[COMMON] Handle TLS/Non-TLS for Service

Current service and headlessService templates doesn't handle the fact
that out of cluster ports must be TLS encrypted only.
With a new (backward compatible) DSL, this is now possible.

In values.yaml, all ports in service part with port AND plain_port will
have the ability to be HTTP or HTTPS depending on the context.

Per default, they'll be HTTPS.

TLS choice will be done according this table:

| tlsOverride | global.tlsEnabled | global.serviceMesh.enabled | global.serviceMesh.tls | result |
|-------------|-------------------|----------------------------|------------------------|--------|
| not present | not present       | not present                | any                    | true   |
| not present | not present       | false                      | any                    | true   |
| not present | not present       | true                       | false                  | true   |
| not present | not present       | true                       | true                   | false  |
| not present | true              | any                        | any                    | true   |
| not present | false             | any                        | any                    | false  |
| true        | any               | any                        | any                    | true   |
| false       | any               | any                        | any                    | false  |

Service template will create one or two service templates according to this table:

| serviceType   | both_tls_and_plain | result       |
|---------------|--------------------|--------------|
| ClusterIP     | any                | one Service  |
| Not ClusterIP | not present        | one Service  |
| Not ClusterIP | false              | one Service  |
| Not ClusterIP | true               | two Services |

If two services are created, one is ClusterIP with both crypted and plain
ports and the other one is NodePort (or LoadBalancer) with crypted port only.

Issue-ID: OOM-1936
Signed-off-by: Sylvain Desbureaux <sylvain.desbureaux@orange.com>
Change-Id: If766dd73132022d1a6e578fd36113c461bb91ea5

1 files changed, 141 insertions, 26 deletions

diff --git a/kubernetes/common/common/templates/_service.tpl b/kubernetes/common/common/templates/_service.tpl
index 55f73c1635..cd1595b0ca 100644
--- a/kubernetes/common/common/templates/_service.tpl
+++ b/kubernetes/common/common/templates/_service.tpl
@@ -35,6 +35,7 @@
      - .dot : environment (.)
      - .suffix : a string which will be added at the end of the name (with a '-').
      - .annotations: the annotations to add
+     - .msb_informations: msb information in order to create msb annotation
      Usage example:
       {{ include "common.serviceMetadata" ( dict "suffix" "myService" "dot" .) }}
       {{ include "common.serviceMetadata" ( dict "annotations" .Values.service.annotation "dot" .) }}
@@ -43,8 +44,24 @@
   {{- $dot := default . .dot -}}
   {{- $suffix := default "" .suffix -}}
   {{- $annotations := default "" .annotations -}}
-{{- if $annotations -}}
-annotations: {{- include "common.tplValue" (dict "value" $annotations "context" $dot) | nindent 2 }}
+  {{- $msb_informations := default "" .msb_informations -}}
+{{- if or $annotations $msb_informations -}}
+annotations:
+{{-   if $annotations }}
+{{      include "common.tplValue" (dict "value" $annotations "context" $dot) | indent 2 }}
+{{-   end }}
+{{-   if $msb_informations }}
+  msb.onap.org/service-info: '[
+      {
+          "serviceName": "{{ include "common.servicename" $dot }}",
+          "version": "{{ default "v1" $msb_informations.version }}",
+          "url": "{{ default "/" $msb_informations.url }}",
+          "protocol": "{{ default "REST" $msb_informations.protocol }}",
+          "port": "{{ $msb_informations.port }}",
+          "visualRange":"{{ default "1" $msb_informations.visualRange }}"
+      }
+      ]'
+{{-   end}}
 {{- end }}
 name: {{ include "common.servicename" $dot }}{{ if $suffix }}{{ print "-" $suffix }}{{ end }}
 namespace: {{ include "common.namespace" $dot }}
@@ -55,65 +72,121 @@ labels: {{- include "common.labels" $dot | nindent 2 -}}
      The function takes three arguments (inside a dictionary):
      - .dot : environment (.)
      - .ports : an array of ports
-     - .portType: the type of the service
-     - .prefix: NodePort prefix to be used
-
+     - .serviceType: the type of the service
+     - .add_plain_port: add tls port AND plain port
 */}}
 {{- define "common.servicePorts" -}}
-{{- $portType := .portType -}}
-{{- $dot := .dot -}}
-{{- range $index, $port := .ports }}
-{{- $portPrefix := default "nodePortPrefix" $port.prefix }}
+{{- $serviceType := .serviceType }}
+{{- $dot := .dot }}
+{{- $add_plain_port := default false .add_plain_port }}
+{{-   range $index, $port := .ports }}
+{{-     if (include "common.needTLS" $dot) }}
 - port: {{ $port.port }}
   targetPort: {{ $port.name }}
-  {{- if (eq $portType "NodePort") }}
-  nodePort: {{ index $dot.Values "global" $portPrefix | default (index $dot.Values $portPrefix) }}{{ $port.nodePort }}
-  {{- end }}
+{{-       if $port.port_protocol }}
+  name: {{ printf "%ss-%s" $port.port_protocol $port.name }}
+{{-       else }}
   name: {{ $port.name }}
-{{- end -}}
+{{-       end }}
+{{-       if (eq $serviceType "NodePort") }}
+  nodePort: {{ $dot.Values.global.nodePortPrefix | default $dot.Values.nodePortPrefix }}{{ $port.nodePort }}
+{{-       end }}
+{{-     else }}
+- port: {{ default $port.port $port.plain_port }}
+  targetPort: {{ $port.name }}
+{{-       if $port.port_protocol }}
+  name: {{ printf "%s-%s" $port.port_protocol $port.name }}
+{{-       else }}
+  name: {{ $port.name }}
+{{-       end }}
+{{-     end }}
+{{-     if (and (and (include "common.needTLS" $dot) $add_plain_port) $port.plain_port)  }}
+{{-       if (eq $serviceType "ClusterIP")  }}
+- port: {{ $port.plain_port }}
+  targetPort: {{ $port.name }}-plain
+{{-         if $port.port_protocol }}
+  name: {{ printf "%s-%s" $port.port_protocol $port.name }}
+{{-         else }}
+  name: {{ $port.name }}-plain
+{{-         end }}
+{{-       end }}
+{{-     end }}
+{{-   end }}
 {{- end -}}
 
 {{/* Create generic service template
      The function takes several arguments (inside a dictionary):
      - .dot : environment (.)
      - .ports : an array of ports
-     - .portType: the type of the service
+     - .serviceType: the type of the service
      - .suffix : a string which will be added at the end of the name (with a '-')
      - .annotations: the annotations to add
+     - .msb_informations: msb information in order to create msb annotation
      - .publishNotReadyAddresses: if we publish not ready address
      - .headless: if the service is headless
+     - .add_plain_port: add tls port AND plain port
 */}}
 {{- define "common.genericService" -}}
 {{- $dot := default . .dot -}}
 {{- $suffix := default "" .suffix -}}
 {{- $annotations := default "" .annotations -}}
+{{- $msb_informations := default "" .msb_informations -}}
 {{- $publishNotReadyAddresses := default false .publishNotReadyAddresses -}}
-{{- $portType := .portType -}}
+{{- $serviceType := .serviceType -}}
 {{- $ports := .ports -}}
 {{- $headless := default false .headless -}}
+{{- $add_plain_port := default false .add_plain_port }}
 apiVersion: v1
 kind: Service
-metadata: {{ include "common.serviceMetadata" (dict "suffix" $suffix "annotations" $annotations "dot" $dot ) | nindent 2 }}
+metadata: {{ include "common.serviceMetadata" (dict "suffix" $suffix "annotations" $annotations "msb_informations" $msb_informations "dot" $dot) | nindent 2 }}
 spec:
   {{- if $headless }}
   clusterIP: None
   {{- end }}
-  ports: {{- include "common.servicePorts" (dict "portType" $portType "ports" $ports "dot" $dot) | nindent 4 }}
+  ports: {{- include "common.servicePorts" (dict "serviceType" $serviceType "ports" $ports "dot" $dot "add_plain_port" $add_plain_port) | nindent 4 }}
   {{- if $publishNotReadyAddresses }}
   publishNotReadyAddresses: true
   {{- end }}
-  type: {{ $portType }}
+  type: {{ $serviceType }}
   selector: {{- include "common.matchLabels" $dot | nindent 4 }}
 {{- end -}}
 
