[AAI] Service Mesh compatibility

This patch makes AAI to work on service mesh by removing https calls
from everywhere.
It allows also to use AAI on an environment without need of TLS.

Issue-ID: OOM-2670
Signed-off-by: Ondrej Frindrich <ondrej1.frindrich@orange.com>
Change-Id: I19adabc7b33c1ada243ec16f77dbf8fde19b1386

4 files changed, 28 insertions, 11 deletions

diff --git a/kubernetes/aai/components/aai-resources/resources/config/aaiconfig.properties b/kubernetes/aai/components/aai-resources/resources/config/aaiconfig.properties
index 0d51326f3b..2e6fd25c2b 100644
--- a/kubernetes/aai/components/aai-resources/resources/config/aaiconfig.properties
+++ b/kubernetes/aai/components/aai-resources/resources/config/aaiconfig.properties
@@ -38,9 +38,15 @@ aai.config.checktime=1000
 # this could come from siteconfig.pl?
 aai.config.nodename=AutomaticallyOverwritten
 
+{{ if ( include "common.needTLS" .) }}
 aai.server.url.base=https://aai.{{ include "common.namespace" . }}:8443/aai/
 aai.server.url=https://aai.{{ include "common.namespace" . }}:8443/aai/{{ .Values.global.config.schema.version.api.default }}/
 aai.global.callback.url=https://aai.{{ include "common.namespace" . }}:8443/aai/
+{{ else }}
+aai.server.url.base=http://aai.{{ include "common.namespace" . }}/aai/
+aai.server.url=http://aai.{{ include "common.namespace" . }}/aai/{{ .Values.global.config.schema.version.api.default }}/
+aai.global.callback.url=http://aai.{{ include "common.namespace" . }}/aai/
+{{ end }}
 
 {{ if .Values.global.config.basic.auth.enabled }}
 aai.tools.enableBasicAuth=true
@@ -48,10 +54,12 @@ aai.tools.username={{ .Values.global.config.basic.auth.username }}
 aai.tools.password={{ .Values.global.config.basic.auth.passwd }}
 {{ end }}
 
+{{ if ( include "common.needTLS" .) }}
 aai.truststore.filename={{ .Values.certInitializer.credsPath }}/{{ .Values.certInitializer.fqi_namespace }}.trust.jks
 aai.truststore.passwd.x=${TRUSTSTORE_PASSWORD}
 aai.keystore.filename={{ .Values.certInitializer.credsPath }}/{{ .Values.certInitializer.fqi_namespace }}.p12
 aai.keystore.passwd.x=${KEYSTORE_PASSWORD}
+{{ end }}
 
 aai.notification.current.version={{ .Values.global.config.schema.version.api.default }}
 aai.notificationEvent.default.status=UNPROCESSED
diff --git a/kubernetes/aai/components/aai-resources/resources/config/application.properties b/kubernetes/aai/components/aai-resources/resources/config/application.properties
index 70ebd3ac54..2891e0385f 100644
--- a/kubernetes/aai/components/aai-resources/resources/config/application.properties
+++ b/kubernetes/aai/components/aai-resources/resources/config/application.properties
@@ -28,8 +28,7 @@ spring.main.allow-bean-definition-overriding=true
 server.servlet.context-path=/
 
 spring.autoconfigure.exclude=org.springframework.boot.autoconfigure.jdbc.DataSourceAutoConfiguration,org.springframework.boot.autoconfigure.orm.jpa.HibernateJpaAutoConfiguration,org.keycloak.adapters.springboot.KeycloakAutoConfiguration,org.springframework.boot.autoconfigure.security.servlet.SecurityAutoConfiguration
-
-spring.profiles.active={{ .Values.global.config.profiles.active }}
+spring.profiles.active={{ .Values.global.config.profiles.active  }}{{ .Values.global.aafEnabled | ternary ",aaf-auth" "" }}
 spring.jersey.application-path=${schema.uri.base.path}
 #The max number of active threads in this pool
 server.tomcat.max-threads=200
@@ -44,6 +43,7 @@ server.local.startpath=aai-resources/src/main/resources/
 server.basic.auth.location=${server.local.startpath}etc/auth/realm.properties
 
 server.port=8447
+{{ if ( include "common.needTLS" .) }}
 server.ssl.enabled-protocols=TLSv1.1,TLSv1.2
 server.ssl.key-store={{ .Values.certInitializer.credsPath }}/{{ .Values.certInitializer.fqi_namespace }}.p12
 server.ssl.key-store-password=${KEYSTORE_PASSWORD}
@@ -51,11 +51,15 @@ server.ssl.trust-store={{ .Values.certInitializer.credsPath }}/{{ .Values.certIn
 server.ssl.trust-store-password=${TRUSTSTORE_PASSWORD}
 server.ssl.client-auth=want
 server.ssl.key-store-type=JKS
+{{ else }}
+security.require-ssl=false
+server.ssl.enabled=false
+{{ end }}
 
