diff options
11 files changed, 171 insertions, 0 deletions
diff --git a/kubernetes/sdnc/components/dmaap-listener/templates/authorizationpolicy.yaml b/kubernetes/sdnc/components/dmaap-listener/templates/authorizationpolicy.yaml new file mode 100644 index 0000000000..7158c0263f --- /dev/null +++ b/kubernetes/sdnc/components/dmaap-listener/templates/authorizationpolicy.yaml @@ -0,0 +1,17 @@ +{{/* +# Copyright © 2023 Nordix Foundation +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +*/}} + +{{ include "common.authorizationPolicy" . }}
\ No newline at end of file diff --git a/kubernetes/sdnc/components/dmaap-listener/values.yaml b/kubernetes/sdnc/components/dmaap-listener/values.yaml index e23969eef1..7b7b327896 100644 --- a/kubernetes/sdnc/components/dmaap-listener/values.yaml +++ b/kubernetes/sdnc/components/dmaap-listener/values.yaml @@ -112,6 +112,11 @@ service: - name: http port: 80 +serviceMesh: + authorizationPolicy: + authorizedPrincipals: + - serviceAccount: message-router-read + #Resource limit flavor -By default using small flavor: small #Segregation for different environment (small and large) diff --git a/kubernetes/sdnc/components/sdnc-ansible-server/templates/authorizationpolicy.yaml b/kubernetes/sdnc/components/sdnc-ansible-server/templates/authorizationpolicy.yaml new file mode 100644 index 0000000000..7158c0263f --- /dev/null +++ b/kubernetes/sdnc/components/sdnc-ansible-server/templates/authorizationpolicy.yaml @@ -0,0 +1,17 @@ +{{/* +# Copyright © 2023 Nordix Foundation +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +*/}} + +{{ include "common.authorizationPolicy" . }}
\ No newline at end of file diff --git a/kubernetes/sdnc/components/sdnc-ansible-server/values.yaml b/kubernetes/sdnc/components/sdnc-ansible-server/values.yaml index e9aeaf730a..5cf7b9c528 100644 --- a/kubernetes/sdnc/components/sdnc-ansible-server/values.yaml +++ b/kubernetes/sdnc/components/sdnc-ansible-server/values.yaml @@ -109,6 +109,10 @@ service: ingress: enabled: false +serviceMesh: + authorizationPolicy: + authorizedPrincipals: [] + #Resource Limit flavor -By default using small flavor: small diff --git a/kubernetes/sdnc/components/sdnc-web/templates/authorizationpolicy.yaml b/kubernetes/sdnc/components/sdnc-web/templates/authorizationpolicy.yaml new file mode 100644 index 0000000000..7158c0263f --- /dev/null +++ b/kubernetes/sdnc/components/sdnc-web/templates/authorizationpolicy.yaml @@ -0,0 +1,17 @@ +{{/* +# Copyright © 2023 Nordix Foundation +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +*/}} + +{{ include "common.authorizationPolicy" . }}
\ No newline at end of file diff --git a/kubernetes/sdnc/components/sdnc-web/values.yaml b/kubernetes/sdnc/components/sdnc-web/values.yaml index 3563eb7c10..391ef04d75 100644 --- a/kubernetes/sdnc/components/sdnc-web/values.yaml +++ b/kubernetes/sdnc/components/sdnc-web/values.yaml @@ -81,6 +81,12 @@ ingress: name: "sdnc-web" port: 8080 +serviceMesh: + authorizationPolicy: + authorizedPrincipals: + - serviceAccount: istio-ingress + namespace: istio-ingress + #Resource limit flavor -By default using small flavor: small #segregation for different environment (small and large) diff --git a/kubernetes/sdnc/components/ueb-listener/templates/authorizationpolicy.yaml b/kubernetes/sdnc/components/ueb-listener/templates/authorizationpolicy.yaml new file mode 100644 index 0000000000..7158c0263f --- /dev/null +++ b/kubernetes/sdnc/components/ueb-listener/templates/authorizationpolicy.yaml @@ -0,0 +1,17 @@ +{{/* +# Copyright © 2023 Nordix Foundation +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +*/}} + +{{ include "common.authorizationPolicy" . }}
\ No newline at end of file diff --git a/kubernetes/sdnc/components/ueb-listener/values.yaml b/kubernetes/sdnc/components/ueb-listener/values.yaml index 51c74b99b8..493c684497 100644 --- a/kubernetes/sdnc/components/ueb-listener/values.yaml +++ b/kubernetes/sdnc/components/ueb-listener/values.yaml @@ -123,6 +123,10 @@ service: ingress: enabled: false +serviceMesh: + authorizationPolicy: + authorizedPrincipals: [] + #Resource limit flavor -By default using small flavor: small #Segregation for different environment (small and large) diff --git a/kubernetes/sdnc/templates/authorizationpolicy.yaml b/kubernetes/sdnc/templates/authorizationpolicy.yaml new file mode 100644 index 0000000000..672ddf0b2f --- /dev/null +++ b/kubernetes/sdnc/templates/authorizationpolicy.yaml @@ -0,0 +1,61 @@ +{{/* +# Copyright © 2023 Nordix Foundation +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +*/}} + +{{ include "common.authorizationPolicy" . }} +--- +{{- $dot := default . .dot -}} +{{- $trustedDomain := default "cluster.local" $dot.Values.serviceMesh.authorizationPolicy.trustedDomain -}} +{{- $authorizedPrincipalsSdnHosts := default list $dot.Values.serviceMesh.authorizationPolicy.authorizedPrincipalsSdnHosts -}} +{{- $defaultOperationMethods := list "GET" "POST" "PUT" "PATCH" "DELETE" -}} +{{- $relName := include "common.release" . -}} +{{- if (include "common.useAuthorizationPolicies" .) }} +apiVersion: security.istio.io/v1beta1 +kind: AuthorizationPolicy +metadata: + name: sdnhost-{{ include "common.servicename" . }}-authz + namespace: {{ include "common.namespace" . }} +spec: + selector: + matchLabels: + app: sdnhost-{{ include "common.name" . }} + action: ALLOW + rules: +{{- if $authorizedPrincipalsSdnHosts }} +{{- range $principal := $authorizedPrincipalsSdnHosts }} + - from: + - source: + principals: +{{- $namespace := default "onap" $principal.namespace -}} +{{- if eq "onap" $namespace }} + - "{{ $trustedDomain }}/ns/{{ $namespace }}/sa/{{ $relName }}-{{ $principal.serviceAccount }}" +{{- else }} + - "{{ $trustedDomain }}/ns/{{ $namespace }}/sa/{{ $principal.serviceAccount }}" +{{- end }} + to: + - operation: + methods: +{{- if $principal.allowedOperationMethods }} +{{- range $method := $principal.allowedOperationMethods }} + - {{ $method }} +{{- end }} +{{- else }} +{{- range $method := $defaultOperationMethods }} + - {{ $method }} +{{- end }} +{{- end }} +{{- end }} +{{- end }} +{{- end }}
\ No newline at end of file diff --git a/kubernetes/sdnc/templates/service.yaml b/kubernetes/sdnc/templates/service.yaml index 3490dff9ab..c5ae5d5c10 100644 --- a/kubernetes/sdnc/templates/service.yaml +++ b/kubernetes/sdnc/templates/service.yaml @@ -105,6 +105,7 @@ metadata: name: sdnhost-{{ include "common.servicename" . }}-0 namespace: {{ .Release.Namespace }} labels: + app: sdnhost-{{ include "common.name" . }} statefulset.kubernetes.io/pod-name: {{ include "common.fullname" . }}-0 spec: ports: @@ -126,6 +127,7 @@ metadata: name: sdnhost-{{ include "common.servicename" . }}-1 namespace: {{ .Release.Namespace }} labels: + app: sdnhost-{{ include "common.name" . }} statefulset.kubernetes.io/pod-name: {{ include "common.fullname" . }}-1 spec: ports: @@ -147,6 +149,7 @@ metadata: name: sdnhost-{{ include "common.servicename" . }}-2 namespace: {{ .Release.Namespace }} labels: + app: sdnhost-{{ include "common.name" . }} statefulset.kubernetes.io/pod-name: {{ include "common.fullname" . }}-2 spec: ports: diff --git a/kubernetes/sdnc/values.yaml b/kubernetes/sdnc/values.yaml index f02bc0b3b0..ee8b2e5c30 100644 --- a/kubernetes/sdnc/values.yaml +++ b/kubernetes/sdnc/values.yaml @@ -586,6 +586,26 @@ ingress: config: ssl: "redirect" +serviceMesh: + authorizationPolicy: + authorizedPrincipals: + - serviceAccount: a1policymanagement-read + - serviceAccount: cds-blueprints-processor-read + - serviceAccount: consul-read + - serviceAccount: ncmp-dmi-plugin-read + - serviceAccount: policy-drools-pdp-read + - serviceAccount: robot-read + - serviceAccount: sdnc-ansible-server-read + - serviceAccount: sdnc-dmaap-listener-read + - serviceAccount: sdnc-prom-read + - serviceAccount: sdnc-ueb-listener-read + - serviceAccount: sdnc-web-read + - serviceAccount: so-sdnc-adapter-read + - serviceAccount: istio-ingress + namespace: istio-ingress + authorizedPrincipalsSdnHosts: + - serviceAccount: sdnc-read + #Resource Limit flavor -By Default using small flavor: small #segregation for different envionment (Small and Large) |