Merge "[POLICY] Update strimzi config in policy helm charts"

10 files changed, 182 insertions, 31 deletions

diff --git a/kubernetes/policy/components/policy-apex-pdp/templates/statefulset.yaml b/kubernetes/policy/components/policy-apex-pdp/templates/statefulset.yaml
index 4d9ff9250e..71320dc3eb 100755
--- a/kubernetes/policy/components/policy-apex-pdp/templates/statefulset.yaml
+++ b/kubernetes/policy/components/policy-apex-pdp/templates/statefulset.yaml
@@ -2,6 +2,7 @@
 #  ============LICENSE_START=======================================================
 #   Copyright (C) 2018 Ericsson. All rights reserved.
 #   Modifications Copyright (C) 2020 AT&T Intellectual Property.
+#   Modifications Copyright © 2022 Nordix Foundation
 #  ================================================================================
 #  Licensed under the Apache License, Version 2.0 (the "License");
 #  you may not use this file except in compliance with the License.
@@ -56,6 +57,10 @@ spec:
           {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "restserver-creds" "key" "login") | indent 10 }}
         - name: RESTSERVER_PASSWORD
           {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "restserver-creds" "key" "password") | indent 10 }}
+{{- if .Values.config.useStrimziKafka }}
+        - name: JAASLOGIN
+          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "policy-kafka-user" "key" "sasl.jaas.config") | indent 10 }}
+{{- end }}
         volumeMounts:
         - mountPath: /config-input
           name: apexconfig-input
diff --git a/kubernetes/policy/components/policy-apex-pdp/values.yaml b/kubernetes/policy/components/policy-apex-pdp/values.yaml
index db5251913e..92cd50c808 100755
--- a/kubernetes/policy/components/policy-apex-pdp/values.yaml
+++ b/kubernetes/policy/components/policy-apex-pdp/values.yaml
@@ -1,6 +1,7 @@
 #  ============LICENSE_START=======================================================
 #   Copyright (C) 2018 Ericsson. All rights reserved.
 #   Modifications Copyright (C) 2019-2021 AT&T Intellectual Property.
+#   Modifications Copyright © 2022 Nordix Foundation
 #  ================================================================================
 #  Licensed under the Apache License, Version 2.0 (the "License");
 #  you may not use this file except in compliance with the License.
@@ -44,6 +45,13 @@ secrets:
     externalSecret: '{{ tpl (default "" .Values.certStores.keyStorePasswordExternalSecret) . }}'
     password: '{{ .Values.certStores.keyStorePassword }}'
     passwordPolicy: required
+  - uid: policy-kafka-user
+    externalSecret: '{{ tpl (default "" .Values.config.jaasConfExternalSecret) . }}'
+    type: genericKV
+    envs:
+      - name: sasl.jaas.config
+        value: '{{ .Values.config.someConfig }}'
+        policy: generate
 
 #################################################################
 # Application configuration defaults.
@@ -160,3 +168,26 @@ metrics:
       chart: '{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}'
       release: '{{ include "common.release" . }}'
       heritage: '{{ .Release.Service }}'
+
+# application configuration
+config:
+# Event consumption (kafka) properties
+  useStrimziKafka: true
+  kafkaBootstrap: strimzi-kafka-bootstrap
+  kafka:
+    consumer:
+      groupId: policy-group
+  app:
+    listener:
+      policyPdpPapTopic: policy-pdp-pap
+# If targeting a custom kafka cluster, ie useStrimziKakfa: false
+# uncomment below config and target your kafka bootstrap servers,
+# along with any other security config.
+#
+# eventConsumption:
+#   spring.kafka.bootstrap-servers: <kafka-bootstrap>:9092
+#   spring.kafka.security.protocol: PLAINTEXT
+#   spring.kafka.consumer.group-id: policy-group
+#
+# Any new property can be added in the env by setting in overrides in the format mentioned below
+# All the added properties must be in "key: value" format instead of yaml.
diff --git a/kubernetes/policy/components/policy-clamp-ac-http-ppnt/resources/config/HttpParticipantParameters.yaml b/kubernetes/policy/components/policy-clamp-ac-http-ppnt/resources/config/HttpParticipantParameters.yaml
index 406b59c545..bae5941854 100644
--- a/kubernetes/policy/components/policy-clamp-ac-http-ppnt/resources/config/HttpParticipantParameters.yaml
+++ b/kubernetes/policy/components/policy-clamp-ac-http-ppnt/resources/config/HttpParticipantParameters.yaml
@@ -23,18 +23,17 @@ spring:
       password: ${RESTSERVER_PASSWORD}
 {{- if .Values.config.useStrimziKafka }}
   kafka:
+    consumer:
+      group-id: {{ .Values.config.kafka.consumer.groupId }}
     bootstrap-servers: {{ include "common.release" . }}-{{ .Values.config.kafkaBootstrap }}:9092
     security.protocol: SASL_PLAINTEXT
     properties.sasl:
       mechanism: SCRAM-SHA-512
       jaas.config: ${JAASLOGIN}
 {{ else }}
-{{ toYaml .Values.config.eventPublisher | nindent 2 }}
+{{ toYaml .Values.config.eventConsumption | nindent 2 }}
 {{- end }}
 
