Chapter 4. Connectivity Link application developer workflow

Procedure

1. Create the namespace for your application as follows, if it does not already exist:

   kubectl create ns ${devNS}

2. Deploy the toystore application to your developer namespace as follows, if it has not already been deployed:

   kubectl apply -f https://raw.githubusercontent.com/Kuadrant/Kuadrant-operator/main/examples/toystore/toystore.yaml -n ${devNS}

Procedure

1. Enter the following command to define an HTTP route for your Toystore application API:

   kubectl apply -f - <<EOF
   apiVersion: gateway.networking.k8s.io/v1
   kind: HTTPRoute
   metadata:
     name: toystore
     labels:
       deployment: toystore
       service: toystore
   spec:
     parentRefs:
     - name: ${gatewayName}
       namespace: ${gatewayNS}
     hostnames:
     - "api.${rootDomain}"
     rules:
     - matches:
       - method: GET
         path:
           type: PathPrefix
           value: "/cars"
       - method: GET
         path:
           type: PathPrefix
           value: "/dolls"
       backendRefs:
       - name: toystore
         port: 80
     - matches:
       - path:
           type: PathPrefix
           value: "/admin"
       backendRefs:
       - name: toystore
         port: 80
   EOF

   With this HTTPRoute in place, the service that you deployed is now exposed by the Gateway.

2. You can access your API endpoint over HTTPS as follows:

   export INGRESS_HOST=$(kubectl get gtw ${gatewayName} -o jsonpath='{.status.addresses[0].value}' -n api-gateway)
   
   curl --resolve api.${rootDomain}:443:${INGRESS_HOST} "https://api.${rootDomain}/cars"

Procedure

1. Define API keys for bob and alice users as follows:

   kubectl apply -f - <<EOF
   apiVersion: v1
   kind: Secret
   metadata:
     name: bob-key
     labels:
       authorino.kuadrant.io/managed-by: authorino
       app: toystore
     annotations:
       secret.kuadrant.io/user-id: bob
   stringData:
     api_key: IAMBOB
   type: Opaque
   ---
   apiVersion: v1
   kind: Secret
   metadata:
     name: alice-key
     labels:
       authorino.kuadrant.io/managed-by: authorino
       app: toystore
     annotations:
       secret.kuadrant.io/user-id: alice
   stringData:
     api_key: IAMALICE
   type: Opaque
   EOF

2. Override the AuthPolicy to start accepting the API keys as follows:

   kubectl apply -f - <<EOF
   apiVersion: kuadrant.io/v1
   kind: AuthPolicy
   metadata:
     name: toystore
   spec:
     targetRef:
       group: gateway.networking.k8s.io
       kind: HTTPRoute
       name: toystore
     rules:
       authentication:
         "api-key-users":
           apiKey:
             selector:
               matchLabels:
                 app: toystore
           credentials:
             authorizationHeader:
               prefix: APIKEY
       response:
         success:
           filters:
             "identity":
               json:
                 properties:
                   "userid":
                     selector: auth.identity.metadata.annotations.secret\.kuadrant\.io/user-id
   EOF

Procedure

1. Enter the following command to set rate limits for specific users:

   kubectl apply -f - <<EOF
   apiVersion: kuadrant.io/v1
   kind: RateLimitPolicy
   metadata:
     name: toystore
   spec:
     targetRef:
       group: gateway.networking.k8s.io
       kind: HTTPRoute
       name: toystore
     limits:
       "general-user":
         rates:
         - limit: 1
           duration: 3
           unit: second
         counters:
         - metadata.filter_metadata.envoy\.filters\.http\.ext_authz.identity.userid
         when:
         - selector: metadata.filter_metadata.envoy\.filters\.http\.ext_authz.identity.userid
           operator: neq
           value: bob
       "bob-limit":
         rates:
         - limit: 2
           duration: 3
           unit: second
         when:
         - selector: metadata.filter_metadata.envoy\.filters\.http\.ext_authz.identity.userid
           operator: eq
           value: bob
   EOF

   Note

   It might take a few minutes for the RateLimitPolicy to be applied, depending on your cluster.

   As another example, you could give bob twice as many requests to use compared to all other users.

2. To test your new setup, send requests as alice as follows:

   while :; do curl --resolve api.${rootDomain}:443:${INGRESS_HOST} --write-out '%{http_code}\n' --silent --output /dev/null -H 'Authorization: APIKEY IAMALICE' "https://api.${rootDomain}/cars" | grep -E --color "\b(429)\b|$"; sleep 1; done

3. Send requests as bob as follows:

   while :; do curl --resolve api.${rootDomain}:443:${INGRESS_HOST} --write-out '%{http_code}\n' --silent --output /dev/null -H 'Authorization: APIKEY IAMBOB' "https://api.${rootDomain}/cars" | grep -E --color "\b(429)\b|$"; sleep 1; done

   Note

   If you set up a DNS provider and configured a DNSPolicy as described in the platform engineer workflow, you can omit the --resolve api.${rootDomain}:443:${INGRESS_HOST} flag. For example, for alice as follows:

   while :; do curl --write-out '%{http_code}\n' --silent --output /dev/null -H 'Authorization: APIKEY IAMALICE' "https://api.${rootDomain}/cars" | grep -E --color "\b(429)\b|$"; sleep 1; done

   Note

   If you followed through this guide on more than one cluster, the DNS record for the HTTPRoute hostname will have multiple IP addresses. This means that requests will be made in a round-robin pattern across clusters because your DNS provider sends different responses to lookups.