Skip to content

Commit 9846922

Browse files
Tahzeergitbook-bot
authored andcommitted
GITBOOK-1609: Tahzeer's Oct 22 changes
1 parent cd2794f commit 9846922

File tree

12 files changed

+764
-10
lines changed

12 files changed

+764
-10
lines changed

.gitbook/assets/image (80).png

10.4 KB
Loading

.gitbook/assets/image (81).png

23.6 KB
Loading

SUMMARY.md

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -405,15 +405,15 @@
405405
* [Roles & privileges](pbms-gen2/design/roles-and-privileges.md)
406406
* [G2P Bridge workflow](pbms-gen2/design/g2p-bridge-workflow.md)
407407
* [Deployment](pbms-gen2/deployment/README.md)
408-
* [PBMS Odoo](pbms-gen2/deployment/pbms-odoo.md)
409-
* [PBMS BG Tasks](pbms-gen2/deployment/pbms-bg-tasks.md)
408+
* [PBMS 3.0](pbms-gen2/deployment/pbms-3.0.md)
410409
* [Configurations](pbms-gen2/deployment/configurations.md)
411410
* [Domain names & certificates](pbms-gen2/deployment/domain-names-and-certificates.md)
412-
* [Helm charts](pbms-gen2/deployment/helm-charts.md)
411+
* [PBMS Helm Charts](pbms-gen2/deployment/pbms-helm-charts.md)
413412
* [Developer Zone](pbms-gen2/developer-zone/README.md)
414413
* [PBMS Helm Chart 4.x](pbms-gen2/developer-zone/pbms-helm-chart-4.x.md)
415-
* [Developer Install](pbms-gen2/developer-zone/developer-install.md)
416414
* [Repositories](pbms-gen2/developer-zone/repositories.md)
415+
* [Developer Install](pbms-gen2/developer-zone/developer-install.md)
416+
* [PBMS Docker](pbms-gen2/developer-zone/pbms-docker.md)
417417
* [API Reference](pbms-gen2/api-reference/README.md)
418418
* [Beneficiary portal APIs](pbms-gen2/api-reference/beneficiary-portal-apis.md)
419419
* [Agency app APIs](pbms-gen2/api-reference/agency-app-apis.md)
Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,44 @@
1+
---
2+
description: >-
3+
The instructions here are related to configuration of base settings for PBMS
4+
using the Odoo UI
5+
---
6+
17
# Configurations
28

9+
Once all the pods are in **Running** state we can start interacting with the Odoo UI and configure some base settings.
10+
11+
## Prerequisites
12+
13+
* [ ] The user must have access to PBMS in OpenG2P systems.
14+
* [ ] The user must be an Administrator on the system
15+
16+
## Configure Minio Object Store
17+
18+
1. Navigate to the minio hostname specified during installation. You can find this in your Rancher namespace by navigating to **Istio -> Virtual Services**, and searching for `minio`
19+
2. Login using credentials from Rancher **Storage -> Secrets**, search for `minio`
20+
3. Navigate to the Buckets section in the Minio UI and click **Create Bucket**
21+
4. Choose an appropriate bucket name (example: `documents`) and click on **Create Bucket**
22+
23+
## Configure PBMS Document Settings
24+
25+
1. Navigate to the pbms hostname specified during installation. You can find this in your Rancher namespace by navigating to **Istio -> Virtual Services**, and searching for `pbms`. Login using credentials from Rancher.
26+
2. From the top-left Apps icon, go to **Settings -> Technical -> Storage Backend**
27+
3. Create a new storage backend or update existing ones.
28+
* Give the record a name (example: Default S3 Document Store)
29+
* Select Backend type as **Amazon S3**
30+
* Check the `Is Public` boolean field.
31+
* Fill the Amazon S3 section using credentials from Rancher and the bucket name created while [configuring minio](configurations.md#configure-minio-object-store) (it is recomended to use internal url on port 9000, example: `http://minio-pbms:9000`).
32+
* Save the record using the top-left odoo save icon.
33+
34+
## Configure Keycloak
35+
36+
1. _To be added_
37+
38+
## Configure PBMS Base Settings
39+
40+
1. Navigate to the pbms hostname specified during installation. You can find this in your Rancher namespace by navigating to **Istio -> Virtual Services**, and searching for `pbms`. Login using credentials from Rancher.
41+
2. From the top-left Apps icon, go to **Settings** and click on **G2P PBMS Settings** tab from the left sidebar.
42+
3. Update the URLs for Background Task API and Bridge API from **Rancher -> Istio -> Virtual Services**.
43+
4. Select the pre-configured Document Store from the dropdown.
44+
5. Configure Keymanager if required (by default Keymanager is toggled off).
Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,19 @@
1+
---
2+
description: Domain names and certificates for PBMS
3+
---
4+
15
# Domain names & certificates
26