-{{- if .Values.config.additional }}
-{{ toYaml .Values.config.additional | nindent 2 }}
-{{- end }}
 security:
   enable-csrf: false
 
@@ -62,6 +61,29 @@ participant:
             - ${topicServer:message-router}
           topicCommInfrastructure: dmaap
           useHttps: true
+# If Strimzi Kafka to be used for communication, replace clampAutomationCompositionTopics configuration with below
+#    clampAutomationCompositionTopics:
+#      topicSources:
+#        - topic: policy-acruntime-participant
+#          servers:
+#            - {{ include "common.release" . }}-{{ .Values.config.kafkaBootstrap }}:9092
+#          topicCommInfrastructure: kafka
+#          fetchTimeout: 15000
+#          useHttps: true
+#          additionalProps:
+#            security.protocol: SASL_PLAINTEXT
+#            sasl.mechanism: SCRAM-SHA-512
+#            sasl.jaas.config: ${JAASLOGIN}
+#      topicSinks:
+#        - topic: policy-acruntime-participant
+#          servers:
+#            - {{ include "common.release" . }}-{{ .Values.config.kafkaBootstrap }}:9092
+#          topicCommInfrastructure: kafka
+#          useHttps: true
+#          additionalProps:
+#            security.protocol: SASL_PLAINTEXT
+#            sasl.mechanism: SCRAM-SHA-512
+#            sasl.jaas.config: ${JAASLOGIN}
 
 management:
   endpoints:
diff --git a/kubernetes/policy/components/policy-clamp-ac-k8s-ppnt/resources/config/KubernetesParticipantParameters.yaml b/kubernetes/policy/components/policy-clamp-ac-k8s-ppnt/resources/config/KubernetesParticipantParameters.yaml
index 6c14fd2207..00451b9425 100644
--- a/kubernetes/policy/components/policy-clamp-ac-k8s-ppnt/resources/config/KubernetesParticipantParameters.yaml
+++ b/kubernetes/policy/components/policy-clamp-ac-k8s-ppnt/resources/config/KubernetesParticipantParameters.yaml
@@ -21,20 +21,19 @@ spring:
     user:
       name: ${RESTSERVER_USER}
       password: ${RESTSERVER_PASSWORD}
-{{- if .Values.config.useStrimziKafka }}
   kafka:
+    consumer:
+      group-id: {{ .Values.config.kafka.consumer.groupId }}
+{{- if .Values.config.useStrimziKafka }}
     bootstrap-servers: {{ include "common.release" . }}-{{ .Values.config.kafkaBootstrap }}:9092
     security.protocol: SASL_PLAINTEXT
     properties.sasl:
       mechanism: SCRAM-SHA-512
       jaas.config: ${JAASLOGIN}
 {{ else }}
-{{ toYaml .Values.config.eventPublisher | nindent 2 }}
+{{ toYaml .Values.config.eventConsumption | nindent 2 }}
 {{- end }}
 
-{{- if .Values.config.additional }}
-{{ toYaml .Values.config.additional | nindent 2 }}
-{{- end }}
 security:
   enable-csrf: false
 
