наявність бізнес-процесів, UI-форм тощо. Службова назва референтних прикладів міститиме префікс *`reference-`*. + -TIP: Адміністративний портал доступний за посиланням: https://admin-tools-.[]. +TIP: Адміністративний портал доступний за посиланням: https://admin-tools-.[]. + image:registry-admin/cp-deploy-consent-data/cp-deploy-consent-data-11.png[] + @@ -192,7 +192,7 @@ image:registry-admin/cp-deploy-consent-data/cp-deploy-consent-data-11.png[] == Опис вмісту регламенту демо-реєстру -Вміст регламенту демо-реєстру подібний до типового регламенту будь-якого реєстру, що розгорнуто на Платформі (_див. детальніше -- xref:platform-develop:registry-regulations-deployment.adoc#registry-regulations-structure[Структура регламенту]_). +Вміст регламенту демо-реєстру подібний до типового регламенту будь-якого реєстру, що розгорнуто на Платформі (_див. детальніше -- xref:registry-develop:registry-admin/regulations-deploy/registry-regulations-structure.adoc[]_). Регламент демо-реєстру містить референтні приклади, відмічені префіксом *`reference-`* та приклади для тестування, відмічені префіксом *`feature-`*. Це можуть бути _.bpmn_-схеми бізнес-процесів, _.json_-форми внесення даних до процесу, _.xml_-схеми розгортання моделі даних реєстру тощо. diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/create-users/create-registry-admins.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/create-users/create-registry-admins.adoc index 4e497877a7..ac04465796 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin/create-users/create-registry-admins.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin/create-users/create-registry-admins.adoc @@ -1,23 +1,7 @@ -:toc-title: ЗМІСТ -:toc: auto -:toclevels: 5 -:experimental: -:important-caption: ВАЖЛИВО -:note-caption: ПРИМІТКА -:tip-caption: ПІДКАЗКА -:warning-caption: ПОПЕРЕДЖЕННЯ -:caution-caption: УВАГА -:example-caption: Приклад -:figure-caption: Зображення -:table-caption: Таблиця -:appendix-caption: Додаток -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Створення адміністраторів реєстру +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Загальний опис @@ -245,18 +229,4 @@ image:admin:user-management/user-management-44.png[] * xref:registry-develop:study-project/index.adoc[] * xref:admin:registry-management/control-plane-assign-platform-admins.adoc[] * xref:admin:registry-management/control-plane-edit-registry.adoc[] -* xref:admin:update/update-registry-components.adoc[] - -//// -KeyCloak:gerrit-administrators - -KeyCloak:camunda-admin - -KeyCloak:redash-admin - -jKeyCloak:jenkins-users (за запитом Адміністратор користувачів може надати jenkins-admin) - -KeyCloak:nexus-user -//// - -<<< \ No newline at end of file +* xref:admin:update/update-registry-components.adoc[] \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/create-users/import-users-officer.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/create-users/import-users-officer.adoc index 9a989f56ed..53cfa789f9 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin/create-users/import-users-officer.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin/create-users/import-users-officer.adoc @@ -1,23 +1,7 @@ -:experimental: -:important-caption: ВАЖЛИВО -:note-caption: ПРИМІТКА -:tip-caption: ПІДКАЗКА -:warning-caption: ПОПЕРЕДЖЕННЯ -:caution-caption: УВАГА -:example-caption: Приклад -:figure-caption: Зображення -:table-caption: Таблиця -:appendix-caption: Додаток -:toc-title: ЗМІСТ -:toc: -:toclevels: 5 -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Імпорт користувачів через файл та надання прав доступу +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Загальний опис @@ -195,13 +179,11 @@ image:registry-develop:bp-modeling/bp/kibana/kibana-section1-figure3.png[] ==== - [#validation-rules] -=== Загальні валідаційні правила для перевірки даних користувачів з файлу. +=== Загальні валідаційні правила для перевірки даних користувачів з файлу -Загальну схему валідаційних правил представлено нижче. - -image:registry-develop:registry-admin/import-users(officer)/import-users(officer).jpg[] +.Загальна схема валідаційних правил +image::registry-develop:registry-admin/import-users(officer)/import-users-officer.svg[] У разі порушення валідаційного правила запису даних у файлі буде показана відповідна помилка: @@ -238,7 +220,6 @@ image:registry-develop:registry-admin/import-users(officer)/import-users(officer Якщо імпорт користувачів у Keycloak відбувся з помилками (часткове створення користувачів), потрібно наново завантажити файл з користувачами, яких не вдалося створити, виконавши потрібні корегування. ==== - === Результат виконання процесу імпорту з помилкою Першочергово необхідно в логах знайти відповідний запис з загальним результатом опрацювання імпорту. diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/create-users/manual-user-creation.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/create-users/manual-user-creation.adoc index 3cf90cb3a5..7718e93ebf 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin/create-users/manual-user-creation.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin/create-users/manual-user-creation.adoc @@ -1,23 +1,9 @@ = Створення окремого користувача та надання прав доступу -:experimental: -:important-caption: ВАЖЛИВО -:note-caption: ПРИМІТКА -:tip-caption: ПІДКАЗКА -:warning-caption: ПОПЕРЕДЖЕННЯ -:caution-caption: УВАГА -:example-caption: Приклад -:figure-caption: Зображення -:table-caption: Таблиця -:appendix-caption: Додаток -:toc-title: ЗМІСТ -:toc: -:toclevels: 5 -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] +include::platform:ROOT:partial$admonitions/language-ua.adoc[] + +[#create-user] == Створення користувача у системі Щоб створити нового користувача (посадову особу) у Keycloak, необхідно виконати наступні кроки: diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/external-integration/api-publish/index.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/external-integration/api-publish/index.adoc index 0a6fb72cec..9ba608a635 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin/external-integration/api-publish/index.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin/external-integration/api-publish/index.adoc @@ -2,9 +2,12 @@ == Огляд секції -* xref:registry-develop:registry-admin/external-integration/api-publish/rest-soap-api-expose.adoc[] -* ШБО "Трембіта" -** xref:registry-develop:registry-admin/external-integration/api-publish/trembita-bp-invoking.adoc[] -** xref:registry-develop:registry-admin/external-integration/api-publish/trembita-data-invoking.adoc[] -* Інші реєстри та системи -** xref:registry-develop:registry-admin/external-integration/api-publish/get-jwt-token-postman.adoc[] \ No newline at end of file +* Приватні дані +** xref:registry-develop:registry-admin/external-integration/api-publish/rest-soap-api-expose.adoc[] +*** _ШБО "Трембіта"_ +**** xref:registry-develop:registry-admin/external-integration/api-publish/trembita-bp-invoking.adoc[] +**** xref:registry-develop:registry-admin/external-integration/api-publish/trembita-data-invoking.adoc[] +*** _Інші реєстри та системи_ +******* xref:registry-develop:registry-admin/external-integration/api-publish/get-jwt-token-postman.adoc[] +* Публічні дані +** xref:registry-develop:registry-admin/external-integration/api-publish/public-api/expose-public-api.adoc[] \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/external-integration/api-publish/public-api/expose-public-api.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/external-integration/api-publish/public-api/expose-public-api.adoc index b62f28b3c8..11083cea68 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin/external-integration/api-publish/public-api/expose-public-api.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin/external-integration/api-publish/public-api/expose-public-api.adoc @@ -1,6 +1,8 @@ = Налаштування доступу до публічних даних реєстру include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] +include::platform:ROOT:partial$admonitions/language-ua.adoc[] + == Загальний опис Сторонні системи та користувачі мають можливість отримувати публічну інформацію з реєстру в актуальному стані, обробляти та візуалізувати її без автентифікації, використовуючи публічні точки доступу API. @@ -13,10 +15,10 @@ include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc * [*] Публікація пошукових запитів * [*] Конфігурація ресурсів публічного API -* [*] Створення точок інтеграції для публічного API технічним адміністратором реєстру. -* [*] Отримання документації та використання публічного API. -* [*] Моніторинг стану та використання публічних пошукових критеріїв. -* [*] Зміна рейт-лімітів для наявних точок інтеграції. +* [*] Створення точок інтеграції для публічного API технічним адміністратором реєстру +* [*] Отримання документації та використання публічного API +* [*] Моніторинг стану та використання публічних пошукових критеріїв +* [*] Зміна рейт-лімітів для наявних точок інтеграції == План дій з налаштування та використання @@ -26,53 +28,86 @@ include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc + [%interactive] * [ ] xref:#regulations-modeling[] - * [ ] xref:#regulations-api-publish[] - * [ ] xref:#view-endpoints-openapi[] Налаштування на рівні конфігурації реєстру: :: + [%interactive] -* [ ] xref:#control-plane-public-access[Налаштування доступу до публічних даних та рейт-лімітів] -* [ ] xref:#apply-changes-to-registry[] -* [ ] xref:#grafana-monitoring[] +* [ ] xref:#control-plane-public-access[Налаштування доступу до публічних даних та встановлення рейт-лімітів] +* [ ] (_Додатково_) xref:#grafana-monitoring[] * [ ] (_Додатково_) xref:#public-user-account[] - [#regulations-modeling] == Моделювання регламенту -. Створення версії "кандидат": Розробник регламенту переходить в кабінет адміністратора та створює версію "кандидат" в розділі "таблиці". -. Додавання пошукового запиту: У файл опису структури додається новий пошуковий запит. -. Встановлення публічного доступу: Додається ченджсет для надання публічного доступу для доданого пошукового запиту, використовуючи тег exposeSearchCondition з новим параметром publicAccess. +. Відкрийте *Адміністративний портал* та створіть версію-кандидат. ++ +TIP: Детальніше про це читайте на сторінці xref:registry-admin/admin-portal/version-control/candidate/create-new-change-request.adoc[]. -- Створіть модель даних в рамках регламенту. -- В моделі даних, змоделюйте "Search Conditions" або пошукові критерії. -- Визначте потрібні пошукові критерії як публічно доступні через тег `exposeSearchCondition`. -- Наприклад: +. Перейдіть у *Таблиці > Файл опису структури* та додайте новий changeset із критерієм пошуку (Search Condition). ++ +[TIP] +==== +* Детальніше про файл опису структури читайте на сторінці xref:registry-admin/admin-portal/registry-modeling/tables/xml-editor.adoc[]. + +* Детальніше про критерії пошуку (Search Conditions) читайте на сторінці xref:data-modeling/data/physical-model/liquibase-ddm-ext.adoc[]. +==== + ++ +image:registry-develop:registry-admin/external-integration/api-publish/public-api/expose-public-api-1.png[] + +. Визначте, який саме пошуковий критерій ви хочете зробити публічним. Для цього додайте новий changeset із тегом `exposeSearchCondition` та атрибутом `publicAccess`. + [source,xml] ---- - + ---- ++ +TIP: Більш детально про `exposeSearchCondition` -- див. xref:data-modeling/data/physical-model/liquibase-ddm-ext.adoc#exposeSearchCondition[Тег налаштування доступу до API реєстру]. + ++ +[NOTE] +==== +Рекомендуємо налаштувати посторінкову пагінацію (тип `page`) для управління відображенням повернутих з `exposeSearchCondition` даних (`count`). Також налаштуйте `limit` до кількості даних реєстру, які повертаються у відповіді. + +Дізнайтеся більше про `limit` та `pagination` у наступних розділах документації: -- Створіть новий ченджсет і вкажіть який пошуковий критерій ви хочете зробити публічним. +* xref:data-modeling/data/physical-model/liquibase-ddm-ext.adoc#limit-attribute-values[Атрибут limit] +* xref:data-modeling/data/physical-model/liquibase-ddm-ext.adoc#pagination-attribute-values[Атрибут pagination] +==== + +. Перейдіть до наступного розділу для публікації моделі даних у регламенті. [#regulations-api-publish] == Публікація API у регламенті -. Публікація змін: Після збереження всіх змін, розробник застосовує ці зміни до Master версії. +Опублікуйте модель даних, застосувавши зміни до майстер-версії регламенту. +API-точка доступу до даних буде згенерована на базі кожного визначеного пошукового критерію. -Опублікуйте модель даних, застосувавши зміни до майстер-гілки. Точка доступу до даних буде згенерована на базі кожного визначеного критерію. +TIP: Детальніше про публікацію змін до регламенту читайте у розділі xref:registry-admin/admin-portal/version-control/candidate/overview-new-change-request.adoc#push-changes-master[Застосування змін до майстер-версії]. [#view-endpoints-openapi] == Перегляд опублікованих API у Swagger -. Перевірка змін: Після успішного проходження всіх етапів публікації, можна переглянути внесені пошукові запити, які доступні для публічного доступу, у специфікації. Для цього необхідно перейти в вебінтерфейс управління кластером Open Shift, знайти посилання на "platform-gateway-kong-proxy" та додати в адресу `/openapi`. +Після успішного проходження всіх етапів публікації, можна переглянути внесені пошукові запити, які доступні для публічного доступу, в OpenAPI-специфікації. Для цього: + +. Перейдіть до вебінтерфейсу управління кластером OpenShift. +. Оберіть проєкт із вашим реєстром, відкрийте Networking > Routes та перейдіть за посиланням до сервісу *`platform-gateway-kong-proxy`*. ++ +[NOTE] +==== +Обов'язково додайте в кінець URL-адреси `/openapi`, інакше ви потрапите до sandbox-середовища із pet-точками доступу. Ваш URL у браузері має виглядати так: + +---- +https://example.com/api/public/data-factory/openapi +---- +==== . Відкрийте openapi та знайдіть опубліковані публічні точки доступу. . Скопіюйте ім'я ендпоінту до буфера обміну та перейдіть до наступного кроку налаштувань. ++ +image:registry-develop:registry-admin/external-integration/api-publish/public-api/expose-public-api-2.png[] [NOTE] @@ -88,36 +123,58 @@ include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc [#control-plane-public-access] == Налаштування доступу до публічних даних -=== Налаштування реєстру у Control Plane +=== Налаштування доступу до публічних даних та встановлення рейт-лімітів -Відкрийте доступ публічних даних та налаштуйте рейт-ліміти. +Відкрийте доступ до публічних даних та налаштуйте рейт-ліміти. . Увійдіть до адміністративної панелі *Control Plane*. -. Відкрийте вкладку Інформація про реєстр. -. Натисніть на секцію Публічний доступ. -. Натисніть кнопку Надати доступ. +. На вкладці *Інформація про реєстр* знайдіть секцію *Публічний доступ*. +. Натисніть кнопку `*Надати доступ*`. . У новому вікні заповніть поля: -* Службова назва запита. + -Введіть службову назву запита. Наприклад, city-lab. -* Точка інтеграції. + -Вкажіть точку інтеграції, налаштовану розробником регламенту на етапі xref:#regulations-modeling[] та опубліковану в сервісі API реєстру. Наприклад, `/search-laboratories-by-city`. +* *Службова назва запита*: введіть службову назву запита. Наприклад, `city-lab`. +* *Точка інтеграції*: +вкажіть точку інтеграції, налаштовану розробником регламенту на етапі xref:#regulations-modeling[] та опубліковану в сервісі API реєстру. Наприклад, `/search-laboratories-by-city`. -* Встановіть рейт-ліміти на доступ -- кількість запитів від користувачів/систем за одиницю часу, наприклад, за годину, місяць тощо. -. Натисніть кнопку Надати. - +* Встановіть рейт-ліміти на доступ -- кількість запитів від користувачів/систем за одиницю часу. Наприклад, за годину, місяць тощо. +. Натисніть кнопку `*Надати*`. ++ +image:registry-develop:registry-admin/external-integration/api-publish/public-api/expose-public-api-3.png[] -- Перейдіть до секції *Запиту на оновлення* та підтвердіть застосування. +. Перейдіть до секції *Запити на оновлення*, відкрийте та підтвердьте новий запит. Запропоновані зміни будуть застосовані до налаштувань реєстру у файлі *_deploy-templates/values.yaml_*. ++ +image:registry-develop:registry-admin/external-integration/api-publish/public-api/expose-public-api-5.png[] ++ +TIP: Див. детальніше про підтвердження змін на сторінці xref:admin:registry-management/control-plane-submit-mr.adoc[]. ++ +Після налаштування, конфігурація реєстру матиме такий вигляд: ++ +[source,yaml] +---- +publicApi: + - name: vpo-person-type-test + url: /vpo-person-type-contains-name-public-test + limits: + second: 5 + hour: 100 + enabled: true + - ... +---- ++ +Після виконання пайплайну розгортання, публічний доступ до даних через вказаний API-ендпоінт буде відкритий. === Перевірка роботи публічного доступу -. Відкрийте браузер у режимі Інкогніто й перейдіть за посиланням на доданий пошуковий запит. -. Неавтентифікований користувач повинен отримати дані у форматі JSON. - - +. Відкрийте браузер у режимі _Інкогніто_ й вставте скопійоване у розділі xref:#view-endpoints-openapi[] посилання на доданий пошуковий запит. ++ +image:registry-develop:registry-admin/external-integration/api-publish/public-api/expose-public-api-6.png[] +. Неавтентифікований користувач/система отримає дані у форматі JSON. ++ +image:registry-develop:registry-admin/external-integration/api-publish/public-api/expose-public-api-6-1.png[] ++ [CAUTION] ==== При досягненні ліміту, формується відповідь від API Gateway з кодом 429 та тілом @@ -128,75 +185,49 @@ include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc === Керування доступом -- Для редагування точки інтеграції та лімітів: -- Натисніть на іконку *редагувати* біля відповідного запиту. -- Внесіть необхідні зміни та підтвердьте їх. -- Для блокування доступу натисніть на іконку *заблокувати*. -- Доступ можна відновити, натиснувши на іконку *розблокувати*. -- Для видалення доступу натисніть на іконку *видалити*. - -Після кожної дії перевірте та xref:#apply-changes-to-registry[підтвердьте застосування змін] у секції *Запити на оновлення*. - -CAUTION: Якщо видалити наявні точки інтеграції або тимчасово вимкнути їх, користувач отримає повідомлення про помилку HTTP 404 при спробі доступу. - -[#apply-changes-to-registry] -== Застосування змін до реєстру +. Редагуйте точки інтеграції та рейт-ліміти: :: -CAUTION: Секція у процесі розробки. +.. Натисніть на іконку _редагування_ 🖉 біля відповідного запита. +.. Внесіть необхідні зміни та підтвердьте їх. ++ +image:registry-develop:registry-admin/external-integration/api-publish/public-api/expose-public-api-7.png[] -. Відкрийте секцію Запити на оновлення... +. Заблокуйте доступ натисканням іконки _блокування_ 🔒. Технічно це означатиме призупинення доступу до певного API-ендпоінту. ++ +TIP: Доступ можна відновити, натиснувши на _розблокування_ (_повторний клік на заблокований елемент_ 🔒). ++ +image:registry-develop:registry-admin/external-integration/api-publish/public-api/expose-public-api-7-1.png[] -Після налаштування, конфігурація реєстру матиме такий вигляд: +. Анулюйте доступ повністю натисканням іконки _видалення_ 🚫. ++ +NOTE: Після кожної дії перевірте та підтвердьте застосування змін у секції *Запити на оновлення*. -[source,yaml] ----- -publicApi: - - name: city-lab - enabled: true - url: /search-laboratories-by-city - limits: - second: 5 - hour: 100 - - ... ----- +CAUTION: Якщо видалити наявні точки інтеграції або тимчасово вимкнути їх, користувач отримає повідомлення про помилку HTTP 404 при спробі доступу. -Після виконання пайплайну розгортання, публічний доступ до даних через вказаний API-ендпоінт буде відкритий. +[NOTE] +==== +Зміна іконок статусу навпроти публічного API у секції _Публічний доступ_ означає, що створений запит на оновлення застосовано до `master`-гілки, а внесені зміни потрапили до файлу конфігурації реєстру -- _deploy-templates/values.yml_. +Щоб перевірити успішність застосування змін і коректність налаштованого доступу до публічних ендпоінтів, технічний адміністратор реєстру повинен перевірити статус пайплайну `master`-гілки. +==== [#grafana-monitoring] == Моніторинг показників у Grafana -CAUTION: Секція у процесі розробки. - -=== Опис дашборду +Платформа має Grafana-дашборд, призначений для моніторингу показників виконання і кількості запитів до публічних точок інтеграції від неавтентифікованих користувачів і сторонніх систем. -Grafana-дашборд, призначений для моніторингу показників виконання і кількості запитів до публічних точок інтеграції від неавтентифікованих користувачів і сторонніх систем. +image:registry-develop:registry-admin/external-integration/api-publish/public-api/expose-public-api-4.png[] -* Технічний адміністратор реєстру може користуватися даними з дашборду для відстеження динаміки й стану показників. -* Ці дані можуть допомогти у визначенні потреби в оптимізації налаштувань, таких як коригування лімітів на запити. +Технічний адміністратор реєстру може користуватися даними з дашборду для відстеження динаміки й стану показників. Ці дані можуть допомогти у визначенні потреби в оптимізації налаштувань, таких як коригування лімітів на запити. -=== Доступ до дашборду - -. Для доступу до дашборду, перейдіть за вказаним посиланням до сервісу Grafana в адміністративній панелі Control Plane. - -. У рядку пошуку знайдіть *Public API Kong Metrics* та оберіть ваш реєстр. - -=== Перегляд метрик дашборду - -* Секція *Request rate*: -** Відображає кількість запитів по кожній точці інтеграції. -* Секція ... -** Моніторинг успішних запитів, помилок сервера, помилок клієнта та інших кодів відповіді. -* Секція "...": -** Статистика швидкодії: найдовший, середній, найшвидший запит. -- Секція *Latencies*: -- Аналіз динаміки показників за певний період часу й історичні дані. +TIP: Детальну інформацію щодо моніторингу ви можете переглянути на сторінці xref:registry-admin/grafana-monitoring/public-api-kong-metrics.adoc[]. [#public-user-account] == Створення сервісного облікового запису для виконання публічних запитів -Попри те що формально точки інтеграції є публічними, для підтримання однорідності аудиту та логування в середині Платформи, такі запити будуть здійснюватись від імені службового користувача із realm `external-system`. Система автоматично створить службового користувача `public-user` для авторизації на рівні `platform-gateway`. - -Переконайтеся, що такий системний користувач створений у відповідному реалмі сервісу Keycloak. +Попри те, що формально точки інтеграції є публічними, для підтримання однорідності аудиту та логування в середині Платформи, такі запити будуть здійснюватись від імені службового користувача із Keycloak-реалму `external-system`. Система автоматично створить службового користувача `public-user` для авторизації на рівні `platform-gateway`. -//TODO: Add screenshot +_Переконайтеся_, що такий системний користувач створений у відповідному реалмі сервісу Keycloak. Для цього: +. Відкрийте сервіс автентифікації та авторизації Keycloak +. Знайдіть реалм `-external-system` для вашого реєстру. +. Відкрийте меню *Clients* > `public-user`. \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/external-integration/api-publish/rest-soap-api-expose.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/external-integration/api-publish/rest-soap-api-expose.adoc index 9f6fdf9595..b2b6bfb75a 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin/external-integration/api-publish/rest-soap-api-expose.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin/external-integration/api-publish/rest-soap-api-expose.adoc @@ -1,23 +1,7 @@ -:toc-title: ЗМІСТ -:toc: auto -:toclevels: 5 -:experimental: -:important-caption: ВАЖЛИВО -:note-caption: ПРИМІТКА -:tip-caption: ПІДКАЗКА -:warning-caption: ПОПЕРЕДЖЕННЯ -:caution-caption: УВАГА -:example-caption: Приклад -:figure-caption: Зображення -:table-caption: Таблиця -:appendix-caption: Додаток -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Налаштування регламенту для надання доступу до даних через SOAP та REST API +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] Якщо ваш реєстр є власником даних, і ви хочете виставляти інтеграційні API-точки, отримувати запити та віддавати дані іншим реєстрам або системам, виконайте наступні налаштування регламенту: @@ -118,8 +102,11 @@ image::registry-admin/external-integration/rest-api-no-trembita/accept-map-param [TIP] ==== -Приклад _.bpmn_-моделі процесу, а також користувацькі _.json_-форми до нього ви можете знайти у регламенті демо-реєстру *_consent-data_* за посиланням: -https://admin-tools-consent-data.apps.envone.dev.registry.eua.gov.ua/gerrit. +[%collapsible] +.Де можна знайти приклад референтного бізнес-процесу? +===== +include::partial$snippets/demo-reg-reference-examples-ua.adoc[] -Процес буде доступний за назвою *_BPMN-create-school-auto-sign.bpmn_*. Назви форм ви можете знайти всередині відповідних користувацьких задач бізнес-процесу у полі *`Form key`*. +Приклад BPMN-схеми процесу буде доступний у регламенті демо-реєстру за пошуком по ключовим словам -- *_create-school-auto-sign_*. Назви форм ви можете знайти всередині відповідних користувацьких задач (User Task) бізнес-процесу у полі *`Form key`*. +===== ==== \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/external-integration/api-publish/trembita-bp-invoking.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/external-integration/api-publish/trembita-bp-invoking.adoc index 666c8b73dd..3f5bcdfdfa 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin/external-integration/api-publish/trembita-bp-invoking.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin/external-integration/api-publish/trembita-bp-invoking.adoc @@ -1,23 +1,5 @@ -:toc-title: ЗМІСТ -:toc: auto -:toclevels: 5 -:experimental: -:important-caption: ВАЖЛИВО -:note-caption: ПРИМІТКА -:tip-caption: ПІДКАЗКА -:warning-caption: ПОПЕРЕДЖЕННЯ -:caution-caption: УВАГА -:example-caption: Приклад -:figure-caption: Зображення -:table-caption: Таблиця -:appendix-caption: Додаток -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - -= Реєстрація сервісів та виклик бізнес-процесів через ШБО "Трембіта" += Реєстрація API-ендпоінтів у ШБО "Трембіта": активація та виклик бізнес-процесів +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] == Передумови @@ -41,11 +23,11 @@ NOTE: Налаштування показано на прикладі створ === Додавання WSDL-файлу . Увійдіть до адміністративного інтерфейсу ШБО "Трембіта". -. Відкрийте меню +++Клієнти Сервера Безпеки+++ та оберіть необхідну підсистему (*`SUBSYSTEM`*). +. Відкрийте меню *Клієнти Сервера Безпеки* та оберіть необхідну підсистему (*`SUBSYSTEM`*). + image:registry-admin/external-integration/api-publish/data-platform/trembita-add-wsdl-step-1.png[] -. У розділі _клієнта-надавача_ перейдіть до налаштувань +++Сервіси SOAP+++, натиснувши відповідну іконку image:registry-admin/external-integration/api-publish/data-platform/soap-config.png[width="25"] +. У розділі _клієнта-надавача_ перейдіть до налаштувань *Сервіси SOAP*, натиснувши відповідну іконку image:registry-admin/external-integration/api-publish/data-platform/soap-config.png[width="25"] та оберіть `Додати WSDL`. + image:registry-develop:registry-admin/external-integration/api-publish/bp/trembita-bp-invoking-1.png[] @@ -56,8 +38,12 @@ image:registry-develop:registry-admin/external-integration/api-publish/bp/trembi ==== WSDL-файл з описом вебсервісу можна отримати, наприклад, за таким шляхом: ---- -https://bp-webservice-gateway-lowcode-gryffindor-qa.apps.cicd2.mdtu-ddm.projects.epam.com/ws/bpWebservice.wsdl +https://bp-webservice-gateway-example-registry.apps.example.com/ws/bpWebservice.wsdl ---- +* `bp-webservice-gateway` -- назва API-сервісу, що розгортається разом з реєстром; +* `example-registry` -- назва вашого реєстру; +* `apps.example.com` -- DNS-wildcard (домен та піддомени сервера); +* `/ws/bpWebservice.wsdl` -- ендпоінт, де зберігається WSDL-файл. ==== . Натисніть кнопку `OK`. diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/external-integration/api-publish/trembita-data-invoking.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/external-integration/api-publish/trembita-data-invoking.adoc index 3a4b2d3ce1..c94ed5ebd8 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin/external-integration/api-publish/trembita-data-invoking.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin/external-integration/api-publish/trembita-data-invoking.adoc @@ -1,23 +1,5 @@ -:toc-title: ЗМІСТ -:toc: auto -:toclevels: 5 -:experimental: -:important-caption: ВАЖЛИВО -:note-caption: ПРИМІТКА -:tip-caption: ПІДКАЗКА -:warning-caption: ПОПЕРЕДЖЕННЯ -:caution-caption: УВАГА -:example-caption: Приклад -:figure-caption: Зображення -:table-caption: Таблиця -:appendix-caption: Додаток -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Реєстрація сервісів та виклик API дата-фабрики через ШБО "Трембіта" +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] == Передумови @@ -38,7 +20,7 @@ Whitelisting налаштовується на рівні конфігураці . Увійдіть до адміністративного інтерфейсу ШБО "Трембіта". -. Відкрийте меню +++Клієнти Сервера Безпеки+++. +. Відкрийте меню *Клієнти Сервера Безпеки*. + image:registry-admin/external-integration/api-publish/data-platform/trembita-add-wsdl-step-1.png[] + @@ -51,7 +33,7 @@ image:registry-admin/external-integration/api-publish/data-platform/trembita-add Наприклад, `DDMTest**_prod**` -- надавач, а `DDMTest**_cons**` -- споживач. ==== -. У розділі _клієнта-надавача_ перейдіть до налаштувань +++Сервіси SOAP+++, натиснувши відповідну іконку image:registry-admin/external-integration/api-publish/data-platform/soap-config.png[width="25"] +. У розділі _клієнта-надавача_ перейдіть до налаштувань *Сервіси SOAP*, натиснувши відповідну іконку image:registry-admin/external-integration/api-publish/data-platform/soap-config.png[width="25"] та оберіть `Додати WSDL`. + image:registry-develop:registry-admin/external-integration/api-publish/bp/trembita-bp-invoking-1.png[] @@ -62,8 +44,12 @@ image:registry-develop:registry-admin/external-integration/api-publish/bp/trembi ==== WSDL-файл з описом вебсервісу можна отримати, наприклад, за таким шляхом: ---- -https://bp-webservice-gateway-lowcode-gryffindor-qa.apps.cicd2.mdtu-ddm.projects.epam.com/ws/bpWebservice.wsdl +https://bp-webservice-gateway-example-registry.apps.example.com/ws/bpWebservice.wsdl ---- +* `bp-webservice-gateway` -- назва API-сервісу, що розгортається разом з реєстром; +* `example-registry` -- назва вашого реєстру; +* `apps.example.com` -- DNS-wildcard (домен та піддомени сервера); +* `/ws/bpWebservice.wsdl` -- ендпоінт, де зберігається WSDL-файл. ==== + image:registry-admin/external-integration/api-publish/data-platform/trembita-add-wsdl-step-2.png[] diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/external-integration/cp-mock-integrations.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/external-integration/cp-mock-integrations.adoc index cdf2c8ec51..483e540381 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin/external-integration/cp-mock-integrations.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin/external-integration/cp-mock-integrations.adoc @@ -48,7 +48,7 @@ image:release-notes:wn-1-9-5/whats-new-1-9-5-2.png[] * xref:registry-admin/external-integration/cp-integrate-trembita.adoc[Налаштування взаємодії з реєстрами через ШБО "Трембіта"] * xref:registry-admin/external-integration/cp-integrate-ext-system.adoc[Налаштування взаємодії з іншими системами] -Активуйте перемикач +++Використати мок зовнішньої інтеграції+++ для відповідного типу взаємодії. +Активуйте перемикач *Використати мок зовнішньої інтеграції* для відповідного типу взаємодії. .Увімкнення емуляторів взаємодії з реєстрами через ШБО "Трембіта" image::release-notes:wn-1-9-5/whats-new-1-9-5-2.png[] diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/external-integration/ext-integration-overview.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/external-integration/ext-integration-overview.adoc index baa213c7b1..113ea8d481 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin/external-integration/ext-integration-overview.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin/external-integration/ext-integration-overview.adoc @@ -1,23 +1,7 @@ -:toc-title: ЗМІСТ -:toc: auto -:toclevels: 5 -:experimental: -:important-caption: ВАЖЛИВО -:note-caption: ПРИМІТКА -:tip-caption: ПІДКАЗКА -:warning-caption: ПОПЕРЕДЖЕННЯ -:caution-caption: УВАГА -:example-caption: Приклад -:figure-caption: Зображення -:table-caption: Таблиця -:appendix-caption: Додаток -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Управління зовнішніми інтеграціями +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Загальні положення diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/external-integration/rest-api-no-trembita.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/external-integration/rest-api-no-trembita.adoc index a02a261216..be00309f76 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin/external-integration/rest-api-no-trembita.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin/external-integration/rest-api-no-trembita.adoc @@ -1,23 +1,7 @@ -:toc-title: ЗМІСТ -:toc: auto -:toclevels: 5 -:experimental: -:important-caption: ВАЖЛИВО -:note-caption: ПРИМІТКА -:tip-caption: ПІДКАЗКА -:warning-caption: ПОПЕРЕДЖЕННЯ -:caution-caption: УВАГА -:example-caption: Приклад -:figure-caption: Зображення -:table-caption: Таблиця -:appendix-caption: Додаток -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Інтеграційна REST-взаємодія реєстрів з іншими реєстрами на Платформі та зовнішніми системами +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Загальний опис @@ -123,10 +107,13 @@ TIP: Деталі дивіться на сторінці xref:admin:registry-man + [TIP] ==== -Приклад _.bpmn_-моделі процесу, а також користувацькі _.json_-форми до нього ви можете знайти у регламенті демо-реєстру *_consent-data_* за посиланням: -https://admin-tools-consent-data.apps.envone.dev.registry.eua.gov.ua/gerrit. +[%collapsible] +.Де можна знайти приклад референтного бізнес-процесу? +===== +include::partial$snippets/demo-reg-reference-examples-ua.adoc[] -Процес буде доступний за назвою *_BPMN-create-school-auto.bpmn_*. Назви форм ви можете знайти всередині відповідних користувацьких задач бізнес-процесу у полі *`Form key`*. +Приклад BPMN-схеми процесу буде доступний у регламенті демо-реєстру за пошуком по ключовим словам -- *_create-school-auto_*. Назви форм ви можете знайти всередині відповідних користувацьких задач (User Task) бізнес-процесу у полі *`Form key`*. +===== ==== . В рамках бізнес-процесу використовуйте типові інтеграційні розширення для взаємодії з іншими реєстрами на Платформі: diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/grafana-monitoring/grafana-alerting-notifications.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/grafana-monitoring/grafana-alerting-notifications.adoc index 00e6b96d02..e59c0adaf9 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin/grafana-monitoring/grafana-alerting-notifications.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin/grafana-monitoring/grafana-alerting-notifications.adoc @@ -1,23 +1,5 @@ -:toc-title: ЗМІСТ -:toc: auto -:toclevels: 5 -:experimental: -:important-caption: ВАЖЛИВО -:note-caption: ПРИМІТКА -:tip-caption: ПІДКАЗКА -:warning-caption: ПОПЕРЕДЖЕННЯ -:caution-caption: УВАГА -:example-caption: Приклад -:figure-caption: Зображення -:table-caption: Таблиця -:appendix-caption: Додаток -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Налаштування сповіщень моніторингу Grafana +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] Для налаштування нотифікацій виконайте наступні кроки: diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/grafana-monitoring/grafana-camunda-metrics.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/grafana-monitoring/grafana-camunda-metrics.adoc index 8658786559..6bc686b027 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin/grafana-monitoring/grafana-camunda-metrics.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin/grafana-monitoring/grafana-camunda-metrics.adoc @@ -1,23 +1,7 @@ -:toc-title: ЗМІСТ -:toc: auto -:toclevels: 5 -:experimental: -:important-caption: ВАЖЛИВО -:note-caption: ПРИМІТКА -:tip-caption: ПІДКАЗКА -:warning-caption: ПОПЕРЕДЖЕННЯ -:caution-caption: УВАГА -:example-caption: Приклад -:figure-caption: Зображення -:table-caption: Таблиця -:appendix-caption: Додаток -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Моніторинг показників виконання бізнес-процесів +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Загальний опис diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/grafana-monitoring/overview.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/grafana-monitoring/overview.adoc new file mode 100644 index 0000000000..37955c068e --- /dev/null +++ b/docs/ua/modules/registry-develop/pages/registry-admin/grafana-monitoring/overview.adoc @@ -0,0 +1,24 @@ += Моніторинг систем Платформи +:sectlinks: +:sectanchors: + +_Моніторинг_ -- це ключовий елемент ефективної роботи будь-якої IT-платформи. Для забезпечення повного контролю за роботою наших систем та вчасного виявлення й усунення можливих проблем ми використовуємо потужний інструмент моніторингу -- *Grafana*. + +У Grafana ми розробили різноманітні дашборди, що дозволяють налаштовувати та відстежувати ключові показники продуктивності, зокрема: + +* Роботу різних компонентів Платформи (як-от Camunda або Strimzi Kafka); +* Стан баз даних та файлової системи (наприклад, PostgreSQL чи Ceph cluster); +* Метрику і статистику запитів у Public API Kong; +* Аналітичні дані через Redash; +* Стан кеш-пам'яті за допомогою Redis; +* Метрики зі Spring Boot, Prometheus та інші. + +Ці дашборди надають глибокий аналіз роботи нашої Платформи та розгорнутих на ній реєстрів, що допомагає нам забезпечувати стабільність, продуктивність та відзначати можливі відхилення або проблеми ще до того, як вони стануть критичними. + +TIP: Повний перелік доступних дашбордів для моніторингу можна знайти на сторінці xref:arch:architecture/platform/operational/monitoring/overview.adoc[]. + +== Огляд секції + +* xref:registry-develop:registry-admin/grafana-monitoring/grafana-alerting-notifications.adoc[] +* xref:registry-develop:registry-admin/grafana-monitoring/grafana-camunda-metrics.adoc[] +* xref:registry-develop:registry-admin/grafana-monitoring/public-api-kong-metrics.adoc[] \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/grafana-monitoring/public-api-kong-metrics.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/grafana-monitoring/public-api-kong-metrics.adoc new file mode 100644 index 0000000000..47b54af46e --- /dev/null +++ b/docs/ua/modules/registry-develop/pages/registry-admin/grafana-monitoring/public-api-kong-metrics.adoc @@ -0,0 +1,72 @@ += Моніторинг метрик публічного API +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] + +== Загальний опис дашборду + +Платформа має Grafana-дашборд, призначений для моніторингу показників виконання і кількості запитів до публічних точок інтеграції від неавтентифікованих користувачів і сторонніх систем. + +image:registry-develop:registry-admin/external-integration/api-publish/public-api/expose-public-api-4.png[] + +Технічний адміністратор реєстру може користуватися даними з дашборду для відстеження динаміки й стану показників. Ці дані можуть допомогти у визначенні потреби в оптимізації налаштувань, таких як коригування лімітів на запити. + +== Доступ до дашборду + +Щоб переглянути дашборд, виконайте наступні кроки: + +. Увійдіть до адміністративної панелі *Control Plane*. + +. Оберіть ваш реєстр > `Редагувати` > +++Швидкі посилання+++. ++ +TIP: Детальніше про швидкі посилання див. на сторінці xref:admin:registry-management/control-plane-quick-links.adoc[]. + +. Перейдіть за посиланням до вебінтерфейсу моніторингу Платформи -- *Grafana*. ++ +image:registry-admin/grafana/bpms/grafana-bpms-1.png[] + +. Виконайте вхід за допомогою опції *`Sign in with OAuth`*. ++ +image:registry-admin/grafana/bpms/grafana-bpms-2.png[] + +. На боковій панелі зліва оберіть *Manage* > *Dashboards* > *Go to folder*. ++ +image:registry-admin/grafana/bpms/grafana-bpms-3.png[] + +. У рядку пошуку знайдіть *Public API Kong Metrics*, натисніть *namespace* та оберіть ваш реєстр. ++ +image:registry-develop:registry-admin/external-integration/api-publish/public-api/expose-public-api-8.png[] + +== Перегляд метрик дашборду + +Для моніторингу продуктивності та відстежування запитів до вашого API, використовуйте дашборд метрик. Постійний моніторинг цих метрик допоможе вам виявити можливі проблеми в роботі API та вчасно реагувати на них. + +Оберіть публічну точку, за якою потрібно переглянути метрики. Це можна зробити у розділі полі *public endpoint*. Оберіть усі створені точки або конкретні. + +image:registry-develop:registry-admin/external-integration/api-publish/public-api/expose-public-api-9.png[] + +* Секція *Request rate* показує кількість запитів по кожній точці інтеграції. + +** *Total requests per second (RPS)* відображає загальний обсяг запитів за секунду до API. +** *RPS per route* аналізує обсяг запитів для кожного роута окремо. + ++ +image:registry-develop:registry-admin/external-integration/api-publish/public-api/expose-public-api-4.png[] + +* Секції *Requests by status code* (*_2xx, 4xx, 5xx та other_*) показують статистику успішних запитів, помилок клієнта, помилок сервера та інших кодів відповіді. ++ +image:registry-develop:registry-admin/external-integration/api-publish/public-api/expose-public-api-10.png[] + +* Секція *Latencies* визначає час відгуку сервера на запити. + +** *Request time per route* вказує середній час відгуку сервера для кожного роута окремо. ++ +image:registry-develop:registry-admin/external-integration/api-publish/public-api/expose-public-api-11.png[] + +** *Kong Proxy latency per route* показує затримку між часом отримання запита сервером і надсиланням його відповіді. ++ +image:registry-develop:registry-admin/external-integration/api-publish/public-api/expose-public-api-11-1.png[] + +** *Upstream time across per route* визначає час, який потрібен серверу для обробки запита і отримання відповіді від upstream-сервісу. ++ +image:registry-develop:registry-admin/external-integration/api-publish/public-api/expose-public-api-11-2.png[] \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/regulations-deploy/registry-admin-deploy-regulation.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/regulations-deploy/registry-admin-deploy-regulation.adoc index 0e5ae13358..550213476e 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin/regulations-deploy/registry-admin-deploy-regulation.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin/regulations-deploy/registry-admin-deploy-regulation.adoc @@ -146,4 +146,4 @@ image:admin:user-management/user-management-59.png[] Приклад пошуку та виявлення помилок у журналі подій (логах) Jenkins доступний за xref:registry-admin/regulations-deploy/registry-regulations-auto-validation.adoc#example-validation-fk-name[посиланням]. ==== -Після успішного виконання Jenkins job, сутності регламенту реєстру створено і можливо переходити до їх перевірки. +Після успішного виконання Jenkins job, сутності регламенту реєстру створено і можливо переходити до їх перевірки. \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/regulations-deploy/registry-admin-introduction.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/regulations-deploy/registry-admin-introduction.adoc index b054791287..642ff4798f 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin/regulations-deploy/registry-admin-introduction.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin/regulations-deploy/registry-admin-introduction.adoc @@ -5,4 +5,5 @@ * xref:registry-develop:registry-admin/regulations-deploy/registry-regulations-structure.adoc[] * xref:registry-develop:registry-admin/regulations-deploy/registry-admin-deploy-regulation.adoc[] * xref:registry-develop:registry-admin/regulations-deploy/registry-regulations-auto-validation.adoc[] -* xref:registry-admin/regulations-deploy/cleanup-job.adoc[] \ No newline at end of file +* xref:registry-admin/regulations-deploy/cleanup-job.adoc[] +* xref:registry-admin/regulations-deploy/regulations-idempotеnt-deployment.adoc[] \ No newline at end of file diff --git "a/docs/ua/modules/registry-develop/pages/registry-admin/regulations-deploy/regulations-idempot\320\265nt-deployment.adoc" "b/docs/ua/modules/registry-develop/pages/registry-admin/regulations-deploy/regulations-idempot\320\265nt-deployment.adoc" new file mode 100644 index 0000000000..b087831e50 --- /dev/null +++ "b/docs/ua/modules/registry-develop/pages/registry-admin/regulations-deploy/regulations-idempot\320\265nt-deployment.adoc" @@ -0,0 +1,98 @@ += Ідемпотентне розгортання регламенту реєстру +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +== Введення + +Ця документація описує процес ідемпотентного розгортання регламенту реєстру, який розв'язує проблему неконсистентності стану регламенту через ігнорування неуспішних кроків у попередніх запусках пайплайну. Мета цього процесу - забезпечити, що всі зміни в регламенті застосовуються надійно та послідовно. + +== Проблематика + +У попередніх версіях пайплайну розгортання, певні кроки активувались тільки при внесенні змін у відповідні директорії регламенту. Якщо крок був неуспішним, але у поточному коміті змін не було, цей крок ігнорувався і вважався успішним. Це створювало проблеми з виявленням і виправленням помилок. + +== Ідемпотентний підхід + +=== Реалізація та збереження чексум + +На Платформі впроваджено ідемпотентний підхід, що включає: + +* *Порівняння станів регламенту*: поточний стан регламенту порівнюється зі станом на момент останнього успішного виконання кроку. +* *Генерування та зберігання чексум*: чексуми директорій та файлів регламенту генеруються з використанням алгоритму шифрування `SHA256` та зберігаються як секрети. + +{empty} + +Перегляд збережених чексум: :: + +Адміністратор реєстру може переглянути ці секрети через Вебінтерфейс управління кластером OpenShift: + +. Відкрийте консоль +include::platform:ROOT:partial$templates/links/platform/administrative/openshift.adoc[] +. +. Перейдіть до розділу *Workloads* > *Secrets*. +. Знайдіть секрет *`registry-regulations-state`*. У розділі *Data* ви зможете переглянути чексуми відповідних компонентів розгортання регламенту. ++ +image:registry-develop:registry-admin/regulations-deploy/idempotant-deployment/idempotant-deployment-1.png[] + +=== Практичне застосування + +. Внесіть зміни до версії-кандидата регламенту, наприклад, створіть новий бізнес-процес (_див. детальніше -- xref:registry-develop:registry-admin/admin-portal/registry-modeling/process-models/create-process.adoc[]_). +. Перевірте та застосуйте зміни до мастер-версії (_див. детальніше -- xref:registry-admin/admin-portal/version-control/candidate/overview-new-change-request.adoc[]_). + +Jenkins і MASTER-Build-пайплайн: :: + +. Перейдіть до сервісу *Jenkins* за посиланням у Кабінеті адміністратора регламентів. ++ +image:registry-develop:registry-admin/regulations-deploy/idempotant-deployment/idempotant-deployment-3.png[] + +. У пайплайні *MASTER-Build-registry-regulations* кожен крок перевіряє чексуми файлів директорій. ++ +image:registry-develop:registry-admin/regulations-deploy/idempotant-deployment/idempotant-deployment-2.png[] ++ +[NOTE] +.Крок розгортання повторно запускається, якщо: +==== +. У секреті відсутній крок з таким ім'ям. +. Чексума для хоча б однієї з директорій відрізняється від чексуми в секреті. +. Відсутня інформація про чексуму файлу у секреті. +==== + +Залежні директорії: :: + +Перевірка чексум для залежних директорій, які використовуються у декількох кроках, відбувається окремо для кожного кроку. + +=== Примусове розгортання + +Розробники регламенту мають можливість активувати примусове розгортання всіх кроків у пайплайні завдяки параметру *`FULL_DEPLOY`*: + +TIP: Запуск пайплайну публікації регламенту -- *`MASTER-Build-registry-regulations`* -- з активованою опцією *`FULL_DEPLOY`* дозволяє правильно і повністю розгорнути регламент. + +image:registry-admin/regulations-deploy/cleanup-job/cleanup-job-4.png[] + +== Відстеження змін та збереження даних після розгортання + +У нашому прикладі створено бізнес-процес, а тому зміни стосуються директорії _bpmn_. Відповідно коли в директорію _bpmn_ регламенту реєстру вносяться зміни, автоматично запускається крок `upload-business-process-changes`. Ви можете побачити відповідні записи у логах виконання пайнлайну. + +.Перевірка успішного розгортання змін до bpmn +image::registry-develop:registry-admin/regulations-deploy/idempotant-deployment/idempotant-deployment-4.png[] + +Інші кроки у пайплайні маркуються як неактивні, якщо відповідні зміни в директоріях не виявлені. Це також відображається у логах пайплайну. + +.Кроки, де зміни до файлів не виявлено +image::registry-develop:registry-admin/regulations-deploy/idempotant-deployment/idempotant-deployment-5.png[] + +Після кроку розгортання: :: ++ +* Запускається утиліта, що зберігає назву кроку, перелік директорій та чексуми у форматі JSON до секрету. ++ +.Приклад. Збереження чексуми до секрету для схеми бізнес-процесу у bpmn +[source,json] +---- +{ + "bpmn/a-new-bp-test.bpmn": "d206ee947a1f92946401a908f713398066b46f4c85e88c2bff9c27540a15461c" +} +---- + +* Після успішного збереження, статус кроку розгортання позначається як успішно пройдений. + +Завдяки цьому підходу, розробник може бути впевненим у правильному застосуванні всіх змін до регламенту реєстру, мінімізуючи ризики неконсистентності. + + diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/user-notifications/diia/diia-bp-notification.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/user-notifications/diia/diia-bp-notification.adoc index ed04c07bef..cbbb70e29c 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin/user-notifications/diia/diia-bp-notification.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin/user-notifications/diia/diia-bp-notification.adoc @@ -1,25 +1,7 @@ -:toc-title: ЗМІСТ -:toc: auto -:toclevels: 5 -:experimental: -:important-caption: ВАЖЛИВО -:note-caption: ПРИМІТКА -:tip-caption: ПІДКАЗКА -:warning-caption: ПОПЕРЕДЖЕННЯ -:caution-caption: УВАГА -:example-caption: Приклад -:figure-caption: Зображення -:table-caption: Таблиця -:appendix-caption: Додаток -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Налаштування відправлення push-повідомлень у застосунок "Дія" +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] -[preconditions] +[#preconditions] == Передумови Для налаштування функції відправлення _push_-сповіщень користувачам у мобільний застосунок "Дія", користувач має спочатку підтвердити, тобто авторизувати канал зв'язку `diia` за допомогою OTP-коду. Для підтвердження використовується xref:registry-admin/user-notifications/diia/diia-channel-confirmation-temp.adoc[окремий шаблон _channel-confirmation_], який адміністратор регламенту повинен змоделювати. @@ -201,7 +183,7 @@ TIP: У нашому прикладі вказана змінна `${usersByAttr ==== Ви можете самостійно переглянути фіксацію подій відправлення повідомлень у логах бази даних `audit`, під'єднатися до якої можливо за інструкцією: -* xref:admin:connection-database-openshift.adoc[] +* xref:registry-develop:registry-admin/db-connection/db-connection-pgadmin.adoc[] ==== .Аудит подій відправлення push-нотифікацій у "Дію" diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/user-notifications/email/config-smtp-server.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/user-notifications/email/config-smtp-server.adoc index 8477414224..d1c70e80ce 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin/user-notifications/email/config-smtp-server.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin/user-notifications/email/config-smtp-server.adoc @@ -1,23 +1,7 @@ -:toc-title: ЗМІСТ -:toc: auto -:toclevels: 5 -:experimental: -:important-caption: ВАЖЛИВО -:note-caption: ПРИМІТКА -:tip-caption: ПІДКАЗКА -:warning-caption: ПОПЕРЕДЖЕННЯ -:caution-caption: УВАГА -:example-caption: Приклад -:figure-caption: Зображення -:table-caption: Таблиця -:appendix-caption: Додаток -:sectnums: -:sectnumlevels: 5 -:sectanchors: -:sectlinks: -:partnums: - = Налаштування підключення до поштового сервера +include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] + +include::platform:ROOT:partial$admonitions/language-ua.adoc[] == Загальна інформація @@ -25,13 +9,13 @@ Наразі Платформа підтримує одну з наступних опцій налаштувань поштового сервера залежно від вимог реєстру: -* _Внутрішній поштовий сервер (*platform-mail-server*)_ -- поштовий сервер, який розповсюджується як платформний сервіс та доступний для використання усіма реєстрами одного екземпляра Платформи. +* *Платформний поштовий сервер* (`platform-mail-server`)_ -- поштовий сервер, який розповсюджується як внутрішній Платформний сервіс та доступний для використання усіма реєстрами одного екземпляра Платформи. -* _Зовнішній поштовий сервер (*external-mail-server*)_ -- зовнішній відносно Платформи поштовий сервіс (Gmail, тощо). +* *Зовнішній поштовий сервер* (`external-mail-server`)_ -- зовнішній відносно Платформи поштовий сервіс (Gmail тощо). -Налаштування зберігаються у файлі `values.yaml` конфігурації реєстру відповідно до прикладів: +Налаштування зберігаються у файлі _deploy-templates/values.yaml_ конфігурації реєстру відповідно до прикладів: -.Зовнішній сервер: +.Налаштування з'єднання із зовнішнім сервером [source, yaml] ---- global: @@ -44,7 +28,7 @@ password: 123 ---- -.Внутрішній сервер: +.