first commit

templates/pep-server/NOTES.txt

@@ -0,0 +1,8 @@
+Thank you for installing the {{ .Chart.Name }} chart for the Amplify Integration Platform.
+
+Your release is named {{ .Release.Name }}.
+
+To learn more about the release, try:
+
+  $ helm status {{ .Release.Name }}
+  $ helm get all {{ .Release.Name }}

templates/pep-server/_helpers.tpl

@@ -0,0 +1,76 @@
+{{- define "pep-server.name" -}}
+{{- default "pep-server" .Values.pepServer.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "pep-server.fullname" -}}
+{{- if .Values.pepServer.fullnameOverride }}
+{{- .Values.pepServer.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default "pep-server" .Values.pepServer.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+
+{{/*
+Common labels
+*/}}
+{{- define "pep-server.labels" -}}
+{{ include "dataplane.labels" . }}
+{{ include "pep-server.selectorLabels" . }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "pep-server.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "pep-server.name" . }}
+app: {{ include "pep-server.appName" . }}
+dplane: "pep-server"
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "pep-server.serviceAccountName" -}}
+{{- if .Values.pepServer.serviceAccount.enabled }}
+{{- default (include "pep-server.fullname" .) .Values.pepServer.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.pepServer.serviceAccount.name }}
+{{- end }}
+{{- end }}
+
+{{/*
+Custom templates start here 
+*/}}
+
+{{- define "pep-server.appName" -}}
+{{- $name := default "pep-server" .Values.pepServer.nameOverride -}}
+{{- $env := default "pep-server" .Values.global.appEnv -}}
+{{- printf "%s-%s" $name $env  | trunc 63 | trimSuffix "-" -}}
+{{- end }}
+
+{{/*
+Image name
+*/}}
+{{- define "image.finalname" -}}
+{{- printf "%s/%s:%s" .Values.pepServer.image.server "pep-server" .Chart.AppVersion }}
+{{- end }}
+
+{{/*
+Cpu min request
+*/}}
+{{- define "microserviceChart.minCpuUnits" -}}
+"
+{{- index .Values.pepServer.valuesPerEnvironment.cpuUnits ((pluck .Values.pepServer.environment .Values.pepServer.environments | first | default .Values.pepServer.environments.sandbox) | int) -}}
+m"
+{{- end }}

templates/pep-server/calico.netpol.yaml

@@ -0,0 +1,70 @@
+{{- if .Values.pepServer.calicoNetpol.enabled }}
+apiVersion: projectcalico.org/v3
+kind: NetworkPolicy
+metadata:
+  name: {{ template "pep-server.appName" .}}
+  namespace: {{ .Release.Namespace }}
+spec:
+  order: 10
+  selector: dplane == 'pep-server'
+  types:
+    - Ingress
+    - Egress
+  ingress:
+    ### traffic from ingress###
+    - action: Allow
+      protocol: TCP
+      source:
+        selector: dplane == 'envoy' || dplane == 'pep-server'
+        namespaceSelector: projectcalico.org/name == '{{ .Release.Namespace }}'
+      destination:
+        ports:
+          {{- range .Values.pepServer.service.ports}}
+          - {{ .targetPort }}
+          {{- end}}
+  egress:
+    # allow to communicate to DNS pods
+    - action: Allow
+      protocol: UDP
+      destination:
+        namespaceSelector: projectcalico.org/name == 'kube-system'
+        ports:
+          - 53
+    - action: Allow
+      protocol: TCP
+      destination:
+        namespaceSelector: projectcalico.org/name == 'kube-system'
+        ports:
+          - 53
+    # allow to communicate with k8s api server
+    - action: Allow
+      destination:
+        services:
+          name: kubernetes
+          namespace: default
+      protocol: TCP
+    ### Traffic to Valkey ###
+    {{- if .Values.valkey.enabled }}
+    - action: Allow
+      protocol: TCP
+      destination:
+      {{- if and .Values.valkey.internal.enabled .Values.valkey.internal.calicoNetpol.enabled }}
+        selector: dplane == 'valkey'
+        namespaceSelector: projectcalico.org/name == '{{ .Release.Namespace }}'
+      {{- else if and .Values.valkey.external.enabled .Values.valkey.external.calicoNetpol.enabled }}
+        ports:
+          {{- include "dataplane.collectPorts" (dict "hosts" .Values.valkey.hosts "defaultPort" 6379) | trim | nindent 10 }}
+        {{- $rule := .Values.valkey.external.calicoNetpol.outboundRule }}
+        {{- if $rule.nets }}
+        nets:
+          {{- range $rule.nets }}
+          - {{ . }}
+          {{- end }}
+        {{- else if $rule.selector }}
+        selector: {{ $rule.selector }}
+        {{- else }}
+        namespaceSelector: projectcalico.org/name == '{{ .Release.Namespace }}'
+        {{- end }}
+      {{- end }}
+    {{- end }}
+{{- end }}

