Merge branch 'RESTAPI-1027-review-environment-var-docs' into 'master'

Review environment var docs See merge request firecrest/firecrest!285
eth-cscs · Apr 11, 2024 · b4008fb · b4008fb
2 parents 63dac78 + 066a8b2
commit b4008fb
Show file tree

Hide file tree

Showing 43 changed files with 833 additions and 633 deletions.
diff --git a/.vscode/launch.json b/.vscode/launch.json
@@ -17,7 +17,7 @@
                 "FLASK_DEBUG": "1",
                 "F7T_REALM_RSA_TYPE":"RS256",
                 "F7T_LOG_PATH":"${workspaceFolder}/logs/",
-                "F7T_PERSISTENCE_IP":"localhost",
+                "F7T_PERSIST_HOST":"localhost",
                 "F7T_PERSIST_PORT":"6379",
                 "F7T_PERSIST_PWD":"rediS2200",
                 "F7T_TASKS_PORT":"5003",

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -9,12 +9,28 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+### Changed
+
+- Environment variable names
+  - Added: `F7T_CERTIFICATOR_HOST`, `F7T_COMPUTE_HOST`, `F7T_RESERVATION_HOST`, `F7T_STATUS_HOST`, `F7T_STORAGE_HOST`, `F7T_TASKS_HOST`, `F7T_UTILITIES_HOST`
+  - Replaced
+    - `F7T_SYSTEMS_PUBLIC` by `F7T_SYSTEMS_PUBLIC_NAME`
+    - `F7T_USE_SSL` by `F7T_SSL_ENABLED`
+    - `F7T_POLICY_PATH` by `F7T_OPA_POLICY_PATH`
+    - `F7T_PERSISTENCE_IP` by `F7T_PERSIST_HOST`
+    - `F7T_SSH_CERTIFICATE_WRAPPER` by `F7T_SSH_CERTIFICATE_WRAPPER_ENABLED`
+    - `F7T_STATUS_SYSTEMS` by `F7T_SYSTEMS_INTERNAL_STATUS_ADDR`
+    - `F7T_SECRET_KEY` by `F7T_SWIFT_SECRET_KEY`
+    - `F7T_USE_SPANK_PLUGIN` by `F7T_SPANK_PLUGIN_ENABLED` 
+
+  - Removed: `F7T_CERTIFICATOR_URL`, `F7T_COMPUTE_URL`, `F7T_RESERVATION_URL`, `F7T_STATUS_URL`, `F7T_STORAGE_URL`, `F7T_TASKS_URL`, `F7T_UTILITIES_URL`, and `F7T_SWIFT_ACCOUNT` (it's using the same value than `F7T_OS_PROJECT_ID`)
+
+- On task response metadata, the `task_url` value is now relative to the `/tasks` endpoint
+
 - Add the endpoints `/compute/nodes` and `/compute/nodes/{nodeName}` to retrieve information about nodes in the scheduling queue.
 - Added endpoints `POST /utilities/compress`, `POST /utilities/extract`, `POST /storage/xfer-internal/compress` and `POST /storage/xfer-internal/extract` for file compression and extraction.
 - Added recurisive option to ls utilities command `&recursive=true`.
 
-### Changed
-
 ### Fixed
 
 - Fixed error on pipeline when releasing production version.

