Chapter 2. Connect and secure APIs and services

Procedure

1. Create an HTTPRoute custom resource (CR), such as <toystore>-route.yaml, that has the following information:

   Example HTTPRoute CR

   apiVersion: gateway.networking.k8s.io/v1
   kind: HTTPRoute
   metadata:
     name: <toystore>
     namespace: <${KUADRANT_DEVELOPER_NS}>
     labels:
       deployment: <toystore>
       service: <toystore>
   spec:
     parentRefs:
       - name: <${KUADRANT_GATEWAY_NAME}>
         namespace: <${KUADRANT_GATEWAY_NS}>
     hostnames:
       - api.${KUADRANT_ZONE_ROOT_DOMAIN}
     rules:
       - matches:
           - method: GET
             path:
               type: PathPrefix
               value: /cars
           - method: GET
             path:
               type: PathPrefix
               value: /health
         backendRefs:
           - name: <toystore>
             port: 80

   • Replace <toystore> with the name of your application.
   • metadata.namespace: The namespace in which you are deploying your application. Replace <${KUADRANT_DEVELOPER_NS}> with the environment variable you used during installation.
   • spec.parentRefs.name and spec.parentRefs.namespace: The values must match the Gateway object.
   • spec.hostnames: The hostname must match the one specified in the Gateway object.
   • hostname.rules.matches.backendRefs.name: The name of the Service for your application.

2. Apply your HTTPRoute CR by running the following command:

   $ oc apply -f <toystore>-route.yaml

   Replace <toystore> with the name of your application.

   Example output

   httproute.gateway.networking.k8s.io/toystore-route created

   The output indicates that the route to the application exists.

Verification

1. Verify that the HTTPRoute is created by running the following command:

   $ oc get httproute <toystore> -n kuadrant -o=jsonpath='{.status.parents[].conditions[?(@.type=="Accepted")].message}{"\n"}{.status.parents[].conditions[?(@.type=="ResolvedRefs")].message}'

   Replace <toystore> with the name of your application.

   Example output

   Route was valid

2. If you have DNSPolicy and TLSPolicy objects applied, you can validate that your backend is reachable by running the following command:

   $ curl -k  https://api.${KUADRANT_ZONE_ROOT_DOMAIN}:443/cars

   Note that the example TLSPolicy CR uses a self-signed ClusterIssuer object.

Procedure

1. Create a new RateLimitPolicy custom resource (CR) in a different namespace to override the default low-limit policy and set rate limits for specific users by using the following example:

   Example RateLimitPolicy CR for specific users

   apiVersion: kuadrant.io/v1
   kind: RateLimitPolicy
   metadata:
     name: toystore-rlp
     namespace: ${KUADRANT_DEVELOPER_NS}
   spec:
     targetRef:
       group: gateway.networking.k8s.io
       kind: HTTPRoute
       name: toystore
     limits:
       "general-user":
         rates:
         - limit: 5
           window: 10s
         counters:
         - expression: auth.identity.userid
         when:
         - predicate: "auth.identity.userid != 'bob'"
       "bob-limit":
         rates:
         - limit: 2
           window: 10s
         when:
         - predicate: "auth.identity.userid == 'bob'"

2. Apply the CR by running the following command:

   $ oc apply -f <toystore-rlp>

   • Replace <toystore-rlp> with the name of your YAML.
   • Wait a few minutes for the RateLimitPolicy CR to be applied.

3. Check that the RateLimitPolicy has a status of Accepted and Enforced by running the following command:

   $ oc get ratelimitpolicy -n ${KUADRANT_DEVELOPER_NS} toystore-rlp -o=jsonpath='{.status.conditions[?(@.type=="Accepted")].message}{"\n"}{.status.conditions[?(@.type=="Enforced")].message}'

4. Check that the status of the HTTPRoute is now affected by the RateLimitPolicy CR in the same namespace:

   $ oc get httproute toystore -n ${KUADRANT_DEVELOPER_NS} -o=jsonpath='{.status.parents[0].conditions[?(@.type=="kuadrant.io/RateLimitPolicyAffected")].message}'

Verification

1. Send requests as user alice by running the following command:

   $ while :; do curl -k --write-out '%{http_code}\n' --silent --output /dev/null -H 'Authorization: APIKEY IAMALICE' "https://api.$KUADRANT_ZONE_ROOT_DOMAIN/cars" | grep -E --color "\b(429)\b|$"; sleep 1; done

   The expected outcome is an HTTP status 200 every second for 5 seconds, followed by HTTP status 429 every second for 5 seconds.

2. Send requests as user bob by running the following command:

   $ while :; do curl -k --write-out '%{http_code}\n' --silent --output /dev/null -H 'Authorization: APIKEY IAMBOB' "https://api.$KUADRANT_ZONE_ROOT_DOMAIN/cars" | grep -E --color "\b(429)\b|$"; sleep 1; done

   The expected outcome is an HTTP status 200 every second for 2 seconds, followed by HTTP status 429 every second for 8 seconds.

Procedure

1. Create a GRPCRoute YAML by using the following example:

   Example GRPCRoute CR

   apiVersion: gateway.networking.k8s.io/v1
   kind: GRPCRoute
   metadata:
     name: <grpcstore>
   spec:
     parentRefs:
       - name: <kuadrant_ingressgateway>
         namespace: <gateway_system>
     hostnames: [<"grpc.example.com">]
     rules:
       - matches:
           - method:
               service: <"talker.TalkerService">
               method: <"Echo">
         backendRefs:
           - name: grpcstore
             port: 9000

   See the "GRPCRoute custom resource parameters" reference information for details about parameters.

   Important

   If you include a spec.rules.matches.method block, you must specify a service name, a method name, or both. Omitting the method block entirely matches all gRPC traffic.

2. Apply your GRPCRoute CR by running the following command:

   $ oc apply -f <grpcstore_route.yaml>

   Replace <grpcstore_route.yaml> with the name of your gRPC YAML.

   Example output

   grpcroute.gateway.networking.k8s.io/grpcstore-route created

   The output indicates that the route to the object exists.

Procedure

1. Delete your HTTPRoute CRs. You must remove the HTTPRoute CR must before you can use the GRPCRoute CR on the same hostname.

2. Update the spec.targetRef.kind parameter value in your AuthPolicy and RateLimitPolicy CRs to GRPCRoute by using the following example:

   Example AuthPolicy CR updated to gRPC

   #...
   spec:
     targetRef:
       group: gateway.networking.k8s.io
       kind: GRPCRoute
       name: grpcstore
   #...