2 # Copyright © 2020 Amdocs, Bell Canada, Orange
3 # Modifications Copyright © 2023 Nordix Foundation
5 # Licensed under the Apache License, Version 2.0 (the "License");
6 # you may not use this file except in compliance with the License.
7 # You may obtain a copy of the License at
9 # http://www.apache.org/licenses/LICENSE-2.0
11 # Unless required by applicable law or agreed to in writing, software
12 # distributed under the License is distributed on an "AS IS" BASIS,
13 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 # See the License for the specific language governing permissions and
15 # limitations under the License.
19 Calculate if we are on service mesh.
21 {{- define "common.onServiceMesh" -}}
22 {{- if .Values.global.serviceMesh -}}
23 {{- if (default false .Values.global.serviceMesh.enabled) -}}
30 Kills the sidecar proxy associated with a pod.
32 {{- define "common.serviceMesh.killSidecar" -}}
33 {{- if (include "common.onServiceMesh" .) }}
35 echo "*** script finished with exit code $RCODE" ;
36 echo "*** killing service mesh sidecar" ;
37 curl -sf -X POST http://127.0.0.1:15020/quitquitquit ;
39 echo "*** exiting with script exit code" ;
45 Wait for job container.
47 {{- define "common.waitForJobContainer" -}}
48 {{- $dot := default . .dot -}}
49 {{- $wait_for_job_container := default $dot.Values.wait_for_job_container .wait_for_job_container -}}
50 {{- if (include "common.onServiceMesh" .) }}
51 - name: {{ include "common.name" $dot }}{{ ternary "" (printf "-%s" $wait_for_job_container.name) (empty $wait_for_job_container.name) }}-service-mesh-wait-for-job-container
52 image: {{ include "repositoryGenerator.image.quitQuit" $dot }}
53 imagePullPolicy: {{ $dot.Values.global.pullPolicy | default $dot.Values.pullPolicy }}
58 - echo "waiting 10s for istio side cars to be up"; sleep 10s;
59 {{- range $container := $wait_for_job_container.containers }}
60 /app/ready.py --service-mesh-check {{ tpl $container $dot }} -t 45;
67 fieldPath: metadata.namespace
72 Use Authorization Policies or not.
74 {{- define "common.useAuthorizationPolicies" -}}
75 {{- if (include "common.onServiceMesh" .) }}
76 {{- if .Values.global.authorizationPolicies -}}
77 {{- if (default false .Values.global.authorizationPolicies.enabled) -}}
85 Create Authorization Policy template.
86 If common.useAuthorizationPolicies returns true:
87 Will create authorization policy, provided with array of authorized principals in .Values.serviceMesh.authorizationPolicy.authorizedPrincipals
90 - serviceAccount: <serviceaccount name> (Mandatory)
91 namespace: <namespace name> (Optional, will default to onap)
92 allowedOperationMethods: <list of allowed HTTP operations (Optional, will default to ["GET", "POST", "PUT", "PATCH", "DELETE"])
94 If no authorizedPrincipals provided, will default to denying all requests to the app matched under the
98 app: <app-to-match> ("app" corresponds to a key defined in "common.labels", which is included in "common.service")
100 If common.useAuthorizationPolicies returns false:
101 Will not create an authorization policy
103 {{- define "common.authorizationPolicy" -}}
104 {{- $dot := default . .dot -}}
105 {{- $trustedDomain := default "cluster.local" $dot.Values.serviceMesh.authorizationPolicy.trustedDomain -}}
106 {{- $authorizedPrincipals := default list $dot.Values.serviceMesh.authorizationPolicy.authorizedPrincipals -}}
107 {{- $defaultOperationMethods := list "GET" "POST" "PUT" "PATCH" "DELETE" -}}
108 {{- $relName := include "common.release" . -}}
109 {{- if (include "common.useAuthorizationPolicies" .) }}
110 apiVersion: security.istio.io/v1beta1
111 kind: AuthorizationPolicy
113 name: {{ include "common.fullname" (dict "suffix" "authz" "dot" . )}}
114 namespace: {{ include "common.namespace" . }}
118 app: {{ include "common.name" . }}
121 {{- if $authorizedPrincipals }}
122 {{- range $principal := $authorizedPrincipals }}
126 {{- $namespace := default "onap" $principal.namespace -}}
127 {{- if eq "onap" $namespace }}
128 - "{{ $trustedDomain }}/ns/{{ $namespace }}/sa/{{ $relName }}-{{ $principal.serviceAccount }}"
130 - "{{ $trustedDomain }}/ns/{{ $namespace }}/sa/{{ $principal.serviceAccount }}"
135 {{- if $principal.allowedOperationMethods }}
136 {{- range $method := $principal.allowedOperationMethods }}
140 {{- range $method := $defaultOperationMethods }}