templates/pep-server/configmap-pep-server.yaml

@@ -0,0 +1,39 @@
+{{- if eq .Values.common.externalConfigMaps false }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ template "pep-server.appName" . }}
+  namespace: {{ .Release.Namespace }}
+data:
+  JAVA_OPTS: "{{ .Values.pepServer.javaOpts }}"
+  QUARKUS_LOG_CONSOLE_LEVEL: "{{ .Values.pepServer.QUARKUS_LOG_CONSOLE_LEVEL }}"
+  TERMINATION_GRACE_PERIOD_SECS: "{{ .Values.pepServer.terminationGracePeriodSeconds }}"
+  QUARKUS_SHUTDOWN_DELAY: "{{ .Values.pepServer.preStopSleepSeconds }}"
+  extproc_background_cleanup_duration: "{{ .Values.pepServer.extproc_background_cleanup_duration }}"
+  grpc_server_drain: "{{ .Values.pepServer.grpc_server_drain }}"
+  multihost_enabled: "{{ .Values.global.multihost.enabled }}"
+  idle_timeout: "{{ .Values.pepServer.idleTimeout }}"
+  extAuthzTimeout: "{{ .Values.pepServer.extAuthzTimeout }}"
+  ocspTimeOut: "{{ .Values.pepServer.ocspTimeOut | default "900ms" }}"
+  ocspCacheTTL: "{{ .Values.pepServer.ocspCacheTTL | default "1440m" }}"
+  max_orchestration_duration: "{{ .Values.envoy.timeouts.maxDuration }}"
+  {{ if .Values.global.multihost.enabled  }}
+  api_enabled: "{{ .Values.global.multihost.listeners.tls.api.enabled }}"
+  api_mtls_enabled: "{{ .Values.global.multihost.listeners.tls.api_mtls.enabled }}"
+  https_enabled: "{{ .Values.global.multihost.listeners.tls.https.enabled }}"
+  webhook_enabled: "{{ .Values.global.multihost.listeners.tls.webhook.enabled }}"
+  api_server_name: "{{ .Values.global.multihost.listeners.tls.api.hostPrefix }}.{{ .Values.global.external_domain }}"
+  api_mtls_server_name: "{{ .Values.global.multihost.listeners.tls.api_mtls.hostPrefix }}.{{ .Values.global.external_domain }}"
+  https_server_name: "{{ .Values.global.multihost.listeners.tls.https.hostPrefix }}.{{ .Values.global.external_domain }}"
+  webhook_server_name: "{{ .Values.global.multihost.listeners.tls.webhook.hostPrefix }}.{{ .Values.global.external_domain }}"
+  listener_port: "8443"
+  {{ else }}
+  listener_port: "4443"
+  listener_mtls_port: "5443"
+  {{- if eq  (include "parent.dataplaneMode" . ) "shared" }}
+  api_server_name: "*.{{ .Values.global.external_domain }}"
+  {{- else }}
+  api_server_name: "{{ .Values.global.external_domain }}"
+  {{- end }}
+  {{- end }}
+{{- end }}

