Merge "[STRIMZI] Correction for external Access via Ingress"

6 files changed, 193 insertions, 46 deletions

diff --git a/docs/sections/guides/infra_guides/oom_base_optional_addons.rst b/docs/sections/guides/infra_guides/oom_base_optional_addons.rst
index f795a8664a..b55ed0ef66 100644
--- a/docs/sections/guides/infra_guides/oom_base_optional_addons.rst
+++ b/docs/sections/guides/infra_guides/oom_base_optional_addons.rst
@@ -127,12 +127,20 @@ Install Istio Gateway
 
     > kubectl label namespace istio-ingress istio-injection=enabled
 
-- Install the Istio Gateway chart,replacing the
+- To expose additional ports besides HTTP/S (e.g. for external Kafka access)
+  create an override file (e.g. istio-ingress.yaml)
+
+    .. collapse:: istio-ingress.yaml
+
+      .. include:: ../../resources/yaml/istio-ingress.yaml
+         :code: yaml
+
+- Install the Istio Gateway chart using the override file, replacing the
   <recommended-istio-version> with the version defined in
   the :ref:`versions_table` table::
 
     > helm upgrade -i istio-ingress istio/gateway -n istio-ingress
-    --version <recommended-istio-version> --wait
+    --version <recommended-istio-version> -f ingress-istio.yaml --wait
 
 Kiali Installation
 ==================
diff --git a/docs/sections/resources/yaml/envoyfilter-case.yaml b/docs/sections/resources/yaml/envoyfilter-case.yaml
index c919319ecc..31e80374e2 100644
--- a/docs/sections/resources/yaml/envoyfilter-case.yaml
+++ b/docs/sections/resources/yaml/envoyfilter-case.yaml
@@ -37,4 +37,47 @@ spec:
               stateful_formatter:
                 name: preserve_case
                 typed_config:
+                  '@type': type.googleapis.com/envoy.extensions.http.header_formatters.preserve_case.v3.PreserveCaseFormatterConfig
+---
+apiVersion: networking.istio.io/v1alpha3
+kind: EnvoyFilter
+metadata:
+  name: header-casing-outbound
+  namespace: istio-config
+  #annotations:
+  #  argocd.argoproj.io/hook: PostSync
+spec:
+  configPatches:
+  - applyTo: CLUSTER
+    match:
+      context: SIDECAR_OUTBOUND
+    patch:
+      operation: MERGE
+      value:
+        typed_extension_protocol_options:
+          envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+            '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+            use_downstream_protocol_config:
+              http_protocol_options:
+                header_key_format:
+                  stateful_formatter:
+                    name: preserve_case
+                    typed_config:
+                      '@type': type.googleapis.com/envoy.extensions.http.header_formatters.preserve_case.v3.PreserveCaseFormatterConfig
+  - applyTo: NETWORK_FILTER
+    match:
+      listener:
+        filterChain:
+          filter:
+            name: envoy.filters.network.http_connection_manager
+    patch:
+      operation: MERGE
+      value:
+        typed_config:
+          '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+          http_protocol_options:
+            header_key_format:
+              stateful_formatter:
+                name: preserve_case
+                typed_config:
                   '@type': type.googleapis.com/envoy.extensions.http.header_formatters.preserve_case.v3.PreserveCaseFormatterConfig
\ No newline at end of file
diff --git a/docs/sections/resources/yaml/istio-ingress.yaml b/docs/sections/resources/yaml/istio-ingress.yaml
new file mode 100644
index 0000000000..5f000d306d
--- /dev/null
+++ b/docs/sections/resources/yaml/istio-ingress.yaml
@@ -0,0 +1,32 @@
+service:
+  # Type of service. Set to "None" to disable the service entirely
+  type: LoadBalancer
+  ports:
+  - name: status-port
+    port: 15021
+    protocol: TCP
+    targetPort: 15021
+  - name: http2
+    port: 80
+    protocol: TCP
+    targetPort: 80
+  - name: https
+    port: 443
+    protocol: TCP
+    targetPort: 443
+  - name: kafka-bootstrap
+    port: 9010
+    targetPort: 9010
+    protocol: TCP
+  - name: kafka-0
+    port: 9000
+    targetPort: 9000
+    protocol: TCP
+  - name: kafka-1
+    port: 9001
+    targetPort: 9001
+    protocol: TCP
+  - name: kafka-2
+    port: 9002
+    targetPort: 9002
+    protocol: TCP
\ No newline at end of file
diff --git a/kubernetes/common/common/templates/_ingress.tpl b/kubernetes/common/common/templates/_ingress.tpl
index 30ef02295f..a9ffd70f96 100644
--- a/kubernetes/common/common/templates/_ingress.tpl
+++ b/kubernetes/common/common/templates/_ingress.tpl
@@ -102,18 +102,20 @@ true
 */}}
 {{- define "istio.config.port" -}}
 {{-   $dot := default . .dot -}}
-{{-   if .exposedPort }}
-      number: {{ .exposedPort }}
-{{-     if .exposedProtocol }}
-      name: {{ .baseaddr }}
-      protocol: {{ .exposedProtocol }}
+{{-   $baseaddr := (required "'baseaddr' param, set to the specific part of the fqdn, is required." .baseaddr) -}}
+{{-   $protocol := (required "'protocol' param, set to the name of the port, is required." .protocol) -}}
+{{-   if $dot.exposedPort }}
+      number: {{ $dot.exposedPort }}
+{{-     if $dot.exposedProtocol }}
+      name: {{ $protocol }}-{{ $dot.exposedPort }}
+      protocol: {{ $dot.exposedProtocol }}
 {{-     else }}
-      name: http
+      name: {{ $protocol }}
       protocol: HTTP
 {{-     end -}}
 {{-   else }}
       number: 80
-      name: http
+      name: {{ $protocol }}
       protocol: HTTP
 {{-   end -}}
 {{- end -}}
@@ -148,25 +150,47 @@ true
   Istio Helper function to add the route to the service
 */}}
 {{- define "istio.config.route" -}}
-{{-   $dot := default . .dot -}}
-  http:
+{{- $dot := default . .dot -}}
+{{- $protocol := (required "'protocol' param, is required." .protocol) -}}
+{{- if eq $protocol "tcp" }}
+  - match:
+    - port: {{ $dot.exposedPort }}
+    route:
+    - destination:
+        port:
+        {{- if $dot.plain_port }}
+        {{- if kindIs "string" $dot.plain_port }}
+          name: {{ $dot.plain_port }}
+        {{- else }}
+          number: {{ $dot.plain_port }}
+        {{- end }}
+        {{- else }}
+        {{- if kindIs "string" $dot.port }}
+          name: {{ $dot.port }}
+        {{- else }}
+          number: {{ $dot.port }}
+        {{- end }}
+        {{- end }}
+        host: {{ $dot.name }}
+{{- else if eq $protocol "http" }}
   - route:
     - destination:
         port:
-        {{- if .plain_port }}
-        {{- if kindIs "string" .plain_port }}
-          name: {{ .plain_port }}
+        {{- if $dot.plain_port }}
+        {{- if kindIs "string" $dot.plain_port }}
+          name: {{ $dot.plain_port }}
         {{- else }}
-          number: {{ .plain_port }}
+          number: {{ $dot.plain_port }}
         {{- end }}
         {{- else }}
-        {{- if kindIs "string" .port }}
-          name: {{ .port }}
+        {{- if kindIs "string" $dot.port }}
+          name: {{ $dot.port }}
         {{- else }}
-          number: {{ .port }}
+          number: {{ $dot.port }}
         {{- end }}
         {{- end }}
-        host: {{ .name }}
+        host: {{ $dot.name }}
+{{- end -}}
 {{- end -}}
 