Налаштування з'єднання із внутрішнім сервером [source, yaml] ---- global: @@ -53,73 +37,65 @@ type: internal ---- -== Налаштування SMTP-підключення до зовнішнього поштового сервера +== Налаштування SMTP-з'єднання із зовнішнім поштовим сервером Щоб налаштувати використання зовнішнього поштового сервера для реєстру виконайте наступні кроки. -. Увійдіть до адміністративної панелі керування кластером та реєстрами *Control Plane*. -+ -image:admin:infrastructure/cluster-mgmt/update-cluster-mgmt-01.png[] +. Увійдіть до інтерфейсу +include::ROOT:partial$templates/links/platform/administrative/control-plane.adoc[] +. -. Відкрийте меню `Реєстри`. -. Увійдіть до налаштувань реєстру. +. Відкрийте меню *Реєстри* та оберіть потрібний реєстр. + image:admin:infrastructure/update-registry-components/update-registry-components-1.png[] -. У правому верхньому куті сторінки натисніть `Редагувати`. +. У правому верхньому куті сторінки натисніть *`Редагувати`*. + -image:admin:infrastructure/update-registry-components/update-registry-components-2.png[] +image:admin:registry-management/registry-create/cp-create-registry-ua-4.png[] -. Оберіть прапорець `Редагувати налаштування SMTP`. -+ -image:registry-develop:registry-admin/config-smtp-server/config-smtp-server-01.png[] +. Перейдіть до розділу *Поштовий сервер*. -. Зі спадного списку _``Поштовий сервер``_ оберіть пункт `Зовнішній поштовий сервер`. -+ -image:registry-develop:registry-admin/config-smtp-server/config-smtp-server-02.png[] +. З випадного списку оберіть `Зовнішній поштовий сервер`. . Вкажіть параметри налаштування зовнішнього поштового сервера: -* `Хост`; -* `Порт`; -* `Поштова адреса`; -* `Пароль`. +* *Хост* +* *Порт* +* *Поштова адреса* +* *Пароль* + -image:registry-develop:registry-admin/config-smtp-server/config-smtp-server-03.png[] +image:registry-develop:registry-admin/config-smtp-server/config-smtp-server-03-ua.png[] . Натисніть `Підтвердити`, щоб зберегти налаштування. -У подальшому відправлення всіх повідомлень буде виконуватись з вказаної зовнішньої поштової адреси. +Надалі відправлення всіх повідомлень буде виконуватись з вказаної зовнішньої поштової адреси. -== Налаштування SMTP-підключення до внутрішнього поштового сервера +== Налаштування SMTP-з'єднання із Платформним поштовим сервером Щоб змінити налаштування реєстру на використання внутрішнього поштового сервера, виконайте наступні кроки. -. Увійдіть до адміністративної панелі керування кластером та реєстрами *Control Plane*. -+ -image:admin:infrastructure/cluster-mgmt/update-cluster-mgmt-01.png[] +. Увійдіть до інтерфейсу +include::ROOT:partial$templates/links/platform/administrative/control-plane.adoc[] +. -. Відкрийте меню `Реєстри`. -. Увійдіть до налаштувань реєстру. +. Відкрийте меню *Реєстри* та оберіть потрібний реєстр. + image:admin:infrastructure/update-registry-components/update-registry-components-1.png[] -. У правому верхньому куті сторінки натисніть `Редагувати`. -+ -image:admin:infrastructure/update-registry-components/update-registry-components-2.png[] +. У правому верхньому куті сторінки натисніть *`Редагувати`*. -. Оберіть прапорець `Редагувати налаштування SMTP`. +. Перейдіть до розділу *Поштовий сервер*. + -image:registry-develop:registry-admin/config-smtp-server/config-smtp-server-01.png[] +image:admin:registry-management/registry-create/cp-create-registry-ua-4.png[] -. Зі спадного списку _``Поштовий сервер``_ оберіть пункт `Платформенний поштовий сервер`. -+ -image:registry-develop:registry-admin/config-smtp-server/config-smtp-server-04.png[] +. З випадного списку оберіть `Платформний поштовий сервер`. -. Натисніть `Підтвердити`, щоб зберегти налаштування. +. Вкажіть параметри налаштування Платформного поштового сервера: + -image:registry-develop:registry-admin/config-smtp-server/config-smtp-server-05.png[] +image:registry-develop:registry-admin/config-smtp-server/config-smtp-server-04-ua.png[] + +. Натисніть *`Підтвердити`*, щоб зберегти налаштування. + [NOTE] ==== @@ -127,18 +103,18 @@ image:registry-develop:registry-admin/config-smtp-server/config-smtp-server-05.p ==== + -В результаті сформується запит на зміну конфігурації реєстру. Перейдіть до розділу +++Реєстри > Запити на оновлення+++ > ваш останній запит > натисніть іконку перегляду 👁 > відкрийте вікно для підтвердження зміни та натисніть `+++Підтвердити+++`. +У результаті формується запит на зміну конфігурації реєстру. Перейдіть до розділу *Реєстри > Запити на оновлення* > ваш останній запит > натисніть іконку перегляду 👁 > відкрийте вікно для підтвердження зміни та натисніть `*Підтвердити*`. -Надалі відправлення всіх повідомлень буде виконуватись з вказаної внутрішньої (платформної) поштової адреси: +Надалі відправлення всіх повідомлень буде виконуватись зі вказаної внутрішньої (Платформної) поштової адреси: -* *@*, _де_: +* `@`, _де_: -** ** -- назва реєстру; -** ** -- доменне ім’я кластера. +** `` -- назва реєстру; +** `` -- доменне ім'я кластера. [NOTE] ==== -Налаштування внутрішнього SMTP-сервера виконує адміністратор платформи. Детальну інформацію можна отримати за посиланням: +Налаштування внутрішнього SMTP-сервера виконує адміністратор Платформи. Детальну інформацію можна отримати за посиланням: * xref:admin:installation/internal-smtp-server-setup.adoc[] ==== diff --git a/docs/ua/modules/registry-develop/pages/registry-admin/user-notifications/email/e-mail-notification.adoc b/docs/ua/modules/registry-develop/pages/registry-admin/user-notifications/email/e-mail-notification.adoc index df4f3d5167..b4aa3933ae 100644 --- a/docs/ua/modules/registry-develop/pages/registry-admin/user-notifications/email/e-mail-notification.adoc +++ b/docs/ua/modules/registry-develop/pages/registry-admin/user-notifications/email/e-mail-notification.adoc @@ -38,6 +38,7 @@ Відправка повідомлень системою можлива лише зареєстрованим користувачам. +[#email-notification-temp] == Налаштування шаблону повідомлення Для реалізації функціональності відправки email-повідомлень користувачам кабінету через електронну пошту, необхідно створити шаблон повідомлення, що буде використовуватися при моделюванні бізнес-процесу. diff --git a/docs/ua/modules/registry-develop/pages/registry-audit-instruction/modules/bp-audit.adoc b/docs/ua/modules/registry-develop/pages/registry-audit-instruction/modules/bp-audit.adoc new file mode 100644 index 0000000000..35c55ea7ce --- /dev/null +++ b/docs/ua/modules/registry-develop/pages/registry-audit-instruction/modules/bp-audit.adoc @@ -0,0 +1,477 @@ += Аудит бізнес-процесів + +|=== +|Назва | Критичність + +|<<_bp_01>> |Висока +|<<_bp_02>> |Висока +|<<_bp_03>> |Висока +|<<_bp_04>> |Висока +|<<_bp_05>> |Середня +|<<_bp_06>> |Середня +|<<_bp_07>> |Середня +|<<_bp_08>> |Висока +|<<_bp_09>> |Низька +|<<_bp_10>> |Низька +|<<_bp_11>> |Низька +|<<_bp_12>> |Низька +|<<_bp_13>> |Низька +|<<_bp_14>> |Висока +|<<_bp_15>> |Висока +|<<_bp_16>> |Середня +|<<_bp_17>> |Середня +|<<_bp_18>> |Висока + +|=== + +[#_bp_01] +== BP-01. X-Access-Token в сервісних задач +Використовувати в сервісних задачах X-Access-Token, який був отриманий в поточній транзакції бізнес-процесу + +IMPORTANT: Критичність: висока + +.Опис +При використанні _juel_ функцій для отримання користувацького авторизаційного токену (наприклад, +_completer('ActivityId').accessToken_, _initiator().accessToken_) треба впевнитись, що місце використання функції та +відповідна актівіті (користувацька задача, або початкова подія) знаходяться в одній транзакції бізнес-процесу. + + +.Вплив +Термін дії користувацького авторизаційного токена може закінчитися, поки бізнес-процес дійде до точки використання. +Може бути не виявлено на етапі розробки та тестування через відсутність відповідних умов (задача, яку не беруть у +виконання понад 5 хв, довга транзакція, тимчасова недоступність сервісу тощо) + + +.Рекомендації +Використовувати токен користувача найближчої до точки використання задачі або токен системного користувача +(_system_user().accessToken_) + +NOTE: При використанні токена системного користувача в історичну таблицю будуть внесені дані саме цього користувача, +а не дані безпосередньо ініціатора зміни. В такому випадку рекомендується розглянути розширення дата моделі регламенту +для внесення даних про ініціатора явно. + +[#_bp_02] +== BP-02. Довгі транзакції бізнес-процесів +При наявності в бізнес-процесі транзакцій, які потенційно можуть виконуватись довгий час, треба розділяти їх на окремі +транзакції. + +IMPORTANT: Критичність: висока + +.Опис +При моделюванні бізнес-процесів необхідно розділяти великі транзакції та робити якомога більше задач асинхронними для +надійності виконання та спрощення реагуванні на можливі помилки. + +.Вплив +Довгі транзакції можуть призвести до наступних проблем: + +* Вичерпання пулу з'єднань до бази даних і блокування виконання інших бізнес-процесів. +* При виникненні помилки, політики повтору (retry policy) будуть виконуватися від початку транзакції, виконуючи всі +задачі, які вже були виконані +* Час життя _X-Access-Token_, який використовується в сервісних задачах транзакції може закінчитися, поки транзакція +виконується +* Якщо початком транзакції є користувацька задача: +** Користувач буде бачити лоадер і не отримає повідомлення про успішно виконану операцію, поки транзакція не буде +завершена +** Транзакції на Кафці пов'язані з транзакціями на _Сервісі виконання бізнес-процесів_ при виконанні користувацьких +задач і обмежені по часу у 30 секунд. +** Проксі сервери мають обмеження на час виконання запиту у 30 секунд. Тобто при перевищенні цього показника часу +користувацький запит буде відхилено. + +.Рекомендації +В задачах транзакції проставляти атрибути _camunda:asyncBefore_ або _camunda:asyncAfter_ зі значенням _true_ для +асинхронного продовження (_Asynchronous Continuations_) бізнес-процесу, що призведе до створення нової транзакції. +Додатково слід враховувати роботу з користувацьким токеном (<<_bp_01>>) та несталими +змінами (<<_bp_07>>) при моделюванні асинхронних задач. + +NOTE: Детальніше про транзакції у Camunda можна ознайомитись +https://docs.camunda.org/manual/7.19/user-guide/process-engine/transactions-in-processes/[за посиланням] + +[#_bp_03] +== BP-03. Транзакції в циклах +При наявності циклів в бізнес-процесі, розпочинати кожну ітерацію в окремій транзакції + +IMPORTANT: Критичність: висока + +.Опис +Причиною довгої транзакції може бути цикл, який виконує велику кількість ітерації, тому при моделюванні циклів в +бізнес-процесах необхідно застосовувати асинхронне виконання для кожної ітерації. + +.Вплив +При наявності циклів, які мають велику кількість ітерацій _Camunda Engine_ тримає транзакцію на базі даних протягом всього +часу його виконання, що може призвести до впливу довгих транзакцій, які описані в <<_bp_02>>. +Додатково слід зауважити, що при виникненні помилки на 100-ій ітерації, буде спроба виконати всі ітерації, починаючи з +першої. + +.Рекомендації +Проставляти _camunda:asyncBefore_ атрибут після першої актівіті у циклі (це може бути сервісна задача, або початкова +подія у випадку під-процесу) або _camunda:asyncAfter_ останньої актівіті у циклі. Потрібно також врахувати та виключити +використання несталих (transient) змінних, які були отримані у бізнес-процесі до першої операції у циклу. + +[#_bp_04] +== BP-04. Стратегія повторних спроб (retry time cycle) +Перевизначати стратегію повторних спроб (retry time cycle) для асинхронних задач. + +IMPORTANT: Критичність: висока + +.Опис +За замовчуванням при виникненні помилки при виконанні асинхронних задач виконавець робіт (job executor) буде пробувати +виконати задачу ще 3 рази без пауз між ними. У більшості випадків причиною помилки може бути виклик іншого сервісу як +всередині системи, так і за її межами, який міг бути тимчасово недоступний. В такому випадку негайний повтор не призведе +до якихось змін і врешті решт задача буде помічена невдалою (failed) і може бути перезапущена тільки вручну +_Адміністратором реєстру_ у _Сервісі адміністрування бізнес-процесами_ + +.Вплив +При виникненні помилки під час виконання асинхронних задач у більшості випадків повторні спроби не призводять до +успішного завершення задачі, а лише ще більше навантажують сервіс з яким могла виникнути проблема. + +.Рекомендації +Для асинхронних задач встановити атрибут циклу повторних спроб _camunda:failedJobRetryTimeCycle_ з певною затримкою, +наприклад, 5 спроб кожні 5 хвилин _R5/PT5M_. В процесі експлуатації значення може бути адаптоване відповідно до поведінки +бізнес-процесу. + +NOTE: Детальніше про повторні спроби у Camunda можна ознайомитись https://docs.camunda.org/manual/7.19/user-guide/process-engine/the-job-executor/#retry-time-cycle-configuration[за посиланням] + +[#_bp_05] +== BP-05. Ліміт для критеріїв пошуку +При використанні сервісної задачі з пошуку сутностей в фабриці даних, треба явно задавати параметр по максимальній +кількості даних (limit), які можуть бути отримані. + +IMPORTANT: Критичність: середня + +.Опис +При використанні задач з пошуку даних в реєстрі, параметр з максимальною кількістю даних (limit) не є обов'язковим, і +часто не вказується при роботі з таблицями, які на етапі розробки містять невелику кількість даних. Однак, при використанні +в промисловому середовищі такі запити потенційно можуть нести набагато більше даних, що може призвести до деградації роботи +системи. + +.Вплив +Велика кількість даних, отримана при використанні сервісної задачі з відсутнім параметром ліміту, може призвести до +наступних потенційних проблем: + +* Додаткове навантаження на сервіси системи: +** Реляційна база даних +** Сервіс синхронного управління даними реєстру +** Сервіс виконання бізнес-процесів + +* Збільшений час виконання бізнес-процесу +* Збільшений час виконання окремої транзакції бізнес-процесу + +.Рекомендації +Завжди вказувати параметр ліміту (limit) для сервісних задач з пошуку даних. Можливі сценарії використання: + +=== Пошук обмеженої кількості елементів +Якщо за бізнес-логікою відомо що після виконання запиту обробляється тільки певна кількість даних (наприклад, перший +елемент зі списку), то треба явно обмежити запит цією кількістю. + +=== Обробка всіх даних за результатами пошуку +Якщо бізнес-процес повинен обробити всі дані, то треба розглянути поетапну обробку елементів (можливо, пачками) +в циклі та пагінацією при використанні сервісних задач з пошуку даних. + +=== Інтеграція з зовнішніми системами +При необхідності запитів зовнішніми системами для вибірки даних з реєстру в першу чергу треба розглянути можливість +використання напряму АПІ для читання даних без залучення бізнес-процесу (але все одно з обов'язковими параметрами пагінації). +Якщо ж відповідна інтеграція потребує певної логіки бізнес-процесу, то треба додати відповідні параметри пагінації як +вхідні атрибути бізнес-процесу та імплементувати логіку пагінації на системі, що інтегрується. + +[#_bp_06] +== BP-06. Складна логіка в скриптових задачах +При використанні скриптових задач слід уникати складної логіки і робити їх якомога простішими. + +IMPORTANT: Критичність: середня + +.Опис +Скриптові задачі дозволяють писати доволі складну логіку, використовуючи всю потужність мови Groovy, що в +короткостроковій перспективі (наприклад, розробка прототипів) можуть допомогти розробнику, але впроваджують перелік +ризиків пов'язаних з підтримкою та розробкою в майбутньому. + +.Вплив +Важливі аспекти, пов'язані з використанням складної логіки в скриптових задачах: + +* Супроводження: Складну логіку складно розуміти, обслуговувати та усунути. Це може зробити бізнес-процес важким для +управління та розвитку з часом і призвести до потенційних помилок та повільніших циклів розробки. +* Тестування: скриптові завдання зі складною логікою можуть бути важкими для ізольованого тестування, що ускладнює +забезпечення якості та надійності процесу. +* Продуктивність: складна логіка у скриптових завданнях може вплинути на продуктивність, особливо якщо вона містить +операції, що споживають багато ресурсів або довготривалі задачі. +* Обробка помилок: обробка помилок у скриптових задачах може бути складною, що ще більше ускладнює супроводження та +розуміння скрипту + +.Рекомендації +* Використовувати скриптові задачі для простих, коротких та зрозумілих операцій +* Використовувати можливості DMN та BPMN для будь-якої бізнес-логіки в бізнес-процесах +* Використовувати вбудовані можливості _Camunda Spin_ для роботи з +https://docs.camunda.org/manual/7.19/user-guide/data-formats/xml/[XML] та +https://docs.camunda.org/manual/7.19/user-guide/data-formats/json/[JSON] + +[#_bp_07] +== BP-07. Робота з несталими (transient) змінними +При моделюванні бізнес-процесів слід враховувати, що деякі змінні можуть бути несталими (transient) та не зберігатись +при переході на наступну транзакцію. + +IMPORTANT: Критичність: середня + +.Опис +При моделюванні бізнес-процесів є певний перелік сервісних задач, які виконують виклики, як всередині системи, так і на +зовнішні сервіси, наприклад, виклики до фабрики даних, сервісу управління користувачами та ролями, сервісу підпису, +Трембіти та інші. Результат будь-якого такого виклику може містити персональні дані користувача, тому зберігається як +нестала (transient) змінна і є доступна тільки в поточній транзакції бізнес-процесу. + +.Вплив +Результат виклику сервісної задачі буде недоступний після переходу межі бізнес-процесу (користувацька задача, асинхронне +продовження, очікування повідомлення тощо) + +.Рекомендації +* Використовувати результат виконання виклику сервісної задачі відразу після отримання результату в рамках однієї транзакції +* Якщо результат виклику сервісної задачі потрібно використовувати в наступних транзакціях і вони не містять персональних +даних, зберігати результат в сталій змінній бізнес-процесу +* Якщо результат виклику містить змішані дані, але надалі використовується тільки неперсональна частина з них (наприклад, +ідентифікатор сутності), відокремити її та зберегти як окрему сталу змінну + +NOTE: Детальніше про несталі змінні в Camunda можна ознайомитись +https://docs.camunda.org/manual/7.19/user-guide/process-engine/variables/#transient-variables[за посиланням] + +[#_bp_08] +== BP-08. Декілька викликів фабрики даних в одній транзакції +Для збереження складної сутності та транзакційного запису в декілька таблиць використовувати функціонал вкладених +сутностей (nested entity). + +IMPORTANT: Критичність: висока + +.Опис +При моделюванні бізнес-процесу може виникнути необхідність оновлення декількох таблиць бази даних в рамках однієї +транзакції (бази даних, не плутати з транзакцією бізнес-процесу). Тобто щоб або всі таблиці були оновлені, або жодна з них. +На рівні виконання бізнес-процесу не має можливості пов'язати декілька викликів фабрики даних в одну транзакцію, тому +декілька послідовних викликів фабрики даних в одному бізнес-процесі можуть призвести до створення неконсистентних даних +в базі даних. + +.Вплив +* Створення неконсистентних даних в базі даних після виникнення помилки між окремими викликами фабрики даних. В залежності +від логіки та моделі регламенту може призвести до повного блокування роботи з конкретним записом. +* При виникненні помилки, політика повторних спроб виконання бізнес-процесу розпочне виконання з початку, що може призвести +до повторної вставки даних в окрему таблицю. + +.Рекомендації +* Використовувати функціонал вкладених сутностей (nested entity) для збереження складної сутності та транзакційного +виконання оновлення декількох таблиць бази даних в рамках однієї транзакції +* Якщо функціоналу по роботі з вкладеними сутностями виявилось недостатньо, розглянути наступні практики: +** Моделювання компенсації в бізнес-процесі. При виникненні помилки виконання бізнес-процесу виконати відкат змін у вигляді +викликів фабрики даних на видалення створених записів або відновлення попереднього стану +** Налаштувати кожну вставку в базу даних з асинхронним продовженням бізнес-процесу і відповідними політиками повторних +спроб. Це дозволить закінчити умовну транзакцію вставки в базу даних після усунення причини виникнення помилки +** Розташування окремих викликів фабрики даних один за одним в бізнес-процесі. Чим більше буде проміжних задач між викликами, +тим більше ймовірність виникнення помилки між вставками і невдалого виконання транзакції + +[#_bp_09] +== BP-09. Ініціалізація та використання змінних +IMPORTANT: Критичність: низька + +.Опис +При необхідності створення додаткової змінної в бізнес-процесі ініціалізувати її якомога ближче до місця використання. + +.Вплив +* Погіршує читабельність та розуміння бізнес-процесу +* Ускладнює виявлення можливих помилок +* Зайве використання пам'яті при збереженні сталих змінних + +.Рекомендації +Ініціалізувати змінну безпосередньо перед її використанням. Під ініціалізацією змінної може бути як і явне її створення, +так і використання будь-яких задач, результат яких також зберігається як змінна. + +[#_bp_10] +== BP-10. Ідентифікатори елементів бізнес-процесів +IMPORTANT: Критичність: низька + +.Опис +Присвоювати технічно доречні ідентифікатори всім елементам бізнес-процесу в BPMN діаграмі. + +.Вплив +Ідентифікатори елементів бізнес-процесу постійно використовуються в технічних логах, і підхід до доречного іменування +полегшує сприйняття і розуміння причини виникнення помилки. + +.Рекомендації +Першим чином, розглянути перейменування процесів, актівіті (activity), повідомлень і ідентифікаторів помилок. Також +важливими елементами будуть шлюзи (gateways) і їх гілки виконання (sequence flows). Детальніше з конвенцією іменування +можна ознайомитись +https://docs.camunda.io/docs/components/best-practices/modeling/naming-technically-relevant-ids/#using-naming-conventions-for-bpmn-ids[за посиланням] + +[#_bp_11] +== BP-11. Створення читабельних BPMN діаграм +IMPORTANT: Критичність: низька + +.Опис +При моделюванні BPMN діаграм використовувати загально прийняті практики. + +.Вплив +* Покращує читабельність і розуміння BPMN діаграми. +* Полегшує онбордінг нових членів команди +* BPMN діаграма стає зрозумілим і важливим інструментом при комунікації зі стейкхолдерами +* При необхідності загальної публікації опису послуги не потребує додаткового форматування + +.Рекомендації +Орієнтуватися на +https://docs.camunda.io/docs/components/best-practices/modeling/creating-readable-process-models/#modeling-from-left-to-rightp[офіційну документацію] +Camunda з кращих практик моделювання BPMN діаграм. Деякі з рекомендацій наведені нижче: + +* https://docs.camunda.io/docs/components/best-practices/modeling/creating-readable-process-models/#labeling-bpmn-elements[Маркування елементів BPMN] +* https://docs.camunda.io/docs/components/best-practices/modeling/creating-readable-process-models/#modeling-symmetrically[Моделювання симетрично] +* https://docs.camunda.io/docs/components/best-practices/modeling/creating-readable-process-models/#modeling-from-left-to-right[Моделювання зліва направо] +* https://docs.camunda.io/docs/components/best-practices/modeling/creating-readable-process-models/#creating-readable-sequence-flows[Створення читабельних потоків послідовностей (sequence flows)] +* https://docs.camunda.io/docs/components/best-practices/modeling/creating-readable-process-models/#modeling-explicitly[Моделювання явно (modeling explicitly)] +* https://docs.camunda.io/docs/components/best-practices/modeling/creating-readable-process-models/#avoiding-lanes[Уникання смуг (lanes)] +* https://docs.camunda.io/docs/components/best-practices/modeling/creating-readable-process-models/#emphasizing-the-happy-path[Підкреслення основного флоу (happy path))] + +[#_bp_12] +== BP-12. Цикли за допомогою багатоекземплярних (multi-instance) підпроцесів +IMPORTANT: Критичність: низька + +.Опис +При моделюванні циклів розглянути можливість використання багатоекземплярних (multi-instance) підпроцесів замість +циклів з використанням шлюзів (gateways). + +.Вплив +В деяких випадках може покращити читабельність BPMN діаграми, внаслідок видалення технічних складових з бізнес-процесу +таких як: + +* Явне створення і керування змінними для ітерації +* Перевірка умови завершення циклу з використанням шлюзів (gateways) + +.Рекомендації +* Виділити логіку для окремої ітерації циклу в під-процес (sub-process) +* Змінити тип під-процесу на багатоекземплярний (multi-instance) +* Налаштувати параметри для багатоекземплярного (multi-instance) під-процесу: +** _camunda:collection_ - для кожного елементу колекції буде створено окремий інстанс під-процесу і виконана логіка +ітерації +** _camunda:elementVariable_ - змінна в якій буде зберігатися конкретний елемент колекції для кожної ітерації +** _completionCondition_ - додаткова умова для завершення циклу до кінця ітерації +** _loopCardinality_ - кількість ітерацій циклу (як альтернатив використання колекції) + +NOTE:: Детальніше про багатоекземплярні (multi-instance) підпроцеси можна прочитати в +https://docs.camunda.io/docs/components/modeler/bpmn/multi-instance/[офіційній документації] + +[#_bp_13] +== BP-13. Логування в скриптових задачах +IMPORTANT: Критичність: низька + +.Опис +Часто в скриптових задачах використовуються методи _print_ / _println_ для логування даних в консоль, що є припустимим +при розробці бізнес-процесу, але не прийнятно для промислових середовищ. + +.Вплив +Використання методів _print_ / _println_ в скриптових задачах призводить до логування інформації в _Сервісі виконання +бізнес-процесів_, які надалі не можна пов'язати з конкретним бізнес-процесом та запитом користувача. + +.Рекомендації +* Розглянути можливість відмови від додаткового логування в скриптових задачах взагалі. У більшості випадків логування +моделювальникам необхідне для налагодження бізнес-процесу на етапі розробки +* Якщо логування все ж необхідне, то рекомендується ініціалізувати _org.slf4j.Logger_ та використовувати його методи +* Додатково важливо перевірити, що в процесі логування не використовується жодна персональна чи конфіденційна +інформація + +[#_bp_14] +== BP-14. Авторизаційні токени для викликів зовнішніх сервісів +IMPORTANT: Критичність: висока + +.Опис +В регламенті реєстру, а зокрема в файлах бізнес-процесу (BPMN) не повинно бути жодних авторизаційних токенів чи паролів +для викликів зовнішніх сервісів. + +.Вплив +Регламент реєстру не є захищеним сховищем і зберігання токенів в ньому може призвести до їх витоку і використання +третіми особами. + +.Рекомендації +Всі авторизаційні токени для викликів зовнішніх сервісів повинні бути зареєстровані відповідно до xref:arch:architecture/platform/administrative/control-plane/platform-evolution/registry-regulation-secrets.adoc[документу] + +[#_bp_15] +== BP-15. Таймери на користувацьких задачах +IMPORTANT: Критичність: висока + +.Опис +При роботі з бізнес-процесами реєстру відповідальні особи працюють з користувацькими задачами (user task), які були на +них призначені і які з тих чи інших причин можуть бути виконані та забуті. Одним з можливих рішень є використання +таймерів з автоматичним завершенням бізнес-процесу + +.Вплив +Велике накопичення відкритих бізнес-процесів через користувацькі задачі, які вже не будуть виконані призводить до +безпотрібного навантаження на систему та використання її ресурсів та необхідності виконання додаткових операцій по +видаленню запущених бізнес-процесів + +.Рекомендації +На користувацьких задачах, що потенційно можуть бути забуті, рекомендується використовувати timer boundary event, який +по закінченню налаштованого часу автоматично буде переривати виконання бізнес-процесу та призводити до його завершення. +Додатково можна розглянути виділення критичних секцій в підпроцеси і використання такого роду івентів на них. + +NOTE: Про використання timer boundary event можна ознайомитись https://docs.camunda.org/manual/7.19/reference/bpmn20/events/timer-events/#timer-boundary-eventх[за посиланням] + +[#_bp_16] +== BP-16. Зменшення дублікації коду +IMPORTANT: Критичність: середня + +.Опис +Уникати дублювання однакових послідовностей блоків при моделюванні бізнес-процесів + +.Вплив +* Ускладнення візуального сприйняття бізнес-процесу +* Збільшення часу на розробку та тестування бізнес-процесу +* За потреби внесення змін в одну з послідовностей блоків, необхідно буде вносити зміни в усі блоки, що дублюються +* Збільшення ймовірності допускання помилок при внесенні змін + +.Рекомендації +* Винести спільну логіку в окремий підпроцес +* Видалити блоки, що дублюються та викликати підпроцес за допомогою call activity +* В окремих випадках можна також уникнути дублювання шляхом рефакторингу логіки бізнес-процесу об'єднання різних гілок +виконання + +NOTE: Детальніше про під-процеси можна ознайомитись в https://docs.camunda.org/manual/7.19/reference/bpmn20/subprocesses/call-activity/[офіційній документації] та +https://youtu.be/l4w1n2KUR6Q?t=565&si=q2Qb7bK6Wg8b1iNO[відео] + +[#_bp_17] +== BP-17. Робота з бізнес-ключами +IMPORTANT: Критичність: середня + +.Опис +Задавати бізнес-ключ бізнес-процесу (business key) якомога раніше в процесі його виконання + +.Вплив +* Наявність бізнес-ключа спрощує пошук та фільтрацію бізнес-процесів: +** В операційній базі даних _Camunda_ при наявності помилок виконання +** В історичній базі даних _Camunda_ при завершенні бізнес-процесу +* Якщо бізнес-ключ встановлюється в кінці виконання бізнес-процесу в одній з гілок, то можливі наступні проблеми: +** При виникненні помилки до встановлення бізнес-ключа, бізнес-процес не буде його мати +** Можливо забути встановити бізнес-ключ в одній з гілок +** Потенційне дублювання коду для встановлення бізнес-ключа в кінці кожної з гілок +(див. <<_bp_16>>) +* Наявність контекстної інформації в бізнес-ключі спрощує ідентифікацію потенційних проблем при виконанні бізнес-процесу. + +.Рекомендації +* Встановлювати бізнес-ключ відразу після можливості його визначення +* В бізнес-ключ можна передавати інформацію про контекст бізнес-процесу, наприклад, номер заявки, номер договору або +параметри з якими був запущений бізнес-процес чи виконана користувацька задача + +NOTE: На момент написання статті окремого способу зберегти додаткову контекстну інформацію про бізнес-процес для подальшого +збереження в історичну таблицю не існує + +[#_bp_18] +== BP-18. Історичні події для високонавантажених бізнес-процесів +IMPORTANT: Критичність: висока + +.Опис +При виконанні бізнес-процесів для нього зберігаються історичні події пов'язані з його проходженням, такі як виконання +задачі, зберігання окремих видів змінних тощо. Процес зберігання історичних подій може суттєво навантажувати систему +і навіть бути причиною помилок, якщо кількість таких процесів є досить великою. Рекомендується відповідним чином адаптувати +бізнес-процес, якщо прогнозується високе навантаження на нього. + +.Вплив +* Додаткове навантаження на _Підсистему асинхронного обміну повідомленнями_ та _Сервіс фіксації історичних подій_ через +велику кількість історичних подій в процесі виконання бізнес-процесів, що призводить до збільшення часу затримок і +відмови окремих компонентів системи +* Додаткове навантаження на _Підсистему управління реляційними базами даних_, що можуть призвести до відмови ключових +сервісів, таких як _Сервіс виконання бізнес-процесів_, що практично повністю блокує роботу реєстру + +.Рекомендації +* Ідентифікувати бізнес-процеси, для яких планується високе навантаження (понад 50 тисяч запусків на день) +* Для таких бізнес-процесів провести наступні оптимізації, які можуть суперечити іншим рекомендаціям з цього розділу: +** Мінімізувати кількість задач, що виконуються в процесі виконання бізнес-процесу. Розглянути можливість заміни +скриптових задач на _Execution Listener_ або використання _Expression Language_ для створення змінної безпосередньо +в місці її використання +** Розглянути відмову від використання підпроцесів і перенесення логіки в тіло основного бізнес-процесу +** Відмовитись від використання бізнес-ключів та встановлення результату бізнес-процесу. Для автоматичних бізнес-процесів +та бізнес-процесів, що запускаються зовнішніми системами - це обов'язковий пункт \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/pages/registry-audit-instruction/modules/dm-audit.adoc b/docs/ua/modules/registry-develop/pages/registry-audit-instruction/modules/dm-audit.adoc new file mode 100644 index 0000000000..b0734bddf1 --- /dev/null +++ b/docs/ua/modules/registry-develop/pages/registry-audit-instruction/modules/dm-audit.adoc @@ -0,0 +1,214 @@ += Аудит моделі даних + +|=== +|Назва | Критичність + +|<<_dm_01>> |Висока +|<<_dm_02>> |Середня +|<<_dm_03>> |Низька +|<<_dm_04>> |Висока +|<<_dm_05>> |Висока +|<<_dm_06>> |Висока +|<<_dm_07>> |Середня +|<<_dm_08>> |Висока +|<<_dm_09>> |Висока + +|=== + +[#_dm_01] +== DM-01. Індекси для критеріїв пошуку +IMPORTANT: Критичність: висока + +.Опис +Створюйте індекси необхідні для оптимальної продуктивності запитів критеріїв пошуку. При цьому слідкувати за тим щоб не +створювалися дублікати або зайві індекси. + +.Вплив +Належне індексування є важливим у реляційних базах даних для покращення продуктивності запитів. Без індексів система +управління базами даних (СУБД) мусить сканувати всю таблицю, що може бути дуже повільним для великих наборів даних. + +Головними кандидатами на індексування є стовпці по яких відбувається пошук та стовпці по яких відбувається з'єднання +таблиць у запитах. + +Створення індексів може значно покращити продуктивність запитів, але є ситуації, коли варто утриматися від створення +індексу або ретельно розглянути, чи варто його створювати: + +* Якщо стовпець має дуже низьку селективність, тобто в ньому мало різних значень в порівнянні з загальною кількістю +рядків, створення індексу може не суттєво покращити продуктивність запитів. Наприклад, стовпець із всього двома різними +значеннями, такими як "Так" і "Ні", немає сенсу індексувати. + +* Малі таблиці з невеликою кількістю рядків може бути не вигідно індексувати. Накладні витрати на підтримку структури +даних індексу можуть перевищити потенційні прирости продуктивності запитів. + +* Індекси не покращать запити, що виконують агрегації (наприклад, SUM, AVG, COUNT) по всій таблиці, оскільки для цих +операцій потрібно сканувати весь набір даних, незалежно від наявності індексів. + +* Дубльовані індекси слід уникати, оскільки вони витрачають ресурси, збільшують витрати на обслуговування і можуть +призвести до непередбачуваної продуктивності запитів. + +.Рекомендації +Використовуйте атрибут `indexing="true"` тегу `ext:createSearchCondition` для автоматичного створення необхідних +індексів на стовпці по яких відбувається пошук. + +Використовуйте тег `createIndex` для ручного створення індексів, наприклад для ключів по яких відбувається join. + +Звертайте увагу на те що система автоматично створює індекси для первинних ключів, унікальних ключів та стовпців пошуку, +якщо ввімкнено `indexing="true"` тегу `ext:createSearchCondition`, та не створюйте індексів які їх дублюють. + +Своєчасно видаляйте дублікати та зайві індекси за допомогою тегу `dropIndex`. + +[#_dm_02] +== DM-02. Зайві чендж сети в рамках 1 релізу +IMPORTANT: Критичність: середня + +.Опис +Видаляйте непотрібні чендж сети та зміни створені в процесі розробки, до релізу в промислове середовище. + +.Вплив +* Зі зростанням кількості чендж сетів збільшується складність файлу changelog, що робить його важким у керуванні та +розумінні. +* Чим більше чендж сетів у вас є, тим більше часу займає застосування змін в базі даних. + +.Рекомендації +Користуйтесь можливістю виділяти зміни в моделі даних, які були створені в процесі розробки релізу. Наприклад якщо ви +створили таблицю і потім вирішили до неї додати колонку не створюйте новий чендж сет `addColumn`, а перестворіть таблицю +з новою колонкою. Так само якщо ви створили критерій пошуку, а потім вирішили його змінити або видалити, просто змініть +або видаліть оригінальний чендж сет. Такі операції можуть потребувати очищення розробницького оточення за допомогою +`clean-up`. + +[#_dm_03] +== DM-03. Іменування ідентифікаторів чендж сетів +IMPORTANT: Критичність: низька + +.Опис +Додержуйтесь єдиної конвенції в найменуваннях ідентифікаторів чендж сетів. + +.Вплив +Прийняття чіткої та послідовної конвенції найменування для ідентифікаторів чендж сетів допоможе організувати та зрозуміло +представити зміни в схемі бази даних. + +.Рекомендації +Встановіть конвенцію для найменування та послідовно дотримуйтеся її протягом усього проєкту. Це забезпечить розуміння +всім членам команди правил найменування та легкої ідентифікації змінних. + +Використовуйте описові назви, які пояснюють призначення або характер змін. Добре обрана назва повинна чітко розкривати +суть зміни. + +TIP: З найкращими практиками використання liquibase можна ознайомитися за посиланням https://www.liquibase.org/get-started/best-practices[Best Practices] + +[#_dm_04] +== DM-04. Перелік колонок в критеріях пошуку +IMPORTANT: Критичність: низька + +.Опис +Додавати в критерії пошуку тільки ті колонки, що використовуються в бізнес-процесі, формах чи зовнішньому АПІ. +Якщо колонка не використовується в пошуку, то вона не повинна бути включена в критерії пошуку. + +.Вплив +* Більші за об'ємом результати обробляються довше, що збільшує навантаження на систему. +* Коли запити повертають більше інформації, ніж це потрібно, це може призвести до витоку конфіденційної інформації, особливо якщо ці дані не правильно обробляються. +* Наявність файлів в критеріях пошуку і їх виклик з бізнес-процесу призводить до перекладання файлів між постійним та +тимчасовим сховищем, що впливає на час виконання операції та призводить до додаткового навантаження на систему + +.Рекомендації +* Передавати лише ті дані, які дійсно необхідні для виконання конкретної операції. +* Не робити 1 критерій пошуку для всіх потреб (аналогія антипатерну _"God Object"_). Краще зробити декілька критеріїв +пошуку, що будуть задовільняти конкретні потреби. + +[#_dm_05] +== DM-05. Ліміти на критерії пошуку +IMPORTANT: Критичність: висока + +.Опис +Завжди вказуйте ліміт при моделюванні критеріїв пошуку + +.Вплив +Якщо зовнішній сервіс чи бізнес-процес не вкаже ліміт при визові критерію пошуку, та на самому критерії ліміт не вказано, +це може призвести як до витоку даних, так і до проблем з продуктивністю системи. + +.Рекомендації +Вказуйте ліміт для критерію пошуку, користуючись атрибутом `limit` тегу `ext:createSearchCondition` + +[#_dm_06] +== DM-06. Нормалізація схеми бази даних +IMPORTANT: Критичність: висока + +.Опис +Моделюйте схему бази даних в третій нормальній формі. + +.Вплив +Третя нормальна форма (3NF) усуває або значно зменшує повторення даних. Це мінімізує ризик невідповідності та аномалій +в даних, які можуть виникнути, коли однакові дані зберігаються в кількох місцях. Вона сприяє існуванню єдиного джерела +правди для кожного фрагмента даних. + +Шляхом усунення повторення даних та забезпечення логічного та організованого зберігання кожного фрагмента даних, 3NF +підвищує цілісність даних. Дані залишаються точними та надійними, зменшуючи ризик помилок. + +Також завдяки уникненню повторення даних, схеми 3NF зазвичай потребують менше простору для зберігання. Це важливо для +економії витрат та ефективного використання ресурсів, особливо в великих базах даних. + +.Рекомендації +Використовувати 3-ю нормальну форму (3NF) як базову для моделювання схеми. + +В випадках коли відступ від 3NF є обґрунтованим, наприклад для оптимізації продуктивності, треба глибоко розуміти та +враховувати компроміси які виникають. + +[#_dm_07] +== DM-07. Часткове оновлення +IMPORTANT: Критичність: середня + +.Опис +При необхідності оновлення сутності в бізнес-процесі надавати перевагу частковому оновленню (partial update) замість +стандартного повного оновлення сутності. + +.Вплив +* Спрощує логіку бізнес-процесу +* Менше викликів до бази даних. Немає потреби додатково вичитувати сутність для подальшого її оновлення + +NOTE: Треба пам'ятати, що при використанні часткового оновлення, всі поля, які в ньому присутні повинні бути передані. +Інакше, вони будуть встановлені в NULL. + +.Рекомендації +Створюйте API для часткового оновлення за допомогою тегу `ext:partialUpdate` та використовуйте при необхідності +оновлювати частину стовпців сутності. + +[#_dm_08] +== DM-08. SQL тег Liquibase +IMPORTANT: Критичність: висока + +.Опис +Використовуйте стандартні теги _Liquibase_ що надаються платформою. + +.Вплив +SQL-вирази, написані в чендж сетах, можуть виявитися не сумісними з новими версіями платформи. + +Liquibase забезпечує перевірку та виявлення помилок для стандартних тегів. На відміну від цього, SQL-вирази в чендж +сетах не перевіряються Liquibase, і помилки можуть бути виявлені лише під час виконання. + +.Рекомендації +Використовуйте стандартні теги _Liquibase_ що підтримуються платформою. + +Якщо з'являється необхідність використати SQL, обов'язково ретельно тестуйте та перевіряйте ваші чендж сети, щоб +переконатися, що вони працюють правильно і не вводять помилок у схему бази даних. + +[#_dm_09] +== DM-09. Пагінація (Посторінкова навігація) на критеріях пошуку +IMPORTANT: Критичність: висока + +.Опис +Використовуйте можливості пагінації при моделюванні критеріїв пошуку + +.Вплив +Пагінація зменшує обсяг передаваних даних, поліпшуючи роботу мережі. + +Надання посторінкових результатів дозволяє користувачам переглядати дані у керованих частинах. + +Менші за об'ємом результати обробляються швидше, що зменшує навантаження на сервер бази даних. + +.Рекомендації +Обирайте необхідний тип пагінації за допомогою атрибуту `pagination` тегу `ext:createSearchCondition`. + +* Для випадків коли необхідно щоб поверталась також і інформація про загальну кількість сторінок та рядків - +`pagination="page"` +* Для випадків коли інформація про загальну кількість сторінок та рядків не потрібна - `pagination="offset"`. Це тип +пагінації за замовчанням. diff --git a/docs/ua/modules/registry-develop/pages/registry-audit-instruction/modules/excerpt-audit.adoc b/docs/ua/modules/registry-develop/pages/registry-audit-instruction/modules/excerpt-audit.adoc new file mode 100644 index 0000000000..74abfbadc8 --- /dev/null +++ b/docs/ua/modules/registry-develop/pages/registry-audit-instruction/modules/excerpt-audit.adoc @@ -0,0 +1,42 @@ += Аудит шаблонів витягів + +|=== +|Назва | Критичність + +|<<_ex_01>> |Середня +|<<_ex_02>> |Середня + +|=== + +[#_ex_01] +== EX-01. Набір даних для витягів +IMPORTANT: Критичність: середня + +.Опис +В процесі тестування перевіряти витяги з різним набором даних і обсягом наближеним до промислового. В процесі розробки +можуть бути непокриті сценарії з перенесенням елементів шаблону на нову сторінку в залежності від обсягу даних. + +.Вплив +* Деякі елементи шаблонів витягів можуть бути неправильно розміщені на сторінці в залежності від обсягу даних. +(наприклад, таблиці) + +.Рекомендації +* Перевіряти витяги з різним набором даних і обсягом який призведе до перенесення елементів шаблону на нову сторінку. +* Виправити потенційні помилки і адаптувати шаблони з урахуванням можливого перенесення + +[#_ex_02] +== EX-02. Обов'язкові параметри шаблонів витягів +IMPORTANT: Критичність: середня + +.Опис +Враховувати обов'язковість за замовчуванням всіх вхідних параметрів для шаблонів витягів. + +.Вплив +При запиті на генерацію витягу з бізнес-процесу не буле передавний обов'язковий параметр, то генерація витягу буде зупинена +з помилкою, яку потенційно буде складно ідентифікувати. + +.Рекомендації +* Класифікувати вхідні параметри шаблонів витягів на обов'язкові та необов'язкові. +* Для обов'язкових параметрів додати додаткову перевірку в бізнес-процес перед викликом на генерацію витягу. +* Для необов'язкових параметрів врахувати можливість їх відсутності в шаблоні витягу та розглянути значення за +замовчуванням, наприклад, символ "-". diff --git a/docs/ua/modules/registry-develop/pages/registry-audit-instruction/modules/form-audit.adoc b/docs/ua/modules/registry-develop/pages/registry-audit-instruction/modules/form-audit.adoc new file mode 100644 index 0000000000..4daada2461 --- /dev/null +++ b/docs/ua/modules/registry-develop/pages/registry-audit-instruction/modules/form-audit.adoc @@ -0,0 +1,264 @@ += Аудит UI-форм бізнес-процесів + +|=== +|Назва | Критичність + +|<<_fr_01>> |Висока +|<<_fr_02>> |Середня +|<<_fr_03>> |Висока +|<<_fr_04>> |Висока +|<<_fr_05>> |Висока +|<<_fr_06>> |Середня +|<<_fr_07>> |Середня +|<<_fr_08>> |Висока +|<<_fr_09>> |Середня +|<<_fr_10>> |Висока + +|=== + +[#_fr_01] +== FR-01. Великі форми +IMPORTANT: Критичність: Висока + +.Опис +Робити форми якомога простішими та короткими + +.Вплив +* Зниження продуктивності при рендерінгу форми в браузері +* Ускладнення внесення змін до форми розробниками регламенту +* Погіршення користувацького досвіду при заповненні або перегляді форми +* Збільшення ймовірність виникнення системної помилки у користувача при роботі з формою (наприклад, втрата заповнених даних через закінчення сесії користувача) +* Ускладнення тестування форми. Велика кількість тест кейсів, які треба покрити + +.Рекомендації +* При внесенні даних, розбивати форму на декілька окремих і робити збір даних поетапно +* При перегляді даних: +** Показувати обмежений набір даних за замовчуванням +** Для перегляду детальної інформації використовувати звіти чи витяги +* Уникати комплексної вкладеності компонентів зі складними зв'язками + + +NOTE: Детальніше про кращі практики по розробці WEB форм можна ознайомитись https://nngroup.com/articles/web-form-design/[за посиланням] + +[#_fr_02] +== FR-02. Lazy load для компонента _Select_ +IMPORTANT: Критичність: середня + +.Опис +При наявності великої кількості компонентів _Select_ на формі, використовувати _lazy load_ для підвантаження даних по URL. +За замовчуванням компонент _Select_ заздалегідь дістає дані (_eager load_) по URL в наступних випадках: + +* При первинному рендерінгу форми +* При зміні в пов'язаному компоненті +* При оновленні користувацького токена (системна поведінка, яка відбувається безумовно незалежно від дій користувача) + +.Вплив +* Додаткове навантаження на сервери та мережу +* Збільшення часу рендерінгу форми +* На момент написання документа в деяких випадках при значній кількості компонентів _Select_ у користувача може виникати +системна помилка з оновленням авторизаційного токена + +.Рекомендації +* Уникати створення великих форм (див. <<_fr_01>>) +* Використовувати _lazy load_ для компонентів _Select_ якщо їх кількість на формі достатньо велика (понад 5) +* Використовувати _eager load_ у випадках, коли це дійсно може покращити користувацький досвід. Наприклад, для першого +компоненту _Select_ на формі, щоб у користувача відразу після рендерінгу форми були необхідні дані для вибору + +[#_fr_03] +== FR-03. _Javascript_ логіка в компонентах форми +IMPORTANT: Критичність: висока + +.Опис +Конструктор форм дозволяє втілити значну кількість обробки даних та валідацій за допомогою вбудованих можливостей. +Додатково, існує можливість для певного переліку налаштувань (validation, conditional, custom default value) +реалізувати індивідуальну логіку на javascript. Це дозволяє з одного боку гнучко налаштовувати форму, однак, складна +та об'ємна логіка створює приховану складність, яка може призвести до проблем, що важко відлагоджуються або +непередбачуваної поведінки форми. + +.Вплив +Підтримка та розвиток складної _javascript_ логіки на рівні моделювання форми стають крайно незручними. Це може призвести +до додаткового часу, витраченого на відлагодження, а також збільшити ймовірність помилок. Особливо це стає актуальним, +коли команда розробників змінюється або проєкт передається на підтримку. + +.Рекомендації +* Контроль обсягу використання Javascript. Обмежувати складність _javascript_ логіки в формах. Намагатися зберігати логіку +якомога простішою та більш прямолінійною. +* Використовувати вбудовані можливості конструктора форм для валідації та обробки даних +* Уникати побічних ефектів в місцях використання. Кожна вставка _javascript_ логіки має єдину відповідальність (валідація, +умовне відображення, обробка даних тощо) та не має впливати на інші частини форми + +[#_fr_04] +== FR-04. Зовнішні АПІ сервіси в компоненті _Select_ +IMPORTANT: Критичність: висока + +.Опис +Компонент _Select_ як джерело даних може використовувати зовнішні АПІ сервіси за довільним доменом, наприклад, +як довідник. Додатково існує можливість додавання кук (cookie) домену АПІ сервісу у виклик, який може містить куку +(cookie) для авторизації. Треба узгодити налаштування на такому АПІ сервісі (якщо є можливість впливати на ці +налаштування) та формою, яка виконує цей запит. + +NOTE: Безпосередньо отримання авторизаційної кукі (cookie) поза скоупом рішення і не є предметом цього документу. + +.Вплив +* Браузер заблокує виконання запиту до АПІ сервісу через CORS політики +* АПІ сервіс заблокує запит через відсутність необхідної Cookie + +.Рекомендації +* Якщо АПІ сервіс відкритий і не потребує авторизації: +** В налаштуваннях компонента _Select_ виключити передачу авторизаційної інформації при запиті на АПІ сервіс (параметр +_Add authentication cookies for cross-site requests_ = false) +** Значення заголовка _Access-Control-Allow-Origin_ у відповіді АПІ сервісу повинно мати значення домену кабінету +користувача або вайлкард _*_ +* Якщо АПІ сервіс потребує авторизації та рішення припускає наявність кукі (cookie) для авторизації на домен АПІ сервісу +в браузері необхідні наступні умови: +** В налаштуваннях компонента _Select_ додати передачу авторизаційної інформації при запиті на АПІ сервіс (параметр _Add +authentication cookies for cross-site requests_ = true) +** Значення заголовка _Access-Control-Allow-Origin_ у відповіді АПІ сервісу повинно мати значення домену кабінету +користувача (https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS/Errors/CORSNotSupportingCredentials[вайлдард _*_ + не допускається]) +* Додатково перед виходом в промислове середовище потрібно перевірити налаштування АПІ сервісу та форми та впевнитися, що +вони заздалегідь адаптовані до вимог CORS політик. Наприклад, домен користувача кабінету доданий в налаштування зовнішнього +АПІ сервісу + +[#_fr_05] +== FR-05. Компонент карти. Нестандартні тайл-сервери +IMPORTANT: Критичність: висока + +.Опис +При використанні нестандартних тайл-серверів для базового шару карти необхідно провести додаткові налаштування +на сервері для оновлення _Content-Security-Policy_ (CSP) заголовка відповіді. + +NOTE: На момент написання документа стандартними тайл-серверами вважаються _tile.openstreetmap.org_ та _visicom.ua_. + +.Вплив +Без додаткових налаштувань на сервері браузер буде блокувати запити на тайл-сервер і карта не буде працювати. + +.Рекомендації +Заздалегідь провести налаштування на відповідному оточенні, якщо відомо, що будуть використовуватися нестандартні +тайл-сервери. + +NOTE: На момент написання статті конфігурація _Content-Security-Policy_ (CSP) задається у файлі +_deploy-templates/templates/kong-response-transformer-plugin.yaml_ репозиторію _common-web-app_ + +[#_fr_06] +== FR-06. Експериментальні компоненти +Критичність: середня + +.Опис +Компоненти в конструкторі форм в _Веб-інтерфейсі моделювання регламенту_ розділені по 3 категоріям: + +* _Оновлені_: адаптовані компоненти під рішення та дизайн кабінетів. Розробка та тестування цих компонентів підтримується командою розробки платформи +* _Експериментальні_: стандартні компоненти _Form.io_. Не адаптовані під систему. Не підтримуються командою розробки платформи й не тестуються на відповідність вимогам системи +* _Компоненти_: застарілі адаптовані компоненти, які вже не підтримуються командою розробки платформи + +При моделюванні форм рекомендується використовувати компоненти з категорії _Оновлені_ + +.Вплив +* Працездатність форми, яка містить компоненти з категорій _Експериментальні_ та _Компоненти_ не гарантується + +.Рекомендації +* Використовувати компоненти з категорії _Оновлені_ +* Якщо використання компонентів з інших категорій є обґрунтованим, врахувати всі можливі ризики й приділити тестування +таких форм більшу увагу +* Окремо слід зауважити, що використання компонентів з категорії _Експериментальні_ чи _Компоненти_ з подальшим ручним +виправленням коду і зміни типа на latest, що відповідає оновленому компоненту може призвести до непередбачуваних наслідків +і працездатність не гарантується в такому випадку + +[#_fr_07] +== FR-07. Ліміти на критеріях пошуку для компонента _Select_ +Критичність: середня + +.Опис +При використанні компонента _Select_ з інтеграцію з довідниками через критерії пошуку дата моделі реєстру чи зовнішніми +сервісами завжди вказувати параметр _limit_ в налаштуваннях компонента. В промисловому середовищі кількість даних може +бути набагато більшої, чим у тестовому, тому використання параметра _limit_ дозволить уникнути проблем з продуктивністю. + +.Вплив +Велика кількість даних, отримана в компоненті _Select_ з відсутнім параметром ліміту, може призвести до наступних +потенційних проблем: + +* Додаткове непотрібне навантаження на реляційну базу даних +* Додаткове непотрібне навантаження на сервіс синхронного управління даними реєстру +* Збільшення часу рендерінгу форми + +.Рекомендації +* Задавати параметр _limit_ для компонента _Select_ в мінімально необхідне значення для коректного функціонування форми +* Використання параметра _Disable limiting response_ повинно бути обґрунтоване і у більшості випадків не рекомендується + +[#_fr_08] +== FR-08. Математичні обчислення +Критичність: висока + +.Опис +Будь-які математичні обчислення (в особливості фінансові), результат виконання яких є достатньо критичним для +функціонування реєстру повинні виконуватися на сервері в рамках DMN таблиць чи бізнес-процесів. + +.Вплив +* Результат математичних обчислень, що виконують на стороні клієнта можуть бути скомпрометовані й не можуть вважатися +правдивими +* Компонент _Number_ використовує _Javascript_ тип Number, який не є точним для фінансових обчислень і його використання +для великих чисел може бути небезпечним + +.Рекомендації +* Використовувати DMN таблиці чи бізнес-процеси для виконання математичних обчислень +* Для покращення користувацького досвіду та швидшого розуміння результату обчислення користувачем, логіка може бути +продубльована на клієнті, але результат повинен ігноруватися на сервері + +[#_fr_09] +== FR-09. Маска на текстовому полі +Критичність: середня + +.Опис +Для спрощення вводу даних у компонент текстового поля можна використовувати маску. Маска визначає формат введення даних +у поле. Для коректного передзаповнення полів з маскою, дані повинні відповідати формату маски. + +.Вплив +* Користувач не зможе підписати дані форми через помилку валідації на клієнті, якщо текстове поле з маскою не було +передзаповнено коректно і відповідно +бізнес-процес неможливо буде завершити +* Користувач не зможе виконати користувацьку задачу при наступних умовах: +** Текстове поле містить маску +** Текстове поле налаштоване як таке, що не можливо редагувати +** Дані для передзаповнення не відповідають формату маски для текстового поля + +.Рекомендації +* На формах, де передбачається використання маски, перевіряти відповідні дані для передзаповнення полів в бізнес-процесі +* Особливу увагу приділяти даним, які були отримані зі сторонніх систем, і які з великою ймовірністю можуть не відповідати +масці +* Розглянути можливість відмови від використання масок. Іноді додаткові зусилля на підтримку масок для даних з різних +джерел можуть бути недоцільними. Також маску можна залишити для вводу даних, але не використовувати її для +передзаповнення + +[#_fr_10] +== FR-10. Edit Grid +Критичність: висока + +.Опис +При використанні компонента _Edit Grid_ слід враховувати, що наявність складної логіки вкладених компонентів може +суттєво впливати на продуктивність рендерінгу форми в поєднанні з великою кількістю рядків у таблиці. Це однаково +стосується як і режиму для читання, де дані для відображення готуються в бізнес-процесі, так і режиму редагування, де +користувач вносить дані в таблицю. + +NOTE: В рамках цього пункту значення в тексті _Таблиця_ та _Edit Grid_ є синонімами. + +.Вплив +* Збільшення часу рендерінгу форми через наступні причини: +** Виконання запитів на критерії пошуку для кожного рядка таблиці. Тобто, якщо в таблиці 100 рядків, з 3 селектами, то +буде виконано 300 запитів на критерії пошуку +** Виконання запиту на пошук файлів в _Сервіс цифрових документів_ для кожного рядка таблиці при наявності файлу. Слід +зауважити, що запит зі сторони клієнта виконується 1 раз для таблиці, проте час його виконання буде пропорційно +збільшуватися від кількості файлів через деталі внутрішньої реалізації (складність дорівнює _O(n)_) + +.Рекомендації +* Використовувати параметр для оптимізації рендерінгу колонок _Edit Grid_ (Вкладка _Data_, чекбокс +_Optimize column render_). Цей параметр вимикає всі можливості по складній логіці вкладених компонентів (_javascript_ код, +який відповідає за валідацію, умовне відображення, обчислювальне значення, виклики критеріїв пошуку тощо). Тобто, таблиця +буде відображати тільки дані які підготовлені заздалегідь в бізнес-процесі, або додані користувачем. При цьому форма, +яка відповідає за додавання нового елементу в таблицю збереже відповідні можливості. +* Уникати використання файлів в _Edit Grid_ для відображення даних, які були підготовленні в БП. Для перегляду файлів +використовувати детальну картку для окремого запису на окремій формі. +* Використовувати мінімум даних для перегляду в таблиці: +** Зменшити кількість рядків до мінімального допустимого значення. За можливості, розглянути альтернативу у вигляді звітів, +якщо необхідно працювати з усіма даними відповідної таблиці +** Зменшити кількість колонок до мінімально необхідного значення. Як і в рекомендації з файлами, використовувати окрему +форму для перегляду детальної інформації про рядок \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/pages/registry-audit-instruction/modules/integration-audit.adoc b/docs/ua/modules/registry-develop/pages/registry-audit-instruction/modules/integration-audit.adoc new file mode 100644 index 0000000000..0cabeac445 --- /dev/null +++ b/docs/ua/modules/registry-develop/pages/registry-audit-instruction/modules/integration-audit.adoc @@ -0,0 +1,84 @@ += Аудит інтеграцій з зовнішніми системами + +|=== +|Назва | Критичність + +|<<_in_01>> |Середня +|<<_in_02>> |Середня +|<<_in_03>> |Середня + +|=== + +[#_in_01] +== IN-01. Окремі бізнес-процеси та критерії пошуку +IMPORTANT: Критичність: середня + +.Опис +Створювати окремі бізнес-процеси та критерії пошуку для вхідних зовнішніх інтеграцій сторонніми системами. Використання +спільних бізнес-процесів, що можуть запускатися користувачем в кабінеті та зовнішньою системою вважається поганою +практикою і може призвести до проблем з оновленням та підтримкою. Теж саме стосується і критеріїв пошуку. + +.Вплив +Використання спільних бізнес-процесів та критеріїв пошуку для зовнішніх систем і для користувачів в кабінеті є порушенням +принципу єдиної відповідальності. При оновленні функціонала, як результат виконання запиту на зміну від конкретного +стейкхолдера (наприклад, посадової особи), відбудеться небажане оновлення і для інших стейкхолдерів (наприклад, зовнішньої +системи), що може не відповідати вимогам бізнес-процесу чи критерію пошуку. + +.Рекомендації +* Розробляти окремі бізнес-процеси під зовнішні інтеграції +* Розробляти окремі критерії пошуку під зовнішні інтеграції +* При оновленні контракту взаємодії, випускати нову версію бізнес-процесу та критерію пошуку залишаючи стару версію +тимчасово для зворотної сумісності + +[#_in_02] +== IN-02. Симуляція АПІ зовнішніх систем +IMPORTANT: Критичність: середня + +.Опис +Проводити тестування вихідних інтеграцій з зовнішніми системами за допомогою функціональності симуляції АПІ зовнішніх +систем перед виходом в промислове середовище. Не потрібно відкладати до промислового середовища повноцінну e2e перевірку +відповідних бізнес-процесів. + +.Вплив +Неперевірені сценарії в яких залучені зовнішні системи можуть призвести до непередбачуваних наслідків при використанні +в промисловому середовищі + +.Рекомендації +* Проводити тестування використовуючи можливості по симуляції АПІ зовнішніх систем +* Проводити тестування вихідних зовнішніх інтеграцій з тестовим середовищем зовнішньої системи при умові, що таке оточення +існує + +[#_in_03] +== IN-03. Обробка помилок +IMPORTANT: Критичність: середня + +.Опис +При використанні вихідних зовнішніх інтеграцій треба продумати стратегію обробки помилок при зовнішніх викликах. Стратегія, яка +використовується за замовчування може не відповідати вимогам бізнес-процесу і в такому випадку повинна бути адаптована. + +NOTE: На момент написання документа, за замовчуванням відповіді викликів зовнішніх систем з HTTP статус кодами 4\** або +5\** вважаються помилками та генерують виключення. Тобто при використанні відповідного делегату, буде виконаний виклик, +згенерована помилка та токен виконання бізнес-процесу буде повернутий до останнього wait-state. При асинхронному виклику, +додатково ще будуть відпрацьовані retry policy. + +.Вплив +При тимчасовій чи постійній проблемі на стороні сервісу зовнішньої системи поведінка бізнес-процесу може відрізнятися +від фактичних вимог і може бути неоптимізованою. Наприклад, коли виклик зовнішньої системи є некритичним і може бути +виконаний після відновлення системи, то доцільно буде змоделювати додаткову асинхронну логіку в бізнес-процесі, яка +не буде блокувати виконання основного флоу. + +.Рекомендації +* При використанні вихідних зовнішніх інтеграцій, визначити критичність конкретного виклику і відповідну стратегію +обробки помилок +* При виникненні помилки може бути застосована одна з наступних тактик: +** Відкат до останнього wait-state. Це може бути, як користувацька задача, так і старт асинхронного виконання. Слід +зауважити, що якщо останній wait-state є користувацькою задачею, то відповідну помилку побачить користувач, і саме +він повинен бути ініціювати повторну спробу. При асинхронному виконанні, буде спочатку відпрацьована політика retry +policy, після чого буде сформований інцидент. В такому варіанті, повторну спробу повинен бути ініціювати адміністратор +ресурсу. +** Обробка помилок за допомогою _Error Boundary Event_ на сервісній задачі зовнішнього виклику. Якщо помилка при виклику +зовнішньої системи є станом, що можна передбачити та обробити відповідним чином, цю поведінку потрібно імплементувати +в бізнес-процесі. + +NOTE: Детальніше про wait-state можна ознайомитись в +https://docs.camunda.org/manual/7.19/user-guide/process-engine/transactions-in-processes/#wait-states[офіційній документації Camunda] \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/pages/registry-audit-instruction/modules/report-audit.adoc b/docs/ua/modules/registry-develop/pages/registry-audit-instruction/modules/report-audit.adoc new file mode 100644 index 0000000000..3d5b2fcab7 --- /dev/null +++ b/docs/ua/modules/registry-develop/pages/registry-audit-instruction/modules/report-audit.adoc @@ -0,0 +1,133 @@ += Аудит шаблонів аналітичних звітів + +|=== +|Назва | Критичність + +|<<_rp_01>> |Висока +|<<_rp_02>> |Висока +|<<_rp_03>> |Низька +|<<_rp_04>> |Середня +|<<_rp_05>> |Середня +|<<_rp_06>> |Висока + +|=== + +[#_rp_01] +== RP-01. Фільтрація в CTE +IMPORTANT: Критичність: висока + +.Опис +При використанні спільних табличних виразів (common table expression) в SQL-запитах вкрай важливо виконувати фільтрацію +безпосередньо у тілі CTE, а не у основному виразі, що використовує CTE. + +.Вплив +Застосування фільтрів у основному виразі замість тіла CTE може призвести до значно більшого часу обробки. Нефільтровані +CTE можуть спричинити витягування зайвих даних з бази даних, унаслідок чого обчислення CTE та цілого запиту стають +набагато повільнішими. + +.Рекомендації +Завжди застосовуйте фільтри в тілі CTE, а не у основному виразі. Це оптимізує ваші SQL-запити, зменшує непотрібне +обчислювальне навантаження та покращує загальний час обробки даних. + +[#_rp_02] +== RP-02. Індекси для аналітичних представлень +IMPORTANT: Критичність: висока + +.Опис +При створенні аналітичних представлень (за допомогою тегу `ext:createAnalyticsView`), необхідно також створювати індекси +для полів, за якими буде відбуватися пошук. + +.Вплив +Невикористання індексів може суттєво сповільнити продуктивність запитів до бази даних. Це може негативно вплинути на +загальну продуктивність системи, час відклику на запити користувачів та задоволеність користувачів. + +.Рекомендації +* Створювати індекси для полів, які використовуються для пошуку в аналітичних представленнях, за допомогою тегу +`ext:createAnalyticsIndex`. Це забезпечує швидке пошукове звернення до даних та зменшує час відповіді на стороні сервера. +* Своєчасно видаляти дублікати та зайві індекси за допомогою тегу `ext:dropAnalyticsIndex`. + +NOTE: Більш детально про роботу з індексами описано в пункті xref:registry-develop:registry-audit-instruction/modules/dm-audit.adoc#_dm_02[DM-02. Індекси + для аналітичних представлень] + +[#_rp_03] +== RP-03. Типові SQL-функції +IMPORTANT: Критичність: низька + +.Опис +Використовувати SQL функції, розроблені в платформі для розв'язання типових задач при моделюванні запитів для аналітичних +звітів + +.Вплив +* Використання типових SQL функцій дозволяє зменшити кількість коду, який потрібно писати для розв'язання типових задач +* Функції, що постачаються в платформі, вже оптимізовані й враховують більше варіантів використання +* Зменшення часу розробки внаслідок перевикористання рішень, які вже реалізовані в платформі + +.Рекомендації +Для наступних типових задач можуть бути використані SQL функції: + +* Екранування спеціальних символів в параметрах пошуку - _f_regexp_escape_, _f_like_escape_ +* Застосування RLS (Row Level Security) - _f_starts_with_array_ + +NOTE: Детальніше про типові SQL функції можна ознайомитись за посиланням: xref:registry-develop:data-modeling/data/physical-model/liquibase-ddm-ext.adoc[Liquibase extensions for data modeling] + +[#_rp_04] +== RP-04. Зміни в аналітичних звітах для різних ролей +IMPORTANT: Критичність: середня + +.Опис +Вносити зміни в кожну копію звіту для кожної окремої ролі при необхідності внесення змін в звіт чи відповідний запит. +Авторизаційна модель для аналітичних звітів побудована таким образом, що для кожної ролі створюється окрема директорія, +що містить всі необхідні запити та звіти, що для цієї ролі доступні. Це призводить до того, що фактично йде копіювання +файлів описів запитів та звітів для кожної ролі в регламенті. + +.Вплив +* Неконсистентний стан звітів для різних ролей. Наприклад, при виправленні помилки для однієї з ролей, інші ролі будуть +бачити стару версію звіту, доки не буде внесено зміни в кожну копію звіту. +* Потенційно збільшена кількість ітерацій для випуску релізу чи хотфіксу + +.Рекомендації +* Після внесення змін у відповідний звіт у _Веб-інтерфейсі моделювання звітів_ треба розповсюдити його по всім ролям, що +його використовують. +* Якщо на якомусь етапі розробки було виявлено, що звіт для окремої ролі повинен відрізнятися чи має специфічні вимоги - +винести його як окремий звіт для цієї ролі зі своїм життєвим циклом +* При копіюванні звітів для ролей не змінювати імена файлів та ідентифікатори ресурсів в файлах, які були згенеровані +при створенні звітів у _Веб-інтерфейсі моделювання аналітичних звітів_ для можливостей простежуваності (traceability) +копій. + +[#_rp_05] +== RP-05. Заплановані запити (Scheduled Queries) +IMPORTANT: Критичність: середня + +.Опис +Зробити частоту запланованих запитів (Scheduled Queries) якомога меншою. Для запитів є можливість налаштувати автоматичне +оновлення результатів за розкладом без додаткових дій від користувача. Це може покращити користувацький досвід при +роботі зі звітами та залежними запитами. + +.Вплив +* Додаткове навантаження на аналітичну базу даних внаслідок частого виконання запитів за розкладом +* Додаткове навантаження на тимчасове сховище результатів запитів внаслідок частого виконання запитів за розкладом + +.Рекомендації +Проаналізувати бізнес вимоги до того, коли дійсно потрібно оновлювати результати запитів і зробити розклад максимально +адаптованим до користувача без зайвих навантажень на систему. + +[#_rp_06] +== RP-06. Налаштування прав доступ до аналітичних представлень +IMPORTANT: Критичність: висока + +.Опис +При налаштуванні прав доступу до аналітичних представлень (за допомогою тегу _ext:grant_) застосовувати принцип найменших +привілеїв. Тобто надавати доступ тільки до тих представлень, які використовуються в звітах, а не для всіх представлень. + +NOTE: Права доступу для звітів налаштовуються на рівні облікового запису користувача (доступ до звіту та запитів) та на +рівні джерела даних (доступ до аналітичних представлень) + +.Вплив +Див. xref:registry-develop:registry-audit-instruction/modules/sec-audit.adoc#_sc_01[Принцип найменших привілеїв] + +.Рекомендації +* Застосовувати гранулярний підхід до видачі прав за допомогою тегу _ext:grant_ до конкретних представлень конкретній ролі +* Застосовувати тег _ext:grantAll_ для видачі прав на всі представлення тільки для ролі _analytics_admin_ яка необхідна +для розробки звітів у _Веб-інтерфейсі моделювання аналітичних звітів_ +* Для тегів _ext:grant_ та _ext:grantAll_ вказувати атрибут _runAlways="true"_ для підтримання налаштувань авторизації при +змінах в аналітичних представленнях \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/pages/registry-audit-instruction/modules/sec-audit.adoc b/docs/ua/modules/registry-develop/pages/registry-audit-instruction/modules/sec-audit.adoc new file mode 100644 index 0000000000..a42b9ed92b --- /dev/null +++ b/docs/ua/modules/registry-develop/pages/registry-audit-instruction/modules/sec-audit.adoc @@ -0,0 +1,142 @@ += Аудит безпеки + +|=== +|Назва | Критичність + +|<<_sc_01>> |Висока +|<<_sc_02>> |Висока +|<<_sc_03>> |Висока +|<<_sc_04>> |Висока +|<<_sc_05>> |Висока +|<<_sc_06>> |Висока + +|=== + +[#_sc_01] +== SC-01. Принцип найменших привілеїв +IMPORTANT: Критичність: висока + +.Опис +При налаштуванні прав доступу до бізнес-процесів кожна окрема роль повинна мати лише ті права, які необхідні для +виконання її функцій. Це дозволить уникнути можливості використання ролі для виконання дій, які не передбачені її +функціональним призначенням. + +.Вплив +- **Збільшення ризику несанкціонованого доступу:** Якщо ролі надаються занадто широкі права, користувачі можуть отримати доступ до інформації або функцій, які повинні бути обмежені. + +- **Несанкціонована зміна даних**: Користувачі можуть внести зміни в дані або конфігурацію, що може призвести до неправильної роботи регламенту. + +- **Збільшення ризику витоку інформації:** Доступ до даних, який не передбачено роллю, може призвести до ненавмисного або навмисного розголошення конфіденційної інформації. + +.Рекомендації +- Необхідно розробити та поставити процес регулярного огляду налаштувань прав доступу, щоб гарантувати, що кожна роль має лише відповідні права. + +- Завжди надавайте ролям мінімум необхідних прав. + +- Навчання розробників регламенту основам інформаційної безпеки й важливості обмеження доступу. + +[#_sc_02] +== SC-02. Мінімізація ролей з розширеними правами +IMPORTANT: Критичність: висока + +.Опис +При створенні моделі прав доступу до даних рекомендується використовувати обмежену кількість ролей які мають високий рівень доступу до ресурсів, таких як адміністративні. Недотримання цього принципу може призвести до серйозних ризиків безпеки. + +.Вплив +- **Збільшення ризику шахрайства та зловживань:** Користувачі з розширеними правами можуть здійснювати небезпечні зміни, які не можуть бути легко виявлені або відновлені. + +- **Ризик втрати даних:** Користувачі з великими повноваженнями можуть випадково або навмисно видалити важливі дані. + +- **Збільшений ризик взломів:** Якщо багато користувачів мають розширені права, атакуючі будуть мати більше цілей для спроб взлому, що може призвести до компрометації системи. + +- **Розголошення конфіденційної інформації:** Більше користувачів з високим рівнем доступу означає більше можливостей для витоку або розголошення конфіденційної інформації. + +.Рекомендації +- Неодхідно розробити та поставити процес регулярного огляду ролей в системі та визначення, хто дійсно потребує розширених прав. + +- Завжди надавайте користувачам та системам лише ті права, які вони дійсно потребують для виконання своїх завдань. + +- Обмежте тривалість часу, протягом якого розширені права присвоюються ролям у разі необхідності, і встановіть процес перегляду та відновлення цих прав. + +- Проводьте регулярні сесії навчання з інформаційної безпеки для користувачів яким було присвоєно ролі з розширеними повноваженнями. + +[#_sc_03] +== SC-03. Принцип розділення обов'язків +IMPORTANT: Критичність: висока + +.Опис +При моделюванні прав доступу до бізнес-процесів чи баз даних надавати перевагу створенню декількох ролей які будуть залучені для виконання ключових функцій, особливо тих, що стосуються критично важливих операцій, щоб уникнути зловживань, помилок або шахрайства. + +.Вплив +- **Збільшення ризику шахрайства:** Якщо одна особа контролює всі етапи критичного процесу, їй легше скоїти шахрайство, не будучи виявленою. + +- **Відсутність контролю:** Без розділення обов'язків складно виявити помилки або неналежні дії, що можуть призвести до втрати даних, збитків або інших проблем. + +- **Конфлікти інтересів:** Одна особа може здійснювати дії на користь собі та на шкоду організації. + +- **Збільшення ризику втрати конфіденційної інформації:** Без належного розділення обов'язків особа з надмірними повноваженнями може мати доступ до інформації, яка їй не потрібна для роботи, і може використовувати або розголошувати цю інформацію неналежним чином. + +.Рекомендації +- Основна мета полягає в тому, щоб жодна окрема особа не мала досить авторитету або можливості виконувати, одноосібно, всі етапи критичного процесу. + +- Розділення обов'язків забезпечує, що окремі особи виконують різні функції, що зменшує ризик зловживань. + +- Коли кілька осіб перевіряє та підтверджує дії одна одної, існує менший ризик несанкціонованих або помилкових дій. + +- Розділення обов'язків ускладнює вчинення шахрайства, оскільки це вимагає співпраці кількох осіб. + +[#_sc_04] +== SC-04. RLS (Row Level Security) на моделі даних +IMPORTANT: Критичність: висока + +.Опис +Для забезпечення гранулярного доступу до даних слід використовувати механізм RLS (Row Level Security). RLS дозволяє обмежити доступ для читання до певних +рядків (сутностей) на основі зазначеного атрибута користувача. Наприклад, розділити доступ до даних за підрозділом організації, до якого належить користувач. + +.Вплив +- **Зменшення ризику витоку даних:** Для отримання доступу до всіх даних необхідно широка площа атаки на всіх користувачів. + +- **Підвищення контролю доступу:** Кількість отриманих даних обмежена не залежно від запиту користувача атрибутами які присвоєні даному користувачу. + +.Рекомендації +- При побудові централізованих реєстрів, які мають децентралізовану природу та базуються на територіальній приналежності можна використовувати КАТОТТГ коди в якості атрибутів користувачів. + +- Для зменшення ризиків витоку конфіденційної інформації не слід використовувати таку інформацію як атрибут для користувачів +для обмеження доступу до даних на базі RLS + +[#_sc_05] +== SC-05. RBAC (Role Based Access Control) на моделі даних +IMPORTANT: Критичність: висока + +.Опис +Для забезпечення безпеки даних та гранулярності доступу до даних використовувати механізм RBAC (Role Based Access Control). +RBAC дозволяє обмежити доступ до певних атрибутів сутності (колонок таблиці) в залежності від ролі користувача. + +.Вплив +- **Зменшення ризику несанкціонованого доступу:** Дані мають додатковий рівень захисту, таким чином у разі зловживань або помилок у бізнес-процесі виконується додаткові перевірки доступності операції. + +- **Несанкціонована зміна даних**: Можливість надання користувачу доступ тільки на читання на рівні дата моделі зменшує шанс несанкціонованої зміни даних. + +.Рекомендації +- Використовувати мінімальні необхідні доступні права до даних. + +[#_sc_06] +== SC-06. Конфіденційні дані +IMPORTANT: Критичність: висока + +.Опис +При проєктуванні та моделюванні регламенту реєстру мінімізувати використання і зберігання конфіденційних даних в базі даних та +_Підсистемі управління користувачами та ролями_ до мінімально можливих для функціонування системи. + +.Вплив +- **Ризик витоку даних:** Збільшується ймовірність витоку конфіденційних даних, якщо база даних буде скомпрометована. + +- **Збільшення цілей для атак:** Збільшена кількість конфіденційних даних у базі робить її більш цінною ціллю для зловмисників. + +- **Ускладнення відновлення:** У випадку втрати даних буде важче відновити систему без ризику для конфіденційності інформації. + +- **Недотримання законодавчих та нормативних вимог:** Збільшення ймовірності виникнення проблеми з дотриманням вимог +законодавства щодо захисту конфіденційних даних. + +.Рекомендації +- Зберігайте лише ті дані, які дійсно необхідні для функціонування системи. \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/pages/registry-audit-instruction/registry-audit-instruction.adoc b/docs/ua/modules/registry-develop/pages/registry-audit-instruction/registry-audit-instruction.adoc new file mode 100644 index 0000000000..f13be51ee0 --- /dev/null +++ b/docs/ua/modules/registry-develop/pages/registry-audit-instruction/registry-audit-instruction.adoc @@ -0,0 +1,28 @@ += Аудит регламенту реєстру. Загальні рекомендації + +Документ містить перелік рекомендацій, які дозволяють оцінити якість регламенту реєстру та виявити можливі проблеми, +які можуть виникнути при його використанні. Рекомендації згруповані відповідно до структури +xref:arch:architecture/registry/administrative/regulation-management/registry-regulation/registry-regulation.adoc[Цифрового + регламенту реєстру]. + +Перед впровадженням регламенту в промислову експлуатацію рекомендується провести повний аудит регламенту реєстру відповідно +до пунктів описаних в розділах: + +* xref:registry-develop:registry-audit-instruction/modules/bp-audit.adoc[Аудит бізнес-процесів] +* xref:registry-develop:registry-audit-instruction/modules/dm-audit.adoc[Аудит моделі даних] +* xref:registry-develop:registry-audit-instruction/modules/form-audit.adoc[Аудит UI-форм бізнес-процесів] +* xref:registry-develop:registry-audit-instruction/modules/sec-audit.adoc[Аудит безпеки] +* xref:registry-develop:registry-audit-instruction/modules/excerpt-audit.adoc[Аудит шаблонів витягів] +* xref:registry-develop:registry-audit-instruction/modules/report-audit.adoc[Аудит шаблонів аналітичних звітів] +* xref:registry-develop:registry-audit-instruction/modules/integration-audit.adoc[Аудит зовнішніх інтеграцій] + +Процес проведення аудиту є поза областю цього документу, але може бути використаний один з наступних підходів: + +* Self-review команди розробки +* Проведення аудиту зовнішньою командою аудиторів +* Проведення аудиту зовнішньою командою аудиторів з активним залученням команди розробки. Цей підхід може містить +проведення воркшопів з опитуванням команди розробки за пунктами аудиту і подальший незалежний аналіз кодової бази. + +Застосування пунктів оцінки якості рекомендується, але не обмежується проведенням аудиту перед виходом в промислову +експлуатацію і повинно проводитися постійно в процесі розробки регламенту реєстру. Ознайомлення з рекомендаціями повинно +бути обов'язковим для всіх учасників процесу розробки регламенту реєстру перед початком роботи над регламентом. \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/pages/study-project/index.adoc b/docs/ua/modules/registry-develop/pages/study-project/index.adoc index ddfc0ca4d2..0799f2ba9e 100644 --- a/docs/ua/modules/registry-develop/pages/study-project/index.adoc +++ b/docs/ua/modules/registry-develop/pages/study-project/index.adoc @@ -48,134 +48,14 @@ TIP: Детальніше про регламент та особливості [#local-environment-setup] === Налаштування локального середовища +Для повноцінної та зручної роботи із реєстром та його сутностями, вам необхідно налаштувати локальне середовище. Для цього встановіть на вашій локальній машині наступний перелік інструментів: + include::partial$snippets/study/local-environment-setup-ua.adoc[] === Інструменти розробки: робоче середовище include::partial$snippets/study/platform-tools-ua.adoc[] -//// - -// Коротко перелічити інструменти, з якими доведеться працювати -- узяти звідси https://kb.epam.com/pages/viewpage.action?pageId=1808447575 - -Цей розділ презентує перелік основних сервісів та інструментів, якими доведеться, або зручно користуватися в процесі розробки та супроводу реєстрів. - -. https://console-openshift-console.apps.envone.dev.registry.eua.gov.ua/[*OpenShift (Kubernetes)*] -- консоль керування Платформою. Призначення: - -+ -* Перегляд технічних логів. -* Управління подами (програмами, частинами мікросервісної архітектури реєстру). -* Перегляд посилань, що доступні в рамках реєстру (список посилань до вебпорталів, Gerrit, Jenkins тощо). -* Перегляд секретів (username:password) для доступу до різних систем. - -. https://kibana-openshift-logging.apps.envone.dev.registry.eua.gov.ua/app/kibana[*Kibana*] -- сервіс перегляду технічних логів. -+ -Найбільш поширені випадки використання Kibana: - -* Пошук причин помилки за `traceId`. -* Пошук причетних логів за id конкретного бізнес-процесу (за аналогію до `traceId`). - -+ -[TIP] -==== -Документація: :: -xref:registry-develop:registry-admin/openshift-logging/kibana.adoc[]. -==== - -. https://gerrit-control-plane-platform-main.apps.envone.dev.registry.eua.gov.ua/[*Gerrit*] -- система рецензування коду, сховище коду регламенту реєстру. -+ -[TIP] -==== -Документація: :: -xref:registry-develop:registry-admin/regulations-deploy/registry-admin-deploy-regulation.adoc[]. -==== - -. https://jenkins-control-plane-platform-main.apps.envone.dev.registry.eua.gov.ua/[*Jenkins*] -- сервіс для автоматизованої збірки коду та розгортання компонентів регламенту. Призначення: - -* Перегляд та управління процесом збірки коду. -* Перегляд логів, пов'язаних зі збіркою та розгортанням. - -+ -[TIP] -==== -Документація: :: - -* xref:platform-develop:registry-regulations-deployment.adoc[] -* xref:registry-develop:registry-admin/regulations-deploy/registry-regulations-auto-validation.adoc[] -==== - -. *Camunda Cockpit* -- сервіс для адміністрування екземплярів бізнес-процесів. -+ -Призначення: - -* Адміністрування бізнес-процесів -* Моніторинг бізнес-процесів -* Перевірка розгортання бізнес-процесів - -+ -[TIP] -==== -Посилання до сервісу: :: https://business-proc-admin-.apps.envone.dev.registry.eua.gov.ua/ - -Документація: :: -xref:registry-develop:registry-admin/registry-admin-bp-management-cockpit.adoc[]. -==== - -. https://platform-keycloak.apps.envone.dev.registry.eua.gov.ua/[*Keycloak*] -- сервіс управління ідентифікацією користувачів та надання їм прав доступу. - -+ -[TIP] -==== -Документація: :: - -* xref:registry-develop:registry-admin/create-users/manual-user-creation.adoc[] -* xref:admin:user-management-auth/keycloak-create-users.adoc[] -==== - -. *Swagger* -- інструмент для перегляду згенерованих API-точок доступу реєстру. - -+ -[TIP] -==== -Посилання до сервісу: :: https://registry-rest-api-.apps.envone.dev.registry.eua.gov.ua/openapi. - -Обов'язково додавайте [.underline]`*/openapi*` в кінець посилання, інакше ви потрапите до тестового середовища (пісочниці) Swagger. -==== - -. *pgAdmin* -- інструмент для роботи із базою даних реєстру, перегляд таблиць та представлень (Search Conditions). -+ -[TIP] -==== -Посилання до сервісу: :: https://pgadmin-.apps.envone.dev.registry.eua.gov.ua/. -==== - -. *Redash* -- інструмент для роботи з аналітичною звітністю. Створення та перегляд аналітичної звітності, створення запитів (Queries) та дашбордів (Dashboards), публікація та експорт звітності. -+ -Є 2 екземпляри (сервіси) Redash: :: - -* `*redash-admin*` -- необхідний для моделювання запитів та звітів зі сторони розробників/адміністраторів реєстру. -+ -[TIP] -==== -Посилання до сервісу: :: -https://redash-admin-.apps.envone.dev.registry.eua.gov.ua/ - -Документація: :: - -* xref:registry-develop:study-project/study-tasks/task-6-registry-reports-modeling.adoc[] (Детальний опис створення та публікації аналітичної звітності) - -* xref:registry-develop:data-modeling/reports/data-analytical-reports-creation.adoc[] -* xref:registry-develop:data-modeling/reports/data-analytical-data-access-rights.adoc[] -==== - -* `*redash-viewer*` -- необхідний для перегляду сформованих звітів зі сторони користувачів кабінету посадової особи (авторизація за допомогою КЕП ключа). -+ -[TIP] -==== -Посилання до сервісу: https://redash-viewer-.apps.envone.dev.registry.eua.gov.ua/ -==== -//// - == Дорожня карта моделювання регламенту Дорожня карта з моделювання регламенту (Roadmap) показує верхньорівневі етапи по роботі з основними сутностями регламенту та надає загальний контекст командам розробки та супроводу реєстрів. diff --git a/docs/ua/modules/registry-develop/pages/study-project/study-tasks/task-6-registry-reports-modeling.adoc b/docs/ua/modules/registry-develop/pages/study-project/study-tasks/task-6-registry-reports-modeling.adoc index f5d524bd24..a0f3314756 100644 --- a/docs/ua/modules/registry-develop/pages/study-project/study-tasks/task-6-registry-reports-modeling.adoc +++ b/docs/ua/modules/registry-develop/pages/study-project/study-tasks/task-6-registry-reports-modeling.adoc @@ -224,17 +224,13 @@ roles: ---- -. Оновіть версію регламенту у файлі _settings.yaml_, що знаходиться у кореневій папці Gerrit-репозиторію. -+ -image:registry-develop:study-project/task-6/task-6-13-redash.png[] - . Застосуйте зміни до Gerrit (`git commit`, `git push`). . Проведіть процедуру рецензування коду вашого commit. За відсутності прав, попросіть про це відповідальну особу. . Дочекайтеся виконання *Jenkins*-пайплайну *MASTER-Build-registry-regulations*. === Процес створення звіту в Redash -Розробка аналітичної звітності ведеться на базі admin-екземпляра *Redash*. Необхідно мати роль `redash-admin` у реалмі `-admin` реєстру. Роль призначає адміністратор безпеки в інтерфейсі сервісу *Keycloak*. Зверніться до сторінки xref:admin:user-management-auth/keycloak-create-users.adoc[] за детальною інформацією щодо керування ролями. +Розробка аналітичної звітності ведеться на базі admin-екземпляра *Redash*. Необхідно мати роль `redash-admin` у реалмі `-admin` реєстру. Роль призначає адміністратор безпеки в інтерфейсі сервісу *Keycloak*. Зверніться до сторінки xref:registry-admin/create-users/overview.adoc[] за детальною інформацією щодо керування ролями. [TIP] ==== @@ -249,9 +245,16 @@ image:registry-develop:study-project/task-6/task-6-13-redash.png[] + Адміністратор звітності отримує роль `redash-admin` у реалмі `-admin` реєстру. Після цього він матиме повний доступ до звітності у сервісі Redash. -* Знайти посилання до екземплярів Redash можна в інтерфейсі OpenShift-консолі за https://console-openshift-console.apps.envone.dev.registry.eua.gov.ua/[посиланням]. +* Знайти посилання до екземплярів Redash можна в інтерфейсі Control Plane, у розділі *Швидкі посилання*. ++ +Дізнайтеся більше деталей про формування посилань на сторінці xref:admin:registry-management/control-plane-quick-links.adoc[]. ++ +Альтернативно, відкрийте консоль +include::platform:ROOT:partial$templates/links/platform/administrative/openshift.adoc[] +> *Проєкт вашого реєстру* > *Networking* > *Routes* та знайдіть потрібні посилання серед списку доступних. ++ +image:study-project/task-6/task-6-12-01-redash.png[] -image:registry-develop:study-project/task-6/task-6-12-redash.png[] ==== ==== Створення запита для параметра "Тип Власності" @@ -455,7 +458,7 @@ image:registry-develop:study-project/task-6/task-6-10-redash.png[] . Натисніть кнопку `Опублікувати` щоб опублікувати запит. -==== Створення Інформаційної Панелі (Дашборду) +==== Створення інформаційної панелі (Дашборду) Створіть нову інформаційну панель (*Dashboard*): @@ -483,17 +486,33 @@ image:registry-develop:study-project/task-6/dashboard-naming/dashnoard-naming-1. Параметр `*slug*` -- псевдонім, який додається до ідентифікатора дашборда в URL через дефіс. У нашому прикладі *`"slug": "laboratories"`* (_див. зображення нижче_). ===== + -image:registry-develop:study-project/task-6/dashboard-naming/dashnoard-naming-2.png[] +image:registry-develop:study-project/task-6/dashboard-naming/dashnoard-naming-2-ua.png[] * Отримати JSON-представлення дашборда за його ID можна, передавши до Redash API _кореневий шлях оточення_, на якому розгорнуто *`redash-admin`* + `*/api/dashboards/*`. + -.Приклад. Запит на отримання дашборда №8 +.Шаблон посилання до сервісу redash-admin +---- +https://admin-tools--main./reports +---- + +** `` -- назва реєстру; +** `-main` -- системна константа; +** `` -- визначає домен та піддомени середовища. +** `/reports` -- ендпоінт доступу до сервісу. ++ +*Наприклад:* +https://admin-tools-platform-demo-main.example.com/reports ++ +TIP: Див. детальніше про формування посилань: xref:admin:registry-management/control-plane-quick-links.adoc[]. ++ +.Приклад. Запит на отримання дашборда №8 із реєстру platform-demo, який розгорнуто у середовищі apps.envone.dev.registry.eua.gov.ua [source,http] ---- -https://redash-admin-<назва-реєстру>.apps.envone.dev.registry.eua.gov.ua/api/dashboards/8 +https://redash-admin-platform-demo.apps.envone.dev.registry.eua.gov.ua/api/dashboards/8 ---- + -image:registry-develop:study-project/task-6/dashboard-naming/dashnoard-naming-3.png[] +image:registry-develop:study-project/task-6/dashboard-naming/dashnoard-naming-3-ua.png[] + * Якщо перейменувати назву дашборда кирилицею, то в URL ви отримаєте ідентифікатор дашборда та прочерк. + image:registry-develop:study-project/task-6/dashboard-naming/dashnoard-naming-4.png[] diff --git a/docs/ua/modules/registry-develop/partials/best-practices/nav.adoc b/docs/ua/modules/registry-develop/partials/best-practices/nav.adoc new file mode 100644 index 0000000000..ef44686561 --- /dev/null +++ b/docs/ua/modules/registry-develop/partials/best-practices/nav.adoc @@ -0,0 +1,19 @@ +** xref:registry-develop:best-practices/best-practices-overview.adoc[] +*** Референтні приклади бізнес-процесів +**** xref:registry-develop:best-practices/bp-timer-launch.adoc[] +**** Самостійна реєстрація користувачів +***** xref:registry-develop:best-practices/bp-officer-self-register-auto.adoc[] +***** xref:registry-develop:best-practices/bp-officer-self-register-manual.adoc[] +***** xref:registry-develop:best-practices/bp-officer-self-register-combined.adoc[] +**** xref:registry-develop:best-practices/edit-grid-rows-action.adoc[] +**** xref:registry-develop:best-practices/bp-upload-edit-file.adoc[] +**** xref:registry-develop:best-practices/bp-sign-validate-asics-cades.adoc[Перевірка підписаних даних, отриманих зі сторонньої системи] +**** xref:registry-develop:best-practices/bp-iban-update.adoc[] +**** xref:registry-develop:best-practices/bp-officers-simultaneous-tasks.adoc[] +**** xref:registry-develop:best-practices/bp-view-object-creator-editor.adoc[] +**** xref:registry-develop:best-practices/bp-and-or-single-table.adoc[] +**** xref:registry-develop:best-practices/bp-send-notifications-blacklist.adoc[] +**** xref:registry-develop:best-practices/bp-launch-via-url.adoc[] +*** Референтні приклади UI-форм +**** xref:registry-develop:best-practices/forms/text-field-enter-phone-number.adoc[] +**** xref:registry-develop:best-practices/forms/date-time-enter-date.adoc[] \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/partials/data-modeling/data/physical-model/sc/nav.adoc b/docs/ua/modules/registry-develop/partials/data-modeling/data/physical-model/sc/nav.adoc new file mode 100644 index 0000000000..57c177bb26 --- /dev/null +++ b/docs/ua/modules/registry-develop/partials/data-modeling/data/physical-model/sc/nav.adoc @@ -0,0 +1,7 @@ +//SEARCH CONDITIONS (SC) +***** Атрибути пошукових умов +****** xref:registry-develop:data-modeling/data/physical-model/sc/attributes/search-type/search-type-attribute.adoc[] +***** Оператори +****** xref:registry-develop:data-modeling/data/physical-model/sc/operators/logical/manage-logical-operators-and-or.adoc[] +***** Поєднання таблиць +****** xref:registry-develop:data-modeling/data/physical-model/sc/joins/join-and-or-usage.adoc[] \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/partials/nav.adoc b/docs/ua/modules/registry-develop/partials/nav.adoc index 41bf80d0b0..3abc918931 100644 --- a/docs/ua/modules/registry-develop/partials/nav.adoc +++ b/docs/ua/modules/registry-develop/partials/nav.adoc @@ -12,9 +12,10 @@ + *** xref:registry-develop:registry-admin/admin-portal/overview.adoc[] **** xref:registry-develop:registry-admin/admin-portal/version-control/version-control-overview.adoc[] -***** xref:registry-develop:registry-admin/admin-portal/version-control/master-version-settings.adoc[] -***** xref:registry-develop:registry-admin/admin-portal/version-control/create-new-change-request.adoc[] -***** xref:registry-develop:registry-admin/admin-portal/version-control/overview-new-change-request.adoc[] +***** xref:registry-develop:registry-admin/admin-portal/version-control/master/master-version-settings.adoc[] +***** xref:registry-develop:registry-admin/admin-portal/version-control/candidate/create-new-change-request.adoc[] +***** xref:registry-develop:registry-admin/admin-portal/version-control/candidate/overview-new-change-request.adoc[] +***** xref:registry-develop:registry-admin/admin-portal/version-control/candidate/check-regulations-integrity.adoc[] **** xref:registry-develop:registry-admin/admin-portal/admin-portal-user-mgmt.adoc[] **** xref:registry-develop:registry-admin/admin-portal/registry-modeling/overview.adoc[] ***** xref:registry-develop:registry-admin/admin-portal/registry-modeling/registry-global-settings.adoc[] @@ -24,7 +25,6 @@ ****** xref:registry-develop:registry-admin/admin-portal/registry-modeling/process-models/search-process.adoc[] ****** xref:registry-develop:registry-admin/admin-portal/registry-modeling/process-models/copy-process.adoc[] ****** xref:registry-develop:registry-admin/admin-portal/registry-modeling/process-models/upload-process.adoc[] -//TODO: TBD in future: Експортувати (download) процеси ****** xref:registry-develop:registry-admin/admin-portal/registry-modeling/process-models/sorting-process.adoc[] ****** xref:registry-develop:registry-admin/admin-portal/registry-modeling/process-models/process-groups.adoc[] ****** xref:registry-develop:registry-admin/admin-portal/registry-modeling/process-models/delete-process.adoc[] @@ -32,9 +32,16 @@ ******* xref:registry-develop:registry-admin/admin-portal/registry-modeling/process-models/components/tab-code.adoc[] ******* xref:registry-develop:registry-admin/admin-portal/registry-modeling/process-models/components/tab-bpmn-editor.adoc[] ******* xref:registry-develop:registry-admin/admin-portal/registry-modeling/process-models/components/edit-groovy-scripts.adoc[] -***** xref:registry-develop:registry-admin/admin-portal/registry-modeling/ui-forms/ui-forms-overview.adoc[] -****** xref:registry-develop:registry-admin/admin-portal/registry-modeling/ui-forms/sorting-paginating-forms.adoc[] -****** xref:registry-develop:registry-admin/admin-portal/registry-modeling/ui-forms/json-code-view-edit.adoc[] +***** xref:registry-develop:registry-admin/admin-portal/registry-modeling/ui-forms/ui-forms-overview.adoc[Управління схемами UI-форм реєстру] +****** xref:registry-develop:registry-admin/admin-portal/registry-modeling/ui-forms/create-forms.adoc[Створення UI-форм] +****** xref:registry-develop:registry-admin/admin-portal/registry-modeling/ui-forms/edit-forms.adoc[Редагування UI-форм] +****** xref:registry-develop:registry-admin/admin-portal/registry-modeling/ui-forms/search-forms.adoc[Навігація та пошук UI-форм] +****** xref:registry-develop:registry-admin/admin-portal/registry-modeling/ui-forms/copy-forms.adoc[Копіювання UI-форм] +****** xref:registry-develop:registry-admin/admin-portal/registry-modeling/ui-forms/download-forms.adoc[Завантаження UI-форм] +****** xref:registry-develop:registry-admin/admin-portal/registry-modeling/ui-forms/sorting-paginating-forms.adoc[Сортування та пагінація UI-форм] +****** xref:registry-develop:registry-admin/admin-portal/registry-modeling/ui-forms/delete-forms.adoc[Видалення форм] +****** xref:registry-develop:registry-admin/admin-portal/registry-modeling/ui-forms/json-code-view-edit.adoc[Перегляд та редагування коду JSON-представлення форми] +****** xref:registry-admin/admin-portal/registry-modeling/ui-forms/form-tabs.adoc[Перегляд та редагування складових форми (Вкладки)] ***** xref:registry-develop:registry-admin/admin-portal/registry-modeling/tables/tables-overview.adoc[] ****** xref:registry-develop:registry-admin/admin-portal/registry-modeling/tables/tables-data-structures.adoc[] ****** xref:registry-develop:registry-admin/admin-portal/registry-modeling/tables/xml-editor.adoc[] @@ -48,6 +55,7 @@ **** xref:registry-develop:registry-admin/regulations-deploy/registry-admin-deploy-regulation.adoc[] **** xref:registry-develop:registry-admin/regulations-deploy/registry-regulations-auto-validation.adoc[] **** xref:registry-develop:registry-admin/regulations-deploy/cleanup-job.adoc[] +**** xref:registry-develop:registry-admin/regulations-deploy/regulations-idempotеnt-deployment.adoc[] + //Внесення користувачів до системи *** xref:registry-develop:registry-admin/create-users/overview.adoc[] @@ -60,6 +68,7 @@ **** Надавачі послуг ***** xref:registry-develop:registry-admin/cp-auth-setup/cp-auth-setup-officers.adoc[] ***** xref:registry-develop:registry-admin/cp-auth-setup/cp-officer-self-registration.adoc[] +***** xref:registry-develop:registry-admin/cp-auth-setup/officer-portal-access-individual-qes.adoc[] **** Отримувачі послуг ***** xref:registry-develop:registry-admin/cp-auth-setup/cp-auth-setup-citizens.adoc[] + @@ -97,8 +106,10 @@ **** xref:registry-develop:registry-admin/openshift-logging/kibana-request-dashboard.adoc[] + // ================ GRAFANA MONITORING =================== -*** Моніторинг систем Платформи (Grafana) +*** xref:registry-develop:registry-admin/grafana-monitoring/overview.adoc[] +**** xref:registry-develop:registry-admin/grafana-monitoring/grafana-alerting-notifications.adoc[] **** xref:registry-develop:registry-admin/grafana-monitoring/grafana-camunda-metrics.adoc[] +**** xref:registry-develop:registry-admin/grafana-monitoring/public-api-kong-metrics.adoc[Моніторинг метрик публічного API] + // Налаштування реєстру *** xref:registry-develop:registry-admin/regulation-settings.adoc[] @@ -115,26 +126,28 @@ **** xref:registry-develop:registry-admin/external-integration/ext-integration-overview.adoc[] **** xref:registry-develop:registry-admin/external-integration/registration-subsystem-trembita/registration-subsystem-trembita.adoc[] **** xref:registry-develop:registry-admin/external-integration/rest-api-no-trembita.adoc[] -**** Виклик зовнішніх реєстрів та систем -***** ШБО "Трембіта" +**** Ваша команда викликає API +***** _ШБО "Трембіта"_ ****** xref:registry-develop:registry-admin/external-integration/api-call/trembita/external-services-connection-config.adoc[] ****** xref:registry-develop:registry-admin/external-integration/cp-integrate-trembita.adoc[] ****** xref:registry-develop:registry-admin/external-integration/api-call/trembita/overview.adoc[Реєстри та системи ШБО "Трембіта"] -***** Інші реєстри та системи +***** _Інші реєстри та системи_ ****** xref:registry-develop:bp-modeling/bp/rest-connector.adoc#regulations-configuration[Інтеграція із зовнішніми сервісами за допомогою конектора REST: Налаштування регламенту] ****** xref:registry-develop:registry-admin/external-integration/cp-integrate-ext-system.adoc[] -**** xref:registry-develop:registry-admin/external-integration/api-publish/index.adoc[] -***** xref:registry-develop:registry-admin/external-integration/api-publish/rest-soap-api-expose.adoc[] -***** ШБО "Трембіта" -****** xref:registry-develop:registry-admin/external-integration/api-publish/trembita-bp-invoking.adoc[] -****** xref:registry-develop:registry-admin/external-integration/api-publish/trembita-data-invoking.adoc[] -***** Інші реєстри та системи -****** xref:registry-develop:registry-admin/external-integration/api-publish/get-jwt-token-postman.adoc[] +**** xref:registry-develop:registry-admin/external-integration/api-publish/index.adoc[Ваша команда надає API] +***** Приватні дані +****** xref:registry-develop:registry-admin/external-integration/api-publish/rest-soap-api-expose.adoc[] +****** _ШБО "Трембіта"_ +******* xref:registry-develop:registry-admin/external-integration/api-publish/trembita-bp-invoking.adoc[] +******* xref:registry-develop:registry-admin/external-integration/api-publish/trembita-data-invoking.adoc[] +****** _Інші реєстри та системи_ +******* xref:registry-develop:registry-admin/external-integration/api-publish/get-jwt-token-postman.adoc[] +***** Публічні дані +****** xref:registry-develop:registry-admin/external-integration/api-publish/public-api/expose-public-api.adoc[] //WIREMOCK **** xref:registry-develop:registry-admin/external-integration/cp-mock-integrations.adoc[] + // API Rate Limits -// TODO: Review and update *** xref:registry-develop:registry-admin/api-rate-limits.adoc[] *** xref:registry-develop:registry-admin/remote_connection.adoc[] + @@ -148,10 +161,12 @@ **** xref:registry-develop:data-modeling/data/physical-model/liquibase-introduction.adoc[] **** xref:registry-develop:data-modeling/data/physical-model/liquibase-standard-change-types.adoc[] **** xref:registry-develop:data-modeling/data/physical-model/liquibase-ddm-ext.adoc[] +//SEARCH CONDITIONS +include::registry-develop:partial$data-modeling/data/physical-model/sc/nav.adoc[] +//SOME LIQUIBASE SCENARIOS ***** xref:registry-develop:data-modeling/data/physical-model/liquibase-changes-management-sys-ext.adoc[] **** xref:registry-develop:data-modeling/data/physical-model/rest-api-view-access-to-registry.adoc[] **** xref:registry-develop:data-modeling/data/physical-model/auto-generate-number.adoc[] -**** xref:registry-develop:data-modeling/data/physical-model/join-and-or-usage.adoc[] + // Первинне завантаження даних *** xref:registry-develop:data-modeling/initial-load/index.adoc[Первинне завантаження даних] @@ -170,12 +185,13 @@ **** xref:registry-develop:bp-modeling/bp/what-is-bp.adoc[Що таке бізнес-процеси: аналіз, структура і типи операцій] **** xref:registry-develop:bp-modeling/bp/bp-modeling-instruction.adoc[] **** xref:registry-develop:bp-modeling/bp/element-templates/element-templates-overview.adoc[] -//***** xref:registry-develop:bp-modeling/bp/element-templates/bp-element-templates-installation-configuration.adoc[] +***** xref:registry-develop:bp-modeling/bp/element-templates/element-templates-install.adoc[Встановлення типових розширень до бізнес-процесів (_для локальної розробки_)] ***** xref:registry-develop:bp-modeling/bp/element-templates/user-task-templates/user-task-overview.adoc[] ****** xref:registry-develop:bp-modeling/bp/element-templates/user-task-templates/user-form.adoc[] ****** xref:registry-develop:bp-modeling/bp/element-templates/user-task-templates/officer-sign-task.adoc[] ****** xref:registry-develop:bp-modeling/bp/element-templates/user-task-templates/citizen-sign-task.adoc[] -***** xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/service-task-overview.adoc[] +//***** xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/service-task-overview.adoc[] +***** xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/service-task-overview.adoc[Типові розширення для сервісних задач] ****** Керування користувачами та ролями ******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/add-role-to-keycloak-user.adoc[] ******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/save-user-roles.adoc[] @@ -184,20 +200,23 @@ ******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/remove-role-from-keycloak-user.adoc[] ****** Керування налаштування користувача ******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/read-user-settings.adoc[] -****** Створення сутностей -******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/create-entity.adoc[] -******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/create-nested-entities.adoc[] -******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/batch-creation-entities.adoc[] -******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/batch-creation-entities-v2.adoc[] -****** Читання та пошук сутностей -******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/read-entity.adoc[] -******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/batch-read-entities-from-data-factory.adoc[] -******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/search-entities-in-data-factory.adoc[] -****** Оновлення сутностей -******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/update-entity-in-data-factory.adoc[] -******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/update-entity-in-data-factory-partially.adoc[] -****** Видалення сутностей -******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/delete-entity.adoc[] +****** Керування сутностями +******* Створення сутностей +******** xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/create-entity.adoc[] +******** xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/create-nested-entities.adoc[] +******** xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/batch-creation-entities.adoc[] +******** xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/batch-creation-entities-v2.adoc[] +******* Читання та пошук сутностей +******** xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/read-entity.adoc[] +******** xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/batch-read-entities-from-data-factory.adoc[] +******** xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/search-entities-in-data-factory.adoc[] +******* Оновлення сутностей +******** xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/update-entity-in-data-factory.adoc[] +******** xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/update-entity-in-data-factory-partially.adoc[] +******* Видалення сутностей +******** xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/delete-entity.adoc[] +******* Загальний делегат (`POST`, `GET`, `PUT`, `PATCH`) +******** xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/connect-to-data-factory.adoc[] ****** Моделювання цифрових підписів ******* xref:registry-develop:bp-modeling/bp/element-templates/service-task-templates/digital-signature-by-dso-service.adoc[] ****** Інтеграція зовнішніх систем @@ -213,6 +232,7 @@ ***** xref:registry-develop:bp-modeling/bp/element-templates/rest-integration-registries/rest-integration-registries-overview.adoc[Інтеграція реєстрів на Платформі] ****** xref:registry-develop:bp-modeling/bp/element-templates/rest-integration-registries/start-bp-another-registry.adoc[] ****** xref:registry-develop:bp-modeling/bp/element-templates/rest-integration-registries/search-for-entities-another-registry.adoc[] +***** xref:registry-develop:bp-modeling/bp/element-templates/element-templates-validate.adoc[Валідація шаблонів типових розширень] **** xref:registry-develop:bp-modeling/bp/bpmn/index.adoc[] ***** xref:registry-develop:bp-modeling/bp/bpmn/tasks/overview.adoc[] ***** xref:registry-develop:bp-modeling/bp/bpmn/gateways/overview.adoc[] @@ -243,9 +263,11 @@ **** Моделювання витягів ***** xref:registry-develop:bp-modeling/bp/excerpts/bp-modeling-excerpt-csv-docx.adoc[] **** xref:registry-develop:registry-admin/user-notifications/email/e-mail-notification.adoc[] -**** xref:registry-develop:bp-modeling/bp/loading-data-from-csv.adoc[] -**** xref:registry-develop:bp-modeling/bp/file-upload-bp.adoc[] -**** xref:registry-develop:bp-modeling/bp/save-digital-doc-remote-url.adoc[] +**** Робота з цифровими документами +***** xref:registry-develop:bp-modeling/bp/loading-data-from-csv.adoc[] +***** xref:registry-develop:bp-modeling/bp/bp-async-data-load.adoc[] +***** xref:registry-develop:bp-modeling/bp/file-upload-bp.adoc[] +***** xref:registry-develop:bp-modeling/bp/save-digital-doc-remote-url.adoc[] **** xref:registry-develop:bp-modeling/bp/global-vars.adoc[] + // Моделювання форм до бізнес-процесів @@ -267,6 +289,7 @@ ***** xref:registry-develop:bp-modeling/forms/components/edit-grid/edit-grid.adoc[Edit Grid] ****** xref:registry-develop:bp-modeling/forms/components/edit-grid/edit-grid-save-data-list.adoc[] ****** xref:registry-develop:bp-modeling/forms/components/edit-grid/edit-grid-columns-sorting.adoc[] +****** xref:registry-develop:bp-modeling/forms/components/edit-grid/edit-grid-hide-view-button.adoc[] ***** xref:registry-develop:bp-modeling/forms/components/date-time.adoc[Date/Time] ***** xref:registry-develop:bp-modeling/forms/components/checkbox.adoc[Checkbox] ***** xref:registry-develop:bp-modeling/forms/components/select/select-overview.adoc[Select] @@ -313,13 +336,15 @@ include::registry-develop:partial$registry-admin-study/nav.adoc[] + // ================= BEST PRACTICES ================== -** xref:registry-develop:best-practices/best-practices-overview.adoc[] -*** Референтні приклади бізнес-процесів -**** xref:registry-develop:best-practices/bp-timer-launch.adoc[] -**** Самостійна реєстрація користувачів -***** xref:registry-develop:best-practices/bp-officer-self-register-auto.adoc[] -***** xref:registry-develop:best-practices/bp-officer-self-register-manual.adoc[] -**** xref:registry-develop:best-practices/edit-grid-rows-action.adoc[] -**** xref:registry-develop:best-practices/bp-upload-edit-file.adoc[] +include::registry-develop:partial$best-practices/nav.adoc[] // ================ IT SYSTEM CLASSES ======================= -** xref:registry-develop:it-system-classes.adoc[Класи IT-систем, які можна побудувати на Платформі реєстрів] \ No newline at end of file +** xref:registry-develop:it-system-classes.adoc[Класи IT-систем, які можна побудувати на Платформі реєстрів] +// ================ Інструкції по аудиту регламенту реєстру ======================= +** xref:registry-develop:registry-audit-instruction/registry-audit-instruction.adoc[Аудит регламенту реєстру. Загальні рекомендації] +*** xref:registry-develop:registry-audit-instruction/modules/bp-audit.adoc[Аудит бізнес-процесів] +*** xref:registry-develop:registry-audit-instruction/modules/dm-audit.adoc[Аудит моделі даних] +*** xref:registry-develop:registry-audit-instruction/modules/form-audit.adoc[Аудит UI-форм бізнес-процесів] +*** xref:registry-develop:registry-audit-instruction/modules/sec-audit.adoc[Аудит безпеки] +*** xref:registry-develop:registry-audit-instruction/modules/excerpt-audit.adoc[Аудит шаблонів витягів] +*** xref:registry-develop:registry-audit-instruction/modules/report-audit.adoc[Аудит шаблонів аналітичних звітів] +*** xref:registry-develop:registry-audit-instruction/modules/integration-audit.adoc[Аудит зовнішніх інтеграцій] \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/partials/registry-admin-study/nav.adoc b/docs/ua/modules/registry-develop/partials/registry-admin-study/nav.adoc index 89645b7739..06d4e81b20 100644 --- a/docs/ua/modules/registry-develop/partials/registry-admin-study/nav.adoc +++ b/docs/ua/modules/registry-develop/partials/registry-admin-study/nav.adoc @@ -3,6 +3,14 @@ **** xref:registry-develop:registry-admin-study/registry-admin-study.adoc[] **** xref:registry-develop:registry-admin-study/study-tasks/study-tasks-overview.adoc[] ***** xref:registry-develop:registry-admin-study/study-tasks/task-1-registry-introduction.adoc[] -***** xref:registry-develop:registry-admin-study/study-tasks/task-2-manage-registry-administrators.adoc[] -***** xref:registry-develop:registry-admin-study/study-tasks/task-3-registry-backup-restore.adoc[] -***** xref:registry-develop:registry-admin-study/study-tasks/task-4-registry-update.adoc[] \ No newline at end of file +***** xref:registry-develop:registry-admin-study/study-tasks/task-2-registry-update.adoc[] +***** xref:registry-develop:registry-admin-study/study-tasks/task-3-manage-registry-administrators.adoc[] +***** xref:registry-develop:registry-admin-study/study-tasks/task-4-update-registry-keys.adoc[] +***** xref:registry-develop:registry-admin-study/study-tasks/task-5-registry-resources-management.adoc[] +***** xref:registry-develop:registry-admin-study/study-tasks/task-6-set-file-upload-restrictions.adoc[] +***** xref:registry-develop:registry-admin-study/study-tasks/task-7-add-registry-users.adoc[] +***** xref:registry-develop:registry-admin-study/study-tasks/task-8-event-logging-kibana.adoc[] +***** xref:registry-develop:registry-admin-study/study-tasks/task-9-platform-metrics-monitoring-grafana.adoc[] +***** xref:registry-develop:registry-admin-study/study-tasks/task-10-registry-backup-restore.adoc[] +***** xref:registry-develop:registry-admin-study/study-tasks/task-11-setup-custom-dns.adoc[] +***** xref:registry-develop:registry-admin-study/study-tasks/task-12-authentication-setup.adoc[] \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/partials/snippets/admin-portal-master-candidate-edit.adoc b/docs/ua/modules/registry-develop/partials/snippets/admin-portal-master-candidate-edit.adoc new file mode 100644 index 0000000000..618bdd0825 --- /dev/null +++ b/docs/ua/modules/registry-develop/partials/snippets/admin-portal-master-candidate-edit.adoc @@ -0,0 +1,13 @@ +[CAUTION] +==== +Майстер-версія регламенту використовується здебільшого для читання даних. У випадку редагування регламенту, зміни можна вносити лише у версію-кандидат (_запит на внесення змін, який застосовується до мастер-версії_). + +Редагувати _UI-форми та бізнес-процеси_ можна _безпосередньо в мастер-версії_. Однак, при цьому користувачі бачитимуть попереджувальне вікно з наступними опціями: + +* Продовжити в майстер-версії -- це дозволить внести зміни безпосередньо в актуальну головну версію регламенту. +* xref:registry-admin/admin-portal/version-control/create-new-change-request.adoc[Створити версію-кандидат] -- це дозволить створити новий запит на внесення змін. + +Детальніше про особливості роботи з версіями регламенту дивіться на сторінці: + +* xref:registry-admin/admin-portal/version-control/version-control-overview.adoc[] +==== \ No newline at end of file diff --git a/docs/ua/modules/registry-develop/partials/snippets/demo-reg-reference-examples-ua.adoc b/docs/ua/modules/registry-develop/partials/snippets/demo-reg-reference-examples-ua.adoc new file mode 100644 index 0000000000..e8615599fd --- /dev/null +++ b/docs/ua/modules/registry-develop/partials/snippets/demo-reg-reference-examples-ua.adoc @@ -0,0 +1,3 @@ +Адміністратор Платформи може розгорнути для вас _демо-реєстр_ -- еталонний реєстр, що містить _референтні та інші приклади файлів для створення цифрового регламенту_. Він містить різноманітні елементи для розробки моделі даних, бізнес-процесів, UI-форм, аналітичної звітності, витягів, сповіщень, зовнішніх інтеграцій та багато іншого. + +Детальну інструкцію щодо розгортання демо-реєстру та отримання референтних прикладів моделювання ви знайдете на сторінці xref:registry-admin/cp-deploy-consent-data.adoc[]. \ No newline at end of file diff --git a/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-1.png b/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-1.png new file mode 100644 index 0000000000..4b3ac64c2b Binary files /dev/null and b/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-1.png differ diff --git a/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-10.png b/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-10.png new file mode 100644 index 0000000000..b7ff7c9bf7 Binary files /dev/null and b/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-10.png differ diff --git a/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-11.png b/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-11.png new file mode 100644 index 0000000000..d3ed113501 Binary files /dev/null and b/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-11.png differ diff --git a/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-12.png b/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-12.png new file mode 100644 index 0000000000..46b1842cf4 Binary files /dev/null and b/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-12.png differ diff --git a/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-13.png b/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-13.png new file mode 100644 index 