 # JMS bind address host port
 jms.bind.address=tcp://localhost:61647
-dmaap.ribbon.listOfServers=message-router.{{.Release.Namespace}}:3905
-dmaap.ribbon.transportType=https
+dmaap.ribbon.listOfServers=message-router.{{.Release.Namespace}}:{{ (eq "true" (include "common.needTLS" .)) | ternary 3905 3904 }}
+dmaap.ribbon.transportType={{ include "common.scheme" . }}
 
 # Schema related attributes for the oxm and edges
 # Any additional schema related attributes should start with prefix schema
@@ -87,13 +91,15 @@ schema.version.edge.label.start={{ .Values.global.config.schema.version.edge.lab
 schema.version.api.default={{ .Values.global.config.schema.version.api.default }}
 
 schema.translator.list={{ .Values.global.config.schema.translator.list }}
-schema.service.base.url=https://aai-schema-service.{{ include "common.namespace" . }}:8452/aai/schema-service/v1/
+schema.service.base.url={{ include "common.scheme" . }}://aai-schema-service.{{ include "common.namespace" . }}:8452/aai/schema-service/v1/
 schema.service.nodes.endpoint=nodes?version=
 schema.service.edges.endpoint=edgerules?version=
 schema.service.versions.endpoint=versions
-schema.service.client={{ .Values.global.config.schema.service.client }}
+schema.service.client={{ (eq "true" ( include "common.needTLS" .)) | ternary .Values.global.config.schema.service.client "no-auth" }}
 
+{{ if ( include "common.needTLS" .) }}
 schema.service.ssl.key-store={{ .Values.certInitializer.credsPath }}/{{ .Values.certInitializer.fqi_namespace }}.p12
 schema.service.ssl.trust-store={{ .Values.certInitializer.credsPath }}/{{ .Values.certInitializer.fqi_namespace }}.trust.jks
 schema.service.ssl.key-store-password=${KEYSTORE_PASSWORD}
 schema.service.ssl.trust-store-password=${TRUSTSTORE_PASSWORD}
+{{ end }}
diff --git a/kubernetes/aai/components/aai-resources/templates/service.yaml b/kubernetes/aai/components/aai-resources/templates/service.yaml
index e4f84a963d..46118461d1 100644
--- a/kubernetes/aai/components/aai-resources/templates/service.yaml
+++ b/kubernetes/aai/components/aai-resources/templates/service.yaml
@@ -30,13 +30,13 @@ spec:
   {{ if eq .Values.service.type "NodePort" -}}
   - port: {{ .Values.service.internalPort }}
     nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{ .Values.service.nodePort }}
-    name: {{ .Values.service.portName }}
+    name: {{ .Values.service.portName }}{{ (eq "true" (include "common.needTLS" .)) | ternary "s" "" }}
   - port: {{ .Values.service.internalPort2 }}
     nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{ .Values.service.nodePort2 }}
     name: {{ .Values.service.portName2 }}
   {{- else -}}
   - port: {{ .Values.service.internalPort }}
-    name: {{ .Values.service.portName }}
+    name: {{ .Values.service.portName }}{{ (eq "true" (include "common.needTLS" .)) | ternary "s" "" }}
   - port: {{ .Values.service.internalPort2 }}
     name: {{ .Values.service.portName2 }}
   {{- end }}
diff --git a/kubernetes/aai/components/aai-resources/values.yaml b/kubernetes/aai/components/aai-resources/values.yaml
index f30b067b2e..776f8be4b4 100644
--- a/kubernetes/aai/components/aai-resources/values.yaml
+++ b/kubernetes/aai/components/aai-resources/values.yaml
@@ -33,6 +33,8 @@ global: # global defaults
     migration:
       enabled: false
 
+  aafEnabled: false
+
   config:
     # Specifies that the cluster connected to a dynamic
     # cluster being spinned up by kubernetes deployment
@@ -49,7 +51,8 @@ global: # global defaults
 
     # Active spring profiles for the resources microservice
     profiles:
-      active: production,dmaap,aaf-auth #,keycloak
+      # aaf-auth profile will be automatically set if aaf enabled is set to true 
+      active: production,dmaap #,aaf-auth
 
     # Notification event specific properties
     notification:
@@ -216,9 +219,9 @@ readiness:
 
 service:
   type: ClusterIP
-  portName: aai-resources-8447
+  portName: http
   internalPort: 8447
-  portName2: aai-resources-5005
+  portName2: tcp-5005
   internalPort2: 5005
 
 ingress: