[COMMON] Handle TLS/Non-TLS for Service

Current service and headlessService templates doesn't handle the fact
that out of cluster ports must be TLS encrypted only.
With a new (backward compatible) DSL, this is now possible.

In values.yaml, all ports in service part with port AND plain_port will
have the ability to be HTTP or HTTPS depending on the context.

Per default, they'll be HTTPS.

TLS choice will be done according this table:

| tlsOverride | global.tlsEnabled | global.serviceMesh.enabled | global.serviceMesh.tls | result |
|-------------|-------------------|----------------------------|------------------------|--------|
| not present | not present       | not present                | any                    | true   |
| not present | not present       | false                      | any                    | true   |
| not present | not present       | true                       | false                  | true   |
| not present | not present       | true                       | true                   | false  |
| not present | true              | any                        | any                    | true   |
| not present | false             | any                        | any                    | false  |
| true        | any               | any                        | any                    | true   |
| false       | any               | any                        | any                    | false  |

Service template will create one or two service templates according to this table:

| serviceType   | both_tls_and_plain | result       |
|---------------|--------------------|--------------|
| ClusterIP     | any                | one Service  |
| Not ClusterIP | not present        | one Service  |
| Not ClusterIP | false              | one Service  |
| Not ClusterIP | true               | two Services |

If two services are created, one is ClusterIP with both crypted and plain
ports and the other one is NodePort (or LoadBalancer) with crypted port only.

Issue-ID: OOM-1936
Signed-off-by: Sylvain Desbureaux <sylvain.desbureaux@orange.com>
Change-Id: If766dd73132022d1a6e578fd36113c461bb91ea5

1 files changed, 51 insertions, 0 deletions

diff --git a/kubernetes/onap/values.yaml b/kubernetes/onap/values.yaml
index 2395495df3..86fd2635c7 100755
--- a/kubernetes/onap/values.yaml
+++ b/kubernetes/onap/values.yaml
@@ -63,6 +63,57 @@ global:
     virtualhost:
         enabled: true
         baseurl: "simpledemo.onap.org"
+
+  # Global Service Mesh configuration
+  # POC Mode, don't use it in production
+  serviceMesh:
+    enabled: false
+    tls: true
+
+  # Disabling AAF
+  # POC Mode, don't use it in production
+  aafEnabled: true
+
+  # TLS
+  # Set to false if you want to disable TLS for NodePorts. Be aware that this
+  # will loosen your security.
+  # if set this element will force or not tls even if serviceMesh.tls is set.
+  # tlsEnabled: false
+
+
+# Example of specific for the components where you want to disable TLS only for
+# it:
+# if set this element will force or not tls even if global.serviceMesh.tls and
+# global.tlsEnabled is set otherwise.
+# robot:
+#   tlsOverride: false
+
+  # Global storage configuration
+  #    Set to "-" for default, or with the name of the storage class
+  #    Please note that if you use AAF, CDS, SDC, Netbox or Robot, you need a
+  #    storageclass with RWX capabilities (or set specific configuration for these
+  #    components).
+  # persistence:
+  #   storageClass: "-"
+
+# Example of specific for the components which requires RWX:
+# aaf:
+#   persistence:
+#     storageClassOverride: "My_RWX_Storage_Class"
+# contrib:
+#   netbox:
+#     netbox-app:
+#       persistence:
+#         storageClassOverride: "My_RWX_Storage_Class"
+# cds:
+#   cds-blueprints-processor:
+#     persistence:
+#       storageClassOverride: "My_RWX_Storage_Class"
+# sdc:
+#   sdc-onboarding-be:
+#     persistence:
+#       storageClassOverride: "My_RWX_Storage_Class"
+
 #################################################################
 # Enable/disable and configure helm charts (ie. applications)
 # to customize the ONAP deployment.