OOM code transfer for AAI (inc)

Incremental code transfer from oom/kubernetes/aai
into the aai/oom tech team repo.

Change-Id: I7cdf904377022bcf806033544760d539df11c6cf
Issue-ID: CIMAN-250

17 files changed, 351 insertions, 105 deletions

diff --git a/charts/aai-elasticsearch/resources/config/sg/sg_config.yml b/charts/aai-elasticsearch/resources/config/sg/sg_config.yml
index 9172b71..d0050e0 100644
--- a/charts/aai-elasticsearch/resources/config/sg/sg_config.yml
+++ b/charts/aai-elasticsearch/resources/config/sg/sg_config.yml
@@ -37,35 +37,28 @@
 # HTTP
 #   basic (challenging)
 #   proxy (not challenging, needs xff)
-#   kerberos (challenging)
 #   clientcert (not challenging, needs https)
-#   jwt (not challenging)
 #   host (not challenging) #DEPRECATED, will be removed in a future version.
 #                           host based authentication is configurable in sg_roles_mapping
 
 # Authc
 #   internal
 #   noop
-#   ldap
 
 # Authz
-#   ldap
 #   noop
 
+# Some SearchGuard functionality is licensed under Apache-2.0, while other functionality is non-free;
+# see https://github.com/floragunncom/search-guard. The functionality enabled in this configuration
+# file only include those that are licensed under Apache-2.0. Please use care and review SearchGuard's
+# license details before enabling any additional features here.
+
 searchguard:
   dynamic:
     # Set filtered_alias_mode to 'disallow' to forbid more than 2 filtered aliases per index
     # Set filtered_alias_mode to 'warn' to allow more than 2 filtered aliases per index but warns about it (default)
     # Set filtered_alias_mode to 'nowarn' to allow more than 2 filtered aliases per index silently
     #filtered_alias_mode: warn
-    #kibana:
-      # Kibana multitenancy
-      # see https://github.com/floragunncom/search-guard-docs/blob/master/multitenancy.md
-      # To make this work you need to install https://github.com/floragunncom/search-guard-module-kibana-multitenancy/wiki
-      #multitenancy_enabled: true
-      #server_username: kibanaserver
-      #index: '.kibana'
-      #do_not_fail_on_forbidden: false
     http:
       anonymous_auth_enabled: false
       xff:
@@ -80,20 +73,6 @@ searchguard:
         ###### and here https://tools.ietf.org/html/rfc7239
         ###### and https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Remote_IP_Valve
     authc:
-      kerberos_auth_domain: 
-        http_enabled: false
-        transport_enabled: false
-        order: 6
-        http_authenticator:
-          type: kerberos
-          challenge: true
-          config:
-            # If true a lot of kerberos/security related debugging output will be logged to standard out
-            krb_debug: false
-            # If true then the realm will be stripped from the user name
-            strip_realm_from_principal: true
-        authentication_backend:
-          type: noop
       basic_internal_auth_domain:
         http_enabled: true
         transport_enabled: true
@@ -141,81 +120,4 @@ searchguard:
           challenge: false
         authentication_backend:
           type: noop
-      ldap:
-        http_enabled: false
-        transport_enabled: false
-        order: 5
-        http_authenticator:
-          type: basic
-          challenge: false
-        authentication_backend:
-          # LDAP authentication backend (authenticate users against a LDAP or Active Directory)
-          type: ldap
-          config:
-            # enable ldaps
-            enable_ssl: false
-            # enable start tls, enable_ssl should be false
-            enable_start_tls: false
-            # send client certificate
-            enable_ssl_client_auth: false
-            # verify ldap hostname
-            verify_hostnames: true
-            hosts:
-              - localhost:8389
-            bind_dn: null
-            password: null
-            userbase: 'ou=people,dc=example,dc=com'
-            # Filter to search for users (currently in the whole subtree beneath userbase)
-            # {0} is substituted with the username 
-            usersearch: '(sAMAccountName={0})'
-            # Use this attribute from the user as username (if not set then DN is used)
-            username_attribute: null
-    authz:    
-      roles_from_myldap:
-        http_enabled: false
-        transport_enabled: false
-        authorization_backend:
-          # LDAP authorization backend (gather roles from a LDAP or Active Directory, you have to configure the above LDAP authentication backend settings too)
-          type: ldap
-          config:
-            # enable ldaps
-            enable_ssl: false
-            # enable start tls, enable_ssl should be false
-            enable_start_tls: false
-            # send client certificate
-            enable_ssl_client_auth: false
-            # verify ldap hostname
-            verify_hostnames: true
-            hosts:
-              - localhost:8389
-            bind_dn: null
-            password: null
-            rolebase: 'ou=groups,dc=example,dc=com'
-            # Filter to search for roles (currently in the whole subtree beneath rolebase)
-            # {0} is substituted with the DN of the user
-            # {1} is substituted with the username 
-            # {2} is substituted with an attribute value from user's directory entry, of the authenticated user. Use userroleattribute to specify the name of the attribute            
-            rolesearch: '(member={0})'
-            # Specify the name of the attribute which value should be substituted with {2} above
-            userroleattribute: null
-            # Roles as an attribute of the user entry
-            userrolename: disabled
-            #userrolename: memberOf
-            # The attribute in a role entry containing the name of that role, Default is "name".
