Repository: open-edge-platform/edge-manageability-framework
Pull request #32: Initial commit for AMT
Author: login: DevipriyaS17
Labels: name: FEATURE
description: Request for feature.
Created: 2025-04-03T07:36:38Z | Merged: 2025-05-27T12:56:41Z

Code changes for integrating Vpro ( AMT ) with EIM

Dependency PR:

1. https://github.com/open-edge-platform/orch-utils/pull/16
2. https://github.com/open-edge-platform/infra-charts/pull/5
3. https://github.com/open-edge-platform/infra-charts/pull/57
4. https://github.com/open-edge-platform/infra-charts/pull/59
5. https://github.com/open-edge-platform/infra-charts/pull/61


Diff:
diff --git a/argocd/applications/configs/infra-external.yaml b/argocd/applications/configs/infra-external.yaml
index 13f02b4b6..350471855 100644
--- a/argocd/applications/configs/infra-external.yaml
+++ b/argocd/applications/configs/infra-external.yaml
@@ -3,7 +3,9 @@
 # SPDX-License-Identifier: Apache-2.0
 
 ---
-import: {}
+import:
+  amt:
+    enabled: true
 
 loca-manager:
   serviceAccount:
@@ -78,3 +80,27 @@ loca-credentials:
   params:
     keycloakUrl: "http://platform-keycloak.orch-platform.svc.cluster.local:8080"
     vaultUrl: "http://vault.orch-platform.svc.cluster.local:8200"
+
+amt:
+  mps:
+    traefikReverseProxy:
+      enabled: true
+      secretName: "tls-orch"
+      tlsOption: "gateway-tls"
+      gatewayNamespace: orch-gateway
+  rps:
+    traefikReverseProxy:
+      enabled: true
+      secretName: "tls-orch"
+      tlsOption: "gateway-tls"
+      gatewayNamespace: orch-gateway
+  dm-manager:
+    serviceArgs:
+      # Password policy for AMT
+      # If 'static', then password from params.password will be used for every AMT device.
+      # If 'dynamic', then password will be generated for each AMT device.
+      passwordPolicy: static
+    params:
+      # User-provided password
+      # Should have One uppercase letter, one lowercase letter, one digit, one special character, and be at least 8 characters long.
+      password: "P@ssw0rd"
diff --git a/argocd/applications/configs/kyverno-extra-policies.yaml b/argocd/applications/configs/kyverno-extra-policies.yaml
index b557150d5..883cebe49 100644
--- a/argocd/applications/configs/kyverno-extra-policies.yaml
+++ b/argocd/applications/configs/kyverno-extra-policies.yaml
@@ -37,6 +37,8 @@ restrictedPolicyOrch:
       - "edgenode-observability-opentelemetry-collector*"
       - "edgenode-observability-minio*"
       - "dkam*"
+      - "mps*"
+      - "rps*"
   - namespace: "capi-operator-system"
     names:
       - "capi-operator-cluster-api-operator*"
diff --git a/argocd/applications/configs/kyverno-traefik-policy.yaml b/argocd/applications/configs/kyverno-traefik-policy.yaml
index 02716082f..5a90908ae 100644
--- a/argocd/applications/configs/kyverno-traefik-policy.yaml
+++ b/argocd/applications/configs/kyverno-traefik-policy.yaml
@@ -20,6 +20,8 @@ jwtMiddlewareException:
       - "iam-umbrella-nexus-api-gw-api-docs"
       - "cluster-connect-gateway-ws"
       - "cluster-connect-gateway-kubeapi"
+      - "amt-api-mps"
+      - "amt-api-rps"
       - "orch-platform-keycloak"
   - namespace: "orch-boots"
     names:
diff --git a/argocd/applications/configs/traefik.yaml b/argocd/applications/configs/traefik.yaml
index 6c2cd611e..0d4621841 100644
--- a/argocd/applications/configs/traefik.yaml
+++ b/argocd/applications/configs/traefik.yaml
@@ -53,7 +53,8 @@ metrics:
 
 deployment:
   podAnnotations:
-    traffic.sidecar.istio.io/excludeInboundPorts: "8000,8443,8080"               # Traefik listened
+    traffic.sidecar.istio.io/excludeInboundPorts: "8000,8443,8080,4433"               # Traefik listened
+    traffic.sidecar.istio.io/excludeOutboundPorts: "4433"                             # Traefik MPS passthrough
     # TODO: Make configurable because every k8s cluster is different
     traffic.sidecar.istio.io/excludeOutboundIPRanges: "10.96.0.1/32"        # k8s API server
 
diff --git a/argocd/applications/custom/infra-external.tpl b/argocd/applications/custom/infra-external.tpl
index b2b13a36d..8865f6f2b 100644
--- a/argocd/applications/custom/infra-external.tpl
+++ b/argocd/applications/custom/infra-external.tpl
@@ -84,3 +84,31 @@ loca-templates-manager:
   {{- end}}
   {{- end}}
 {{- end }}
+
+amt:
+  mps:
+    commonName: "mps-node.{{ .Values.argo.clusterDomain }}"
+    traefikReverseProxy:
+      host:
+        cira:
+          name: "mps-node.{{ .Values.argo.clusterDomain }}"
+        webport: # Define a new name for the other port
+          name: "mps-webport-node.{{ .Values.argo.clusterDomain }}" # Define the name for the new port
