kubectl create -f <WORKDIR>/create_svc_secret.yaml

kubectl create -f /workdir/OIRI/create_svc_secret.yaml

apiVersion: v1
kind: Secret
type: kubernetes.io/service-account-token
metadata:
 name: oaa-service-account
 namespace: <OAANS>
 annotations:
  kubernetes.io/service-account.name: "oaa-service-account"

OAANS=oaans
WORKDIR=/workdir/OAA

TOKENNAME=oaa-service-account

OAANS=oaans
WORKDIR=/workdir/OAA
TOKEN=`kubectl -n $OAANS get secret $TOKENNAME -o jsonpath='{.data.token}'| base64 --decode`
K8URL=`grep server: $KUBECONFIG | sed 's/server://;s/ //g'`

kubectl config --kubeconfig=$WORKDIR/oaa_config set-cluster oaa-cluster --server=$K8URL --certificate-authority=$WORKDIR/ca.crt --embed-certs=true

kubectl config --kubeconfig=$WORKDIR/oaa_config set-credentials oaa-service-account --token=$TOKEN

kubectl config --kubeconfig=$WORKDIR/oaa_config set-context oaa --user=oaa-service-account --cluster=oaa-cluster

kubectl config --kubeconfig=$WORKDIR/oaa_config use-context oaa

OAANS=oaans
WORKDIR=/workdir/OAA

kubectl cp $WORKDIR/ca.crt $OAANS/oaa-mgmt:/u01/oracle/scripts/creds

kubectl cp $WORKDIR/oaa_config $OAANS/oaa-mgmt:/u01/oracle/scripts/creds/k8sconfig

chmod 400 /u01/oracle/scripts/creds/k8sconfig

kubectl get pod -n $OAANS

kubectl get pod -n oaans

echo -n <LDAP_OAMADMIN_USER>:<LDAP_USER_PWD> | base64

echo -n oamadmin:mypassword | base64

##################################### 1. Common Deployment configuration#########################################
#Common configuration options
#If enabled and set to true, helm installation will only display generated values and will not actually perform the installation.
#common.dryrun=true
#Name of the helm deployment. It is unique per kubernetes cluster and namespace. Should be all lowercase.
common.deployment.name=edg
#Override file to override any char values. Must be in yaml format.
common.deployment.overridefile=/u01/oracle/scripts/settings/oaaoverride.yaml
#Kubernetes context if there are multiple contexts available
#common.kube.context=idmoci
#Kubernetes deployment namespace where all the services will be installed.
common.kube.namespace=oaans
#Certificate store used in all the services 
common.deployment.sslcert=/u01/oracle/scripts/creds/cert.p12
#Trust store used in all the services
common.deployment.trustcert=/u01/oracle/scripts/creds/trust.p12
#Passphrase for cert.p12 file. If the value for the passphrase is not present in properties below, it will be prompted during installation.
common.deployment.keystorepassphrase=myPassword
#Passphrase for trust.p12 file. If the value for the passphrase is not present in properties below, it will be prompted during installation.
common.deployment.truststorepassphrase=myPassword
#If the flag is enabled then trust certificate in the JRE truststore
common.deployment.importtruststore=true
#The flag to disable the generation of secret in the keystore provided in the property common.deployment.sslcert. Following secret keys are generated and are required for installation to work which can also be pre-seeded in the keystore.
#spui-enckey , aes256_config_key_alias and aes256_db_key_alias
common.deployment.generate.secret=true
#Deployment mode. Possible values are OAA, Risk or Both. Default mode is Both which will install OAA integrated with Risk. 
common.deployment.mode=Both
#Base64 encoded config key from the migrating system. If enabled the value will be placed in the vault and used for migration of legacy data
#common.migration.configkey=
#Base64 encoded db key from the migrating system. If enabled the value will be placed in the vault and used for migration of db data.
#common.migration.dbkey=
#If the integation is required with OIM set the following property to true. This also enables the forgot password functionality.  
#common.oim.integration=true
#Key for Apple push notification service. Only needed when push factor is enabled.
#common.deployment.push.apnsjksfile=
#Deprecated. By default policy snapshot import is not enabled. Kindly refer document to import it post installation.
common.deployment.import.snapshot=true
##################################### 2. Database configuration#########################################
# Database setting for OAA
#The installation supports the following ways to install and configure the database:
#1. Installing database along with installing services on kubernetes cluster 
#2. Installing database outside the installation of services and providing the database configuration below.
#In case of 2, set database.createschema=false
#If set to true schema will be created along with the installation.
database.createschema=true
#Host IP or name where Oracle DB is running. If hostname is provided then it should be resolvable from the container.
database.host=db-scan.example.com
#Database port 
database.port=1521
#Database sysdba user required to create the schema. If database.createschema is set to false, the property is not required.
database.sysuser=sys
#Sys password will not be prompted if value is provided for the property database.syspassword. If database.createschema is set to false, the property is not required.
database.syspassword=sysPassword
#Schema name to be created in the database. The value is required.
database.schema=EDG_OAA
#Name of the tablespace. If database.createschema is set to false, the property is not required.
database.tablespace=EDG_OAA_TBS
#Schema password will not be prompted if value is provided for the property database.schemapassword
database.schemapassword=schemaPassword
#Database service name 
database.svc=edgoaa.example.com
#Name of the database. In case of OCI database service, the name is present in the OCI console. If name is not present, use value of database.svc property.
database.name=iamdb1

##################################### 3. OAUTH configuration#########################################
#Oauth setting for OAA. Oauth is required for enabling spui , admin and fido.
# If oauth.enabled is set as false, install.spui.enabled , install.oaa-admin-ui.enabled and install.fido.enabled should also be set to false otherwise helm installation
# will fail. Setting the property to true enables OAM Oauth integration during installation of services.
oauth.enabled=true
#Create OAuth Domain in OAM
oauth.createdomain=true
#Create OAuth Resource in OAM 
oauth.createresource=true
#Create OAuth client in OAM
oauth.createclient=true
#OAuth domain name used when creating the OAuth domain in OAM
oauth.domainname=OAADomain
#OAuth domain identity provider configured for OAuth in OAM
oauth.identityprovider=OAMIDSTORE
#OAuth client name
oauth.clientname=OAAClient
#Grants for OAuth client created during installation. CLIENT_CREDENTIALS is required for validation to pass.
oauth.clientgrants="PASSWORD","CLIENT_CREDENTIALS","JWT_BEARER","REFRESH_TOKEN","AUTHORIZATION_CODE","IMPLICIT"
#OAuth Client Type of new OAuth client
oauth.clienttype=PUBLIC_CLIENT
#Client password must conform to regex ^[a-zA-Z0-9.\-\/+=@_ ]*$ with a maximum length of 500
oauth.clientpassword=myPassword
#OAuth resouce name for new OAuth resource
oauth.resourcename=OAAResource
#Default score of OAuth resource
oauth.resourcescope=viewResource
#Post authentication redirecturl is required. Used for validating configuration of OAuth services in OAM by generating a access token.
oauth.redirecturl=https://login.example.com:443
#Application id protected by oauth. The value can be any valid string. It is required to setup runtime integration between OAM and OAA.  
oauth.applicationid=edg
#OAM Admin URL where OAuth API are enabled.
oauth.adminurl=http://accessdomain-adminserver.oamns.svc.cluster.local:7001
#Base64 encoded authorization header of OAM Admin server
oauth.basicauthzheader=EncodedOAMPassord
#OAM Managed server providing runtime support for OAuth Services
oauth.identityuri=https://login.example.com:443

##################################### 4. Vault configuration#########################################
#Following vaules are possible for vault.provider : oci , fks
#If oci is the provider the oci related configuration may be required to perform the vault initialization
#Name to be used in vault for this deploymemt. If name is already present in the vault, it will be reused.
vault.deploy.name=oaavault
#Flag to control the vault creation. If vault is initialized outside the installation, it should be set to false.
vault.create.deploy=true
#Provider type of vault. Supported provider types are oci, fks.
vault.provider=fks

#oci vault configuration required for the vault. Check vault documentation on how to obtain value for following properties.
#vault.oci.uasoperator=
#vault.oci.tenancyId=
#vault.oci.userId=
#vault.oci.fpId=
#vault.oci.compartmentId=
#vault.oci.vaultId=
#vault.oci.keyId=