 {{/*
@@ -240,12 +264,27 @@ true
 {{- end -}}
 
 {{/*
+  Create Port entry in the Gateway resource
+*/}}
+{{- define "istio.config.gatewayPort" -}}
+{{-   $dot := default . .dot -}}
+{{-   $service := (required "'service' param, set to the specific service, is required." .service) -}}
+{{-   $baseaddr := (required "'baseaddr' param, set to the specific part of the fqdn, is required." .baseaddr) -}}
+{{-   $protocol := (required "'protocol' param, set to the specific port, is required." .protocol) -}}
+  - port:
+      {{- include "istio.config.port" (dict "dot" $service "baseaddr" $baseaddr "protocol" $protocol) }}
+    hosts:
+    - {{ include "ingress.config.host" (dict "dot" $dot "baseaddr" $baseaddr) }}
+    {{- include "istio.config.tls" (dict "dot" $dot "service" $service "baseaddr" $baseaddr) }}
+{{- end -}}
+
+{{/*
   Create Istio Ingress resources per defined service
 */}}
 {{- define "common.istioIngress" -}}
-{{-   $dot := default . .dot -}}
-{{    range $dot.Values.ingress.service }}
-{{-     $baseaddr := (required "'baseaddr' param, set to the specific part of the fqdn, is required." .baseaddr) }}
+{{- $dot := default . .dot -}}
+{{  range $dot.Values.ingress.service }}
+{{-   $baseaddr := (required "'baseaddr' param, set to the specific part of the fqdn, is required." .baseaddr) }}
 ---
 apiVersion: networking.istio.io/v1beta1
 kind: Gateway
@@ -255,11 +294,17 @@ spec:
   selector:
     istio: ingress # use Istio default gateway implementation
   servers:
-  - port:
-      {{- include "istio.config.port" . }}
-    hosts:
-    - {{ include "ingress.config.host" (dict "dot" $dot "baseaddr" $baseaddr) }}
-    {{- include "istio.config.tls" (dict "dot" $dot "service" . "baseaddr" $baseaddr) }}
+{{-   if .tcpRoutes }}
+{{      range .tcpRoutes }}
+  {{ include "istio.config.gatewayPort" (dict "dot" $dot "service" . "baseaddr" $baseaddr "protocol" "tcp") | trim }}
+{{      end -}}
+{{-   else }}
+  {{-   if .protocol }}
+  {{ include "istio.config.gatewayPort" (dict "dot" $dot "service" . "baseaddr" $baseaddr "protocol" .protocol) | trim }}
+  {{-   else }}
+  {{ include "istio.config.gatewayPort" (dict "dot" $dot "service" . "baseaddr" $baseaddr "protocol" "http") | trim }}
+  {{    end }}
+{{    end }}
 ---
 apiVersion: networking.istio.io/v1beta1
 kind: VirtualService
@@ -270,8 +315,21 @@ spec:
     - {{ include "ingress.config.host" (dict "dot" $dot "baseaddr" $baseaddr) }}
   gateways:
   - {{ $baseaddr }}-gateway
-  {{ include "istio.config.route" . | trim }}
-{{-   end -}}
+{{-   if .tcpRoutes }}
+  tcp:
+{{      range .tcpRoutes }}
+  {{ include "istio.config.route" (dict "dot" . "protocol" "tcp") | trim }}
+{{      end -}}
+{{-   else  }}
+  {{-   if .protocol }}
+  {{ .protocol }}:
+  {{ include "istio.config.route" (dict "dot" . "protocol" .protocol) | trim }}
+  {{-   else }}
+  http:
+  {{ include "istio.config.route" (dict "dot" . "protocol" "http") | trim }}
+  {{    end }}
+{{    end }}
+{{- end -}}
 {{- end -}}
 
 {{/*
diff --git a/kubernetes/strimzi/templates/strimzi-kafka.yaml b/kubernetes/strimzi/templates/strimzi-kafka.yaml
index 99252ec3e6..3ce7b1d627 100644
--- a/kubernetes/strimzi/templates/strimzi-kafka.yaml
+++ b/kubernetes/strimzi/templates/strimzi-kafka.yaml
@@ -36,9 +36,9 @@ spec:
       - name: external
         port: 9094
         type: {{ if (include "common.ingressEnabled" .) }}cluster-ip{{ else }}nodeport{{ end }}
-        tls: true
+        tls: {{ if (include "common.ingressEnabled" .) }}false{{ else }}true{{ end }}
         authentication:
-          type: tls
+          type: {{ if (include "common.ingressEnabled" .) }}{{ .Values.config.saslMechanism }}{{ else }}tls{{ end }}
         configuration:
           {{- if not (include "common.ingressEnabled" .) }}
           bootstrap:
diff --git a/kubernetes/strimzi/values.yaml b/kubernetes/strimzi/values.yaml
index ec1ed887a7..057f2003c7 100644
--- a/kubernetes/strimzi/values.yaml
+++ b/kubernetes/strimzi/values.yaml
@@ -19,6 +19,12 @@ global:
   nodePortPrefixExt: 304
   persistence:
     mountPath: /dockerdata-nfs
+  ingress:
+    virtualhost:
+      baseurl: &baseurl "simpledemo.onap.org"
+      preaddr: &preaddr ""
+      postaddr: &postaddr ""
+
 #################################################################
 # Application configuration defaults.
 #################################################################
@@ -66,23 +72,23 @@ ingress:
   - baseaddr: "kafka-bootstrap-api"
     name: "onap-strimzi-kafka-external-bootstrap"
     port: 9094
+    protocol: tcp
     exposedPort: 9010
     exposedProtocol: TLS
-  - baseaddr: "kafka-0-api"
-    name: "onap-strimzi-kafka-0"
-    port: 9094
-    exposedPort: *advertizedPortBroker0
-    exposedProtocol: TLS
-  - baseaddr: "kafka-1-api"
-    name: "onap-strimzi-kafka-1"
-    port: 9094
-    exposedPort: *advertizedPortBroker1
-    exposedProtocol: TLS
-  - baseaddr: "kafka-2-api"
-    name: "onap-strimzi-kafka-2"
-    port: 9094
-    exposedPort: *advertizedPortBroker2
-    exposedProtocol: TLS
+  - baseaddr: "kafka-api"
+    tcpRoutes:
+    - name: "onap-strimzi-kafka-0"
+      port: 9094
+      exposedPort: *advertizedPortBroker0
+      exposedProtocol: TLS
+    - name: "onap-strimzi-kafka-1"
+      port: 9094
+      exposedPort: *advertizedPortBroker1
+      exposedProtocol: TLS
+    - name: "onap-strimzi-kafka-2"
+      port: 9094
+      exposedPort: *advertizedPortBroker2
+      exposedProtocol: TLS
 
 ######################
 #  Component overrides