diff --git a/deploy/demo/common/common.env b/deploy/demo/common/common.env
@@ -12,8 +12,6 @@ F7T_REALM_RSA_PUBLIC_KEY='MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqB44q32bQp
 F7T_AUTH_TOKEN_ISSUER='http://localhost:8080/auth/realms/kcrealm'
 # specify Audience established by Keycloak, leave empty to skip verification
 F7T_AUTH_TOKEN_AUD=''
-# list authorized users, will be checked by cscs_api_common.py: get_username
-F7T_AUTH_ALLOWED_USERS=''
 # Keycloak scope for clients:
 F7T_AUTH_REQUIRED_SCOPE='firecrest'
 F7T_REALM_RSA_TYPE=RS256
@@ -26,7 +24,7 @@ F7T_DEBUG_MODE=True
 F7T_CERTIFICATOR_IP=192.168.220.11
 F7T_COMPUTE_IP=192.168.220.9
 #TaskPersistence (redis)
-F7T_PERSISTENCE_IP=192.168.220.13
+F7T_PERSIST_HOST=192.168.220.13
 F7T_STATUS_IP=192.168.220.4
 F7T_STORAGE_IP=192.168.220.5
 F7T_TASKS_IP=192.168.220.6
@@ -41,20 +39,17 @@ F7T_STORAGE_PORT=5002
 F7T_UTILITIES_PORT=5004
 F7T_RESERVATIONS_PORT=5005
 #-------
-# microservices urls: used by Kong and between microservices
-F7T_CERTIFICATOR_URL=https://192.168.220.11:5010
-F7T_COMPUTE_URL=https://192.168.220.9:5006
-F7T_STATUS_URL=https://192.168.220.4:5001
-F7T_STORAGE_URL=https://192.168.220.5:5002
-F7T_TASKS_URL=https://192.168.220.6:5003
-F7T_UTILITIES_URL=https://192.168.220.7:5004
-F7T_RESERVATIONS_URL=https://192.168.220.8:5005
-# kong_url: used by microservices when return URL to clients
-F7T_KONG_URL=http://192.168.220.10:8000
+F7T_CERTIFICATOR_HOST=192.168.220.11
+F7T_COMPUTE_HOST=192.168.220.9
+F7T_STATUS_HOST=192.168.220.4
+F7T_STORAGE_HOST=192.168.220.5
+F7T_TASKS_HOST=192.168.220.6
+F7T_UTILITIES_HOST=192.168.220.7
+F7T_RESERVATIONS_HOST=192.168.220.8
 #-------
 # list of systems
 #public name for systems, where users except to submit jobs and get files (list with ';')
-F7T_SYSTEMS_PUBLIC='cluster;cluster'
+F7T_SYSTEMS_PUBLIC_NAME='cluster;cluster'
 # List of filesystems mounted in each system
 #F7T_FILESYSTEMS="{'cluster01': [{'name':'PROJECT','path':'/project','description':'Project Filesystem'}, 
 #                                {'name':'STORE', 'path':'/store', 'description':'Long term filesystem'}, 
@@ -67,16 +62,18 @@ F7T_FILESYSTEMS="{
                                {'name':'SCRATCH', 'path':'/scratch', 'description':'Scratch filesystem'}] 
                  } "  
 #internal machines that microservices connect to (in correlation with SYSTEMS_PUBLIC)
-F7T_SYSTEMS_INTERNAL_COMPUTE='192.168.220.12:22;192.168.220.12:22'
-F7T_SYSTEMS_INTERNAL_STORAGE='192.168.220.12:22;192.168.220.12:22'
-F7T_SYSTEMS_INTERNAL_UTILITIES='192.168.220.12:22;192.168.220.12:22'
+F7T_SYSTEMS_INTERNAL_ADDR='192.168.220.12:22;192.168.220.12:22'
+#F7T_SYSTEMS_INTERNAL_STATUS_ADDR='192.168.220.12:22;192.168.220.12:22'
+#F7T_SYSTEMS_INTERNAL_COMPUTE_ADDR='192.168.220.12:22;192.168.220.12:22'
+#F7T_SYSTEMS_INTERNAL_STORAGE_ADDR='192.168.220.12:22;192.168.220.12:22'
+#F7T_SYSTEMS_INTERNAL_UTILITIES_ADDR='192.168.220.12:22;192.168.220.12:22'
 #-------
 # COMPUTE options
 # Base filesystem where job submission files will be stored.
 # ; separated for system
 F7T_COMPUTE_BASE_FS="/home;/home"
 # enables the use of a additional plugin in sbatch command
-F7T_USE_SPANK_PLUGIN="True;True"
+F7T_SPANK_PLUGIN_ENABLED="True;True"
 # value of the plugin
 F7T_SPANK_PLUGIN_OPTION=--nohome
 #-------
@@ -98,7 +95,7 @@ F7T_USE_SCHED_PROJECT=True
 #-------
 # STATUS: microservices & systems to pool:
 F7T_STATUS_SERVICES='certificator;utilities;compute;tasks;storage;reservations'
-F7T_STATUS_SYSTEMS='192.168.220.12:22;192.168.220.12:22'
+F7T_SYSTEMS_INTERNAL_STATUS_ADDR='192.168.220.12:22;192.168.220.12:22'
 #-------
 # UTILITIES: max size of file for download/upload from filesystem in MB
 F7T_UTILITIES_MAX_FILE_SIZE=5
@@ -108,22 +105,14 @@ F7T_UTILITIES_TIMEOUT=5
 F7T_RESERVATIONS_TIMEOUT=30
 #------
 # if enabled FirecREST sends a certificate as command, requires a serverside ssh ForceCommand wrapper
-F7T_SSH_CERTIFICATE_WRAPPER=True
-#------
-# KONG internal URLs for services
-F7T_KONG_COMPUTE_URL=http://192.168.220.9:5006
-F7T_KONG_STATUS_URL=http://192.168.220.4:5001
-F7T_KONG_STORAGE_URL=http://192.168.220.5:5002
-F7T_KONG_TASKS_URL=http://192.168.220.6:5003
-F7T_KONG_UTILITIES_URL=http://192.168.220.7:5004
-F7T_KONG_RESERVATIONS_URL=http://192.168.220.8:5005
+F7T_SSH_CERTIFICATE_WRAPPER_ENABLED=True
 #------
 # OPA Vars
-F7T_OPA_USE=True
+F7T_OPA_ENABLED=True
 F7T_OPA_URL=https://192.168.220.40:8181
-F7T_POLICY_PATH=v1/data/f7t/authz
+F7T_OPA_POLICY_PATH=v1/data/f7t/authz
 # SSL vars
-F7T_USE_SSL=True
+F7T_SSL_ENABLED=True
 F7T_SSL_CRT=/ssl/f7t_internal.crt
 F7T_SSL_KEY=/ssl/f7t_internal.key
 #-------

diff --git a/deploy/demo/docker-compose.yml b/deploy/demo/docker-compose.yml
@@ -194,24 +194,6 @@ services:
       - ./ssl:/ssl
       - ./logs/profs:/var/log/profs
 
-  # web client
-  client:
-    image: f7t-client
-    container_name: client
-    build:
-      context: ../../src/tests/template_client
-      dockerfile: ./Dockerfile
-      network: host
-    networks:
-      firecrest-internal:
-        ipv4_address: 192.168.220.30
-    ports:
-      - "7000:5000"
-    volumes:
-      - ./demo_client/config.py:/app/config.py:ro
-      - ./demo_client/client_secrets.json:/app/client_secrets.json:ro
-      - ./logs/client:/var/log:delegated
-
   # dummy cluster
   cluster:
     image: f7t-cluster
@@ -244,7 +226,7 @@ services:
       - ./logs/keycloak:/opt/jboss/keycloak/standalone/log/:delegated
 
   kong:
-    image: kong:3.6.0
+    image: kong:3.2
     container_name: kong
     environment:
       - KONG_DATABASE=off

diff --git a/deploy/demo/kong/kong.yml b/deploy/demo/kong/kong.yml
@@ -120,4 +120,3 @@ services:
     methods: [DELETE,GET,POST,PUT]
     paths:
     - /reservations
-
diff --git a/deploy/demo/source/kong/kong.yml.template b/deploy/demo/source/kong/kong.yml.template
@@ -29,35 +29,35 @@ routes:
 
 services:
 - name: compute
-  url: F7T_KONG_COMPUTE_URL
+  url: F7T_HTTP_SCHEMA://F7T_COMPUTE_HOST:F7T_COMPUTE_PORT
   routes:
   - name: compute
     methods: [DELETE,GET,POST]
     paths:
     - /compute/
 - name: status
-  url: F7T_KONG_STATUS_URL
+  url: F7T_HTTP_SCHEMA://F7T_STATUS_HOST:F7T_STATUS_PORT
   routes:
   - name: status
     methods: [GET]
     paths:
     - /status/
 - name: storage
-  url: F7T_KONG_STORAGE_URL
+  url: F7T_HTTP_SCHEMA://F7T_STORAGE_HOST:F7T_STORAGE_PORT
   routes:
   - name: storage
     methods: [GET,POST,PUT]
     paths:
     - /storage/
 - name: tasks
-  url: F7T_KONG_TASKS_URL
+  url: F7T_HTTP_SCHEMA://F7T_TASKS_HOST:F7T_TASKS_PORT
   routes:
   - name: tasks
     methods: [GET]
     paths:
     - /tasks/
 - name: utilities
-  url: F7T_KONG_UTILITIES_URL
+  url: F7T_HTTP_SCHEMA://F7T_UTILITIES_HOST:F7T_UTILITIES_PORT
   routes:
   - name: utilities
     methods: [DELETE,GET,POST,PUT]

diff --git a/deploy/demo/source/kong/update_kong_config.sh b/deploy/demo/source/kong/update_kong_config.sh
@@ -9,12 +9,26 @@
 # read common variables
 . ../../common/common.env
 
+F7T_HTTP_SCHEMA="http"
+
+if [ "${F7T_SSL_ENABLED}" == "True" ]; then
+    F7T_HTTP_SCHEMA="https"; 
+fi
+
+echo "F7T_HTTP_SCHEMA: $F7T_HTTP_SCHEMA"
+
 # use '#' to separate string because '/' and ':' are valid on URLs
 sed -e 's#F7T_AUTH_TOKEN_ISSUER#'${F7T_AUTH_TOKEN_ISSUER}'#' \
     -e 's#F7T_REALM_RSA_PUBLIC_KEY#'${F7T_REALM_RSA_PUBLIC_KEY}'#' \
-    -e 's#F7T_KONG_COMPUTE_URL#'${F7T_KONG_COMPUTE_URL}'#' \
-    -e 's#F7T_KONG_STATUS_URL#'${F7T_KONG_STATUS_URL}'#' \
-    -e 's#F7T_KONG_STORAGE_URL#'${F7T_KONG_STORAGE_URL}'#' \
-    -e 's#F7T_KONG_TASKS_URL#'${F7T_KONG_TASKS_URL}'#' \
-    -e 's#F7T_KONG_UTILITIES_URL#'${F7T_KONG_UTILITIES_URL}'#' \
-       < kong.yml.template > ../../kong/kong.yml
+    -e 's#F7T_COMPUTE_HOST#'${F7T_COMPUTE_HOST}'#' \
+    -e 's#F7T_COMPUTE_PORT#'${F7T_COMPUTE_PORT}'#' \
+    -e 's#F7T_STATUS_HOST#'${F7T_STATUS_HOST}'#' \
+    -e 's#F7T_STATUS_PORT#'${F7T_STATUS_PORT}'#' \
+    -e 's#F7T_STORAGE_HOST#'${F7T_STORAGE_HOST}'#' \
+    -e 's#F7T_STORAGE_PORT#'${F7T_STORAGE_PORT}'#' \
+    -e 's#F7T_TASKS_HOST#'${F7T_TASKS_HOST}'#' \
+    -e 's#F7T_TASKS_PORT#'${F7T_TASKS_PORT}'#' \
+    -e 's#F7T_UTILITIES_HOST#'${F7T_UTILITIES_HOST}'#' \
+    -e 's#F7T_UTILITIES_PORT#'${F7T_UTILITIES_PORT}'#' \
+    -e 's#F7T_HTTP_SCHEMA#'${F7T_HTTP_SCHEMA}'#' \
+       < kong.yml.template > ../../kong/kong.yml 
diff --git a/deploy/docker/status/Dockerfile b/deploy/docker/status/Dockerfile
@@ -15,7 +15,7 @@ RUN pip3 install -r deps/requirements.txt
 ADD src/status/status.py status.py
 ADD src/common/cscs_api_common.py cscs_api_common.py
 
-ENV F7T_STATUS_PORT 5000
+ENV F7T_STATUS_PORT 5001
 ENV F7T_LOG_PATH /var/log
 ENV F7T_SSL_CRT /ssl/f7t_internal.crt
 ENV F7T_SSL_KEY /ssl/f7t_internal.key

diff --git a/deploy/k8s/certificator/templates/cm.certificator.yaml b/deploy/k8s/certificator/templates/cm.certificator.yaml
@@ -2,8 +2,8 @@ apiVersion: v1
 data:
   F7T_CERTIFICATOR_PORT: "{{ .Values.F7T_CERTIFICATOR_PORT }}"
   F7T_OPA_URL: "{{ .Values.F7T_OPA_URL }}"
-  F7T_OPA_USE: "{{ .Values.F7T_OPA_USE }}"
-  F7T_POLICY_PATH: "{{ .Values.F7T_POLICY_PATH }}"
+  F7T_OPA_ENABLED: "{{ .Values.F7T_OPA_ENABLED }}"
+  F7T_OPA_POLICY_PATH: "{{ .Values.F7T_OPA_POLICY_PATH }}"
   F7T_CA_KEY_PATH: "{{ .Values.F7T_CA_KEY_PATH }}"
   F7T_PUB_USER_KEY_PATH: "{{ .Values.F7T_PUB_USER_KEY_PATH }}"
 kind: ConfigMap

diff --git a/deploy/k8s/compute/templates/cm.compute.yaml b/deploy/k8s/compute/templates/cm.compute.yaml
@@ -3,7 +3,7 @@ data:
   F7T_COMPUTE_BASE_FS: "{{ .Values.F7T_COMPUTE_BASE_FS }}"
   F7T_COMPUTE_PORT: "{{ .Values.F7T_COMPUTE_PORT }}"
   F7T_SPANK_PLUGIN_OPTION: "{{ .Values.F7T_SPANK_PLUGIN_OPTION }}"
-  F7T_USE_SPANK_PLUGIN: "{{ .Values.F7T_USE_SPANK_PLUGIN }}"
+  F7T_SPANK_PLUGIN_ENABLED: "{{ .Values.F7T_SPANK_PLUGIN_ENABLED }}"
 kind: ConfigMap
 metadata:
   name: compute-env-file

diff --git a/deploy/k8s/config/templates/cm.common.yaml b/deploy/k8s/config/templates/cm.common.yaml
@@ -6,28 +6,37 @@ data:
   F7T_AUTH_ROLE: "{{ .Values.F7T_AUTH_ROLE }}"
   F7T_AUTH_TOKEN_AUD: "{{ .Values.F7T_AUTH_TOKEN_AUD }}"
   F7T_GATEWAY_URL: "{{ .Values.global.F7T_GATEWAY_HOST }}:{{ .Values.global.F7T_GATEWAY_PORT }}"
-  F7T_CERTIFICATOR_URL: "{{ .Values.global.F7T_CERTIFICATOR_HOST }}:{{ .Values.global.F7T_CERTIFICATOR_PORT }}"
-  F7T_COMPUTE_URL: "{{ .Values.global.F7T_COMPUTE_HOST }}:{{ .Values.global.F7T_COMPUTE_PORT }}"
-  F7T_STATUS_URL: "{{ .Values.global.F7T_STATUS_HOST }}:{{ .Values.global.F7T_STATUS_PORT }}"
-  F7T_STORAGE_URL: "{{ .Values.global.F7T_STORAGE_HOST }}:{{ .Values.global.F7T_STORAGE_PORT }}"
-  F7T_TASKS_URL: "{{ .Values.global.F7T_TASKS_HOST }}:{{ .Values.global.F7T_TASKS_PORT }}"
-  F7T_UTILITIES_URL: "{{ .Values.global.F7T_UTILITIES_HOST }}:{{ .Values.global.F7T_UTILITIES_PORT }}"
-  F7T_RESERVATIONS_URL: "{{ .Values.F7T_RESERVATIONS_URL }}"
+  F7T_CERTIFICATOR_HOST: "{{ .Values.global.F7T_CERTIFICATOR_HOST }}"
+  F7T_CERTIFICATOR_PORT: "{{ .Values.global.F7T_CERTIFICATOR_PORT }}"
+  F7T_COMPUTE_HOST: "{{ .Values.global.F7T_COMPUTE_HOST }}"
+  F7T_COMPUTE_PORT: "{{ .Values.global.F7T_COMPUTE_PORT }}"
+  F7T_RESERVATIONS_HOST: "{{ .Values.F7T_RESERVATIONS_HOST }}"
+  F7T_RESERVATIONS_PORT: "{{ .Values.F7T_RESERVATIONS_PORT }}"
+  F7T_STATUS_HOST: "{{ .Values.global.F7T_STATUS_HOST }}"
+  F7T_STATUS_PORT: "{{ .Values.global.F7T_STATUS_PORT }}"
+  F7T_STORAGE_HOST: "{{ .Values.global.F7T_STORAGE_HOST }}" 
+  F7T_STORAGE_PORT: "{{ .Values.global.F7T_STORAGE_PORT }}"
+  F7T_TASKS_HOST: "{{ .Values.global.F7T_TASKS_HOST }}"
+  F7T_TASKS_PORT: "{{ .Values.global.F7T_TASKS_PORT }}"
+  F7T_UTILITIES_HOST: "{{ .Values.global.F7T_UTILITIES_HOST }}"
+  F7T_UTILITIES_PORT: "{{ .Values.global.F7T_UTILITIES_PORT }}"
   F7T_FILESYSTEMS: "{{ .Values.F7T_FILESYSTEMS }}"
   F7T_GUNICORN_SSL: "{{ .Values.F7T_GUNICORN_SSL }}"
   F7T_JAEGER_AGENT: "{{ .Values.F7T_JAEGER_AGENT }}"
-  F7T_KONG_URL: "{{ .Values.F7T_KONG_URL }}"  
   F7T_LOG_TYPE: "stdout"
   F7T_GUNICORN_LOG: ""
   F7T_OBJECT_STORAGE: "{{ .Values.F7T_OBJECT_STORAGE }}"
   F7T_REALM_RSA_PUBLIC_KEY: '{{ include "list.listPubKeys" . }}'
   F7T_REALM_RSA_TYPE: '{{ include "list.listPubKeyTypes" . }}'
-  F7T_SSH_CERTIFICATE_WRAPPER: "{{ .Values.F7T_SSH_CERTIFICATE_WRAPPER }}"
+  F7T_SSH_CERTIFICATE_WRAPPER_ENABLED: "{{ .Values.F7T_SSH_CERTIFICATE_WRAPPER_ENABLED }}"
+  F7T_SSL_ENABLED: "{{ .Values.F7T_SSL_ENABLED }}"
   F7T_SSL_CRT: "{{ .Values.F7T_SSL_CRT }}"
   F7T_SSL_KEY: "{{ .Values.F7T_SSL_KEY }}"
-  F7T_SYSTEMS_INTERNAL_COMPUTE: "{{ .Values.F7T_SYSTEMS_INTERNAL_COMPUTE }}"
-  F7T_SYSTEMS_INTERNAL_UTILITIES: "{{ .Values.F7T_SYSTEMS_INTERNAL_UTILITIES }}"
-  F7T_SYSTEMS_PUBLIC: "{{ .Values.F7T_SYSTEMS_PUBLIC }}"
+  F7T_SYSTEMS_INTERNAL_ADDR: "{{ .Values.F7T_SYSTEMS_INTERNAL_ADDR }}"
+  F7T_SYSTEMS_INTERNAL_STATUS_ADDR: "{{ .Values.F7T_SYSTEMS_INTERNAL_STATUS_ADDR }}"
+  F7T_SYSTEMS_INTERNAL_COMPUTE_ADDR: "{{ .Values.F7T_SYSTEMS_INTERNAL_COMPUTE_ADDR }}"
+  F7T_SYSTEMS_INTERNAL_UTILITIES_ADDR: "{{ .Values.F7T_SYSTEMS_INTERNAL_UTILITIES_ADDR }}"
+  F7T_SYSTEMS_PUBLIC_NAME: "{{ .Values.F7T_SYSTEMS_PUBLIC_NAME }}"
   F7T_UTILITIES_MAX_FILE_SIZE: "{{ .Values.F7T_UTILITIES_MAX_FILE_SIZE }}"
   F7T_UTILITIES_TIMEOUT: "{{ .Values.F7T_UTILITIES_TIMEOUT }}"  
 kind: ConfigMap