#fks related configuration. Check the documentation on how to obtain value for properties below.
#NFS server ip or resolvable hostname. 
vault.fks.server=dbdevfssmnt-shared01.dev2fss1iad.databasede2iad.oraclevcn.com
#Path on NFS server to be mapped to folder in the running containers.
vault.fks.path=/export/IAMPVS/oaavaultpv
#Base64 encoded vault password.
vault.fks.key=TWFuYWdlcjE=
#The value in this property need to be same as the value passed through the helm chart. Do not change it
vault.fks.mountpath=/u01/oracle/service/store/oaa

##################################### 5. Chart configuration#########################################
#Note: Any property  that starts with install. will be provided as input to the helm chart using --set parameter.
#Container image repositories where the images can be pulled by the cluster nodes.
install.global.repo=iad.ocir.io/mytenancy
#Kubernetes secret reference to be used while pulling the docker images from the protected docker registries.
install.global.imagePullSecrets\[0\].name=regcred
install.global.imagePullSecrets\[1\].name=gitcred
#Chart Database properties
install.riskdb.service.type=ExternalName
#Image tags to be used
install.global.image.tag=12.2.1.4.1_20220419
#Oauth logout URL
install.global.oauth.logouturl=https://login.example.com:443/oam/server/logout

#Installation api key
#Rest Api key for OAA service.
install.global.uasapikey=myAPIpassword
#Rest Api key for policy service.
install.global.policyapikey=myAPIpassword
#Rest API key for all factor services.
install.global.factorsapikey=myAPIpassword
#Rest API key for risk and risk customer care services.
install.global.riskapikey=myAPIpassword
#Rest API key for DRSS service.
install.global.drssapikey=myAPIpassword

#In case of OCI vault, the following configuration can be overridden if provided for read-only users during helm installation.
#If the value is not provided in the properties below then it will be picked from vault section.
#All the values in the section below is optional.
#install.global.vault.mapId=b2NpZDEudmF1bHRzZWNyZXQub2MxLmlhZC5hbWFhYWFhYWRjeHl1dXFha2xmejVkbW9rcnpkajZva2Rtdmt0bGp2Y2tyZGIyd3B0emt6bHlkbTN1emEK
#install.global.vault.oci.uasoperator=
#install.global.vault.oci.tenancyId=
#install.global.vault.oci.userId=
#install.global.vault.oci.fpId=

##################################### 6. Optional configuration#########################################
##Ingress properties that can be used to enable ingress for services begin deployed.
#Deprecated property. Will be removed in future. Use install.global.ingress.enabled instead.
#install.ingress.enabled=true
#Enable ingress for all services.
install.global.ingress.enabled=true
#Ingress resource hostname. Should be all lowercase. If provided, dedicated hostname will be used to access the deployment. Otherwise can use any hostname or IP Address.
#Following configurations are deprecated. Use install.global.ingress.runtime.host and install.global.ingress.admin.host for specifying runtime and admin host
#install.global.ingress.hosts\[0\].host=oaainstall-host
#install.global.ingress.hosts\[1\].host=oaaadmin-host

#Runtime host used for accessing runtime services including all factors, oaa ,spui and risk.
install.global.ingress.runtime.host=login.example.com
#Admin host used for accessing admin, policy and risk-cc services.
install.global.ingress.admin.host=iadadmin.example.com

##Following properties are picked from database related properties if not present below.
#install.global.dbhost=
#install.global.dbport=
#install.global.dscredentials=
#install.global.dbservicename=

##Following properties are picked from oauth related properties if not present below.
#install.global.oauth.oidcidentityuri=
#install.global.oauth.oidcaudience=
#install.global.oauth.oidcclientid=

#if load balancer/ingress url is present, then configure the url here. All UI service will be behind this load balancer/ingress.
#In case ingress installation is set to true, the appropriate service url will be fetch after ingress installation
# and will be used as service url. If provided, service url from the property below will have higher priority.
install.global.serviceurl=https://login.example.com:443
#Service URL of oaa admin, if different from the service url of global oauth. 
install.oaa-admin-ui.serviceurl=http://iadadmin.example.com:80

#If oauth.enabled is set to false, uncomment following properties. Also when deployment mode is Risk spui, fido and oaa-kba services are not required.
#install.spui.enabled=false
#install.fido.enabled=false
#install.oaa-admin-ui.enabled=false
#install.oaa-kba.enabled=false

#Also authentication factor Services are enabled by default. To disable them uncomment the lines below.
#When deployment mode is Risk, the following configurations is not required.
#install.totp.enabled=false
#install.push.enabled=false
#install.sms.enabled=false
#install.yotp.enabled=false
#install.email.enabled=false

#Default service type for services is NodePort. When deployment mode is Risk following service are not deployed :
#OAA, SPUI, All Factors (fido, push, yotp, email ,sms, totp and kba)
#install.service.type=ClusterIP
#install.oaa-admin-ui.service.type=ClusterIP
#install.oaa-policy.service.type=ClusterIP
#install.spui.service.type=ClusterIP
#install.totp.service.type=ClusterIP
#install.fido.service.type=ClusterIP
#install.push.service.type=ClusterIP
#install.email.service.type=ClusterIP
#install.sms.service.type=ClusterIP
#install.yotp.service.type=ClusterIP
#install.risk.service.type=ClusterIP
#install.oaa-kba.service.type=ClusterIP
#install.risk.riskcc.service.type=ClusterIP
#Properties used to install ingress using the ingress chart present in helmcharts folder

##################################### 7. Ingress configuration#########################################
#To install the ingress controller along with the services set the following flag to true. 
ingress.install=false
#Kubernetes name space which will be used to install ingress
ingress.namespace=ingress-nginx
#Admissions controller can be installed seperately. 
#Ingress admissions name is not present the controller.admissionWebhooks.enabled will be set to false in the nginx ingress chart. 
#ingress.admissions.name=ingress-nginx-controller-admission
#Ingress class name that would be used for installation. Must not be existing
ingress.class.name=ingress-nginx-class
ingress.service.type=NodePort

#anything starting with ingress.install can be additionally supplied to set the ingress chart value.
#ingress.install.releaseNameOverride=base

##################################### 8. OAA management configuration#########################################
#NFS volumes
#install.mount.config.path=<NFS_CONFIG_PATH>
#install.mount.config.server=<NFS_CONFIG_SERVER>
#install.mount.creds.path=<NFS_CREDS_PATH>
#install.mount.creds.server=<NFS_CREDS_SERVER>
#install.mount.logs.path=<NFS_LOGS_PATH>
#install.mount.logs.server=<NFS_LOGS_SERVER>
#OAA mgmt chart release name, default can be used for most installations
install.mgmt.release.name=oaamgmt
#Location of kube credentials to use for installation.
#If not provide credentials in $KUBECONFIG or ~/.kube/config will be used
#install.kube.creds=<LOCAL_PATH>/<KUBE_CREDS>
#SSL certificates
#common.local.sslcert=<LOCAL_PATH>/<LOCAL_CERT_FILE>
#common.local.trustcert=<LOCAL_PATH>/<LOCAL_TRUST_FILE>
common.deployment.import.snapshot=true
common.deployment.import.snapshot.file=/u01/oracle/scripts/oarm-12.2.1.4.1-base-snapshot.zip

##################################### 9. OUA Configuration ###################
# OUA properties needed for integration with OAA.
# OUA Agent Name. Has to be the same as the TAP Partner in OAM.
oua.tapAgentName=OAM-OUA-TAP
# OUA Password for the jks file (Base 64 Encoded)
oua.tapAgentFilePass=keystorepassword
# OUA JKS File Location
oua.tapAgentFileLocation=/u01/oracle/scripts/creds/OAMOUAKeyStore.jks
# OUA OAM Runtime Endpoint
oua.oamRuntimeEndpoint=https://login.example.com:443

##################################### 10. LDAP configuration#########################################
ldap.server=ldap://edg-oud-ds-rs-lbr-ldap.oudns.svc.cluster.local:1389
ldap.username=cn=oudadmin
ldap.password=******
ldap.oaaAdminUser=cn=oaaadmin,cn=Users,dc=edg,dc=com
ldap.adminRole=cn=OAA-Admin-Role,cn=Groups,dc=edg,dc=com
ldap.userRole=cn=OAA-App-User,cn=Groups,dc=edg,dc=com
ldap.oaaAdminUserPwd=******
ldap.addExistingUsers=yes