+  {{- if .Values.argo.traefik }}
+    tlsOption: {{ .Values.argo.traefik.tlsOption | default "" | quote }}
+  {{- end }}
+
+  rps:
+    traefikReverseProxy:
+      host:
+        grpc:
+          name: "rps-node.{{ .Values.argo.clusterDomain }}"
+        webport: # Define a new name for the other port
+          name: "rps-webport-node.{{ .Values.argo.clusterDomain }}" # Define the name for the new port
+  {{- if .Values.argo.traefik }}
+    tlsOption: {{ .Values.argo.traefik.tlsOption | default "" | quote }}
+  {{- end }}
+
+  dm-manager:
+    serviceArgs:
+      clusterDomain: {{ .Values.argo.clusterDomain }}
diff --git a/argocd/applications/custom/infra-onboarding.tpl b/argocd/applications/custom/infra-onboarding.tpl
index 55d006f6b..0f50e5ca2 100644
--- a/argocd/applications/custom/infra-onboarding.tpl
+++ b/argocd/applications/custom/infra-onboarding.tpl
@@ -38,6 +38,10 @@ infra-config:
     orchAttestationStatus: attest-node.{{ .Values.argo.clusterDomain }}:443
     orchRegistry: {{ .Values.argo.releaseService.ociRegistry }}:9443
     orchFileServer: {{ .Values.argo.releaseService.fileServer }}:60444
+    orchMPSHost: mps-node.{{ .Values.argo.clusterDomain }}:4433
+    orchMPSWHost: mps-webport-node.{{ .Values.argo.clusterDomain }}:443
+    orchRPSHost: rps-node.{{ .Values.argo.clusterDomain }}:443
+    orchRPSWHost: rps-webport-node.{{ .Values.argo.clusterDomain }}:443
 
     rsType: "{{ index .Values.argo "infra-onboarding" "rsType" | default "no-auth" }}"
     netIp: "{{ index .Values.argo "infra-onboarding" "netIp" | default "dynamic" }}"
diff --git a/argocd/applications/custom/traefik.tpl b/argocd/applications/custom/traefik.tpl
index 0f466f12f..fd097d0d8 100644
--- a/argocd/applications/custom/traefik.tpl
+++ b/argocd/applications/custom/traefik.tpl
@@ -40,3 +40,8 @@ ports:
       - orch-gateway-cors@kubernetescrd
       {{- end }}
       {{- end }}
+  tcpamt:
+    port: 4433
+    exposedPort: 4433
+    expose: true
+    protocol: TCP
diff --git a/argocd/applications/templates/infra-external.yaml b/argocd/applications/templates/infra-external.yaml
index c0cbab74c..8ab485ccc 100644
--- a/argocd/applications/templates/infra-external.yaml
+++ b/argocd/applications/templates/infra-external.yaml
@@ -21,7 +21,7 @@ spec:
   sources:
     - repoURL: {{ required "A valid chartRepoURL entry required!" .Values.argo.chartRepoURL }}
       chart: infra/charts/{{$appName}}
-      targetRevision: 2.1.3
+      targetRevision: 2.4.3
       helm:
         releaseName: {{$appName}}
         valuesObject:
diff --git a/argocd/applications/templates/infra-onboarding.yaml b/argocd/applications/templates/infra-onboarding.yaml
index e88b7e260..af5dd3363 100644
--- a/argocd/applications/templates/infra-onboarding.yaml
+++ b/argocd/applications/templates/infra-onboarding.yaml
@@ -21,7 +21,7 @@ spec:
   sources:
     - repoURL: {{ required "A valid chartRepoURL entry required!" .Values.argo.chartRepoURL }}
       chart: infra/charts/{{$appName}}
-      targetRevision: 1.30.1
+      targetRevision: 1.30.2
       helm:
         releaseName: {{$appName}}
         valuesObject:
diff --git a/argocd/applications/templates/istio-policy.yaml b/argocd/applications/templates/istio-policy.yaml
index 0082932d9..f8b65d50e 100644
--- a/argocd/applications/templates/istio-policy.yaml
+++ b/argocd/applications/templates/istio-policy.yaml
@@ -21,7 +21,7 @@ spec:
   sources:
     - repoURL: {{ required "A valid chartRepoURL entry required!" .Values.argo.chartRepoURL }}
       chart: common/charts/{{$appName}}
-      targetRevision: 2.0.6
+      targetRevision: 2.0.7
       helm:
         releaseName: {{$appName}}
         valuesObject:
diff --git a/argocd/applications/templates/self-signed-cert.yaml b/argocd/applications/templates/self-signed-cert.yaml
index 86bdbd7d7..75952d927 100644
--- a/argocd/applications/templates/self-signed-cert.yaml
+++ b/argocd/applications/templates/self-signed-cert.yaml
@@ -21,7 +21,7 @@ spec:
   sources:
     - repoURL: {{ required "A valid chartRepoURL entry required!" .Values.argo.chartRepoURL }}
       chart: common/charts/{{$appName}}
-      targetRevision: 4.0.8
+      targetRevision: 4.0.9
       helm:
         releaseName: {{$appName}}
         valuesObject:
diff --git a/argocd/applications/values.yaml b/argocd/applications/values.yaml
index bb2528b95..b839a4aa7 100644
--- a/argocd/applications/values.yaml
+++ b/argocd/applications/values.yaml
@@ -18,5 +18,9 @@ argo:
         name: alerting
       - namespace: orch-iam
         name: iam-tenancy
+      - namespace: orch-infra
+        name: mps
+      - namespace: orch-infra
+        name: rps
   traefik:
     tlsOption: "gateway-tls"
diff --git a/mage/generate.go b/mage/generate.go
index a3048b75b..b36109314 100644
--- a/mage/generate.go
+++ b/mage/generate.go
@@ -1220,6 +1220,10 @@ func firewallDataLookup(dest string) (string, string, bool) {
 		"observability-ui.":       {northboundSource, "Observability", false},
 		"onboarding-node.":        {southboundSource, "Infrastructure Management", false},
 		"onboarding-stream.":      {southboundSource, "Infrastructure Management", false},
+		"mps-node.":               {southboundSource, "Infrastructure Management", false},
+		"mps-webport-node.":       {southboundSource, "Infrastructure Management", false},
+		"rps-node.":               {southboundSource, "Infrastructure Management", false},
+		"rps-webport-node.":       {southboundSource, "Infrastructure Management", false},
 		"registry.":               {northboundSource, "Harbor UI", false},
 		"release.":                {southboundSource, "Release Service Token", false},
 		"telemetry-node.":         {southboundSource, "Observability", false},
@@ -1281,6 +1285,10 @@ func loopHosts(sb *strings.Builder, hosts []string) error {
 		"attest-node",
 		"onboarding-node",
 		"onboarding-stream",
+		"mps-node",
+		"mps-webport-node",
+		"rps-node",
+		"rps-webport-node",
 		"release",
 		"metrics-node",
 		"telemetry-node",
diff --git a/pod-configs/module/orch-route53/variable.tf b/pod-configs/module/orch-route53/variable.tf
index 47ca23feb..2724b094f 100644
--- a/pod-configs/module/orch-route53/variable.tf
+++ b/pod-configs/module/orch-route53/variable.tf
@@ -38,6 +38,8 @@ variable "hostname" {
     "log-query",
     "metadata",
     "metrics-node",
+    "mps-node",
+    "mps-webport-node",
     "observability-admin",
     "observability-ui",
     "onboarding-node",
@@ -45,6 +47,8 @@ variable "hostname" {
     "registry",
     "registry-oci",
     "release",
+    "rps-node",
+    "rps-webport-node",
     "telemetry-node",
     "tinkerbell-server",
     "update-node",
diff --git a/terraform/edge-network/variables.tf b/terraform/edge-network/variables.tf
index 41e016255..aafccc5bf 100644
--- a/terraform/edge-network/variables.tf
+++ b/terraform/edge-network/variables.tf
@@ -67,6 +67,10 @@ variable "dns_hosts" {
     { hostname = "observability-ui.cluster.onprem", ip = "192.168.99.30" },
     { hostname = "onboarding-node.cluster.onprem", ip = "192.168.99.30" },
     { hostname = "onboarding-stream.cluster.onprem", ip = "192.168.99.30" },
+    { hostname = "mps-node.cluster.onprem", ip = "192.168.99.30" },
+    { hostname = "mps-webport-node.cluster.onprem", ip = "192.168.99.30" },
+    { hostname = "rps-node.cluster.onprem", ip = "192.168.99.30" },
+    { hostname = "rps-webport-node.cluster.onprem", ip = "192.168.99.30" },
     { hostname = "registry-oci.cluster.onprem", ip = "192.168.99.30" },
     { hostname = "registry.cluster.onprem", ip = "192.168.99.30" },
     { hostname = "release.cluster.onprem", ip = "192.168.99.30" },
diff --git a/tools/router/docker-compose.template b/tools/router/docker-compose.template
index e20f25c51..cff1b90fd 100644
--- a/tools/router/docker-compose.template
+++ b/tools/router/docker-compose.template
@@ -11,6 +11,7 @@ services:
     hostname: "traefik-router"
     ports:
       - "443:443"
+      - "4433:4433"
     volumes:
       - "/var/run/docker.sock:/var/run/docker.sock:ro"
       - "./traefik.yml:/traefik.yml:ro"
diff --git a/tools/router/traefik.template b/tools/router/traefik.template
index f796ff43b..ab87becd5 100644
--- a/tools/router/traefik.template
+++ b/tools/router/traefik.template
@@ -23,7 +23,8 @@ api:
 entryPoints:
   websecure:
     address: ":443"
-
+  tcpamt:
+    address: ":4433"
 providers:
   docker:
     endpoint: "unix:///var/run/docker.sock"
@@ -139,6 +140,14 @@ tcp:
         - "websecure"
       tls:
         passthrough: true
+    TCProuter4:
+      rule: "HostSNI(`*`)"
+      priority: 10
+      service: "orch-kind-cira"
+      entryPoints:
+        - "tcpamt"
+      tls:
+        passthrough: true
   services:
     argo-kind:
       loadBalancer:
@@ -148,6 +157,10 @@ tcp:
       loadBalancer:
         servers:
           - address: {{ .OrchIP }}:443
+    orch-kind-cira:
+      loadBalancer:
+        servers:
+          - address: {{ .OrchIP }}:4433
     boots-kind:
       loadBalancer:
         servers:


Reviews:
user: login: github-actions[bot]
body: Thank you for your contribution! Please make sure to review our [Contributing Guide](https://github.com/open-edge-platform/edge-manageability-framework/blob/main/.github/CONTRIBUTING.md).