-{{/* Create service template */}}
+{{/*
+    Create service template
+    Will create one or two service templates according to this table:
+
+    | serviceType   | both_tls_and_plain | result       |
+    |---------------|--------------------|--------------|
+    | ClusterIP     | any                | one Service  |
+    | Not ClusterIP | not present        | one Service  |
+    | Not ClusterIP | false              | one Service  |
+    | Not ClusterIP | true               | two Services |
+
+    If two services are created, one is ClusterIP with both crypted and plain
+    ports and the other one is NodePort (or LoadBalancer) with crypted port only.
+*/}}
 {{- define "common.service" -}}
-{{- $suffix := default "" .Values.service.suffix -}}
-{{- $annotations := default "" .Values.service.annotations -}}
-{{- $publishNotReadyAddresses := default false .Values.service.publishNotReadyAddresses -}}
-{{- $portType := .Values.service.type -}}
-{{- $ports := .Values.service.ports -}}
-{{ include "common.genericService" (dict "suffix" $suffix "annotations" $annotations "dot" . "publishNotReadyAddresses" $publishNotReadyAddresses "ports" $ports "portType" $portType) }}
+{{-   $suffix := default "" .Values.service.suffix -}}
+{{-   $annotations := default "" .Values.service.annotations -}}
+{{-   $publishNotReadyAddresses := default false .Values.service.publishNotReadyAddresses -}}
+{{-   $msb_informations := default "" .Values.service.msb -}}
+{{-   $serviceType := .Values.service.type -}}
+{{-   $ports := .Values.service.ports -}}
+{{-   $both_tls_and_plain:= default false .Values.service.both_tls_and_plain }}
+{{-   if (and (include "common.needTLS" .) $both_tls_and_plain) }}
+{{      include "common.genericService" (dict "suffix" $suffix "annotations" $annotations "msb_informations" $msb_informations "dot" . "publishNotReadyAddresses" $publishNotReadyAddresses "ports" $ports "serviceType" "ClusterIP" "add_plain_port" true) }}
+{{-     if (ne $serviceType "ClusterIP") }}
+---
+{{-       if $suffix }}
+{{-         $suffix = printf "%s-external" $suffix }}
+{{-       else }}
+{{-         $suffix = "external" }}
+{{-       end }}
+{{        include "common.genericService" (dict "suffix" $suffix "annotations" $annotations "dot" . "publishNotReadyAddresses" $publishNotReadyAddresses "ports" $ports "serviceType" $serviceType) }}
+{{-     end }}
+{{-   else }}
+{{      include "common.genericService" (dict "suffix" $suffix "annotations" $annotations "dot" . "publishNotReadyAddresses" $publishNotReadyAddresses "ports" $ports "serviceType" $serviceType) }}
+{{-   end }}
 {{- end -}}
 
 {{/* Create headless service template */}}
@@ -122,7 +195,7 @@ spec:
 {{- $annotations := default "" .Values.service.headless.annotations -}}
 {{- $publishNotReadyAddresses := default false .Values.service.headless.publishNotReadyAddresses -}}
 {{- $ports := .Values.service.headlessPorts -}}
-{{ include "common.genericService" (dict "suffix" $suffix "annotations" $annotations "dot" . "publishNotReadyAddresses" $publishNotReadyAddresses "ports" $ports "portType" "ClusterIP" "headless" true ) }}
+{{ include "common.genericService" (dict "suffix" $suffix "annotations" $annotations "dot" . "publishNotReadyAddresses" $publishNotReadyAddresses "ports" $ports "serviceType" "ClusterIP" "headless" true ) }}
 {{- end -}}
 
 {{/*
@@ -135,3 +208,45 @@ spec:
 {{-     print "headless" }}
 {{-   end }}
 {{- end -}}
+
+{{/*
+  Calculate if we need to use TLS ports.
+  We use TLS by default unless we're on service mesh with TLS.
+  We can also override this behavior with override toggles:
+  - .Values.global.tlsEnabled  : override default TLS behavior for all charts
+  - .Values.tlsOverride : override global and default TLS on a per chart basis
+
+  this will give these combinations:
+  | tlsOverride | global.tlsEnabled | global.serviceMesh.enabled | global.serviceMesh.tls | result |
+  |-------------|-------------------|----------------------------|------------------------|--------|
+  | not present | not present       | not present                | any                    | true   |
+  | not present | not present       | false                      | any                    | true   |
+  | not present | not present       | true                       | false                  | true   |
+  | not present | not present       | true                       | true                   | false  |
+  | not present | true              | any                        | any                    | true   |
+  | not present | false             | any                        | any                    | false  |
+  | true        | any               | any                        | any                    | true   |
+  | false       | any               | any                        | any                    | false  |
+
+*/}}
+{{- define "common.needTLS" -}}
+{{-   if hasKey .Values "tlsOverride" }}
+{{-     if .Values.tlsOverride -}}
+true
+{{-       end }}
+{{-   else }}
+{{-     if hasKey .Values.global "tlsEnabled" }}
+{{-       if .Values.global.tlsEnabled }}
+true
+{{-       end }}
+{{-     else }}
+{{-       if not (include "common.onServiceMesh" .) -}}
+true
+{{-       else }}
+{{-         if not (default false .Values.global.serviceMesh.tls) -}}
+true
+{{-         end }}
+{{-       end }}
+{{-     end }}
+{{-   end }}
+{{- end -}}