istio: allow to change tls cipher suites and headers

Signed-off-by: Pascal Sthamer <10992664+P4sca1@users.noreply.github.com>

charts/shuffle/README.md

@@ -539,8 +539,11 @@ SHUFFLE_ENCRYPTION_MODIFIER: "MyShuffleEncryptionModifier"
 | `istio.gateway.http.httpsRedirect`      | If set to true, a 301 redirect is send for all HTTP connections                 | `false`                  |
 | `istio.gateway.https.enabled`           | Enable HTTPS server on port 443                                                 | `false`                  |
 | `istio.gateway.https.tlsCredentialName` | The name of the secret that holds the TLS certs including the CA certificates.  | `""`                     |
+| `istio.gateway.https.tlsCipherSuites`   | If specified, only support the specified cipher list.                           | `[]`                     |
 | `istio.gateway.extraServers`            | Additional servers for the Gateway resource                                     | `[]`                     |
 | `istio.virtualService.annotations`      | Additional annotations for the VirtualService resource.                         | `{}`                     |
+| `istio.virtualService.backendHeaders`   | Header manipulation rules for backend traffic                                   | `{}`                     |
+| `istio.virtualService.frontendHeaders`  | Header manipulation rules for frontend traffic                                  | `{}`                     |
 
 ### Persistence Parameters
 
@@ -596,3 +599,5 @@ SHUFFLE_ENCRYPTION_MODIFIER: "MyShuffleEncryptionModifier"
 | `vault.secrets` | A list of VaultSecrets to create                                           | `[]`  |
 
 ### Other Parameters
+
+

charts/shuffle/templates/istio/gateway.yaml

@@ -32,6 +32,9 @@ spec:
       tls:
         credentialName: {{ .Values.istio.gateway.https.tlsCredentialName }}
         mode: SIMPLE
+        {{- with .Values.istio.gateway.https.tlsCipherSuites }}
+        cipherSuites: {{- include "common.tplvalues.render" ( dict "value" . "context" $ ) | nindent 10 }}
+        {{- end }}
 	{{- end }}
     {{- if .Values.istio.gateway.extraServers }}
     {{- include "common.tplvalues.render" (dict "value" .Values.istio.gateway.extraServers "context" $) | nindent 4 }}

charts/shuffle/templates/istio/virtual-service.yaml

@@ -14,7 +14,8 @@ spec:
   gateways:
     - {{ include "common.names.fullname" . }}
   http:
-    - match:
+    - name: backend
+      match:
         - uri:
             prefix: /api
       route:
@@ -22,9 +23,16 @@ spec:
             host: {{ include "shuffle.backend.name" . }}
             port:
               number: {{ .Values.backend.containerPorts.http }}
-    - route:
+      {{- with .Values.istio.virtualService.backendHeaders }}
+      headers: {{- include "common.tplvalues.render" ( dict "value" . "context" $ ) | nindent 8 }}
+      {{- end }}
+    - name: frontend
+      route:
         - destination:
             host: {{ include "shuffle.frontend.name" . }}
             port:
               number: {{ .Values.frontend.containerPorts.http }}
+      {{- with .Values.istio.virtualService.frontendHeaders }}
+      headers: {{- include "common.tplvalues.render" ( dict "value" . "context" $ ) | nindent 8 }}
+      {{- end }}
     {{- end }}

charts/shuffle/values.schema.json

@@ -2366,6 +2366,12 @@
                                     "type": "string",
                                     "description": "The name of the secret that holds the TLS certs including the CA certificates.",
                                     "default": ""
+                                },
+                                "tlsCipherSuites": {
+                                    "type": "array",
+                                    "description": "If specified, only support the specified cipher list.",
+                                    "default": [],
+                                    "items": {}
                                 }
                             }
                         },
@@ -2384,6 +2390,16 @@
                             "type": "object",
                             "description": "Additional annotations for the VirtualService resource.",
                             "default": {}
+                        },
+                        "backendHeaders": {
+                            "type": "object",
+                            "description": "Header manipulation rules for backend traffic",
+                            "default": {}
+                        },
+                        "frontendHeaders": {
+                            "type": "object",
+                            "description": "Header manipulation rules for frontend traffic",
+                            "default": {}
                         }
                     }
                 }

charts/shuffle/values.yaml

@@ -1632,18 +1632,30 @@ istio:
       httpsRedirect: false
     ## @param istio.gateway.https.enabled Enable HTTPS server on port 443
     ## @param istio.gateway.https.tlsCredentialName The name of the secret that holds the TLS certs including the CA certificates.
+    ## @param istio.gateway.https.tlsCipherSuites If specified, only support the specified cipher list.
     ## NOTE: The secret must exist in the namespace of the istio gateway pod
+    ##
     https:
       enabled: false
       tlsCredentialName: ""
+      tlsCipherSuites: []
     ## @param istio.gateway.extraServers Additional servers for the Gateway resource
     ## ref: https://istio.io/latest/docs/reference/config/networking/gateway/#Server
+    ##
     extraServers: []
 
   virtualService:
     ## @param istio.virtualService.annotations Additional annotations for the VirtualService resource.
     ##
     annotations: {}
+    ## @param istio.virtualService.backendHeaders Header manipulation rules for backend traffic
+    ## ref: https://istio.io/latest/docs/reference/config/networking/virtual-service/#Headers
+    ##
+    backendHeaders: {}
+    ## @param istio.virtualService.frontendHeaders Header manipulation rules for frontend traffic
+    ## ref: https://istio.io/latest/docs/reference/config/networking/virtual-service/#Headers
+    ##
+    frontendHeaders: {}
 
 ## @section Persistence Parameters
 ##