state: COMMENTED
author_association: NONE
submitted_at: 2025-04-03T07:37:20Z
user: login: DevipriyaS17
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-03T08:50:25Z
user: login: ikyrycho
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-12T10:14:31Z
user: login: ikyrycho
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-20T11:21:33Z
user: login: ikyrycho
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-20T11:21:44Z
user: login: ikyrycho
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-20T11:21:53Z
user: login: DevipriyaS17
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-21T10:52:39Z
user: login: DevipriyaS17
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-21T10:52:46Z
user: login: DevipriyaS17
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-21T10:55:28Z
user: login: ikyrycho
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-22T12:06:07Z
user: login: ikyrycho
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-05-22T12:06:17Z
user: login: DevipriyaS17
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-22T14:09:26Z
user: login: pierventre
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-23T06:53:57Z
user: login: pierventre
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-23T06:56:12Z
user: login: pierventre
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-23T06:56:29Z
user: login: pierventre
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-23T07:03:12Z
user: login: pierventre
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-23T07:03:42Z
user: login: pierventre
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-23T07:04:10Z
user: login: pierventre
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-23T07:20:23Z
user: login: pierventre
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-23T07:21:21Z
user: login: DevipriyaS17
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-23T07:52:18Z
user: login: DevipriyaS17
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-23T07:52:42Z
user: login: DevipriyaS17
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-23T07:53:17Z
user: login: DevipriyaS17
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-23T07:56:36Z
user: login: DevipriyaS17
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-23T07:58:38Z
user: login: DevipriyaS17
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-23T08:15:08Z
user: login: DevipriyaS17
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-23T08:15:17Z
user: login: DevipriyaS17
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-23T08:17:47Z
user: login: DevipriyaS17
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-23T08:17:57Z
user: login: DevipriyaS17
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-23T08:18:03Z
user: login: DevipriyaS17
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-23T08:20:12Z
user: login: ANUSHABHASKAR
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-05-23T11:01:38Z
user: login: pierventre
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-05-23T16:24:44Z
user: login: pierventre
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-05-26T21:32:03Z
user: login: ikyrycho
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-05-27T10:39:52Z
user: login: pierventre
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-05-27T11:34:09Z
user: login: palade
body: Left one comment
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-05-27T11:41:35Z
user: login: ikyrycho
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-27T11:46:30Z

Review comments:
diff_hunk: @@ -5,7 +5,7 @@
 namespaces:
   - name: "orch-infra"
     labels:
-      istio-injection: enabled
+      istio-injection: disabled
path: argocd/applications/configs/namespace-label.yaml
user: login: DevipriyaS17
body: this change is temporary to debug the tcp connection port issue
created_at: 2025-04-03T08:50:25Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1220,6 +1220,11 @@ func firewallDataLookup(dest string) (string, string, bool) {
 		"observability-ui.":       {northboundSource, "Observability", false},
 		"onboarding-node.":        {southboundSource, "Infrastructure Management", false},
 		"onboarding-stream.":      {southboundSource, "Infrastructure Management", false},
+		"mps-node.":               {southboundSource, "Infrastructure Management", false},
+		"mps-webport-node.":       {southboundSource, "Infrastructure Management", false},
path: mage/generate.go
user: login: ikyrycho
body: DMT UI is not deployed, so we have to remove UI-related ports/settings.
created_at: 2025-05-12T10:14:31Z
author_association: CONTRIBUTOR
diff_hunk: @@ -19,9 +19,9 @@ metadata:
 spec:
   project: {{ required "A valid projectName entry required!" .Values.argo.project }}
   sources:
-    - repoURL: {{ required "A valid chartRepoURL entry required!" .Values.argo.chartRepoURL }}
-      chart: infra/charts/{{$appName}}
-      targetRevision: 2.1.3
+    - repoURL: https://github.com/open-edge-platform/infra-charts
+      path: infra-external
+      targetRevision: amt-latest
path: argocd/applications/templates/infra-external.yaml
user: login: ikyrycho
body: TODO: revert before merge
created_at: 2025-05-20T11:21:33Z
author_association: CONTRIBUTOR
diff_hunk: @@ -19,9 +19,9 @@ metadata:
 spec:
   project: {{ required "A valid projectName entry required!" .Values.argo.project }}
   sources:
-    - repoURL: {{ required "A valid chartRepoURL entry required!" .Values.argo.chartRepoURL }}
-      chart: common/charts/{{$appName}}
-      targetRevision: 4.0.8
+    - repoURL: https://github.com/open-edge-platform/orch-utils
+      path: charts/{{$appName}}
+      targetRevision: amt-latest
path: argocd/applications/templates/self-signed-cert.yaml
user: login: ikyrycho
body: TODO: revert before merge
created_at: 2025-05-20T11:21:44Z
author_association: CONTRIBUTOR
diff_hunk: @@ -19,9 +19,9 @@ metadata:
 spec:
   project: {{ required "A valid projectName entry required!" .Values.argo.project }}
   sources:
-    - repoURL: {{ required "A valid chartRepoURL entry required!" .Values.argo.chartRepoURL }}
-      chart: common/charts/{{$appName}}
-      targetRevision: 4.1.9
+    - repoURL: https://github.com/open-edge-platform/orch-utils
+      path: charts/{{$appName}}
+      targetRevision: amt-latest
path: argocd/applications/templates/traefik-extra-objects.yaml
user: login: ikyrycho
body: TODO: revert before merge
created_at: 2025-05-20T11:21:52Z
author_association: CONTRIBUTOR
diff_hunk: @@ -19,9 +19,9 @@ metadata:
 spec:
   project: {{ required "A valid projectName entry required!" .Values.argo.project }}
   sources:
-    - repoURL: {{ required "A valid chartRepoURL entry required!" .Values.argo.chartRepoURL }}
-      chart: infra/charts/{{$appName}}
-      targetRevision: 2.1.3
+    - repoURL: https://github.com/open-edge-platform/infra-charts
+      path: infra-external
+      targetRevision: amt-latest
path: argocd/applications/templates/infra-external.yaml
user: login: DevipriyaS17
body: reverted to the format, can update the version accordingly once we release the charts 
created_at: 2025-05-21T10:52:39Z
author_association: CONTRIBUTOR
diff_hunk: @@ -19,9 +19,9 @@ metadata:
 spec:
   project: {{ required "A valid projectName entry required!" .Values.argo.project }}
   sources:
-    - repoURL: {{ required "A valid chartRepoURL entry required!" .Values.argo.chartRepoURL }}
-      chart: common/charts/{{$appName}}
-      targetRevision: 4.0.8
+    - repoURL: https://github.com/open-edge-platform/orch-utils
+      path: charts/{{$appName}}
+      targetRevision: amt-latest
path: argocd/applications/templates/self-signed-cert.yaml
user: login: DevipriyaS17
body: done
created_at: 2025-05-21T10:52:46Z
author_association: CONTRIBUTOR
diff_hunk: @@ -19,9 +19,9 @@ metadata:
 spec:
   project: {{ required "A valid projectName entry required!" .Values.argo.project }}
   sources:
-    - repoURL: {{ required "A valid chartRepoURL entry required!" .Values.argo.chartRepoURL }}
-      chart: common/charts/{{$appName}}
-      targetRevision: 4.1.9
+    - repoURL: https://github.com/open-edge-platform/orch-utils
+      path: charts/{{$appName}}
+      targetRevision: amt-latest
path: argocd/applications/templates/traefik-extra-objects.yaml
user: login: DevipriyaS17
body: done
created_at: 2025-05-21T10:55:28Z
author_association: CONTRIBUTOR
diff_hunk: @@ -63,6 +63,7 @@ var giteaRepos = []string{
 var githubRepos = []string{
 	"https://github.com/open-edge-platform/edge-manageability-framework",
 	"https://github.com/open-edge-platform/orch-utils",
+	"https://github.com/open-edge-platform/infra-charts",
path: mage/Magefile.go
user: login: ikyrycho
body: Do we need this?
created_at: 2025-05-22T12:06:07Z
author_association: CONTRIBUTOR
diff_hunk: @@ -63,6 +63,7 @@ var giteaRepos = []string{
 var githubRepos = []string{
 	"https://github.com/open-edge-platform/edge-manageability-framework",
 	"https://github.com/open-edge-platform/orch-utils",
+	"https://github.com/open-edge-platform/infra-charts",
path: mage/Magefile.go
user: login: DevipriyaS17
body: No, have removed and updated it
created_at: 2025-05-22T14:09:26Z
author_association: CONTRIBUTOR
diff_hunk: @@ -37,6 +37,8 @@ restrictedPolicyOrch:
       - "edgenode-observability-opentelemetry-collector*"
       - "edgenode-observability-minio*"
       - "dkam*"
+      - "mps*"
+      - "rps*"
path: argocd/applications/configs/kyverno-extra-policies.yaml
user: login: pierventre
body: what are the issues? Is there something we can fix in the charts ?
created_at: 2025-05-23T06:53:56Z
author_association: CONTRIBUTOR
diff_hunk: @@ -37,6 +37,8 @@ restrictedPolicyOrch:
       - "edgenode-observability-opentelemetry-collector*"
       - "edgenode-observability-minio*"
       - "dkam*"
+      - "mps*"
+      - "rps*"
path: argocd/applications/configs/kyverno-extra-policies.yaml
user: login: pierventre
body: please create tickets and use our 24617 as EPIC
created_at: 2025-05-23T06:56:12Z
author_association: CONTRIBUTOR
diff_hunk: @@ -20,6 +20,8 @@ jwtMiddlewareException:
       - "iam-umbrella-nexus-api-gw-api-docs"
       - "cluster-connect-gateway-ws"
       - "cluster-connect-gateway-kubeapi"
+      - "amt-api-mps"
+      - "amt-api-rps"
path: argocd/applications/configs/kyverno-traefik-policy.yaml
user: login: pierventre
body: why do we need these exceptions?
created_at: 2025-05-23T06:56:28Z
author_association: CONTRIBUTOR
path: argocd/applications/custom/infra-external.tpl
user: login: pierventre
body: I would drop `node` from all these APIs. There is no difference between north and south like we have for our services
created_at: 2025-05-23T07:03:12Z
author_association: CONTRIBUTOR
diff_hunk: @@ -84,3 +84,27 @@ loca-templates-manager:
   {{- end}}
   {{- end}}
 {{- end }}
+
+amt:
+  mps:
+    commonName: "mps-node.{{ .Values.argo.clusterDomain }}"
+    traefikReverseProxy:
+      host:
+        cira:
+          name: "mps-node.{{ .Values.argo.clusterDomain }}"
+        webport: # Define a new name for the other port
+          name: "mps-webport-node.{{ .Values.argo.clusterDomain }}" # Define the name for the new port
path: argocd/applications/custom/infra-external.tpl
user: login: pierventre
body: ```suggestion
          name: "mps-wss-node.{{ .Values.argo.clusterDomain }}" # Define the name for the new port
```
webport is the WebSocket ?
created_at: 2025-05-23T07:03:42Z
author_association: CONTRIBUTOR
diff_hunk: @@ -38,6 +38,10 @@ infra-config:
     orchAttestationStatus: attest-node.{{ .Values.argo.clusterDomain }}:443
     orchRegistry: {{ .Values.argo.releaseService.ociRegistry }}:9443
     orchFileServer: {{ .Values.argo.releaseService.fileServer }}:60444
+    orchMPSHost: mps-node.{{ .Values.argo.clusterDomain }}:4433
+    orchMPSWHost: mps-webport-node.{{ .Values.argo.clusterDomain }}:443
+    orchRPSHost: rps-node.{{ .Values.argo.clusterDomain }}:443
+    orchRPSWHost: rps-webport-node.{{ .Values.argo.clusterDomain }}:443
path: argocd/applications/custom/infra-onboarding.tpl
user: login: pierventre
body: do we need here at the moment ?
created_at: 2025-05-23T07:04:09Z
author_association: CONTRIBUTOR
path: mage/generate.go
user: login: pierventre
body: see my comment about node and webport
created_at: 2025-05-23T07:20:23Z
author_association: CONTRIBUTOR
diff_hunk: @@ -67,6 +67,12 @@ variable "dns_hosts" {
     { hostname = "observability-ui.cluster.onprem", ip = "192.168.99.30" },
     { hostname = "onboarding-node.cluster.onprem", ip = "192.168.99.30" },
     { hostname = "onboarding-stream.cluster.onprem", ip = "192.168.99.30" },
+    { hostname = "mps-node.cluster.onprem", ip = "192.168.99.30" },
+    { hostname = "mps-webport-node.cluster.onprem", ip = "192.168.99.30" },
+    { hostname = "rps-node.cluster.onprem", ip = "192.168.99.30" },
+    { hostname = "rps-webport-node.cluster.onprem", ip = "192.168.99.30" },
+    { hostname = "onboarding.cluster.onprem", ip = "192.168.99.30" },
+    { hostname = "orchestrator-license.cluster.onprem", ip = "192.168.99.30" },
path: terraform/edge-network/variables.tf
user: login: pierventre
body: remove those. They seem coming from old content
created_at: 2025-05-23T07:21:20Z
author_association: CONTRIBUTOR
diff_hunk: @@ -20,6 +20,8 @@ jwtMiddlewareException:
       - "iam-umbrella-nexus-api-gw-api-docs"
       - "cluster-connect-gateway-ws"
       - "cluster-connect-gateway-kubeapi"
+      - "amt-api-mps"
+      - "amt-api-rps"
path: argocd/applications/configs/kyverno-traefik-policy.yaml
user: login: DevipriyaS17
body: was getting kyverno webhook denied the request due to middleware policy
created_at: 2025-05-23T07:52:18Z
author_association: CONTRIBUTOR
diff_hunk: @@ -84,3 +84,27 @@ loca-templates-manager:
   {{- end}}
   {{- end}}
 {{- end }}
+
+amt:
+  mps:
+    commonName: "mps-node.{{ .Values.argo.clusterDomain }}"
+    traefikReverseProxy:
+      host:
+        cira:
+          name: "mps-node.{{ .Values.argo.clusterDomain }}"
+        webport: # Define a new name for the other port
+          name: "mps-webport-node.{{ .Values.argo.clusterDomain }}" # Define the name for the new port
path: argocd/applications/custom/infra-external.tpl
user: login: DevipriyaS17
body: yes
created_at: 2025-05-23T07:52:42Z
author_association: CONTRIBUTOR
diff_hunk: @@ -38,6 +38,10 @@ infra-config:
     orchAttestationStatus: attest-node.{{ .Values.argo.clusterDomain }}:443
     orchRegistry: {{ .Values.argo.releaseService.ociRegistry }}:9443
     orchFileServer: {{ .Values.argo.releaseService.fileServer }}:60444
+    orchMPSHost: mps-node.{{ .Values.argo.clusterDomain }}:4433
+    orchMPSWHost: mps-webport-node.{{ .Values.argo.clusterDomain }}:443
+    orchRPSHost: rps-node.{{ .Values.argo.clusterDomain }}:443
+    orchRPSWHost: rps-webport-node.{{ .Values.argo.clusterDomain }}:443
path: argocd/applications/custom/infra-onboarding.tpl
user: login: DevipriyaS17
body: i believe yes,will create a ticket to track this to keep or remove in future pr
created_at: 2025-05-23T07:53:16Z
author_association: CONTRIBUTOR
path: argocd/applications/custom/infra-external.tpl
user: login: DevipriyaS17
body: okay.. can we do these changes as part of a ticket on future PR?
created_at: 2025-05-23T07:56:36Z
author_association: CONTRIBUTOR
diff_hunk: @@ -67,6 +67,12 @@ variable "dns_hosts" {
     { hostname = "observability-ui.cluster.onprem", ip = "192.168.99.30" },
     { hostname = "onboarding-node.cluster.onprem", ip = "192.168.99.30" },
     { hostname = "onboarding-stream.cluster.onprem", ip = "192.168.99.30" },
+    { hostname = "mps-node.cluster.onprem", ip = "192.168.99.30" },
+    { hostname = "mps-webport-node.cluster.onprem", ip = "192.168.99.30" },
+    { hostname = "rps-node.cluster.onprem", ip = "192.168.99.30" },
+    { hostname = "rps-webport-node.cluster.onprem", ip = "192.168.99.30" },
+    { hostname = "onboarding.cluster.onprem", ip = "192.168.99.30" },
+    { hostname = "orchestrator-license.cluster.onprem", ip = "192.168.99.30" },
path: terraform/edge-network/variables.tf
user: login: DevipriyaS17
body: done
created_at: 2025-05-23T07:58:38Z
author_association: CONTRIBUTOR
diff_hunk: @@ -37,6 +37,8 @@ restrictedPolicyOrch:
       - "edgenode-observability-opentelemetry-collector*"
       - "edgenode-observability-minio*"
       - "dkam*"
+      - "mps*"
+      - "rps*"
path: argocd/applications/configs/kyverno-extra-policies.yaml
user: login: DevipriyaS17
body: ITEP-67861
created_at: 2025-05-23T08:15:08Z
author_association: CONTRIBUTOR
diff_hunk: @@ -20,6 +20,8 @@ jwtMiddlewareException:
       - "iam-umbrella-nexus-api-gw-api-docs"
       - "cluster-connect-gateway-ws"
       - "cluster-connect-gateway-kubeapi"
+      - "amt-api-mps"
+      - "amt-api-rps"
path: argocd/applications/configs/kyverno-traefik-policy.yaml
user: login: DevipriyaS17
body: ITEP-67861
created_at: 2025-05-23T08:15:16Z