-            # Can also be "dn" to use the full DN as rolename.
-            rolename: cn
-            # Resolve nested roles transitive (roles which are members of other roles and so on ...)
-            resolve_nested_roles: true
-            userbase: 'ou=people,dc=example,dc=com'
-            # Filter to search for users (currently in the whole subtree beneath userbase)
-            # {0} is substituted with the username 
-            usersearch: '(uid={0})'
-            # Skip users matching a user name, a wildcard or a regex pattern
-            #skip_users: 
-            #  - 'cn=Michael Jackson,ou*people,o=TEST'
-            #  - '/\S*/'    
-      roles_from_another_ldap:
-        enabled: false
-        authorization_backend:
-          type: ldap
-          #config goes here ...
+    authz:
\ No newline at end of file
diff --git a/charts/aai-search-data/resources/fproxy/config/fproxy.properties b/charts/aai-search-data/resources/fproxy/config/fproxy.properties
new file mode 100644
index 0000000..f512fb7
--- /dev/null
+++ b/charts/aai-search-data/resources/fproxy/config/fproxy.properties
@@ -0,0 +1,2 @@
+credential.cache.timeout.ms=180000
+transactionid.header.name=X-TransactionId
\ No newline at end of file
diff --git a/charts/aai-search-data/resources/fproxy/config/logback-spring.xml b/charts/aai-search-data/resources/fproxy/config/logback-spring.xml
new file mode 100644
index 0000000..edac199
--- /dev/null
+++ b/charts/aai-search-data/resources/fproxy/config/logback-spring.xml
@@ -0,0 +1,48 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<configuration>
+
+    <property name="LOGS" value="./logs/AAF-FPS" />
+    <property name="FILEPREFIX" value="application" />
+
+    <appender name="Console"
+        class="ch.qos.logback.core.ConsoleAppender">
+        <layout class="ch.qos.logback.classic.PatternLayout">
+            <Pattern>
+                %d{ISO8601} %-5level [%t] %C{1.}: %msg%n%throwable
+            </Pattern>
+        </layout>
+    </appender>
+
+    <appender name="RollingFile"
+        class="ch.qos.logback.core.rolling.RollingFileAppender">
+        <file>${LOGS}/${FILEPREFIX}.log</file>
+        <encoder
+            class="ch.qos.logback.classic.encoder.PatternLayoutEncoder">
+            <Pattern>%d %p %C{1.} [%t] %m%n</Pattern>
+        </encoder>
+
+        <rollingPolicy
+            class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
+            <!-- rollover daily and when the file reaches 10 MegaBytes -->
+            <fileNamePattern>${LOGS}/archived/${FILEPREFIX}-%d{yyyy-MM-dd}.%i.log
+            </fileNamePattern>
+            <timeBasedFileNamingAndTriggeringPolicy
+                class="ch.qos.logback.core.rolling.SizeAndTimeBasedFNATP">
+                <maxFileSize>10MB</maxFileSize>
+            </timeBasedFileNamingAndTriggeringPolicy>
+        </rollingPolicy>
+    </appender>
+
+    <!-- LOG everything at INFO level -->
+    <root level="debug">
+        <appender-ref ref="RollingFile" />
+        <appender-ref ref="Console" />
+    </root>
+
+    <!-- LOG "com.baeldung*" at TRACE level -->
+    <logger name="org.onap.aaf.fproxy" level="trace" additivity="false">
+        <appender-ref ref="RollingFile" />
+        <appender-ref ref="Console" />
+    </logger>
+
+</configuration>
diff --git a/charts/aai-search-data/resources/fproxy/config/readme.txt b/charts/aai-search-data/resources/fproxy/config/readme.txt
new file mode 100644
index 0000000..79cf29e
--- /dev/null
+++ b/charts/aai-search-data/resources/fproxy/config/readme.txt
@@ -0,0 +1 @@
+Relevant configuration files need to be copied here to successfully run this service locally.
\ No newline at end of file
diff --git a/charts/aai-search-data/resources/rproxy/config/auth/uri-authorization.json b/charts/aai-search-data/resources/rproxy/config/auth/uri-authorization.json
new file mode 100644
index 0000000..595d484
--- /dev/null
+++ b/charts/aai-search-data/resources/rproxy/config/auth/uri-authorization.json
@@ -0,0 +1,11 @@
+[
+  {
+    "uri": "\/services\/search-data-service\/.*",
+    "method": "GET|PUT|POST|DELETE",
+    "permissions": [
+      "org\\.onap\\.aai\\.resources\\|\\*\\|.*"
+     ]
+  }
+
+
+]
diff --git a/charts/aai-search-data/resources/rproxy/config/cadi.properties b/charts/aai-search-data/resources/rproxy/config/cadi.properties
new file mode 100644
index 0000000..c2b628d
--- /dev/null
+++ b/charts/aai-search-data/resources/rproxy/config/cadi.properties
@@ -0,0 +1,39 @@
+# This is a normal Java Properties File
+# Comments are with Pound Signs at beginning of lines,
+# and multi-line expression of properties can be obtained by backslash at end of line
+
+#hostname is used for local testing where you may have to set your hostname to **.att.com or **.sbc.com. The example given below
+#will allow for an ATT cross domain cookie to be used for GLO. If you are running on Windows corp machine, your machine name 
+#may be used automatically by cadi. However, if it is not, you will need to use hostname=mywebserver.att.com and add mywebserver.att.com
+#to your hosts file on your machine.
+#hostname=test.aic.cip.att.com
+
+cadi_loglevel=DEBUG
+
+# OAuth2
+aaf_oauth2_token_url=https://AAF_LOCATE_URL/AAF_NS.token:2.0/token
+aaf_oauth2_introspect_url=https://AAF_LOCATE_URL/AAF_NS.introspect:2.0/introspect
+
+cadi_latitude=37.78187
+cadi_longitude=-122.26147
+
+# Locate URL (which AAF Env)
+aaf_locate_url=https://aaf-locate.{{.Release.Namespace}}:8095
+
+# AAF URL
+aaf_url=https://AAF_LOCATE_URL/AAF_NS.service:2.0
+
+cadi_keyfile=/opt/app/rproxy/config/security/keyfile
+cadi_keystore=/opt/app/rproxy/config/auth/org.onap.aai.p12
+cadi_keystore_password=enc:383RDJRFA6yQz9AOxUxC1iIg3xTJXityw05MswnpnEtelRQy2D4r5INQjrea7GTV
+cadi_alias=aai@aai.onap.org
+cadi_truststore=/opt/app/rproxy/config/auth/tomcat_keystore
+cadi_truststore_password=OBF:1y0q1uvc1uum1uvg1pil1pjl1uuq1uvk1uuu1y10
+
+aaf_env=DEV
+
+aaf_id=demo@people.osaaf.org
+aaf_password=enc:92w4px0y_rrm265LXLpw58QnNPgDXykyA1YTrflbAKz
+
+# This is a colon separated list of client cert issuers
+cadi_x509_issuers=CN=ONAP, OU=ONAP, O=ONAP, L=Ottawa, ST=Ontario, C=CA
diff --git a/charts/aai-search-data/resources/rproxy/config/forward-proxy.properties b/charts/aai-search-data/resources/rproxy/config/forward-proxy.properties
new file mode 100644
index 0000000..55a9b48
--- /dev/null
+++ b/charts/aai-search-data/resources/rproxy/config/forward-proxy.properties
@@ -0,0 +1,4 @@
+forward-proxy.protocol = https
+forward-proxy.host = localhost
+forward-proxy.port = 10680
+forward-proxy.cacheurl = /credential-cache
diff --git a/charts/aai-search-data/resources/rproxy/config/logback-spring.xml b/charts/aai-search-data/resources/rproxy/config/logback-spring.xml
new file mode 100644
index 0000000..289fe75
--- /dev/null
+++ b/charts/aai-search-data/resources/rproxy/config/logback-spring.xml
@@ -0,0 +1,48 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<configuration>
+
+    <property name="LOGS" value="./logs/reverse-proxy" />
+    <property name="FILEPREFIX" value="application" />
+
+    <appender name="Console"
+        class="ch.qos.logback.core.ConsoleAppender">
+        <layout class="ch.qos.logback.classic.PatternLayout">
+            <Pattern>
+                %d{ISO8601} %-5level [%t] %C{1.}: %msg%n%throwable
+            </Pattern>
+        </layout>
+    </appender>
+
+    <appender name="RollingFile"
+        class="ch.qos.logback.core.rolling.RollingFileAppender">
+        <file>${LOGS}/${FILEPREFIX}.log</file>
+        <encoder
+            class="ch.qos.logback.classic.encoder.PatternLayoutEncoder">
+            <Pattern>%d %p %C{1.} [%t] %m%n</Pattern>
+        </encoder>
+
+        <rollingPolicy
+            class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
+            <!-- rollover daily and when the file reaches 10 MegaBytes -->
+            <fileNamePattern>${LOGS}/archived/${FILEPREFIX}-%d{yyyy-MM-dd}.%i.log
+            </fileNamePattern>
+            <timeBasedFileNamingAndTriggeringPolicy
+                class="ch.qos.logback.core.rolling.SizeAndTimeBasedFNATP">
+                <maxFileSize>10MB</maxFileSize>
+            </timeBasedFileNamingAndTriggeringPolicy>
+        </rollingPolicy>
+    </appender>
+
+    <!-- LOG everything at INFO level -->
+    <root level="debug">
+        <appender-ref ref="RollingFile" />
+        <appender-ref ref="Console" />
+    </root>
+
+    <!-- LOG "com.baeldung*" at TRACE level  -->
+    <logger name="org.onap.aaf.rproxy" level="trace" additivity="false">
+        <appender-ref ref="RollingFile" />
+        <appender-ref ref="Console" />
+    </logger>
+
+</configuration>
diff --git a/charts/aai-search-data/resources/rproxy/config/primary-service.properties b/charts/aai-search-data/resources/rproxy/config/primary-service.properties
new file mode 100644
index 0000000..5fddcb2
--- /dev/null
+++ b/charts/aai-search-data/resources/rproxy/config/primary-service.properties
@@ -0,0 +1,3 @@
+primary-service.protocol = https
+primary-service.host = localhost
+primary-service.port = 9509
diff --git a/charts/aai-search-data/resources/rproxy/config/readme.txt b/charts/aai-search-data/resources/rproxy/config/readme.txt
new file mode 100644
index 0000000..79cf29e
--- /dev/null
+++ b/charts/aai-search-data/resources/rproxy/config/readme.txt
@@ -0,0 +1 @@
+Relevant configuration files need to be copied here to successfully run this service locally.
