Configure REST Proxy

global:
  rest-proxy:
    enabled: true

rest-proxy:
  image:
  #  tag: "1.5.4" #override
    registry: "registry.axual.io"
  keystoreProvider:
    image:
      registry: "registry.axual.io"
  # Enable podDisruptionBudget
  podDisruptionBudget:
    enabled: true
  # Enable Reloader
  # -- Optional: deployment-specific annotations.
  # These are not required for the Axual Platform itself,
  # but can be useful depending on your cluster setup.
  podAnnotations:
    # Enables automatic pod reload when ConfigMaps/Secrets change (Stakater Reloader)
    "reloader.stakater.com/auto": "true"
    # Specifies Fluent Bit parser for structured log collection
    fluentbit.io/parser: json

  config:
    # REST Proxy component is installed for a specific tenant, specific instance, specific cluster. If it is needed to add REST Proxy to other instance then a separate chart can be used to install it
    axual:
      tenant: "<tenant-short-name>" # The target tenant
      instance: "<instance-short-name>" # The shortname of the target instance
      configMode: "static"
      static-configuration:
        tenant: "<tenant-short-name>" # The target tenant
        instance: "<instance-short-name>" # The shortname of the target instance
        cluster: "<cluster-name>" # The name of the target cluster
        # If REST Proxy is running in the same Kubernetes cluster we can just use the internal service url as well.
        bootstrapServers: "bootstrap-kafka.<domain>:443"
        schemaRegistryUrl: "https://apicurio.<domain>"
        enable.value.headers: "false"
        groupIdResolver: "io.axual.common.resolver.GroupPatternResolver"
        groupIdPattern: "{tenant}-{instance}-{environment}-{group}" # This should be the same with the group pattern which is used in cluster configuration
        topicResolver: "io.axual.common.resolver.TopicPatternResolver"
        topicPattern: "{tenant}-{instance}-{environment}-{topic}" # This should be the same with the group pattern which is used in topic configuration
        transactionalIdResolver: "io.axual.common.resolver.TransactionalIdPatternResolver"
        transactionalIdPattern: "{tenant}-{instance}-{environment}-{app.id}-{transactional.id}" # This should be the same with the group pattern which is used in transaction configuration
        # We use AdvancedAclPrincipalBuilder as we have chained principals. In case of principal without chain, use BasicAclPrincipalBuilder
        principalBuilderClass: io.axual.security.principal.AdvancedAclPrincipalBuilder
    spring:
      security:
        oauth2:
          resourceserver:
            jwt:
              issuer-uri: https://sts.windows.net/dcbcc3be-2c54-4328-86ee-2589d4da46de/  #iss of the token
      application:
        name: axual-rest-proxy
  logbackConfig: |
    <?xml version="1.0" encoding="UTF-8"?>
    <configuration>
      <appender name="console" class="ch.qos.logback.core.ConsoleAppender">
        <encoder class="net.logstash.logback.encoder.LogstashEncoder"/>
      </appender>

      <root level="INFO">
        <appender-ref ref="console" />
      </root>
    </configuration>
  tls:
    clientEnabled: true
    serverEnabled: true
    clientAuth: need
    automatedKeystores: true
    createServerKeypairSecret: false
    serverKeypairSecretName: server-cert-secret
    createClientKeypairSecret: false
    clientKeypairSecretName: rest-proxy-cert-secret
    createTruststoreCaSecret: false
    truststoreCaSecretName: my-external-ca
  service:
    type: ClusterIP
  ingress:
    enabled: true
    # -- The name of the IngressClass cluster resource.
    className: nginx
    # -- Annotations to add to the Ingress resource.
    annotations:
      nginx.ingress.kubernetes.io/backend-protocol: HTTPS
      nginx.ingress.kubernetes.io/ssl-passthrough: "true"
      nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
      external-dns.alpha.kubernetes.io/hostname: "restproxy.<domain>"
      axual.com/service.class: "aks-np-ams"
      external-dns.alpha.kubernetes.io/ttl: "60"
    hosts:
      - # -- The fully qualified domain name of a network host.
        host: restproxy.<domain>
        paths:
          - # -- Matched against the path of an incoming request.
            path: /
            # -- Determines the interpretation of the Path matching.
            # Can be one of the following values: `Exact`, `Prefix`, `ImplementationSpecific`.
            pathType: ImplementationSpecific
    # -- TLS configuration for this Ingress.
    tls:
      # Use secretName to update the certificates of the ingress
      - secretName: server-cert-secret
        hosts:
          - restproxy.<domain>

  kafkaInitContainer:
    # -- Kafka bootstrap servers to initialize
    # If REST Proxy is running in the same Kubernetes cluster we can just use the internal service url as well.
    bootstrapServers: "SSL://bootstrap-kafka.<domain>:443"
    # -- Principal common name to give access to (should match tls.clientKeypairSecretName)
    # principal: "[0] CN=Axual Root CA 2018, [1] CN=Axual Intermediate CA 2018 1, [2] CN=REST Proxy Client, O=Axual B.V.,L=Utrecht,ST=Utrecht,C=NL"
    # Check in Kafka logs if there is a certificate related error and check the CN there.
    # In this example, we dont have chained certificates so the value here should be just "REST Proxy Client"
    principal: "CN=REST Proxy Client"
    # Those two should be set based on the topic and group pattern, in this example the should be just {instance}
    # -- Group prefix to give access to (usually {tenant}-{instance})
    groupPattern: "<instance-short-name>"
    # -- Topic prefix to give access to (usually {tenant}-{instance})
    topicPattern: "<instance-short-name>"
    tls:
      # -- Existing Keypair secret name
      keypairSecretName: "server-cert-secret"
      # -- Existing Keypair key name
      keypairSecretKeyName: "tls.key"
      # -- Existing Keypair certificate name
      keypairSecretCertName: "tls.crt"
      # -- Existing Truststore secret name
      truststoreCaSecretName: "my-external-ca"
      # -- Existing Truststore certificate name
      truststoreCaSecretCertName: "ca.crt"
  serviceMonitor:
    enabled: true

#!/bin/bash
# https://<rest-proxy-ingress>
REST_HOST="https://restproxy.<domain>"
# Short name of the target environment
ENVIRONMENT=""
# Name of the target topic
STREAM=""
# The uuid of the target application. Can be found in URL of the application details in UI
UUID=""
# The id of the target application
APP_ID=""
JSON_HEADER="Content-Type: application/json"
PRODUCE_RECORD='{
   "keyMessage":{
      "type":"STRING",
      "message":"Random key: '$RANDOM'"
   },
   "valueMessage":{
      "type":"STRING",
      "message":"Random value: '$RANDOM'"
   }
}'
echo "Sending"
curl -vk --request POST \
  --url "${REST_HOST}/stream/${ENVIRONMENT}/${STREAM}" \
  --header "axual-application-id: $APP_ID" \
  --header 'axual-application-version: 1.0' \
  --header "axual-producer-uuid: $UUID" \
  --header "$JSON_HEADER" \
  --key <path-to-certificate-key> \
  --cert <path-to-certificate-crt> \
  --data "$PRODUCE_RECORD" \