summaryrefslogtreecommitdiffstats
path: root/kubernetes/onap
diff options
context:
space:
mode:
authorSylvain Desbureaux <sylvain.desbureaux@orange.com>2020-03-04 11:31:11 +0100
committerSylvain Desbureaux <sylvain.desbureaux@orange.com>2020-03-06 09:04:31 +0100
commit88b2f92e51dc29461e0ebe443a24b9e5d99b11be (patch)
treeba7b43fa3056c09b4fb32a79ba7fc26f2d2f48c6 /kubernetes/onap
parentff1c5075c21a7fe77e9be438eb1831c5dbcb552f (diff)
[COMMON] Handle TLS/Non-TLS for Service
Current service and headlessService templates doesn't handle the fact that out of cluster ports must be TLS encrypted only. With a new (backward compatible) DSL, this is now possible. In values.yaml, all ports in service part with port AND plain_port will have the ability to be HTTP or HTTPS depending on the context. Per default, they'll be HTTPS. TLS choice will be done according this table: | tlsOverride | global.tlsEnabled | global.serviceMesh.enabled | global.serviceMesh.tls | result | |-------------|-------------------|----------------------------|------------------------|--------| | not present | not present | not present | any | true | | not present | not present | false | any | true | | not present | not present | true | false | true | | not present | not present | true | true | false | | not present | true | any | any | true | | not present | false | any | any | false | | true | any | any | any | true | | false | any | any | any | false | Service template will create one or two service templates according to this table: | serviceType | both_tls_and_plain | result | |---------------|--------------------|--------------| | ClusterIP | any | one Service | | Not ClusterIP | not present | one Service | | Not ClusterIP | false | one Service | | Not ClusterIP | true | two Services | If two services are created, one is ClusterIP with both crypted and plain ports and the other one is NodePort (or LoadBalancer) with crypted port only. Issue-ID: OOM-1936 Signed-off-by: Sylvain Desbureaux <sylvain.desbureaux@orange.com> Change-Id: If766dd73132022d1a6e578fd36113c461bb91ea5
Diffstat (limited to 'kubernetes/onap')
-rwxr-xr-xkubernetes/onap/values.yaml51
1 files changed, 51 insertions, 0 deletions
diff --git a/kubernetes/onap/values.yaml b/kubernetes/onap/values.yaml
index 2395495df3..86fd2635c7 100755
--- a/kubernetes/onap/values.yaml
+++ b/kubernetes/onap/values.yaml
@@ -63,6 +63,57 @@ global:
virtualhost:
enabled: true
baseurl: "simpledemo.onap.org"
+
+ # Global Service Mesh configuration
+ # POC Mode, don't use it in production
+ serviceMesh:
+ enabled: false
+ tls: true
+
+ # Disabling AAF
+ # POC Mode, don't use it in production
+ aafEnabled: true
+
+ # TLS
+ # Set to false if you want to disable TLS for NodePorts. Be aware that this
+ # will loosen your security.
+ # if set this element will force or not tls even if serviceMesh.tls is set.
+ # tlsEnabled: false
+
+
+# Example of specific for the components where you want to disable TLS only for
+# it:
+# if set this element will force or not tls even if global.serviceMesh.tls and
+# global.tlsEnabled is set otherwise.
+# robot:
+# tlsOverride: false
+
+ # Global storage configuration
+ # Set to "-" for default, or with the name of the storage class
+ # Please note that if you use AAF, CDS, SDC, Netbox or Robot, you need a
+ # storageclass with RWX capabilities (or set specific configuration for these
+ # components).
+ # persistence:
+ # storageClass: "-"
+
+# Example of specific for the components which requires RWX:
+# aaf:
+# persistence:
+# storageClassOverride: "My_RWX_Storage_Class"
+# contrib:
+# netbox:
+# netbox-app:
+# persistence:
+# storageClassOverride: "My_RWX_Storage_Class"
+# cds:
+# cds-blueprints-processor:
+# persistence:
+# storageClassOverride: "My_RWX_Storage_Class"
+# sdc:
+# sdc-onboarding-be:
+# persistence:
+# storageClassOverride: "My_RWX_Storage_Class"
+
#################################################################
# Enable/disable and configure helm charts (ie. applications)
# to customize the ONAP deployment.