diff --git a/deploy/k8s/kong/templates/cm.kong.yaml b/deploy/k8s/kong/templates/cm.kong.yaml
@@ -67,7 +67,7 @@ items:
         - /tasks/tasklist
       services:
       - name: compute
-        url: "{{ .Values.global.F7T_COMPUTE_HOST }}:{{ .Values.global.F7T_COMPUTE_PORT }}"
+        url: "{{if .Values.F7T_SSL_ENABLED}}https{{else}}http{{end}}://{{ .Values.global.F7T_COMPUTE_HOST }}:{{ .Values.global.F7T_COMPUTE_PORT }}"
         routes:
         - name: compute
           methods: [DELETE,GET,POST]
@@ -86,36 +86,36 @@ items:
             config:
               anonymous: docs
       - name: status
-        url: "{{ .Values.global.F7T_STATUS_HOST }}:{{ .Values.global.F7T_STATUS_PORT }}"
+        url: "{{if .Values.F7T_SSL_ENABLED}}https{{else}}http{{end}}://{{ .Values.global.F7T_STATUS_HOST }}:{{ .Values.global.F7T_STATUS_PORT }}"
         routes:
         - name: status
           methods: [GET]
           paths:
           - /status/
       - name: storage
-        url: "{{ .Values.global.F7T_STORAGE_HOST }}:{{ .Values.global.F7T_STORAGE_PORT }}"
+        url: "{{if .Values.F7T_SSL_ENABLED}}https{{else}}http{{end}}://{{ .Values.global.F7T_STORAGE_HOST }}:{{ .Values.global.F7T_STORAGE_PORT }}"
         routes:
         - name: storage
           methods: [GET,POST]
           paths:
           - /storage/
       - name: tasks
-        url: "{{ .Values.global.F7T_TASKS_HOST }}:{{ .Values.global.F7T_TASKS_PORT }}"
+        url: "{{if .Values.F7T_SSL_ENABLED}}https{{else}}http{{end}}://{{ .Values.global.F7T_TASKS_HOST }}:{{ .Values.global.F7T_TASKS_PORT }}"
         routes:
         - name: tasks
           methods: [GET]
           paths:
           - /tasks
       - name: utilities
-        url: "{{ .Values.global.F7T_UTILITIES_HOST }}:{{ .Values.global.F7T_UTILITIES_PORT }}"
+        url: "{{if .Values.F7T_SSL_ENABLED}}https{{else}}http{{end}}://{{ .Values.global.F7T_UTILITIES_HOST }}:{{ .Values.global.F7T_UTILITIES_PORT }}"
         routes:
         - name: utilities
           methods: [DELETE,GET,POST,PUT]
           paths:
           - /utilities/
       {{ if .Values.global.include_reservations }}
       - name: reservations
-        url: "{{ .Values.global.F7T_RESERVATIONS_HOST }}:{{ .Values.global.F7T_RESERVATIONS_PORT }}"
+        url: "{{if .Values.F7T_SSL_ENABLED}}https{{else}}http{{end}}://{{ .Values.global.F7T_RESERVATIONS_HOST }}:{{ .Values.global.F7T_RESERVATIONS_PORT }}"
         routes:
         - name: reservations
           methods: [DELETE,GET,POST,PUT]

diff --git a/deploy/k8s/kong/templates/deploy.kong.yaml b/deploy/k8s/kong/templates/deploy.kong.yaml
@@ -19,7 +19,7 @@ spec:
         role: gateway
     spec:
       containers:
-      - image: kong:3.6.0
+      - image: kong:3.2
         env:
         - name: KONG_DECLARATIVE_CONFIG
           value: /kong/kong.yaml