Chapter 1. Configuring and deploying gateway policies

Procedure

1. Optional: Set the following environment variables:

   export KUADRANT_GATEWAY_NS=api-gateway
   export KUADRANT_GATEWAY_NAME=external
   export KUADRANT_DEVELOPER_NS=toystore
   export KUADRANT_AWS_ACCESS_KEY_ID=xxxx
   export KUADRANT_AWS_SECRET_ACCESS_KEY=xxxx
   export KUADRANT_AWS_DNS_PUBLIC_ZONE_ID=xxxx
   export KUADRANT_ZONE_ROOT_DOMAIN=example.com
   export KUADRANT_CLUSTER_ISSUER_NAME=self-signed

   Copy to Clipboard Toggle word wrap

   These environment variables are described as follows:

   • KUADRANT_GATEWAY_NS: Namespace for your example gateway in OpenShift Container Platform.
   • KUADRANT_GATEWAY_NAME: Name of your example gateway in OpenShift Container Platform.
   • KUADRANT_DEVELOPER_NS: Namespace for the example Toystore app in OpenShift Container Platform.
   • KUADRANT_AWS_ACCESS_KEY_ID: AWS key ID with access to manage your DNS zone.
   • KUADRANT_AWS_SECRET_ACCESS_KEY: AWS secret access key with permissions to manage your DNS zone.
   • KUADRANT_AWS_DNS_PUBLIC_ZONE_ID: AWS Route 53 zone ID for the Gateway. This is the ID of the hosted zone that is displayed in the AWS Route 53 console.
   • KUADRANT_ZONE_ROOT_DOMAIN: Root domain in AWS Route 53 associated with your DNS zone ID.

   • KUADRANT_CLUSTER_ISSUER_NAME: Name of the certificate authority or issuer TLS certificates.

     Note

     If you know your environment variable values, you can set up the required YAML files to suit your environment.

2. Create the namespace for the Toystore app as follows:

   $ kubectl create ns ${KUADRANT_DEVELOPER_NS}

   Copy to Clipboard Toggle word wrap

3. Deploy the Toystore app to the developer namespace:

   $ kubectl apply -f https://raw.githubusercontent.com/Kuadrant/Kuadrant-operator/main/examples/toystore/toystore.yaml -n ${KUADRANT_DEVELOPER_NS}

   Copy to Clipboard Toggle word wrap

Procedure

1. Create the namespace that the Gateway will be deployed in as follows:

   kubectl create ns ${KUADRANT_GATEWAY_NS}

   Copy to Clipboard Toggle word wrap

2. Create the secret credentials in the same namespace as the Gateway as follows:

   $ kubectl -n ${KUADRANT_GATEWAY_NS} create secret generic aws-credentials \
     --type=kuadrant.io/aws \
     --from-literal=AWS_ACCESS_KEY_ID=$KUADRANT_AWS_ACCESS_KEY_ID \
     --from-literal=AWS_SECRET_ACCESS_KEY=$KUADRANT_AWS_SECRET_ACCESS_KEY

   Copy to Clipboard Toggle word wrap

3. Before adding a TLS certificate issuer, create the secret credentials in the cert-manager namespace as follows:

   $ kubectl -n cert-manager create secret generic aws-credentials \
     --type=kuadrant.io/aws \
     --from-literal=AWS_ACCESS_KEY_ID=$KUADRANT_AWS_ACCESS_KEY_ID \
     --from-literal=AWS_SECRET_ACCESS_KEY=$KUADRANT_AWS_SECRET_ACCESS_KEY

   Copy to Clipboard Toggle word wrap

Procedure

1. Enter the following command to define a TLS certificate issuer:

   $ kubectl apply -f - <<EOF
   apiVersion: cert-manager.io/v1
   kind: ClusterIssuer
   metadata:
     name: ${KUADRANT_CLUSTER_ISSUER_NAME}
   spec:
     selfSigned: {}
   EOF

   Copy to Clipboard Toggle word wrap

2. Wait for the ClusterIssuer to become ready as follows:

   $ kubectl wait clusterissuer/${KUADRANT_CLUSTER_ISSUER_NAME} --for=condition=ready=true

   Copy to Clipboard Toggle word wrap

Procedure

1. Enter the following command to create the Gateway:

   $ kubectl apply -f - <<EOF
   apiVersion: gateway.networking.k8s.io/v1
   kind: Gateway
   metadata:
     name: ${KUADRANT_GATEWAY_NAME}
     namespace: ${KUADRANT_GATEWAY_NS}
     labels:
       kuadrant.io/gateway: "true"
   spec:
       gatewayClassName: istio
       listeners:
       - allowedRoutes:
           namespaces:
             from: All
         hostname: "api.${KUADRANT_ZONE_ROOT_DOMAIN}"
         name: api
         port: 443
         protocol: HTTPS
         tls:
           certificateRefs:
           - group: ""
             kind: Secret
             name: api-${KUADRANT_GATEWAY_NAME}-tls
           mode: Terminate
   EOF

   Copy to Clipboard Toggle word wrap

2. Check the status of your Gateway as follows:

   kubectl get gateway ${KUADRANT_GATEWAY_NAME} -n ${KUADRANT_GATEWAY_NS} -o=jsonpath='{.status.conditions[?(@.type=="Accepted")].message}{"\n"}{.status.conditions[?(@.type=="Programmed")].message}'

   Copy to Clipboard Toggle word wrap

   Your Gateway should be Accepted and Programmed, which means that it is valid and assigned an external address.

3. Check the status of your HTTPS listener as follows:

   $ kubectl get gateway ${KUADRANT_GATEWAY_NAME} -n ${KUADRANT_GATEWAY_NS} -o=jsonpath='{.status.listeners[0].conditions[?(@.type=="Programmed")].message}'

   Copy to Clipboard Toggle word wrap

   You will see that the HTTPS listener is not yet programmed or ready to accept traffic due to bad TLS configuration. Connectivity Link can help with this by using a TLSPolicy, which is described in the next step.

Procedure

1. Set the TLSPolicy for your Gateway as follows:

   $ kubectl apply -f - <<EOF
   apiVersion: kuadrant.io/v1
   kind: TLSPolicy
   metadata:
     name: ${KUADRANT_GATEWAY_NAME}-tls
     namespace: ${KUADRANT_GATEWAY_NS}
   spec:
     targetRef:
       name: ${KUADRANT_GATEWAY_NAME}
       group: gateway.networking.k8s.io
       kind: Gateway
     issuerRef:
       group: cert-manager.io
       kind: ClusterIssuer
       name: ${KUADRANT_CLUSTER_ISSUER_NAME}
   EOF

   Copy to Clipboard Toggle word wrap

2. Check that your TLS policy has an Accepted and Enforced status as follows:

   $ kubectl get tlspolicy ${KUADRANT_GATEWAY_NAME}-tls -n ${KUADRANT_GATEWAY_NS} -o=jsonpath='{.status.conditions[?(@.type=="Accepted")].message}{"\n"}{.status.conditions[?(@.type=="Enforced")].message}'

   Copy to Clipboard Toggle word wrap

   This may take a few minutes depending on the TLS provider, for example, Let’s Encrypt.

Procedure

1. Ensure that your Connectivity Link system namespace is set correctly as follows:

   $ export KUADRANT_SYSTEM_NS=$(kubectl get kuadrant -A -o jsonpath="{.items[0].metadata.namespace}")

   Copy to Clipboard Toggle word wrap

2. Define API keys for bob and alice users as follows:

   kubectl apply -f - <<EOF
   apiVersion: v1
   kind: Secret
   metadata:
     name: bob-key
     namespace: ${KUADRANT_SYSTEM_NS}
     labels:
       authorino.kuadrant.io/managed-by: authorino
       app: toystore
     annotations:
       secret.kuadrant.io/user-id: bob
   stringData:
     api_key: IAMBOB
   type: Opaque
   ---
   apiVersion: v1
   kind: Secret
   metadata:
     name: alice-key
     namespace: ${KUADRANT_SYSTEM_NS}
     labels:
       authorino.kuadrant.io/managed-by: authorino
       app: toystore
     annotations:
       secret.kuadrant.io/user-id: alice
   stringData:
     api_key: IAMALICE
   type: Opaque
   EOF

   Copy to Clipboard Toggle word wrap

3. Create a new AuthPolicy in a different namespace that overrides the deny-all policy created earlier and accepts the API keys as follows:

   kubectl apply -f - <<EOF
   apiVersion: kuadrant.io/v1
   kind: AuthPolicy
   metadata:
     name: toystore-auth
     namespace: ${KUADRANT_DEVELOPER_NS}
   spec:
     targetRef:
       group: gateway.networking.k8s.io
       kind: HTTPRoute
       name: toystore
     defaults:
      when:
        - predicate: "request.path != '/health'"
      rules:
       authentication:
         "api-key-users":
           apiKey:
             selector:
               matchLabels:
                 app: toystore
           credentials:
             authorizationHeader:
               prefix: APIKEY
       response:
         success:
           filters:
             "identity":
               json:
                 properties:
                   "userid":
                     selector: auth.identity.metadata.annotations.secret\.kuadrant\.io/user-id
   EOF

   Copy to Clipboard Toggle word wrap

Procedure

1. Create a new RateLimitPolicy in a different namespace to override the default low-limit policy created previously and set rate limits for specific users as follows:

   kubectl apply -f - <<EOF
   apiVersion: kuadrant.io/v1
   kind: RateLimitPolicy
   metadata:
     name: toystore-rlp
     namespace: ${KUADRANT_DEVELOPER_NS}
   spec:
     targetRef:
       group: gateway.networking.k8s.io
       kind: HTTPRoute
       name: toystore
     limits:
       "general-user":
         rates:
   
         - limit: 5
           window: 10s
         counters:
         - expression: auth.identity.userid
         when:
         - predicate: "auth.identity.userid != 'bob'"
       "bob-limit":
         rates:
         - limit: 2
           window: 10s
         when:
         - predicate: "auth.identity.userid == 'bob'"
   EOF

   Copy to Clipboard Toggle word wrap

   It might take a few minutes for the RateLimitPolicy to be applied, depending on your cluster.

2. Check that the RateLimitPolicy has a status of Accepted and Enforced as follows:

   $ kubectl get ratelimitpolicy -n ${KUADRANT_DEVELOPER_NS} toystore-rlp -o=jsonpath='{.status.conditions[?(@.type=="Accepted")].message}{"\n"}{.status.conditions[?(@.type=="Enforced")].message}'

   Copy to Clipboard Toggle word wrap

3. Check that the status of the HTTPRoute is now affected by the RateLimitPolicy in the same namespace:

   $ kubectl get httproute toystore -n ${KUADRANT_DEVELOPER_NS} -o=jsonpath='{.status.parents[0].conditions[?(@.type=="kuadrant.io/RateLimitPolicyAffected")].message}'

   Copy to Clipboard Toggle word wrap

Verification

1. Send requests as user alice as follows:

   $ while :; do curl -k --write-out '%{http_code}\n' --silent --output /dev/null -H 'Authorization: APIKEY IAMALICE' "https://api.$KUADRANT_ZONE_ROOT_DOMAIN/cars" | grep -E --color "\b(429)\b|$"; sleep 1; done

   Copy to Clipboard Toggle word wrap

   You should see HTTP status 200 every second for 5 seconds, followed by HTTP status 429 every second for 5 seconds.

2. Send requests as user bob as follows:

   $ while :; do curl -k --write-out '%{http_code}\n' --silent --output /dev/null -H 'Authorization: APIKEY IAMBOB' "https://api.$KUADRANT_ZONE_ROOT_DOMAIN/cars" | grep -E --color "\b(429)\b|$"; sleep 1; done

   Copy to Clipboard Toggle word wrap

   You should see HTTP status 200 every second for 2 seconds, followed by HTTP status 429 every second for 8 seconds.