7+
## Domain names <a href="#domain-names" id="domain-names"></a>
8+
9+
The suggested convention is given below.
10+
11+
`<component>.<environment>.<your org domain>.<tld>`
12+
13+
<table><thead><tr><th width="165">Component</th><th>Example Domain</th></tr></thead><tbody><tr><td>PBMS</td><td><code>pbms.dev.openg2p.org</code></td></tr></tbody></table>
14+
15+
All the above domains point to Nginx IP corresponding to server (virtual host) that routes to Istio Ingress gateway server on [OpenG2P Cluster](https://docs.openg2p.org/deployment/base-infrastructure/openg2p-cluster).
16+
17+
## Certificates
18+
19+
SSL certs for all the above must be available, generally as a wild card certificate for the domain, example. `*.dev.openg2p.org`\

pbms-gen2/deployment/helm-charts.md

Lines changed: 0 additions & 2 deletions
This file was deleted.

pbms-gen2/deployment/pbms-3.0.md

Lines changed: 189 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,189 @@
1+
---
2+
description: >-
3+
The instructions here pertain to the deployment of PBMS 3.0 and associated
4+
components on the Kubernetes cluster using OpenG2P PBMS Helm chart. All the
5+
components are installed in the same namespace.
6+
---
7+
8+
# PBMS 3.0
9+
10+
## Prerequisites
11+
12+
Before you deploy, make sure the following are in place:
13+
14+
* [ ] Kubernetes cluster is up and running
15+
* [ ] Nginx server is configured (skip this for OpenG2P-in-a-box)
16+
* [ ] Namespace is created (via Rancher under a Project)
17+
* [ ] Project Owner access on the OpenG2P namespace
18+
* [ ] Istio gateway is set up in the namespace
19+
20+
## Installation using Rancher UI
21+
22+
1. **Log in** to the **Rancher Admin Console** and select your **target cluster**.
23+
2. Navigate to **Apps → Repositories** and click **Create** to add a new repository:
24+
25+
* **Name:** `openg2p`
26+
* **Target HTTPS Index URL:** `https://openg2p.github.io/openg2p-helm/rancher`
27+
* Click **Create**
28+
29+
<figure><img src="../../.gitbook/assets/image.png" alt=""><figcaption></figcaption></figure>
30+
3. On the top-right, select the **namespace** where you want to install PBMS.
31+
4. To view prerelease charts (if required), click your **user avatar → Preferences → Include Prerelease Versions**.
32+
33+
<figure><img src="../../.gitbook/assets/image (81).png" alt=""><figcaption></figcaption></figure>
34+
5. Navigate to **Apps → Charts** and locate the chart:
35+
36+
* **Name:** _OpenG2P PBMS (3.0.0)_
37+
* **Description:** Installs PBMS Odoo + Postgres, Background Tasks, and Minio
38+
39+
<figure><img src="../../.gitbook/assets/image (80).png" alt=""><figcaption></figcaption></figure>
40+
6. Click the chart, choose **version 3.0.0**, and click **Install**.
41+
7. On the next screen:
42+
* **Installation Name:** `openg2p-pbms` (or any preferred name)
43+
* Enable **Customise Helmbox before installation** → click **Next**
44+
8. In the **General Settings** section, configure the following:
45+
* **Hostname:** Set the PBMS URL (e.g., `pbms.dev.openg2p.org`)
46+
* **PostgreSQL Host:** Provide the hostname of the PostgreSQL instance (or use the internal one if enabled)
47+
* **Keycloak Base URL:** Enter your Keycloak URL (e.g., `https://keycloak.openg2p.sandbox.net`)
48+
* **Email Service Name:** Provide the email service name used in PBMS
49+
* **OIDC Client ID:** Provide the OIDC client ID for PBMS (Odoo)
50+
* **OIDC Client Secret:** Provide the OIDC client secret for PBMS (Odoo)
51+
9. In the **Registry Settings** section:
52+
* **Registry DB:** Provide the PostgreSQL database name for Registry
53+
* **Registry DB User:** Enter the DB username
54+
* **Registry DB Secret:** Specify the Kubernetes secret name containing the DB password
55+
* **Registry DB Secret Key:** Enter the key name within the secret containing the user password
56+
10. In the **Background Task Settings** section (only visible if enabled):
57+
* **Celery Beat Producer Frequency:** Set frequency in seconds (e.g., `60`)
58+
* **Celery Beat Producer Batch Size:** Set the number of tasks per batch
59+
* **Celery Beat Producer Number of Tasks to Process:** Set total tasks per run
60+
* **Celery Workers G2P Bridge Base URL:** Provide the Bridge API URL used by Celery Workers
61+
* **Celery Workers Batch Size:** Set worker batch size
62+
11. Configure **Minio Settings** (if applicable):
63+
* **Hostname:** e.g., `minio-pbms.dev.openg2p.org`
64+
* Enable **Install Minio** and **Enable Minio Persistence**
65+
12. Click **Next** → go to **Helm Options**.
66+
* **Disable the Wait flag**
67+
13. Click **Install**.
68+
14. Monitor pods in your namespace until they reach the **Running** state.
69+
70+
<div align="left"><figure><img src="../../.gitbook/assets/image (5).png" alt=""><figcaption></figcaption></figure></div>
71+
72+
## Installation using CLI
73+
74+
1. Clone the [OpenG2P PBMS Deployment Repository](pbms-helm-charts.md)
75+
76+
```
77+
git clone https://github.com/OpenG2P/openg2p-pbms-gen2-deployment.git
78+
cd openg2p-pbms-gen2-deployment/charts
79+
```
80+
81+
82+
2. Update Helm Dependencies
83+
84+
```
85+
helm dependency update openg2p-pbms
86+
```
87+
88+
89+
3. Review and update `values.yaml` as needed:
90+
91+
* `global.hostname`: Public hostname for PBMS (e.g., `pbms.dev.openg2p.org`)
92+
* `global.keycloakBaseUrl`: Base URL for Keycloak authentication
93+
* `global.postgresqlHost`: PostgreSQL host (e.g., `openg2p-commons-postgresql`)
94+
* `global.registryDB*` and `global.pbmsDB*`: Registry and PBMS database credentials
95+
* `global.minioInstallationName`: Minio instance for file storage
96+
* `odoo.image.tag`: PBMS version or custom image tag
97+
* `openg2p-pbms-bg-task-celery-*`: Celery environment variables (frequency, batch size, etc.)
98+
* `istio.virtualservice.host`: Hostname when Istio is enabled
99+
100+
{% hint style="info" %}
101+
You can override values inline using `--set` or pass a custom file with `-f`.
102+
{% endhint %}
103+
104+
105+
4. Install the Helm chart
106+
107+
```
108+
helm install <release-name> openg2p-pbms \
109+
-f ./values.yaml \
110+
-n <namespace>
111+
```
112+
113+
Replace `<release-name>` with a unique name (e.g., `pbms-dev`) and `<namespace>` with the target Kubernetes namespace.
114+
5. Verify deployment
115+
116+
```
117+
helm status <release-name> -n <namespace>
118+
kubectl get pods,svc -n <namespace>
119+
```
120+
121+
122+
6. Upgrade the deployment when changing configuration
123+
124+
```
125+
helm upgrade <release-name> openg2p-pbms \
126+
-f ./values.yaml \
127+
-n <namespace>
128+
```
129+
130+
\
131+
You can view current values using:
132+
133+
```
134+
helm get values <release-name> -n <namespace>
135+
```
136+
137+
{% hint style="info" %}
138+
To uninstall PBMS from command line:
139+
140+
```
141+
helm uninstall <release-name> -n <namespace>
142+
```
143+
{% endhint %}
144+
145+
## Post-Installation Configuration
146+
147+
1. Get the Odoo service URL (usually from ingress or Istio VirtualService):
148+
149+
```
150+
kubectl get svc,ingress -n <namespace>
151+
```
152+
153+
154+
2. Log in to Odoo using admin credentials (configured in Keycloak or Odoo setup).
155+
3. Activate the PBMS modules under **Apps**:
156+
* Ensure “OpenG2P PBMS Core”, “OpenG2P PBMS Background Tasks”, and other required extensions are installed.
157+
* Update module list if they aren’t visible:
158+
159+
```
160+
kubectl exec -it <odoo-pod-name> -n <namespace> -- \
161+
odoo -d <database-name> -u all --stop-after-init
162+
```
163+
164+
165+
4. Verify background workers:
166+
* Check Celery workers and beat scheduler pods:
167+
168+
```
169+
kubectl get pods -n <namespace> | grep celery
170+
```
171+
* Confirm task queues are registered correctly.\
172+
173+
5. Validate Redis and Minio connectivity:
174+
* Ensure Redis pod is running and reachable by the Celery worker.
175+
* Verify Minio access credentials match the Helm values and Odoo configuration.
176+
6. Confirm database migrations:
177+
* Review logs of Odoo pod for any migration errors:
178+
179+
```
180+
kubectl logs <odoo-pod-name> -n <namespace>
181+
```
182+
183+
184+
7. (Optional) Apply PBMS demo or seed data:
185+
186+
```
187+
kubectl exec -it <odoo-pod-name> -n <namespace> -- \
188+
odoo -d <database-name> -i g2p_pbms_demo
189+
```

pbms-gen2/deployment/pbms-bg-tasks.md

Lines changed: 0 additions & 2 deletions
This file was deleted.
Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
---
2+
description: >-
3+
Information regarding helm charts for installation for PBMS and all it's
4+
dependencies
5+
---
6+
7+
# PBMS Helm Charts
8+
9+
G2P PBMS (Odoo + Background Tasks) and all its dependencies can be installed using a single [Helm chart](https://github.com/OpenG2P/openg2p-pbms-deployment/tree/4.0/charts/openg2p-pbms) which acts the main chart for PBMS Odoo Core (`odoo`) and references multiple sub-charts.
10+
11+
* `openg2p-pbms-bg-task-api`
12+
* `openg2p-pbms-bg-task-celery-beat-producers`
13+
* `openg2p-pbms-bg-task-celery-workers`
14+
15+
### PBMS Core Odoo
16+
17+
The **PBMS Core Odoo** chart is the primary component of the PBMS Helm deployment. It serves as the main Odoo instance for PBMS and includes references to all Background Task sub-charts (API, Celery Beat Producers, and Celery Workers).
18+
19+
This component deploys the Odoo application container image (`openg2p/openg2p-pbms-core`) configured with PostgreSQL, Redis, Keycloak for OIDC authentication, and MinIO for object storage.
20+
21+
#### Key configurations include:
22+
23+
* External PostgreSQL connection (`externalDatabase`) linked to `pbmsdb`.
24+
* OIDC integration using Keycloak (`oidcIssuerUrl`, `oidcClientId`, `oidcClientSecret`).
25+
* Environment variables controlling performance, logging, and module behavior.
26+
* Integration with MinIO (`S3_URL`, `S3_ACCESS_KEY_ID`, `S3_SECRET_ACCESS_KEY`) for media and file storage.
27+
* Redis service used as a broker for job queues and cache.
28+
* Optional Istio VirtualService configuration for routing traffic to Odoo.
29+
30+
### PBMS Background Tasks API
31+
32+
The **PBMS Background Tasks API** sub-chart deploys the API service responsible for managing and exposing background task endpoints.\
33+
It provides an interface layer between PBMS and the asynchronous processing system, handling requests from Odoo and passing task metadata to Celery producers and workers.
34+
35+
#### Key configurations include:
36+
37+
* Uses the PostgreSQL instance defined in the global configuration.
38+
* Connects to both the **Background Task Database (`bgtaskdb`)** and **Social Registry Database (`registrydb`)**.
39+
* Configured via environment variables such as:
40+
* `BG_TASK_API_DB_HOSTNAME`, `BG_TASK_API_DB_DBNAME`, `BG_TASK_API_DB_USERNAME` for the Background Task DB.
41+
* `BG_TASK_API_DB_HOSTNAME_SR`, `BG_TASK_API_DB_DBNAME_SR`, `BG_TASK_API_DB_USERNAME_SR` for the Social Registry DB.
42+
* Integrates with Keymanager for secure key operations if required.
43+
44+
### PBMS Background Tasks Celery Beat Producers
45+
46+
The **PBMS Background Tasks Celery Beat Producers** sub-chart is responsible for **scheduling and triggering** periodic background tasks.\
47+
It acts as the “heartbeat” of the background task system, periodically generating task events for Celery Workers to process.
48+
49+
#### Key configurations include:
50+
51+
* Frequency, batch size, and concurrency are controlled by environment variables:
52+
* `BG_TASK_CELERY_BEAT_PRODUCER_FREQUENCY`
53+
* `BG_TASK_CELERY_BEAT_BATCH_SIZE`
54+
* `BG_TASK_CELERY_BEAT_NO_OF_TASKS_TO_PROCESS`
55+
* Connects to multiple databases:
56+
* **PBMS Core DB (`pbmsdb`)**
57+
* **Background Task DB (`bgtaskdb`)**
58+
* **Social Registry DB (`registrydb`)**
59+
* Uses Redis as the Celery broker and backend:
60+
* `BG_TASK_CELERY_BEAT_CELERY_BROKER_URL`
61+
* `BG_TASK_CELERY_BEAT_CELERY_BACKEND_URL`
62+
63+
This component ensures continuous and reliable task dispatching to maintain workflow execution in the PBMS ecosystem.
64+
65+
### PBMS Background Tasks Celery Workers
66+
67+
The **PBMS Background Tasks Celery Workers** sub-chart handles **asynchronous execution** of the tasks generated by Celery Beat Producers and the API.\
68+
Each worker consumes jobs from the Redis queue and performs operations such as data synchronization, eligibility computation, and background updates.
69+
70+
#### Key configurations include:
71+
72+
* Batch and concurrency control: `BG_TASK_CELERY_WORKERS_BATCH_SIZE`.
73+
* Multi-database connectivity:
74+
* **PBMS DB**, **Background Task DB**, **Social Registry DB**, and asynchronous Postgres connections (`postgresql+asyncpg`).
75+
* Redis as Celery’s broker and backend for reliable task delivery and tracking.
76+
* Keymanager integration for cryptographic operations (e.g., signing keys, secure access tokens).
77+
78+
Environment variables manage:
79+
80+
* Async DB connection (`BG_TASK_CELERY_WORKERS_DB_DRIVER_ASYNC`, `BG_TASK_CELERY_WORKERS_DB_USERNAME_ASYNC`).
81+
* Security and Keymanager access (`BG_TASK_CELERY_WORKERS_SIGN_KEY_KEYMANAGER_APP_ID`, `BG_TASK_CELERY_WORKERS_KEYMANAGER_API_BASE_URL`, etc.).
82+
83+
## Database
84+
85+
The PBMS Helm chart provisions a shared **PostgreSQL** instance used by both the **PBMS Core Odoo** and **Background Tasks** components. The database runs in the same Kubernetes namespace as the application stack and is automatically initialized via the `postgres-init` job. This ensures that all required databases, users, and secrets are created before Odoo and Background Task pods start.
86+
87+
Two distinct databases are configured for separation of concerns:
88+
89+
* **`pbmsdb`** — the primary database for the PBMS Odoo instance.
90+
* **`bgtaskdb`** — the dedicated database for Background Task components (API, Celery Beat Producers, and Celery Workers).
91+
92+
Database connection details, usernames, and secrets are defined under the `global` values section in the Helm chart and templated per release using Helm’s `tpl` function. Key parameters include:
93+
94+
* **Global DB variables**
95+
* `global.postgresqlHost`: internal PostgreSQL service hostname (e.g., `openg2p-commons-postgresql`)
96+
* `global.pbmsDB`, `global.pbmsDBUser`, `global.pbmsDBSecret`, `global.pbmsDBUserPasswordKey`: for the Odoo database
97+
* `global.pbmsBgTaskDB`, `global.pbmsBgTaskDBUser`, `global.pbmsBgTaskDBSecret`, `global.pbmsBgTaskDBUserPasswordKey`: for the Background Tasks database
98+
* **Database initialization (`postgres-init`)**
99+
* Automatically provisions both `pbmsdb` and `bgtaskdb` with corresponding users.
100+
* References the global secret templates for credential management:
101+
102+
```
103+
- name: '{{ tpl .Values.global.pbmsDB $ }}'
104+
user: '{{ tpl .Values.global.pbmsDBUser $ }}'
105+
secret: '{{ tpl .Values.global.pbmsDBSecret $ }}'
106+
- name: '{{ .Release.Name }}_bgtask_db'
107+
user: '{{ .Release.Name }}_bgtask_db_user'
108+
secret: '{{ .Release.Name }}-bgtask'
109+
```
110+
* The root PostgreSQL password is read from the existing secret `openg2p-commons-postgresql`.
111+
112+
All PBMS components — Odoo, API, Celery Beat Producers, and Celery Workers — connect to PostgreSQL using these templated credentials via their respective `envVars` sections. This allows consistent configuration and automatic secret injection across sub-charts.
113+
114+
By maintaining separate databases under a shared PostgreSQL service, the Helm chart provides both **operational isolation** (between synchronous and asynchronous workloads) and **deployment simplicity**, while leveraging Kubernetes Secrets for secure credential management.

pbms-gen2/deployment/pbms-odoo.md

Lines changed: 0 additions & 2 deletions
This file was deleted.

0 commit comments

Comments
 (0)