@@ -67,6 +66,32 @@ participant:
           topicCommInfrastructure: dmaap
           useHttps: true
 
+# If Strimzi Kafka to be used for communication, replace clampAutomationCompositionTopics configuration with below
+#    clampAutomationCompositionTopics:
+#      topicSources:
+#        -
+#          topic: policy-acruntime-participant
+#          servers:
+#            - {{ include "common.release" . }}-{{ .Values.config.kafkaBootstrap }}:9092
+#          topicCommInfrastructure: kafka
+#          fetchTimeout: 15000
+#          useHttps: true
+#          additionalProps:
+#            security.protocol: SASL_PLAINTEXT
+#            sasl.mechanism: SCRAM-SHA-512
+#            sasl.jaas.config: ${JAASLOGIN}
+#      topicSinks:
+#        -
+#          topic: policy-acruntime-participant
+#          servers:
+#            - {{ include "common.release" . }}-{{ .Values.config.kafkaBootstrap }}:9092
+#          topicCommInfrastructure: kafka
+#          useHttps: true
+#          additionalProps:
+#            security.protocol: SASL_PLAINTEXT
+#            sasl.mechanism: SCRAM-SHA-512
+#            sasl.jaas.config: ${JAASLOGIN}
+
 management:
   endpoints:
     web:
diff --git a/kubernetes/policy/components/policy-clamp-ac-pf-ppnt/resources/config/PolicyParticipantParameters.yaml b/kubernetes/policy/components/policy-clamp-ac-pf-ppnt/resources/config/PolicyParticipantParameters.yaml
index 856b16d91d..07d5eca377 100644
--- a/kubernetes/policy/components/policy-clamp-ac-pf-ppnt/resources/config/PolicyParticipantParameters.yaml
+++ b/kubernetes/policy/components/policy-clamp-ac-pf-ppnt/resources/config/PolicyParticipantParameters.yaml
@@ -21,20 +21,19 @@ spring:
     user:
       name: ${RESTSERVER_USER}
       password: ${RESTSERVER_PASSWORD}
-{{- if .Values.config.useStrimziKafka }}
   kafka:
+    consumer:
+      group-id: {{ .Values.config.kafka.consumer.groupId }}
+{{- if .Values.config.useStrimziKafka }}
     bootstrap-servers: {{ include "common.release" . }}-{{ .Values.config.kafkaBootstrap }}:9092
     security.protocol: SASL_PLAINTEXT
     properties.sasl:
       mechanism: SCRAM-SHA-512
       jaas.config: ${JAASLOGIN}
 {{ else }}
-{{ toYaml .Values.config.eventPublisher | nindent 2 }}
+{{ toYaml .Values.config.eventConsumption | nindent 2 }}
 {{- end }}
 
-{{- if .Values.config.additional }}
-{{ toYaml .Values.config.additional | nindent 2 }}
-{{- end }}
 security:
   enable-csrf: false
 
@@ -83,6 +82,32 @@ participant:
           topicCommInfrastructure: dmaap
           useHttps: true
 
+# If Strimzi Kafka to be used for communication, replace clampAutomationCompositionTopics configuration with below
+#    clampAutomationCompositionTopics:
+#      topicSources:
+#        -
+#          topic: policy-acruntime-participant
+#          servers:
+#            - {{ include "common.release" . }}-{{ .Values.config.kafkaBootstrap }}:9092
+#          topicCommInfrastructure: kafka
+#          fetchTimeout: 15000
+#          useHttps: true
+#          additionalProps:
+#            security.protocol: SASL_PLAINTEXT
+#            sasl.mechanism: SCRAM-SHA-512
+#            sasl.jaas.config: ${JAASLOGIN}
+#      topicSinks:
+#        -
+#          topic: policy-acruntime-participant
+#          servers:
+#            - {{ include "common.release" . }}-{{ .Values.config.kafkaBootstrap }}:9092
+#          topicCommInfrastructure: kafka
+#          useHttps: true
+#          additionalProps:
+#            security.protocol: SASL_PLAINTEXT
+#            sasl.mechanism: SCRAM-SHA-512
+#            sasl.jaas.config: ${JAASLOGIN}
+
 management:
   endpoints:
     web:
diff --git a/kubernetes/policy/components/policy-clamp-runtime-acm/resources/config/acRuntimeParameters.yaml b/kubernetes/policy/components/policy-clamp-runtime-acm/resources/config/acRuntimeParameters.yaml
index 219be24079..4fb70fc337 100644
--- a/kubernetes/policy/components/policy-clamp-runtime-acm/resources/config/acRuntimeParameters.yaml
+++ b/kubernetes/policy/components/policy-clamp-runtime-acm/resources/config/acRuntimeParameters.yaml
@@ -44,19 +44,17 @@ spring:
       hibernate:
         dialect: org.hibernate.dialect.MariaDB103Dialect
         format_sql: true
-{{- if .Values.config.useStrimziKafka }}
   kafka:
+    consumer:
+      group-id: {{ .Values.config.kafka.consumer.groupId }}
+{{- if .Values.config.useStrimziKafka }}
     bootstrap-servers: {{ include "common.release" . }}-{{ .Values.config.kafkaBootstrap }}:9092
     security.protocol: SASL_PLAINTEXT
     properties.sasl:
       mechanism: SCRAM-SHA-512
       jaas.config: ${JAASLOGIN}
 {{ else }}
-{{ toYaml .Values.config.eventPublisher | nindent 2 }}
-{{- end }}
-
-{{- if .Values.config.additional }}
-{{ toYaml .Values.config.additional | nindent 2 }}
+{{ toYaml .Values.config.eventConsumption | nindent 2 }}
 {{- end }}
 
 security:
@@ -95,6 +93,32 @@ runtime:
         topicCommInfrastructure: dmaap
         useHttps: true
 
+# If Strimzi Kafka to be used for communication, replace clampAutomationCompositionTopics configuration with below
+#  topicParameterGroup:
+#    topicSources:
+#      -
+#        topic: policy-acruntime-participant
+#        servers:
+#          - {{ include "common.release" . }}-{{ .Values.config.kafkaBootstrap }}:9092
+#        topicCommInfrastructure: kafka
+#        useHttps: true
+#        fetchTimeout: 15000
+#        additionalProps:
+#          security.protocol: SASL_PLAINTEXT
+#          sasl.mechanism: SCRAM-SHA-512
+#          sasl.jaas.config: ${JAASLOGIN}
+#    topicSinks:
+#      -
+#        topic: policy-acruntime-participant
+#        servers:
+#          - {{ include "common.release" . }}-{{ .Values.config.kafkaBootstrap }}:9092
+#        topicCommInfrastructure: kafka
+#        useHttps: true
+#        additionalProps:
+#          security.protocol: SASL_PLAINTEXT
+#          sasl.mechanism: SCRAM-SHA-512
+#          sasl.jaas.config: ${JAASLOGIN}
+
 management:
   endpoints:
     web:
diff --git a/kubernetes/policy/components/policy-pap/resources/config/papParameters.yaml b/kubernetes/policy/components/policy-pap/resources/config/papParameters.yaml
index 195b087ff1..7cb32d0079 100644
--- a/kubernetes/policy/components/policy-pap/resources/config/papParameters.yaml
+++ b/kubernetes/policy/components/policy-pap/resources/config/papParameters.yaml
@@ -1,5 +1,6 @@
 #  ============LICENSE_START=======================================================
 #   Copyright (C) 2022 Bell Canada. All rights reserved.
+#   Modifications Copyright © 2022 Nordix Foundation
 #  ================================================================================
 #  Licensed under the Apache License, Version 2.0 (the "License");
 #  you may not use this file except in compliance with the License.
@@ -40,19 +41,17 @@ spring:
       naming:
         physical-strategy: org.hibernate.boot.model.naming.PhysicalNamingStrategyStandardImpl
         implicit-strategy: org.onap.policy.common.spring.utils.CustomImplicitNamingStrategy
-{{- if .Values.config.useStrimziKafka }}
   kafka:
+    consumer:
+      group-id: {{ .Values.config.kafka.consumer.groupId }}
+{{- if .Values.config.useStrimziKafka }}
     bootstrap-servers: {{ include "common.release" . }}-{{ .Values.config.kafkaBootstrap }}:9092
     security.protocol: SASL_PLAINTEXT
     properties.sasl:
       mechanism: SCRAM-SHA-512
       jaas.config: ${JAASLOGIN}
 {{ else }}
-{{ toYaml .Values.config.eventPublisher | nindent 2 }}
-{{- end }}
-
-{{- if .Values.config.additional }}
-{{ toYaml .Values.config.additional | nindent 2 }}
+{{ toYaml .Values.config.eventConsumption | nindent 2 }}
 {{- end }}
 
 server:
@@ -99,6 +98,15 @@ pap:
       - message-router
       useHttps: true
       topicCommInfrastructure: dmaap
+# If Strimzi Kafka to be used for communication, replace following configuration for topicSources and topicSinks
+#          servers:
+#            - {{ include "common.release" . }}-{{ .Values.config.kafkaBootstrap }}:9092
+#          topicCommInfrastructure: kafka
+#          additionalProps:
+#            security.protocol: SASL_PLAINTEXT
+#            sasl.mechanism: SCRAM-SHA-512
+#            sasl.jaas.config: ${JAASLOGIN}
+
   healthCheckRestClientParameters:
   - clientName: api
     hostname: policy-api
diff --git a/kubernetes/policy/components/policy-pap/values.yaml b/kubernetes/policy/components/policy-pap/values.yaml
index 2c240d2347..a5d6cdece8 100755
--- a/kubernetes/policy/components/policy-pap/values.yaml
+++ b/kubernetes/policy/components/policy-pap/values.yaml
@@ -2,6 +2,7 @@
 #   Copyright (C) 2019 Nordix Foundation.
 #   Modifications Copyright (C) 2019-2021 AT&T Intellectual Property.
 #   Modifications Copyright (C) 2020-2022 Bell Canada. All rights reserved.
+#   Modifications Copyright © 2022 Nordix Foundation
 #  ================================================================================
 #  Licensed under the Apache License, Version 2.0 (the "License");
 #  you may not use this file except in compliance with the License.
@@ -211,7 +212,7 @@ config:
   kafkaBootstrap: strimzi-kafka-bootstrap
   kafka:
     consumer:
-      groupId: poicy-group
+      groupId: policy-group
   app:
     listener:
       policyPdpPapTopic: policy-pdp-pap
diff --git a/kubernetes/policy/templates/policy-kafka-user.yaml b/kubernetes/policy/templates/policy-kafka-user.yaml
index 1bc7ab1d3a..43edb64c83 100644
--- a/kubernetes/policy/templates/policy-kafka-user.yaml
+++ b/kubernetes/policy/templates/policy-kafka-user.yaml
@@ -1,5 +1,6 @@
 {{/*
 # Copyright © 2022 Nordix Foundation
+# Modifications Copyright © 2022 Nordix Foundation
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -29,13 +30,21 @@ spec:
     - resource:
         type: group
         name: {{ .Values.config.acRuntimeTopic.consumer.groupId }}
-      operation: Read
+      operation: All
     - resource:
         type: topic
         name: {{ .Values.config.acRuntimeTopic.name }}
-      operation: Read
+      operation: All
     - resource:
         type: topic
-        name: {{ .Values.config.acRuntimeTopic.name }}
-      operation: Write
+        name: {{ .Values.config.policyPdpPapTopic.name }}
+      operation: All
+    - resource:
+        type: topic
+        name: {{ .Values.config.policyHeartbeatTopic.name }}
+      operation: All
+    - resource:
+        type: topic
+        name: {{ .Values.config.policyNotificationTopic.name }}
+      operation: All
 {{- end }}
diff --git a/kubernetes/policy/values.yaml b/kubernetes/policy/values.yaml
index d7d556a39f..aa3fdb7bf2 100755
--- a/kubernetes/policy/values.yaml
+++ b/kubernetes/policy/values.yaml
@@ -237,6 +237,7 @@ config:
     segmentBytes: 1073741824
     consumer:
       groupId: policy-group
+  someConfig: blah
 
 mariadb-galera:
   # mariadb-galera.config and global.mariadb.config must be equals