Add Pluggable Security to aai-resources

Note that by default this feature is turned off. To enable update the
installSidecarSecurity in aai/values.yaml to true.

Change-Id: If5d2be859ead2f0bd81aabb4fde749f105974bcf
Issue-ID: AAF-616
Signed-off-by: Ravi Geda <gravik@amdocs.com>

2 files changed, 208 insertions, 0 deletions

diff --git a/kubernetes/aai/charts/aai-resources/templates/configmap.yaml b/kubernetes/aai/charts/aai-resources/templates/configmap.yaml
index 001f5ead65..4fd939dbd0 100644
--- a/kubernetes/aai/charts/aai-resources/templates/configmap.yaml
+++ b/kubernetes/aai/charts/aai-resources/templates/configmap.yaml
@@ -136,3 +136,88 @@ data:
 {{ tpl (.Files.Glob "resources/config/aaf/org.onap.aai.p12").AsSecrets . | indent 2 }}
 {{ tpl (.Files.Glob "resources/config/aaf/truststoreONAPall.jks").AsSecrets . | indent 2 }}
 {{ tpl (.Files.Glob "resources/config/aaf/bath_config.csv").AsSecrets . | indent 2 }}
+
+{{ if .Values.global.installSidecarSecurity }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "common.fullname" . }}-aai-policy-configmap
+  namespace: {{ include "common.namespace" . }}
+  labels:
+    app: {{ include "common.name" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+data:
+{{ tpl (.Files.Glob "resources/config/auth/aai_policy.json").AsConfig . | indent 2 }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "common.fullname" . }}-fproxy-config
+  namespace: {{ include "common.namespace" . }}
+data:
+{{ tpl (.Files.Glob "resources/fproxy/config/*").AsConfig . | indent 2 }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "common.fullname" . }}-fproxy-log-config
+  namespace: {{ include "common.namespace" . }}
+  labels:
+    app: {{ include "common.name" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+data:
+{{ tpl (.Files.Glob "resources/fproxy/config/logback-spring.xml").AsConfig . | indent 2 }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "common.fullname" . }}-fproxy-auth-config
+  namespace: {{ include "common.namespace" . }}
+type: Opaque
+data:
+{{ tpl (.Files.Glob "resources/fproxy/config/auth/*").AsSecrets . | indent 2 }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "common.fullname" . }}-rproxy-config
+  namespace: {{ include "common.namespace" . }}
+data:
+{{ tpl (.Files.Glob "resources/rproxy/config/*").AsConfig . | indent 2 }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "common.fullname" . }}-rproxy-log-config
+  namespace: {{ include "common.namespace" . }}
+  labels:
+    app: {{ include "common.name" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+data:
+{{ tpl (.Files.Glob "resources/rproxy/config/logback-spring.xml").AsConfig . | indent 2 }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "common.fullname" . }}-rproxy-auth-config
+  namespace: {{ include "common.namespace" . }}
+type: Opaque
+data:
+{{ tpl (.Files.Glob "resources/rproxy/config/auth/*").AsSecrets . | indent 2 }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "common.fullname" . }}-rproxy-security-config
+  namespace: {{ include "common.namespace" . }}
+type: Opaque
+data:
+{{ tpl (.Files.Glob "resources/rproxy/config/security/*").AsSecrets . | indent 2 }}
+{{ end }}
diff --git a/kubernetes/aai/charts/aai-resources/templates/deployment.yaml b/kubernetes/aai/charts/aai-resources/templates/deployment.yaml
index 4dcfa2cf9c..8d7b740276 100644
--- a/kubernetes/aai/charts/aai-resources/templates/deployment.yaml
+++ b/kubernetes/aai/charts/aai-resources/templates/deployment.yaml
@@ -419,6 +419,12 @@ spec:
     spec:
       hostname: aai-resources
     {{ if .Values.global.initContainers.enabled }}
+      {{ if .Values.global.installSidecarSecurity }}
+      hostAliases:
+      - ip: {{ .Values.global.aaf.serverIp }}
+        hostnames:
+        - {{ .Values.global.aaf.serverHostname }}
+      {{ end }}
       initContainers:
       - command:
       {{  if .Values.global.jobs.createSchema.enabled  }}
@@ -441,6 +447,13 @@ spec:
         image: "{{ .Values.global.readinessRepository }}/{{ .Values.global.readinessImage }}"
         imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
         name: {{ include "common.name" . }}-readiness
+      {{ if .Values.global.installSidecarSecurity }}
+      - name: {{ .Values.global.tproxyConfig.name }}
+        image: "{{ include "common.repository" . }}/{{ .Values.global.tproxyConfig.image }}"
+        imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
+        securityContext:
+          privileged: true
+      {{ end }}
     {{ end }}
       containers:
       - name: {{ include "common.name" . }}
@@ -475,6 +488,11 @@ spec:
         - mountPath: /opt/app/aai-resources/resources/etc/auth/realm.properties
           name: {{ include "common.fullname" . }}-realm-conf
           subPath: realm.properties
+        {{ if .Values.global.installSidecarSecurity }}
+        - mountPath: /opt/app/aai-resources/resources/etc/auth/aai_policy.json
+          name: {{ include "common.fullname" . }}-aai-policy
+          subPath: aai_policy.json
+        {{ end }}
         - mountPath: /opt/app/aai-resources/resources/aaf/org.onap.aai.keyfile
           name: {{ include "common.fullname" . }}-aaf-certs
           subPath: org.onap.aai.keyfile
@@ -548,6 +566,85 @@ spec:
           name: {{ include "common.fullname" . }}-logs
         - mountPath: /usr/share/filebeat/data
           name: {{ include "common.fullname" . }}-filebeat
+    {{ if .Values.global.installSidecarSecurity }}
+      - name: {{ .Values.global.rproxy.name }}
+        image: "{{ include "common.repository" . }}/{{ .Values.global.rproxy.image }}"
+        imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
+        env:
+        - name: CONFIG_HOME
+          value: "/opt/app/rproxy/config"
+        - name: KEY_STORE_PASSWORD
+          value: {{ .Values.sidecar.keyStorePassword }}
+        - name: spring_profiles_active
+          value: {{ .Values.global.rproxy.activeSpringProfiles }}
+        volumeMounts:
+        - name: {{ include "common.fullname" . }}-rproxy-config
+          mountPath: /opt/app/rproxy/config/forward-proxy.properties
+          subPath: forward-proxy.properties
+        - name: {{ include "common.fullname" . }}-rproxy-config
+          mountPath: /opt/app/rproxy/config/primary-service.properties
+          subPath: primary-service.properties
+        - name: {{ include "common.fullname" . }}-rproxy-config
+          mountPath: /opt/app/rproxy/config/reverse-proxy.properties
+          subPath: reverse-proxy.properties
+        - name: {{ include "common.fullname" . }}-rproxy-config
+          mountPath: /opt/app/rproxy/config/cadi.properties
+          subPath: cadi.properties
+        - name: {{ include "common.fullname" . }}-rproxy-log-config
+          mountPath: /opt/app/rproxy/config/logback-spring.xml
+          subPath: logback-spring.xml
+        - name: {{ include "common.fullname" . }}-rproxy-auth-config
+          mountPath: /opt/app/rproxy/config/auth/tomcat_keystore
+          subPath: tomcat_keystore
+        - name: {{ include "common.fullname" . }}-rproxy-auth-config
+          mountPath: /opt/app/rproxy/config/auth/client-cert.p12
+          subPath: client-cert.p12
+        - name: {{ include "common.fullname" . }}-rproxy-auth-config
+          mountPath: /opt/app/rproxy/config/auth/uri-authorization.json
+          subPath: uri-authorization.json
+        - name: {{ include "common.fullname" . }}-rproxy-auth-config
+          mountPath: /opt/app/rproxy/config/auth/aaf_truststore.jks
+          subPath: aaf_truststore.jks
+        - name: {{ include "common.fullname" . }}-rproxy-security-config
+          mountPath: /opt/app/rproxy/config/security/keyfile
+          subPath: keyfile
+        - name: {{ include "common.fullname" . }}-rproxy-auth-config
+          mountPath: /opt/app/rproxy/config/auth/org.onap.aai.p12
+          subPath: org.onap.aai.p12
+        ports:
+        - containerPort: {{ .Values.global.rproxy.port }}
+
+      - name: {{ .Values.global.fproxy.name }}
+        image: "{{ include "common.repository" . }}/{{ .Values.global.fproxy.image }}"
+        imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
+        env:
+        - name: CONFIG_HOME
+          value: "/opt/app/fproxy/config"
+        - name: KEY_STORE_PASSWORD
+          value: {{ .Values.sidecar.keyStorePassword }}
+        - name: TRUST_STORE_PASSWORD
+          value: {{ .Values.sidecar.trustStorePassword }}
+        - name: spring_profiles_active
+          value: {{ .Values.global.fproxy.activeSpringProfiles }}
+        volumeMounts:
+        - name: {{ include "common.fullname" . }}-fproxy-config
+          mountPath: /opt/app/fproxy/config/fproxy.properties
+          subPath: fproxy.properties
+        - name: {{ include "common.fullname" . }}-fproxy-log-config
+          mountPath: /opt/app/fproxy/config/logback-spring.xml
+          subPath: logback-spring.xml
+        - name: {{ include "common.fullname" . }}-fproxy-auth-config
+          mountPath: /opt/app/fproxy/config/auth/fproxy_truststore
+          subPath: fproxy_truststore
+        - name: {{ include "common.fullname" . }}-fproxy-auth-config
+          mountPath: /opt/app/fproxy/config/auth/tomcat_keystore
+          subPath: tomcat_keystore
+        - name: {{ include "common.fullname" . }}-fproxy-auth-config
+          mountPath: /opt/app/fproxy/config/auth/client-cert.p12
+          subPath: client-cert.p12
+        ports:
+        - containerPort: {{ .Values.global.fproxy.port }}
+    {{ end }}
 
       volumes:
       - name: localtime
@@ -595,6 +692,32 @@ spec:
            - key: {{ . }}
              path: {{ . }}
           {{ end }}
+    {{ if .Values.global.installSidecarSecurity }}
+      - name: {{ include "common.fullname" . }}-aai-policy
+        configMap:
+         name: {{ include "common.fullname" . }}-aai-policy-configmap
+      - name: {{ include "common.fullname" . }}-rproxy-config
+        configMap:
+         name: {{ include "common.fullname" . }}-rproxy-config
+      - name: {{ include "common.fullname" . }}-rproxy-log-config
+        configMap:
+         name: {{ include "common.fullname" . }}-rproxy-log-config
+      - name: {{ include "common.fullname" . }}-rproxy-auth-config
+        secret:
+         secretName: {{ include "common.fullname" . }}-rproxy-auth-config
+      - name: {{ include "common.fullname" . }}-rproxy-security-config
+        secret:
+         secretName: {{ include "common.fullname" . }}-rproxy-security-config
+      - name: {{ include "common.fullname" . }}-fproxy-config
+        configMap:
+         name: {{ include "common.fullname" . }}-fproxy-config
+      - name: {{ include "common.fullname" . }}-fproxy-log-config
+        configMap:
+         name: {{ include "common.fullname" . }}-fproxy-log-config
+      - name: {{ include "common.fullname" . }}-fproxy-auth-config
+        secret:
+         secretName: {{ include "common.fullname" . }}-fproxy-auth-config
+    {{ end }}
       restartPolicy: {{ .Values.restartPolicy }}
       imagePullSecrets:
       - name: "{{ include "common.namespace" . }}-docker-registry-key"