0000000000..c32156aaf7 Binary files /dev/null and b/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-13.png differ diff --git a/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-14.png b/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-14.png new file mode 100644 index 0000000000..d25d7e8e23 Binary files /dev/null and b/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-14.png differ diff --git a/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-15.png b/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-15.png new file mode 100644 index 0000000000..7ed6fa3766 Binary files /dev/null and b/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-15.png differ diff --git a/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-16.png b/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-16.png new file mode 100644 index 0000000000..642eeb9700 Binary files /dev/null and b/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-16.png differ diff --git a/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-18.png b/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-18.png new file mode 100644 index 0000000000..b639c1e2a5 Binary files /dev/null and b/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-18.png differ diff --git a/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-19.png b/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-19.png new file mode 100644 index 0000000000..67a0a9fec6 Binary files /dev/null and b/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-19.png differ diff --git a/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-2.png b/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-2.png new file mode 100644 index 0000000000..a686faed74 Binary files /dev/null and b/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-2.png differ diff --git a/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-20.png b/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-20.png new file mode 100644 index 0000000000..f57e226e45 Binary files /dev/null and b/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-20.png differ diff --git a/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-21.png b/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-21.png new file mode 100644 index 0000000000..a16cd58c8b Binary files /dev/null and b/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-21.png differ diff --git a/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-22.png b/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-22.png new file mode 100644 index 0000000000..da72e942e7 Binary files /dev/null and b/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-22.png differ diff --git a/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-24.png b/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-24.png new file mode 100644 index 0000000000..a2fa3f954d Binary files /dev/null and b/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-24.png differ diff --git a/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-25.png b/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-25.png new file mode 100644 index 0000000000..9b3ece0da4 Binary files /dev/null and b/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-25.png differ diff --git a/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-26.png b/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-26.png new file mode 100644 index 0000000000..dc82eb5d78 Binary files /dev/null and b/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-26.png differ diff --git a/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-3.png b/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-3.png new file mode 100644 index 0000000000..4f5c3a44f3 Binary files /dev/null and b/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-3.png differ diff --git a/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-30.png b/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-30.png new file mode 100644 index 0000000000..4f8675946d Binary files /dev/null and b/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-30.png differ diff --git a/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-31.png b/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-31.png new file mode 100644 index 0000000000..34a972b777 Binary files /dev/null and b/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-31.png differ diff --git a/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-32.png b/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-32.png new file mode 100644 index 0000000000..32036659b7 Binary files /dev/null and b/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-32.png differ diff --git a/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-33.png b/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-33.png new file mode 100644 index 0000000000..06fda387b6 Binary files /dev/null and b/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-33.png differ diff --git a/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-4.png b/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-4.png new file mode 100644 index 0000000000..590508bce8 Binary files /dev/null and b/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-4.png differ diff --git a/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-5.png b/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-5.png new file mode 100644 index 0000000000..a4594a253c Binary files /dev/null and b/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-5.png differ diff --git a/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-6.png b/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-6.png new file mode 100644 index 0000000000..268cdeb7cd Binary files /dev/null and b/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-6.png differ diff --git a/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-7.png b/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-7.png new file mode 100644 index 0000000000..07edfada2f Binary files /dev/null and b/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-7.png differ diff --git a/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-8.png b/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-8.png new file mode 100644 index 0000000000..8bc3addd92 Binary files /dev/null and b/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-8.png differ diff --git a/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-9.png b/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-9.png new file mode 100644 index 0000000000..b13244cbe3 Binary files /dev/null and b/docs/ua/modules/release-notes/images/wn-1-9-7/wn-1-9-7-9.png differ diff --git a/docs/ua/modules/release-notes/pages/backward-incompatible-changes.adoc b/docs/ua/modules/release-notes/pages/backward-incompatible-changes.adoc deleted file mode 100644 index 80df11b386..0000000000 --- a/docs/ua/modules/release-notes/pages/backward-incompatible-changes.adoc +++ /dev/null @@ -1,21 +0,0 @@ -= Зворотно несумісні зміни 1.9.6 -include::platform:ROOT:partial$templates/document-attributes/breaking-changes-set-ua.adoc[] - -Ця сторінка фокусується на найбільш критичних змінах до функціональності Платформи, які є зворотно несумісними. - -== Зміна назви Кабінету посадової особи на нейтральну - -[WARNING] -==== -Що змінено: :: -_Кабінет посадової особи_ тепер має назву _+++Кабінет користувача+++_. - -Причина: :: -Для уникнення плутанини назву кабінету змінено, оскільки ним користуються не лише посадові особи, а й інші надавачі послуг, такі як ветеринари тощо. - -Вплив на користувачів: :: -Зміна робить інтерфейс інтуїтивно більш зрозумілим для всіх користувачів, незалежно від їх ролі. -Це спрощує взаємодію із системою і знижує ризик помилок при виборі потрібного кабінету. - -image:user:officer/overview/officer-portal-overview-001.png[] -==== \ No newline at end of file diff --git a/docs/ua/modules/release-notes/pages/breaking-changes/breaking-changes.adoc b/docs/ua/modules/release-notes/pages/breaking-changes/breaking-changes.adoc new file mode 100644 index 0000000000..34bd589eeb --- /dev/null +++ b/docs/ua/modules/release-notes/pages/breaking-changes/breaking-changes.adoc @@ -0,0 +1,102 @@ += Зворотно несумісні зміни 1.9.7 +include::platform:ROOT:partial$templates/document-attributes/breaking-changes-set-ua.adoc[] + +Ця сторінка фокусується на найбільш критичних змінах до функціональності Платформи, які є зворотно несумісними. + +== Оновлення Платформи для сумісності з OpenShift версії 4.12 (_AWS та vSphere_) + +[WARNING] +==== + +Перед оновленням OKD до версії 4.12, необхідно підготувати відповідні заходи для забезпечення сумісності згідно з розділами: + +* xref:admin:update/special-steps-for-update/special-steps.adoc#update-jaeger-operator[Адаптація jaeger-operator для сумісності з OKD 4.12]. + +* xref:admin:update/special-steps-for-update/special-steps.adoc#update-registry-postgres[Адаптація registry-postgres для сумісності з OKD 4.12] + +Детальні інструкції й рекомендації щодо оновлення містяться на сторінці xref:admin:update/update-okd-4-12.adoc[]. +==== + +== Оптимізація процесу створення реєстрів: відмова від використання різних шаблонів і гнучкість налаштувань + +[WARNING] +==== +Ми відмовилися від використання різних шаблонів для розгортання реєстру і зробили один з можливістю гнучкого налаштування. Для міграції наявних налаштувань дивись сторінку xref:admin:update/special-steps-for-update/special-steps.adoc[]. +==== + +== Міграція доступів до SOAP-роутів ШБО "Трембіта" + +[WARNING] +==== +У рамках нової функціональності по обмеженню доступів на рівні IP до SOAP-роутів ШБО "Трембіта", будуть видалені наявні SOAP API-роути за відсутності щонайменше однієї дозволеної IP-адреси. Тому для використання зовнішньої інтеграції через ШБО "Трембіта", після xref:admin:update/update-registry-components.adoc[оновлення реєстру] необхідно виконати кроки з інструкції xref:admin:registry-management/control-plane-soap-api-access-trembita.adoc#control-plane-add-ip[Обмеження доступу на рівні IP до SOAP-роутів ШБО "Трембіта"]. +==== + +== Зміна назви Кабінету посадової особи на нейтральну + +[WARNING] +==== +Що змінено: :: +_Кабінет посадової особи_ тепер має назву _+++Кабінет користувача+++_. + +Причина: :: +Для уникнення плутанини назву кабінету змінено, оскільки ним користуються не лише посадові особи, а й інші надавачі послуг, такі як ветеринари тощо. + +Вплив на користувачів: :: +Зміна робить інтерфейс інтуїтивно більш зрозумілим для всіх користувачів, незалежно від їх ролі. +Це спрощує взаємодію із системою і знижує ризик помилок при виборі потрібного кабінету. + +image:user:officer/overview/officer-portal-overview-001.png[] +==== + +//// + +== Винесення реєстрового адміністративного ендпоінту admin-portal під Kong API Gateway +//https://jiraeu.epam.com/browse/MDTUDDM-13757 + +[WARNING] +==== +Змінено посилання до сервісу `admin-portal`: + +Замість *`admin-portal-stageName.dnsWildcard`* користувачі в *URL* бачитимуть *`admin-tools-stageName.dnsWildcard`*. + +Адміністративні інструменти доступні за єдиним URL, яким керує Kong API Gateway. Root-шлях веде до сервісу `admin-portal`. +==== + +== Винесення сервісів для роботи з аналітичною звітністю за Kong API + +[WARNING] +==== +Змінено посилання до сервісів для побудови та перегляду аналітичної звітності реєстру -- *`redash-admin`* та *`redash-viewer`*. Тепер компоненти винесені за KONG API-шлюз та доступні за ендпоінтом *`/reports`*. + +Нові посилання до сервісів виглядають наступним чином: + +.redash-admin +---- +https://admin-tools-<назва-реєстру>.dnsWildcard/reports. +---- + +.redash-viewer +---- +https://officer-portal-<назва-реєстру>.dnsWildcard/reports. +---- +==== + +== Швидкі посилання до сервісів реєстру + +[WARNING] +==== +Після оновлення Платформи, навіть без оновлення реєстру, посилання до компонентів реєстру переміщаються на вкладку +++ Швидкі посилання +++ у *Control Plane*. + +Детальніше ви можете ознайомитися з функціональністю на сторінці xref:admin:registry-management/control-plane-quick-links.adoc[]. +==== + +== Зміна логіки роботи Cleanup-процесу видалення регламенту + +[WARNING] +==== +З'явилася можливість виконати cleanup реєстру зі збереженням поточного регламенту, регулюючи процес вхідним параметром `*DELETE_REGISTRY_REGULATIONS_GERRIT_REPOSITORY*`. + +Детальніше ви можете ознайомитися зі змінами на сторінці xref:registry-develop:registry-admin/regulations-deploy/cleanup-job.adoc[]. +==== + +//// \ No newline at end of file diff --git a/docs/ua/modules/release-notes/pages/deprecated-functionality.adoc b/docs/ua/modules/release-notes/pages/deprecated-functionality/deprecated-functionality.adoc similarity index 100% rename from docs/ua/modules/release-notes/pages/deprecated-functionality.adoc rename to docs/ua/modules/release-notes/pages/deprecated-functionality/deprecated-functionality.adoc diff --git a/docs/ua/modules/release-notes/pages/overview.adoc b/docs/ua/modules/release-notes/pages/overview.adoc index f27aa383ee..9476bb9d76 100644 --- a/docs/ua/modules/release-notes/pages/overview.adoc +++ b/docs/ua/modules/release-notes/pages/overview.adoc @@ -4,10 +4,10 @@ == Огляд секції -* [*] xref:release-notes:whats-new.adoc[Що нового у релізі] -- сторінка містить презентацію нових функцій релізу з коротким описом функціональності. Звідси можна перейти до сторінок з детальними інструкціями. +* [*] xref:release-notes:whats-new/whats-new.adoc[Що нового у релізі] -- сторінка містить презентацію нових функцій релізу з коротким описом функціональності. Звідси можна перейти до сторінок з детальними інструкціями. -* [*] xref:release-notes:release-notes.adoc[Примітки до релізу] -- сторінка містить перелік функцій релізу з чіткою прив'язкою до версії Інсталера. Сторінка включає опис нових та розширення наявних функцій, а також список виправлених недоліків, рішення дизайну та інші впровадження. +* [*] xref:release-notes:release-notes/release-notes.adoc[Примітки до релізу] -- сторінка містить перелік функцій релізу з чіткою прив'язкою до версії Інсталера. Сторінка включає опис нових та розширення наявних функцій, а також список виправлених недоліків, рішення дизайну та інші впровадження. -* [*] xref:release-notes:backward-incompatible-changes.adoc[Зворотно несумісні зміни] -- сторінка фокусується на найбільш критичних змінах до функціональності Платформи, які є зворотно несумісними. +* [*] xref:release-notes:breaking-changes/breaking-changes.adoc[Зворотно несумісні зміни] -- сторінка фокусується на найбільш критичних змінах до функціональності Платформи, які є зворотно несумісними. -* [*] xref:release-notes:deprecated-functionality.adoc[] -- сторінка описує перелік застарілих (deprecated) функцій у системі, які є не рекомендованими до використання і будуть видалені з часом. +* [*] xref:release-notes:deprecated-functionality/deprecated-functionality.adoc[Застаріла функціональність] -- сторінка описує перелік застарілих (deprecated) функцій у системі, які є не рекомендованими до використання і будуть видалені з часом. diff --git a/docs/ua/modules/release-notes/pages/release-notes.adoc b/docs/ua/modules/release-notes/pages/release-notes.adoc deleted file mode 100644 index 3bfde50150..0000000000 --- a/docs/ua/modules/release-notes/pages/release-notes.adoc +++ /dev/null @@ -1,529 +0,0 @@ -= Примітки до релізу 1.9.6 -include::platform:ROOT:partial$templates/document-attributes/release-notes-set-ua.adoc[] - -Пропонуємо ознайомитися з останніми примітками до релізу нашого програмного продукту. У цьому розділі ми надаємо інформацію про нові функції, оновлення компонентів, виправлення помилок, оптимізацію продуктивності та покращення безпеки. - -== Розробка - - -=== Функціональність для отримувачів послуг - -==== Надання публічного доступу до даних, та управління ним - -[TIP] -==== -Надано можливість відкривати публічний API та контролювати доступ до даних через нього. Тепер неавтентифіковані користувачі можуть отримати доступ до публічних даних Реєстру, а технічні адміністратори мають змогу моніторити та контролювати цей доступ. - -Розробник регламенту може налаштовувати доступ до представлень та REST API реєстру для неавтентифікованих користувачів: :: - -* [*] Додано обробку нового параметра `publicAccess у liquibase (ext+schema). - -* [*] Згенеровано ресурси AuthorizationPolicy, RequestAuthentication, та Service, виділені під public взаємодію. - -* [*] При запиті до platform-gateway за шляхом /public/data-factory/... до запиту додається токен public-user, та перенаправлення до сервісу із public rest api. /public/data-factory/... додано до whitelist в auth policy. - -* [*] При запиті на public rest api swagger користувач бачить одну групу - public з ендпоінтами `exposeSearchConditions public = true`. - -* [*] У компоненті registry-configuration, у values.yaml додано створення юзера `public-user`. - -* [*] Додано NetworkPolicy, яка відкриває доступ з platform-gateway до rest-api-public (в директорію deploy-templates/network-management/templates). - -* [*] Створено kong роут до свагера platform-gateway: /public/data-factory/openapi. - -* [*] Додано можливість відключити публічний доступ для СК на який він був попередньо наданий. - -Технічний адміністратор Реєстру може моніторити показники виконання та кількості запитів до публічного API через Grafana-dashboard: :: - -* [*] Додано створення ресурсів KongPlugin з іменем kong-prometheus-plugin для кожного реєстру, сервіс kong-prometheus-monitoring для збирання метрик, та створення ресурсу ServiceMonitor з іменем kong-service-monitor у неймспейсі openshift-monitoring. - -* [*] Додано підключення дашборду з метриками для kong у values.yaml платформенного компонента monitoring, та конфігмапу з офіційною Grafana Dashboard у директорію dashboаrds компонента monitoring. - -Технічний адміністратор Реєстру може налаштовувати, редагувати, блокувати, розблокувати, та видалити доступ до публічних даних Реєстру через адмін-консоль Control Plane: :: - -* [*] Додано секцію для конфігурації публічного API в registry-configuration. - - -Технічний адміністратор Реєстру може налаштовувати доступ до OpenAPI специфікації: :: - -* [*] Додано кешування роуту /public/data-factory/openapi. - - -Серед налаштувань контролю доступу до публічних даних є обмеження запитів за допомогою рейт-лімітів. - -Технічний адміністратор Реєстру може налаштовувати та редагувати рейт-ліміти на кількість запитів до публічних даних реєстру через адмін-консоль Control Plane: :: - -* [*] Налаштування додано рейт-лімітів у попап "Надати публічний доступ". - -* [*] Додано обробку параметрів у GoLang. - -* [*] Додано обробку значень рейт-лімітів у ingress. - -==== - -==== Функціональність електронних підписів - -[TIP] -==== -Надано можливість перевіряти валідність підпису КЕП та його джерела, _коли підпис надійшов у бізнес-процес по API разом із даними (контейнер типу Asics або CAdES)_. - -Розробник Регламенту тепер має делегат для перевірки валідності підпису даних та архіву файлів, що містять підпис: :: - -* [*] Імплементовано необхідні ендпоінти в digital-signature-ops та ddm-dso-client. - -* [*] Розроблено делегат та element template. - -Розробник Регламенту тепер має відповідні JUEL-функції для отримання деталей про підписанта даних та архіву файлів, що містять підпис, та отримання контенту підписаних даних та архіву файлів, що містять підпис: :: - -* [*] Розроблено JUEL-функцію `signature_details`. - -* [*] Розроблено JUEL-функцію `signature_content`. - -Розробник Регламенту тепер має референтний приклад можливості перевіряти валідність підпису КЕП і ким підписано контент: :: - -* [*] Створено референтний Бізнес-Процес, як приклад валідації. - -==== - -[TIP] -==== - -Надано можливість використання хмарного ключа для автентифікації та підпису. - -Отримувач та надавач послуг може автентифікуватись на користувацькому порталі за допомогою хмарного ключа: :: - -* [*] Додано можливість рендеру QR-коду в компоненті SignatureWidget для сторінок KeyCloak. - -Отримувач та надавач послуг може підписувати дані, внесені через форми на користувацькому порталі, за допомогою хмарного ключа: :: - -* [*] Додано можливість рендеру QR-коду в компоненті SignatureWidget для кабінету надавача послуг. - - -==== - -[TIP] -==== -Надано можливість використання Дія.Підпис для автентифікації та підпису. - -Отримувач послуг, що має статус ФО або ФОП, може використовувати Дія.Підпис для підпису даних: :: - -* [*] Представник ФОП чи ЮО отримає "помилку валідації" при спробі підпису за допомогою Дія.Підпис. - - -==== - -[TIP] -==== -Єдина автентифікація надавачів послуг для групи Реєстрів: :: - -* [*] Для адміністраторів Реєстрів розроблено інструкцію з об'єднання Реєстрів у групу та налаштуванню автентифікації для надавачів послуг в цій групі реєстрів. - -==== - -=== Функціональність для надавачів послуг - -==== Інструмент для перегляду, збереження та відправлення нотифікацій надавачам послуг - -[TIP] -==== -Налаштування каналів зв'язку в кабінеті надавача послуг. - -Розробник Регламенту може використовувати параметр ролі користувача в шаблонах повідомлень при налаштуванні нотифікацій для певного кабінету: :: - -* [*] У user-settings-service при відправці повідомлення у user-notifications топік додано маркер рілма користувача, для якого відправляється повідомлення (CITIZEN/OFFICER). - -* [*] Для channel-confirmation оновлено шаблон додатковою розвилкою в залежності від ролей користувача у змінній recipientRoles (якщо ролі contains citizen - вивід для кабінету отримувача послуг, якщо ролі contains officer - вивід для кабінету надавача послуг. - -* [*] Для надавачів послуг закрита робота з каналом Дія. - -Надавач послуг може бачити налаштування каналу зв'язку "Електронна пошта": :: - -* [*] Додано відображення налаштувань електронної пошти у порталі надавача послуг. - -Надавач послуг може вносити електронну адресу у канал зв'язку "Електронна пошта" у профілі Кабінету надавача послуг та отримати одноразовий пароль (OTP) для підтвердження: :: - -* [*] Заборонено використання спеціальних символів на початку та в кінці електронної адреси. - -Надавач послуг може деактивувати/активувати канал зв'язку "Електронна пошта" з раніше внесеною адресою електронної пошти у профілі Кабінету надавача послуг. Також, він може використати одноразовий пароль (OTP) щоб підтвердити зміну елетронної адреси. - - -==== - -[TIP] -==== -Електронна пошта та нотифікації у кабінеті посадової особи. - -Розробник Регламенту може моделювати відправку повідомлень у канал зв'язку email та inbox надавача послуг: :: - -* [*] Відповідні зміни додано в делегат та element template. - -* [*] Додано обробку рілма користувача у notification-service. - -Надавач послуг може отримувати та переглядати inbox повідомлення у відповідному Кабінеті користувача: :: - -* [*] Додано відображення inbox для повідомлень у кабінеті надавача послуг. - -==== - -[NOTE] -==== -Отримувач послуг та надавач послуг можуть вивантажувати файли з EditGrid в один клік у своїх відповідних користувацьких порталах. -==== - -=== Функціональність для команд розробки - -[TIP] -==== -Спрощення внесення та застосування змін у UI-форми та Бізнес-Процеси. - -Розробник Регламенту може створювати/копіювати/редагувати/видаляти UI-форми в мастер-версії для швидшого застосування змін. Також, він може переглядати результат публікації змін, внесених до мастер-версії, у розділі "Огляд версії": :: - -* [*] Додано примусову синхронізацію з remote при читанні 1 файлу в репозиторії HeadFileRepositoryImpl. - -* [*] Створено компонент для управління UI формами (створення, редагування, копіювання, видалення) в мастер версії. - -* [*] Створено POST ендпоінт для створенню форми у мастер-версії. - -* [*] Створено PUT ендпоінт для редагування форм у мастер-версії. - -* [*] Створено DELETE ендпоінт для редагування форм у мастер-версії. - -* [*] Додано логіку для створення та редагування UI форм в мастер-версію. - -* [*] Налаштовано пайплайн перевірки регламенту на роботу тільки з публічними змінами Gerrit (exclude Private changes). - -* [*] Додано права сервіс акаунту RRM на виконання update by submit операції в Gerrit. - -* [*] Додано header Access-Control-Expose-Headers: ETag для не PROD_LIKE середовищ cicd2-кластера. - -* [*] Створено HEAD метод для форм у мастер-версії та версії кандидаті. - -* [*] Додано логіку для видалення UI форм в мастер-версію. - -* [*] Додано відображення результату публікації змін, внесених до мастер версії на головній сторінці. - - -Моделювальник Регламенту може створювати/копіювати/редагувати/видаляти бізнес-процеси в мастер-версії для швидшого застосування змін: :: - -* [*] Розроблено POST ендпоінт для створення Бізнес-Процесу у мастер-версії. - -* [*] Розроблено відповідні компоненти для створення Бізнес-Процесу в мастер-версії та простого створення версії-кандидата. - -Розробник Регламенту може бачити чи конфлікти з мастер-версією в огляді версії-кандидата для кожної зміненої складової регламенту. Також, він має можливість часткового відкату окремих складових версії-кандидату до стану мастер-версії для спрощення вирішення конфліктів: :: - -* [*] Додано необхідні ендпоінти в registry-regulation-management. - -* [*] Додано зміни на сторінку з відображенням версії-кандидата. - -==== -[TIP] -==== -Розроблено інструкцію для тестування та перегляду внесених змін до моделі даних версії-кандидата в ізоляції без необхідності їх інтеграції в мастер-версію. - -==== - -=== Технічні можливости для адмінстраторів реєстрів та адміністратора платформи - -[TIP] -==== -Керування параметрами реєстра через візуальний інтерфейс. Налаштування параметрів автентифікації та підпису даних через віджет, параметрів підпису через id.gov.ua для отримувачів послуг та автентифікація отримувачів послуг з Дія.Підпис. - -Адміністратор реєстру може налаштовувати віджет як спосіб автентифікації для отримувачів послуг. Також, він може налаштовувати спосіб підпису даних для отримувача послуг: :: - -* [*] Додано параметри по налаштуванню автентифікації надавачів послуг у Control Plane при створенні та редагуванні Реєстру. - -* [*] Додано параметри по налаштуванню автентифікації отримувача послуг в темплейти Реєстрів. - -* [*] Додано параметри по citizen auth flow в конфігурацію автентифікатора. - -* [*] Додано новий параметр authType (тип автентифікації) в конфігурацію автентифікатора. - -* [*] Додано секцію з параметрами віджету підпису для отримувачів послуг. - -* [*] Додано в темплейт Реєстру значення для віджету підпису для отримувачів послуг. - -* [*] Додати параметри з віджету підпису для отримувачів послуг в common-web-app. - -* [*] Винесено в окремий параметр налаштування для віджету підпису для кабінету громадян. - -Користувач кабінету може автентифікуватися в кабінеті способом, налаштованим Адміністратором на рівні реєстру. Кабінет користувача не змінюється незалежно від обраного способу автентифікації: :: - -* [*] Додано новий тип автентифікації (platform-id-gov-ua). - -* [*] Змінено логіку формування provider user id для уніфікації даних користувача. - -Отримувач послуг, що має статус ФОП, або представника ФОП чи ЮО, має можливість автентифікуватись у кабінеті використовуючи КЕП у сервісі id.gov.ua: :: - -* [*] Розширено правила валідації підтримкою представників ЮО у іd-gov-ua authenticator. - -Отримувач послуг, що має статус ФО або ФОП, має можливість автентифікуватись у кабінеті використовуючи BankID у сервісі id.gov.ua, залежно від обраного режиму автентифікації. Також, він може автентифікуватись у кабінеті використовуючи Дія-підпис у сервісі id.gov.ua з врахуванням обраного режиму автентифікації: :: - -* [*] Розширено правила валідації підтримкою ФОП у іd-gov-ua authenticator. - -* [*] Активовано опцію "Авторизуватись з id.gov.ua" при виборі режиму "Для бізнесу" на сторінці автентифікації. - -Отримувач послуг може підписувати дані файловим та апаратним КЕПом у віджеті підпису, сконфігурованому з id.gov.ua. - -Адміністратор може оновлювати сертифікати Акредитованого Центру Сертифікації Ключів для Платформи та Реєстру через Control Plane без зміни ключа послуг: :: - -* [*] Розділено UI елементи по групах та налаштувати валідацію на рівні Платформи. - -* [*] Розділено UI елементи по групах та налаштувати валідацію на рівні Реєстру. - -* [*] Додано поточну дату та час до імені файлу в Gerrit. - -* [*] Налаштовано перезавантаження компоненту DSO після оновлення секретів ключів. - -Адміністратор Реєстру може редагувати параметри вибраної версії Реєстру. Також, він може налаштовувати розмір пула в rest-api і кafka-api: :: - -* [*] Додано поля для налаштування kafkaApi та restApi параметрів - -* [*] Додано параметр data-platform.datasource.maxPoolSize до ddm-starter-database. - -* [*] Додано рестарт сервісів rest-api та kafka-api при зміні конфіг-мапи - -==== - - - -[TIP] -==== -Введено підтримку для розподілення рівнів доступу користувачів за ієрархічною моделлю Row-level security (RLS). -Згідно налаштування RLS з мета-даних (регламенту), сервіс зчитує jwtAttribute з токена поточного користувача, і використовує результат для внесення додаткового параметра запиту в гео-сервері. - -Користувач може мати доступ до даних з гео-серверу відповідно до свого рівня доступу в RLS: :: - -* [*] Створено envoy filter. - -* [*] Розроблено темплейт з envoy filter у service generation utility. - - -==== - - -[NOTE] -==== -Оновлено інструкцію для адміністратора Платформи по розгортанню Платформи на кластері в vSphere. -==== - - - -== Інші впровадження - -[NOTE] -==== -* *Istio* оновлено до версії `1.18.x`. - -* *KeyCloak* оновлено до версії `20.0.3`, `keycloak-operator` оновлено до версії `1.15.0`. - -* *Gerrit-operator* оновлено до останньої EDP-версії. - -* *Jenkins-operator* оновлено до останньої EDP-версії. - -* Назву `Кабінет посадової особи` змінено на `Кабінет користувача`. - -* Делегати пошуку користувачів у Кейклоак помічено як Deprecated. - -* Оновлено user-integration-test, які використовують користувача "auto-user-officer-duplicate". - -* Стабілізовано BPMN парсинг. - -* Впроваджено тоггл на відключення очищення formdata у Redis. - -* Вирівнено версії для збірки інсталеру. - -* Видалено файли, що не привʼязані до жодного активного БП з lowcode-file-storage. - -* Оновлено trembita-edr-registry-mock до останньої build/1.3.0-SNAPSHOT.80 версії у external-integration-mocks репозиторії. - -* Перероблено механізм релоаду після зміни конфіг мапи environment js на релоадер. - -* Додано анотацію @Step до степів у data-factory-integration-tests. - -* Для апдейту деплоймента/стейтфул сет при оновленні секретів та конфіг мап використовується компонент reloader. - -* Перейменовано крок create-redash-snippets в пайплайні публікації на restore-redash-admin-state. - -* Оптимізовано копіювання докер імеджів у центральний нексус при розгортанні інсталеру. - -* Оновлено версію Feign-annotation-error-decoder. - -* Для управління міграціями даних БД "camunda", перейшли до liquibase. - -* Додано можливість вимикати валідацію автозгенерованного поля, якщо його явно передає користувач. - -* Виправлено нестабільні локальні тести у rest-api-core. - -* Оновлено БЕ бібліотеки після переходу на новий feign-annotation-error-decoder. - -* Для рестарту bpms та ddm-notification-service при оновленні secrets/configmaps, які менеджить external-secrets operator, використовується компонент reloader. - -* Винесено всі Kong CRD у cp-installer. - -* Додано помилку при ситуації коли в IdGovUaOfficerAuthenticator знайдено більше одного користувача за параметрами. - -* Оновлено версії платформенних компонентів в CodeBase. - -==== - -[NOTE] -==== -Завантаження файлів під час обміну повідомленнями. - -При завантаженні отримувачем чи надавачем послуг даних з csv-файлу масивом в дата-фабрику відбувається попередня валідація даних для більш швидкого виявлення помилок: :: - -* [*] Розроблено генерацію ендпоінта для валідації csv файлу. - - -Отримувач та надавач послуг в рамках Бізнес-Процесу може завантажувати csv-файл з кількістью записів `>50` для збереження/дозбереження даних в дата-фабрику: :: - -* [*] liquibase-ddm-ext розширено новими тегами. - -* [*] service-generation-utility розширено генерацією kafka лісенерів. - -* [*] Розроблено делегат на відправку повідомлень в Kafka для csv батч-лоаду. - -* [*] Розроблено лісенер у bpms що читає повідомлення з Kafka та повідомляє БП про завершення обробки csv файлу - -* [*] Розроблено референтний приклад використання batch-load з можливістю завантажувати більше ніж 50 рядків. - -Розроблено новий компонент `DataImport`, що дозволяє розробнику регламенту налаштовувати імпорт даних з csv-файлу в Бізнес-Процес. - -==== - -//TODO Серед дефектів є схожі за описом на покращення, наприклад https://jiraeu.epam.com/browse/MDTUDDM-27038 Що з ними робити? - Вкинути в інше в Інших впровадженнях. - -//TODO Додати про загальне покращення та оптимізація автоматизованих тестів для різних компонентів Платформи, зокрема на рівнях виконання бізнес-процесів, Фабрики даних та порталів користувачів. - -//// -//TODO: Add some improvements from support/reg. activities under the NOTE block -[NOTE] -==== - -==== -//// - -//// -//TODO: Add some bullshit from support/reg. activities under the Caution block -[CAUTION] -==== - -==== -//// - -== Регресійні дефекти - -Ці оновлення включають ряд виправлень та покращень. - -[IMPORTANT] -==== -[%collapsible] -.Список регресійних дефектів. Натисніть, щоб розгорнути або згорнути. -===== -Регресійні дефекти PST: :: -* Не створюється MR у Gerrit на оновлення кластера, якщо немає різниці між Інсталерами та є виправлення при розгортанні платформи. -* Підтягуються зміни з попереднього відхиленого запита у Control Plane. -* Помилки в поді admin-console-operator на всіх кластерах. -* Задача compact-blobstore-default у платформному Nexus налаштований на пустий blob storage. -* При редагуванні Опису реєстру створюється порожній МР на оновлення. -* Оновився client secret після оновлення версії keycloak-operator. -* На cicd2 пода vault-tenant-integration завжди в статусі `Init:0/1` на всіх середовищах. -* Support-активності з міграції ДП УСС на новий кластер. -* Не працює налаштування розкладу створення бекапів реєстру. -* Не працює взаємодія між реєстрами. -* Неправильне редагування значення (value) для полів "Змінні оточення". -* Немає можливості налаштувати взаємодії із зовнішніми системами та трембіта реестрами які мають автентифікацію. -* Після підтвердження оновлення платформи через Control Plane консоль створюється 2 дублікати запиту. -* Розгортання платформи 1.9.3 на отточенні ДП УСС. -* Доступ до keycloak адмін консолі не закритий для користувачів ззовні. -* Помилка на UI при створенні МР в Керуванні Платформою. -* Після вимкнення DNS налаштувань з кабінетів Officer та Citizen отримаємо помилку 404 при відкритті роута. -* Створюється дублікат МР у Герріт при редагуванні реєстру або платформи. - -Регресійні дефекти ST2: :: -* Існує можливість створити у gerrit change, котрий сприймається системою як активний і змерджений одночасно. -* Створюється новий патчсет та запускається код-ревью пайп при натисканні кнопки "Зберегти зміни", навіть якщо змін внесено не було. -* Некоректна робота валідації на стейджі "registry-regulations-validation" під час деплою регламенту з внутрішніми посиланнями на nexus у data-model. -* Створюється пустий МР під час оновлення облікових даних для типу автентифікації надавачів послуг, що може вводити у оману адмістратора. -* Автотести дивляться на останні "submitted" ченжі у Gerrit на огляді змін у мастер в admin-tools, а система проставляє дату останніх "Updated" змін у мастер в admin-tools. -* Помилка `415 Payload Too Large` при спробі завантажити файл розміром більше 1МВ. -* При подвійному кліку по кнопці "Підтвердити" чи "Відхилити" в МР оновленні платформи "Керування платформою" система генерує `500` помилку та відображає системний код оновлення. -* В Керуванні Платформою -> налаштування ДНС не працює посилання "Інструкція з зовнішньої конфігурації". -Помилка `At least one or more documents was not found in provided ids list`, якщо користувач зберіг файл у основному процесі і далі через call-activity викликає підпроцес, де намагається відобразити файл. -* Немає логів json формату та plain text у Kibana від запитів на Kong. -* Існує можливість валідно завершити БП з КЕП через Дія підпис, зчитавши та підписавши 1-ий QR-code іншим користувачем, а 2-ий QR-code підписавши ініціатором БП. -* Помилка під час підписання задач БП прод ключами з увімкненим Istio. -* При подвійному натисканні по кнопці "Підтвердити" у всіх розділах "Редагувати реєстр" система генерує `500` помилку та рендерить білий екран с роутами git. -* Падає деплой регламенту при додаванні другого ченджсету з addColumn для однієї таблиці. -* На інтерфейсі не відображається, що доступи були заблоковані у блоці "ДОСТУП ДЛЯ РЕЄСТРІВ ПЛАТФОРМИ ТА ЗОВНІШНІХ СИСТЕМ". -* Не змінюється статус у блоці "ДОСТУП ДЛЯ РЕЄСТРІВ ПЛАТФОРМИ ТА ЗОВНІШНІХ СИСТЕМ" після успішного додавання інтеграції. -* Неможливо додати кейклоак ДНС в налаштуваннях платформи. -* В Адмін Порталі при редагуванні скриптів користувача конфьюзить наявність кількох однакових кнопок "Зберегти". -* Новостворенний БП має за замовчуванням властивість isExecutable="false". -* Під час налаштування конфігурації "ДАНІ ПРО КЛЮЧ" (Тип носія: Апаратний носій) на платформі система не рендерить шаблон з параметрами у полі "INI конфігурація". -* Помилка `com.iit.certificateAuthority.endUser.libraries.signJava.EndUserException: Wrong signature` під час підпису форми, де у компоненті number введене дробне число більше `9 999 999.99`. -* Під час переходу до реєстру у КП система генерує `500` помилку та рендерить білий екран з помилкою "yaml: unmarshal errors". -* Авторизація на сitizen-portal при активній табі "Для громадян" через сервіс id.gov.ua ключем ФОП генерує запис у KeyCloak з атрибутом edrpou. -* Налаштування DNS для кабінету отримувача послуг не додаються у values.yaml у КП. -* В Адмін Порталі у переліку БП є нефункціональна кнопка скачування схеми БП. -* Помилка у digital-doc-service `Document not found errorDocument not found error` при сабміті форми з файлом. -* Відсутній fullname опис у попапі у officer-citizen порталах. -* Під час декількох рефрешів сторінки аутентифікації порталів через браузерну кнопку оновлення, система рендерить білу сторінку. - -Регресійні дефекти ST1: :: -* Не обробляється завантаження файлів з розширенням у аперкейсі. -* Не вивантажується файл який був збережанний делегатом dataFactoryConnectorBatchCreateDelegateV2. -* При використанні бібліотеки moment з оновленим компонентом DateTime не працює задання мінімальної та максимальної дати. -* Контекстне меню в рядку таблиці пропадає при застосуванні горизонтального скролу. -* Відсутній префікс /nexus для білд пайлайну liquidbase schema ext. -* Тег add column працює некорректно, якщо в таблиці присутня колонка із типом CHAR. -* Назва групи в bp-grouping.yml розділена "\" якщо вона більше 73 символів при створенні через АП. -* Колір валідаційних помилок має бути червоним. -* Відстань між заголовком на полем замаленька у розділі "АВТЕНТИФІКАЦІЯ НАДАВАЧІВ ПОСЛУГ" Control Plane. -* Велика відстань між лейбою та дропдауном у компоненті Select (стилізованому). -* Не призупиняються крон джоби бекапів після видалення розкладу. -* В Citizen Порталі виправити елементи інтерфейсу по налаштуванню каналів зв'язку відповідно до мокапів. -* Невірно відпрацьовує поведінка кнопки "До профілю" у сітізен порталі. -* Поле "Електронна адреса" невірно предзаповнено у сітізен порталі. -* Якщо сервер не відповідає користувач отримує невірну помилку. -* Сервіси зовнішніх систем не повинні ходити на поду app=registry-rest-api. -* При більше ніж трьох символах розміру типу поля в ліквідбейзі падає білд дата моделі. -* Необхідно використувувати пагінацію для видалення redash дашбордів. -* Whitelabel error при переході на Camunda Dashboard. -* Відстань між текстом та кнопками у поп-апі "Скасувати зміни?" не відповідає мокапу. -* Переробити генерацію назв сервісів для єкспоуз серч кондішенів. -* Невірно відпрацьовує кнопка "Повернутись" у профілі користувача сітізен порталу. -* При додаванні автентифікації користувача через idgovua після деплою видаляється identity provider для id-gov-ua officer. -* Select component pre-population працює некоректно. -* Додати до ресурсу id-gov-ua-officer параметри для селфрегістрації. -* При переході за прямим посиланням `rpm.diia.org.ua/themes` відбувається перенаправлення до `officer-portal-root.pzm-stage.svc:8080/themes/`. -* Використання адреси електронної пошти з допустимим символом "." призводить до виникнення валідаційної помилки. -* Немає локалізації масок компонента Date/Time всередині компонента Edit Grid на перегляді списку. -* Для SC, які повертають файли та використовуються зовнішніми системами або публічними API, повертати null для файлів. - -===== -==== - -== Безпека - -У релізі 1.9.6 було покращено декілька аспектів, що стосуються безпеки. Основні зміни включають: - -[WARNING] -==== -[%collapsible] -.Список покращень безпеки. Натисніть, щоб розгорнути або згорнути. -===== -* [*] Розширено Go/Javascript Jenkins agents плагіном `cyclonedx`. - -* [*] Додано 4 dast stages до пайплайна `proxy-mode`: `dast-api-scan-user-settings-service`, `dast-api-scan-excerpt-service`, `dast-api-scan-process-history-service`, `dast-api-scan-registry-rest`. - -* [*] Додано перевірки з безпеки до пайплайнів *MASTER-Build* `redash-chart` та `redash`. - -* [*] Видалено список ключів, що не використовуються, в AWS. - -* [*] Додано `service-mesh`-компоненти до процесу перевірки безпеки. - -* [*] Видалено компонент `telemetr-client`, що передає телеметрію на сервери RedHat. - -* [*] Додано `cyclonedx-maven-plugin` до всіх POM файлів Java-проєктів. -===== -==== \ No newline at end of file diff --git a/docs/ua/modules/release-notes/pages/release-notes/part-1/rn-1.adoc b/docs/ua/modules/release-notes/pages/release-notes/part-1/rn-1.adoc new file mode 100644 index 0000000000..e81cc30dde --- /dev/null +++ b/docs/ua/modules/release-notes/pages/release-notes/part-1/rn-1.adoc @@ -0,0 +1,20 @@ +:sectlinks: +:sectanchors: +:note-caption: Покращено +:tip-caption: Розроблено +:caution-caption: Інше +:important-caption: Виправлено +:warning-caption: Покращення безпеки + += Примітки до релізу 1.9.7. Частина 1 + +== Реалізація обмеження на сукупний об'єм масиву файлів, що завантажуються через БП + +[TIP] +==== +* [*] Реалізовано обмеження на сукупний об'єм масиву файлів при завантаженні через БП. Системне обмеження на розмір завантажуваних файлів становить 100 MB. + +* [*] Обмеження на сукупний об'єм завантажуваних файлів застосовується до кожного поля масиву файлів на формі, а не сумарно до сторінки. + +* [*] Змінено налаштування у компоненті *File*: додано поля "Мінімальний сукупний об'єм завантажуваних файлів" та "Максимальний сукупний об'єм завантажуваних файлів". Тепер моделювальник регламенту реєстру може налаштовувати розмір масиву файлів під час завантаження через компонент File. +==== \ No newline at end of file diff --git a/docs/ua/modules/release-notes/pages/release-notes/part-2/rn-2.adoc b/docs/ua/modules/release-notes/pages/release-notes/part-2/rn-2.adoc new file mode 100644 index 0000000000..7c3b7a26f6 --- /dev/null +++ b/docs/ua/modules/release-notes/pages/release-notes/part-2/rn-2.adoc @@ -0,0 +1,28 @@ += Примітки до релізу 1.9.7. Частина 1-2 +:sectnums: +:sectlinks: +:sectanchors: +:note-caption: Покращено +:tip-caption: Розроблено +:caution-caption: Інше +:important-caption: Виправлено +:warning-caption: Покращення безпеки + +== Завантаження файлів формату p7s та asic на формі задачі +//https://jiraeu.epam.com/browse/MDTUDDM-21820 +//TODO: first.xlsx + +[TIP] +==== +* [*] Можливість в рамках виконання бізнес-процесу завантажувати та дозавантажувати файл у форматах `p7s` та `asics` для збереження його до бази даних реєстру. Функціональність доступна для Кабінетів посадової особи та отримувача послуг. +==== + +//// +== Використання JOIN з можливістю вказання додаткової умови OR +//https://jiraeu.epam.com/browse/MDTUDDM-20617 + +[TIP] +==== +* [*] Розширено можливості використання операції `*JOIN*` для поєднання таблиць-представлень (Search Conditions) у БД додатковою умовою `*OR*`, окрім вже наявної `AND`. Тепер адміністратор регламенту зможе використовувати нову функціональність при роботі з моделлю даних реєстру. +==== +//// \ No newline at end of file diff --git a/docs/ua/modules/release-notes/pages/release-notes/part-3/rn-3.adoc b/docs/ua/modules/release-notes/pages/release-notes/part-3/rn-3.adoc new file mode 100644 index 0000000000..4be5b8d31f --- /dev/null +++ b/docs/ua/modules/release-notes/pages/release-notes/part-3/rn-3.adoc @@ -0,0 +1,242 @@ += Примітки до релізу 1.9.7. Частина 3 +:toc: +:toc-title: ЗМІСТ +:sectnums: +:sectlinks: +:sectanchors: +:note-caption: Покращено +:tip-caption: Розроблено +:caution-caption: Інше +:important-caption: Виправлено +:warning-caption: Покращення безпеки + +== Нормалізація апострофа та інших спецсимволів ПІБ у КЕП та id.gov.ua +//https://jiraeu.epam.com/browse/MDTUDDM-20479 +//TODO: first.xlsx + +[TIP] +==== +* [*] Розроблено новий механізм порівняння імені користувача (параметр `fullName`) при автентифікації з КЕП, або id.gov.ua. Тепер не враховуються усі символи, окрім літер кирилиці, латиниці та цифр, не враховується регістр символів. Така логіка застосовується до всіх реєстрів, що розгорнуті на Платформі. + +//https://jiraeu.epam.com/browse/MDTUDDM-22074 +* [*] При автентифікації посадової особи, або отримувача послуг, з ПІБ у ключі та системі видаляються усі спецсимволи. Це надає можливість входити до кабінетів при наявності допустимих відмінностей. + +* [*] Змінено логіку роботи сервісів автентифікації посадових осіб та отримувачів послуг. +==== + +== Автентифікація через id.gov.ua в Кабінеті посадової особи +//https://jiraeu.epam.com/browse/MDTUDDM-22266 +//TODO: first.xlsx + +[TIP] +==== +//https://jiraeu.epam.com/browse/MDTUDDM-18659 +* [*] Можливість виконувати вхід в кабінет через `id.gov.ua` у Кабінеті посадової особи. + +[TIP] +//https://jiraeu.epam.com/browse/MDTUDDM-22782 +* [*] Можливість налаштовувати тип автентифікації через `id.gov.ua` для Кабінету посадової особи. + +[TIP] +//https://jiraeu.epam.com/browse/MDTUDDM-22803 +* [*] Можливість налаштовувати тип автентифікації через IIT-віджет для Кабінету посадової особи. +==== + +//// +== Редагування скриптів бізнес-процесів реєстру через візуальний редактор коду +//https://jiraeu.epam.com/browse/MDTUDDM-13328 + +[TIP] +==== +* [*] Розробник регламенту реєстру може у вбудованому редакторі діаграм *BPMN.iO* переглядати (для майстер-версії) та редагувати (для версії-кандидата) https://uk.wikipedia.org/wiki/Groovy[*Groovy*]-скрипти через візуальний редактор коду. Для цього імплементовано рішення https://microsoft.github.io/monaco-editor/[Monaco Editor], візуалізоване темою *Visual Studio Dark*. + +Підтримуються наступні функції при роботі з редактором: :: + +* [*] Автодоповнення +* [*] Автодоповнення для кастомних функцій +* [*] Синтаксичний аналіз коду та перевірка помилок +* [*] Підтримка коментарів +* [*] Згортання та розгортання блоку з кодом +==== + +[NOTE] +==== +//https://jiraeu.epam.com/browse/MDTUDDM-3032 +* [*] Зміни до скриптів бізнес-процесів (через візуальний редактор скриптів) у VCS автоматично розгортаються у сервісі виконання бізнес-процесів. + +//https://jiraeu.epam.com/browse/MDTUDDM-3030 +* [*] Скрипти, які використовуються у бізнес-процесах, зберігаються згідно з регламентованою структурою у VCS. + +//https://jiraeu.epam.com/browse/MDTUDDM-3031 +* [*] Зміни до скриптів бізнес-процесів у VCS автоматично відстежуються. +==== + +== Управління налаштуваннями та секретами зовнішніх систем +//https://jiraeu.epam.com/browse/MDTUDDM-20495 + +[TIP] +==== +//https://jiraeu.epam.com/browse/MDTUDDM-19044 +* [*] Можливість бачити в Control Plane перелік зовнішніх інтеграцій через "Трембіту" після створення реєстру. + +//https://jiraeu.epam.com/browse/MDTUDDM-19045 +* [*] Можливість бачити в Control Plane запис щодо інтеграції із зовнішньою системою "Дія" після створення реєстру. + +//https://jiraeu.epam.com/browse/MDTUDDM-19046 +* [*] Можливість налаштовувати зовнішні інтеграції через "Трембіту" в Control Plane при створенні реєстру. + +//https://jiraeu.epam.com/browse/MDTUDDM-19048 +* [*] Можливість налаштовувати зовнішню інтеграцію з "Дія" в Control Plane. + +//https://jiraeu.epam.com/browse/MDTUDDM-19049 +* [*] Можливість видаляти налаштування зовнішньої системи. + +//https://jiraeu.epam.com/browse/MDTUDDM-19050 +* [*] Можливість налаштовувати зовнішні інтеграції на рівні регламенту (мінімальні налаштування). + +//https://jiraeu.epam.com/browse/MDTUDDM-19053 +* [*] Можливість налаштовувати зовнішні інтеграції (окрім інтеграцій через Трембіту та інтеграції з "Дія") у Control Plane. + +//https://jiraeu.epam.com/browse/MDTUDDM-20996 +* [*] При оновленні версії реєстру, всі оновлення щодо винесення секретів з конфігураційного файлу відбуваються автоматично. + +//https://jiraeu.epam.com/browse/MDTUDDM-21106 +* [*] Додано обробку помилок при винесенні секретів. +==== + +[NOTE] +==== +//https://jiraeu.epam.com/browse/MDTUDDM-20035 +* [*] Видалено поле `*Authorization Token*` з шаблонів. + +//https://jiraeu.epam.com/browse/MDTUDDM-23207 +* [*] Автоматичне злиття змін до реєстру після додавання/зміни інтеграцій для "Трембіта"/"Дія"/Зовнішня система. + +//https://jiraeu.epam.com/browse/MDTUDDM-23209 +* [*] Додано підказку до полів `Адреса зовнішньої системи` та `Адреса ШБО Трембіти`. + +//https://jiraeu.epam.com/browse/MDTUDDM-23397 +* [*] Змінено колір кнопки `Підтвердити` на зелений згідно з шаблонами. +==== + +== Перегляд переліку таблиць моделі даних реєстру у режимі читання для версії-кандидата +//https://jiraeu.epam.com/browse/MDTUDDM-20609 + +[TIP] +==== +//https://jiraeu.epam.com/browse/MDTUDDM-19038 +* [*] Перегляд списку таблиць для версії-кандидата у режимі читання. + +//https://jiraeu.epam.com/browse/MDTUDDM-22606 +* [*] Періодичне видалення застарілих схем БД по всіх версіях-кандидатах. + +//https://jiraeu.epam.com/browse/MDTUDDM-22997 +* [*] Можливість бачити стан розгортання тимчасової БД для Кандидат-версії. + +//https://jiraeu.epam.com/browse/MDTUDDM-23068 +* [*] Видалення всіх тимчасових БД для версій-кандидатів cleanup-процесом. + +//https://jiraeu.epam.com/browse/MDTUDDM-23089 +* [*] Механізм генерації "data model snapshot" видаляється для Майстер-версії. +==== + +[NOTE] +==== +//https://jiraeu.epam.com/browse/MDTUDDM-22996 +* [*] Видалення з переліку таблиць для Майстер-версії ознаки історичності. +==== + +== Можливість моделювання на навігаційних кнопках поп-апу підтвердження дії із заданням тексту на кнопках дій поп-апу +//Моделювання спливних вікон для підтвердження дії у компоненті Button +//https://jiraeu.epam.com/browse/MDTUDDM-21378 + +[TIP] +==== +* [*] Розроблено функціональність моделювання спливних вікон для підтвердження, або скасування дій на UI-формах. + +* [*] Адміністратор може налаштовувати спливні вікна у розділі моделювання UI-форм Кабінету адміністратора регламентів за допомогою компонента `*Button*` («Кнопка») та параметра `*Pop-up should display*`. Налаштування працюватимуть для форм введення даних у Кабінетах посадових осіб та отримувачів послуг. +==== + +== Скриптування вивантаження файлів за віддаленою адресою із подальшим збереженням до реєстру у бізнес-процесі +//Завантаження цифрових документів за зовнішнім посиланням +//https://jiraeu.epam.com/browse/MDTUDDM-21544 + +[TIP] +==== +* [*] Можливість завантажувати цифрові документи за віддаленою адресою у зовнішній системі та зберігати їх до реєстру для подальшого використання у бізнес-процесах. + +* [*] Наразі система дозволяє отримувати цифрові документи за зовнішнім посиланням із типом автентифікації `*NO_AUTH*`, коли запит виконується до публічних API. + +* [*] Для отримання цифрових файлів за віддаленою адресою розроблена JUEL-функція `*save_digital_document_from_url ()*`, яку можна використовувати для спрощення моделювання процесів у скриптах. + +* [*] Створення REST-ендпоінту для завантаження файлу. + +* [*] Створено новий репозиторій `ddm-digital-document-client`. + +* [*] Створення JUEL-функції для завантаження з використанням бібліотеки клієнта dds. +==== + +[NOTE] +==== +* [*] Винесено REST-клієнт `digital-document-service` в окрему бібліотеку. +==== + +== Спрощення моделювання поля Url в оновленому компоненті File +//https://jiraeu.epam.com/browse/MDTUDDM-22302 + +[NOTE] +==== +* [*] Поле `Storage` у компоненті `File` передзаповнюється значення `Digital-document-service` та є прихованим. ++ +Раніше при моделюванні компоненти *File* існувала можливість обрати в полі `Storage` одну з опцій: `Digital-document-service`, або `Custom Url`. ++ +Опцію "Custom Url" прибрано. +==== + +== Впровадження Маркер Кластера на мапі при відображенні великої кількості об'єктів + +[TIP] +==== +* [*] Імплементовано лічильник кількості об'єктів, що належать до одного просторового кластера. +Функціональність полегшує візуалізацію великої кількості об'єктів на мапі у Кабінетах отримувача та надавача послуг. ++ +Ця зміна дозволяє користувачам швидше сприймати інформацію про об'єкти та їхні кластери на карті, покращуючи візуальний досвід. +==== + +== Централізоване розповсюдження типових розширень БП як частини Платформи + +[TIP] +==== +* [*] Було впроваджено централізовану систему розповсюдження типових розширень бізнес-процесів як частини платформи, що дозволяє їх використання у моделюванні бізнес-процесів з метою забезпечення сумісності між різними версіями. ++ +У попередніх версіях `admin-portal` зчитував розширення `business-process-modeler-extensions` з hardcoded-конфігурації. ++ +Механізм зчитування змінено. Наразі зчитування відбувається із файлу `business-process-modeler-element-templates.js`. +==== + +== Керування розкладом створення резервних копій центральних компонент та часом їх зберігання +//https://jiraeu.epam.com/browse/MDTUDDM-21045 + +[TIP] +==== +* [*] Імплементовано можливість керувати розкладом створення резервних копій наступних центральних компонентів, а також часом зберігання таких резервних копій у сховищі бекапів: + +** [*] Бекапування центрального *Nexus* (сховище артефактів); +** [*] Бекапування центрального *Control Plane* (панель керування Платформою та реєстрами); +** [*] Бекапування центрального *user-management* (Керування користувачами); +** [*] Бекапування центрального *monitoring* (моніторинг). + +* [*] Значення зберігаються до конфігурації *_values.yaml_* у репозиторії *_cluster-mgmt_*. + +* [*] Відповідні параметри застосовуються завдяки Jenkins-пайплайну `Cluster-mgmt`. +==== + +== Оновлення Платформних ключів та сертифікатів з адмін-консолі адміністратором Платформи + +[TIP] +==== +//https://jiraeu.epam.com/browse/MDTUDDM-17503 +* [*] Можливість оновлювати Платформні ключі та сертифікати цифрового підпису з адмін-консолі Control Plane адміністратором Платформи. +==== + +//// diff --git a/docs/ua/modules/release-notes/pages/release-notes/part-4/rn-4.adoc b/docs/ua/modules/release-notes/pages/release-notes/part-4/rn-4.adoc new file mode 100644 index 0000000000..3e4161a615 --- /dev/null +++ b/docs/ua/modules/release-notes/pages/release-notes/part-4/rn-4.adoc @@ -0,0 +1,260 @@ += Примітки до релізу 1.9.7. Частина 4 +:toc: +:toc-title: ЗМІСТ +:sectnums: +:sectlinks: +:sectanchors: +:note-caption: Покращено +:tip-caption: Розроблено +:caution-caption: Інше +:important-caption: Виправлено +:warning-caption: Покращення безпеки + +== Конфігурація перевірки в ЄДР при логіні юридичних осіб до Кабінету отримувача послуг +//MDTUDDM-22846 +//TODO: first.xlsx + +[TIP] +==== +* [*] Можливість налаштовування перевірки в ЄДР для користувачів, що обрали вхід "Для бізнесу" на сторінці автентифікації для технічного адміністратора реєстру. + +* [*] Забезпечено можливість автентифікації для отримувачів послуг-ФОП, представників ФОП або ЮО, обираючи режим "Для бізнесу" та використовуючи КЕП без відповіді ЄДР. +==== + +== Впровадження універсального SOAP-конектора для взаємодії з "Трембіта" +//MDTUDDM-20426 +//TODO: first.xlsx + +[TIP] +==== +* [*] Додано автодоповнення для JUEL-функції `get_trembita_auth_token()` у візуальному редакторі коду для версії-кандидат. + +* [*] Розробникам регламенту надана можливість виклику із БП довільного реєстру-учасника ШБО "Трембіта", використовуючи універсальний SOAP-конектор. + +* [*] Адміністраторам реєстру надана можливість налаштувати інтеграцію із довільною зовнішньою системою-учасником ШБО Трембіта через SOAP протокол в інтерфейсі Control Plane. +==== + +== Інструкція з розгортання Платформи у публічному хмарному середовищі AWS +//MDTUDDM-22057 +//TODO: first.xlsx + +[TIP] +==== +* [*] Впроваджено детальне покрокове керівництво для адміністратора Платформи щодо розгортання системи на цільовому публічному хмарному оточенні AWS. +==== + +//// + +== Оптимізація збирання логів для спрощення їх аналізу у виробничому середовищі + +[NOTE] +==== +* [*] Налаштовано логування Kong у форматі JSON. + +* [*] Додано контекстну інформацію до логів form-schema-provider. + +* [*] Додано логування responseCode до registry-rest-api. + +* [*] Покращено логування для Keycloak. + +* [*] Зменшено рівень логування для kafka-кластера у виробничому режимі. + +* [*] Зменшено рівень логування в Jenkins. + +* [*] Змінено рівень логування Ceph (rgw, mon). + +* [*] Вирівняно структуру логів для сервісів реєстру. + +* [*] Прибрано логи Crawling result set у registry-regulation-mng. + +* [*] Додано логування до сервісу DSO для деталізації помилок ініціалізації контексту. + +* [*] Перевірено та вимкнено логування cookie header в усіх BE-сервісах. +==== + +== Категоризація доступних послуг у Кабінетах користувачів + +[TIP] +==== +* [*] Можливість використання конфігурації репозиторію регламенту для налаштування групування послуг в Кабінеті посадової особи. + +* [*] Створення нових груп доступних послуг для відображення в кабінетах користувачів через інтерфейс Адмін порталу. + +* [*] Додавання не згрупованих бізнес-процесів до наявних та нових груп для відображення у Кабінетах користувачів через інтерфейс адміністративного порталу. + +* [*] Сортування груп, бізнес-процесів в групах та поза групами для відображення в кабінетах користувачів через інтерфейс адміністративного порталу у версії-кандидат. + +* [*] Зміна назви та видалення груп доступних послуг через інтерфейс Адмін порталу. + +* [*] Збереження змін на вкладці "Відображення в кабінетах" у поточній версії-кандидат через інтерфейс Адмін порталу. + +* [*] Виключення бізнес-процесів з груп через інтерфейс Адмін порталу. + +* [*] Перегляд доступних груп, послуг в них та поза групами у версії-кандидат та Мастер версії через інтерфейс адмін-порталу. + +* [*] Відображення груп доступних послуг за категоріями для користувачів Кабінету посадової особи/отримувача послуг. + +* [*] Відображення збережених змін на вкладці "Відображення в кабінетах" в розділі "Огляд версії" інтерфейсу адмін-порталу. + +* [*] Видалення process definition із груп при виклику ендпоінта видалення бізнес-процесу. + +* [*] Міграція груп для наявних реєстрів. +==== + +[NOTE] +==== +* [*] Оптимізовано рендеринг сторінки "Відображення в кабінетах". +==== + +== Підтвердження при залишенні форми задачі або стартової форми із незбереженими даними + +[TIP] +==== +* [*] У цьому оновленні ми зосередилися на підвищенні користувацького досвіду та запобіганні втраті внесених даних. Тепер наша система оснащена новою можливістю: коли користувач працює з формою задачі або стартовою формою, він буде отримувати попередження перед тим, як залишити сторінку. ++ +Ця зміна має велике значення для підвищення ефективності взаємодії з системою. Вона дозволяє користувачам отримати повідомлення про можливість зберегти важливі дані, які вони ввели, перед тим, як залишити сторінку. Таким чином, користувачі можуть уникнути ненавмисного втрачання цінної інформації та забезпечити більш безперервний робочий процес. +==== + +== Можливість задавати DNS-ім'я для аутентифікації користувачів для конкретного реєстру + +[TIP] +==== +Розширене управління DNS-іменами в Keycloak для адміністраторів :: + +* [*] В останньому оновленні ми значно покращили можливості управління DNS-іменами в компоненті Keycloak, що дозволяє більш гнучке налаштування аутентифікації користувачів для різних реєстрів. + +Для адміністраторів Платформи :: + +* [*] Ви тепер можете додавати та редагувати додаткові DNS-імена для компонента Keycloak через адміністративну консоль Control Plane. Це дозволяє вам налаштовувати імена за замовчуванням, що підвищує безпеку та ефективність управління ідентифікацією користувачів. +* [*] Можливість редагування внесених додаткових DNS через адмін-консоль на рівні Платформи. +* [*] Оптимізовано інтерфейс налаштувань Платформи, розділивши їх на окремі вкладки для зручності та кращої організації. + +Для адміністраторів реєстрів :: + +* [*] Тепер ви можете використовувати DNS-імена компонента Keycloak, налаштовані адміністратором Платформи. Це спрощує процес аутентифікації користувачів та забезпечує більшу консистентність в налаштуваннях безпеки між різними реєстрами. +==== + +== Видалення попередньої версії автогенерованого коду при розгортанні регламенту + +[TIP] +==== + +* [*] Впроваджено автоматичну заміну коду новою версією у Gerrit реєстру в репозиторії для технічного адміністратора реєстру. + +* [*] Забезпечено автоматичне оновлення версій Docker images в Nexus реєстру останньою версією для технічного адміністратора реєстру. + +* [*] У Kafka реєстру тепер відображаються тільки топіки для сервісів API, що використовуються в останній версії реєстру, для технічного адміністратора реєстру. + +* [*] Відмова від необхідності змінювати версію регламенту в структурі регламенту після кожної зміни для розробників та моделювальників регламенту. +==== + +== Швидкі посилання до сервісів у Control Plane + +[TIP] +==== +* [*] Додано посилання на Openshift, pgAdmin, Kibana, Swagger, Redash та інші адміністративні ендпоінти в інтерфейсі Control Plane для зручності адміністратора реєстру. +==== + +== Можливість пагінації пошукових запитів + +[TIP] +==== +* [*] Можливість налаштування отримання інформації про загальну кількість знайдених елементів при створенні критеріїв пошуку (SC) для коректного налаштування пагінації користувачів. +==== + +== Внесення змін до файлу описів структур таблиць моделі даних реєстру через вебредактор коду + +[TIP] +==== +* [*] Підтвердження змін у файлі описів структур таблиць моделі даних реєстру через вебредактор коду у версії-Кандидаті. + +* [*] Перегляд файлу описів структур таблиць моделі даних реєстру через вебредактор коду для версії-кандидата та Майстер-версії. + +* [*] Відображення статусу оновлення структур таблиць моделі даних, здійснених через вебредактор коду. + +* [*] Редагування файлу опису структур таблиць моделі даних реєстру для Версії Кандидата, використовуючи автопідказки, автодоповнення та аналіз коду згідно з liquibase та DDM xsd. + +* [*] Відображення сторінок помилок при перегляді переліку таблиць при відсутності файлу опису моделі даних та неуспішному запиті файлу у майстер-версії. +==== + +== Моніторинг показників виконання бізнес-процесів + +[TIP] +==== +* [*] Додано можливість для технічного адміністратора реєстру моніторити показники виконання бізнес-процесів через дашборд. +==== + +== Додавання або видалення API по роботі з масивами даних для наявних таблиць + +[TIP] +==== +* [*] Додано можливість зміни налаштувань на рівні створення таблиць для розробників регламенту, що впливає на поведінку згенерованого коду API. +==== + +== Відображення масивів даних у вигляді таблиць на формах БП з можливістю виклику інших БП для певного рядка + +[TIP] +==== +* [*] Додано можливість налаштовувати компонент EditGrid для роботи в режимі "тільки для перегляду" для розробників регламенту. + +* [*] Користувачі Кабінету посадової особи та отримувачі послуг можуть переглядати даних UI-форми в режимі "read only" та виконувати дії стосовно обраного запису таблиці. + +* [*] Розробникам регламенту додано можливість налаштовувати набір дій, які можна виконати стосовно окремих записів таблиці. + +* [*] Моделювальникам реєстру надано можливість відображати масиви даних у вигляді таблиць на формах БП з можливістю виклику інших БП для певного рядка. + +* [*] Розроблено референтний БП для функціональності вибору одного рядка в таблиці та запуску для нього БП. +==== + +== Можливість обирати декілька рядків у таблиці та запускати для них БП + +[TIP] +==== +Моделювальникам реєстру додано можливість обирати декілька рядків в таблиці та запускати для них бізнес-процеси. + +* [*] Розробникам регламенту надано можливість налаштовувати активацію обрання декількох записів з таблиці для виконання стосовно них дій. + +* [*] Користувачі Кабінету посадової особи та отримувачам послуг можуть ініціювати виконання бізнес-процесів з даними декількох обраних рядків з таблиці. + +* [*] Розробникам регламенту додано можливість налаштовувати ширину полів компонентів для відображення в таблиці EditGrid. + +* [*] Розроблено референтний бізнес-процес для функціональності вибору одного або декількох рядків в таблиці та запуску для них бізнес-процесів. +==== + +[NOTE] +==== +* [*] Оптимізовано рендеринг таблиці для забезпечення кращої продуктивності. +==== + +== Автореєстрація для посадових осіб з ручним або автоматичним модеруванням + +[TIP] +==== +* [*] Додано можливість для моделювальників реєстру дати можливість посадовим особам проходити самореєстрацію з ручним або автоматичним модеруванням. + +* [*] Адміністраторам реєстру надано можливість налаштовувати самореєстрацію посадових осіб. + +* [*] Розроблено референтні приклади бізнес-процесів автореєстрації посадової особи з автоматичною та ручною модерацією для моделювальників реєстру. + +* [*] Посадові особи можуть після автентифікації в кабінеті автоматично почати процес самореєстрації, якщо він змодельований в реєстрі та налаштована автореєстрація. + +* [*] Розробникам регламенту надано окреме типове розширення *Save user roles* для внесення змін до переліку регламентних ролей користувача. +==== + +== Запуск бізнес-процесу за таймером + +[TIP] +==== +* [*] Додано референтний приклад бізнес-процесу для розробників та моделювальників регламенту, що демонструє запуск бізнес-процесу за встановленим розкладом у події "Таймер". +==== + +== Зміна логіки роботи Cleanup-процесу видалення регламенту + +[TIP] +==== +* [*] Змінено логіку роботи Cleanup-процесу видалення регламенту. +* [*] Додано можливість виконати cleanup зі збереженням поточного регламенту, регулюючи процес вхідним параметром *`DELETE_REGISTRY_REGULATIONS_GERRIT_REPOSITORY`*. +==== + +//// + diff --git a/docs/ua/modules/release-notes/pages/release-notes/part-5/rn-5.adoc b/docs/ua/modules/release-notes/pages/release-notes/part-5/rn-5.adoc new file mode 100644 index 0000000000..04235369fe --- /dev/null +++ b/docs/ua/modules/release-notes/pages/release-notes/part-5/rn-5.adoc @@ -0,0 +1,322 @@ += Примітки до релізу 1.9.7. Частина 5 +//:toc: +:toc-title: ЗМІСТ +//:sectnums: +:sectlinks: +:sectanchors: +:note-caption: Покращено +:tip-caption: Розроблено +:caution-caption: Інше +:important-caption: Виправлено +:warning-caption: Покращення безпеки + +== Обмеження доступу на рівні IP до SOAP-інтерфейсів ШБО "Трембіта" +//TODO: first.xlsx + +[TIP] +==== +* [*] Можливість обмежувати доступ до SOAP API-роутів, що використовуються ШБО "Трембіта". + +* [*] Можливість задавати дозволені IP-адреси для налаштування вхідних інтеграцій через ШБО "Трембіта". + +* [*] Додано логіку: не створювати `registry-soap-api` роут за відсутності адрес в `ipList`. + +* [*] Реалізовано можливість додавати IP-адреси в анотацію роутів компонентів `bp-webservice-gateway-trembita` та `registry-soap-api`. + +* [*] Змінено роут `bp-webservice-gateway-trembita` на `path`-based. + +* [*] Додано валідацію IP-адреси на рівні Jenkins-пайплайну. + +* [*] Внесено зміни до бібліотеки для тестів після додавання нового роуту `bp-webservice-gateway-trembita`. +==== + +//// + +== Управління керівником реєстру кадровиками та іншими посадовими особами + +[TIP] +==== +Управління кадровиками та посадовими особами у реєстрі: :: + +* [*] Запроваджено референтний бізнес-процес для управління реєстром кадровиків та інших посадових осіб керівником реєстру. + +* [*] Керівники реєстру тепер мають змогу переглядати інформацію про кадровиків та інших посадових осіб, а також виконувати дії з обраними записами таблиці через Кабінет. + +Типові розширення для розробників регламенту: :: + +* [*] *Create officer user*: дозволяє створювати посадових осіб з обов'язковим внесенням службових атрибутів та додаванням додаткових довільних атрибутів, з автоматичним призначенням системної ролі. + +* [*] *Save officer user attributes*: дозволяє редагувати системні та додаткові атрибути посадових осіб з бізнес-процесу. + +* [*] *Get roles*: дає змогу отримувати список доступних ролей заданого реалма із бізнес-процесу. + +* [*] *Get user roles*: дозволяє отримувати перелік регламентних ролей користувача. + +Делегати та шаблони element templates: :: + +* [*] На рівні back-end розроблено делегати та element templates для вищезгаданих типових розширень, що значно спрощує процес інтеграції та розширення функціональності бізнес-процесів. +==== + +== Управління кадровиком посадовими особами + +[TIP] +==== +* [*] Створено референтний бізнес-процес для управління посадовими особами через кабінет кадровика. Тепер кадровики мають змогу переглядати інформацію про посадових осіб, а також виконувати дії з обраними записами у таблиці. Це поліпшує ефективність управління персоналом та спрощує процеси. +==== + +== Ієрархічна модель заявників (не лише в рамках однієї юрособи) -- референтний приклад + +[TIP] +==== +Управління повноваженнями та ієрархічна модель: :: + +* [*] Створено ієрархічну модель заявників для управління повноваженнями отримувачів послуг на референтному бізнес-процесі. Це дозволяє керівникам ЮО/ФОП ефективно керувати дозволами діяти від імені їхньої організації. + +Модель даних та повідомлення: :: + +* [*] Реалізовано дата-модель та сформовано шаблони повідомлень для бізнес-процесу. + +Моделювання форм та сценаріїв: :: + +* [*] Здійснено моделювання форм та сценаріїв бізнес-процесу, що підвищує зручність роботи користувачів. + +Скасування ліцензій та управління повноваженнями: :: + +* [*] Також, уповноваженим особам-отримувачам послуг надано можливість створювати запити на скасування ліцензій від імені ЮО/ФОП через референтний бізнес-процес. Це забезпечує більшу гнучкість та контроль над управлінням повноваженнями. +==== + +== Створення елементів ієрархії (підрозділи…) із Кабінету посадової особи -- референтний приклад + +[TIP] +==== +Розробка бізнес-процесу та моделі даних: :: + +* [*] Розроблено референтний бізнес-процес (БП) для перегляду та виконання дій з елементами ієрархії з кабінету посадової особи. + +* [*] Створено модель даних для управління ієрархією та заповнено довідники початковими значеннями. + +* [*] Розроблено бізнес-процес для управління ієрархічною структурою, включаючи розробку форм. + +* [*] Розроблено форми для редагування та створення документів у рамках бізнес-процесів. + +* [*] Розширено модель даних необхідними критеріями пошуку (Search Conditions). + +Робота з атрибутами користувачів: :: + +* [*] Додано підтримку автоматичного пропагування додаткових атрибутів користувачів в Access Token / ID Token / UserInfo через "JsonWebToken#otherClaims". + +* [*] Розроблено компонент `oidc-usermodel-custom-attributes-mapper` в EDP для обробки кастомних атрибутів користувачів для протоколу OIDC. + +* [*] Додано mapper для кастомних атрибутів у збірку Keycloak та налаштування для клієнтів "officer-portal" та "citizen-portal". + +* [*] Додано можливість отримання значень додаткових атрибутів користувача через функції "initiator()" та "completer()" у JUEL-виразах БП за допомогою "UserDto#attributes". + +* [*] Додано метод (getter) "attributes" у клас "UserDTO" для використання у функціях "initiator()" та "completer()" JUEL. + +Налаштування та використання атрибутів: :: + +* [*] Налаштовано атрибут "КАТОТТГ" як ознаку приналежності до ієрархії та доступність для використання в RLS (Row-Level Security) та звітах на рівні регламенту реєстру разом з іншими додатковими атрибутами. + +* [*] Позначено protocol mapper "КАТОТТГ" як deprecated у helm-чартах. +Позначено відповідні java-класи та методи, які використовують "КАТОТТГ", як deprecated. + +Робота з протоколами та компонентами: :: + +* [*] Додано компонент "saml-user-custom-attributes-mapper" в EDP для обробки кастомних атрибутів користувачів для протоколу SAML. + +* [*] Додано mapper для кастомних атрибутів у збірку Keycloak та налаштування для клієнтів "redash-viewer" та "redash-admin". + +Розширення пошуку та швидкого пошуку: :: + +* [*] Розроблено типове розширення "Search registry users by attributes" для пошуку користувачів з можливістю вказати атрибути, їх значення та тип пошуку. + +* [*] Створено універсальний делегат для пошуку користувачів в Keycloak та розроблено відповідний елемент-шаблон. + +* [*] Розширено Keycloak REST API extension новим методом для пошуку користувачів за атрибутами. + +* [*] Додано можливість швидкого текстового пошуку в табличному компоненті для користувачів кабінету посадової особи/громадянина після SAML-автентифікації. + +* [*] Додано компонент "Quick Search" для швидкого пошуку у компоненті "Edit Grid" для використання в "Officer-portal" та "Citizen-portal". + +* [*] Додано можливість налаштування швидкого текстового пошуку у табличному компоненті за даними ("Quick Search"). +==== + +== Декларативний підхід до налаштування емуляторів зовнішніх систем для спрощення тестування зовнішніх інтеграцій реєстру + +[TIP] +==== +Налаштування емуляторів для зовнішніх інтеграцій у Control Plane: :: + +* [*] Розширено можливості control-plane-console для виконання налаштувань. + +* [*] Оновлено Control Plane Jenkins-пайплайн для розгортання реєстру з урахуванням описаних змін. + +* [*] Видалено роут для Wiremock. + +* [*] Прибрано з примітки біля чек-боксу "для версій реєстру 1.9.4 та вище". + +* [*] Змінено URL емулятора реєстру з `url = http://wiremock:/` на `http://wiremock.{NAME_REGІSTRy}:/`. + +Додавання нових емуляторів для інтеграції зовнішніх систем: :: + +* [*] Реалізовано можливість додавати нові емулятори для інтеграції зовнішніх систем. + +* [*] Додано правила валідації регламенту. + +* [*] Додано етап для імпорту mappings до пайплайну *registry-regulations*. + +* [*] Додано `network-policy` для взаємодії з реєстровим WM-сервісом. +==== + +== Єдиний URL для Кабінету посадової особи та інструменту Redash + +[TIP] +==== +Єдиний URL для Redash: :: + +* [*] Винесено Redash Viewer за основний KONG API-шлюз за шляхом `/reports`. + +Налаштування Redash Viewer: :: + +* [*] Налаштовано Redash Viewer використовувати Kong DNS. + +* [*] Налаштування маршрутизації в React для видачі статики `/static` за context path-ом `REDASH_ROUTE_PREFIX`. + +Налаштування Redash Admin: :: + +* [*] Винесено реєстровий адміністративний ендпоінт Redash Admin під Kong API Gateway. +==== + +[NOTE] +==== +* [*] Видалено функціональність по використанню власних DNS для Redash Viewer. + +* [*] Видалено окреме налаштування DNS в control-plane-console для Redash. +==== + +== Зв'язок зі службою підтримки при виникненні некритичних помилок у Кабінетах користувачів + +[TIP] +==== +* [*] Додано можливість отримання ідентифікатора трасування (*Trace ID*) при виникненні некритичних помилок на інтерфейсах користувачів. + +* [*] Додано можливість скопіювати Email та зв'язатися зі службою підтримки при виникненні некритичних помилок. + +* [*] Створено попереджувальне вікно нотифікацій, яке відображає інформацію про помилку. + +* [*] Додано відображення нотифікації у Кабінетах користувачів (посадової особи, отримувача послуг та адміністратора регламенту). +==== + +== Розгортання демо-реєстру із референтними прикладами + +[TIP] +==== +* [*] Реалізовано можливість розгорнути демо-реєстр із референтними прикладами моделювання регламенту, зокрема бізнес-процесів, UI-форм, схем моделі даних тощо. + +* [*] Додано пакування _consent-data_ як додаткового репозиторію Gerrit в Інсталері. + +* [*] Додано версіонування по гілці у _consent-data_. + +* [*] Адаптовано пайплайн публікації для можливості використання внутрішніх посилань до `nexus` у liquibase-файлах моделі даних. + +* [*] Змінено для розгортання Nexus `basePath` CICD2-кластера (узгоджено зі значенням для Envone-кластера). + +* [*] Додано сервіс для nexus для використання порту 80 (назва сервісу -- `artifactory`). +==== + +[NOTE] +==== +* [*] Переведено _consent-data_ на використання внутрішніх посилань до `nexus` у liquibase-файлах моделі даних. + +* [*] Переведено `empty-registry-reg` template на використання внутрішніх посилань до nexus у liquibase-файлах моделі даних. + +* [*] Оновлено структуру регламенту _consent-data_ для розділення на unit та complex референтні приклади. +==== + +== Кешування JWT-токенів при взаємодії з іншими системами + +[TIP] +==== +Кешування тимчасових авторизаційних JWT-токенів: :: + +* [*] Кешування тимчасових авторизаційних JWT-токенів, отриманих в рамках взаємодії із зовнішніми системами, згідно з визначеним специфікацією терміном дії у клеймі "exp". + +* [*] Кешування тимчасових авторизаційних JWT-токенів, отриманих в рамках взаємодії із зовнішніми системами через "Універсальний REST-конектор", згідно з визначеним специфікацією часом дії у клеймі "exp". + +Кешування тимчасових авторизаційних JWT-токенів для відправки push-повідомлень: :: + +* [*] Кешування тимчасових авторизаційних JWT-токенів, отриманих в рамках взаємодії з "Дією" при обміні push-повідомленнями, згідно з визначеним специфікацією терміном дії у клеймі "exp". + +* [*] Винесено логіку по кешуванню токена доступу в окремий клас. +==== + +== Управління обмеженнями на завантаження цифрових документів та можливість скриптування завантаження та вивантаження файлів + +[TIP] +==== +Завантаження цифрових документів: :: + +* [*] Додано можливість скриптування завантаження цифрових документів, завантажених користувачами або отриманих із зовнішніх систем, у межах виконання бізнес-процесу. + +* [*] Розроблено JUEL-функцію `load_digital_document()`. + +Отримання метаданих: :: + +* [*] Розроблено внутрішній ендпоінт для вивантажування файлів із сервісу цифрових документів. + +* [*] Розроблено JUEL-функцію `get_digital_document_metadata()` для отримання метаданих цифрових документів у рамках бізнес-процесу. + +* [*] Додано розроблену JUEL-функцію для вивантажування файлу в автопідказки Groovy в адміністративному порталі. + +* [*] Розроблено референтний приклад з використанням двох JUEL-функцій для роботи з файлами. + +Збереження файлів у сховище: :: + +* [*] Додано службову JUEL-функцію `save_digital_document()` для скриптування збереження файлів, які були сформовані або вивантажені з зовнішніх систем, у сховище цифрових документів в рамках бізнес-процесу. + +* [*] Розроблено внутрішній ендпоінт для збереження файлу до Сервісу цифрових документів. + +* [*] Додано розроблену JUEL-функцію для збереження файлу в автопідказки Groovy в адміністративному порталі. + +Налаштування обмежень розмірів файлів: :: + +* [*] Додано можливість налаштовувати обмеження на розмір файлів цифрових документів, які завантажуються до реєстру. + +* [*] Додано параметри до конфігурації сервісу для встановлення обмежень на розмір файлів. + +* [*] Виконано валідацію розмірів файлів при завантаженні та редагуванні компонента на формі. + +Застосування обмежень на завантаження файлів: :: + +* [*] Додано обмеження на максимальний розмір файлів цифрових документів, завантажених користувачами через UI-форми, налаштовані на рівні конфігурації реєстру. + +* [*] Замінено використання параметра `max-remote-file-size-mb` на `digitalDocuments.maxFileSize`. + +* [*] Додано механізм перевірки розширення файлу, завантаженого за віддаленою адресою, на доступність. +==== + +== Керування розкладом реплікації об'єктів S3 через Control Plane + +[TIP] +==== +Керування розкладом реплікації об'єктів S3 через Control Plane: :: + +* [*] Імплементовано керування розкладом реплікації (бекапування) об'єктів в S3. + +* [*] Додано керування розкладом у Control Plane. + +* [*] Налаштовано передачу до пайплайну створення резервних копій S3-бакетів значення з Vault. + +Редагування внесених даних місця зберігання реплікації об'єктів в S3: :: + +* [*] Імплементовано можливість редагувати внесені дані місця зберігання реплікації (бекапування) об'єктів в S3. +==== + +== Інструкція з ручного перенесення реєстру з одного інстансу на інший + +[TIP] +==== +* [*] Розроблено детальну покрокову інструкцію щодо правильного перенесення реєстру з одного екземпляра на інший. +==== + +//// diff --git a/docs/ua/modules/release-notes/pages/release-notes/part-6/rn-6.adoc b/docs/ua/modules/release-notes/pages/release-notes/part-6/rn-6.adoc new file mode 100644 index 0000000000..17123a10c6 --- /dev/null +++ b/docs/ua/modules/release-notes/pages/release-notes/part-6/rn-6.adoc @@ -0,0 +1,391 @@ += Примітки до релізу 1.9.7. Частина 6 +:toc: +:toc-title: ЗМІСТ +:sectnums: +:sectlinks: +:sectanchors: +:note-caption: Покращено +:tip-caption: Розроблено +:caution-caption: Інше +:important-caption: Виправлено +:warning-caption: Покращення безпеки + +== Використання _Дія.Підпис_ для автентифікації та підпису +//MDTUDDM-23534 +//TODO: first.xlsx + +[TIP] +==== + +* [*] Впроваджено використання _Дія.Підпис_ у нашій системі. Тепер отримувачі послуг -- фізичні особи та ФОП -- мають можливість використовувати _Дія.Підпис_ для автентифікації та підпису даних на формах у Кабінеті. + +* [*] Для _Дія.Підпису_ тепер підтримуються такі ж правила валідації, як і для інших типів КЕП (Кваліфікованих Електронних Підписів). +==== + +== Використання хмарного ключа для автентифікації та підпису даних у Кабінеті +//MDTUDDM-23533 +//TODO: first.xlsx + +[TIP] +==== + +Надано можливість використання хмарного ключа для автентифікації та підпису: :: + +* [*] Отримувач та надавач послуг може автентифікуватись на користувацькому порталі за допомогою хмарного ключа. + +* [*] Отримувач та надавач послуг може підписувати дані, внесені через форми на користувацькому порталі, за допомогою хмарного ключа. + +* [*] Додано можливість рендерингу QR-коду в компоненті `SignatureWidget` для Keycloak. + +* [*] Додано можливість рендерингу QR-коду в компоненті `SignatureWidget` для Кабінету користувача. +==== + +== Перевірка підписаних даних, отриманих зі сторонньої системи: валідація КЕП та ідентифікація підписантів у файлах ASICS/CADES +//MDTUDDM-26500 +//TODO: first.xlsx + +[TIP] +==== +Надано можливість перевіряти валідність підпису КЕП та його джерела, _коли підпис надійшов у бізнес-процес по API разом із даними (контейнер типу ASICS або CADES)_. + +Розробник Регламенту тепер має делегат для перевірки валідності підпису даних та архіву файлів, що містять підпис: :: + +* [*] Імплементовано необхідні ендпоінти в `digital-signature-ops` та `ddm-dso-client`. + +* [*] Розроблено делегат та element template. + +Розробник Регламенту тепер має відповідні JUEL-функції для отримання деталей про підписанта даних та архіву файлів, що містять підпис, та отримання контенту підписаних даних та архіву файлів, що містять підпис: :: + +* [*] Розроблено JUEL-функцію `signature_details(...)`. + +* [*] Розроблено JUEL-функцію `signature_content(...)`. + +Розробник Регламенту тепер має референтний приклад можливості перевіряти валідність підпису КЕП і ким підписано контент: :: + +* [*] Створено референтний бізнес-процес, як приклад валідації. +==== + +== Інструкція по розгортанню Платформи з Інсталера у цільовому приватному хмарному середовищі _vSphere_ +//MDTUDDM-26142 +//TODO: first.xlsx + +[TIP] +==== +* [*] Розроблено детальну покрокову інструкцію для адміністратора по розгортанню Платформи з нуля на кластері у приватному хмарному середовищі _vSphere_. +==== + +== Створення пам'ятки: виведення Платформи та реєстрів у промислову експлуатацію +//MDTUDDM-22886 +//TODO: first.xlsx + +[TIP] +==== +* [*] Для полегшення процесу виводу реєстру та Платформи у промислове середовище, ми розробили спеціалізовану пам'ятку. Цей документ стане незамінним помічником для вашої команди під час переходу від тестової стадії до промислової експлуатації. + +* [*] Пам'ятка містить вичерпний перелік передумов, послідовність кроків, докладний опис налаштувань, корисні рекомендації, а також інформацію про можливі проблеми, які можуть виникнути під час цього процесу, та шляхи їх вирішення. + +* [*] Впровадження цього інструменту сприятиме більш гладкому та ефективному переходу вашої платформи та реєстрів в промислове середовище, зменшуючи ризики та забезпечуючи високу надійність системи. +==== + +== Зміна назви кабінету посадової особи на нейтральну з урахуванням користувачів-представників бізнесу +//MDTUDDM-26959 +//TODO: first.xlsx + +[TIP] +==== +Змінено назву Кабінету посадової особи (надавача послуг) на нейтральну, яка є зрозумілою всім категоріям його користувачів, зокрема представникам бізнесу, що надають реєстраційні послуги. + +* [*] Назву `Кабінет посадової особи` змінено на `Кабінет користувача`. +==== + +== Оновлення сертифікатів АЦСК для Платформи та реєстру через Control Plane без зміни ключа послуг +//MDTUDDM-22895 +//TODO: first.xlsx + +[TIP] +==== +* [*] Запроваджено можливість оновлення сертифікатів надавачів послуг (файли _CA.json_, _CACertificates.p7b_) в адміністративній консолі Control Plane для адміністраторів Платформи та реєстру. Тепер оновлення можливе без внесення інформації про ключ для перевірки та формування підпису в Кабінетах користувачів. + +* [*] Додатково, адміністраторам надана можливість оновлення переліку дозволених ключів. Це спрощує процес управління сертифікатами та підвищує гнучкість у роботі з сертифікатами надавачів послуг. + +Це оновлення робить управління сертифікатами більш зручним та ефективним, мінімізуючи зусилля адміністраторів при забезпеченні безпеки та актуальності даних. +==== + +== Налаштування параметрів автентифікації та підпису даних через віджет, параметрів підпису через id.gov.ua для отримувачів послуг та автентифікація отримувачів послуг з _Дія.підпис_ +//MDTUDDM-22796 +//TODO: first.xlsx + +[TIP] +==== + +* [*] Внесено зміни, що дозволяють адміністраторам реєстру налаштовувати для користувачів Кабінету отримувачів послуг специфічний спосіб підпису даних та вибирати віджет як метод автентифікації. Користувачам Кабінету тепер доступний лише один, визначений адміністратором, спосіб автентифікації. + +* [*] Для користувачів ФО та ФОП імплементована можливість автентифікації за допомогою _Дія.підпису_ та _BankID_ з урахуванням обраного ними режиму автентифікації: "Для громадян" чи "Для бізнесу". + +* [*] Користувачам ФОП і представникам ФОП та ЮО надана можливість автентифікації в Кабінеті через сервіс `id.gov.ua`, використовуючи КЕП. + +* [*] Забезпечено можливість для користувачів підписувати дані за допомогою файлового та апаратного КЕПу у віджеті підпису, налаштованому через `id.gov.ua`, що підвищує гнучкість та зручність у використанні платформи. + +Ці оновлення значно розширюють функціональність Кабінету отримувачів послуг, пропонуючи більше варіантів автентифікації та підпису, тим самим вдосконалюючи взаємодію користувачів із системою. +==== + +//// + +== Створення proxy-сервера для geoserver для підтримки розподілення за ієрархічною моделлю (RLS) + +[TIP] +==== +* [*] Введено підтримку для розподілення рівнів доступу користувачів за ієрархічною моделлю Row-level security (RLS) для компонента `geoserver`. + +* [*] Користувач може мати доступ до даних з геосервера відповідно до свого рівня доступу в RLS. + +* [*] Згідно з налаштуванням RLS із метаданих (регламенту), сервіс зчитує `jwtAttribute` із токена поточного користувача, і використовує результат для внесення додаткового параметра запита в геосервері. +==== + +== Публічний API на читання даних + +[TIP] +==== + +Розробка публічних інтерфейсів :: + +* [*] У цьому релізі ми розширили можливості нашого API. Тепер, окрім внутрішнього API, розробники можуть відкривати публічний API для доступу до даних. Користувачі, які не пройшли аутентифікацію, тепер можуть переглядати публічні дані реєстру. + +* [*] Імплементовано можливість налаштовувати доступ до представлень та REST API реєстру для неавтентифікованих користувачів. + +Автоматична публікація в Open API :: + +* [*] Тепер налаштовані точки доступу автоматично публікуються в openapi-специфікації API-сервісу. Це робить інтеграцію та документацію API простішою. + +Оптимізація завантаження :: + +* [*] Впроваджено TTL-based кешування для `GET`-запитів, коли йде мова про посилання до API-документації. Це зменшує навантаження на наш сервіс Kong API Gateway та прискорює доступ до інформації. + +Розширені можливості в адмін-консолі Control Plane :: + +* [*] В адмін-консолі Control Plane додано новий інструмент для керування публічним доступом. Ви зможете налаштовувати, редагувати, блокувати або розблоковувати доступ до публічних даних реєстру. + +Моніторинг API:: + +* [*] Імплементовано моніторинг показників виконання та кількості запитів до публічного API. Тепер ці метрики можна легко контролювати завдяки новому Grafana-dashboard. +==== + +== Рейт-ліміти на запити на читання даних публічного API + +[TIP] +==== + +Розширені можливості в адмін-консолі Control Plane :: + +* [*] Реалізовано можливість в адміністративній панелі Control Plane встановлювати рейт-ліміти для запитів на читання даних для публічних точок доступу API. + +Моніторинг рейт-лімітів :: + +* [*] Імплементовано моніторинг показників виконання та кількості запитів до публічного API. Тепер ці метрики можна легко контролювати завдяки новому Grafana-dashboard. +==== + +== Використання dependency track для збереження даних інвентаризації компонентів Платформи + +[TIP] +==== + +Механізм для збереження даних інвентаризації :: + +* [*] Реалізовано механізм збору даних інвентаризації залежностей у форматі BOM's (_наприклад, CycloneDX SBOM_). + +* [*] Встановлено та налаштовано dependency track-додаток з необхідними модулями: автентифікація, моніторинг, резервні копії тощо. + +* [*] Налаштовано Dependency Track Vulnerability Policies та інтегровано з зовнішніми сервісами для аналізу вразливостей. + +* [*] Проведено аналіз Rest API dependency track та визначено механізм доставки репорту inventory management до кінцевого користувача. + +Надано можливість отримувати Dependency Management Report :: + +* [*] Перелік 3rd party залежностей, їх версій, ліцензій, аналіз по кожному компоненту системи. + +* [*] Порівняння використовуваних версій з поточними версіями кожної залежності. + +* [*] Визначення major чи minor оновлень. + +* [*] Інформація про LTS дати для кожної залежності (потребує POC). + +Це оновлення значно покращує процес управління інвентаризацією компонентів Платформи, забезпечуючи більшу прозорість та контроль над залежностями та вразливостями системи. +==== + +== Можливість вивантаження файлів з Edit Grid + +[TIP] +==== + +* [*] Розширено можливості компонента моделювання форм -- *Edit Grid*. Надавачі та отримувачі послуг тепер можуть легко завантажувати та переглядати файли прямо з табличного компонента одним натисканням кнопки. +==== + +== Можливість завантажувати файли більші за 50 рядків + +[TIP] +==== + +* [*] Додано можливість завантаження csv-файлу з кількістю записів, що перевищує 50. Так отримувач та надавач послуг можуть з легкістю вносити масивні зміни в рамках бізнес-процесу за одну транзакцію. + +* [*] Введено новий компонент моделювання UI-форм -- *Data Import*. З його допомогою розробник регламенту може легко налаштовувати імпорт даних з csv-файлу прямо в бізнес-процес. Це значно спрощує та автоматизує роботу з даними. + +* [*] Розроблено делегат *Async Data Load Csv Delegate* для відправлення повідомлень в Kafka про CSV batch load. Це поліпшує комунікацію та забезпечує швидке отримання статусів. + +* [*] При завантаженні даних з csv-файлу в дата-фабрику, імплементовано попередню валідацію. Це дозволяє швидко виявляти та виправляти помилки. + +* [*] Listener у bpms-сервісі тепер може отримувати повідомлення від Kafka та інформувати БП про завершення обробки csv-файлу, що робить процес більш прозорим. + +* [*] Розроблено референтний приклад використання batch-load у бізнес-процесі. Він демонструє можливість завантаження понад 50 рядків. +==== + +== Можливість редагувати параметри реєстру залежно від його версії + +[TIP] +==== + +* [*] Впроваджено можливість в інтерфейсі Control Plane редагувати параметри реєстру, враховуючи його конкретну версію. Це гарантує сумісність і стабільність роботи реєстрів незалежно від їхньої версії. + +* [*] Реалізовано можливість підтримки декількох версій Control Plane, що збігаються із версіями реєстрів. Таким чином, кожна версія реєстру має свої специфічні налаштування, адаптовані під її особливості. + +==== + +== Спрощений процес розробки регламенту через мастер-версію для форм і бізнес-процесів та захист від перезапису змін + +[TIP] +==== + +* [*] Полегшено розробку регламенту реєстру. Тепер для внесення до UI-форм та моделей процесів не потрібно створювати окрему версію-кандидат. Розробник та моделювальник можуть вносити зміни прямо у мастер-версію. + +* [*] Моделювальник регламенту тепер може прямо у мастер-версії створювати, копіювати, редагувати чи видаляти бізнес-процеси та UI-форми. Це сприяє швидшому застосуванню змін. Результат публікації змін можна перевірити у розділі "Огляд версії". + +* [*] Реалізовано вбудований механізм, який гарантує, що зміни не будуть випадково перезаписані, забезпечуючи надійний захист від непередбачуваних ситуацій у процесі розробки. +==== + +== Інструкція для перегляду та перевірки внесених змін до моделі даних версії-кандидата в ізоляції без необхідності їх інтеграції в мастер-версію + +[TIP] +==== + +* [*] Впроваджено стандартну процедуру для перевірки змін моделі даних перед їх інтеграцією в мастер-версію. + +* [*] Розроблено детальну інструкцію, яка включає кроки для створення таблиць, налаштування критеріїв пошуку, первинного завантаження даних та перевірки у тимчасовій БД через pgAdmin. Цей посібник гарантує правильне та ефективне впровадження змін розробниками регламенту. + +==== + +== Індикація наявності конфліктних змін на рівні складових версії-кандидата при перегляді + +[TIP] +==== + +* [*] Розширено можливості Адміністративного порталу. Тепер розробники може з легкістю виявляти та переглядати конфліктні зміни відносно майстер-версії на сторінці Огляд версії. + +* [*] Яскраві індикатори поруч із назвами файлів допомагають миттєво розібратися в статусі змін. При наведенні курсора, розробник отримує зрозумілу підказку. + +* [*] При виявленні конфліктних змін у складовій регламенту, їх деталі автоматично розгортаються, що допомагає розробникам швидко орієнтуватися у ситуації. +==== + +== Частковий відкат окремих складових версії-кандидату до стану мастер-версії для спрощення розв'язання конфліктів + +[TIP] +==== +* [*] Реалізовано функціональність для розробників регламенту: тепер можна відкотити зміни в окремих файлах назад до стану майстер-версії. Такий інструмент дозволяє швидко та безболісно уникати конфліктів, не видаляючи або перестворюючи версію-кандидат при зіткненні з конфліктами. +==== + +== Можливість налаштовувати розмір пула в rest-api та кafka-api + +[TIP] +==== + +* [*] Реалізовано можливість налаштовувати розмір пула з’єднань, специфічного для сервісів `rest-api` та `kafka-api`. Це дозволяє оптимізувати роботу сервісів з урахуванням потреб користувачів. + +* [*] Додано параметр *Maximum pool size*, що дозволяє встановити максимальну кількість одночасних з'єднань із базою даних. Пул з'єднань гарантує, що використовується найбільше ефективна кількість з'єднань, забезпечуючи оптимальну продуктивність системи. +==== + +== Налаштування каналів зв'язку в Кабінеті користувача + +[TIP] +==== + +Керування електронною поштою у Кабінеті користувача :: + +* [*] Можливість перегляду налаштувань електронної пошти. + +* [*] Внесення або видалення електронної адреси. Підтвердження даних за допомогою OTP-коду. + +* [*] Опції активації та деактивації електронних адрес. + +Перегляд inbox-повідомлень :: + +* [*] Надавачам послуг надана можливість перегляду повідомлень у розділі _Повідомлення_ у Кабінеті. Ця функція активована автоматично.н + +Моделювання шаблонів повідомлень :: + +* [*] Налаштування шаблону повідомлень у різні Кабінети з урахуванням ролі користувача: CITIZEN/OFFICER. +==== + +== Відправка inbox- та email-нотифікацій посадовим особам + +[TIP] +==== + +* [*] Реалізовано можливість отримувати та переглядати inbox-повідомлення у Кабінеті користувача надавачами послуг. + +* [*] Реалізовано можливість отримувати та переглядати email-повідомлення у Кабінеті користувача надавачами послуг. + +{empty} + +Моделювання нотифікацій :: + +* [*] Моделювання повідомлень доступне для каналів inbox та email. + +* [*] Надсилання повідомлень у різні Кабінети з одного шаблону з урахуванням ролі користувача: `CITIZEN`/`OFFICER`. + +* [*] Шаблон `channel-confirmation` модифіковано, враховуючи роль користувача. + +* [*] Розроблено референтний бізнес-процес для відправлення повідомлень надавачам послуг. + +{empty} + +Розробка нового інтеграційного розширення :: + +* [*] Імплементовано делегат *Send user notification v2*. Шаблон делегата інтегровано в Адміністративний портал для розширення можливостей бізнес-процесів. + +==== + +== Інструкція. Автентифікація посадових осіб, єдина для групи реєстрів завдяки ручним налаштуванням + +[TIP] +==== + +* [*] Впроваджено можливість адміністраторам реєстрів об'єднувати реєстри у групу, щоб забезпечити спрощену та єдину автентифікацію для надавачів послуг у рамках цієї групи. + +* [*] Для зручності користувачів, розроблено детальну інструкцію, яка крок за кроком допоможе налаштувати цю функціональність. +==== + +== Навчальний курс для адміністраторів реєстрів + +[TIP] +==== + +* [*] Представлено новий навчальний курс, призначений для адміністраторів реєстрів, який охоплює весь спектр обов'язків та функціональностей, необхідних для підвищення компетенцій у керуванні та адмініструванні реєстрів на Платформі. + +* [*] Курс включає: + +** [*] Вступ до ролі адміністратора реєстру. + +** [*] Повний огляд обов'язків та вимог до адміністратора. + +** [*] Докладні інструкції по розгортанню та редагуванню конфігурації реєстру. + +** [*] Налаштування локального та робочого середовища. + +** [*] Керування реєстрами через Control Plane, включаючи налаштування конфігурацій, ключів, сертифікатів, DNS-імен та інших компонентів. + +** [*] Опис процесів резервного копіювання, відновлення та оновлення реєстру. + +** [*] Практичні аспекти логування подій та моніторингу метрик Платформи та адміністрування бізнес-процесів. + +** [*] Управління користувачами та ролями. +==== + +//// \ No newline at end of file diff --git a/docs/ua/modules/release-notes/pages/release-notes/part-7/rn-7.adoc b/docs/ua/modules/release-notes/pages/release-notes/part-7/rn-7.adoc new file mode 100644 index 0000000000..b3b52f9798 --- /dev/null +++ b/docs/ua/modules/release-notes/pages/release-notes/part-7/rn-7.adoc @@ -0,0 +1,406 @@ += Примітки до релізу 1.9.7. Частина 7 +:toc: +:toc-title: ЗМІСТ +:sectnums: +:sectlinks: +:sectanchors: +:note-caption: Покращено +:tip-caption: Розроблено +:caution-caption: Інше +:important-caption: Виправлено +:warning-caption: Покращення безпеки + +== Валідація порожніх обов'язкових полів на рівні шаблону бізнес-процесу +//MDTUDDM-20485 +//TODO: first.xlsx + +[TIP] +==== + +* [*] Впроваджено клієнтську валідацію у вебінтерфейсі моделювання регламенту для перевірки порожніх обов'язкових полів у шаблонах типових розширень до бізнес-процесів. + +* [*] Додано серверний механізм валідації на пайплайні перевірки регламенту, який використовує ті ж валідаційні правила, що й клієнтська валідація. + +* [*] У логах пайплайну в сервісі Jenkins тепер відображаються ідентифікатори задач із помилками, пов'язаними з відсутністю значень в обов'язкових для заповнення полях типових розширень. + +Це оновлення забезпечує більшу точність та консистентність у процесі моделювання бізнес-процесів, запобігаючи помилкам, пов'язаним з пропущеними обов'язковими полями. +==== + +== Перевірка цілісності запита на внесення змін до регламенту реєстру +//MDTUDDM-13344 +//TODO: first.xlsx + +[TIP] +==== +* [*] Впроваджено новий механізм перевірки цілісності запитів на внесення змін до регламенту реєстру у пайплайнах публікації та перевірки регламенту. + +Оновлені правила включають: :: + +** [*] Перевірку цілісності запита і внутрішніх зв'язків у делегатах бізнес-процесів. + +** [*] Валідацію залежностей для JUEL-функцій бізнес-процесів. + +Оновлення сприяє підвищенню якості та надійності регламенту, запобігаючи помилкам, пов'язаним з внутрішньою цілісністю бізнес-процесів та функцій. +==== + +== Розширення можливостей пошуку із вказанням додаткової умови OR в межах однієї таблиці +//MDTUDDM-26686 +//TODO: first.xlsx + +[TIP] +==== + +* [*] Внесено зміни, що дозволяють моделювальникам регламенту реєстру об'єднувати кілька параметрів пошуку за допомогою оператора `OR` в рамках однієї таблиці. + +Розробники тепер мають можливість: :: + +** [*] Застосовувати умову `OR` для групування декількох параметрів пошуку. +** [*] Визначати порядок виконання операторів `AND` і `OR`, що надає більшу гнучкість у формуванні запитів. + +Це оновлення полегшує процес моделювання складніших запитів пошуку та забезпечує більш ефективне використання даних у регламенті. +==== + +== Відображення інформації про автора створення та редагування об'єктів +//MDTUDDM-20490 +//TODO: first.xlsx + +[TIP] +==== + +* [*] Впроваджено нову функціональність для отримувачів та надавачів послуг, що дозволяє відображати на формах бізнес-процесів та у витягах інформацію про особу, яка створила та востаннє редагувала об'єкт. + +* [*] Для надавачів послуг тепер доступний звіт, який, крім інформації про автора створення та редагування сутностей, також включає дату та час виконаних дій. + +* [*] Розроблено референтні приклади бізнес-процесів та звіту, демонструючи використання цих нових можливостей, для кращого розуміння та наочності. + +Це оновлення покращує прозорість у процесі надання та отримання послуг, надаючи користувачам повну інформацію про історію об'єктів. +==== + +== Генерація GET та POST запитів на пошук даних для моделювальників регламенту +//MDTUDDM-25119 +//TODO: first.xlsx + +[TIP] +==== + +* [*] Вдосконалено інструментарій моделювання регламенту, додавши можливість автоматичної генерації як `GET`, так і `POST`-ендпоінтів при створенні запитів на пошук даних. + +* [*] Впроваджено новий механізм для створення запитів за типом `IN`/`NOT IN`, що ефективно обробляє дані з рядками, які містять коми у своїх значеннях. + +Це оновлення значно спрощує процес створення та використання запитів пошуку в регламенті, забезпечуючи коректну обробку складних даних і підвищуючи гнучкість моделювання. +==== + +== Референтний приклад та покращення компонента Textfield для вводу номера телефону (Україна) +//MDTUDDM-26321 +//TODO: first.xlsx + +[TIP] +==== + +* [*] Розроблено референтний приклад використання компонента *Textfield* з маскою для введення номерів телефону в українському форматі: +380(00)123-4567. + +* [*] Компонент *Textfield* тепер розширено налаштуванням, яке дозволяє передавати дані введеного номеру телефону без службових символів та розділових знаків, у форматі чистих цифр. + +Ці зміни забезпечують моделювальникам регламенту реєстру зручний та інтуїтивно зрозумілий спосіб для введення та обробки телефонних номерів, а також підвищують точність та якість обробки даних. +==== + +== Призначення ролей отримувача послуг з урахуванням онбордингу через окремі URL до Кабінету +//MDTUDDM-26305 +//TODO: first.xlsx + +[TIP] +==== + +* [*] Тепер отримувачам послуг, які ще не пройшли автентифікацію в кабінеті, доступна можливість переходу за спеціалізованими посиланнями для проходження онбордингу та отримання певної ролі в реєстрі. + +* [*] Запроваджено функціональність, що дозволяє моделювальникам регламенту реєстру передавати через URL-посилання для входу в Кабінет користувача необхідні параметри, зокрема роль, назву бізнес-процесу, стартову форму, а також за потреби додаткові параметри для автозаповнення форми. + +* [*] Надано референтний бізнес-процес, який демонструє використання цих нових можливостей. + +Це оновлення спрощує процес призначення ролей та доступу до відповідних бізнес-процесів для неавтентифікованих користувачів, роблячи процес онбордингу більш гнучким та інтуїтивним. +==== + +== Управління доступом користувачів до Кабінету надавача послуг з використанням КЕП фізичної особи +//MDTUDDM-28126 +//TODO: first.xlsx + +[TIP] +==== +* [*] Введено нову можливість для певних категорій надавачів послуг: доступ до Кабінету користувача за допомогою ключа фізичної особи, навіть за відсутності параметра "ЄДРПОУ". + +* [*] Адміністратори реєстру тепер мають змогу у Вебінтерфейсі управління Платформою налаштовувати дозвіл на автентифікацію та накладання підпису для користувачів з файловим, апаратним або хмарним ключем фізичної особи. + +* [*] Можливість автентифікації користувачів з ключем фізичної особи забезпечена як через віджет ІІТ, так і через сервіс `id.gov.ua`, залежно від обраного типу автентифікації. + +* [*] Додано референтний приклад бізнес-процесу самореєстрації з додатковою модерацією іншим уповноваженим користувачем, забезпечуючи контроль та безпеку процесу реєстрації в Кабінеті реєстру. + +Це оновлення відкриває нові можливості для надавачів послуг, забезпечуючи гнучкість у процесі автентифікації, а також підвищує контроль та безпеку при реєстрації нових користувачів. +==== + +== Можливість налаштовувати кнопку "Переглянути" у компоненті EditGrid +//MDTUDDM-28016 +//TODO: first.xlsx + +[TIP] +==== + +* [*] Внесено важливі оновлення у налаштування компоненти моделювання *Edit Grid*, розширюючи можливості керування інтерфейсом для моделювальників регламенту реєстру. + +* [*] Тепер моделювальники мають змогу приховувати кнопку "Переглянути" у контекстному меню рядка таблиці для надавачів та отримувачів послуг на формі задачі бізнес-процесу, коли активовано режим перегляду таблиці "read only". + +Це оновлення забезпечує більшу гнучкість та контроль над відображенням елементів інтерфейсу, дозволяючи адаптувати форми задач бізнес-процесів відповідно до специфічних потреб та вимог. +==== + +== Відправлення нотифікацій на довільні електронні адреси, що не заборонені blacklist +//MDTUDDM-20376 +//TODO: first.xlsx + +[TIP] +==== + +* [*] Впровадження можливості моделювання для відправки нотифікацій на електронні адреси у бізнес-процесах, дозволяючи моделювальникам регламенту реєстру відправляти повідомлення на довільні електронні адреси. + +Нові можливості включають зокрема: :: + +* [*] Відправлення повідомлень на електронні адреси, введені на формі, збережені в базі даних реєстру або отримані із зовнішніх систем. + +* [*] Перевірку електронних адрес на приналежність їх доменів до переліку заборонених для використання на території України, як на формі задачі, так і в делегаті бізнес-процесу. + +* [*] Представлено референтний приклад бізнес-процесу, який демонструє ці нові можливості. + +Це оновлення сприяє більшій гнучкості та ефективності у моделюванні бізнес-процесів, забезпечуючи точніше та більш контрольоване відправлення електронних нотифікацій. +==== + +== Призначення ролей посадової особи з урахуванням онбордингу через окремі URL до Кабінету +//MDTUDDM-26304 +//TODO: first.xlsx + +[TIP] +==== + +* [*] Впроваджено нову функціональність, яка дозволяє надавачам послуг, які не пройшли автентифікацію в Кабінеті, самостійно реєструватися та набувати певні ролі в реєстрі через спеціально сформовані URL-адреси. + +* [*] Моделювальникам регламенту реєстру тепер доступна можливість передачі в посиланні для входу в Кабінет користувача параметрів, які дозволять користувачам вибрати необхідний шлях: роль, назву бізнес-процесу, стартову форму та додаткові параметри для автозаповнення форми. + +* [*] Розроблено референтний бізнес-процес, що демонструє використання цих нових можливостей, забезпечуючи ефективний процес самореєстрації та призначення ролей. + +Це оновлення сприяє зручнішому та ефективнішому процесу онбордингу для надавачів послуг, дозволяючи їм швидко набувати потрібні ролі та отримувати доступ до відповідних бізнес-процесів. +==== + +== Інструкція з аудиту реєстру в розробці, етапності та переліку необхідних експертів для такого аудиту +//MDTUDDM-26036 +//TODO: first.xlsx + +[TIP] +==== + +* [*] Розроблено детальну інструкцію, призначену для команд розробки реєстрів, яка містить рекомендації щодо проведення аудиту реєстру на різних етапах розробки. + +Інструкція включає: :: + +* [*] Вказівки щодо критичних етапів розробки, на яких необхідно провести аудит. +* [*] Перелік експертів і спеціалістів, яких рекомендується залучати на кожному етапі для забезпечення високої якості та ефективності аудиту. +* [*] Методи та практики, які допоможуть оптимізувати процес аудиту та підвищити його ефективність. + +Ця інструкція спрямована на підвищення ефективності роботи команд розробників, забезпечуючи високу якість та відповідність розроблених реєстрів встановленим стандартам та вимогам. +==== + +== Додавання в Control Plane посилань на адміністративні ресурси Платформи, які мають інтерфейс +//MDTUDDM-23259 +//TODO: first.xlsx + +[TIP] +==== + +* [*] Внесено оновлення в адміністративну консоль Control Plane, що забезпечує адміністраторам Платформи швидкий доступ до адміністративних ендпоінтів Платформи, які мають вебінтерфейс. + +Нові функції включають зокрема: :: + +* [*] Згруповані посилання на адміністративні ендпоінти в адмін-консолі Control Plane, розділені за операційною та адміністративною зонами Платформи. + +* [*] Посилання розташовані у порядку частоти їх використання, забезпечуючи ефективний та зручний доступ до найбільш часто використовуваних інструментів. + +Це оновлення полегшує навігацію та підвищує ефективність роботи адміністраторів Платформи, дозволяючи швидко знаходити та використовувати необхідні інструменти управління. +==== + +== Оптимізація процесу створення реєстрів: мінімізація шаблонів і гнучкість налаштувань +//MDTUDDM-24344 +//TODO: first.xlsx + +[TIP] +==== + +* [*] Здійснено важливе оновлення в адміністративній консолі Control Plane, що спрощує процес створення реєстрів для адміністраторів. Тепер доступний мінімізований набір шаблонів. + +Нові функції дозволяють адміністраторам реєстру: :: + +* [*] Самостійно вибирати параметри реєстру під час його створення, замість використання попередньо сконфігурованих шаблонів. + +* [*] Редагувати параметри реєстру, які були налаштовані при його створенні, з можливістю коригування залежно від своєї ролі. + +Це оновлення значно підвищує гнучкість та ефективність процесу створення та управління реєстрами, дозволяючи адміністраторам швидко адаптуватися до змінних потреб та специфікацій. +==== + +== Додавання можливості вибору року в календарі компонента Date/Time +//MDTUDDM-28015 +//TODO: first.xlsx + +[TIP] +==== + +* [*] Відтепер користувачам кабінетів доступна покращена функціональність вибору дати в календарі, завдяки оновленій компоненті моделювання *Date/Time*. + +Основні нововведення: :: + +* [*] Можливість вибору потрібного року через випадний список біля значення року в календарі. Це спрощує процес вибору дат, особливо тих, що знаходяться значно віддалено від поточної дати. + +* [*] Розширений компонент Date/Time забезпечує більш гнучкі та зручні опції для користувачів при виборі дат. + +* [*] Розроблено референтний бізнес-процес, де продемонстровано використання оновленого компонента, що дозволить користувачам ознайомитися з новими можливостями на практиці. + +Це оновлення значно поліпшує інтерфейс та зручність вибору дат у Кабінетах користувачів, роблячи процес більш інтуїтивним та ефективним. +==== + +== Референтний приклад для вводу дати (Україна) +//MDTUDDM-26320 +//TODO: first.xlsx + +[TIP] +==== + +* [*] Розроблено приклади моделювання компонента *Date/Time*, спрямовані на задоволення різноманітних потреб користувачів кабінетів у використанні налаштованих полів для дати та часу. + +Нові можливості включають: :: + +* [*] Вибір попередніх дат, включаючи сьогоднішню. + +* [*] Вибір дати зі встановленого проміжку часу. + +* [*] Обрання потрібної дати лише через календар, без можливості ручного введення. + +* [*] Введення дати вручну при недоступному календарі. + +* [*] Відображення у полі значення, передзаповненого довільною чи поточною датою. + +* [*] Надано референтний бізнес-процес із налаштованими формами, доступний у демо-реєстрі для зручності моделювання та демонстрації можливостей. + +Це оновлення забезпечує моделювальникам регламенту реєстру ширші можливості для налаштування та використання компоненти *Date/Time*, відповідаючи різним сценаріям використання та забезпечуючи кращий досвід користувача. +==== + +== Розгортання регламенту як ідемпотентна операція +//MDTUDDM-20961 +//TODO: first.xlsx + +[TIP] +==== + +* [*] Впроваджено новий підхід до розгортання регламенту як ідемпотентну операцію, щоб забезпечити консистентність та точність застосування змін. + +Нові можливості включають: :: + +** [*] Порівняння поточного стану регламенту зі станом після останнього успішного виконання. Це дозволить системі виявити будь-які зміни у важливих директоріях та файлах, впливаючи на запуск відповідних кроків у пайплайні. + +** [*] Збереження стану регламенту в секрет для подальшого порівняння чексум (контрольних сум) директорій та файлів. Це забезпечує додаткову перевірку і також те, що всі зміни відображаються належним чином. + +** [*] Введення опції примусового розгортання регламенту, яка викликає всі кроки незалежно від змін у файлах чи директоріях. + +Ці оновлення поліпшують надійність та ефективність процесу розгортання регламенту, мінімізуючи ризики неконсистентності та помилок. +==== + +//// + +== Інтеграція інстанс-залежних змінних в документацію Платформи + +[TIP] +==== + +* [*] Запроваджено нову можливість для адміністраторів Платформи визначати та налаштовувати демо-реєстр інстансу для прямих переходів з документації. + +Уніфікація посилань в документації: :: + +* [*] Усі посилання в документації приведені до єдиної конвенції, забезпечуючи консистентність та зручність користувачів. +* При натисканні на посилання в документації, вони відкриваються у новому вікні браузера, відповідно до поточного інстансу Платформи та налаштованого демо-реєстру. + +Ці оновлення спрямовані на підвищення зручності користувачів документації, дозволяючи їм швидко та ефективно переходити до потрібних розділів демо-реєстру або інших важливих ресурсів. +==== + +== Розробка референтного прикладу моделювання бізнес-процесу з паралельним виконанням задач надавачами послуг із різними ролями + +[TIP] +==== + +* [*] Реалізовано референтний приклад бізнес-процесу, який є виконуваним (`executable`) та доступним також для ролі `citizen` у Кабінеті отримувача послуг. + +Особливості референтного бізнес-процесу: :: + +* Розподіл задач одночасно на декількох посадових осіб із ролями `officer-first-rank`, `officer-second-rank` та `hierarchy-registry-manager`. + +* [*] Врахування різного часу виконання задач залежно від ролі користувача. + +* [*] Налаштування системи нагадувань для посадових осіб з ролями `officer-first-rank` та `officer-second-rank` про необхідність опрацювання задач з черги. + +* [*] В адміністративному порталі демо-реєстру на вкладці "Моделі процесів" > закладка "Відображення в кабінетах", референтний БП розміщено в теку "Референтні бізнес-процеси". + +Це оновлення надає моделювальникам регламенту реєстру практичний приклад для розробки складних бізнес-процесів з паралельним виконанням задач, забезпечуючи ефективне управління робочими процесами та залучення різних ролей користувачів. +==== + +== Створення практичних завдань для навчання адміністратора реєстру + +[TIP] +==== + +* [*] Розроблено комплексні практичні завдання в рамках навчального курсу для технічних адміністраторів реєстрів з метою покращення навичок та розуміння роботи з реєстрами. + +Курс охоплює наступні теми: :: + +* [*] Ознайомлення з процесами редагування налаштувань реєстру. + +* [*] Покрокове керівництво по створенню та видаленню адміністраторів реєстру. + +* [*] Детальні інструкції з оновлення ключів та сертифікатів цифрового підпису. + +* [*] Керування ресурсами реєстру та обмеженнями на завантаження цифрових документів. + +* [*] Процеси внесення користувачів до реєстру. + +* [*] Налаштування різних типів автентифікації. + +* [*] Логування подій за допомогою Kibana та моніторинг метрик компонентів реєстру через Grafana. + +* [*] Процедури резервного копіювання та відновлення реєстру та його компонентів. + +* [*] Оновлення реєстру та налаштування власного DNS-імені для Кабінету посадової особи. + +Цей курс має на меті забезпечити адміністраторів всіма необхідними знаннями та практичними навичками для ефективного управління реєстрами та їх компонентами. +==== + +== Оновлення Платформи для сумісності з OpenShift версії 4.12 + +[NOTE] +==== +* [*] Оновлено платформу для сумісності з OpenShift версії 4.12 (крім Istio). + +* [*] Підготовлено підсистеми Платформи та реєстрів до оновлення на OKD 4.12. + +* [*] Оновлено версію API `awsproviderconfig.openshift.io/v1beta1` → `machine.openshift.io/v1beta1` для `control-plane-gerrit`, `storage`, `logging`. + +* [*] Додано версію ocs-operator для 4.12 в storage. + +* [*] Оновлено компонент `noobaa`. + +* [*] Оновлено `autoscaling/v2beta2` до `autoscaling/v2`. + +* [*] Переміщено на використання pod security admission. + +* [*] Мігрували з `batch/v1beta1` на `batch/v1`. + +* [*] Оновлено версії `oc` та `kubectl` до відповідних OKD 4.12 / Kubernetes 1.25. + +* [*] Мігрували з використання анотації `service.beta.kubernetes.io/load-balancer-source-ranges` на специфікацію `CR IngressController`. + +* [*] Проведено тестування на зворотну сумісність з OKD 4.11. + +* [*] Змінено NETWORK_TYPE для таргет-кластерів. +==== + +//// \ No newline at end of file diff --git a/docs/ua/modules/release-notes/pages/release-notes/release-notes.adoc b/docs/ua/modules/release-notes/pages/release-notes/release-notes.adoc new file mode 100644 index 0000000000..9181bdfada --- /dev/null +++ b/docs/ua/modules/release-notes/pages/release-notes/release-notes.adoc @@ -0,0 +1,15 @@ += Примітки до релізу 1.9.7 +:sectanchors: +:sectlinks: + +Пропонуємо ознайомитися з останніми примітками до релізу нашого програмного продукту. У цьому розділі ми надаємо інформацію про нові функції, оновлення компонентів, виправлення помилок, оптимізацію продуктивності та покращення безпеки. + +== Огляд секції + +//* xref:release-notes/part-1/rn-1.adoc[] +* xref:release-notes/part-2/rn-2.adoc[] +* xref:release-notes/part-3/rn-3.adoc[] +* xref:release-notes/part-4/rn-4.adoc[] +* xref:release-notes/part-5/rn-5.adoc[] +* xref:release-notes/part-6/rn-6.adoc[] +* xref:release-notes/part-7/rn-7.adoc[] diff --git a/docs/ua/modules/release-notes/pages/whats-new/part-1/wn-1.adoc b/docs/ua/modules/release-notes/pages/whats-new/part-1/wn-1.adoc new file mode 100644 index 0000000000..32edd4ccc3 --- /dev/null +++ b/docs/ua/modules/release-notes/pages/whats-new/part-1/wn-1.adoc @@ -0,0 +1,30 @@ +:toc-title: ЗМІСТ +:toc: auto +:toclevels: 1 +:experimental: +:sectanchors: +:sectlinks: +:important-caption: ВАЖЛИВО +:note-caption: ПРИМІТКА +:tip-caption: ПІДКАЗКА +:warning-caption: ПОПЕРЕДЖЕННЯ +:caution-caption: УВАГА +:example-caption: Приклад +:figure-caption: Зображення +:table-caption: Таблиця +:appendix-caption: Додаток + += Що нового у релізі 1.9.7. Частина 1 + +== Реалізація обмеження на сукупний об'єм масиву файлів, що завантажуються через БП + +У цьому релізі ми поліпшили можливості розробки регламенту при роботі з файлами, зокрема: + +* [*] Реалізовано обмеження на сукупний об'єм масиву файлів при завантаженні через БП. Системне обмеження на розмір завантажуваних файлів становить 100 MB. + +* [*] Обмеження на сукупний об'єм завантажуваних файлів застосовується до кожного поля масиву файлів на формі, а не сумарно до сторінки. + +* [*] Змінено налаштування у компоненті *File*: додано поля "Мінімальний сукупний об'єм завантажуваних файлів" та "Максимальний сукупний об'єм завантажуваних файлів". Тепер моделювальник регламенту реєстру може налаштовувати розмір масиву файлів під час завантаження через компонент File. + +.