[COMMON] Handle TLS/Non-TLS for Service

Current service and headlessService templates doesn't handle the fact
that out of cluster ports must be TLS encrypted only.
With a new (backward compatible) DSL, this is now possible.

In values.yaml, all ports in service part with port AND plain_port will
have the ability to be HTTP or HTTPS depending on the context.

Per default, they'll be HTTPS.

TLS choice will be done according this table:

| tlsOverride | global.tlsEnabled | global.serviceMesh.enabled | global.serviceMesh.tls | result |
|-------------|-------------------|----------------------------|------------------------|--------|
| not present | not present       | not present                | any                    | true   |
| not present | not present       | false                      | any                    | true   |
| not present | not present       | true                       | false                  | true   |
| not present | not present       | true                       | true                   | false  |
| not present | true              | any                        | any                    | true   |
| not present | false             | any                        | any                    | false  |
| true        | any               | any                        | any                    | true   |
| false       | any               | any                        | any                    | false  |

Service template will create one or two service templates according to this table:

| serviceType   | both_tls_and_plain | result       |
|---------------|--------------------|--------------|
| ClusterIP     | any                | one Service  |
| Not ClusterIP | not present        | one Service  |
| Not ClusterIP | false              | one Service  |
| Not ClusterIP | true               | two Services |

If two services are created, one is ClusterIP with both crypted and plain
ports and the other one is NodePort (or LoadBalancer) with crypted port only.

Issue-ID: OOM-1936
Signed-off-by: Sylvain Desbureaux <sylvain.desbureaux@orange.com>
Change-Id: If766dd73132022d1a6e578fd36113c461bb91ea5

1 files changed, 11 insertions, 0 deletions

diff --git a/kubernetes/common/common/templates/_pod.tpl b/kubernetes/common/common/templates/_pod.tpl
index 9329572a92..d3fc25ad6e 100644
--- a/kubernetes/common/common/templates/_pod.tpl
+++ b/kubernetes/common/common/templates/_pod.tpl
@@ -19,10 +19,12 @@
   Will use first ".Values.service.ports" list.
   Will append ports from ".Values.service.headlessPorts" only if port number is
   not already in port list.
+  Will add tls port AND plain port if both_tls_and_plain is set to true
 */}}
 {{- define "common.containerPorts" -}}
 {{-   $ports := default (list) .Values.service.ports }}
 {{-   $portsNumber := list }}
+{{-   $both_tls_and_plain:= default false .Values.service.both_tls_and_plain }}
 {{-   range $index, $port := $ports }}
 {{-     $portsNumber = append $portsNumber $port.port }}
 {{-   end }}
@@ -31,8 +33,17 @@
 {{-       $ports = append $ports $port }}
 {{-     end }}
 {{-   end }}
+{{- $global := . }}
 {{-   range $index, $port := $ports }}
+{{-     if (include "common.needTLS" $global) }}
 - containerPort: {{ $port.port }}
+{{-     else }}
+- containerPort: {{ default $port.port $port.plain_port }}
+{{-     end }}
   name: {{ $port.name }}
+{{-     if (and $port.plain_port (and (include "common.needTLS" $global) $both_tls_and_plain))  }}
+- containerPort: {{ $port.plain_port }}
+  name: {{ $port.name }}-plain
+{{-     end }}
 {{-   end }}
 {{- end -}}