[AAI] Create Authorization Policies for AAI

[oom.git] / kubernetes / aai / values.yaml

diff --git a/kubernetes/aai/values.yaml b/kubernetes/aai/values.yaml
index b023a8b..87de5a3 100644 (file)
--- a/kubernetes/aai/values.yaml
+++ b/kubernetes/aai/values.yaml
@@ -32,7 +32,6 @@ global: # global defaults
 
   restartPolicy: Always
 
-  aafEnabled: false
   msbEnabled: false
   centralizedLoggingEnabled: false
 
@@ -359,18 +358,14 @@ readiness:
 service:
   type: NodePort
   portName: http
-  externalPort: 8443
-  internalPort: 8443
+  externalPort: 80
+  internalPort: 8080
   nodePort: 33
-  externalPlainPort: 80
-  internalPlainPort: 8080
-  nodeport: 33
-  aaiServiceClusterIp:
   sessionAffinity: None
 
 metricsService:
   type: ClusterIP
-  portName: prometheus
+  portName: http-prometheus
   externalPort: 8448
   internalPort: 8448
 
@@ -397,11 +392,38 @@ ingress:
   service:
     - baseaddr: "aai-api"
       name: "aai"
-      port: 8443
-      plain_port: 80
+      port: 80
       config:
        ssl: "redirect"
 
+serviceMesh:
+  authorizationPolicy:
+    authorizedPrincipalsMetrics: []
+    authorizedPrincipals:
+      - serviceAccount: aai-graphadmin-read
+      - serviceAccount: aai-modelloader-read
+      - serviceAccount: aai-resources-read
+      - serviceAccount: aai-schema-service-read
+      - serviceAccount: aai-traversal-read
+      - serviceAccount: cds-blueprints-processor-read
+      - serviceAccount: consul-read
+      - serviceAccount: dcae-prh-read
+      - serviceAccount: dcae-slice-analysis-ms-read
+      - serviceAccount: dcae-tcagen2
+      - serviceAccount: nbi-read
+      - serviceAccount: sdnc-read
+      - serviceAccount: so-read
+      - serviceAccount: so-bpmn-infra-read
+      - serviceAccount: so-cnf-adapter-read
+      - serviceAccount: so-nssmf-adapter-read
+      - serviceAccount: so-etsi-nfvo-ns-lcm-read
+      - serviceAccount: so-etsi-sol003-adapter-read
+      - serviceAccount: so-openstack-adapter-read
+      - serviceAccount: so-sdc-controller-read
+      - serviceAccount: so-ve-vnfm-adapter
+      - serviceAccount: istio-ingress
+        namespace: istio-ingress
+
 resources:
   small:
     limits: