Merge "[POLICY-SDC-DIST] Upgrade policy-distribtuion to use kafka native"

5 files changed, 73 insertions, 16 deletions

diff --git a/kubernetes/policy/components/policy-distribution/resources/config/config.json b/kubernetes/policy/components/policy-distribution/resources/config/config.json
index 1aa9044eab..94fc37b4ad 100755
--- a/kubernetes/policy/components/policy-distribution/resources/config/config.json
+++ b/kubernetes/policy/components/policy-distribution/resources/config/config.json
@@ -56,27 +56,23 @@
         "sdcConfiguration":{
             "parameterClassName":"org.onap.policy.distribution.reception.handling.sdc.SdcReceptionHandlerConfigurationParameterGroup",
             "parameters":{
-                "asdcAddress": "sdc-be.{{ include "common.namespace" . }}:{{ (eq "true" (include "common.needTLS" .)) | ternary 8443 8080 }}",
-                "messageBusAddress": [
-                    "message-router.{{ include "common.namespace" . }}"
-                 ],
+                "environmentName": "AUTO",
+                "isUseHttpsWithSDC": {{ (eq "true" (include "common.needTLS" .)) | ternary true false }},
+                "keyStorePath": "null",
+                "keyStorePassword": "null",
+                "activeserverTlsAuth": false,
+                "sdcAddress": "sdc-be.{{ include "common.namespace" . }}:{{ (eq "true" (include "common.needTLS" .)) | ternary 8443 8080 }}",
                 "user": "${SDCBE_USER}",
                 "password": "${SDCBE_PASSWORD}",
+                "consumerGroup": "{{ .Values.config.kafka.sdcTopic.consumerGroup }}",
+                "consumerId": "{{ .Values.config.kafka.sdcTopic.clientId }}",
                 "pollingInterval":20,
                 "pollingTimeout":30,
-                "consumerId": "policy-id",
                 "artifactTypes": [
                     "TOSCA_CSAR",
                     "HEAT"
                 ],
-                "consumerGroup": "policy-group",
-                "environmentName": "AUTO",
-                "keyStorePath": "null",
-                "keyStorePassword": "null",
-                "activeserverTlsAuth": false,
-                "isFilterinEmptyResources": true,
-                "isUseHttpsWithDmaap": {{ (eq "true" (include "common.needTLS" .)) | ternary true false }},
-                "isUseHttpsWithSDC": {{ (eq "true" (include "common.needTLS" .)) | ternary true false }}
+                "isFilterinEmptyResources": true
             }
         }
     },
diff --git a/kubernetes/policy/components/policy-distribution/templates/deployment.yaml b/kubernetes/policy/components/policy-distribution/templates/deployment.yaml
index 4745aac23b..9c71ac1920 100755
--- a/kubernetes/policy/components/policy-distribution/templates/deployment.yaml
+++ b/kubernetes/policy/components/policy-distribution/templates/deployment.yaml
@@ -75,6 +75,13 @@ spec:
         - name: {{ include "common.name" . }}
           image: {{ include "repositoryGenerator.repository" . }}/{{ .Values.image }}
           imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
+          env:
+          - name: SECURITY_PROTOCOL
+            value: {{ .Values.config.kafka.securityProtocol }}
+          - name: SASL_MECHANISM
+            value: {{ .Values.config.kafka.saslMechanism }}
+          - name: SASL_JAAS_CONFIG
+            {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "policy-dist-kafka-user" "key" "sasl.jaas.config") | indent 12 }}
 {{- if .Values.global.aafEnabled }}
           command: ["sh","-c"]
           args: ["source {{ .Values.certInitializer.credsPath }}/.ci;\
diff --git a/kubernetes/policy/components/policy-distribution/templates/policy-dist-kafka-user.yaml b/kubernetes/policy/components/policy-distribution/templates/policy-dist-kafka-user.yaml
new file mode 100644
index 0000000000..eb721b07bb
--- /dev/null
+++ b/kubernetes/policy/components/policy-distribution/templates/policy-dist-kafka-user.yaml
@@ -0,0 +1,36 @@
+{{/*
+# Copyright © 2022 Nordix Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+*/}}
+apiVersion: kafka.strimzi.io/v1beta2
+kind: KafkaUser
+metadata:
+  name: {{ include "common.release" . }}-{{ .Values.global.policyDistKafkaUser }}
+  labels:
+    strimzi.io/cluster: {{ include "common.release" . }}-strimzi
+spec:
+  authentication:
+    type: {{ .Values.config.kafka.saslMechanism | lower }}
+  authorization:
+    type: {{ .Values.config.kafka.authType }}
+    acls:
+    - resource:
+        type: group
+        name: {{ .Values.config.kafka.sdcTopic.consumerGroup }}
+      operation: Read
+    - resource:
+        type: topic
+        patternType: prefix
+        name: {{ .Values.config.kafka.sdcTopic.pattern }}
+      operation: All
diff --git a/kubernetes/policy/components/policy-distribution/values.yaml b/kubernetes/policy/components/policy-distribution/values.yaml
index d9df88ce79..5cdda2f0b8 100755
--- a/kubernetes/policy/components/policy-distribution/values.yaml
+++ b/kubernetes/policy/components/policy-distribution/values.yaml
@@ -55,7 +55,13 @@ secrets:
     externalSecret: '{{ tpl (default "" .Values.certStores.trustStorePasswordExternalSecret) . }}'
     password: '{{ .Values.certStores.trustStorePassword }}'
     passwordPolicy: required
-
+  - uid: policy-dist-kafka-user
+    externalSecret: '{{ tpl (default "" .Values.config.jaasConfExternalSecret) . }}'
+    type: genericKV
+    envs:
+      - name: sasl.jaas.config
+        value: '{{ .Values.config.someConfig }}'
+        policy: generate
 #################################################################
 # Global configuration defaults.
 #################################################################
@@ -67,13 +73,24 @@ global:
 # Application configuration defaults.
 #################################################################
 # application image
-image: onap/policy-distribution:2.8.2
+image: onap/policy-distribution:2.9.0
 pullPolicy: Always
 
 # flag to enable debugging - application support required
 debugEnabled: false
 
 # application configuration
+config:
+  someConfig: blah
+  kafka:
+    bootstrapServer: strimzi-kafka-bootstrap:9092
+    securityProtocol: SASL_PLAINTEXT
+    saslMechanism: SCRAM-SHA-512
+    authType: simple
+    sdcTopic:
+      pattern: SDC-DIST
+      consumerGroup: policy-group
+      clientId: policy-distribution
 
 restServer:
   user: healthcheck
diff --git a/kubernetes/policy/values.yaml b/kubernetes/policy/values.yaml
index 45ade02a49..c9e236a65c 100755
--- a/kubernetes/policy/values.yaml
+++ b/kubernetes/policy/values.yaml
@@ -38,6 +38,7 @@ global:
       name: postgres
   kafkaBootstrap: strimzi-kafka-bootstrap
   policyKafkaUser: policy-kafka-user
+  policyDistKafkaUser: policy-dist-kafka-user
 
 #################################################################
 # Secrets metaconfig
@@ -128,7 +129,7 @@ policy-distribution:
   enabled: true
   db: *dbSecretsHook
   config:
-    jaasConfExternalSecret: '{{ include "common.release" . }}-{{ .Values.global.policyKafkaUser }}'
+    jaasConfExternalSecret: '{{ include "common.release" . }}-{{ .Values.global.policyDistKafkaUser }}'
 policy-clamp-ac-k8s-ppnt:
   enabled: true
   config: