Chapter 2. Configuring Red Hat Integration products for API development and deployment

Procedure

1. Create an OpenShift OAuth client for 3scale. For more details, see the OpenShift Authentication documentation. In the following example, replace <provide-a-client-secret> with a secret that you generate and replace <3scale-master-domain-route> with the URL to access the 3scale Master Admin Portal.

       $ oc project default
       $ cat <<-EOF | oc create -f -
       kind: OAuthClient
       apiVersion: v1
       metadata:
        name: 3scale
       secret: "<provide-a-client-secret>"
       redirectURIs:
        - "<3scale-master-domain-route>"
       grantMethod: prompt
       EOF

2. Open the 3scale Service Discovery settings file:

       $ oc project <3scale-project>
       $ oc edit configmap system

3. Configure the following settings:

       service_discovery.yml:
         production:
           enabled: true
           authentication_method: oauth
           oauth_server_type: builtin
           client_id: '3scale'
           client_secret: '<choose-a-client-secret>'

4. Ensure that users have proper permissions to view cluster projects containing discoverable services.

   To give an administrator user, represented by <user>, the view permission for the <namespace> project containing a service to be discovered, use this command:

   oc adm policy add-role-to-user view <user> -n <namespace>

5. After modifying configmap, you must redeploy the system-app and system-sidekiq pods to apply the changes.

   oc rollout latest dc/system-app
   oc rollout latest dc/system-sidekiq

6. Check the status of the rollout to ensure it has finished:

   oc rollout status dc/system-app
   oc rollout status dc/system-sidekiq

Procedure

1. Create an OAuth client for 3scale in Red Hat OAuth server (Keycloak).

   Note

   In the client configuration, verify that the username maps to preferred_username, so that OpenShift can link accounts.

2. Edit 3scale Service Discovery settings.

       $ oc project <3scale-project>
       $ oc edit configmap system

3. Verify that the following settings are configured, where `<the-client-secret-from-Keycloak> is the value that Keycloak generated automatically when you created the OAuth client.

       service_discovery.yml:
         production:
           enabled: true
           authentication_method: oauth
           oauth_server_type: rh_sso
           client_id: '3scale'
           client_secret: '<the-client-secret-from-Keycloak>'

4. Make sure that users have proper permissions to view cluster projects containing discoverable services.

   For example, to give <user> view permission for the <namespace> project, use this command:

   oc adm policy add-role-to-user view <user> -n <namespace>

5. After modifying configmap, you must redeploy the system-app and system-sidekiq pods to apply the changes.

Procedure

1. Verify that the 3scale project is the current project.

      $ oc project <3scale-project>

2. Open the 3scale Service Discovery settings in an editor.

      $ oc edit configmap system

3. Verify that the following settings are configured.

   service_discovery.yml:
      production:
         enabled: <%= cluster_token_file_exists = File.exists?(cluster_token_file_path = '/var/run/secrets/kubernetes.io/serviceaccount/token') %>
         bearer_token: "<%= File.read(cluster_token_file_path) if cluster_token_file_exists %>"
         authentication_method: service_account

4. Provide the 3scale deployment amp service account with the relevant permissions to view projects containing discoverable services by following one of these options:

   • Grant the 3scale deployment amp service account with view cluster level permission.

     oc adm policy add-cluster-role-to-user view system:serviceaccount:<3scale-project>:amp

   • Apply a more restrictive policy as described in OpenShift - Service Accounts.