\ No newline at end of file
diff --git a/charts/aai-search-data/resources/rproxy/config/reverse-proxy.properties b/charts/aai-search-data/resources/rproxy/config/reverse-proxy.properties
new file mode 100644
index 0000000..8d46e1f
--- /dev/null
+++ b/charts/aai-search-data/resources/rproxy/config/reverse-proxy.properties
@@ -0,0 +1 @@
+transactionid.header.name=X-TransactionId
\ No newline at end of file
diff --git a/charts/aai-search-data/templates/configmap.yaml b/charts/aai-search-data/templates/configmap.yaml
index b1547f4..4361aa4 100644
--- a/charts/aai-search-data/templates/configmap.yaml
+++ b/charts/aai-search-data/templates/configmap.yaml
@@ -37,3 +37,47 @@ metadata:
     heritage: {{ .Release.Service }}
 data:
 {{ tpl (.Files.Glob "resources/config/log/logback.xml").AsConfig . | indent 2 }}
+
+{{ if .Values.global.installSidecarSecurity }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "common.fullname" . }}-fproxy-config
+  namespace: {{ include "common.namespace" . }}
+data:
+{{ tpl (.Files.Glob "resources/fproxy/config/*").AsConfig . | indent 2 }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "common.fullname" . }}-fproxy-log-config
+  namespace: {{ include "common.namespace" . }}
+data:
+{{ tpl (.Files.Glob "resources/fproxy/config/logback-spring.xml").AsConfig . | indent 2 }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "common.fullname" . }}-rproxy-config
+  namespace: {{ include "common.namespace" . }}
+data:
+{{ tpl (.Files.Glob "resources/rproxy/config/*").AsConfig . | indent 2 }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "common.fullname" . }}-rproxy-log-config
+  namespace: {{ include "common.namespace" . }}
+data:
+{{ tpl (.Files.Glob "resources/rproxy/config/logback-spring.xml").AsConfig . | indent 2 }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "common.fullname" . }}-rproxy-uri-auth-config
+  namespace: {{ include "common.namespace" . }}
+data:
+{{ tpl (.Files.Glob "resources/rproxy/config/auth/uri-authorization.json").AsConfig . | indent 2 }}
+{{ end }}
+
diff --git a/charts/aai-search-data/templates/deployment.yaml b/charts/aai-search-data/templates/deployment.yaml
index 1d39d4e..b63c4c5 100644
--- a/charts/aai-search-data/templates/deployment.yaml
+++ b/charts/aai-search-data/templates/deployment.yaml
@@ -35,6 +35,14 @@ spec:
         release: {{ .Release.Name }}
       name: {{ include "common.name" . }}
     spec:
+    {{ if .Values.global.installSidecarSecurity }}
+      initContainers:
+        - name: {{ .Values.global.tproxyConfig.name }}
+          image: "{{ include "common.repository" . }}/{{ .Values.global.tproxyConfig.image }}"
+          imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
+          securityContext:
+            privileged: true
+    {{ end }}
       containers:
       - name: {{ include "common.name" . }}
         image: "{{ include "common.repository" . }}/{{ .Values.image }}"
@@ -116,6 +124,84 @@ spec:
         - mountPath: /usr/share/filebeat/data
           name: {{ include "common.fullname" . }}-service-filebeat
 
+    {{ if .Values.global.installSidecarSecurity }}
+      - name: {{ .Values.global.rproxy.name }}
+        image: "{{ include "common.repository" . }}/{{ .Values.global.rproxy.image }}"
+        imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
+        env:
+        - name: CONFIG_HOME
+          value: "/opt/app/rproxy/config"
+        - name: KEY_STORE_PASSWORD
+          value: {{ .Values.config.keyStorePassword }}
+        - name: spring_profiles_active
+          value: {{ .Values.global.rproxy.activeSpringProfiles }}
+        volumeMounts:
+        - name: {{ include "common.fullname" . }}-rproxy-config
+          mountPath: /opt/app/rproxy/config/forward-proxy.properties
+          subPath: forward-proxy.properties
+        - name: {{ include "common.fullname" . }}-rproxy-config
+          mountPath: /opt/app/rproxy/config/primary-service.properties
+          subPath: primary-service.properties
+        - name: {{ include "common.fullname" . }}-rproxy-config
+          mountPath: /opt/app/rproxy/config/reverse-proxy.properties
+          subPath: reverse-proxy.properties
+        - name: {{ include "common.fullname" . }}-rproxy-config
+          mountPath: /opt/app/rproxy/config/cadi.properties
+          subPath: cadi.properties
+        - name: {{ include "common.fullname" . }}-rproxy-log-config
+          mountPath: /opt/app/rproxy/config/logback-spring.xml
+          subPath: logback-spring.xml
+        - name: {{ include "common.fullname" . }}-rproxy-auth-certs
+          mountPath: /opt/app/rproxy/config/auth/tomcat_keystore
+          subPath: tomcat_keystore
+        - name: {{ include "common.fullname" . }}-rproxy-auth-certs
+          mountPath: /opt/app/rproxy/config/auth/client-cert.p12
+          subPath: client-cert.p12
+        - name: {{ include "common.fullname" . }}-rproxy-uri-auth-config
+          mountPath: /opt/app/rproxy/config/auth/uri-authorization.json
+          subPath: uri-authorization.json
+        - name: {{ include "common.fullname" . }}-rproxy-auth-certs
+          mountPath: /opt/app/rproxy/config/auth/org.onap.aai.p12
+          subPath: org.onap.aai.p12
+        - name: {{ include "common.fullname" . }}-rproxy-security-config
+          mountPath: /opt/app/rproxy/config/security/keyfile
+          subPath: keyfile
+
+        ports:
+        - containerPort: {{ .Values.global.rproxy.port }}
+
+      - name: {{ .Values.global.fproxy.name }}
+        image: "{{ include "common.repository" . }}/{{ .Values.global.fproxy.image }}"
+        imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
+        env:
+        - name: CONFIG_HOME
+          value: "/opt/app/fproxy/config"
+        - name: KEY_STORE_PASSWORD
+          value: {{ .Values.config.keyStorePassword }}
+        - name: TRUST_STORE_PASSWORD
+          value: {{ .Values.config.trustStorePassword }}
+        - name: spring_profiles_active
+          value: {{ .Values.global.fproxy.activeSpringProfiles }}
+        volumeMounts:
+        - name: {{ include "common.fullname" . }}-fproxy-config
+          mountPath: /opt/app/fproxy/config/fproxy.properties
+          subPath: fproxy.properties
+        - name: {{ include "common.fullname" . }}-fproxy-log-config
+          mountPath: /opt/app/fproxy/config/logback-spring.xml
+          subPath: logback-spring.xml
+        - name: {{ include "common.fullname" . }}-fproxy-auth-certs
+          mountPath: /opt/app/fproxy/config/auth/fproxy_truststore
+          subPath: fproxy_truststore
+        - name: {{ include "common.fullname" . }}-fproxy-auth-certs
+          mountPath: /opt/app/fproxy/config/auth/tomcat_keystore
+          subPath: tomcat_keystore
+        - name: {{ include "common.fullname" . }}-fproxy-auth-certs
+          mountPath: /opt/app/fproxy/config/auth/client-cert.p12
+          subPath: client-cert.p12
+        ports:
+        - containerPort: {{ .Values.global.fproxy.port }}
+    {{ end }}
+
       volumes:
       - name: localtime
         hostPath:
@@ -139,6 +225,35 @@ spec:
       - name: {{ include "common.fullname" . }}-service-log-conf
         configMap:
          name: {{ include "common.fullname" . }}-service-log
+    {{ if .Values.global.installSidecarSecurity }}
+      - name: {{ include "common.fullname" . }}-rproxy-config
+        configMap:
+          name: {{ include "common.fullname" . }}-rproxy-config
+      - name: {{ include "common.fullname" . }}-rproxy-log-config
+        configMap:
+          name: {{ include "common.fullname" . }}-rproxy-log-config
+      - name: {{ include "common.fullname" . }}-rproxy-uri-auth-config
+        configMap:
+          name: {{ include "common.fullname" . }}-rproxy-uri-auth-config
+      - name: {{ include "common.fullname" . }}-rproxy-auth-config
+        secret:
+          secretName: {{ include "common.fullname" . }}-rproxy-auth-config
+      - name: {{ include "common.fullname" . }}-rproxy-auth-certs
+        secret:
+          secretName: aai-rproxy-auth-certs
+      - name: {{ include "common.fullname" . }}-rproxy-security-config
+        secret:
+          secretName: aai-rproxy-security-config
+      - name: {{ include "common.fullname" . }}-fproxy-config
+        configMap:
+          name: {{ include "common.fullname" . }}-fproxy-config
+      - name: {{ include "common.fullname" . }}-fproxy-log-config
+        configMap:
+          name: {{ include "common.fullname" . }}-fproxy-log-config
+      - name: {{ include "common.fullname" . }}-fproxy-auth-certs
+        secret:
+          secretName: aai-fproxy-auth-certs
+    {{ end }}
       restartPolicy: {{ .Values.global.restartPolicy | default .Values.restartPolicy }}
       imagePullSecrets:
       - name: "{{ include "common.namespace" . }}-docker-registry-key"
diff --git a/charts/aai-search-data/templates/secret.yaml b/charts/aai-search-data/templates/secret.yaml
index ee32e19..9af326c 100644
--- a/charts/aai-search-data/templates/secret.yaml
+++ b/charts/aai-search-data/templates/secret.yaml
@@ -38,3 +38,16 @@ metadata:
     heritage: {{ .Release.Service }}
 data:
 {{ tpl (.Files.Glob "resources/config/auth/search_policy.json").AsSecrets . | indent 2 }}
+
+{{ if .Values.global.installSidecarSecurity }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "common.fullname" . }}-rproxy-auth-config
+  namespace: {{ include "common.namespace" . }}
+type: Opaque
+data:
+{{ tpl (.Files.Glob "resources/rproxy/config/auth/*").AsSecrets . | indent 2 }}
+{{ end }}
+
diff --git a/charts/aai-search-data/templates/service.yaml b/charts/aai-search-data/templates/service.yaml
index a49553e..73a4d62 100644
--- a/charts/aai-search-data/templates/service.yaml
+++ b/charts/aai-search-data/templates/service.yaml
@@ -25,6 +25,19 @@ metadata:
 spec:
   type: {{ .Values.service.type }}
   ports:
+ {{ if .Values.global.installSidecarSecurity }}
+      {{if eq .Values.service.type "NodePort" -}}
+      - port: {{ .Values.service.internalPort }}
+        nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{ .Values.service.nodePort }}
+        targetPort: {{ .Values.global.rproxy.port }}
+        name: {{ .Values.service.portName }}
+      {{- else -}}
+      - port: {{ .Values.service.externalPort }}
+        targetPort: {{ .Values.global.rproxy.port }}
+        name: {{ .Values.service.portName }}
+      {{- end}}
+  {{ else }}
+
   {{if eq .Values.service.type "NodePort" -}}
   - port: {{ .Values.service.internalPort }}
     nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{ .Values.service.nodePort }}
@@ -33,6 +46,7 @@ spec:
   - port: {{ .Values.service.internalPort }}
     name: {{ .Values.service.portName }}
   {{- end}}
+{{ end }}
   selector:
     app: {{ include "common.name" . }}
     release: {{ .Release.Name }}
diff --git a/charts/aai-search-data/values.yaml b/charts/aai-search-data/values.yaml
index 2a999b8..9e02e1a 100644
--- a/charts/aai-search-data/values.yaml
+++ b/charts/aai-search-data/values.yaml
@@ -32,7 +32,7 @@ config:
   elasticsearchHttpPort: 9200
   keyStorePassword: OBF:1y0q1uvc1uum1uvg1pil1pjl1uuq1uvk1uuu1y10
   keyManagerPassword: OBF:1y0q1uvc1uum1uvg1pil1pjl1uuq1uvk1uuu1y10
-
+  trustStorePassword: OBF:1y0q1uvc1uum1uvg1pil1pjl1uuq1uvk1uuu1y10
 
 # default number of instances
 replicaCount: 1
diff --git a/resources/config/fproxy/auth/fproxy_truststore b/resources/config/fproxy/auth/fproxy_truststore
index f6ebc75..f5e4170 100644
--- a/resources/config/fproxy/auth/fproxy_truststore
+++ b/resources/config/fproxy/auth/fproxy_truststore