Add user configurable parameter for permitted helm repo protocols

User can configure the permitted helm repository protocols http/https
based on the requirement.

Issue-ID: POLICY-4113
Signed-off-by: zrrmmua <ramesh.murugan.iyer@est.tech>
Change-Id: Ib7c91413babd15d0bd22ceffe10cdc1c3a6a0fd0

diff --git a/packages/policy-clamp-tarball/src/main/resources/etc/KubernetesParticipantParameters.yaml b/packages/policy-clamp-tarball/src/main/resources/etc/KubernetesParticipantParameters.yaml
index c6acf40..ad1669c 100644 (file)
--- a/packages/policy-clamp-tarball/src/main/resources/etc/KubernetesParticipantParameters.yaml
+++ b/packages/policy-clamp-tarball/src/main/resources/etc/KubernetesParticipantParameters.yaml
@@ -59,3 +59,17 @@ logging:
 chart:
   api:
     enabled: false
+
+# Update the config here for permitting repositories and protocols
+helm:
+  repos:
+    -
+      repoName: kong
+      address: https://charts.konghq.com
+    -
+      repoName: bitnami
+      address: https://charts.bitnami.com/bitnami
+
+  protocols:
+    - http
+    - https
\ No newline at end of file

diff --git a/participant/participant-impl/participant-impl-kubernetes/src/main/java/org/onap/policy/clamp/acm/participant/kubernetes/configurations/HelmRepositoryConfig.java b/participant/participant-impl/participant-impl-kubernetes/src/main/java/org/onap/policy/clamp/acm/participant/kubernetes/configurations/HelmRepositoryConfig.java
index 4d00e38..61a813e 100644 (file)
--- a/participant/participant-impl/participant-impl-kubernetes/src/main/java/org/onap/policy/clamp/acm/participant/kubernetes/configurations/HelmRepositoryConfig.java
+++ b/participant/participant-impl/participant-impl-kubernetes/src/main/java/org/onap/policy/clamp/acm/participant/kubernetes/configurations/HelmRepositoryConfig.java
@@ -38,4 +38,6 @@ public class HelmRepositoryConfig {
     private final Logger logger = LoggerFactory.getLogger(MethodHandles.lookup().lookupClass());
 
     private List<HelmRepository> repos = new ArrayList<>();
+
+    private List<String> protocols = new ArrayList<>();
 }

diff --git a/participant/participant-impl/participant-impl-kubernetes/src/main/java/org/onap/policy/clamp/acm/participant/kubernetes/service/ChartService.java b/participant/participant-impl/participant-impl-kubernetes/src/main/java/org/onap/policy/clamp/acm/participant/kubernetes/service/ChartService.java
index e9cd8a2..888600f 100644 (file)
--- a/participant/participant-impl/participant-impl-kubernetes/src/main/java/org/onap/policy/clamp/acm/participant/kubernetes/service/ChartService.java
+++ b/participant/participant-impl/participant-impl-kubernetes/src/main/java/org/onap/policy/clamp/acm/participant/kubernetes/service/ChartService.java
@@ -93,7 +93,7 @@ public class ChartService {
      * @throws IOException in case of IO errors
      */
     public boolean installChart(ChartInfo chart) throws ServiceException, IOException {
-        boolean whiteListed = false;
+        boolean permittedRepo = false;
         if (chart.getRepository() == null) {
             String repoName = findChartRepo(chart);
             if (repoName == null) {
@@ -106,17 +106,18 @@ public class ChartService {
             }
         } else {
             // Add remote repository if passed via TOSCA
-            // check whether the repo is whitelisted
+            // check whether the repo is permitted
             for (HelmRepository repo : helmRepositoryConfig.getRepos()) {
                 if (repo.getAddress().equals(chart.getRepository().getAddress())
-                        && chart.getRepository().getAddress().contains("https")) {
+                        && helmRepositoryConfig.getProtocols()
+                    .contains(chart.getRepository().getAddress().split(":")[0])) {
                     configureRepository(chart.getRepository());
-                    whiteListed = true;
+                    permittedRepo = true;
                     break;
                 }
             }
-            if (!whiteListed) {
-                logger.error("Repository is not Whitelisted / plain http in not allowed");
+            if (!permittedRepo) {
+                logger.error("Helm Repository/Protocol is not permitted for {}", chart.getRepository().getAddress());
                 return false;
             }
         }

diff --git a/participant/participant-impl/participant-impl-kubernetes/src/main/resources/config/application.yaml b/participant/participant-impl/participant-impl-kubernetes/src/main/resources/config/application.yaml
index ac18bca..0f8c495 100644 (file)
--- a/participant/participant-impl/participant-impl-kubernetes/src/main/resources/config/application.yaml
+++ b/participant/participant-impl/participant-impl-kubernetes/src/main/resources/config/application.yaml
@@ -58,7 +58,7 @@ logging:
 chart:
   api:
     enabled: false
-
+# Update the config here for permitting repositories and protocols
 helm:
   repos:
     -
@@ -66,4 +66,8 @@ helm:
       address: https://charts.konghq.com
     -
       repoName: bitnami
-      address: https://charts.bitnami.com/bitnami
\ No newline at end of file
+      address: https://charts.bitnami.com/bitnami
+
+  protocols:
+    - http
+    - https
\ No newline at end of file

diff --git a/participant/participant-impl/participant-impl-kubernetes/src/test/java/org/onap/policy/clamp/acm/participant/kubernetes/service/ChartServiceTest.java b/participant/participant-impl/participant-impl-kubernetes/src/test/java/org/onap/policy/clamp/acm/participant/kubernetes/service/ChartServiceTest.java
index d83d43f..669ca3f 100644 (file)
--- a/participant/participant-impl/participant-impl-kubernetes/src/test/java/org/onap/policy/clamp/acm/participant/kubernetes/service/ChartServiceTest.java
+++ b/participant/participant-impl/participant-impl-kubernetes/src/test/java/org/onap/policy/clamp/acm/participant/kubernetes/service/ChartServiceTest.java
@@ -123,6 +123,7 @@ class ChartServiceTest {
         List<HelmRepository> helmRepositoryList = new ArrayList<>();
         helmRepositoryList.add(HelmRepository.builder().address("https://localhost:8080").build());
         doReturn(helmRepositoryList).when(helmRepositoryConfig).getRepos();
+        doReturn(List.of("http", "https")).when(helmRepositoryConfig).getProtocols();
         assertDoesNotThrow(() -> chartService.installChart(charts.get(0)));
         doThrow(ServiceException.class).when(helmClient).installChart(any());
         assertThatThrownBy(() -> chartService.installChart(charts.get(0))).isInstanceOf(ServiceException.class);