Merge pull request #12 from dnvgl/session-management-flags

Session management flags

charts/platform-service/Chart.yaml

@@ -2,4 +2,4 @@ apiVersion: v1
 appVersion: "1.0"
 description: Platform service chart
 name: platform-service
-version: 1.0.42
+version: 1.0.43

charts/platform-service/templates/deployment.yaml

@@ -43,6 +43,13 @@ spec:
         {{- if .Values.opa.enabled }}
         sidecar.opa-istio.io/inject: "true"
         {{- end }}
+        {{- if .Values.sessionManagement.enabled }}
+        {{- if .Values.sessionManagement.redirectToLogin }}
+        {{ .Values.sessionManagement.enabledWithRedirectLabel }}
+        {{- else }}
+        {{ .Values.sessionManagement.enabledWithoutRedirectLabel }}
+        {{- end }}
+        {{- end }}
         {{- if .Values.additionalPodLabels }}
 {{- with .Values.additionalPodLabels }}
 {{ tpl . $ | indent 8 }}

charts/platform-service/values.yaml

@@ -156,6 +156,12 @@ requestAuthentication:
         - 22b9c23f-4a41-4729-8a5d-793f7601dfdb
         - fe494c14-85d2-4bfa-bb43-92b0ab0a4f72
 
+sessionManagement:
+  enabled: true
+  redirectToLogin: false
+  enabledWithRedirectLabel: "session-management: frontend"
+  enabledWithoutRedirectLabel: "session-management: backend"
+
 authorizationPolicy:
   # Generate default authorization policy
   enabled: true

testing/cors-policy-values.yaml

@@ -0,0 +1,6 @@
+defaultRouting:
+  corsPolicy:
+    allowOrigins:
+    - exact: app://.
+    allowMethods:
+    - GET

testing/generate-results.sh

@@ -0,0 +1,75 @@
+rm results/*.yaml
+echo `date` > results/run-date.txt
+
+helm template test-release ../charts/platform-service -n test-ns -f values.yaml \
+     > results/base-case.yaml
+
+helm template test-release ../charts/platform-service -n test-ns -f values.yaml \
+    --set gateway.exposeService=false \
+    > results/not-exposed.yaml
+
+helm template test-release ../charts/platform-service -n test-ns -f values.yaml \
+    --set sessionManagement.enabled=false \
+    --show-only templates/deployment.yaml \
+    > results/no-sessman.yaml
+
+helm template test-release ../charts/platform-service -n test-ns -f values.yaml \
+    --set sessionManagement.redirectToLogin=true \
+    --show-only templates/deployment.yaml \
+    > results/sessman-with-redirect.yaml
+
+
+helm template test-release ../charts/platform-service -n test-ns -f values.yaml \
+    --set deploymentOnly=true \
+    > results/deployment-only.yaml
+
+helm template test-release ../charts/platform-service -n test-ns -f values.yaml \
+    --set defaultRouting.enabled=false \
+    > results/vs-default-routing-disabled.yaml
+
+helm template test-release ../charts/platform-service -n test-ns -f values.yaml \
+    --set defaultRouting.retries.enabled=true \
+    --show-only templates/virtualservice.yaml \
+    > results/vs-with-retries.yaml
+
+
+helm template test-release ../charts/platform-service -n test-ns -f values.yaml \
+    --set defaultRouting.allHosts=true \
+    --show-only templates/virtualservice.yaml \
+    > results/vs-all-hosts.yaml
+
+
+helm template test-release ../charts/platform-service -n test-ns -f values.yaml \
+    --set defaultRouting.urlPrefixes= \
+    --show-only templates/virtualservice.yaml \
+    > results/vs-no-urlPrefixes.yaml
+
+helm template test-release ../charts/platform-service -n test-ns -f values.yaml \
+    --set defaultRouting.rewriteUrlPrefix.enabled=false \
+    --show-only templates/virtualservice.yaml \
+    > results/vs-rewriteUrlPrefix-disabled.yaml
+
+helm template test-release ../charts/platform-service -n test-ns -f values.yaml \
+    --set defaultRouting.redirectOnNoTrailingSlash=false \
+    --show-only templates/virtualservice.yaml \
+    > results/vs-no-slash-redirect.yaml
+
+helm template test-release ../charts/platform-service -n test-ns -f values.yaml \
+    -f cors-policy-values.yaml \
+    --show-only templates/virtualservice.yaml \
+    > results/vs-cors-policy.yaml
+
+helm template test-release ../charts/platform-service -n test-ns -f values.yaml \
+    --set defaultRouting.urlExactMatches[0]="url1",defaultRouting.urlExactMatches[0]="url2" \
+    --show-only templates/virtualservice.yaml \
+    > results/vs-exact-matches.yaml
+
+
+echo " *** kubeval results ***"
+kubeval --ignore-missing-schemas results/*.yaml
+echo " *** istioctl validation results ***"
+for f in $(ls results/*.yaml);
+do
+  echo istioctl validating $f;
+  cat $f | istioctl validate -f -
+done;

testing/results/base-case.yaml

@@ -0,0 +1,260 @@
+---
+# Source: platform-service/templates/network-policy.yaml
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: test-release-network-policy
+spec:
+  podSelector:
+    matchLabels:
+      app: test
+      version: v1
+  policyTypes:
+    - Ingress
+  ingress:
+  - from:
+    - podSelector:
+        matchLabels:
+          istio: pilot
+      namespaceSelector:
+        matchLabels:
+          istio-operator-managed: Reconcile
+  - from:
+    - podSelector:
+        matchLabels:
+          istio: ingressgateway
+      namespaceSelector:
+        matchLabels:
+          istio-operator-managed: Reconcile
+  - from:
+    - podSelector:
+        matchLabels:
+          app: consumer
+    ports:
+    - protocol: TCP
+      port: 80
+---
+# Source: platform-service/templates/service-account.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: test
+---
+# Source: platform-service/templates/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: test
+  labels:
+    app.kubernetes.io/name: test
+    helm.sh/chart: platform-service-1.0.43
+    app.kubernetes.io/instance: test-release
+    app.kubernetes.io/managed-by: Helm
+spec:
+  type: 
+  ports:
+    - port: 8000
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    app.kubernetes.io/name: test
+    app: test
+---
+# Source: platform-service/templates/deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: test-release
+  labels:
+    app.kubernetes.io/name: test
+    helm.sh/chart: platform-service-1.0.43
+    app.kubernetes.io/instance: test-release
+    app.kubernetes.io/managed-by: Helm
+    app: test
+    version: v1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: test
+      app.kubernetes.io/instance: test-release
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: test
+        app.kubernetes.io/instance: test-release
+        app: test
+        version: v1
+        session-management: backend
+      annotations:
+    spec:
+      serviceAccountName: test
+      initContainers:
+      containers:
+
+        - name: test
+          image: "test.io/some/repository:latest"
+          imagePullPolicy: IfNotPresent
+
+          env:
+            - name: baseLevel
+              value: "only set at base"
+            - name: definedInBaseAndDuplicatedInOverride
+              value: "sharedValue"
+            - name: definedInBaseAndOverridden
+              value: "baseValue"
+            - name: definedInBaseAndOverriddenValue
+              valueFrom:
+                secretKeyRef:
+                  key: username
+                  name: base-secret
+            - name: onlyDefinedInBaseValue
+              valueFrom:
+                secretKeyRef:
+                  key: username
+                  name: base-secret
+
+          ports:
+            - name: http
+              containerPort: 80
+              protocol: TCP
+          livenessProbe:
+            failureThreshold: 3
+            httpGet:
+              path: /healthz
+              port: 80
+            initialDelaySeconds: 0
+            periodSeconds: 10
+            timeoutSeconds: 1
+          readinessProbe:
+            httpGet:
+              path: /ready
+              port: 80
+            successThreshold: 3
+          startupProbe:
+            failureThreshold: 30
+            httpGet:
+              path: /health/startup
+              port: 80
+            periodSeconds: 10
+          volumeMounts:
+            - name: service-secrets
+              mountPath: /secrets
+
+          resources:
+            {}
+      volumes:
+
+      - name: service-secrets
+        secret:
+          secretName: test-secrets
+---
+# Source: platform-service/templates/authorizationPolicy.yaml
+apiVersion: security.istio.io/v1beta1
+kind: AuthorizationPolicy
+metadata:
+  name: test-release
+spec:
+  selector:
+    matchLabels:
+      app: test
+      version: v1
+  action: ALLOW
+  rules:
+  - from:
+    - source:
+        principals: ["cluster.local/ns/myns/sa/consumersp"]
+  - from:
+    - source:
+        principals: ["cluster.local/ns/test-ns/sa/testsp"]
+        requestPrincipals: ["*"]
+  - from:
+    - source:
+        namespaces: ["istio-system"]
+        requestPrincipals: ["*"]
+---
+# Source: platform-service/templates/destinationrules.yaml
+apiVersion: networking.istio.io/v1alpha3
+kind: DestinationRule
+metadata:
+  name: test-release-destinationrule
+spec:
+  host: test
+  trafficPolicy:
+    loadBalancer:
+      simple: RANDOM
+    tls:
+      mode: ISTIO_MUTUAL
+---
+# Source: platform-service/templates/requestAuthentication.yaml
+apiVersion: security.istio.io/v1beta1
+kind: RequestAuthentication
+metadata:
+  name: test-release
+spec:
+  selector:
+    matchLabels:
+      app: test
+      version: v1
+  jwtRules:
+  - audiences:
+    - test-audience
+    forwardOriginalToken: true
+    issuer: https://login.microsoftonline.com/abcd/v2.0/
+    jwksUri: https://jwksuri/discovery/v2.0/keys
+---
+# Source: platform-service/templates/virtualservice.yaml
+apiVersion: networking.istio.io/v1alpha3
+kind: VirtualService
+metadata:
+  name: test
+spec:
+  hosts:
+  - test
+  gateways:
+  - mesh
+  http:
+  - route:
+    - destination:
+        host: "test"
+---
+# Source: platform-service/templates/virtualservice.yaml
+apiVersion: networking.istio.io/v1alpha3
+kind: VirtualService
+metadata:
+  name: test-external
+spec:
+  hosts:
+  - "mysubdomain1.mydomain.com"
+  - "mysubdomain2.mydomain.com"
+  gateways:
+  - gateway/one-gateway
+  http:
+  # redirect on prefixes without trailing slashes
+  - match:
+    - uri:
+        exact: /prefix1
+    redirect:
+      uri: /prefix1/
+  - match:
+    - uri:
+        exact: /prefix2
+    redirect:
+      uri: /prefix2/
+  # routes to service
+  - route:
+    - destination:
+        host: "test"
+    match:
+    - uri:
+        prefix: /prefix1/
+    - uri:
+        prefix: /prefix2/
+    rewrite:
+      uri: /
+    # deprecated
+    headers:
+      request:
+        add:
+          x-appname: prefix1