Максимальний сукупний обсяг файлів, що завантажуються через один компонент File +image::registry-develop:bp-modeling/forms/component-file-multiple-values/component-file-multiple-values-08.png[] \ No newline at end of file diff --git a/docs/ua/modules/release-notes/pages/whats-new/part-2/wn-2.adoc b/docs/ua/modules/release-notes/pages/whats-new/part-2/wn-2.adoc new file mode 100644 index 0000000000..8305bc2c32 --- /dev/null +++ b/docs/ua/modules/release-notes/pages/whats-new/part-2/wn-2.adoc @@ -0,0 +1,56 @@ +:toc-title: ЗМІСТ +//:toc: auto +:toclevels: 1 +:experimental: +:sectanchors: +:sectlinks: +:important-caption: ВАЖЛИВО +:note-caption: ПРИМІТКА +:tip-caption: ПІДКАЗКА +:warning-caption: ПОПЕРЕДЖЕННЯ +:caution-caption: УВАГА +:example-caption: Приклад +:figure-caption: Зображення +:table-caption: Таблиця +:appendix-caption: Додаток + += Що нового у релізі 1.9.7. Частина 1-2 + +== Завантаження файлів формату p7s та asics на UI-формі +//https://jiraeu.epam.com/browse/MDTUDDM-21820 + +У цьому релізі ми розробили функціональність, яка дозволяє посадовим особам та отримувачам послуг реєстру [.underline]#працювати з файлами у форматах *`p7s`* та *`asics`* та використовувати їх у рамках бізнес-процесів#. Ці файли є документами, що підписані КЕП, і мають специфічне розширення. + +image:user:upload-files/p7s-asic/upload-multiple-values-p7s-asic-2.png[] + +Користувачі кабінетів можуть [.underline]#завантажити, або дозавантажити один або декілька таких файлів на UI-формі бізнес-процесу# до фабрики даних як один масив. + +[TIP] +==== +Детальніше про функціональність та особливості завантаження файлів ви можете переглянути на сторінках: + +* xref:user:bp-files/upload-multiple-files-p7s-asic.adoc[] +* xref:registry-develop:bp-modeling/forms/components/file/component-file-multiple-values.adoc[] +==== + +//// + +== Поєднання таблиць за допомогою JOIN із додатковими умовами AND та OR + +Ми розширили можливості використання операції `*JOIN*` для поєднання таблиць-представлень (Search Conditions) у БД додатковою умовою `*OR*`, окрім вже наявної `AND`. + +Тепер адміністратор регламенту зможе використовувати нову функціональність при роботі з моделлю даних реєстру. + +Операція `**` дозволяє поєднувати таблиці за певними умовами. Використовується при створенні критеріїв пошуку всередині тегу `**` для отримання необхідних даних у зведених таблицях. + +Операцію `**` можна використовувати із додатковими умовами `*and*` та `*or*`, які визначаються в рамках тегу `**` як значення атрибута `*logicOperator*`. + +[TIP] +==== +Детальніше про функціональність ви можете переглянути на сторінках: + +* xref:registry-develop:data-modeling/data/physical-model/liquibase-ddm-ext.adoc[] +* xref:registry-develop:data-modeling/data/physical-model/join-and-or-usage.adoc[] +==== + +//// \ No newline at end of file diff --git a/docs/ua/modules/release-notes/pages/whats-new/part-3/wn-3.adoc b/docs/ua/modules/release-notes/pages/whats-new/part-3/wn-3.adoc new file mode 100644 index 0000000000..15569cd10f --- /dev/null +++ b/docs/ua/modules/release-notes/pages/whats-new/part-3/wn-3.adoc @@ -0,0 +1,256 @@ +:toc-title: ЗМІСТ +:toc: auto +:toclevels: 1 +:experimental: +:sectanchors: +:sectlinks: +:important-caption: ВАЖЛИВО +:note-caption: ПРИМІТКА +:tip-caption: ПІДКАЗКА +:warning-caption: ПОПЕРЕДЖЕННЯ +:caution-caption: УВАГА +:example-caption: Приклад +:figure-caption: Зображення +:table-caption: Таблиця +:appendix-caption: Додаток + += Що нового у релізі 1.9.7. Частина 3 + +== Впровадження стратегії нечіткого порівняння імені користувача при автентифікації + +Ми постійно працюємо над удосконаленням нашої платформи, і раді оголосити про нове оновлення, яке покращує процес автентифікації користувачів у реєстрах. + +Ми використовуємо нові правила порівняння, щоб забезпечити успішну автентифікацію користувачів реєстру. Коли ми отримуємо ім'я користувача, тобто атрибут `fullName` (ПІБ) через КЕП або від зовнішнього провайдера ідентифікації, то порівнюємо його зі значенням, яке зберігається в Keycloak IAM. При цьому ми застосовуємо нові правила, які не враховують спеціальні символи та дозволяють нечітко порівнювати імена користувачів. Такий підхід забезпечує більш точну та надійну автентифікацію. + +[TIP] +==== +Наприклад: :: + +Якщо користувач заведений у Keycloak як `fullName: "Маряна-Іриnа Сергіївна"`, а у КЕП вказано `fullName: "Мар'яна-Іриna Сергіївна!%?"`, то користувач зможе пройти автентифікацію та увійти до Кабінету. +==== + +[TIP] +==== +Детальніше про функціональність ви можете переглянути на сторінці: + +* xref:user:citizen-officer-portal-auth.adoc#auth-logic[Логіка автентифікації користувачів] +==== + +== Автентифікація за допомогою id.gov.ua для надавачів послуг + +Наша платформа підтримує автентифікацію за допомогою інтегрованої системи електронної ідентифікації (ІСЕІ) `*id.gov.ua*`. Вбудований віджет дозволяє нашим користувачам автентифікуватися безпечно та зручно. + +image:user:cp-auth-idgovua-1.png[] + +Віднині автентифікація через зовнішнього провайдера можлива як [.underline]#для отримувачів послуг#, так і [.underline]#для посадових осіб (надавачів послуг)# реєстру. + +image:user:user-auth/user-auth-idgovua-4-02.png[] + +Звертаємо вашу увагу на те, що ІСЕІ `id.gov.ua` має атестат відповідності комплексної системи захисту інформації (КСЗІ), що гарантує надійний захист персональних даних наших користувачів. + +[TIP] +==== +Детальніше про функціональність ви можете переглянути на сторінці: + +* xref:user:citizen-officer-portal-auth.adoc#auth-id-gov-ua[Автентифікація з ID.GOV.UA]. +==== + +//// + +== Розробка бізнес-процесів у візуальному редакторі скриптів + +Ми раді повідомити, що в нашому останньому оновленні з'явилась цікава функція для розробників регламенту. Тепер в нашій інноваційній платформі є вбудований візуальний редактор коду, який надає можливість легко редагувати https://uk.wikipedia.org/wiki/Groovy[*Groovy*]-скрипти. + +image:registry-develop:registry-admin/admin-portal/process-models/edit-groovy-scripts/edit-groovy-scripts-1-2.png[] + +Завдяки імплементації рішення https://microsoft.github.io/monaco-editor/[Monaco Editor], ви можете зручно створювати та змінювати код, насолоджуючись простим та зручним дизайном у стилі *Visual Studio Dark*. + +image:registry-develop:registry-admin/admin-portal/process-models/edit-groovy-scripts/edit-groovy-scripts-3.png[] + +Не витрачайте час на нудне кодування та ефективніше працюйте з нашим оновленням. Оновіться зараз та переконайтеся у всіх перевагах нової версії! + +image:registry-develop:registry-admin/admin-portal/process-models/edit-groovy-scripts/edit-groovy-scripts-6.png[] + +Підтримуються наступні функції при роботі з редактором: :: + +* [*] Автодоповнення +* [*] Автодоповнення для кастомних функцій +* [*] Синтаксичний аналіз коду та перевірка помилок +* [*] Підтримка коментарів +* [*] Згортання та розгортання блоку з кодом + +[TIP] +==== +Детальніше про функціональність ви можете переглянути на сторінці: + +* xref:registry-develop:registry-admin/admin-portal/registry-modeling/process-models/components/edit-groovy-scripts.adoc[]. +==== + +== Завантаження цифрових документів за віддаленою адресою + +У нашому останньому релізі ми представляємо можливість завантажувати цифрові документи із зовнішніх систем та зберігати їх до реєстру для подальшого використання у бізнес-процесах. Тепер ви можете отримувати цифрові документи за зовнішнім посиланням до публічних API. + +.Налаштування взаємодії із зовнішнім відкритим API +image::registry-develop:registry-admin/external-integration/cp-integrate-ext-system/cp-ext-sys-3.png[] + +Для отримання цифрових файлів за віддаленою адресою розроблена JUEL-функція *`save_digital_document_from_url()`*. + +.Використання функції save_digital_document_from_url() у скрипті бізнес-процесу +image::registry-develop:bp-modeling/bp/save-digital-doc-remote-url/dig-doc-remote-url-2.png[] + +Завдяки розробленій функції, моделювання бізнес-процесів стало набагато зручнішим та швидшим, що дозволяє замінити створення складних та специфічних скриптів використанням уніфікованого рішення, зекономити час, а також значно зменшити кількість помилок та неполадок, що можуть виникнути під час розробки та виконання скриптів. + +[TIP] +==== +Детальніше про функціональність ви можете переглянути на сторінці: + +* xref:registry-develop:bp-modeling/bp/save-digital-doc-remote-url.adoc[] +==== + +== Таблиці моделі даних реєстру та їх структури + +Тепер ви можете працювати з моделлю даних реєстру в режимі читання у версіях-кандидатах. Під час роботи з даними реєстру для кожної версії-кандидата створюється тимчасова репліка з еталонної бази даних (PostgreSQL). + +Функціональність дозволяє: :: ++ +* Переглядати поточний стан моделі даних регламенту реєстру (перелік таблиць), що розробляється в рамках версії-кандидата. ++ +image:registry-develop:registry-admin/admin-portal/tables-data-structures/tables-data-structures-5.png[] + +* Досліджувати "суб'єктність" у переліку таблиць. ++ +image:registry-develop:registry-admin/admin-portal/tables-data-structures/tables-data-structures-6.png[] + +* Отримувати результат перевірки можливості успішного розгортання моделі даних. ++ +image:registry-develop:registry-admin/admin-portal/tables-data-structures/tables-data-structures-8.png[] + +* Видаляти тимчасові бази даних для версій-кандидатів за допомогою окремого процесу реконсиляції. ++ +image:registry-develop:registry-admin/admin-portal/tables-data-structures/tables-data-structures-11.png[] + +[TIP] +==== +Детальніше про функціональність ви можете переглянути на сторінці: + +* xref:registry-develop:registry-admin/admin-portal/registry-modeling/tables/tables-data-structures.adoc#data-model-version-candidate[Особливості роботи з таблицями в рамках версій-кандидатів] +==== + +== Моделювання спливних вікон для підтвердження дії у компоненті Button + +Адміністратори можуть налаштувати спливні вікна для форм введення даних у Кабінетах посадових осіб та отримувачів послуг. Це можна зробити у розділі моделювання UI-форм Кабінету адміністратора регламентів за допомогою компонента `*Button*` («Кнопка») та параметра `*Pop-up should display*`. + +.Моделювання компонента Button +image::registry-develop:bp-modeling/forms/components/button/popup/button-popup-2.png[] + +.Попередній перегляд спливного вікна на UI-формі +image::registry-develop:bp-modeling/forms/components/button/popup/button-popup-4.png[] + +Спливні вікна можуть бути особливо корисними, адже дозволяють користувачам уникати непередбачуваних результатів, надавати додаткову інформацію та покращити безпеку взаємодії зі сторінкою тощо. + +[TIP] +==== +Детальніше про функціональність ви можете переглянути на сторінці: + +* xref:registry-develop:bp-modeling/forms/components/button/button-popup.adoc[] +==== + +== Налаштування автентифікації надавачів послуг + +Відтепер адміністратори реєстру можуть легко налаштувати тип автентифікації для Кабінету посадової особи в інтерфейсі Control Plane. Наша платформа надає можливість використовувати [.underline]#власний IIT-віджет# для автентифікації за допомогою КЕП, або налаштувати інтеграцію із [.underline]#зовнішнім провайдером# `*id.gov.ua*`. + +При вході до Кабінету, посадові особи реєстру зможуть використовувати лише один тип автентифікації: [.underline]#або КЕП#, [.underline]#або `id.gov.ua`#. Оновлення стануть у пригоді всім, хто шукає простий та швидкий спосіб доступу до важливої інформації та функціональності Кабінетів. + +.Налаштування автентифікації через IIT-віджет +image::registry-develop:registry-admin/cp-auth-setup-officers/cp-id-gov-ua-iit-setup-1.png[] + +.Налаштування автентифікації через id.gov.ua +image::registry-develop:registry-admin/cp-auth-setup-officers/cp-id-gov-ua-iit-setup-2.png[] + +Використовуйте нові можливості нашої платформи вже сьогодні! + +[TIP] +==== +Детальніше про функціональність ви можете переглянути на сторінках: + +* xref:registry-develop:registry-admin/cp-auth-setup/cp-auth-setup-officers.adoc[] +* xref:user:citizen-officer-portal-auth.adoc[] +==== + +== Керування розкладом та часом зберігання резервних копій реєстру + +У новому релізі додана можливість керувати розкладом створення резервних копій та зберігання їх у сховищі бекапів. Це дозволяє автоматизувати процес бекапування компонентів реєстру, забезпечити актуальність бекапів та можливість відновлення даних у разі потреби. + +image:admin:backup-restore/backup-schedule-registry-components/backup-schedule-registry-components-01.png[] + +Резервні копії створюються за допомогою інструменту *`velero`* та зберігаються у захищеному сховищі бекапів *`minio`*, що знаходиться поза межами кластера Платформи. + +image:admin:backup-restore/backup-schedule-registry-components/backup-schedule-registry-components-02.png[] + +Налаштувати розклад бекапування можна у форматі https://uk.wikipedia.org/wiki/Cron[*unix-cron*] на інтерфейсі адміністративної панелі Control Plane. Обирайте зручний час для автоматичного запуску процесу створення резервних копій та задати термін зберігання бекапів у днях. + +[TIP] +==== +Детальніше про функціональність ви можете переглянути на сторінці: + +* xref:admin:backup-restore/backup-schedule-registry-components.adoc[] +==== + +== Оновлення ключів та сертифікатів цифрового підпису для Платформи + +У новому релізі була додана можливість оновлення ключів та сертифікатів цифрового підпису рівня Платформи безпосередньо з адміністративної панелі Control Plane. + +Тепер адміністратор платформи може з легкістю оновлювати дані про файлові та апаратні ключі в розділі _Керування Платформою_ під час редагування конфігурації компонента `*cluster-mgmt*`. Це робить процес керування ключами більш зручним та простим для користувачів. + +.Оновлення даних про файловий ключ +image::admin:infrastructure/cluster-mgmt/change-key/change-key-20.png[] + +.Оновлення даних про апаратний ключ +image::admin:infrastructure/cluster-mgmt/change-key/change-key-37.png[] + +[TIP] +==== +Детальніше про функціональність ви можете переглянути на сторінках: + +* xref:admin:registry-management/system-keys/system-keys-overview.adoc[] +* xref:admin:registry-management/system-keys/control-plane-platform-keys.adoc[] +==== + +== Управління зовнішніми інтеграціями + +У новому релізі ми провели міграцію налаштувань, а також змінили принципи інтеграційної взаємодії з іншими системами. + +Основні принципи інтеграції з іншими реєстрами та системами стали більш централізованими та консистентними: :: +* Регламент реєстру тепер містить налаштування, які не залежать від "оточення"/екземпляра реєстру, що забезпечує однаковість налаштувань для всіх екземплярів. +* Конфіденційні дані не містяться в регламенті реєстру ні в якій формі, що запобігає їх неправомірному використанню. + +Адміністративна панель Control Plane була розширена, тепер разом з реєстром за замовчуванням розгортаються 3 точки для сервісів ШБО "Трембіта" й одна для зовнішньої системи "Дія". Це полегшує та прискорює підключення до інших реєстрів -- адміністратору достатньо внести свої значення в готові поля. + +.Налаштування взаємодії з реєстром ЄДР через "Трембіту" +image::registry-develop:registry-admin/external-integration/cp-integrate-trembita/cp-integrate-trembita-6.png[] + +Також додано підтримку нових методів автентифікації для взаємодії із зовнішніми системами: :: + +* `NO_AUTH` +* `AUTH_TOKEN` +* `BEARER` +* `BASIC` +* `AUTH_TOKEN+BEARER` + +.Налаштування взаємодії із зовнішньою відкритою системою +image::registry-develop:registry-admin/external-integration/cp-integrate-ext-system/cp-ext-sys-3.png[] + +.Налаштування взаємодії із зовнішньою системою за методом двоетапної авторизації +image::registry-develop:registry-admin/external-integration/cp-integrate-ext-system/cp-ext-sys-9.png[] + +[TIP] +==== +Детальніше про оновлення ви можете переглянути на сторінках: :: + +* xref:registry-develop:registry-admin/external-integration/ext-integration-overview.adoc[] +* xref:registry-develop:registry-admin/external-integration/cp-integrate-trembita.adoc[] +* xref:registry-develop:registry-admin/external-integration/cp-integrate-ext-system.adoc[] +* xref:registry-develop:registry-admin/external-integration/rest-api-no-trembita.adoc[] +==== + +//// \ No newline at end of file diff --git a/docs/ua/modules/release-notes/pages/whats-new/part-4/wn-4.adoc b/docs/ua/modules/release-notes/pages/whats-new/part-4/wn-4.adoc new file mode 100644 index 0000000000..6152ade2cf --- /dev/null +++ b/docs/ua/modules/release-notes/pages/whats-new/part-4/wn-4.adoc @@ -0,0 +1,415 @@ +:toc-title: ЗМІСТ +:toc: auto +:toclevels: 1 +:experimental: +:sectanchors: +:sectlinks: +:important-caption: ВАЖЛИВО +:note-caption: ПРИМІТКА +:tip-caption: ПІДКАЗКА +:warning-caption: ПОПЕРЕДЖЕННЯ +:caution-caption: УВАГА +:example-caption: Приклад +:figure-caption: Зображення +:table-caption: Таблиця +:appendix-caption: Додаток + += Що нового у релізі 1.9.7. Частина 4 + +== Налаштування автентифікації отримувачів послуг (перевірка в ЄДР при логіні юридичних осіб) + +Ми раді представити нові налаштування адміністративної панелі Control Plane для отримувачів послуг, які забезпечують більш гнучкий та зручний процес автентифікації. + +image:wn-1-9-4/whats-new-1-9-4-1.png[] + +Ось ключові аспекти цієї функціональності: :: + +* [.underline]#Налаштування в адміністративній панелі Control Plane#: конфігурація перевірки в ЄДР при логіні юридичних осіб до Кабінету отримувача послуг. +* [.underline]#Перевірка активного запису в ЄДР#: для бізнес-користувачів перевіряється наявність активного запису в ЄДР. +* [.underline]#Активація/деактивація перевірки#: перевірку можна активувати або деактивувати перемикачем у налаштуваннях. +* [.underline]#Налаштування для технічного адміністратора реєстру#: можливість налаштування перевірки в ЄДР для користувачів, що обрали вхід "Для бізнесу" на сторінці автентифікації. +* [.underline]#Підтримка різних видів отримувачів послуг#: забезпечено можливість автентифікації для отримувачів послуг-ФОП, представників ФОП або ЮО, обираючи режим "Для бізнесу" та використовуючи КЕП без відповіді ЄДР. + +Цей реліз поліпшує безпеку та зручність автентифікації для отримувачів послуг, дозволяючи технічному адміністратору реєстру налаштовувати перевірку в ЄДР та забезпечувати автентифікацію для різних типів користувачів. + +[TIP] +==== +Детальніше ви можете ознайомитися з функціональністю на сторінці xref:registry-develop:registry-admin/cp-auth-setup/cp-auth-setup-citizens.adoc[]. +==== + +== Інструкція з розгортання Платформи у публічному хмарному середовищі AWS + +У цьому релізі ми розробили детальне покрокове керівництво для адміністратора Платформи щодо розгортання системи у цільовому публічному хмарному оточенні AWS. + +[TIP] +==== +Детальніше ви можете дізнатися на сторінці xref:admin:installation/platform-deployment/platform-aws-deployment.adoc[]. +==== + +== Впровадження загального SOAP-конектора для взаємодії з "Трембіта" + +Ми розробили новий загальний Trembita SOAP-конектор, який може бути використаний для інтеграції з будь-яким SOAP-сервісом, зареєстрованим у СЕВ ДЕІР "Трембіта". + +Ось ключові особливості та переваги цього конектора: :: + +* Інтеграційне розширення-делегат `*${trembitaSoapConnectorDelegate}*`. Цей делегат призначений для виклику зовнішнього SOAP-сервісу через ШБО "Трембіта", що забезпечує максимальну сумісність з різними SOAP-сервісами. +* Налаштування за допомогою шаблону Trembita SOAP connector (_trembitaSoapConnectorDelegate.json_). Шаблон дозволяє легко налаштовувати конектор у бізнес-процесі, що спрощує інтеграцію та підтримку сервісів. + +image:registry-develop:bp-modeling/ext-integration/connectors/trembita-connector/trembita-connector-1.png[] + +[TIP] +==== +Детальніше ви можете ознайомитися з функціональністю на сторінці xref:registry-develop:bp-modeling/external-integration/api-call/connectors-external-registry.adoc#trembita-connector[Загальний Trembita SOAP-конектор]. +==== + +//// + +== Швидкі посилання до сервісів + +Ми раді представити нову функціональність адміністративної панелі Control Plane, яка надає адміністраторам реєстру зручний спосіб доступу до всіх необхідних вебсервісів в одному місці. Ось основні аспекти цієї функціональності: + +* [.underline]#Розділ +++ Швидкі посилання +++#: зібрані посилання на вебінтерфейси різних сервісів з коротким описом їх призначення, що полегшує навігацію та пошук потрібного застосунку. +* [.underline]#Чотири групи сервісів#: _Адміністративна зона реєстру_, _Операційна зона реєстру_, _Адміністративна зона Платформи_ та _Операційна зона Платформи_, що допомагає зорієнтуватися в сервісах та забезпечує структурований доступ до них. +* [.underline]#Впорядковані посилання відповідно до частоти використання#: групи розташовані у порядку від найчастіше використовуваних до найменш використовуваних, а посилання всередині груп також впорядковані за частотою використання від більшого до меншого, що сприяє зручності роботи адміністраторів. + +image:admin:registry-management/quick-links/quick-links-1.png[] + +Цей реліз значно полегшує доступ до вебсервісів для адміністраторів реєстру, забезпечуючи зручний та структурований доступ до всіх необхідних додатків в одному місці. + +[TIP] +==== +Детальніше ви можете ознайомитися з функціональністю на сторінці xref:admin:registry-management/control-plane-quick-links.adoc[]. +==== + +== Налаштування власного DNS-імені для Keycloak + +Адміністратори платформи мають змогу налаштовувати власні DNS-імена для сервісу управління користувачами та ролями Keycloak за допомогою адміністративної панелі Control Plane. Це дозволяє створити зручні URL-адреси для входу користувачів та забезпечує правильну роботу аутентифікації та міжсервісної взаємодії у приватних мережах. + +Переваги використання функціональності: :: + +* [.underline]#Власні DNS-імена#: надає можливість створювати зручні та легко запам'ятовувані URL-адреси для входу користувачів у їхні особисті кабінети. +* [.underline]#Коректна робота у приватних мережах#: працює у приватних мережах, забезпечуючи правильну перевірку сертифікатів та аутентифікацію за допомогою Keycloak для міжсервісної взаємодії. + +Завдяки цьому адміністратори можуть легко та ефективно керувати налаштуваннями Keycloak, що сприяє полегшенню роботи користувачів із системою. + +Тепер є можливість налаштовувати власні DNS-імена централізовано, на рівні Платформи, для подальшого застосування у ваших реєстрах. + +.Додавання DNS для Keycloak на рівні керування Платформою +image::admin:registry-management/custom-dns/keycloak/custom-dns-keycloak-platform-1.png[] + +.Налаштування DNS та завантаження SSL-сертифіката +image::admin:registry-management/custom-dns/keycloak/custom-dns-keycloak-platform-2.png[] + +.Додавання DNS для Keycloak на рівні керування реєстрами +image::admin:registry-management/custom-dns/keycloak/custom-dns-keycloak-registry.png[] + +[TIP] +==== +Детальніше ви можете ознайомитися з функціональністю на сторінці xref:admin:registry-management/custom-dns/cp-custom-dns-keycloak.adoc[]. +==== + +== Автореєстрація для посадових осіб + +В цьому релізі ми додали нові можливості для самостійної реєстрації посадових осіб та моделювання процесу: + +* [.underline]#Налаштування автореєстрації#: увімкнути/вимкнути функцію автореєстрації можна за допомогою перемикача в адмін-консолі *Control Plane*, у розділі +++ Автентифікація надавачів послуг +++. ++ +image:registry-develop:registry-admin/cp-auth-setup-officers/self-registration/cp-officer-self-register-ua-1.png[] + +* [.underline]#Моделювання бізнес-процесу#: додано можливість моделювати проходження самореєстрації посадовими особами з ручним або автоматичним модеруванням. + +* [.underline]#Розширення бізнес-логіки за допомогою нового делегата#: розробникам регламенту надано окреме типове розширення *Save user roles* для внесення змін до переліку регламентних ролей користувача. + +* [.underline]#Референтні приклади#: розроблено референтні приклади бізнес-процесів автореєстрації посадової особи з автоматичною та ручною модерацією для моделювальників реєстру. + +* [.underline]#Проходження самореєстрації у Кабінетах#: посадові особи можуть після автентифікації у Кабінеті розпочати процес самореєстрації, якщо він попередньо змодельований у реєстрі та увімкнена автореєстрація для цього реєстру. ++ +image:wn-1-9-4/whats-new-1-9-4-11.png[] ++ +image:wn-1-9-4/whats-new-1-9-4-12.png[] ++ +image:wn-1-9-4/whats-new-1-9-4-13.png[] + +Ці оновлення спрощують процес самореєстрації для посадових осіб та надають більше можливостей для контролю й адміністрування цього процесу. + +[TIP] +==== +Детальніше ви можете ознайомитися з функціональністю на сторінці xref:registry-develop:registry-admin/cp-auth-setup/cp-officer-self-registration.adoc[]. + +Ознайомтеся також із референтними прикладами бізнес-процесів самостійної реєстрації надавачів послуг у системі: + +* xref:registry-develop:best-practices/bp-officer-self-register-auto.adoc[] +* xref:registry-develop:best-practices/bp-officer-self-register-manual.adoc[] +==== + +== Внесення змін до файлу описів структур таблиць моделі даних реєстру через вебредактор коду + +Адміністративний портал пропонує вбудований XML-редактор, який спеціалізується на роботі зі структурою таблиць у файлі *_data-model/createTables.xml_* і спрощує роботу з моделлю даних у регламенті реєстру. Імплементовано рішення https://microsoft.github.io/monaco-editor/[Monaco Editor], візуалізоване темою *Visual Studio Dark*. Це дозволяє швидко та зручно вносити зміни через єдиний інтерфейс і зменшує кількість помилок, забезпечуючи більш продуктивний процес роботи з моделлю даних. + +image:registry-develop:registry-admin/admin-portal/tables-data-structures/xml-editor/xml-editor-1.png[] + +Однією з переваг цього редактора є _синтаксичний аналіз коду_ -- можливість отримувати сповіщення про синтаксичні помилки, якщо такі виникли. Крім того, редактор надає підказки та дозволяє використовувати функцію автозаповнення, що спрощує процес додавання нової таблиці до моделі даних. + +image:registry-develop:registry-admin/admin-portal/tables-data-structures/xml-editor/xml-editor-6.png[] + +[TIP] +==== +Детальніше ви можете ознайомитися з функціональністю на сторінці xref:registry-develop:registry-admin/admin-portal/registry-modeling/tables/xml-editor.adoc[]. +==== + +== Категоризація доступних послуг у Кабінетах користувачів + +Щоб поліпшити досвід користувачів, реалізовано можливість категоризації послуг за допомогою груп та можливість управління порядком їх відображення. Це дозволяє більш ефективно відображати та знаходити необхідні послуги у реєстрах. + +Розробник регламенту може групувати та сортувати бізнес-процеси через вебінтерфейс адміністративного порталу. Зміни до налаштувань групування та сортування валідуються на етапі публікації регламенту реєстру та розгортаються на відповідному середовищі. + +image::registry-develop:registry-admin/admin-portal/process-models/process-groups/process-groups-1.png[] + +image::registry-develop:registry-admin/admin-portal/process-models/process-groups/process-groups-2.png[] + +Надалі користувачі Кабінетів посадової особи та отримувача послуг зможуть переглядати список бізнес-процесів із розділенням на групи та впорядкованих згідно з налаштуваннями регламенту. + +image:registry-develop:registry-admin/admin-portal/process-models/process-groups/process-groups-17.png[] + +[TIP] +==== +Детальніше ви можете ознайомитися з функціональністю на сторінці xref:registry-develop:registry-admin/admin-portal/registry-modeling/process-models/process-groups.adoc[]. +==== + +== Відображення масивів даних у вигляді таблиць на формах бізнес-процесів + +У цьому релізі ми додали нові можливості для компонента форм *EditGrid*, що полегшують роботу розробників регламенту та моделювальників: + +* [.underline]#Режим "лише для перегляду"#: користувачі можуть переглядати дані UI-форми в режимі "read only" та виконувати дії стосовно обраного запису таблиці. ++ +image:wn-1-9-4/whats-new-1-9-4-2.png[] + +* [.underline]#Налаштування набору дій (action codes)#: розробникам регламенту додано можливість налаштовувати набір дій, які можна виконати стосовно окремих записів таблиці. ++ +image:wn-1-9-4/whats-new-1-9-4-3.png[] + +* [.underline]#Відображення масивів даних#: моделювальникам реєстру надано можливість відображати масиви даних у вигляді таблиць на формах бізнес-процесів з можливістю виклику інших бізнес-процесів для певного рядка. ++ +image:wn-1-9-4/whats-new-1-9-4-4.png[] + +* [.underline]#Референтний бізнес-процес#: розроблено тестовий бізнес-процес для демонстрації функціональності вибору одного рядка в таблиці та запуску для нього бізнес-процесу. ++ +image:wn-1-9-4/whats-new-1-9-4-5.png[] + +Ці оновлення забезпечують більш гнучкі та ефективні можливості для роботи з компонентом EditGrid у різних контекстах у рамках бізнес-процесів реєстру. + +[TIP] +==== +Детальніше ви можете ознайомитися зі змінами на сторінці xref:registry-develop:best-practices/edit-grid-rows-action.adoc[]. +==== + +== Вибір декількох рядків у таблиці та запуск бізнес-процесів з обраними даними + +У цьому релізі ми додали нові можливості для роботи з таблицями та запуску бізнес-процесів для декількох обраних рядків: + +* [.underline]#Налаштування активації вибору у компоненті Edit Grid#: розробникам регламенту надано можливість налаштовувати активацію обрання декількох записів з таблиці для виконання стосовно них дій. ++ +image:wn-1-9-4/whats-new-1-9-4-6.png[] + +* [.underline]#Налаштування ширини полів#: розробникам регламенту додано можливість налаштовувати ширину полів компонентів для відображення в таблиці EditGrid. ++ +image:wn-1-9-4/whats-new-1-9-4-7.png[] + +* [.underline]#Референтний бізнес-процес#: розроблено тестовий бізнес-процес для демонстрації функціональності вибору одного або декількох рядків в таблиці та запуску для них бізнес-процесів. ++ +image:wn-1-9-4/whats-new-1-9-4-8.png[] + +* [.underline]#Ініціювання бізнес-процесів#: користувачі Кабінету посадової особи та отримувачі послуг можуть ініціювати виконання бізнес-процесів з даними відразу декількох обраних рядків з таблиці. + +* [.underline]#Вибір декількох рядків#: користувачі реєстру тепер мають можливість обирати декілька рядків в таблиці під час виконання бізнес-процесу. ++ +image:wn-1-9-4/whats-new-1-9-4-9.png[] + +* [.underline]#Оптимізація рендерингу#: оптимізовано рендеринг таблиці для забезпечення кращої продуктивності. + +Ці оновлення забезпечують більш гнучкі та ефективні можливості для роботи з таблицями бази даних реєстру в рамках бізнес-процесів. + +[TIP] +==== +Детальніше ви можете ознайомитися зі змінами на сторінці xref:registry-develop:best-practices/edit-grid-rows-action.adoc[]. +==== + +== Видалення попередньої версії автогенерованого коду при розгортанні регламенту + +У цьому релізі ми впровадили наступні поліпшення, які спрощують процес розгортання регламенту та роботу з версіями: + +* [.underline]#Автоматична заміна коду#: тепер при розгортанні регламенту, попередня версія автогенерованого коду автоматично замінюється новою у Gerrit реєстру в репозиторії для технічного адміністратора реєстру. + +* [.underline]#Відмова від необхідності змінювати версію регламенту#: розробники та моделювальники регламенту більше не зобов'язані змінювати версію регламенту в структурі регламенту після кожної зміни. + +* [.underline]#Відсутність перевірки версії при розгортанні#: адміністратор регламенту може використовувати атрибут `settings.general.version` у налаштуваннях на власний розсуд. +* [.underline]#Відмова від зберігання старих версій API даних#: при розгортанні пайплайну публікацій `MASTER-Build-registry-regulations`, старі версії API даних не зберігаються, що спрощує процес управління кодом. + +Ці зміни полегшують процес розгортання регламентів та роботу з версіями, дозволяючи командам зосередитись на розробці та впровадженні нових функціональних можливостей. + +[TIP] +==== +Детальніше ви можете ознайомитися зі змінами на сторінці xref:registry-develop:registry-admin/regulation-settings.adoc[]. +==== + +== Зміна логіки роботи Cleanup-процесу видалення регламенту + +В цьому релізі ми додали нову змінили логіку роботи та розширили можливості Cleanup-процесу (*`cleanup-job`*) у Jenkins для підтримки оптимального стану регламенту реєстру. + +image:registry-develop:registry-admin/regulations-deploy/cleanup-job/cleanup-job-2.png[] + +Цей автоматизований процес включає такі функції: :: + +* [.underline]#Очищення тимчасових реплік БД#: Cleanup-процес видаляє тимчасові репліки бази даних, які розгортаються для версій-кандидатів. +* [.underline]#Видалення ресурсів та сервісів#: Cleanup-процес допомагає видалити застарілі або непотрібні ресурси та сервіси. +* [.underline]#Очищення репозиторію Nexus#: Cleanup-процес очищує репозиторій Nexus від старих артефактів та забезпечує оптимальне зберігання. +* Додано можливість виконати Cleanup реєстру зі збереженням поточного регламенту, регулюючи процес вхідним параметром *`DELETE_REGISTRY_REGULATIONS_GERRIT_REPOSITORY`*. + ++ +image:registry-develop:registry-admin/regulations-deploy/cleanup-job/cleanup-job-3.png[] + +Ці оновлення допомагають адміністраторам підтримувати оптимальний стан регламенту реєстру та ефективно керувати ресурсами. + +[TIP] +==== +Детальніше ви можете ознайомитися зі змінами на сторінці xref:registry-develop:registry-admin/regulations-deploy/cleanup-job.adoc[]. +==== + +== Пагінація пошукових запитів + +Пропонуємо ознайомитися із новим типом пагінації пошукових запитів (атрибут *`pagination`*), розробленим для поліпшення досвіду користувачів та спрощення розробки зовнішніх систем. Завдяки цьому оновленню, користувачі тепер зможуть легко отримувати загальну кількість елементів по заданому критерію пошуку (Search Condition), а також додаткову інформацію про поточну сторінку, кількість елементів на сторінці та загальну кількість сторінок. + +Атрибути нової пагінації: :: + +* *`page`* -- повертає інформацію про поточну сторінку, кількість елементів на сторінці, загальну кількість елементів та загальну кількість сторінок. + +* *`none`* -- атрибут дозволяє вимкнути пагінацію при пошукових запитах до API. + +* *`offset`* (за замовчуванням) -- повертає певну кількість записів, враховуючи пагінацію на основі зміщення. При запиті до API кількість записів регулюється параметром *`limit`*. + +Основні переваги нової пагінації: :: + +* [.underline]#Зручність у розробці#: розробники більше не будуть змушені перебирати всі сторінки ресурсу до пустої відповіді, що дозволить зекономити час та зусилля при створенні та підтримці реєстрів. +* [.underline]#Збільшена інформативність#: завдяки додатковій інформації про поточну сторінку, кількість елементів на сторінці, загальну кількість елементів та загальну кількість сторінок користувачі, зможуть краще орієнтуватися у результатах пошуку. +* [.underline]#Зручний інтерфейс для кінцевого користувача#: оновлений тип пагінації дозволить створювати більш інтуїтивно зрозумілі та зручні інтерфейси для кінцевих користувачів, що підвищить їх задоволеність від використання сервісу. + +[TIP] +==== +Детальніше ви можете ознайомитися з функціональністю на сторінці xref:registry-develop:data-modeling/data/physical-model/liquibase-ddm-ext.adoc#pagination-attribute-values[Атрибут pagination та доступні значення]. +==== + +== Зміна налаштувань поведінки API на рівні структури створення таблиць + +У цьому релізі розробникам регламенту пропонується можливість змінювати налаштування поведінки API на рівні структури створення таблиць. Ось основні зміни та їхні переваги: + +* Імплементація тегу *`ext:alterTableApi`*. Цей нестандартний тег розширення Liquibase дозволяє змінювати деякі атрибути таблиці, які не впливають на структуру даних, але впливають на генерацію коду API. + +* Зміна атрибутів *`bulkLoad`* та *`readMode`*. За допомогою тегу *`ext:alterTableApi`* можна змінювати атрибути, які регулюють можливість завантаження даних до таблиці з файлів або масивом (атрибут *`bulkLoad`*) та режим читання даних (синхронний або асинхронний) (атрибут *`readMode`*). + +Ці зміни забезпечують більш гнучке керування налаштуваннями API на рівні структури створення таблиць, що сприяє розробці та підтримці високоефективних та гнучких програмних рішень. + +[TIP] +==== +Детальніше ви можете ознайомитися з функціональністю на сторінці xref:registry-develop:data-modeling/data/physical-model/liquibase-ddm-ext.adoc#alter-table-api[Зміна налаштувань поведінки API на рівні структури створення таблиць]. +==== + +== Запуск бізнес-процесу за розкладом + +У цьому релізі ми додали приклад бізнес-процесу, що демонструє можливості для автоматичного запуску процесів відповідно до графіка: + +* [.underline]#Референтний бізнес-процес#: створено приклад бізнес-процесу, який активується автоматично відповідно до графіка та виконує задачі за встановленою послідовністю. +* [.underline]#Використання таймерів у бізнес-процесах регламенту#: цей приклад допомагає розробникам та моделювальникам регламентів краще розуміти та ефективно використовувати таймери при розробці бі-нес-процесів у реєстрах. +* [.underline]#Опція *`Cycle`*#: дозволяє налаштувати повторювані процеси або події на основі певного інтервалу часу, що може бути встановлений на рівні стартової, проміжної або граничної події, пов'язаних з виконавцем завдань. +* [.underline]#Налаштування циклічних таймерів#: ви можете використовувати стандартний формат *ISO 8601* для інтервалів повторень або *cron*-вираз для налаштування циклічних таймерів. + +image:registry-develop:best-practices/bp-timer-launch/bp-timer-launch-3.png[] + +Це оновлення спрощує процес розробки та впровадження автоматично ініційованих бізнес-процесів, що сприяє ефективній роботі у реєстрах. + +[TIP] +==== +Детальніше ви можете ознайомитися зі змінами на сторінці xref:registry-develop:best-practices/bp-timer-launch.adoc[]. +==== + +== Реструктурування компонентів моделювання UI-форм + +У цьому релізі ми реструктурували розділ оновлених компонентів для моделювання UI-форм бізнес-процесів, перемістивши його на передній план списку. Таке поліпшення допоможе зменшити кількість помилок, що виникають при виборі неправильних компонентів з інших груп, що призводить до невірної конфігурації форм. + +image:registry-develop:bp-modeling/forms/components/components-panel.png[] + +TIP: Детальніше про компоненти форм читайте на сторінці xref:registry-develop:bp-modeling/forms/components/index.adoc[]. + +== Моніторинг показників виконання бізнес-процесів + +Ми додали можливість моніторингу загальних метрик виконання бізнес-процесів для технічного адміністратора реєстру через вебінтерфейс *Grafana*. Ця функція спрощує діагностику та аналіз поведінки системи, що дозволяє своєчасно виконувати дії з корегування. + +Основні особливості моніторингу включають: :: + +* [.underline]#Доступ до окремого дашборду *Camunda Metrics*#: технічному адміністратору реєстру надається доступ до дашборду у Grafana з визначеним набором метрик "Camunda Metrics". +* [.underline]#Вибір проєкту реєстру#: якщо адміністратор має доступ до декількох реєстрів, він може вказати проєкт (namespace) реєстру, для якого хоче переглянути метрики. +* [.underline]#Автоматичне встановлення дашборду#: при оновленні наявних реєстрів дашборд Grafana встановлюється автоматично. + ++ +image:wn-1-9-4/whats-new-1-9-4-14.png[] + +Метрики Camunda Metrics поділяються на такі групи: :: + +* [.underline]#Загальні метрики Process Engine#: містять інформацію про загальний стан Process Engine. +* [.underline]#Загальні метрики бізнес-процесів#: відображають статистику по запуску, виконанню та завершенню бізнес-процесів. +* [.underline]#Загальні метрики обміну повідомленнями в рамках бізнес-процесу#: ці метрики показують інформацію про роботу з повідомленнями в межах бізнес-процесів, включаючи активні підписки на події та обробку повідомлень. +* [.underline]#Загальні метрики асинхронного виконання задач бізнес-процесу#: надають статистику з асинхронного виконання задач, таких як кількість активних, відкладених та завершених задач. +* [.underline]#Видалення історичних даних виконання бізнес-процесів#: містить метрики, пов'язані з видаленням історичних даних про виконання бізнес-процесів для оптимізації ресурсів системи. + +Завдяки новим можливостям, технічні адміністратори реєстру тепер можуть легко стежити за загальними метриками виконання бізнес-процесів та використовувати цю інформацію для своєчасного виявлення проблем або покращення продуктивності системи. + +[TIP] +==== +Детальніше ви можете ознайомитися зі змінами на сторінці xref:registry-develop:registry-admin/grafana-monitoring/grafana-camunda-metrics.adoc[]. +==== + +== Оптимізація процесу збирання логів у Kibana + +У цьому релізі ми оптимізували процес збирання логів для спрощення їх аналізу у виробничих середовищах. Впроваджено новий Kibana-дашборд, який надає оглядову інформацію про роботу реєстру, зокрема статуси виконання зовнішніх запитів. Він включає декілька візуалізацій: + ++++ Запити до +++ API Gateway: :: + +Показує загальну кількість зовнішніх HTTP-запитів, які надійшли до реєстру. + ++++Помилки у +++ Rest API +++ фабрики даних +++: :: +Показує кількість помилок, що виникли в процесі обробки запитів до Rest API фабрики даних. + ++++Використання КЕП у реєстрі +++: :: +Показує загальну кількість операцій, виконаних на криптосервісі, з розподілом за типом та статусом виконання. + ++++ Запити до мікросервісів реєстрів +++: :: +Відображає загальну кількість запитів до мікросервісів реєстрів з розподілом за HTTP-кодом відповіді. + +.Запити до API Gateway, помилки в Rest API фабрики даних та використання КЕП у реєстрі +image::registry-develop:registry-admin/kibana/dashboard-1.png[] + +.Запити до мікросервісів реєстрів +image::registry-develop:registry-admin/kibana/dashboard-2.png[] + + +[TIP] +==== +* Детальніше ви можете ознайомитися зі змінами на сторінці xref:registry-develop:registry-admin/openshift-logging/kibana-request-dashboard.adoc[]. + +* Загальну інформацію по роботі з Kibana ви можете переглянути у розділі xref:registry-develop:registry-admin/openshift-logging/openshift-logging-overview.adoc[]. +==== + +== Функціональність Кабінетів надавача та отримувача послуг + +У Кабінетах посадової особи та отримувача послуг було додано нову функціональність, що запобігає втраті введених даних без їх збереження. Тепер, якщо користувач натискає кнопки, які не мають навігаційної функції, або переходить за посиланням на сторінці редагування форми, в разі наявності незбережених даних, з’являється спеціальне системне попередження у вигляді вікна (поп-ап), яке запитує користувача про підтвердження дії. + +Повідомлення, що з’являється у вікні поп-апу, містить запит на підтвердження дій, щоб користувач міг підтвердити або скасувати внесену на формі інформацію. Це нововведення дозволяє користувачам зберігати свої дані та уникати їх втрати. + +.Системне попереджувальне вікно для підтвердження дій щодо збереження або скасування внесених на формі даних +image::user:alerting-popups/alerting-popups-2.png[] + +[TIP] +==== +Детальніше ви можете ознайомитися зі змінами на сторінці xref:user:alerting-popups.adoc[]. +==== + +//// \ No newline at end of file diff --git a/docs/ua/modules/release-notes/pages/whats-new/part-5/wn-5.adoc b/docs/ua/modules/release-notes/pages/whats-new/part-5/wn-5.adoc new file mode 100644 index 0000000000..f5b8b029e8 --- /dev/null +++ b/docs/ua/modules/release-notes/pages/whats-new/part-5/wn-5.adoc @@ -0,0 +1,364 @@ +:toc-title: ЗМІСТ +//:toc: auto +:toclevels: 1 +:experimental: +:sectanchors: +:sectlinks: +:important-caption: ВАЖЛИВО +:note-caption: ПРИМІТКА +:tip-caption: ПІДКАЗКА +:warning-caption: ПОПЕРЕДЖЕННЯ +:caution-caption: УВАГА +:example-caption: Приклад +:figure-caption: Зображення +:table-caption: Таблиця +:appendix-caption: Додаток + += Що нового у релізі 1.9.7. Частина 5 + +== Обмеження доступу на рівні IP до SOAP-інтерфейсів ШБО "Трембіта" + +Платформа тепер дозволяє вам керувати доступом до SOAP API-інтерфейсів реєстру через адміністративну панель Control Plane. Це означає, що ви можете легко обмежувати та регулювати доступ зовнішніх систем до вашого реєстру. + +image:admin:registry-management/cp-soap-api-access/cp-soap-api-access-trembita-3.png[] + +Що таке SOAP-інтерфейси? :: + +SOAP-інтерфейси використовуються для взаємодії з зовнішніми системами через Шлюз Безпечного Обміну (ШБО) "Трембіта". Завдяки цьому зовнішні системи можуть отримувати дані з вашого реєстру. + +Інфраструктурні Роути :: + +На рівні інфраструктури Платформи SOAP-інтерфейси відображаються як роути (routes), кожен з яких є API-сервісом, розгорнутим на певному хості (host) зі своїм унікальним шляхом (`path`). +Основні роути для SOAP API: + +* bp-webservice-gateway-trembita: Цей API-шлюз направляє трафік до сервісу bp-webservice-gateway, який імплементує точки взаємодії для роботи з бізнес-процесами. + +* registry-soap-api: Цей API-шлюз направляє трафік до сервісу registry-soap-api, який надає точки взаємодії для читання даних з реєстру. + +Безпека і контроль :: + +Для забезпечення безпеки й контролю над використанням SOAP API-інтерфейсів, адміністративна панель *Control Plane* дозволяє обмежувати доступ лише для конкретного переліку IP-адрес. Технічний адміністратор реєстру має забезпечити відповідність IP-адрес і правильність їх налаштувань. ++ +Якщо жодна IP-адреса не вказана у списку ipList, доступ до SOAP API блокується. + +Це оновлення полегшує керування інтеграцією вашого реєстру із зовнішніми системами та забезпечує високий рівень безпеки. + +[TIP] +==== +Детальніше про нові можливості див. на сторінці xref:admin:registry-management/control-plane-soap-api-access-trembita.adoc[]. +==== + +//// + +== Резервне копіювання реплікацій об'єктів S3 + +В останньому релізі Платформи було додано вдосконалення щодо керування розкладом резервного копіювання та реплікації ресурсів. Зокрема, було введено дворівневий захист даних, що значно підвищує надійність та доступність вашої системи. Останні нововведення є такими: + +Автоматична реплікація S3-бакетів :: + +Платформа підтримує автоматичну реплікацію даних, що зберігаються у S3-бакетах. Дані, які важливі для бізнес-процесів, зокрема тимчасові дані та історія виконання процесів, зберігаються у вигляді `ObjectBucketClaim` (`obc`) і автоматично реплікуються між бакетами. Для таких реплікацій тепер можна створити резервну копію, яка буде зберігатися заданий проміжок часу. ++ +Реплікація полягає в автоматичному копіюванні даних з одного бакета до іншого, що може бути корисним, наприклад, для створення резервних копій даних в інших географічних регіонах, що забезпечує високу доступність та надійність. + +Керування через адміністративну панель Control Plane :: + +У релізі також включено можливість налаштовувати резервне копіювання та реплікацію через адміністративну панель *Control Plane*, що робить керування цими процесами простим та зручним. + +image:admin:backup-restore/backup-schedule-registry-components/backup-schedule-registry-components-10.png[] + +[TIP] +==== +Детальніше про нові можливості див. на сторінці xref:admin:backup-restore/backup-schedule-registry-components.adoc[]. +==== + +== Впровадження нових можливостей для роботи із цифровими документами в рамках бізнес-процесів + +Було впроваджено нові можливості для роботи з цифровими документами в рамках бізнес-процесів. Тепер користувачі мають змогу автоматично завантажувати, зберігати та отримувати метадані цифрових документів через скриптові функції. Крім того, додано налаштування обмежень на розмір завантажуваних файлів, що підвищує безпеку та ефективність системи. + +Адміністративна панель *Control Plane* надає зручний інтерфейс, який дозволяє адміністраторам керувати обмеженнями на завантаження цифрових документів до реєстру користувачами та бізнес-процесами. + +image:admin:registry-management/cp-digital-docs-restrictions/cp-digital-docs-restrictions-ua-1.png[] + ++++Максимальний розмір файлу для завантаження (MB)+++: це поле дозволяє встановлювати максимальний розмір окремого файлу, який можна завантажити. + ++++Максимальний сумарний розмір групи файлів для завантаження (MB)+++: це поле дозволяє встановлювати максимальний сумарний розмір для групи файлів, які можна завантажити за один раз. + +Також ми розширили бібліотеку власних JUEL-функцій, які можна використовувати у Groovy-скриптах для спрощення моделювання сценаріїв при роботі із цифровими документами, зокрема додані такі функції: + +* `load_digital_document()` -- для завантаження цифрових документів; +* `get_digital_document_metadata()` -- для отримання метаданих цифрових документів; +* `save_digital_document()` -- для збереження цифрових документів до сховища. + +Додатково ми розробили референтний бізнес-процес по завантаженню та редагуванню цифрових документів, модель даних, а також UI-форми до нього. + +[TIP] +==== +Детальніше про нові можливості дивіться на сторінках + +* xref:admin:registry-management/control-plane-digital-documents.adoc[] +* xref:registry-develop:best-practices/bp-upload-edit-file.adoc[] +* xref:registry-develop:registry-admin/cp-deploy-consent-data.adoc[] + +==== + +== Налаштування емуляторів для зовнішніх інтеграцій + +Представляємо нову функціональність, яка значно спростить ваш процес інтеграції із зовнішніми системами -- налаштування емуляторів (моків) через https://wiremock.org/[WireMock]. + +image:wn-1-9-5/whats-new-1-9-5-2.png[] + +Основні Особливості: :: + +* [*] 🔄 Підтримка SOAP та REST: емуляції можуть бути створені для обох протоколів -- SOAP і REST, що дає більшу гнучкість при роботі з різними зовнішніми системами. + +* [*] 🔧 Керування через Control Plane: активація та керування моками здійснюється через адміністративну панель Control Plane в рамках *`-dev`*-шаблонів реєстру. + +* [*] 🛠️ WireMock - потужний інструмент для тестування: WireMock є симулятором HTTP-серверів, який дозволяє створювати моки HTTP-взаємодій. Це зручний інструмент для імітації роботи зовнішніх API та сервісів. + +* [*] 📁 Кастомізація моків через mock-integrations: ви можете задати структуру моків на рівні регламенту реєстру, використовуючи директорію mock-integrations. + +Сценарії використання: :: + +* [*] 🧪 Тестування: створюйте модульні (unit) та інтеграційні тести з використанням WireMock для емуляції зовнішніх API й сервісів. + +* [*] 💻 Розробка: якщо реальний сервіс ще не готовий або тимчасово недоступний, WireMock допоможе імітувати його поведінку, що дозволить продовжувати розробку без перерв. + +* [*] 🔍 Відтворення помилок: використовуйте WireMock для моделювання різних станів та помилок HTTP-сервісів, що допоможе в глибшому розумінні та розв'язанні проблем. + +Це оновлення призначене для поліпшення якості розробки та тестування, надаючи більше контролю та гнучкості при роботі з зовнішніми системами. + +TIP: Детальніше про функціональність ви можете переглянути на сторінці xref:registry-develop:registry-admin/external-integration/cp-mock-integrations.adoc[]. + +== Розгортання демо-реєстру із референтними прикладами + +Тепер користувачі мають можливість розгортати демо-реєстр на Платформі, який містить референтні приклади моделювання регламенту. Це дозволяє глибше ознайомитись зі структурою регламентів і навчитись використовувати їх ефективно. + +image:registry-develop:registry-admin/cp-deploy-consent-data/cp-deploy-consent-data-7.png[] + +Структура регламенту демо-реєстру аналогічна стандартній структурі регламенту, що використовується для реальних реєстрів на Платформі. + +image:registry-develop:registry-admin/cp-deploy-consent-data/cp-deploy-consent-data-6.png[] + +Регламент демо-реєстру включає референтні приклади, які позначені префіксом *`reference-`*, та приклади для тестування, позначені префіксом *`feature-`*. Це можуть бути зразки _.bpmn_-схем бізнес-процесів, _.json_-форм для внесення даних до процесів, а також _.xml_-схем для розгортання моделі даних реєстру тощо. + +Референтні приклади та зразки, що входять у склад регламенту демо-реєстру, розроблені фахівцями core-команди Платформи і регулярно оновлюються та поповнюються з кожним новим релізом. Це забезпечує можливість користувачам бути в курсі останніх тенденцій та практик у моделюванні регламентів. + +image::registry-develop:registry-admin/cp-deploy-consent-data/cp-deploy-consent-data-13.png[] + +[TIP] +==== +Детальніше про нові можливості див. на сторінці xref:registry-develop:registry-admin/cp-deploy-consent-data.adoc[] +==== + +== Можливості побудови нової ієрархічної моделі реєстру + +Платформа реєстрів тепер дозволяє створювати ієрархічну модель доступу до об'єктів даних, враховуючи рівні ієрархічної структури та ролі користувачів. Це дає змогу контролювати доступ до об'єктів на основі їх положення в ієрархії та ролі користувача. + +У новій ієрархічній моделі доступу використовується _сурогатний ключ_, який присвоюється кожному користувачу, що бере участь у виконанні завдань у рамках такої структури. + +[TIP] +==== +Про особливості побудови нової ієрархічної моделі читайте на сторінці xref:registry-develop:registry-admin/hierarchical-model.adoc[]. +==== + +=== Управління кадровиком посадовими особами + +У цьому релізі ми зробили референтний бізнес-процес для управління посадовими особами. Для цього передбачена нова регламентна роль -- кадровик. Тепер кадровики мають змогу переглядати інформацію про посадових осіб, а також виконувати дії з обраними записами у таблиці. Це поліпшує ефективність управління персоналом та спрощує процеси. + +image:wn-1-9-5/whats-new-1-9-5-3.png[] + +image:wn-1-9-5/whats-new-1-9-5-4.png[] + +[TIP] +==== +* Про особливості побудови нової ієрархічної моделі читайте на сторінці xref:registry-develop:registry-admin/hierarchical-model.adoc[]. + +* Приклади референтних бізнес-процесів ви можете переглянути у розділі xref:registry-develop:best-practices/best-practices-overview.adoc[]. + +* Як розгорнути демо-реєстр із референтними прикладами моделювання регламенту, див. на сторінці xref:registry-develop:registry-admin/cp-deploy-consent-data.adoc[]. +==== + +=== Управління керівником реєстру кадровиками та іншими посадовими особами + +Ми впровадили новий референтний бізнес-процес для ефективного управління реєстром кадровиків та інших посадових осіб керівниками реєстру. Керівники тепер можуть легко переглядати інформацію про кадровиків та посадових осіб, а також взаємодіяти з записами в таблиці через Кабінет. + +image:wn-1-9-5/whats-new-1-9-5-6.png[] + +Додатково, розробникам регламенту надано нові типові розширення для більш гнучкого керування користувачами та їх ролями: + +* [*] *Create officer user*: можливість створювати нових посадових осіб з обов'язковим заповненням службових атрибутів та додаванням додаткових атрибутів. Посадовим особам автоматично призначається системна роль. + +* [*] *Save officer user attributes*: дозволяє редагувати системні та додаткові атрибути посадових осіб безпосередньо з бізнес-процесу. + +* [*] *Get roles*: забезпечує доступ до списку ролей заданого реалма з бізнес-процесу, що спрощує управління ролями. + +* [*] *Get user roles*: дозволяє можливість відображення та отримання регламентних ролей конкретного користувача. + +Ці зміни спрямовані на оптимізацію процесів управління кадровиками та посадовими особами, та надання розробникам більших можливостей для налаштування системи. + +image:wn-1-9-5/whats-new-1-9-5-5.png[] + +[TIP] +==== +* Про особливості побудови нової ієрархічної моделі читайте на сторінці xref:registry-develop:registry-admin/hierarchical-model.adoc[]. + +* Приклади референтних бізнес-процесів ви можете переглянути у розділі xref:registry-develop:best-practices/best-practices-overview.adoc[]. + +* Як розгорнути демо-реєстр із референтними прикладами моделювання регламенту, див. на сторінці xref:registry-develop:registry-admin/cp-deploy-consent-data.adoc[]. +==== + +=== Ієрархічна модель заявників для управління повноваженнями отримувачів послуг + +У цьому релізі ми розробили можливість управляти повноваженнями отримувачів послуг на базі референтної моделі бізнес-процесу, зокрема впроваджено наступні оновлення: + +Управління повноваженнями: :: + +* [*] Створено ієрархічну модель заявників для управління повноваженнями отримувачів послуг на референтному бізнес-процесі. Це дозволяє керівникам ЮО/ФОП ефективно керувати дозволами діяти від імені їхньої організації. + +Дата-модель та повідомлення: :: + +* [*] Реалізовано дата-модель та сформовано шаблони повідомлень для бізнес-процесу. + +Моделювання форм та сценаріїв: :: + +* [*] Здійснено моделювання форм та сценаріїв бізнес-процесу, що підвищує зручність роботи користувачів. + +Скасування ліцензій та управління повноваженнями: :: + +* [*] Також, уповноваженим особам-отримувачам послуг надано можливість створювати запити на скасування ліцензій від імені ЮО/ФОП через референтний бізнес-процес. Це забезпечує більшу гнучкість та контроль над управлінням повноваженнями. + +image:wn-1-9-5/whats-new-1-9-5-7.png[] + +image:wn-1-9-5/whats-new-1-9-5-8.png[] + +[TIP] +==== +* Про особливості побудови нової ієрархічної моделі читайте на сторінці xref:registry-develop:registry-admin/hierarchical-model.adoc[]. + +* Приклади референтних бізнес-процесів ви можете переглянути у розділі xref:registry-develop:best-practices/best-practices-overview.adoc[]. + +* Як розгорнути демо-реєстр із референтними прикладами моделювання регламенту, див. на сторінці xref:registry-develop:registry-admin/cp-deploy-consent-data.adoc[]. +==== + +=== Створення елементів ієрархії у Кабінеті посадової особи + +У цьому релізі ми розробили референтний бізнес-процес для керування та перегляду ієрархічних елементів з Кабінету посадової особи. Це включає створення та редагування форм, моделі даних, та впровадження розширених критеріїв пошуку. + +image:release-notes:wn-1-9-5/whats-new-1-9-5-9.png[] + +image:release-notes:wn-1-9-5/whats-new-1-9-5-10.png[] + +image:release-notes:wn-1-9-5/whats-new-1-9-5-11.png[] + +Також додано нові функціональні можливості для роботи з атрибутами користувачів. Це зокрема включає автоматичне пропагування додаткових атрибутів в токенах. + +Додатково, розширено можливості компонента Edit Grid швидким та ефективним пошуком користувачів за атрибутами, що полегшує навігацію та роботу з даними у Кабінеті посадової особи. + +image:release-notes:wn-1-9-5/whats-new-1-9-5-12.png[] + +Ці зміни забезпечують більш гнучке та ефективне управління ієрархічною структурою та атрибутами користувачів, спрощують процеси пошуку та редагування даних. + +[TIP] +==== +* Про особливості побудови нової ієрархічної моделі читайте на сторінці xref:registry-develop:registry-admin/hierarchical-model.adoc[]. + +* Приклади референтних бізнес-процесів ви можете переглянути у розділі xref:registry-develop:best-practices/best-practices-overview.adoc[]. +* Як розгорнути демо-реєстр із референтними прикладами моделювання регламенту, див. на сторінці xref:registry-develop:registry-admin/cp-deploy-consent-data.adoc[]. +==== + +== Зв'язок зі службою підтримки при виникненні некритичних помилок у Кабінетах користувачів + +Відтепер при виникненні _некритичних помилок, тобто таких, що не впливають на рендеринг вебсторінок_, адміністраторам у +++Кабінеті адміністратора регламентів+++ надається можливість швидко та просто звернутися до служби підтримки. Удосконалений механізм сповіщення про помилки автоматично забезпечує детальний опис проблеми у спливному вікні. + +Інтегрована у цьому вікні кнопка `+++Потрібна допомога?+++` спрямовує користувача до іншого вікна з чіткими інструкціями про звернення до служби підтримки. Також тут містяться рекомендації щодо інформації, яку користувач повинен надати, щоб сприяти швидкому розв'язанню проблеми. + +image:registry-develop:registry-admin/admin-portal/error-non-critical/error-non-critical-2.png[] + +[TIP] +==== +Детальніше про нові можливості див. на сторінці xref:registry-develop:registry-admin/admin-portal/error-non-critical.adoc[]. +==== + +== Спрощення моделювання бізнес-процесів за допомогою нових JUEL-функцій + +Було впроваджено три нові JUEL-функції для розширення можливостей роботи з цифровими документами в рамках бізнес-процесів: + +* [*] *`load_digital_document()`* -- ця функція дозволяє автоматизувати процес завантаження цифрових документів, що були або надіслані користувачами, або отримані з зовнішніх систем. + +* [*] *`get_digital_document_metadata()`* -- за допомогою цієї функції можна отримувати метадані цифрових документів, що допомагає в управлінні та класифікації документів в системі. + +* [*] *`save_digital_document()`* -- ця функція дозволяє скриптувати збереження файлів, що були сформовані в ході бізнес-процесів або отримані з інших джерел, в сховище цифрових документів. + +Функції є доступними для використання у зручному редакторі коду, в Кабінетів адміністратора регламентів. + +image:release-notes:wn-1-9-5/whats-new-1-9-5-13.png[] + +image:release-notes:wn-1-9-5/whats-new-1-9-5-14.png[] + +Ці нововведення роблять більш гнучким та автоматизованим процес роботи з документами, підвищують продуктивність та ефективність бізнес-процесів. + +[TIP] +==== +Детальніше про нові можливості дивіться на сторінках: + +* xref:registry-develop:best-practices/bp-upload-edit-file.adoc[] + +* xref:registry-develop:bp-modeling/bp/modeling-facilitation/modelling-with-juel-functions.adoc[] +==== + +== Зв'язок зі службою підтримки при виникненні некритичних помилок у Кабінетах користувачів + +Відтепер при виникненні _некритичних помилок, тобто таких, що не впливають на рендеринг вебсторінок_, користувачам +++Кабінетів посадової особи+++ та +++отримувача послуг+++ надається можливість швидко та просто звернутися до служби підтримки. Удосконалений механізм сповіщення про помилки автоматично забезпечує детальний опис проблеми у спливному вікні. + +Інтегрована у цьому вікні кнопка `+++Потрібна допомога?+++` спрямовує користувача до іншого вікна з чіткими інструкціями про звернення до служби підтримки. Також тут містяться рекомендації щодо інформації, яку користувач повинен надати, щоб сприяти швидкому розв'язанню проблеми. + +image:release-notes:wn-1-9-5/whats-new-1-9-5-1.png[] + +[TIP] +==== +Детальніше про нові можливості див. на сторінці xref:registry-develop:registry-admin/admin-portal/error-non-critical.adoc[]. +==== + +=== Кешування JWT-токенів при взаємодії з іншими системами + +У цьому релізі Платформи було представлено вдосконалення механізму ефективного кешування токенів авторизації, що використовуються при взаємодії із зовнішніми системами. Ось ключові особливості цього механізму: + +Ефективне кешування токенів авторизації :: + +Платформа тепер підтримує механізм, що дозволяє зберігати токени авторизації у кеші. Це зменшує навантаження на зовнішні системи, уникаючи непотрібних запитів на аутентифікацію і, таким чином, покращує загальну продуктивність системи. + +Інтеграція через REST-конектор :: + +Кешування токенів авторизації ефективно працює з REST-конектором, який є частиною сервісу *`bpms`*. Це забезпечує швидку та надійну взаємодію із зовнішніми системами через REST API. + +Використання JWT-клейма "exp" для керування часом життя токена :: + +Час "життя" токена визначається за допомогою JWT-клейма *`exp`* (expire time), який міститься в авторизаційному токені. Це відповідає специфікації JWT, визначеній у https://www.rfc-editor.org/rfc/rfc7519[RFC 7519]. + +Автоматичне оновлення токенів :: + +Коли термін дії токена, вказаний у клеймі `exp`, спливає, Платформа автоматично відхиляє старий токен і запитує новий для подальшої взаємодії із зовнішньою системою. + +Умови кешування :: + +Якщо токен не містить клейма `exp`, кешування не виконується. Це гарантує, що тільки токени з визначеним терміном дії будуть збережені в кеші для оптимізації продуктивності. + +Ці нововведення значно покращують роботу Платформи при взаємодії із зовнішніми системами, забезпечуючи високу продуктивність та ефективність. + +== Єдиний URL для доступу до Redash та Кабінету посадової особи + +Змінено посилання до сервісів для побудови та перегляду аналітичної звітності реєстру -- *`redash-admin`* та *`redash-viewer`*. Тепер компоненти винесені за KONG API-шлюз та доступні за ендпоінтом *`/reports`*. Це забезпечує спрощення навігації та підвищує зручність користування. + +Нові посилання до сервісів виглядають наступним чином: + +.redash-admin +---- +https://admin-tools-<назва-реєстру>.dnsWildcard/reports. +---- + +.redash-viewer +---- +https://officer-portal-<назва-реєстру>.dnsWildcard/reports. +---- + +//// \ No newline at end of file diff --git a/docs/ua/modules/release-notes/pages/whats-new.adoc b/docs/ua/modules/release-notes/pages/whats-new/part-6/wn-6.adoc similarity index 89% rename from docs/ua/modules/release-notes/pages/whats-new.adoc rename to docs/ua/modules/release-notes/pages/whats-new/part-6/wn-6.adoc index 618ceb32c5..d23ca649b9 100644 --- a/docs/ua/modules/release-notes/pages/whats-new.adoc +++ b/docs/ua/modules/release-notes/pages/whats-new/part-6/wn-6.adoc @@ -14,46 +14,40 @@ :table-caption: Таблиця :appendix-caption: Додаток -= Що нового у релізі 1.9.6 += Що нового у релізі 1.9.7. Частина 6 -На цій сторінці ви знайдете інформацію про найновіші функції нашого програмного продукту. Ми демонструємо нову функціональність, яка розширює можливості Платформи та реєстрів, розгорнутих на ній, спрощуючи роботу користувачів та покращуючи їх досвід. Завдяки новим функціям ви зможете більш ефективно використовувати наше програмне забезпечення та збільшити вашу продуктивність. +== _Дія.Підпис_ для автентифікації та підпису -== Публічний доступ до даних та рейт-ліміти - -Розробка публічних інтерфейсів :: +🔐 У цьому релізі ми додали можливість для отримувачів послуг, які мають статус фізичних осіб або ФОП, використовувати метод `Дія.Підпис` для автентифікація та підпису даних. -* [*] 🌍 У цьому релізі ми розширили можливості нашого API. Тепер, окрім внутрішнього API, ви можете відкривати публічний API для доступу до даних. Користувачі, які не пройшли аутентифікацію, тепер можуть переглядати публічні дані реєстру. -* [*] 🔓 Налаштовуйте доступ до представлень та REST API реєстру для неавтентифікованих користувачів. +image:release-notes:wn-1-9-6/wn-1-9-6-9.png[] -+ -image:registry-develop:registry-admin/external-integration/api-publish/public-api/expose-public-api-1.png[] +image:release-notes:wn-1-9-6/wn-1-9-6-10.png[] -Автоматична публікація в Open API :: +TIP: Детальніше про функціональність ви можете знайти на сторінці xref:user:citizen-officer-portal-auth.adoc[]. -* [*] 📘 Тепер налаштовані вами точки доступу автоматично публікуються в `openapi`-специфікації API-сервісу. Це робить інтеграцію та документацію вашого API ще простіше. +== Хмарний ключ для автентифікації та підпису +Автентифікація за допомогою хмарного ключа :: +* [*] 🔑 У цьому релізі надано можливість для отримувача та надавача послуг автентифікуватись на користувацькому порталі за допомогою нового методу -- _хмарного ключа_. + -image:registry-develop:registry-admin/external-integration/api-publish/public-api/expose-public-api-2.png[] - -Оптимізація завантаження :: - -* [*] 🚀 Ми прагнемо забезпечити найкращий досвід для користувачів, тому впровадили TTL-based кешування для GET-запитів, коли йде мова про посилання до API-документації. Це зменшує навантаження на наш сервіс Kong API Gateway та прискорює доступ до інформації. - -Розширені можливості в адмін-консолі Control Plane :: - -* [*] 🔧 В адмін-консолі Control Plane додано новий інструмент для керування публічним доступом. Ви зможете налаштовувати, редагувати, блокувати або розблоковувати доступ до публічних даних реєстру. -* [*] 📊 Також можна легко встановлювати рейт-ліміти для API-запитів. +image:release-notes:wn-1-9-6/wn-1-9-6-6.png[] +* [*] 📱 Для полегшення процесу автентифікації, додано компонент для рендерингу QR-коду, інтегрований з `SignatureWidget` на сторінках `KeyCloak`. + -image:registry-develop:registry-admin/external-integration/api-publish/public-api/expose-public-api-3.png[] - -Моніторинг API та рейт-лімітів:: +image:release-notes:wn-1-9-6/wn-1-9-6-5.png[] -* [*] 📉 Ми спростили моніторинг показників виконання та кількості запитів до публічного API. Тепер ці метрики можна легко контролювати завдяки новому Grafana-dashboard. +Підпис даних через хмарний ключ :: +* [*] 🖋 Тепер вам доступна можливість підписування даних, введених через форми на користувацькому порталі, за допомогою вашого хмарного ключа. + -image:registry-develop:registry-admin/external-integration/api-publish/public-api/expose-public-api-4.png[] +image:release-notes:wn-1-9-6/wn-1-9-6-7.png[] ++ +image:release-notes:wn-1-9-6/wn-1-9-6-8.png[] +* [*] 📲 Забезпечено відображення QR-коду в компоненті `SignatureWidget` для кабінету надавача послуг, що спрощує підписування даних. + +TIP: Детальніше про функціональність ви можете знайти на сторінці xref:user:citizen-officer-portal-auth.adoc[]. == Перевірка валідності електронних підписів @@ -80,6 +74,102 @@ image:release-notes:wn-1-9-6/wn-1-9-6-3.png[] + image:release-notes:wn-1-9-6/wn-1-9-6-1.png[] +TIP: Детальніше про функціональність ви можете знайти на сторінці xref:registry-develop:best-practices/bp-sign-validate-asics-cades.adoc[]. + +== Розгортання Платформи у приватному хмарному середовищі vSphere + +* [*] ☁️ Ми переглянули та деталізували інструкцію щодо розгортання Платформи у середовищі vSphere. +Завдяки нашому попередньому досвіду, нова версія інструкції набула більшої ясності та точності, що спростить і оптимізує процес розгортання для команди та забезпечить стабільне функціонування Платформи. + +TIP: Детальну інформацію див. на сторінці xref:admin:installation/platform-deployment/platform-vsphere-deployment.adoc[]. + +== Путівник виведення Платформи та реєстрів у промислову експлуатацію + +* [*] 📘 У цьому випуску представлено детальний документ, який об'єднує наш досвід і набір рекомендацій для виведення Платформи та реєстрів до промислового середовища. +Він охоплює підготовчі кроки на рівні платформи та реєстрів, рекомендації з нефункціонального тестування, поради щодо уникнення типових проблем у промисловому середовищі та контрольний список перед запуском публічного сервісу. +Цей матеріал покликаний допомогти командам плавно й ефективно інтегруватися у промислове середовище. + +TIP: Детальну інформацію див. на сторінці xref:platform-develop:platform-prod-deployment.adoc[]. + +== Зміна назви кабінету посадової особи на нейтральну з урахуванням користувачів-представників бізнесу + +Ми змінили назву Кабінету посадової особи (надавача послуг) на нейтральну, яка є зрозумілою всім категоріям його користувачів, зокрема представникам бізнесу, що надають реєстраційні послуги. + +* [*] Назву `Кабінет посадової особи` змінено на `Кабінет користувача`. + +TIP: Більш детально про Кабінет користувача ви можете переглянути на сторінках розділу: xref:user:officer/officer-portal-overview.adoc[]. + +== Оновлення сертифікатів надавачів послуг + +* [*] 🔑 Оновлюйте сертифікати підпису для Платформи та реєстру прямо через Control Plane, не змінюючи цифрові ключі послуг. Це полегшує управління безпекою та забезпечує стабільність ваших послуг. + +image:release-notes:wn-1-9-6/wn-1-9-6-19.png[] + +[TIP] +==== +Детальніше про функціональність ви можете знайти на сторінках: + +* xref:admin:registry-management/system-keys/control-plane-platform-certificates.adoc[]. + +* xref:admin:registry-management/system-keys/control-plane-registry-certificates.adoc[]. +==== + +== Налаштування автентифікації та підпису даних у Control Plane + +* [*] 🔐 Тепер ви можете детально налаштовувати способи автентифікації та підпису даних для отримувачів послуг прямо в адміністративній панелі Control Plane. ++ +image:release-notes:wn-1-9-6/wn-1-9-6-16.png[] + +* [*] 🧩 Використовуйте IIT-віджет для налаштування параметрів автентифікації та підпису даних. Цей інструмент робить процес налаштовування ще простішим та ефективнішим. + +* [*] 🆔 Забезпечте підписування даних, використовуючи сервіс `id.gov.ua`. Ваші користувачі можуть бути впевнені у безпеці та надійності підпису. + +* [*] 📲 Тепер ви можете автентифікувати отримувачів послуг, а також надавати розширені можливості підпису даних з використанням _Дія.підпис_. ++ +image:release-notes:wn-1-9-6/wn-1-9-6-17.png[] + +TIP: Детальніше про функціональність ви можете знайти на сторінці xref:registry-develop:registry-admin/cp-auth-setup/cp-auth-setup-citizens.adoc[]. + +//// + +== Публічний доступ до даних та рейт-ліміти + +Розробка публічних інтерфейсів :: + +* [*] 🌍 У цьому релізі ми розширили можливості нашого API. Тепер, окрім внутрішнього API, ви можете відкривати публічний API для доступу до даних. Користувачі, які не пройшли аутентифікацію, тепер можуть переглядати публічні дані реєстру. +* [*] 🔓 Налаштовуйте доступ до представлень та REST API реєстру для неавтентифікованих користувачів. + ++ +image:registry-develop:registry-admin/external-integration/api-publish/public-api/expose-public-api-1.png[] + +Автоматична публікація в Open API :: + +* [*] 📘 Тепер налаштовані вами точки доступу автоматично публікуються в `openapi`-специфікації API-сервісу. Це робить інтеграцію та документацію вашого API ще простіше. + ++ +image:registry-develop:registry-admin/external-integration/api-publish/public-api/expose-public-api-2.png[] + +Оптимізація завантаження :: + +* [*] 🚀 Ми прагнемо забезпечити найкращий досвід для користувачів, тому впровадили TTL-based кешування для GET-запитів, коли йде мова про посилання до API-документації. Це зменшує навантаження на наш сервіс Kong API Gateway та прискорює доступ до інформації. + +Розширені можливості в адмін-консолі Control Plane :: + +* [*] 🔧 В адмін-консолі Control Plane додано новий інструмент для керування публічним доступом. Ви зможете налаштовувати, редагувати, блокувати або розблоковувати доступ до публічних даних реєстру. +* [*] 📊 Також можна легко встановлювати рейт-ліміти для API-запитів. + ++ +image:registry-develop:registry-admin/external-integration/api-publish/public-api/expose-public-api-3.png[] + +Моніторинг API та рейт-лімітів:: + +* [*] 📉 Ми спростили моніторинг показників виконання та кількості запитів до публічного API. Тепер ці метрики можна легко контролювати завдяки новому Grafana-dashboard. + ++ +image:registry-develop:registry-admin/external-integration/api-publish/public-api/expose-public-api-4.png[] + +TIP: Детальніше про функціональність ви можете знайти на сторінці xref:registry-develop:registry-admin/external-integration/api-publish/public-api/expose-public-api.adoc[]. + == Відправлення повідомлень надавачам послуг 📩 _Керування електронною поштою у Кабінеті користувача_ @@ -133,6 +223,8 @@ image:release-notes:wn-1-9-6/wn-1-9-6-14-1.png[] image:release-notes:wn-1-9-6/wn-1-9-6-14.png[] +TIP: Детальніше про функціональність ви можете знайти на сторінці xref:registry-develop:bp-modeling/bp/bp-async-data-load.adoc[]. + == Завантаження файлів з таблиці в один клік * [*] 📑 Завдяки вдосконаленому компоненту xref:registry-develop:bp-modeling/forms/components/edit-grid/edit-grid.adoc[Edit Grid], надавачі та отримувачі послуг тепер можуть легко завантажувати та переглядати файли прямо з табличного компонента. Оновлена функціональність спрощує процес та покращує користувацький досвід. @@ -141,75 +233,13 @@ image:user:bp-files/editgrid-file-download-1.png[] TIP: Детальну інформацію див. на сторінці xref:user:bp-files/editgrid-file-download.adoc[] -== Налаштування автентифікації та підпису даних у Control Plane - -* [*] 🔐 Тепер ви можете детально налаштовувати способи автентифікації та підпису даних для отримувачів послуг прямо в адміністративній панелі Control Plane. -+ -image:release-notes:wn-1-9-6/wn-1-9-6-16.png[] - -* [*] 🧩 Використовуйте IIT-віджет для налаштування параметрів автентифікації та підпису даних. Цей інструмент робить процес налаштовування ще простішим та ефективнішим. - -* [*] 🆔 Забезпечте підписування даних, використовуючи сервіс `id.gov.ua`. Ваші користувачі можуть бути впевнені у безпеці та надійності підпису. - -* [*] 📲 Тепер ви можете автентифікувати отримувачів послуг, а також надавати розширені можливості підпису даних з використанням _Дія.підпис_. -+ -image:release-notes:wn-1-9-6/wn-1-9-6-17.png[] - -== Хмарний ключ для автентифікації та підпису - -Автентифікація за допомогою хмарного ключа :: -* [*] 🔑 У цьому релізі надано можливість для отримувача та надавача послуг автентифікуватись на користувацькому порталі за допомогою нового методу -- _хмарного ключа_. -+ -image:release-notes:wn-1-9-6/wn-1-9-6-6.png[] - -* [*] 📱 Для полегшення процесу автентифікації, додано компонент для рендерингу QR-коду, інтегрований з `SignatureWidget` на сторінках `KeyCloak`. -+ -image:release-notes:wn-1-9-6/wn-1-9-6-5.png[] - -Підпис даних через хмарний ключ :: - -* [*] 🖋 Тепер вам доступна можливість підписування даних, введених через форми на користувацькому порталі, за допомогою вашого хмарного ключа. -+ -image:release-notes:wn-1-9-6/wn-1-9-6-7.png[] -+ -image:release-notes:wn-1-9-6/wn-1-9-6-8.png[] - -* [*] 📲 Забезпечено відображення QR-коду в компоненті `SignatureWidget` для кабінету надавача послуг, що спрощує підписування даних. - -== Дія.Підпис для автентифікації та підпису - -🔐 У цьому релізі ми додали можливість для отримувачів послуг, які мають статус фізичних осіб або ФОП, використовувати метод `Дія.Підпис` для автентифікація та підпису даних. - -image:release-notes:wn-1-9-6/wn-1-9-6-9.png[] - -image:release-notes:wn-1-9-6/wn-1-9-6-10.png[] - == Єдина автентифікація надавачів послуг для групи реєстрів * [*] 🔐 Ми надали можливість адміністраторам реєстрів об'єднувати реєстри у групу, щоб забезпечити спрощену та єдину автентифікацію для надавачів послуг у рамках цієї групи. * [*] 📘 Для зручності користувачів, розроблено детальну інструкцію, яка крок за кроком допоможе налаштувати цю функціональність. -== Оновлення сертифікатів надавачів послуг - -* [*] 🔑 Оновлюйте сертифікати підпису для Платформи та реєстру прямо через Control Plane, не змінюючи цифрові ключі послуг. Це полегшує управління безпекою та забезпечує стабільність ваших послуг. - -image:release-notes:wn-1-9-6/wn-1-9-6-19.png[] - -== Розгортання Платформи у приватному хмарному середовищі vSphere - -* [*] ☁️ Ми переглянули та деталізували інструкцію щодо розгортання Платформи у середовищі vSphere. -Завдяки нашому попередньому досвіду, нова версія інструкції набула більшої ясності та точності, що спростить і оптимізує процес розгортання для команди та забезпечить стабільне функціонування Платформи. - -TIP: Детальну інформацію див. на сторінці xref:admin:installation/platform-deployment/platform-vsphere-deployment.adoc[]. - -== Путівник виведення Платформи та реєстрів у промислову експлуатацію - -* [*] 📘 У цьому випуску представлено детальний документ, який об'єднує наш досвід і набір рекомендацій для виведення Платформи та реєстрів до промислового середовища. -Він охоплює підготовчі кроки на рівні платформи та реєстрів, рекомендації з нефункціонального тестування, поради щодо уникнення типових проблем у промисловому середовищі та контрольний список перед запуском публічного сервісу. -Цей матеріал покликаний допомогти командам плавно й ефективно інтегруватися у промислове середовище. - -TIP: Детальну інформацію див. на сторінці xref:platform-develop:platform-prod-deployment.adoc[]. +TIP: Детальніше ви можете ознайомитися на сторінці xref:registry-develop:registry-admin/cp-auth-setup/auth-setup-registry-federation.adoc[]. == Деталізований підхід до інтеграції змін моделі даних @@ -233,6 +263,8 @@ TIP: Детальну інформацію див. на сторінці xref:re image:release-notes:wn-1-9-6/wn-1-9-6-15.png[] +TIP: Детальніше про особливості моделювання бізнес-процесів та форм читайте на сторінках адміністративного порталу: xref:registry-develop:registry-admin/admin-portal/overview.adoc[]. + == Виявлення конфліктних змін у майстер-версії * [*] 🕵️‍♂️ У цьому релізі ми розширили можливості Адміністративного порталу. Тепер розробники може з легкістю виявляти та переглядати конфліктні зміни відносно майстер-версії на сторінці +++Огляд версії+++. @@ -276,25 +308,4 @@ TIP: Детальну інформацію див. на сторінці xref:ad image:release-notes:wn-1-9-6/wn-1-9-6-20.png[] - -//// -== Керування Платформою та реєстрами (Control Plane) - -... - -== Моделювання та розробка регламенту - -... - -== Функціональність Кабінетів надавача та отримувача послуг - -... - -== Взаємодія із зовнішніми системами - -... - -== Інфраструктурні зміни - -... //// \ No newline at end of file diff --git a/docs/ua/modules/release-notes/pages/whats-new/part-7/wn-7.adoc b/docs/ua/modules/release-notes/pages/whats-new/part-7/wn-7.adoc new file mode 100644 index 0000000000..c8dd31872e --- /dev/null +++ b/docs/ua/modules/release-notes/pages/whats-new/part-7/wn-7.adoc @@ -0,0 +1,462 @@ +:toc-title: ЗМІСТ +:toc: auto +:toclevels: 1 +:experimental: +:sectanchors: +:sectlinks: +:important-caption: ВАЖЛИВО +:note-caption: ПРИМІТКА +:tip-caption: ПІДКАЗКА +:warning-caption: ПОПЕРЕДЖЕННЯ +:caution-caption: УВАГА +:example-caption: Приклад +:figure-caption: Зображення +:table-caption: Таблиця +:appendix-caption: Додаток +:sectnums: + += Що нового у релізі 1.9.7. Частина 7 + +== Валідація порожніх обов'язкових полів на рівні шаблону бізнес-процесу + +🛠️ У цьому релізі ми впровадили критичне оновлення у вебінтерфейс моделювання регламенту, зокрема: + +✅ _Клієнтську валідацію_: ваші шаблони бізнес-процесів тепер будуть автоматично перевірятися на наявність порожніх обов'язкових полів. Більше жодних пропущених критичних даних! + +🔗 _Серверна валідація на пайплайні_: ми зробили так, що серверні механізми валідації використовують ті ж правила, що й клієнтська валідація, для забезпечення неперервної консистентності. + +📊 _Зрозумілі логи_: тепер у логах пайплайну в Jenkins ви з легкістю знайдете ідентифікатори задач із помилками, що пов'язані із відсутніми обов'язковими полями. + +🚀 _Запобігайте помилкам ефективно_: Це оновлення не тільки полегшує ваш процес моделювання, а й запобігає потенційним помилкам, що забезпечує високу якість вашої роботи. + +Завдяки цим нововведенням, процес моделювання бізнес-процесів стає надійнішим та ефективнішим! 🌟 + +.Валідація полів на рівні делегата у бізнес-процесі +image::release-notes:wn-1-9-7/wn-1-9-7-1.png[] + +.Статус розгортання та перевірки регламенту у Кабінеті адміністратора +image::release-notes:wn-1-9-7/wn-1-9-7-2.png[] + +.Пайплайн MASTER-Code-review-registry-regulations. Крок `registry-regulations-validation` +image::release-notes:wn-1-9-7/wn-1-9-7-3.png[] + +.Console output. Логи пайплайну валідації +image::release-notes:wn-1-9-7/wn-1-9-7-4.png[] + +.Попередження, що процес розгортання та перевірки не завершився або завершився з помилками +image::release-notes:wn-1-9-7/wn-1-9-7-5.png[] + +.Статус публікації регламенту "Не опубліковано" +image::release-notes:wn-1-9-7/wn-1-9-7-6.png[] + +TIP: Детальніше з функціональністю ви можете ознайомитися на сторінці xref:registry-develop:bp-modeling/bp/element-templates/element-templates-validate.adoc[]. + +== Перевірка цілісності запита на внесення змін до регламенту реєстру + +🛠️ Ми раді анонсувати ключове оновлення у пайплайнах публікації та перевірки регламентів. + +✅ Що ми покращили? + +* [*] Перевірка цілісності запитів: тепер кожен запит на внесення змін перевіряється на цілісність, гарантуючи, що всі внутрішні зв'язки й залежності у делегатах бізнес-процесів відповідають нормам. + +* [*] Валідація JUEL-функцій: підвищена точність валідації для JUEL-функцій у бізнес-процесах забезпечує гладке та безпомилкове виконання. + +🎯 Кінцевий результат: ваші регламенти тепер ще більш стабільні та надійні. Ніяких несподіванок чи помилок! + +🚀 Підвищуйте якість та надійність вашого регламенту з нашими останніми оновленнями. Працюйте ефективно та розумно! 🌟 + +image:release-notes:wn-1-9-7/wn-1-9-7-7.png[] + +image:release-notes:wn-1-9-7/wn-1-9-7-8.png[] + +image:release-notes:wn-1-9-7/wn-1-9-7-9.png[] + +image:release-notes:wn-1-9-7/wn-1-9-7-10.png[] + +TIP: Більш детально з описом функціональності ви можете ознайомитися на сторінці xref:registry-develop:registry-admin/admin-portal/version-control/candidate/check-regulations-integrity.adoc[]. + +== Розширення можливостей пошуку із вказанням додаткової умови OR в межах однієї таблиці + +🔎 Останнє оновлення в моделюванні регламентів розширює можливості пошуку, дозволяючи моделювальникам регламенту ефективно об'єднувати кілька параметрів пошуку в рамках однієї таблиці за допомогою оператора `OR`. + +✨ Ключові можливості: + +* [*] Групування параметрів пошуку: Використання умови `OR` дозволяє групувати кілька параметрів пошуку, забезпечуючи більш гнучкі та комплексні запити. + +* [*] Контроль порядку виконання операторів: розробники тепер можуть визначати, яким чином будуть виконуватися оператори `AND` та `OR`, що надає додаткову гнучкість у формуванні запитів. + +🚀 Полегшення процесу моделювання: це оновлення робить процес моделювання більш гнучким, полегшуючи створення складніших запитів пошуку та забезпечуючи більш ефективне використання даних у регламентах. + +image:release-notes:wn-1-9-7/wn-1-9-7-30.png[] + +[TIP] +==== +Більше деталей про особливості налаштування та застосування функціональності ви можете дізнатися на сторінках: + +* xref:registry-develop:data-modeling/data/physical-model/sc/operators/logical/manage-logical-operators-and-or.adoc[] +* xref:registry-develop:best-practices/bp-and-or-single-table.adoc[] +==== + +== Відображення інформації про автора створення та редагування об'єктів + +🌟 Зробіть ваші процеси більш прозорими! Ми раді представити нову функціональність, яка підвищує прозорість для отримувачів та надавачів послуг. Тепер кожен об'єкт на формах бізнес-процесів та у витягах має інформацію про того, хто його створив та востаннє редагував. + +✅ Чому це важливо? + +* [*] Інформація про авторів: ви завжди знатимете, хто створив або останнім редагував об'єкт, що забезпечує додатковий рівень прозорості та відповідальності. ++ +image:release-notes:wn-1-9-7/wn-1-9-7-13.png[] ++ +image:release-notes:wn-1-9-7/wn-1-9-7-12.png[] + +* [*] Докладні звіти для надавачів послуг: отримуйте не лише інформацію про авторство, а й дату та час виконаних дій. + +📊 Для кращого розуміння: референтні приклади бізнес-процесів та звітів демонструють ці нові можливості в дії. + +image:release-notes:wn-1-9-7/wn-1-9-7-11.png[] + +З цим оновленням ваші процеси стають не тільки більш ефективними, а й прозорішими. Завжди будьте в курсі, хто стоїть за змінами у ваших реєстрах! + +TIP: Детальніше про функціональність ви можете переглянути на сторінці xref:registry-develop:best-practices/bp-view-object-creator-editor.adoc[]. + +== Генерація `GET` та `POST`-запитів на пошук даних для моделювальників регламенту + +🔍 Ефективне рішення для моделювання запитів: останнє оновлення в інструментарії моделювання регламенту значно спрощує процес створення запитів на пошук даних. + +✨ Головне з оновлення: + +* [*] Автоматична Генерація `GET` і `POST`-ендпоінтів: тепер, при створенні запитів на пошук даних, система автоматично генерує як `GET`, так і `POST`-ендпоінти, забезпечуючи більшу гнучкість у роботі. + +* [*] Обробка складних запитів: впроваджено механізм для створення запитів за типом `IN`/`NOT IN`, що ефективно обробляє дані з рядками, які містять коми. + +🚀 Ключові переваги: це оновлення не тільки робить процес створення запитів швидшим та простішим, але й забезпечує коректну обробку складних даних. + +image:release-notes:wn-1-9-7/wn-1-9-7-22.png[] + +TIP: Більш детально про функціональність читайте у розділі xref:registry-develop:data-modeling/data/physical-model/sc/attributes/search-type/search-type-attribute.adoc#in-not-in[Оператор in | notIn]. + +== Референтний приклад та покращення компонента Textfield для вводу номера телефону (Україна) + +📱 Покращення введення телефонних номерів: в нашій останній розробці, ми внесли значні покращення до компонента *Textfield*, спеціально для введення номерів телефону в українському форматі. + +✨ Основні оновлення та функції: + +* [*] Референтний приклад із маскою для телефонів: Тепер моделювальники регламенту можуть використовувати референтний приклад для створення полів введення з готовою маскою номера телефону, що відповідає українському формату: `+380(00)123-4567`. + +image:registry-develop:best-practices/forms/enter-phone-number/enter-phone-number-01.png[] + +* [*] Видалення службових символів: компонент *Textfield* тепер можна налаштувати таким чином, щоб він автоматично видаляв всі службові символи та розділові знаки, передаючи лише чисті цифри. + +image:registry-develop:best-practices/forms/enter-phone-number/enter-phone-number-05.png[] + +image:registry-develop:best-practices/forms/enter-phone-number/enter-phone-number-3.png[] + +🔍 Підвищення якості обробки даних: ці зміни не лише роблять процес введення номерів телефону зручнішим та інтуїтивнішим, але й підвищують точність обробки даних. + +🚀 Використовуйте ці нові можливості для оптимізації форм введення даних у ваших регламентах та системах. + +TIP: Детальніше про нову функціональність читайте на сторінці xref:registry-develop:best-practices/forms/text-field-enter-phone-number.adoc[]. + +== Онбординг у Кабінетах через окремі URL для отримувачів та надавачів послуг + +🔗 Новий рівень доступу та реєстрації: впроваджено цінне оновлення, яке дозволяє як отримувачам, так і надавачам послуг, які ще не пройшли автентифікацію, використовувати спеціалізовані URL для онбордингу та призначення ролей у Кабінеті. + +✨ Ключові особливості оновлення: + +* [*] Гнучкий онбординг через URL: Тепер користувачі можуть переходити за спеціалізованими посиланнями для проходження онбордингу та отримання конкретних ролей в реєстрі. + +* [*] Передача параметрів через URL: Моделювальникам регламенту доступна можливість передачі в посиланні на Кабінет користувача важливих параметрів, які включають роль, назву бізнес-процесу, стартову форму та додаткові параметри для автозаповнення форми. + +* [*] Референтний бізнес-процес: надано референтні приклади бізнес-процесів, що демонструють нові можливості в дії. + +🚀 Це оновлення значно спрощує процес онбордингу та призначення ролей для обох категорій користувачів -- отримувачів та надавачів послуг, роблячи цей процес більш гнучким та інтуїтивним. + +.Додавання ролей через делегат +image::registry-develop:best-practices/bp-assign-role-via-url/assign-role-via-url-7.png[] + +.Кодування JSON із роллю користувача +image::release-notes:wn-1-9-7/wn-1-9-7-24.png[] + +.Передача ролі у параметрах запита (query) +image::release-notes:wn-1-9-7/wn-1-9-7-25.png[] + +.Призначення ролі на UI-формі бізнес-процесу +image::release-notes:wn-1-9-7/wn-1-9-7-26.png[] + +TIP: Детальніше про функціональність читайте на сторінці xref:registry-develop:best-practices/bp-launch-via-url.adoc[]. + +== Управління доступом в Кабінеті користувача: використання КЕП фізичної особи + +🔐 Розширення можливостей автентифікації: Введено нову можливість для надавачів послуг, яка дозволяє доступ до Кабінету користувача з використанням ключа електронного цифрового підпису (КЕП) фізичної особи. + +.Кабінет надавача послуг +image::admin:registry-management/registry-create/cp-create-registry-ua-9-1.png[] + +✨ Ключові оновлення: + +* [*] Доступ без ЄДРПОУ: надавачі послуг тепер можуть отримувати доступ до Кабінету, використовуючи КЕП фізичної особи, навіть якщо у них відсутній параметр "ЄДРПОУ". + +* [*] Гнучкість налаштувань адміністраторами: адміністратори реєстру мають змогу налаштовувати дозволи на автентифікацію та накладання підпису для таких користувачів через Вебінтерфейс управління Платформою. + +* [*] Варіативність методів автентифікації: підтримка автентифікації через віджет ІІТ та сервіс `id.gov.ua`, залежно від обраного типу автентифікації. + +* [*] Контроль та безпека у процесі реєстрації: референтний приклад бізнес-процесу самореєстрації з додатковою модерацією, що забезпечує ефективний контроль над процесом. + +🚀 Це оновлення значно підвищує гнучкість та безпеку в процесі автентифікації, дозволяючи надавачам послуг ефективніше управляти доступом до Кабінету. + +Скористайтеся цими новими можливостями для забезпечення більш гнучкого та безпечного доступу до ваших сервісів! 🌐 + +[TIP] +==== +Детальніше про функціональність ви можете дізнатися на сторінках: + +* xref:registry-develop:registry-admin/cp-auth-setup/officer-portal-access-individual-qes.adoc[] +* xref:registry-develop:best-practices/bp-officer-self-register-combined.adoc[] +==== + +== Оновлення компонента Edit Grid: налаштування кнопки "Переглянути" + +🔧 Нові можливості для контролю інтерфейсу: ми раді анонсувати важливі оновлення у налаштуваннях компоненти *Edit Grid*, які значно розширюють можливості моделювальників регламенту реєстру у керуванні інтерфейсом. + +✨ Основні зміни: + +* [*] Гнучкість відображення кнопки "Переглянути": моделювальники тепер можуть приховувати цю кнопку у контекстному меню рядка таблиці, особливо коли активовано режим перегляду таблиці "read only". + +* [*] Адаптація до потреб користувачів: ця можливість дозволяє адаптувати форми задач бізнес-процесів відповідно до конкретних потреб та вимог користувачів. + +🚀 Підвищення ефективності роботи з формами**: це оновлення надає більше контролю над відображенням елементів інтерфейсу, забезпечуючи більшу гнучкість та ефективність у роботі з формами. + +image:registry-develop:bp-modeling/forms/components/edit-grid/hide-view-button/edit-grid-hide-view-button-1.png[] + +image:release-notes:wn-1-9-7/wn-1-9-7-33.png[] + +TIP: Більш детально про функціональність див. на сторінці xref:registry-develop:bp-modeling/forms/components/edit-grid/edit-grid-hide-view-button.adoc[]. + +== Відправлення нотифікацій на довільні електронні адреси, що не заборонені blacklist + +📧 Ми розширили можливості відправки нотифікацій у ваших бізнес-процесах, дозволяючи надсилати повідомлення на будь-які електронні адреси, які не входять до blacklist. + +✨ Особливості оновлення: + +* [*] Гнучкість вибору адрес: відтепер можна відправляти нотифікації на адреси, введені на формі, збережені в базі даних реєстру, або отримані із зовнішніх систем. + +* [*] Перевірка на blacklist: безпечність вашої комунікації забезпечується завдяки перевірці адрес на приналежність до доменів, заборонених на території України. + +🔍 Референтний приклад: переконайтеся в ефективності цих змін, ознайомившись із референтним прикладом бізнес-процесу, який ілюструє нові можливості. + +Це оновлення сприяє більшій гнучкості та ефективності у моделюванні бізнес-процесів, забезпечуючи точніше та більш контрольоване відправлення електронних нотифікацій. + +.Схема бізнес-процесу. Новий делегат для надсилання повідомлень на електронну адресу +image::release-notes:wn-1-9-7/wn-1-9-7-14.png[] + +.Перевірка заборонених адрес на UI-формі Кабінету користувача +image::registry-develop:best-practices/bp-send-notifications-blacklist/bp-send-notifications-blacklist-7.png[] + +.Успішне доставлення повідомлення на дозволену адресу +image::release-notes:wn-1-9-7/wn-1-9-7-16.png[] + +TIP: Детальніше про функціональність читайте на сторінці xref:registry-develop:best-practices/bp-send-notifications-blacklist.adoc[]. + +== Інструкція з аудиту реєстру в розробці, етапності та переліку необхідних експертів для такого аудиту + +🔍 Підвищуйте якість ваших реєстрів: ми розробили комплексну інструкцію, яка надасть вашій команді розробки всі необхідні знання та керівництво для ефективного проведення аудиту реєстру. + +✅ Основні аспекти інструкції: + +* [*] Ключові етапи розробки для аудиту: отримайте чітке розуміння, на яких етапах розробки аудит є найбільш критичним. + +* [*] Експерти для залучення: дізнайтеся, яких експертів та спеціалістів слід залучати на різних етапах для забезпечення детального та ефективного аудиту. + +* [*] Оптимізація процесу аудиту: використовуйте рекомендовані методи та практики для оптимізації процесу та підвищення його ефективності. + +🚀 Забезпечте відповідність стандартам: ця інструкція допоможе вашій команді забезпечити, що кожен розроблений реєстр відповідає встановленим стандартам та вимогам. + +TIP: Детальніше про це див. у розділі xref:registry-develop:registry-audit-instruction/registry-audit-instruction.adoc[] + +== Швидкі посилання до адміністративних ресурсів Платформи, які мають інтерфейс + +🔗 Ефективність та зручність: наше останнє оновлення в адміністративній консолі Control Plane значно спрощує доступ адміністраторів до ключових адміністративних ресурсів Платформи. + +✨ Що змінилося? + +* [*] Згруповані посилання: посилання на адміністративні ендпоінти тепер згруповані за операційною та адміністративною зонами Платформи, що робить навігацію більш інтуїтивною. + +* [*] Організація за частотою використання: посилання розташовані в порядку, що відображає їх частоту використання, дозволяючи вам швидше дістатися до потрібного інструменту. + +🚀 Швидко, зручно, ефективно: завдяки цим оновленням, керування адміністративними ресурсами Платформи стає значно швидшим і зручнішим. + +image:admin:infrastructure/cluster-mgmt/quick-links/platform-management-quick-links-1.png[] + +TIP: Більш детально з описом функціональності ви можете ознайомитися на сторінці xref:admin:registry-management/platform/platform-management-quick-links.adoc[]. + +[#single-template] +== Оптимізація процесу створення реєстрів: мінімізація шаблонів і гнучкість налаштувань + +🔄 *Зміни в адміністративній панелі Control Plane*: +Ми значно спростили процес створення реєстрів, надавши адміністраторам більше можливостей для гнучкого налаштування. Ці зміни роблять процес створення та керування реєстрами більш інтуїтивним, гнучким та відповідним до поточних вимог. Це ще один крок вперед у покращенні досвіду користування нашої платформи. + +🔧 **Ключові оновлення**: + +* [*] *Версія шаблону реєстру*: вибір між поточною та попередньою версією реєстру забезпечує відповідність останнім вимогам та потребам. + +* [*] *Вибір режиму розгортання*: можливість вибору між режимами `development` та `production` дає гнучкість при реалізації реєстру. + ++ +image:admin:registry-management/registry-create/cp-create-registry-ua-1.png[] + +* [*] *Параметри віртуальних машин та горизонтальне масштабування*: для інфраструктур, зокрема AWS, введено специфічні параметри, що підвищують точність налаштувань. Додано можливості налаштування горизонтального масштабування (*Replicas Amount*) відповідно до потреб. + ++ +image:admin:registry-management/registry-create/cp-create-registry-ua-01.png[] + +* [*] *Ресурси та горизонтальне масштабування*: гнучкіше керування ресурсами та можливості налаштування вертикального (CPU, RAM) масштабування відповідно до потреб. + ++ +image:admin:registry-management/registry-resources/registry-resources-2.png[] + +* [*] *Кабінети користувачів*: оновлено вкладки для Кабінетів надавача та отримувача послуг. Додано опції для їх розгортання. + ++ +.Кабінет надавача послуг +image::admin:registry-management/registry-create/cp-create-registry-ua-9.png[] ++ +.Кабінет отримувача послуг +image::admin:registry-management/registry-create/cp-create-registry-ua-10.png[] + +* [*] *Кабінет адміністратора регламенту*: тепер ви можете дозволити або заборонити розгортання вебпорталу для моделювання та розробки регламенту реєстру. ++ +image:admin:registry-management/registry-create/cp-create-registry-ua-02.png[] + +* [*] *Підсистема управління геоданими*: нова вкладка, що дозволяє вирішити, чи потрібно розгортати геомодуль. + ++ +image:admin:registry-management/registry-create/cp-create-registry-ua-03.png[] + +* [*] *Оптимізація навігації*: вдосконалено перехід між вкладками, що забезпечує більшу зручність при налаштуванні реєстру. + +TIP: Більш детально про нові розробки можна дізнатися на сторінці xref:admin:registry-management/control-plane-create-registry.adoc[]. + +== Оновлення компоненти Date/Time: розширені опції та гнучкість у виборі дат + +📅 Новий рівень гнучкості у виборі дати: з останнім оновленням компоненти *Date/Time*, користувачі тепер мають значно більше опцій та гнучкості при виборі дат у календарі. + +✨ Ключові оновлення компоненти Date/Time: + +* [*] Легкий вибір року: можливість вибору потрібного року через випадний список, спрощуючи вибір дат, що знаходяться далеко від поточної. + +* [*] Різноманітні опції вибору дати: включаючи можливість вибору попередніх дат, включаючи сьогоднішню, обрання дати з встановленого проміжку, та інші. + +* [*] Гнучкість у введенні дати: опції для обрання дати лише через календар або введення вручну, відповідно до потреб користувача. + +* [*] Референтні приклади для демонстрації: доступні референтні бізнес-процеси із налаштованими формами в демо-реєстрі, демонструючи використання нових можливостей. + +🚀 Це оновлення забезпечує ширші можливості для налаштування та використання компоненти *Date/Time*, відповідаючи різним потребам та сценаріям використання. + +Використовуйте ці нові можливості для поліпшення інтерфейсу та зручності вибору дат у вашому регламенті або системі! 🌐 + +image:release-notes:wn-1-9-7/wn-1-9-7-32.png[] + +TIP: Більш детально з описом функціональності ви можете ознайомитися на сторінці xref:registry-develop:best-practices/forms/date-time-enter-date.adoc[]. + +== Розгортання регламенту як ідемпотентна операція + +🔍 Ознайомтеся з ідемпотентним розгортанням регламенту: нова функціональність вносить ключові зміни у процес розгортання регламенту, підвищуючи точність та забезпечуючи консистентність ваших операцій. + +🌟 Основні особливості: + +* [*] _Автоматизоване порівняння станів_: система тепер сама порівнює поточний стан регламенту з останнім успішним виконанням, мінімізуючи ризики неконсистентності. ++ +image:registry-develop:registry-admin/regulations-deploy/idempotant-deployment/idempotant-deployment-2.png[] + +* [*] _Захист чексум_: кожна ваша чексума (`SHA256`) надійно збережена, що гарантує безпеку змін. ++ +image:registry-develop:registry-admin/regulations-deploy/idempotant-deployment/idempotant-deployment-1.png[] + +* [*] Гнучкість у розгортанні: можливість примусового розгортання надає додаткову гнучкість у роботі. ++ +image:registry-develop:registry-admin/regulations-deploy/cleanup-job/cleanup-job-4.png[] + +🎯 Зручність та продуктивність: це оновлення робить процес розгортання регламенту більш інтуїтивним та продуктивним. + +TIP: Детальніше про функціональність читайте на сторінці xref:registry-develop:registry-admin/regulations-deploy/regulations-idempotеnt-deployment.adoc[]. + +== Оновлення Платформи для сумісності з OpenShift версії 4.12 (_AWS та vSphere_) + +[TIP] +==== +Платформа 1.9.7 готова до оновлення OKD до версії 4.12. + +* [*] Оновлено Платформу для сумісності з OpenShift версії 4.12. + +* [*] Підготовлено підсистеми Платформи та реєстрів до оновлення на OKD 4.12. + +* [*] Проведено тестування на зворотну сумісність з OKD 4.11. + +Перед оновленням OKD до версії 4.12, необхідно підготувати відповідні заходи для забезпечення сумісності згідно з розділами: + +* xref:admin:update/special-steps-for-update/special-steps.adoc#update-jaeger-operator[Адаптація jaeger-operator для сумісності з OKD 4.12]. + +* xref:admin:update/special-steps-for-update/special-steps.adoc#update-registry-postgres[Адаптація registry-postgres для сумісності з OKD 4.12] + +Детальні інструкції й рекомендації щодо оновлення містяться на сторінці xref:admin:update/update-okd-4-12.adoc[]. +==== + +//// + +== Новий навчальний курс для адміністраторів реєстрів: практичні завдання та керівництво + +📚 Підвищення компетентності адміністраторів реєстрів: ми розробили комплексний навчальний курс з практичними завданнями для технічних адміністраторів реєстрів, який спрямований на підвищення їх навичок та глибокого розуміння роботи з реєстрами. + +✨ Ключові теми курсу: + +* [*] Основи управління реєстрами: ознайомлення з процесами редагування налаштувань реєстру. + +* [*] Створення та видалення адміністраторів: докладні інструкції та керівництво. + +* [*] Оновлення ключів та сертифікатів: детальні поради щодо цифрового підпису. + +* [*] Керування ресурсами реєстру: інструкції з обмеження завантаження документів та управління ресурсами. + +* [*] Налаштування автентифікації та логування подій: використання Kibana та Grafana для моніторингу метрик. + +* [*] Резервне копіювання та відновлення: процедури та кращі практики. + +* [*] Оновлення реєстру та налаштування DNS: практичні поради для адміністраторів. + +🚀 Цей курс забезпечує адміністраторів всіма необхідними знаннями та практичними навичками для ефективного управління реєстрами та їх компонентами, підвищуючи їх професійну ефективність. + +Використовуйте цей навчальний курс як важливий ресурс для забезпечення високої якості управління вашими реєстрами! 