Red Hat Summit Red Hat Summitサポートコンソール開発者トライアルの開始お問い合わせ

このコンテンツは選択した言語では利用できません。

Chapter 2. Configuring Red Hat Integration products for API development and deployment

Your OpenShift Container Platform (OCP) on premise administrator must deploy Fuse Online and 3scale API Management on the same cluster.

In addition, the following configurations are required:

  • For Fuse Online, the default behavior is that APIs are not exposed for automatic discovery in 3scale. You must enable discovery for the OpenShift project in which you install Fuse Online.
  • A 3scale API Management administrator must configure 3scale for service discovery. For example, the administrator must ensure that users have proper permissions to view cluster projects that contain discoverable services.

2.1. Configuring Fuse Online to enable 3scale discovery of APIs
リンクのコピー

If you create an API provider integration, you might want to enable discovery of the API for that integration in Red Hat 3scale. The default behavior is that APIs are not exposed for automatic discovery in 3scale.

For Fuse Online environments that are installed on OCP, you can enable 3scale discovery of APIs by updating the Fuse Online syndesis custom resource. Your update must provide a URL for a 3scale user interface, which turns on 3scale service discovery. When you enable discovery, it applies to only the OpenShift project that you are connected to when you update the resource.

Turning on 3scale service discovery means that:

  • The default behavior is that 3scale publishes API provider integrations. When 3scale publishes an API provider integration:

    • Fuse Online does not provide an external URL for an API provider integration that is running.
    • The API is accessible only through 3scale. Configuration in 3scale is required to expose the endpoint. For details, see Red Hat 3scale API Management, Service Discovery.
  • The creator of an API provider integration can disable 3scale discovery for that integration. In other words, each API provider integration creator can choose whether that integration’s API is discoverable.

Prerequisites

  • Fuse Online is installed on OCP on-site.
  • The oc client tool is installed and it is connected to the OCP cluster in which Fuse Online is installed.
  • You have permission to install Fuse Online in the project for which you want to enable discovery of APIs.

Procedure

  1. Log in to OpenShift with an account that has permission to install Fuse Online. For example: 

    $ oc login -u developer -p developer
    Copy to Clipboard Toggle word wrap

  2. Switch to an OpenShift project in which Fuse Online is running. You are enabling discovery for only this project. For example: 

    $ oc project my-fuse-online-project
    Copy to Clipboard Toggle word wrap

  3. Invoke the oc patch command on the syndesis custom resource and provide the URL for the 3scale user interface. In the following sample command, replace 3scale-url-here with the actual URL for your 3scale user interface: 

    oc patch syndesis app --type='merge' -p '{"spec":{"components":{"server":{"features":{"managementUrlFor3scale":"3scale-url-here"}}}}}'
    Copy to Clipboard Toggle word wrap

Results

The oc patch command updates the syndesis custom resource. The update sets the OPENSHIFT_MANAGEMENT_URL_FOR3SCALE environment variable to the specified URL for the 3scale user interface. This change to the syndesis custom resource triggers the syndesis-operator, which is responsible for installing Fuse Online, to redeploy syndesis-server. In the OpenShift project that you switched to, the new default behavior is that APIs are exposed for discovery in 3scale.

Do not edit the syndesis-server DeploymentConfig object to set the OPENSHIFT_MANAGEMENT_URL_FOR3SCALE environment variable. This does not work because the syndesis-operator reverts your change. The syndesis-operator ensures that Fuse Online is deployed only and always according to the syndesis custom resource.

2.2. Configuring Service Discovery
リンクのコピー

As a 3scale administrator, you can configure Service Discovery with or without Red Hat Single Sign-On (RH SSO).

Prerequisites

  • You must deploy 3scale 1.0 to an OpenShift cluster (version 3.11 or later).
  • To deploy 3scale to OpenShift, you need to use 3scale-amp-openshift-templates.
  • 3scale users that want to use Service Discovery in 3scale must have access to the OpenShift cluster.

2.2.1. Configuring with RH SSO
リンクのコピー

Configuration of 3scale Service Discovery with Red Hat Single Sign-On (RH SSO) causes the following behavior when a 3scale user signs in to 3scale:

  • The user is redirected to the OAuth Server.
  • If the user is not already logged in to the OAuth Server, the user is prompted to log in.
  • If it is the first time that the user implements 3scale Service Discovery with SSO, the OAuth server prompts for authorization to perform the relevant actions.
  • The user is redirected back to 3scale.

To configure Service Discovery with RH SSO, you have the following options:

2.2.1.1. Using OpenShift OAuth server
リンクのコピー

As a 3scale system administrator, you can allow users to individually authenticate and authorize 3scale to discover APIs by using OpenShift built-in OAuth server.

  1. Create an OpenShift OAuth client for 3scale. For more details about OpenShift authentication, see OAuth Clients. 

        $ oc project default
    $ cat <<-EOF | oc create -f -
    kind: OAuthClient
    apiVersion: v1
    metadata:
     name: 3scale
    secret: "<choose-a-client-secret>"
    redirectURIs:
     - "<3scale-master-domain-route>"
    grantMethod: prompt
    EOF
    Copy to Clipboard Toggle word wrap

  2. Open the 3scale Service Discovery settings file: 

        $ oc project <3scale-project>
    $ oc edit configmap system
    Copy to Clipboard Toggle word wrap

  3. Configure the following settings: 

        service_discovery.yml:
      production:
        enabled: true
        authentication_method: oauth
        oauth_server_type: builtin
        client_id: '3scale'
        client_secret: '<choose-a-client-secret>'
    Copy to Clipboard Toggle word wrap

  4. Ensure that users have proper permissions to view cluster projects containing discoverable services.

    For example, to give <user> view permission for the <namespace> project, use this command: 

    oc adm policy add-role-to-user view <user> -n <namespace>
    Copy to Clipboard Toggle word wrap

  5. After modifying configmap, you need to redeploy the system-app and system-sidekiq pods to apply the changes. 

    oc rollout latest dc/system-app
oc rollout latest dc/system-sidekiq
    Copy to Clipboard Toggle word wrap

Additional note

By default, OpenShift OAuth session tokens expire after 24 hours, as indicated in OpenShift Token Options.

2.2.1.2. Using RH SSO server (Keycloak)
リンクのコピー

As a system administrator, you can allow users to individually authenticate and authorize 3scale to discover services using Red Hat SSO for OpenShift.

  1. Create an OAuth client for 3scale in Red Hat OAuth server (Keycloak). 

    IMPORTANT: In the client configuration, verify that the user's username maps to `preferred_username`, so that OpenShift can link accounts.
    Copy to Clipboard Toggle word wrap

  2. Edit 3scale Service Discovery settings. 

        $ oc project <3scale-project>
    $ oc edit configmap system
    Copy to Clipboard Toggle word wrap

  3. Verify that these settings are configured. 

        service_discovery.yml:
      production:
        enabled: true
        authentication_method: oauth
        oauth_server_type: rh_sso
        client_id: '3scale'
        client_secret: '<choose-a-client-secret>'
    Copy to Clipboard Toggle word wrap

  4. Make sure users have proper permissions to view cluster projects containing discoverable services.

    For example, to give <user> view permission for the <namespace> project, use this command: 

    oc adm policy add-role-to-user view <user> -n <namespace>
    Copy to Clipboard Toggle word wrap
  5. After modifying configmap, you need to redeploy the system-app and system-sidekiq pods to apply the changes.

Additional note:

  • Token lifespan: By default, session tokens expire after one minute, as indicated in Keycloak - Session and Token Timeouts. However, it is recommended to set the timeout to an acceptable value of one day.

2.2.2. Configuring without RH SSO
リンクのコピー

To configure the 3scale Service Discovery without SSO, you can use 3scale Single Service Account to authenticate to OpenShift API service. 3scale Single Service Account provides a seamless authentication to the cluster for the Service Discovery without an authorization layer at the user level. All 3scale tenant administration users have the same access level to the cluster while discovering API services through 3scale.

  1. Verify that the 3scale project is the current project. 

       $ oc project <3scale-project>
    Copy to Clipboard Toggle word wrap

  2. Open the 3scale Service Discovery settings in an editor. 

       $ oc edit configmap system
    Copy to Clipboard Toggle word wrap

  3. Verify that the following settings are configured. 

    service_discovery.yml:
   production:
      enabled: <%= cluster_token_file_exists = File.exists?(cluster_token_file_path = '/var/run/secrets/kubernetes.io/serviceaccount/token') %>
      bearer_token: "<%= File.read(cluster_token_file_path) if cluster_token_file_exists %>"
      authentication_method: service_account
    Copy to Clipboard Toggle word wrap

  4. Provide the 3scale deployment amp service account with the relevant permissions to view projects containing discoverable services by following one of these options:

    • Grant the 3scale deployment amp service account with view cluster level permission. 

      oc adm policy add-cluster-role-to-user view system:serviceaccount:<3scale-project>:amp
      Copy to Clipboard Toggle word wrap
    • Apply a more restrictive policy as described in OpenShift - Service Accounts.
トップに戻る
Red Hat logoGithubredditYoutubeTwitter

詳細情報

試用、購入および販売

コミュニティー

Red Hat ドキュメントについて

Red Hat をお使いのお客様が、信頼できるコンテンツが含まれている製品やサービスを活用することで、イノベーションを行い、目標を達成できるようにします。 最新の更新を見る.

多様性を受け入れるオープンソースの強化

Red Hat では、コード、ドキュメント、Web プロパティーにおける配慮に欠ける用語の置き換えに取り組んでいます。このような変更は、段階的に実施される予定です。詳細情報: Red Hat ブログ.

会社概要

Red Hat は、企業がコアとなるデータセンターからネットワークエッジに至るまで、各種プラットフォームや環境全体で作業を簡素化できるように、強化されたソリューションを提供しています。

Theme

© 2025 Red Hat