Chapter 8. Service Discovery

Procedure

1. Create an OpenShift OAuth client for 3scale. For more details, see the OpenShift Authentication documentation. In the following example, replace <provide-a-client-secret> with a secret that you generate and replace <3scale-master-domain-route> with the URL to access the 3scale Master Admin Portal.

       $ oc project default
       $ cat <<-EOF | oc create -f -
       kind: OAuthClient
       apiVersion: v1
       metadata:
        name: 3scale
       secret: "<provide-a-client-secret>"
       redirectURIs:
        - "<3scale-master-domain-route>"
       grantMethod: prompt
       EOF

2. Open the 3scale Service Discovery settings file:

       $ oc project <3scale-project>
       $ oc edit configmap system

3. Configure the following settings:

       service_discovery.yml:
         production:
           enabled: true
           authentication_method: oauth
           oauth_server_type: builtin
           client_id: '3scale'
           client_secret: '<choose-a-client-secret>'

4. Ensure that users have proper permissions to view cluster projects containing discoverable services.

   To give an administrator user, represented by <user>, the view permission for the <namespace> project containing a service to be discovered, use this command:

   oc adm policy add-role-to-user view <user> -n <namespace>

5. After modifying configmap, you must redeploy the system-app and system-sidekiq pods to apply the changes.

   oc rollout latest dc/system-app
   oc rollout latest dc/system-sidekiq

6. Check the status of the rollout to ensure it has finished:

   oc rollout status dc/system-app
   oc rollout status dc/system-sidekiq

Procedure

1. Create an OAuth client for 3scale in Red Hat OAuth server (Keycloak).

   Note

   In the client configuration, verify that the username maps to preferred_username, so that OpenShift can link accounts.

2. Edit 3scale Service Discovery settings.

       $ oc project <3scale-project>
       $ oc edit configmap system

3. Verify that the following settings are configured, where `<the-client-secret-from-Keycloak> is the value that Keycloak generated automatically when you created the OAuth client.

       service_discovery.yml:
         production:
           enabled: true
           authentication_method: oauth
           oauth_server_type: rh_sso
           client_id: '3scale'
           client_secret: '<the-client-secret-from-Keycloak>'

4. Make sure that users have proper permissions to view cluster projects containing discoverable services.

   For example, to give <user> view permission for the <namespace> project, use this command:

   oc adm policy add-role-to-user view <user> -n <namespace>

5. After modifying configmap, you must redeploy the system-app and system-sidekiq pods to apply the changes.

Procedure

1. Verify that the 3scale project is the current project.

      $ oc project <3scale-project>

2. Open the 3scale Service Discovery settings in an editor.

      $ oc edit configmap system

3. Verify that the following settings are configured.

   service_discovery.yml:
      production:
         enabled: <%= cluster_token_file_exists = File.exists?(cluster_token_file_path = '/var/run/secrets/kubernetes.io/serviceaccount/token') %>
         bearer_token: "<%= File.read(cluster_token_file_path) if cluster_token_file_exists %>"
         authentication_method: service_account

4. Provide the 3scale deployment amp service account with the relevant permissions to view projects containing discoverable services by following one of these options:

   • Grant the 3scale deployment amp service account with view cluster level permission.

     oc adm policy add-cluster-role-to-user view system:serviceaccount:<3scale-project>:amp

   • Apply a more restrictive policy as described in OpenShift - Service Accounts.