🌐 + +TIP: Більш детально про навчання адміністраторів див. розділ xref:registry-develop:registry-admin-study/study-tasks/study-tasks-overview.adoc[]. + +== Інтеграція інстанс-залежних змінних в документацію Платформи + +📚 Ми внесли важливі зміни у документацію Платформи, додавши функціональність, яка дозволяє переходити за посиланнями до різних компонентів прямо із сайту документацією, залежно від екземпляра Платформи та демореєстру, який розгорнуто на цьому екземплярі. + +✨ Основні покращення: + +* [*] Уніфікація посилань: усі посилання в документації тепер приведені до єдиної конвенції, що забезпечує легкість використання та консистентність. + +* [*] Посилання, що відкриваються у новому вікні: при натисканні на посилання, вони автоматично відкриваються у новому вікні браузера, забезпечуючи синхронізацію з поточним інстансом Платформи та налаштованим демореєстром. + +🚀 Зручність та ефективність: ці оновлення полегшують навігацію по документації, дозволяючи користувачам швидко знаходити потрібну інформацію та ресурси. + +== Розробка референтного прикладу моделювання бізнес-процесу з паралельним виконанням задач надавачами послуг із різними ролями + +🔄 Ми розробили референтний приклад бізнес-процесу, який демонструє можливості паралельного виконання задач різними посадовими особами з різними ролями. + +✨ Особливості референтного бізнес-процесу: + +* [*] Розподіл задач між різними ролями: задачі у бізнес-процесі розподіляються одночасно між посадовими особами з ролями `officer-first-rank`, `officer-second-rank` та `hierarchy-registry-manager`. + +* [*] Врахування часу виконання за ролями: різні ролі мають відмінний час виконання своїх задач, що додає реалізму та ефективності у процесі моделювання. + +* [*] Система нагадувань для задач: Налаштована система нагадувань для посадових осіб, які повинні опрацювати задачі з черги. + +🚀 Застосування на практиці: Цей референтний бізнес-процес не лише показує практичне застосування паралельного виконання задач, але й служить зразком для розробників у створенні складних бізнес-процесів, що включають різні ролі користувачів. + +Використовуйте цей приклад для розробки ефективних бізнес-процесів, що відповідають динамічним потребам вашої організації! + +image:release-notes:wn-1-9-7/wn-1-9-7-31.png[] + +//// \ No newline at end of file diff --git a/docs/ua/modules/release-notes/pages/whats-new/whats-new.adoc b/docs/ua/modules/release-notes/pages/whats-new/whats-new.adoc new file mode 100644 index 0000000000..e67ddbdd47 --- /dev/null +++ b/docs/ua/modules/release-notes/pages/whats-new/whats-new.adoc @@ -0,0 +1,15 @@ += Що нового у релізі 1.9.7 +:sectanchors: +:sectlinks: + +На цій сторінці ви знайдете інформацію про найновіші функції нашого програмного продукту. Ми демонструємо нову функціональність, яка розширює можливості Платформи та реєстрів, розгорнутих на ній, спрощуючи роботу користувачів та покращуючи їх досвід. Завдяки новим функціям ви зможете більш ефективно використовувати наше програмне забезпечення та збільшити вашу продуктивність. + +== Огляд секції + +//* xref:release-notes:whats-new/part-1/wn-1.adoc[] +* xref:release-notes:whats-new/part-2/wn-2.adoc[] +* xref:release-notes:whats-new/part-3/wn-3.adoc[] +* xref:release-notes:whats-new/part-4/wn-4.adoc[] +* xref:release-notes:whats-new/part-5/wn-5.adoc[] +* xref:release-notes:whats-new/part-6/wn-6.adoc[] +* xref:release-notes:whats-new/part-7/wn-7.adoc[] \ No newline at end of file diff --git a/docs/ua/modules/release-notes/partials/nav.adoc b/docs/ua/modules/release-notes/partials/nav.adoc new file mode 100644 index 0000000000..9d0bc7df18 --- /dev/null +++ b/docs/ua/modules/release-notes/partials/nav.adoc @@ -0,0 +1,20 @@ +//Що нового? +* xref:release-notes:overview.adoc[Що нового] +** xref:release-notes:whats-new/whats-new.adoc[Що нового] +//*** xref:release-notes:whats-new/part-1/wn-1.adoc[] +*** xref:release-notes:whats-new/part-2/wn-2.adoc[] +*** xref:release-notes:whats-new/part-3/wn-3.adoc[] +*** xref:release-notes:whats-new/part-4/wn-4.adoc[] +*** xref:release-notes:whats-new/part-5/wn-5.adoc[] +*** xref:release-notes:whats-new/part-6/wn-6.adoc[] +*** xref:release-notes:whats-new/part-7/wn-7.adoc[] +** xref:release-notes:release-notes/release-notes.adoc[Примітки до релізу] +//*** xref:release-notes:release-notes/part-1/rn-1.adoc[] +*** xref:release-notes:release-notes/part-2/rn-2.adoc[] +*** xref:release-notes:release-notes/part-3/rn-3.adoc[] +*** xref:release-notes:release-notes/part-4/rn-4.adoc[] +*** xref:release-notes:release-notes/part-5/rn-5.adoc[] +*** xref:release-notes:release-notes/part-6/rn-6.adoc[] +*** xref:release-notes:release-notes/part-7/rn-7.adoc[] +** xref:release-notes:breaking-changes/breaking-changes.adoc[Зворотно несумісні зміни] +** xref:release-notes:deprecated-functionality/deprecated-functionality.adoc[Застаріла функціональність] \ No newline at end of file diff --git a/docs/ua/modules/testing/attachments/performance-testing/perf-report/1-9-7/volume-degradation-report.xlsx b/docs/ua/modules/testing/attachments/performance-testing/perf-report/1-9-7/volume-degradation-report.xlsx new file mode 100644 index 0000000000..91773ae18b Binary files /dev/null and b/docs/ua/modules/testing/attachments/performance-testing/perf-report/1-9-7/volume-degradation-report.xlsx differ diff --git a/docs/ua/modules/testing/images/perf-test/1-9-7/1500-1/img-1.png b/docs/ua/modules/testing/images/perf-test/1-9-7/1500-1/img-1.png new file mode 100644 index 0000000000..768cef7a52 Binary files /dev/null and b/docs/ua/modules/testing/images/perf-test/1-9-7/1500-1/img-1.png differ diff --git a/docs/ua/modules/testing/images/perf-test/1-9-7/1500-1/img-2.png b/docs/ua/modules/testing/images/perf-test/1-9-7/1500-1/img-2.png new file mode 100644 index 0000000000..27dacdfc52 Binary files /dev/null and b/docs/ua/modules/testing/images/perf-test/1-9-7/1500-1/img-2.png differ diff --git a/docs/ua/modules/testing/images/perf-test/1-9-7/1500-1/img-3.png b/docs/ua/modules/testing/images/perf-test/1-9-7/1500-1/img-3.png new file mode 100644 index 0000000000..7b475dbfa9 Binary files /dev/null and b/docs/ua/modules/testing/images/perf-test/1-9-7/1500-1/img-3.png differ diff --git a/docs/ua/modules/testing/images/perf-test/1-9-7/1500-1/img-4.png b/docs/ua/modules/testing/images/perf-test/1-9-7/1500-1/img-4.png new file mode 100644 index 0000000000..05d1f2f54e Binary files /dev/null and b/docs/ua/modules/testing/images/perf-test/1-9-7/1500-1/img-4.png differ diff --git a/docs/ua/modules/testing/images/perf-test/1-9-7/1500-1/img-5.png b/docs/ua/modules/testing/images/perf-test/1-9-7/1500-1/img-5.png new file mode 100644 index 0000000000..c8e119416b Binary files /dev/null and b/docs/ua/modules/testing/images/perf-test/1-9-7/1500-1/img-5.png differ diff --git a/docs/ua/modules/testing/images/perf-test/test-preparation/carrier-perf-load-config.png b/docs/ua/modules/testing/images/perf-test/test-preparation/carrier-perf-load-config.png new file mode 100644 index 0000000000..1e9118b672 Binary files /dev/null and b/docs/ua/modules/testing/images/perf-test/test-preparation/carrier-perf-load-config.png differ diff --git a/docs/ua/modules/testing/images/perf-test/test-preparation/carrier-perf-params.png b/docs/ua/modules/testing/images/perf-test/test-preparation/carrier-perf-params.png new file mode 100644 index 0000000000..930e92f495 Binary files /dev/null and b/docs/ua/modules/testing/images/perf-test/test-preparation/carrier-perf-params.png differ diff --git a/docs/ua/modules/testing/images/perf-test/test-preparation/carrier-perf-start.png b/docs/ua/modules/testing/images/perf-test/test-preparation/carrier-perf-start.png new file mode 100644 index 0000000000..e1d3a5258d Binary files /dev/null and b/docs/ua/modules/testing/images/perf-test/test-preparation/carrier-perf-start.png differ diff --git a/docs/ua/modules/testing/images/perf-test/test-preparation/file-uplpad.png b/docs/ua/modules/testing/images/perf-test/test-preparation/file-uplpad.png new file mode 100644 index 0000000000..352b55aaf0 Binary files /dev/null and b/docs/ua/modules/testing/images/perf-test/test-preparation/file-uplpad.png differ diff --git a/docs/ua/modules/testing/images/perf-test/test-preparation/keycloak-flow.png b/docs/ua/modules/testing/images/perf-test/test-preparation/keycloak-flow.png new file mode 100644 index 0000000000..c2097cdfec Binary files /dev/null and b/docs/ua/modules/testing/images/perf-test/test-preparation/keycloak-flow.png differ diff --git a/docs/ua/modules/testing/images/perf-test/test-preparation/keycloak-realm-path.png b/docs/ua/modules/testing/images/perf-test/test-preparation/keycloak-realm-path.png new file mode 100644 index 0000000000..5bb28a9bd2 Binary files /dev/null and b/docs/ua/modules/testing/images/perf-test/test-preparation/keycloak-realm-path.png differ diff --git a/docs/ua/modules/testing/images/perf-test/test-preparation/machine-set-config.png b/docs/ua/modules/testing/images/perf-test/test-preparation/machine-set-config.png new file mode 100644 index 0000000000..ba0f45aa51 Binary files /dev/null and b/docs/ua/modules/testing/images/perf-test/test-preparation/machine-set-config.png differ diff --git a/docs/ua/modules/testing/images/perf-test/test-preparation/perf-testing-profile.png b/docs/ua/modules/testing/images/perf-test/test-preparation/perf-testing-profile.png new file mode 100644 index 0000000000..8d6d3d5fba Binary files /dev/null and b/docs/ua/modules/testing/images/perf-test/test-preparation/perf-testing-profile.png differ diff --git a/docs/ua/modules/testing/images/perf-test/test-preparation/run-pipeline.png b/docs/ua/modules/testing/images/perf-test/test-preparation/run-pipeline.png new file mode 100644 index 0000000000..12b9e15f7b Binary files /dev/null and b/docs/ua/modules/testing/images/perf-test/test-preparation/run-pipeline.png differ diff --git a/docs/ua/modules/testing/images/perf-test/test-preparation/set-build.png b/docs/ua/modules/testing/images/perf-test/test-preparation/set-build.png new file mode 100644 index 0000000000..b5ff72a4d8 Binary files /dev/null and b/docs/ua/modules/testing/images/perf-test/test-preparation/set-build.png differ diff --git a/docs/ua/modules/testing/images/perf-test/test-preparation/test-params.png b/docs/ua/modules/testing/images/perf-test/test-preparation/test-params.png new file mode 100644 index 0000000000..1ad97be68b Binary files /dev/null and b/docs/ua/modules/testing/images/perf-test/test-preparation/test-params.png differ diff --git a/docs/ua/modules/testing/pages/performance-testing/perf-report/1-9-6/perf-test-1-9-6-1500-1.adoc b/docs/ua/modules/testing/pages/performance-testing/perf-report/1-9-6/perf-test-1-9-6-1500-1.adoc index 7a41d4ac78..01f77696db 100644 --- a/docs/ua/modules/testing/pages/performance-testing/perf-report/1-9-6/perf-test-1-9-6-1500-1.adoc +++ b/docs/ua/modules/testing/pages/performance-testing/perf-report/1-9-6/perf-test-1-9-6-1500-1.adoc @@ -541,7 +541,7 @@ image::testing:perf-test/1-9-6/1500-1/img-5.png[] NOTE: Цей тест демонструє приклад роботи реєстру при планованому повному навантаженні в робочий час. -==== Значення затримки при повному навантаженні (95-й процентиль) +==== Значення затримки при повному навантаженні (середнє) * [*] [.underline]#Операції читання# (за ключем та одним полем, без запитів до сторонніх реєстрів) ~ `*25*` мс. * [*] [.underline]#Операції запису# ~ `*427*` мс. diff --git a/docs/ua/modules/testing/pages/performance-testing/perf-report/1-9-7/perf-test-1-9-7-1500-1.adoc b/docs/ua/modules/testing/pages/performance-testing/perf-report/1-9-7/perf-test-1-9-7-1500-1.adoc new file mode 100644 index 0000000000..d5836cd1bc --- /dev/null +++ b/docs/ua/modules/testing/pages/performance-testing/perf-report/1-9-7/perf-test-1-9-7-1500-1.adoc @@ -0,0 +1,293 @@ +:toc-title: ЗМІСТ +:toc: auto +:toclevels: 5 +:experimental: +:important-caption: ВАЖЛИВО +:note-caption: ПРИМІТКА +:tip-caption: РЕСУРС +:warning-caption: ПОПЕРЕДЖЕННЯ +:caution-caption: УВАГА +:example-caption: Приклад +:figure-caption: Зображення +:table-caption: Таблиця +:appendix-caption: Додаток +:sectnums: +:sectnumlevels: 5 +:sectanchors: +:sectlinks: + += Тестування продуктивності Платформи 1.9.7 при навантаженні 1500 користувачів на 1 годину + +Тестування продуктивності Платформи проводиться на базі потужностей «EPAM» для конкретного релізу. Цей процес включає використання заздалегідь встановленої конфігурації кластера Openshift для одного розгорнутого реєстру, що обслуговує 1500 активних користувачів під час планового максимального навантаження у робочі години. + +== Конфігурація кластера Openshift на базі інфраструктури «EPAM» + +Конфігурація кластера *Openshift* на базі інфраструктури «EPAM» наведена нижче в таблиці та подана у розрізі за типом пристроїв та їх призначенням. + +.Типи пристроїв та їх призначення +[width="99%",cols="23%,11%,8%,34%,7%,6%,11%",options="header",] +|=== +|*Пристрій* |*Кількість* |*ОС* |*Призначення* |*vCPU* |*RAM (GB)* |*Сховище* +|Ceph |3 |Fedora |Функціонування об'єктного сховища Ceph |16 |128 |642 GB x3 +|Control plane |3 |Fedora |Функціонування панелі управління Openshift |8 |64 a| +212 Gb + +280 GB + +295 Gb + +|Infra Nodes |3 |Fedora |Функціонування централізованих сервісів Платформи |4 |32 |80 GB x3 +|Logging |3 |Fedora |Функціонування сховища логів ElasticSearch |8 |32 |453 GB x3 +a| +Registry Node +|4 |Fedora |Функціонування сервісів реєстру |8 |32 |80 GB x4 +|Load generator – perf-testing |1 |Ubuntu |Запуск JMeter |4 |32 |50 GB +|Vault |1 |Ubuntu |Менеджмент секретів |1 |1 |18 GB +|Minio |1 |Ubuntu |Об'єктне сховище |1 |1 |308 GB +|=== + + +== Результати запуску тестів навантаження + +=== Умови виконання тесту + +.Умови виконання тесту +[width="100%",cols="51%,49%",options="header",] +|=== +|*Умова* |*Метрика* +|Кількість користувачів (осіб) |1500 +|Час виконання (години) |1 +|Оточення (інфраструктура) |AWS +|Кількість реєстрів (шт.) |1 +|Вебпортал, що перевіряється |officer portal +|=== + +=== Конфігурація Реєстру + +.Конфігурація горизонтального масштабування реєстру +[width="100%",cols="72%,28%",options="header",] +|=== +|Сервіс |Кількість копій (інстансів) +|Admin portal/Officer portal/Citizen portal |1 +|BPMS |4 +|BP WS gateway |1 +|BP admin portal |1 +|DB/DB read replica |1 +|Digital document service |1 +|Digital signature service |1 +|Excerpt services |1 +|Form schema provider |3 +|Form schema validator |3 +|Geoserver |1 +|Istio gateway |1 +|Infra (jenkins/gerrit/nexus etc.) |1 +|Kafka services (exporter, schema registry) |1 +|Kafka cluster |1 +|Kafka cluster zookeeper |1 +|Kong |4 +|Language server |1 +|Process history rest api |2 +|Process history persistence service |1 +|Redash services |1 +|Registry rest api |3 +|Registry rest api ext |1 +|Registry rest api public |1 +|Registry kafka api |3 +|Redis rfr (1000m) |2 +|Redis rfs |3 +|User settings rest api |1 +|User task management |3 +|User process management |2 +|Wiremock |1 +|=== + +.Додаткова конфігурація сервісів реєстру +[width="99%",cols="33%,33%,33%",options="header",] +|=== +| Kubernetes ресурс |Назва |Налаштування +| RedisFailover | redis-sentinel | spec.redis.customConfig.maxMemory = 0 +| ConfigMap | bpms | spring.datasource.hikari.maximum-pool-size: 30 + + camunda.bpm.database-history-level: NONE +|=== + +.Додаткова конфігурація налаштувань у values.yaml реєстру +[width="99%",cols="50%,50%",options="header",] +|=== +| Налаштування |Значення +| global.postgresql.parameters.max_connections |600 +|=== + +=== Загальний опис виконання запитів з Carrier + +[TIP] +==== +URL запита: + +`https://platform.getcarrier.io/-/performance/backend/results?result_id=873` +==== + +.Загальні характеристики сценарію +image::testing:perf-test/1-9-7/1500-1/img-1.png[] + +.Основний графік виконання +image::testing:perf-test/1-9-7/1500-1/img-2.png[] + +=== Таблиця параметрів за кожним типом запитів + +.Параметри за кожним типом запитів +[width="100%",cols="46%,8%,9%,8%,6%,8%,8%,7%",options="header",] +|=== +|Назва (*NAME*) |Кількість запитів (*TTL REQ, COUNT*) |Пропускна здатність, кількість запитів/с (*THRGHPT, REQ/SEC*) |Кількість помилок (*ERRORS, COUNT*) |Найменша кількість часу на запит (*MIN, MS*) | Найбільша кількість часу на запит (*MAX, MS*) |Середнє значення, час на запит (*MEDIAN, MS*) |95-й процентиль (*PCT95, MS*) +|*All* |*1049518* |*298.498* |*1* |*3.0* |*16151.0* |*63.0* |*237* +|*[portal][sc:get:staff-equal-laboratory-id-contains-full-name]* |*5906* |*1.68* |*0* |*9.0* |*853.0* |*21.0* |*39* +|*[portal][sc:get:staff-contains-name]* |*9442* |*2.685* |*0* |*8.0* |*690.0* |*21.0* |*42* +|*[portal][sc:get:research-contains-name]* |*9442* |*2.685* |*0* |*8.0* |*403.0* |*21.0* |*41* +|*[portal][sc:get:refusal-reason-equal-constant-code-contains-name]* |*107147* |*30.474* |*0* |*8.0* |*966.0* |*20.0* |*39* +|*[portal][sc:get:ownership-contains-name]* |*55057* |*15.659* |*0* |*7.0* |*1213.0* |*20.0* |*39* +|*[portal][sc:get:laboratory-equal-subject-code-name]* |*24052* |*6.841* |*0* |*8.0* |*852.0* |*22.0* |*43* +|*[portal][sc:get:kopfg-contains-name]* |*55054* |*15.658* |*0* |*8.0* |*926.0* |*20.0* |*40* +|*[portal][sc:get:koatuu-obl-contains-name]* |*44121* |*12.549* |*0* |*7.0* |*1212.0* |*20.0* |*40* +|*[portal][sc:get:koatuu-np-starts-with-name-by-obl]* |*55051* |*15.657* |*0* |*8.0* |*877.0* |*21.0* |*41* +|*[portal][sc:get:factor-physical-contains-name]* |*6069* |*1.726* |*0* |*9.0* |*838.0* |*23.0* |*47* +|*[portal][sc:get:factor-pesticides-contains-name]* |*6076* |*1.728* |*0* |*9.0* |*666.0* |*23.0* |*47* +|*[portal][sc:get:factor-labour-contains-name]* |*6072* |*1.727* |*0* |*8.0* |*924.0* |*22.0* |*45* +|*[portal][sc:get:factor-chemical-obrb-contains-name]* |*6070* |*1.726* |*0* |*9.0* |*573.0* |*24.0* |*49* +|*[portal][sc:get:factor-chemical-hygiene-contains-name]* |*6072* |*1.727* |*0* |*9.0* |*574.0* |*24.0* |*49* +|*[portal][sc:get:factor-chemical-host-contains-name]* |*6072* |*1.727* |*0* |*10.0* |*342.0* |*23.0* |*47* +|*[portal][sc:get:factor-chemical-arbitrary-contains-name]* |*6071* |*1.727* |*0* |*9.0* |*909.0* |*23.0* |*47* +|*[portal][sc:get:factor-bio-contains-name]* |*6067* |*1.726* |*0* |*9.0* |*1212.0* |*23.0* |*47* +|*[portal][logout]* |*2356* |*0.67* |*0* |*19.0* |*1088.0* |*86.0* |*235* +|*[portal][login]* |*3851* |*1.095* |*0* |*93.0* |*953.0* |*196.0* |*381* +|*[portal][get-user-tasks-lightweight]* |*131412* |*37.375* |*0* |*18.0* |*15980.0* |*38.0* |*65* +|*[portal][get-user-tasks-count]* |*8611* |*2.449* |*0* |*16.0* |*584.0* |*32.0* |*54* +|*[portal][get-user-runtime-process-instances]* |*3662* |*1.042* |*0* |*9.0* |*664.0* |*19.0* |*38* +|*[portal][get-user-info]* |*37647* |*10.707* |*0* |*7.0* |*1107.0* |*35.0* |*87* +|*[portal][get-user-history-tasks]* |*3665* |*1.042* |*0* |*10.0* |*492.0* |*24.0* |*50* +|*[portal][get-user-history-process-instances]* |*3657* |*1.04* |*0* |*9.0* |*584.0* |*22.0* |*45* +|*[portal][get-user-history-process-instances-count]* |*3849* |*1.095* |*0* |*10.0* |*16112.0* |*33.0* |*53* +|*[portal][get-task]* |*33733* |*9.594* |*0* |*14.0* |*16091.0* |*31.0* |*53* +|*[portal][get-process-definitions]* |*31616* |*8.992* |*0* |*14.0* |*16108.0* |*33.0* |*58* +|*[portal][get-process-definitions-count]* |*3851* |*1.095* |*0* |*15.0* |*544.0* |*30.0* |*51* +|*[portal][get-login-page]* |*3854* |*1.096* |*0* |*3.0* |*800.0* |*11.0* |*28* +|*[portal][get-home-page]* |*3853* |*1.096* |*0* |*11.0* |*523.0* |*32.0* |*74* +|*[portal][get-grouped-process-definitions]* |*3850* |*1.095* |*0* |*19.0* |*501.0* |*41.0* |*73* +|*[portal][get-form-by-key]* |*128160* |*36.451* |*0* |*3.0* |*1325.0* |*18.0* |*39* +|*[portal][bp:update-lab][task:update-laboratory-data][sign-form]* |*3641* |*1.036* |*0* |*335.0* |*2187.0* |*665.0* |*1029* +|*[portal][bp:update-lab][task:update-laboratory-data][get-task]* |*3646* |*1.037* |*0* |*24.0* |*431.0* |*51.0* |*89* +|*[portal][bp:update-lab][task:update-laboratory-data][complete]* |*7290* |*2.073* |*0* |*87.0* |*891.0* |*183.0* |*312* +|*[portal][bp:update-lab][task:sign-laboratory-data][get-task]* |*3646* |*1.037* |*0* |*23.0* |*481.0* |*51.0* |*87* +|*[portal][bp:update-lab][task:fill-laboratory-data][get-task]* |*3648* |*1.038* |*0* |*24.0* |*855.0* |*52.0* |*91* +|*[portal][bp:update-lab][start-with-form]* |*3647* |*1.037* |*0* |*106.0* |*1152.0* |*200.0* |*321* +|*[portal][bp:update_personnel][task:update-personnel-data][sign-form]* |*3543* |*1.008* |*0* |*368.0* |*2307.0* |*668.0* |*1021* +|*[portal][bp:update_personnel][task:update-personnel-data][sign-form]* |*3545* |*1.008* |*0* |*24.0* |*909.0* |*53.0* |*93* +|*[portal][bp:update_personnel][task:update-personnel-data][get-task]* |*3544* |*1.008* |*0* |*24.0* |*1271.0* |*53.0* |*93* +|*[portal][bp:update_personnel][task:update-personnel-data][complete]* |*3545* |*1.008* |*0* |*96.0* |*1075.0* |*193.0* |*328* +|*[portal][bp:update_personnel][start-with-form]* |*3548* |*1.009* |*0* |*98.0* |*759.0* |*184.0* |*294* +|*[portal][bp:update_chemical_dict][task:update-chemical-dict][sign-form]* |*3282* |*0.933* |*0* |*347.0* |*2269.0* |*654.0* |*993* +|*[portal][bp:update_chemical_dict][task:update-chemical-dict][get-task]* |*3287* |*0.935* |*0* |*24.0* |*575.0* |*53.0* |*93* +|*[portal][bp:update_chemical_dict][task:update-chemical-dict][complete]* |*3287* |*0.935* |*0* |*87.0* |*1145.0* |*190.0* |*327* +|*[portal][bp:update_chemical_dict][task:sign-update-chemical-dict][get-task]* |*3287* |*0.935* |*0* |*24.0* |*883.0* |*54.0* |*96* +|*[portal][bp:update_chemical_dict][start]* |*3286* |*0.935* |*0* |*35.0* |*806.0* |*75.0* |*128* +|*[portal][bp:read_personnel][task:read-personnel][get-task]* |*2353* |*0.669* |*0* |*26.0* |*909.0* |*57.0* |*101* +|*[portal][bp:read_personnel][task:read-personnel][complete]* |*2355* |*0.67* |*0* |*133.0* |*1360.0* |*306.0* |*511* +|*[portal][bp:read_personnel][start-with-form]* |*2356* |*0.67* |*0* |*108.0* |*776.0* |*198.0* |*312* +|*[portal][bp:read_lab][task:read-lab][get-task]* |*2408* |*0.685* |*0* |*26.0* |*1271.0* |*57.0* |*97* +|*[portal][bp:read_lab][task:read-lab][complete]* |*2405* |*0.684* |*0* |*126.0* |*1708.0* |*295.0* |*505* +|*[portal][bp:read_lab][start-with-form]* |*2407* |*0.685* |*0* |*118.0* |*1025.0* |*220.0* |*360* +|*[portal][bp:create-subject][task:create-subject][sign-form]* |*3747* |*1.066* |*1* |*344.0* |*2286.0* |*614.0* |*954* +|*[portal][bp:create-subject][task:create-subject][get-task]* |*3751* |*1.067* |*0* |*24.0* |*2511.0* |*52.0* |*91* +|*[portal][bp:create-subject][start-with-form]* |*3799* |*1.08* |*0* |*79.0* |*807.0* |*155.0* |*252* +|*[portal][bp:create-lab][task:sign-create-lab][get-task]* |*3777* |*1.074* |*0* |*21.0* |*973.0* |*52.0* |*91* +|*[portal][bp:create-lab][task:fill-laboratory-data][get-task]* |*3773* |*1.073* |*0* |*23.0* |*927.0* |*51.0* |*89* +|*[portal][bp:create-lab][task:fill-laboratory-data][complete]* |*3778* |*1.075* |*0* |*98.0* |*951.0* |*196.0* |*340* +|*[portal][bp:create-lab][task:create-lab][sign-form]* |*3774* |*1.073* |*0* |*345.0* |*2388.0* |*639.0* |*985* +|*[portal][bp:create-lab][start-with-form]* |*3770* |*1.072* |*0* |*72.0* |*16151.0* |*142.0* |*231* +|*[portal][bp:create_app_primary][task:sign-create-app-primary][sign-form]* |*3215* |*0.914* |*0* |*388.0* |*2435.0* |*707.0* |*1072* +|*[portal][bp:create_app_primary][task:sign-create-app-primary][get-task]* |*3216* |*0.915* |*0* |*23.0* |*860.0* |*53.0* |*97* +|*[portal][bp:create_app_primary][task:letter_data][get-task]* |*3218* |*0.915* |*0* |*25.0* |*883.0* |*54.0* |*94* +|*[portal][bp:create_app_primary][task:letter_data][complete]* |*3214* |*0.914* |*0* |*89.0* |*976.0* |*182.0* |*311* +|*[portal][bp:create_app_primary][task:decision_include][get-task]* |*3212* |*0.914* |*0* |*25.0* |*951.0* |*53.0* |*94* +|*[portal][bp:create_app_primary][task:decision_include][complete]* |*3217* |*0.915* |*0* |*83.0* |*1000.0* |*182.0* |*312* +|*[portal][bp:create_app_primary][task:create_app_primary][get-task]* |*3218* |*0.915* |*0* |*36.0* |*594.0* |*89.0* |*159* +|*[portal][bp:create_app_primary][task:create_app_primary][complete]* |*3218* |*0.915* |*0* |*90.0* |*790.0* |*195.0* |*339* +|*[portal][bp:create_app_primary][task:check_complience][get-task]* |*3210* |*0.913* |*0* |*25.0* |*395.0* |*53.0* |*94* +|*[portal][bp:create_app_primary][task:check_complience][complete]* |*3218* |*0.915* |*0* |*97.0* |*1165.0* |*198.0* |*341* +|*[portal][bp:create_app_primary][task:add_bio_phys_labor_factors_task][get-task]* |*3214* |*0.914* |*0* |*24.0* |*613.0* |*53.0* |*96* +|*[portal][bp:create_app_primary][task:add_bio_phys_labor_factors_task][complete]* |*3220* |*0.916* |*0* |*86.0* |*1026.0* |*186.0* |*319* +|*[portal][bp:create_app_primary][start-with-form]* |*3218* |*0.915* |*0* |*115.0* |*981.0* |*211.0* |*329* +|*[portal][bp:create_app_expanse][task:sign-create-app-expanse][sign-form]* |*2850* |*0.811* |*0* |*377.0* |*2609.0* |*710.0* |*1058* +|*[portal][bp:create_app_expanse][task:sign-create-app-expanse][get-task]* |*2856* |*0.812* |*0* |*25.0* |*577.0* |*55.0* |*100* +|*[portal][bp:create_app_expanse][task:letter_data][get-task]* |*2852* |*0.811* |*0* |*25.0* |*575.0* |*54.0* |*97* +|*[portal][bp:create_app_expanse][task:decision_include][get-task]* |*2853* |*0.811* |*0* |*25.0* |*543.0* |*53.0* |*93* +|*[portal][bp:create_app_expanse][task:decision_include][complete]* |*2855* |*0.812* |*0* |*85.0* |*1049.0* |*186.0* |*314* +|*[portal][bp:create_app_expanse][task:create_app_expanse][get-task]* |*2856* |*0.812* |*0* |*39.0* |*716.0* |*90.0* |*165* +|*[portal][bp:create_app_expanse][task:create_app_expanse][complete]* |*2855* |*0.812* |*0* |*93.0* |*934.0* |*197.0* |*337* +|*[portal][bp:create_app_expanse][task:check_complience][get-task]* |*2854* |*0.812* |*0* |*25.0* |*909.0* |*55.0* |*94* +|*[portal][bp:create_app_expanse][task:check_complience][complete]* |*5709* |*1.624* |*0* |*85.0* |*1374.0* |*193.0* |*333* +|*[portal][bp:create_app_expanse][task:add_bio_phys_labor_factors_task][get-task]* |*2854* |*0.812* |*0* |*25.0* |*469.0* |*55.0* |*97* +|*[portal][bp:create_app_expanse][task:add_bio_phys_labor_factors_task][complete]* |*2856* |*0.812* |*0* |*92.0* |*1048.0* |*188.0* |*318* +|*[portal][bp:create_app_expanse][start-with-form]* |*2852* |*0.811* |*0* |*118.0* |*1032.0* |*214.0* |*335* +|*[portal][bp:create_app_exclude][task:sign-create-app-exclude][sign-form]* |*2470* |*0.703* |*0* |*415.0* |*2435.0* |*719.0* |*1081* +|*[portal][bp:create_app_exclude][task:sign-create-app-exclude][get-task]* |*2482* |*0.706* |*0* |*25.0* |*613.0* |*55.0* |*98* +|*[portal][bp:create_app_exclude][task:letter_data][get-task]* |*2480* |*0.705* |*0* |*26.0* |*561.0* |*55.0* |*98* +|*[portal][bp:create_app_exclude][task:letter_data][complete]* |*2483* |*0.706* |*0* |*87.0* |*941.0* |*188.0* |*313* +|*[portal][bp:create_app_exclude][task:create_app_exclude][get-task]* |*2482* |*0.706* |*0* |*38.0* |*571.0* |*94.0* |*172* +|*[portal][bp:create_app_exclude][task:create_app_exclude][complete]* |*2479* |*0.705* |*0* |*97.0* |*975.0* |*203.0* |*350* +|*[portal][bp:create_app_exclude][task:create_app_exclude_decision][get-task]* |*2483* |*0.706* |*0* |*25.0* |*547.0* |*56.0* |*100* +|*[portal][bp:create_app_exclude][task:create_app_exclude_decision][complete]* |*2481* |*0.706* |*0* |*93.0* |*947.0* |*198.0* |*339* +|*[portal][bp:create_app_exclude][task:create_app_exclude_check][get-task]* |*2478* |*0.705* |*0* |*23.0* |*693.0* |*56.0* |*98* +|*[portal][bp:create_app_exclude][task:create_app_exclude_check][complete]* |*2484* |*0.706* |*0* |*98.0* |*1344.0* |*207.0* |*348* +|*[portal][bp:create_app_exclude][start-with-form]* |*2475* |*0.704* |*0* |*101.0* |*1162.0* |*191.0* |*310* +|*[portal][bp:add_personnel][task:sign-personnel-data][get-task]* |*3549* |*1.009* |*0* |*22.0* |*907.0* |*53.0* |*93* +|*[portal][bp:add_personnel][task:fill-personnel-data][sign-form]* |*3548* |*1.009* |*0* |*359.0* |*2054.0* |*594.0* |*875* +|*[portal][bp:add_personnel][task:fill-personnel-data][get-task]* |*3544* |*1.008* |*0* |*24.0* |*505.0* |*52.0* |*92* +|*[portal][bp:add_personnel][task:fill-personnel-data][complete]* |*3548* |*1.009* |*0* |*101.0* |*1021.0* |*206.0* |*339* +|*[portal][bp:add_personnel][start-with-form]* |*3549* |*1.009* |*0* |*72.0* |*815.0* |*143.0* |*241* +|=== + +=== Використання ресурсів + +.Використання ЦП (CPU) +image::testing:perf-test/1-9-7/1500-1/img-3.png[] + +.Використання пам'яті +image::testing:perf-test/1-9-7/1500-1/img-4.png[] + +.Використання мережі +image::testing:perf-test/1-9-7/1500-1/img-5.png[] + +=== Аналіз помилок + +[width="100%",cols="21%,47%,12%,11%,9%",options="header",] +|=== +|*REQUEST NAME* |*URL* |*RESPONSE CODE* |*ERROR MESSAGE* |*COUNT* +|Util_sign | |NuN |[] |1 +|[portal][bp:create-subject][task:create-subject][sign-form] |https://officer-portal-volume-main.apps.perf-testing.mdtu-ddm.projects.epam.com/officer/api/user-task-management/officer/task/6f5551d7-905b-11ee-9fc5-0a580a800616/sign-form |409 |[] |1 +|=== + +Було знайдено 1 помилку. При аналізі було виявлено, що вона пов’язана з дублюванням тестових даних у запущених тестах продуктивності. Ця помилка не пов’язана з працездатністю реєстру. + +=== Висновки + +Платформа з [.underline]#`*1*` розгорнутим реєстром# атестованих лабораторій [.underline]#під навантаженням `*1500*`# користувачів протягом 1 години відпрацьовує з [.underline]#`*0.00%*` помилок# та залишається в межах виділених ресурсів. + +Відповідно до вимог, заданих оперативному реєстру, [.underline]#Платформа залишається у межах допустимих значень *_latency* (затримка) та *throughput_* _(пропускна здатність)_# для операцій читання та запису в продуктивні години роботи реєстру. + +NOTE: Цей тест демонструє приклад роботи реєстру при планованому повному навантаженні в робочий час. + +==== Значення затримки при повному навантаженні (95-й процентиль) + +* [*] [.underline]#Операції читання# даних з реєстру на рівні Дата Платформи (за переліком ключових полів, без запитів до сторонніх реєстрів) ~ `*43*` мс. +* [*] [.underline]#Операції запису# даних в реєстр на рівні Дата Платформи ~ `*916*` мс. + +==== Значення пропускної здатності при повному навантаженні + +* [*] [.underline]#Пропускна здатність для операцій читання# з реєстру на рівні Дата Платформи -- у межах `*117.702*` запитів/с. +* [*] [.underline]#Пропускна здатність для операції запису# даних в реєстр на рівні Дата Платформи -- у межах `*9.561*` запитів/с. +* [*] [.underline]#Пропускна здатність для операції запуску нових бізнес-процесів# -- у межах `*9.927*` запитів/с. +* [*] [.underline]#Пропускна здатність для операції виконання користувацьких задач без підпису# -- у межах `*17.997*` запитів/с. +* [*] [.underline]#Середня пропускна здатність# (усереднена для усіх типів запитів, включно з логіном, опрацюванням бізнес-процесів тощо) -- у межах `*298*` запитів/c. + +==== Загальна кількість операцій при повному навантаженні + +* [*] [.underline]#Загальна кількість операцій збереження даних до реєстру# -- `*33615*` запитів. +* [*] [.underline]#Загальна кількість виконаних бізнес-процесів# -- `*34907*` запитів. \ No newline at end of file diff --git a/docs/ua/modules/testing/pages/performance-testing/perf-report/1-9-7/perf-test-1-9-7.adoc b/docs/ua/modules/testing/pages/performance-testing/perf-report/1-9-7/perf-test-1-9-7.adoc new file mode 100644 index 0000000000..3f1b13041e --- /dev/null +++ b/docs/ua/modules/testing/pages/performance-testing/perf-report/1-9-7/perf-test-1-9-7.adoc @@ -0,0 +1,5 @@ += Тестування продуктивності Платформи 1.9.7 + +== Огляд секції + +* xref:performance-testing/perf-report/1-9-7/perf-test-1-9-7-1500-1.adoc[] diff --git a/docs/ua/modules/testing/pages/performance-testing/perf-report/perf-report-overview.adoc b/docs/ua/modules/testing/pages/performance-testing/perf-report/perf-report-overview.adoc index c45ca17cec..0e21076aa9 100644 --- a/docs/ua/modules/testing/pages/performance-testing/perf-report/perf-report-overview.adoc +++ b/docs/ua/modules/testing/pages/performance-testing/perf-report/perf-report-overview.adoc @@ -8,4 +8,5 @@ * xref:testing:performance-testing/perf-report/1-9-3/perf-test-1-9-3.adoc[] * xref:testing:performance-testing/perf-report/1-9-4/perf-test-1-9-4.adoc[] * xref:testing:performance-testing/perf-report/1-9-5/perf-test-1-9-5.adoc[] -* xref:testing:performance-testing/perf-report/1-9-6/perf-test-1-9-6.adoc[] \ No newline at end of file +* xref:testing:performance-testing/perf-report/1-9-6/perf-test-1-9-6.adoc[] +* xref:testing:performance-testing/perf-report/1-9-7/perf-test-1-9-7.adoc[] \ No newline at end of file diff --git a/docs/ua/modules/testing/pages/testing-overview.adoc b/docs/ua/modules/testing/pages/testing-overview.adoc index 3c1b26209b..53569e134f 100644 --- a/docs/ua/modules/testing/pages/testing-overview.adoc +++ b/docs/ua/modules/testing/pages/testing-overview.adoc @@ -22,10 +22,13 @@ include::platform:ROOT:partial$admonitions/language-ua.adoc[] * xref:testing:functional-testing/functional-testing.adoc[Функціональне тестування] * xref:testing:performance-testing/performance-testing.adoc[Тестування продуктивності] +** xref:testing:performance-testing/performance-baseline.adoc[] +** xref:testing:performance-testing/performance-preparation.adoc[] ** xref:testing:performance-testing/perf-report/perf-report-overview.adoc[] *** xref:testing:performance-testing/perf-report/1-9-2/perf-test-1-9-2.adoc[] *** xref:testing:performance-testing/perf-report/1-9-3/perf-test-1-9-3.adoc[] *** xref:testing:performance-testing/perf-report/1-9-4/perf-test-1-9-4.adoc[] *** xref:testing:performance-testing/perf-report/1-9-5/perf-test-1-9-5.adoc[] *** xref:testing:performance-testing/perf-report/1-9-6/perf-test-1-9-6.adoc[] +*** xref:testing:performance-testing/perf-report/1-9-7/perf-test-1-9-7.adoc[] * xref:testing:security-testing/security-testing.adoc[Тестування безпеки] \ No newline at end of file diff --git a/docs/ua/modules/testing/partials/nav.adoc b/docs/ua/modules/testing/partials/nav.adoc index 82657948eb..387dd0b252 100644 --- a/docs/ua/modules/testing/partials/nav.adoc +++ b/docs/ua/modules/testing/partials/nav.adoc @@ -15,4 +15,6 @@ ***** xref:testing:performance-testing/perf-report/1-9-5/perf-test-1-9-5-1500-8.adoc[] **** xref:testing:performance-testing/perf-report/1-9-6/perf-test-1-9-6.adoc[] ***** xref:testing:performance-testing/perf-report/1-9-6/perf-test-1-9-6-1500-1.adoc[] +**** xref:testing:performance-testing/perf-report/1-9-7/perf-test-1-9-7.adoc[] +***** xref:testing:performance-testing/perf-report/1-9-7/perf-test-1-9-7-1500-1.adoc[] ** xref:testing:security-testing/security-testing.adoc[Тестування безпеки] \ No newline at end of file diff --git a/docs/ua/modules/user/images/cp-auth-10.png b/docs/ua/modules/user/images/cp-auth-10.png new file mode 100644 index 0000000000..78438fb3a7 Binary files /dev/null and b/docs/ua/modules/user/images/cp-auth-10.png differ diff --git a/docs/ua/modules/user/images/cp-auth-11.png b/docs/ua/modules/user/images/cp-auth-11.png new file mode 100644 index 0000000000..30773392cd Binary files /dev/null and b/docs/ua/modules/user/images/cp-auth-11.png differ diff --git a/docs/ua/modules/user/images/cp-auth-12.png b/docs/ua/modules/user/images/cp-auth-12.png new file mode 100644 index 0000000000..9538040281 Binary files /dev/null and b/docs/ua/modules/user/images/cp-auth-12.png differ diff --git a/docs/ua/modules/user/images/cp-auth-13.png b/docs/ua/modules/user/images/cp-auth-13.png new file mode 100644 index 0000000000..9bcfdae147 Binary files /dev/null and b/docs/ua/modules/user/images/cp-auth-13.png differ diff --git a/docs/ua/modules/user/images/cp-auth-9.png b/docs/ua/modules/user/images/cp-auth-9.png new file mode 100644 index 0000000000..2b8de7a00f Binary files /dev/null and b/docs/ua/modules/user/images/cp-auth-9.png differ diff --git a/docs/ua/modules/user/images/user-auth/user-auth-idgovua-10.png b/docs/ua/modules/user/images/user-auth/user-auth-idgovua-10.png new file mode 100644 index 0000000000..9d63f416c4 Binary files /dev/null and b/docs/ua/modules/user/images/user-auth/user-auth-idgovua-10.png differ diff --git a/docs/ua/modules/user/images/user-auth/user-auth-idgovua-11.png b/docs/ua/modules/user/images/user-auth/user-auth-idgovua-11.png new file mode 100644 index 0000000000..9fbde078cd Binary files /dev/null and b/docs/ua/modules/user/images/user-auth/user-auth-idgovua-11.png differ diff --git a/docs/ua/modules/user/images/user-auth/user-auth-idgovua-12.png b/docs/ua/modules/user/images/user-auth/user-auth-idgovua-12.png new file mode 100644 index 0000000000..365d8d8b4a Binary files /dev/null and b/docs/ua/modules/user/images/user-auth/user-auth-idgovua-12.png differ diff --git a/docs/ua/modules/user/images/user-auth/user-auth-idgovua-13.png b/docs/ua/modules/user/images/user-auth/user-auth-idgovua-13.png new file mode 100644 index 0000000000..ce17ae7cb9 Binary files /dev/null and b/docs/ua/modules/user/images/user-auth/user-auth-idgovua-13.png differ diff --git a/docs/ua/modules/user/images/user-auth/user-auth-idgovua-14.png b/docs/ua/modules/user/images/user-auth/user-auth-idgovua-14.png new file mode 100644 index 0000000000..3602ce974c Binary files /dev/null and b/docs/ua/modules/user/images/user-auth/user-auth-idgovua-14.png differ diff --git a/docs/ua/modules/user/images/user-auth/user-auth-idgovua-15.png b/docs/ua/modules/user/images/user-auth/user-auth-idgovua-15.png new file mode 100644 index 0000000000..a5a5d12204 Binary files /dev/null and b/docs/ua/modules/user/images/user-auth/user-auth-idgovua-15.png differ diff --git a/docs/ua/modules/user/images/user-auth/user-auth-idgovua-16.png b/docs/ua/modules/user/images/user-auth/user-auth-idgovua-16.png new file mode 100644 index 0000000000..9a1321a9fc Binary files /dev/null and b/docs/ua/modules/user/images/user-auth/user-auth-idgovua-16.png differ diff --git a/docs/ua/modules/user/images/user-auth/user-auth-idgovua-17.png b/docs/ua/modules/user/images/user-auth/user-auth-idgovua-17.png new file mode 100644 index 0000000000..d2063b2cd1 Binary files /dev/null and b/docs/ua/modules/user/images/user-auth/user-auth-idgovua-17.png differ diff --git a/docs/ua/modules/user/images/user-auth/user-auth-idgovua-18.png b/docs/ua/modules/user/images/user-auth/user-auth-idgovua-18.png new file mode 100644 index 0000000000..b035015182 Binary files /dev/null and b/docs/ua/modules/user/images/user-auth/user-auth-idgovua-18.png differ diff --git a/docs/ua/modules/user/images/user-auth/user-auth-idgovua-4-1.png b/docs/ua/modules/user/images/user-auth/user-auth-idgovua-4-1.png deleted file mode 100644 index cefdf4cc6c..0000000000 Binary files a/docs/ua/modules/user/images/user-auth/user-auth-idgovua-4-1.png and /dev/null differ diff --git a/docs/ua/modules/user/images/user-auth/user-auth-idgovua-9.png b/docs/ua/modules/user/images/user-auth/user-auth-idgovua-9.png new file mode 100644 index 0000000000..193f8c484f Binary files /dev/null and b/docs/ua/modules/user/images/user-auth/user-auth-idgovua-9.png differ diff --git a/docs/ua/modules/user/pages/citizen-officer-portal-auth.adoc b/docs/ua/modules/user/pages/citizen-officer-portal-auth.adoc index 5895807165..22d5cbab93 100644 --- a/docs/ua/modules/user/pages/citizen-officer-portal-auth.adoc +++ b/docs/ua/modules/user/pages/citizen-officer-portal-auth.adoc @@ -1,4 +1,4 @@ -= Автентифікація користувачів реєстру += Автентифікація користувачів реєстру та підпис даних include::platform:ROOT:partial$templates/document-attributes/default-set-ua.adoc[] include::platform:ROOT:partial$admonitions/language-ua.adoc[] @@ -73,9 +73,10 @@ include::platform:ROOT:partial$admonitions/language-ua.adoc[] Якщо користувач заведений у Keycloak як `fullName: "Маряна-Іриna Сергіївна"`, а у КЕП вказано `fullName: "Мар'яна-Іриna Сергіївна!%?"`, то користувач зможе пройти автентифікацію та увійти до Кабінету. ==== +== Автентифікація через IIT-віджет [#kep-auth] -== Автентифікація за допомогою КЕП +=== Автентифікація за допомогою КЕП Автентифікація користувачів за допомогою [.underline]#кваліфікованого електронного підпису (КЕП)# відбувається з використанням встановленого на стороні браузера стороннього віджета https://iit.com.ua/downloads[IIT] для виконання операцій, що вимагають шифрування та підпису даних, а також сервісу для роботи з КЕП, що використовує окрему криптобібліотеку від IIT на стороні Платформи для перевірки цілісності та незмінності даних, що передаються з вебклієнта. @@ -87,13 +88,12 @@ include::platform:ROOT:partial$admonitions/language-ua.adoc[] CAUTION: Автентифікація з КЕП доступна для користувачів Кабінетів посадової особи та отримувача послуг реєстру. - -=== Передумови +==== Передумови Отримайте особистий ключ для підпису даних в одному з https://czo.gov.ua/ca-registry[акредитованих центрів сертифікації ключів (АЦСК)]. Відкритий ключ зберігатиметься на сервері постачальника, в той час, як секретний (закритий) ключ необхідно буде зберегти на одному із захищених носіїв, доступних для використання при вході до системи за допомогою КЕП (_див. крок 3 в підрозділі xref:auth-process-pass[]_). [#auth-process-pass] -=== Проходження автентифікації +==== Проходження автентифікації NOTE: Процес автентифікації за допомогою КЕП є ідентичним як для посадових осіб, так і для отримувачів послуг реєстру. @@ -135,7 +135,7 @@ image:user:cp-auth-3.png[] . Оберіть особистий ключ: * У полі `Особистий ключ` натисніть kbd:[Обрати]. -* Знайдіть особистий ключ (наприклад `Key-6.dat`) та натисніть kbd:[Open] для підтвердження. +* Знайдіть особистий ключ (наприклад `key-6.dat`) та натисніть kbd:[Open] для підтвердження. + image:user:cp-auth-4.png[] @@ -172,6 +172,36 @@ image:user:cp-auth-8-wrong-credentials.png[] NOTE: У Кабінеті посадової особи процес онбордингу не передбачений. Тому перед входом до Кабінету необхідно переконатися, що адміністратор доступу створив відповідного користувача. +[#cloud-key] +=== Автентифікація за допомогою хмарного ключа + +NOTE: Опція автентифікації за допомогою хмарного ключа доступна як _надавачам,_ так й отримувачам послуг, які мають в наявності хмарний ключ. + +. Відкрийте логін-сторінку вашого Кабінету та перейдіть до опцій автентифікації. +. Для вибору автентифікації з використанням хмарного ключа, оберіть на віджеті _Носій у складі сервісу_. ++ +TIP: Для деяких віджетів це значення відображається із назвою _Хмарний ключ_ або _Хмарне сховище (як-от для id.gov.ua)_. ++ +image:user:cp-auth-9.png[] + +. Оберіть емітента (видавця) хмарного ключа з випадного списку у полі _Тип сервісу підпису_. Наприклад, `DepositSign - хмарний підпис`. ++ +image:user:cp-auth-10.png[] + +. Залежно від значення, яке було обрано в полі _Тип сервісу підпису_, на екрані відобразиться або _QR-код для сканування_, або _ідентифікатор користувача_. ++ +.QR-код для сканування +image::user:cp-auth-11.png[] ++ +.Ідентифікатор користувача +image::user:cp-auth-12.png[] + +. У обох випадках процес подальшого підтвердження автентифікації здійснюється через мобільний телефон. Для автентифікації з використанням ключа від DepositSign необхідно ввести ідентифікатор. Після цього на мобільний телефон користувача надсилається повідомлення з проханням підтвердити дію. Якщо підтвердження успішне, з’являється сторінка входу до кабінету, де необхідно знову виконати процедуру підтвердження. ++ +image::user:cp-auth-13.png[] + +. Після цього користувач успішно автентифікується у Кабінеті. + [#auth-id-gov-ua] == Автентифікація з ID.GOV.UA @@ -186,23 +216,22 @@ TIP: Для отримання деталей підключення та вик [#auth-officers] === Автентифікація посадових осіб (надавачів послуг) -. Найперше, виконайте xref:#auth-step-1[крок 1] та xref:#auth-step-1[крок 2] у попередньому розділі цього документа. -. Натисніть на відповідний елемент для автентифікації з ID.GOV.UA: +. Відкрийте логін-сторінку вашого Кабінету та перейдіть до опцій автентифікації. +. Натисніть на відповідний елемент для автентифікації з ID.GOV.UA. + - image:user:cp-auth-idgovua-1.png[] . Оберіть вхід за допомогою [.underline]#Електронного підпису#. + image:user-auth/user-auth-idgovua-4-02.png[] -. Оберіть метод автентифікації -- [.underline]#Файловий носій#. +. Оберіть метод автентифікації -- [.underline]#Файловий носій# або [.underline]#Хмарний ключ#. + -[IMPORTANT] +[TIP] ==== -Посадові особи можуть автентифікуватися лише через файловий носій. +Посадові особи можуть автентифікуватися як через _файловий носій_, так і _хмарний ключ_. -TIP: Файловий носій – це спеціальний файл, який містить ваш особистий ключ. +Файловий носій – це спеціальний файл, який містить ваш особистий ключ. Зазвичай цей файл має назву `*Key-6*` з розширенням `*.dat` (зустрічаються також розширення *.pfx, *.pk8, *.zs2, *.jks). ==== + @@ -219,23 +248,35 @@ image:user-auth/user-auth-idgovua-3.png[] + У разі успішного зчитування ключа та проходження автентифікації, посадова особа зможе увійти до Кабінету. +[#citizen-portal-auth] === Автентифікація отримувачів послуг -. Увійдіть до Кабінету отримувача послуг (_див. xref:#auth-step-1[крок 1] та xref:#auth-step-1[крок 2] цього документа_). +[NOTE] +==== +Автентифікація за допомогою `id.gov.ua` доступна як фізичним особам, так і представникам бізнесу, зокрема: -. Оберіть опцію [.underline]#Для громадян#. +. Автентифікація з використанням методу КЕП доступна користувачам ФОП та представникам ФОП та ЮО. + -image:user:user-auth/user-auth-idgovua-4-01.png[] -+ -[IMPORTANT] -==== -Автентифікація з id.gov.ua можлива лише _ДЛЯ ГРОМАДЯН_. Якщо ви представник бізнесу, то зможете увійти до Кабінету лише з КЕП. + -Фізичним особам доступні обидві опції для автентифікації: КЕП та id.gov.ua. +Процес автентифікації представників бізнесу є аналогічним процесу для фізичних осіб і описаний у розділі xref:#kep-auth[] для випадку, коли користувач обирає _Файловий носій_. + +. Автентифікація з використанням *Bank-ID* доступна також користувачам-ФОП і є аналогічною процесу для фізичних осіб, описаному у розділі xref:#auth-bank-id[]. + +. Автентифікація з _Дія.Підпис_ доступна також користувачам-ФОП. Детальніше описано у розділі xref:#auth-dia-signature[]. + +Зверніть увагу, що користувач більше не може обирати спосіб автентифікації на одній сторінці. В один момент часу доступний лише один з двох способів автентифікації, налаштований адміністратором реєстру -- IIT-віджет або id.gov.ua. ==== +Процес автентифікації є наступним: :: +. Відкрийте логін-сторінку вашого Кабінету та перейдіть до опцій автентифікації. ++ +image:user:cp-auth-1.png[] + +. Оберіть опцію [.underline]#Для громадян# або [.underline]#Для бізнесу#. + . Автентифікуйтеся через віджет `*ID.GOV.UA*`. + -image:user:user-auth/user-auth-idgovua-4-1.png[] +.Автентифікація через id.gov.ua +image::registry-develop:registry-admin/cp-auth-setup-citizens/cp-auth-setup-citizens-08.png[] . Оберіть бажану схему (спосіб) автентифікації. + @@ -258,15 +299,47 @@ NOTE: Уся обробка даних відбувається на сторо Електронний підпис є аналогом власноручного підпису та забезпечує правдивість і цілісність інформації, викладеної у документі, а також дає змогу підтвердити цілісність електронного документа та ідентифікувати особу, яка підписала документ. -. Увійдіть за допомогою електронного підпису. +image:user:user-auth/user-auth-idgovua-5.png[] + +. Оберіть опцію _Увійти за допомогою електронного підпису_. . Оберіть тип ключа, яким ви хочете підписати дані: -* Файловий носій -* Токен -* Хмарне сховище -* ID-картка +* _Файловий носій_ -- це спеціальний файл, який містить ваш особистий ключ. Зазвичай цей файл має назву Key-6 з розширенням _*.dat_ (зустрічаються також розширення _*.pfx_, _*.pk8_, _*.zs2_, _*.jks_). ++ +image:user:user-auth/user-auth-idgovua-10.png[] ++ +TIP: Автентифікація з цим методом є аналогічною до описаної до у розділі xref:#kep-auth[]. + +* _Хмарне сховище_ -- якщо ваш особистий ключ зберігається за допомогою стороннього сервісу (зберігання у захищеному хмарному сховищі), то для зчитування ключа необхідно обрати свого надавача зі списку та пройти авторизацію у його системі. ++ +image:user:user-auth/user-auth-idgovua-12.png[] -image:user:user-auth/user-auth-idgovua-5.png[] +* _Токен_ -- метод автентифікації за допомогою апаратно-програмного пристрою, який працює на базі криптобібліотеки. На Платформі можливим варіантом використання токена ++ +[TIP] +==== +.Що таке токен? +[%collapsible] +===== +Токен -- це спеціальний апаратно-програмний пристрій, який захищає особисті ключі від копіювання чи зміни зловмисниками. Токен може мати форму USB-пристрою або у формі смарткартка (картки з чипом). Прикладами токенів є пристрої _Алмаз-1К_, _Кристал-1_, `Гряда 301` тощо. + +Щоб скористатися токеном: + +1. Під'єднайте ваш токен через USB-порт (_якщо у вас токен у формі USB-пристрою_) або скористатися спеціальним зчитувачем інформації (_якщо у вас токен у формі смарткартка_). + +2. Оберіть зі списку свого надавача електронних довірчих послуг -- суб'єкта, до якого ви зверталися для отримання електронного підпису. + +3. Зі списку токенів оберіть тип пристрою, який ви хочете використати. + +4. Вкажіть пароль доступу до особистого ключа у відповідному полі. +===== +==== ++ +image:user:user-auth/user-auth-idgovua-11.png[] + +* _ID-картка_ _(Не використовується)_ + +. Виконайте усі необхідні кроки, після чого ви зможете увійти до Кабінету. [#auth-bank-id] ==== Автентифікація з BankID НБУ @@ -288,15 +361,85 @@ image:user:user-auth/user-auth-idgovua-7.png[] Отримати особистий ключ віддалено за допомогою мобільного застосунку Дія мають можливість громадяни України, які є власниками ID-картки або біометричного закордонного паспорта. -Щоб авторизуватися на сайті за допомогою Дія ID, вам необхідно: +Щоб авторизуватися на сайті за допомогою Дія ID: -1. Відсканувати QR-код. +. Проскануйте QR-код. -2. Зчитати особистий ключ шляхом сканування обличчя (перевірки за фото) та вводу пароля до особистого ключа. +. Зчитайте особистий ключ шляхом сканування обличчя (перевірки за фото) та вводу пароля до особистого ключа. -3. У разі успішної автентифікації у мобільному застосунку Дія, система передає ваші персональні дані, що дозволить вас ідентифікувати. +. У разі успішної автентифікації у мобільному застосунку Дія, система передає ваші персональні дані, що дозволить вас ідентифікувати. + image:user:user-auth/user-auth-idgovua-8.png[] ++ +image:user:user-auth/user-auth-idgovua-9.png[] + +== Підпис даних + +=== Підпис даних хмарним ключем через IIT-віджет + +NOTE: Опція автентифікації хмарним ключем доступна для користувачів обох типів кабінетів, умовою є наявність хмарного ключа у користувача. + +Процес підпису даних за допомогою хмарного ключа на віджеті виконується за тією ж схемою, що й автентифікація через IIT-віджет із використанням хмарного ключа (_див. детальніше xref:#cloud-key[]_). + +=== Підпис даних хмарним ключем через віджет ID.GOV.UA + +Отримувачі послуг, зокрема фізичні особи та ФОП можуть підписувати дані, перейшовши на сторінку id.gov.ua. Після переходу цим користувачам доступні такі опції: + +. Використання _КЕП_ +. Використання _хмарного ключа_ +. Використання _Дія.Підпис_ + +==== Використання КЕП для підпису даних + +. При переході на задачу підписання даних у бізнес-процесі, користувачам відображається наступний віджет: ++ +image:user:user-auth/user-auth-idgovua-13.png[] + +. Оберіть опцію _Електронного підпису_. Далі відбувається перехід на сторінку id.gov.ua. ++ +image:user:user-auth/user-auth-idgovua-14.png[] + +. Оберіть значення _Файловий_, додайте особистий ключ та пароль до нього. Натисніть кнопку `Зчитати`. ++ +image:user:user-auth/user-auth-idgovua-15.png[] + +. Відбувається зчитування даних з ключа та перехід на сторінку для підпису даних. ++ +image:user:user-auth/user-auth-idgovua-16.png[] + +. Натисніть `Підписати`, дані успішно підписано. + +==== Використання хмарного ключа для підпису даних + +. При переході на задачу підписання даних у бізнес-процесі, користувачам відображається наступний віджет. ++ +image:user:user-auth/user-auth-idgovua-13.png[] + +. Оберіть опцію _Електронного підпису_. Далі відбувається перехід на сторінку id.gov.ua. + +. Оберіть значення _Хмарний_, тип сервісу підпису та, залежно від обраного значення, або внесіть ідентифікатор, або проскануйте QR-код. Натисніть кнопку `Зчитати`. ++ +image:user:user-auth/user-auth-idgovua-17.png[] ++ +NOTE: Обидві дії потребують підтвердження за допомогою мобільного телефона. Після цього відображається сторінка для підпису даних, де потрібно натиснути кнопку `Підписати` і ще раз підтвердити дію за допомогою мобільного телефону. ++ +image:user:user-auth/user-auth-idgovua-16.png[] + +==== Використання Дія.Підпис для підпису даних + +. У випадку, коли адміністратор реєстру вже налаштував у Control Plane у розділі _Віджет підпису документів,_ зокрема у полі _Посилання_, адресу віджета id.gov.ua (наприклад, https://id.gov.ua/sign-widget/v20220527/[]), отримувач послуг -- будь-то фізична особа чи ФОП -- при підписі даних побачить наступний екран: ++ +image:user:user-auth/user-auth-idgovua-13.png[] + +. Проскануйте QR-код через мобільний додаток Дія. Відбувається підтвердження підпису. ++ +image:user:user-auth/user-auth-idgovua-18.png[] + +. На наступній сторінці натисніть `Підписати`. ++ +image:user:user-auth/user-auth-idgovua-16.png[] + +. Тепер повторно підтвердьте підписання даних, ще раз просканувавши QR-код через мобільний додаток _Дія_. Після цього дані будуть успішно підписані. == Пов'язані сторінки diff --git a/site-en-github.yaml b/site-en-github.yaml index fb29fdd7ec..9770e32f90 100644 --- a/site-en-github.yaml +++ b/site-en-github.yaml @@ -10,7 +10,7 @@ runtime: content: sources: - url: ./ - branches: HEAD + branches: ["1.9.6-docs", "main"] start_path: docs/en output: diff --git a/site-en.yaml b/site-en.yaml index e015a17f83..812a5405ed 100644 --- a/site-en.yaml +++ b/site-en.yaml @@ -7,7 +7,7 @@ runtime: content: sources: - url: https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/mdtu-ddm/general/ddm-architecture - branches: ["1.9.4-docs", "1.9.5-docs", "master"] + branches: ["1.9.6-docs"] start_path: docs/en output: diff --git a/site-ua-github.yaml b/site-ua-github.yaml index ecf326884a..2fff99a3b9 100644 --- a/site-ua-github.yaml +++ b/site-ua-github.yaml @@ -10,7 +10,7 @@ runtime: content: sources: - url: ./ - branches: HEAD + branches: ["1.9.6-docs", "main"] start_path: docs/ua output: diff --git a/site-ua.yaml b/site-ua.yaml index b599f978ee..4182194fec 100644 --- a/site-ua.yaml +++ b/site-ua.yaml @@ -7,65 +7,8 @@ runtime: content: sources: - url: https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/mdtu-ddm/general/ddm-architecture - branches: ["1.9.3-docs", "1.9.4-docs", "1.9.5-docs", "master"] + branches: ["1.9.6.1-docs", "master"] start_path: docs/ua - - url: https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/mdtu-ddm/data-architecture/libraries/service-generation-utility - branches: ["1.9.3-docs"] - start_path: docs - - url: https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/mdtu-ddm/data-architecture/application/template-rest-api - branches: ["1.9.3-docs"] - start_path: docs - - url: https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/mdtu-ddm/data-architecture/application/template-kafka-api - branches: ["1.9.3-docs"] - start_path: docs - - url: https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/mdtu-ddm/data-architecture/libraries/data-model - branches: ["1.9.3-docs"] - start_path: docs - - url: https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/mdtu-ddm/general/keycloak-ds-officer-authenticator - branches: ["1.9.3-docs"] - start_path: docs - - url: https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/mdtu-ddm/low-code-platform/platform/backend/applications/digital-signature-ops - branches: ["1.9.3-docs"] - start_path: docs - - url: https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/mdtu-ddm/low-code-platform/platform/backend/applications/digital-document-service - branches: ["1.9.3-docs"] - start_path: docs - - url: https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/mdtu-ddm/low-code-platform/platform/backend/applications/user-task-management - branches: ["1.9.3-docs"] - start_path: docs - - url: https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/mdtu-ddm/low-code-platform/platform/backend/applications/user-process-management - branches: ["1.9.3-docs"] - start_path: docs - - url: https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/mdtu-ddm/low-code-platform/platform/backend/applications/bp-admin-portal - branches: ["1.9.3-docs"] - start_path: docs - - url: https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/mdtu-ddm/low-code-platform/platform/business-process-modeler-extensions - branches: ["1.9.3-docs"] - start_path: docs - - url: https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/mdtu-ddm/low-code-platform/platform/backend/utilities/camunda-auth-cli - branches: [ "1.9.3-docs"] - start_path: docs - - url: https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/mdtu-ddm/low-code-platform/platform/backend/applications/bpms - branches: [ "1.9.3-docs"] - start_path: docs - - url: https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/mdtu-ddm/low-code-platform/platform/frontend/applications/common-web-app - branches: [ "1.9.3-docs"] - start_path: docs - - url: https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/mdtu-ddm/low-code-platform/platform/backend/applications/registry-regulation-management - branches: [ "1.9.3-docs"] - start_path: docs - - url: https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/mdtu-ddm/infrastructure/backup-management - branches: ["1.9.3-docs"] - start_path: docs - - url: https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/mdtu-ddm/low-code-platform/platform/backend/low-code-platform-maven-tiles - branches: ["1.9.3-docs"] - start_path: docs - - url: https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/mdtu-ddm/low-code-platform/platform/backend/applications/form-submission-validation - branches: ["1.9.3-docs"] - start_path: docs - - url: https://gerrit-mdtu-ddm-edp-cicd.apps.cicd2.mdtu-ddm.projects.epam.com/mdtu-ddm/data-architecture/libraries/liquibase-ddm-ext - branches: ["1.9.3-docs"] - start_path: docs output: clean: true diff --git a/supplemental-ui/static/css/custom-site.css b/supplemental-ui/static/css/custom-site.css index 68ffaac31a..4370d044b1 100644 --- a/supplemental-ui/static/css/custom-site.css +++ b/supplemental-ui/static/css/custom-site.css @@ -63,3 +63,11 @@ footer.footer p { #search-field svg { margin-right: 4px; } + +.nav-item.is-active>a.nav-link { + color: #1565c0; +} + +.nav-item.is-active>span.nav-text { + color: #1565c0; +} \ No newline at end of file