[SDNC] Create Authorization Policies for SDNC

[oom.git] / kubernetes / sdnc / values.yaml

diff --git a/kubernetes/sdnc/values.yaml b/kubernetes/sdnc/values.yaml
index 15a8045..ee8b2e5 100644 (file)
--- a/kubernetes/sdnc/values.yaml
+++ b/kubernetes/sdnc/values.yaml
@@ -22,7 +22,6 @@ global:
   nodePortPrefixExt: 304
   persistence:
     mountPath: /dockerdata-nfs
-  aafEnabled: true
   centralizedLoggingEnabled: true
   mariadbGalera:
     #This flag allows SO to instantiate its own mariadb-galera cluster
@@ -181,7 +180,10 @@ secrets:
     externalSecret: '{{ ternary (tpl (default "" .Values.config.sdnr.oauth.providersSecrets.keycloakExternalSecret) .) "oauth-disabled" .Values.config.sdnr.oauth.enabled }}'
     password: '{{ .Values.config.sdnr.oauth.providersSecrets.keycloak }}'
     passwordPolicy: required
-
+  - uid: ves-collector-secret
+    type: basicAuth
+    login: '{{ .Values.config.sdnr.vesCollector.username }}'
+    password: '{{ .Values.config.sdnr.vesCollector.password }}'
 #################################################################
 # Certificates
 #################################################################
@@ -207,7 +209,7 @@ certificates:
 # application images
 
 pullPolicy: Always
-image: onap/sdnc-image:2.2.2
+image: onap/sdnc-image:2.4.2
 
 # flag to enable debugging - application support required
 debugEnabled: false
@@ -261,6 +263,7 @@ config:
   ansibleUser: sdnc
   ansiblePassword: sdnc
   # ansibleCredsExternalSecret: some secret
+
   dbSdnctlDatabase: &sdncDbName sdnctl
   enableClustering: true
   sdncHome: /opt/onap/sdnc
@@ -354,24 +357,18 @@ config:
         title: ONAP Keycloak Provider
         roleMapping:
           mykeycloak: admin
-
-# dependency / sub-chart configuration
-certInitializer:
-  nameOverride: sdnc-cert-initializer
-  truststoreMountpath: /opt/onap/sdnc/data/stores
-  fqdn: "sdnc"
-  app_ns: "org.osaaf.aaf"
-  fqi: "sdnc@sdnc.onap.org"
-  fqi_namespace: org.onap.sdnc
-  public_fqdn: "sdnc.onap.org"
-  aafDeployFqi: "deployer@people.osaaf.org"
-  aafDeployPass: demo123456!
-  cadi_latitude: "38.0"
-  cadi_longitude: "-72.0"
-  credsPath: /opt/app/osaaf/local
-  aaf_add_config: >
-    cd /opt/app/osaaf/local;
-    /opt/app/aaf_config/bin/agent.sh local showpass {{.Values.fqi}} {{ .Values.fqdn }} | grep cadi_keystore_password= | cut -d= -f 2 > {{ .Values.credsPath }}/.pass 2>&1
+    vesCollector:
+      enabled: false
+      tls:
+        enabled: true
+      trustAllCertificates: false
+      username: sample1
+      password: sample1
+      address: dcae-ves-collector.onap
+      port: 8080
+      version: v7
+      reportingEntityName: ONAP SDN-R
+      eventLogMsgDetail: SHORT
 
 # dependency / sub-chart configuration
 network-name-gen:
@@ -445,8 +442,6 @@ sdnc-ansible-server:
 dgbuilder:
   enabled: true
   nameOverride: sdnc-dgbuilder
-  certInitializer:
-    nameOverride: sdnc-dgbuilder-cert-initializer
   config:
     db:
       dbName: *sdncDbName
@@ -465,17 +460,17 @@ dgbuilder:
   mariadb-galera:
   service:
     name: sdnc-dgbuilder
-    nodePort: "03"
+    ports:
+    - name: http
+      port: 3100
+      nodePort: 03
 
   ingress:
     enabled: false
     service:
-      - baseaddr: "sdnc-dgbuilder"
+      - baseaddr: "sdnc-dgbuilder-ui"
         name: "sdnc-dgbuilder"
-        port: 3000
-      - baseaddr: "sdnc-web-service"
-        name: "sdnc-web-service"
-        port: 8443
+        port: 3100
     config:
       ssl: "redirect"
 
@@ -486,10 +481,6 @@ localElasticCluster: true
 elasticsearch:
   nameOverride: &elasticSearchName sdnrdb
   name: sdnrdb-cluster
-  certInitializer:
-    fqdn: "sdnc"
-    fqi_namespace: org.onap.sdnc
-    fqi: "sdnc@sdnc.onap.org"
   service:
     name: *elasticSearchName
   master:
@@ -501,6 +492,7 @@ elasticsearch:
     dedicatednode: "no"
     nameOverride: *elasticSearchName
     cluster_name: sdnrdb-cluster
+
 # enable
 sdnc-web:
   enabled: true
@@ -526,11 +518,10 @@ readiness:
 service:
   type: NodePort
   name: sdnc
-  portName: sdnc
+  portName: http
   internalPort: 8181
   internalPort2: 8101
   internalPort3: 8080
-  internalPort4: 8443
 
   #port
   externalPort: 8282
@@ -539,7 +530,6 @@ service:
 
   externalPort3: 8280
 
-  externalPort4: 8443
   nodePort4: 67
 
   clusterPort: 2550
@@ -553,7 +543,7 @@ service:
   geoNodePort5: 65
   geoNodePort6: 66
 
-  callHomePort: 6666
+  callHomePort: &chport 4334
   callHomeNodePort: 66
 
 ## Persist data to a persitent volume
@@ -581,31 +571,41 @@ persistence:
   journalPath: /opt/opendaylight/segmented-journal
   snapshotsPath: /opt/opendaylight/snapshots
 
-certpersistence:
-  enabled: true
-
-  ## A manually managed Persistent Volume and Claim
-  ## Requires persistence.enabled: true
-  ## If defined, PVC must be created manually before volume will be bound
-  # existingClaim:
-
-  volumeReclaimPolicy: Retain
-  accessMode: ReadWriteOnce
-  size: 50Mi
-  mountPath: /dockerdata-nfs
-  mountSubPath: sdnc/certs
-  certPath: /opt/app/osaaf
-  ##storageClass: "manual"
-
 ingress:
   enabled: false
   service:
-    - baseaddr: "sdnc.api"
-      name: "sdnc"
-      port: 8443
+  - baseaddr: "sdnc-api"
+    name: "sdnc"
+    port: 8282
+  - baseaddr: "sdnc-callhome"
+    name: "sdnc-callhome"
+    port: *chport
+    protocol: tcp
+    exposedPort: *chport
+    exposedProtocol: TCP
   config:
     ssl: "redirect"
 
+serviceMesh:
+  authorizationPolicy:
+    authorizedPrincipals:
+      - serviceAccount: a1policymanagement-read
+      - serviceAccount: cds-blueprints-processor-read
+      - serviceAccount: consul-read
+      - serviceAccount: ncmp-dmi-plugin-read
+      - serviceAccount: policy-drools-pdp-read
+      - serviceAccount: robot-read
+      - serviceAccount: sdnc-ansible-server-read
+      - serviceAccount: sdnc-dmaap-listener-read
+      - serviceAccount: sdnc-prom-read
+      - serviceAccount: sdnc-ueb-listener-read
+      - serviceAccount: sdnc-web-read
+      - serviceAccount: so-sdnc-adapter-read
+      - serviceAccount: istio-ingress
+        namespace: istio-ingress
+    authorizedPrincipalsSdnHosts:
+      - serviceAccount: sdnc-read
+
 #Resource Limit flavor -By Default using small
 flavor: small
 #segregation for different envionment (Small and Large)