author_association: CONTRIBUTOR
path: argocd/applications/custom/infra-external.tpl
user: login: DevipriyaS17
body: ITEP-67862
created_at: 2025-05-23T08:17:47Z
author_association: CONTRIBUTOR
diff_hunk: @@ -84,3 +84,27 @@ loca-templates-manager:
   {{- end}}
   {{- end}}
 {{- end }}
+
+amt:
+  mps:
+    commonName: "mps-node.{{ .Values.argo.clusterDomain }}"
+    traefikReverseProxy:
+      host:
+        cira:
+          name: "mps-node.{{ .Values.argo.clusterDomain }}"
+        webport: # Define a new name for the other port
+          name: "mps-webport-node.{{ .Values.argo.clusterDomain }}" # Define the name for the new port
path: argocd/applications/custom/infra-external.tpl
user: login: DevipriyaS17
body: ITEP-67862
created_at: 2025-05-23T08:17:56Z
author_association: CONTRIBUTOR
path: mage/generate.go
user: login: DevipriyaS17
body: ITEP-67862
created_at: 2025-05-23T08:18:03Z
author_association: CONTRIBUTOR
diff_hunk: @@ -38,6 +38,10 @@ infra-config:
     orchAttestationStatus: attest-node.{{ .Values.argo.clusterDomain }}:443
     orchRegistry: {{ .Values.argo.releaseService.ociRegistry }}:9443
     orchFileServer: {{ .Values.argo.releaseService.fileServer }}:60444
+    orchMPSHost: mps-node.{{ .Values.argo.clusterDomain }}:4433
+    orchMPSWHost: mps-webport-node.{{ .Values.argo.clusterDomain }}:443
+    orchRPSHost: rps-node.{{ .Values.argo.clusterDomain }}:443
+    orchRPSWHost: rps-webport-node.{{ .Values.argo.clusterDomain }}:443
path: argocd/applications/custom/infra-onboarding.tpl
user: login: DevipriyaS17
body: ITEP-67863
created_at: 2025-05-23T08:20:12Z
author_association: CONTRIBUTOR
diff_hunk: @@ -78,3 +80,27 @@ loca-credentials:
   params:
     keycloakUrl: "http://platform-keycloak.orch-platform.svc.cluster.local:8080"
     vaultUrl: "http://vault.orch-platform.svc.cluster.local:8200"
+
+amt:
+  mps:
+    traefikReverseProxy:
+      enabled: true
+      secretName: "tls-orch"
+      tlsOption: "gateway-tls"
+      gatewayNamespace: orch-gateway
+  rps:
+    traefikReverseProxy:
+      enabled: true
+      secretName: "tls-orch"
+      tlsOption: "gateway-tls"
+      gatewayNamespace: orch-gateway
+  dm-manager:
+    serviceArgs:
+      # Password policy for AMT
+      # If 'static', then password from params.password will be used for every AMT device.
+      # If 'dynamic', then password will be generated for each AMT device.
+      passwordPolicy: static
+    params:
path: argocd/applications/configs/infra-external.yaml
user: login: palade
body: How is this provided by the user? We may need to make changes on the onprem if it requires user input.
created_at: 2025-05-27T11:41:21Z
author_association: CONTRIBUTOR
diff_hunk: @@ -78,3 +80,27 @@ loca-credentials:
   params:
     keycloakUrl: "http://platform-keycloak.orch-platform.svc.cluster.local:8080"
     vaultUrl: "http://vault.orch-platform.svc.cluster.local:8200"
+
+amt:
+  mps:
+    traefikReverseProxy:
+      enabled: true
+      secretName: "tls-orch"
+      tlsOption: "gateway-tls"
+      gatewayNamespace: orch-gateway
+  rps:
+    traefikReverseProxy:
+      enabled: true
+      secretName: "tls-orch"
+      tlsOption: "gateway-tls"
+      gatewayNamespace: orch-gateway
+  dm-manager:
+    serviceArgs:
+      # Password policy for AMT
+      # If 'static', then password from params.password will be used for every AMT device.
+      # If 'dynamic', then password will be generated for each AMT device.
+      passwordPolicy: static
+    params:
path: argocd/applications/configs/infra-external.yaml
user: login: ikyrycho
body: For now this part does nothing, as https://github.com/open-edge-platform/infra-charts/pull/58 is not yet merged.
In future, we are planning to have `dynamic` password policy, that will automatically generate password and will not require user interaction and will be default type and `static`, which will be mainly used for validation/development. We will write in documentation for AMT that if you want to use `static`, then during installation of orch you have to go into this file and edit it.
created_at: 2025-05-27T11:46:30Z
author_association: CONTRIBUTOR

PR comments:
user: login: DevipriyaS17
created_at: 2025-04-16T18:36:19Z
body: smoke test is pending
author_association: CONTRIBUTOR
user: login: pierventre
created_at: 2025-05-23T07:46:28Z
body: also check if there is contnt that need to be updated under orch-configs
https://github.com/search?q=repo%3Aopen-edge-platform%2Fedge-manageability-framework+infra-external+path%3Aorch-configs&type=code

Do we have issue with Lenovo components?
author_association: CONTRIBUTOR
user: login: zdw
created_at: 2025-05-26T04:39:27Z
body: API mappings for MPS and RPS: https://github.com/open-edge-platform/orch-utils/pull/106
author_association: CONTRIBUTOR