templates/pep-server/deployment.yaml

@@ -0,0 +1,141 @@
+{{- if .Values.pepServer.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ template "pep-server.appName" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "pep-server.labels" . | nindent 4 }}
+spec:
+  {{- if not .Values.pepServer.autoscaling.enabled }}
+  replicas: {{ .Values.pepServer.replicaCount }}
+  {{- end }}
+  strategy:
+    type: {{ .Values.pepServer.strategy.type }}
+    rollingUpdate:
+      maxSurge: {{ .Values.pepServer.strategy.rollingUpdate.maxSurge }}
+      maxUnavailable: {{ .Values.pepServer.strategy.rollingUpdate.maxUnavailable }}
+  selector:
+    matchLabels:
+      {{- include "pep-server.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      {{- with .Values.pepServer.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "pep-server.selectorLabels" . | nindent 8 }}
+    spec:
+      terminationGracePeriodSeconds: {{ .Values.pepServer.terminationGracePeriodSeconds }}
+      {{- with .Values.global.image.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if .Values.pepServer.serviceAccount.enabled }}
+      serviceAccountName: {{ include "pep-server.serviceAccountName" . }}
+      {{- end }}
+      {{- if .Values.pepServer.podSecurityContextEnabled }}
+      securityContext: {{- toYaml .Values.pepServer.podSecurityContext | nindent 8 }}
+      {{- end }}
+      dnsConfig:
+        options:
+          - name: use-vc
+      initContainers:
+        - name: {{ .Chart.Name }}-init
+          securityContext:
+            {{- toYaml .Values.pepServer.securityContext | nindent 12 }}
+          image: "{{ default .Values.global.image.repository .Values.global.alpinetools.image.repository }}/{{ .Values.global.alpinetools.image.name }}:{{ .Values.global.alpinetools.image.tag }}"
+          imagePullPolicy: {{ .Values.global.image.pullPolicy }}
+          env:
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  apiVersion: v1
+                  fieldPath: metadata.name
+          envFrom:
+            - configMapRef:
+                name: configmap-common
+          volumeMounts:
+            - name: {{ .Values.global.volumeStorageName }}
+              mountPath: /efs
+          command:
+            - "/bin/sh"
+            - "-c"
+            - |
+              {{- if .Values.valkey.internal.enabled }}
+              {{ include "dataplane.commonInit" (dict "context" . "buildTag" .Values.pepServer.image.buildTag "internal" true "replicas" .Values.valkey.internal.clusterSize) | nindent 14 }}
+              {{- else if .Values.valkey.external.enabled }}
+              {{ include "dataplane.commonInit" (dict "context" . "buildTag" .Values.pepServer.image.buildTag) | nindent 14 }}
+              {{- end }}
+
+              {{- if .Values.fluentBit.enabled }}
+              {{ include "dataplane.createLogDirectory" (dict "serviceName" "pep-server" "efsRoot" "${efs_root}" "podName" "${POD_NAME}" "additionalPathParam" "") | nindent 14 }}
+              {{- end }}
+          {{- with .Values.global.initContainers.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+      containers:
+        - name: {{ template "pep-server.appName" . }}
+          securityContext:
+            {{- toYaml .Values.pepServer.securityContext | nindent 12 }}
+          image: "{{ default .Values.global.image.repository .Values.pepServer.image.repository }}/{{ .Values.pepServer.image.name }}:{{ .Values.pepServer.image.buildTag | default .Chart.AppVersion }}"
+          imagePullPolicy: {{ .Values.global.image.pullPolicy }}
+          envFrom:
+            - configMapRef:
+                name: configmap-common
+            - secretRef:
+                name: {{ .Values.common.clusterDetails.name }}
+            - configMapRef:
+                name: {{ template "pep-server.appName" . }}
+            {{- if .Values.valkey.enabled }}
+            - secretRef:
+                name: {{ .Values.common.datagridCredentials.name }}
+            {{- end }}
+          env:
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: local_ip
+              valueFrom:
+                fieldRef:
+                  fieldPath: status.podIP
+            {{- with .Values.pepServer.env }}
+              {{- toYaml . | nindent 12 }}
+            {{- end }}
+          ports:
+            - containerPort: 9090
+              name: xds
+            - containerPort: 8080
+              name: internal
+          volumeMounts:
+            - name: {{ .Values.global.volumeStorageName }}
+              mountPath: /efs
+            - name: tmpdir
+              mountPath: /tmp
+          resources:
+            {{- toYaml .Values.pepServer.resources | nindent 12 }}
+          livenessProbe: {{- toYaml .Values.pepServer.livenessProbe | nindent 12 }}
+          startupProbe: {{- toYaml .Values.pepServer.startupProbe | nindent 12 }}
+          readinessProbe: {{- toYaml .Values.pepServer.readinessProbe | nindent 12 }}
+      volumes:
+      - name: tmpdir
+        emptyDir: {}
+      - name: {{ .Values.global.volumeStorageName }}
+        persistentVolumeClaim:
+          claimName: {{ .Release.Namespace }}-{{ .Values.global.claimName }}
+      {{- with .Values.pepServer.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.pepServer.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.pepServer.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+{{- end }}

templates/pep-server/hpa.yaml

@@ -0,0 +1,33 @@
+{{- if .Values.pepServer.autoscaling.enabled }}
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{ template "pep-server.appName" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "pep-server.labels" . | nindent 4 }}
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: {{ template "pep-server.appName" . }}
+  minReplicas: {{ .Values.pepServer.autoscaling.minReplicas }}
+  maxReplicas: {{ .Values.pepServer.autoscaling.maxReplicas }}
+  metrics:
+    {{- if .Values.pepServer.autoscaling.targetCPUUtilizationPercentage }}
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: {{ .Values.pepServer.autoscaling.targetCPUUtilizationPercentage }}
+    {{- end }}
+    {{- if .Values.pepServer.autoscaling.targetMemoryUtilizationPercentage }}
+    - type: Resource
+      resource:
+        name: memory
+        target:
+          type: Utilization
+          averageUtilization: {{ .Values.pepServer.autoscaling.targetMemoryUtilizationPercentage }}
+    {{- end }}
+{{- end }}

templates/pep-server/poddisruptionbudget.yaml

@@ -0,0 +1,12 @@
+{{- if .Values.pepServer.podDisruptionBudget.enabled }}
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: {{ template "pep-server.appName" . }}
+  namespace: {{ .Release.Namespace }}
+spec:
+  minAvailable: {{ .Values.pepServer.podDisruptionBudget.minPods }}
+  selector:
+    matchLabels:
+      dplane: {{ .Chart.Name }}
+{{- end}}

templates/pep-server/role.yaml

@@ -0,0 +1,7 @@
+{{- if ( and .Values.pepServer.serviceAccount.enabled ( not .Values.pepServer.serviceAccount.preexisting ) ) -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ template "pep-server.name" . }}-role
+rules: []
+{{- end }}

templates/pep-server/roleBinding.yaml

@@ -0,0 +1,14 @@
+{{- if ( and .Values.pepServer.serviceAccount.enabled ( not .Values.pepServer.serviceAccount.preexisting ) ) -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ template "pep-server.name" . }}-role-binding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ template "pep-server.name" . }}-role
+subjects:
+  - kind: ServiceAccount
+    name: {{ .Values.pepServer.serviceAccount.enabled | ternary .Values.pepServer.serviceAccount.name "default" }}
+    namespace: {{ .Release.Namespace }}
+{{- end }}

templates/pep-server/service.yaml

@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ template "pep-server.appName" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "pep-server.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.pepServer.service.type }}
+  selector:
+    {{- include "pep-server.selectorLabels" . | nindent 4 }}
+  ports:
+    {{- range $port := .Values.pepServer.service.ports }}
+    - name: {{ $port.name }}
+      protocol: {{ $port.protocol }}
+      port: {{ $port.port }}
+      targetPort: {{ $port.targetPort }}
+    {{- end }}

templates/pep-server/serviceaccount.yaml

@@ -0,0 +1,13 @@
+{{- if ( and .Values.pepServer.serviceAccount.enabled ( not .Values.pepServer.serviceAccount.preexisting ) ) -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "pep-server.serviceAccountName" . }}
+  labels:
+    {{- include "pep-server.labels" . | nindent 4 }}
+  {{- with .Values.pepServer.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+automountServiceAccountToken: {{ .Values.pepServer.serviceAccount.automountServiceAccountToken }}
+{{- end }}