Chapter 2. Installing APIcast
Chapter 2. Installing APIcast APIcast is an NGINX based API gateway used to integrate your internal and external API services with the Red Hat 3scale API Management Platform. APIcast does load balancing by using round-robin. In this guide you will learn about deployment options, environments provided, and how to get started. Prerequisites APIcast is not a standalone API gateway. It needs connection to 3scale API Manager. A working 3scale On-Premises instance. To install APIcast, perform the steps outlined in the following sections: APIcast deployment options APIcast environments Configuring the integration settings Configuring your product Deploying an APIcast gateway self-managed solution using the operator 2.1. APIcast deployment options You can use hosted or self-managed APIcast. In both cases, APIcast must be connected to the rest of the 3scale API Management platform: Embedded APIcast : A 3scale API Management installation includes two default APIcast gateways, staging and production. These gateways come preconfigured and ready for immediate use. Self-managed APIcast : You can deploy APIcast wherever you want. Here is one of the recommended option to deploy APIcast: Running APIcast on Red Hat OpenShift: Run APIcast on a supported version of OpenShift. You can connect self-managed APIcasts to a 3scale On-premises installation or to a 3scale Hosted (SaaS) account. For this, deploy an APIcast gateway self-managed solution using the operator . 2.2. APIcast environments By default, when you create a 3scale account, you get embedded APIcast in two different environments: Staging : Intended to be used only while configuring and testing your API integration. When you have confirmed that your setup is working as expected, then you can choose to deploy it to the production environment. Production : This environment is intended for production use. The following parameters are set for the Production APIcast in the OpenShift template: APICAST_CONFIGURATION_LOADER: boot , APICAST_CONFIGURATION_CACHE: 300 . This means that the configuration will be fully loaded when APIcast is started, and will be cached for 300 seconds (5 minutes). After 5 minutes the configuration will be reloaded. This means that when you promote the configuration to production, it may take up to 5 minutes to be applied, unless you trigger a new deployment of APIcast. 2.3. Configuring the integration settings As a 3scale administrator, configure the integration settings for the environment you require 3scale to run in. Prerequisites A 3scale account with administrator privileges. Procedure Navigate to [Your_product_name] > Integration > Settings . Under Deployment , the default options are as follows: Deployment Option: APIcast 3scale managed Authentication mode: API key. Change to your preferred option. To save your changes, click Update Product . 2.4. Configuring your product You must declare your API back-end in the Private Base URL field, which is the endpoint host of your API back-end. APIcast will redirect all traffic to your API back-end after all authentication, authorization, rate limits and statistics have been processed. This section will guide you through configuring your product: Declaring the API backend Configuring the authentication settings Configuring the API test call 2.4.1. Declaring the API backend Typically, the Private Base URL of your API will be something like https://api-backend.yourdomain.com:443 , on the domain that you manage ( yourdomain.com ). For instance, if you were integrating with the Twitter API the Private Base URL would be https://api.twitter.com/ . In this example, you will use the Echo API hosted by 3scale, a simple API that accepts any path and returns information about the request (path, request parameters, headers, etc.). Its Private Base URL is https://echo-api.3scale.net:443 . Procedure Test your private (unmanaged) API is working. For example, for the Echo API you can make the following call with curl command: You will get the following response: 2.4.2. Configuring the authentication settings You can configure authentication settings for your API in the AUTHENTICATION section under [Your_product_name] > Integration > Settings . Table 2.1. Optional authentication fields Field Description Auth user key Set the user key associated with the credentials location. Credentials location Define whether credentials are passed as HTTP headers, query parameters or as HTTP basic authentication. Host Header Define a custom Host request header. This is required if your API backend only accepts traffic from a specific host. Secret Token Used to block direct developer requests to your API backend. Set the value of the header here, and ensure your backend only allows calls with this secret header. Furthermore, you can configure the GATEWAY RESPONSE error codes under [Your_product_name] > Integration > Settings . Define the Response Code , Content-type , and Response Body for the errors: Authentication failed, Authentication missing, and No match. Table 2.2. Response codes and default response body Response code Response body 403 Authentication failed 403 Authentication parameters missing 404 No Mapping Rule matched 429 Usage limit exceeded 2.4.3. Configuring the API test call Configuring the API involves testing the backends with a product and promoting the APIcast configuration to staging and production environments to make tests based on request calls. For each product, requests get redirected to their corresponding backend according to the path. This path is configured when you add the backend to the product. For example, if you have two backends added to a product, each backend has its own path. Prerequisites One or more backends added to a product . A mapping rule for each backend added to a product. An application plan to define the access policies. An application that subscribes to the application plan. Procedure Promote an APIcast configuration to Staging, by navigating to [Your_product_name] > Integration > Configuration . Under APIcast Configuration , you will see the mapping rules for each backend added to the product. Click Promote v.[n] to Staging APIcast . v.[n] indicates the version number to be promoted. Once promoted to staging, you can promote to Production. Under Staging APIcast , click Promote v.[n] to Production APIcast . v.[n] indicates the version number to be promoted. To test requests to your API in the command line, use the command provided in Example curl for testing . The curl command example is based on the first mapping rule in the product. When testing requests to your API, you can modify the mapping rules by adding methods and metrics . Every time you modify the configuration and before making calls to your API, make sure you promote to the Staging and Production environments. When there are pending changes to be promoted to the Staging environment, you will see an exclamation mark in the Admin Portal, to the Integration menu item. 3scale Hosted APIcast gateway does the validation of the credentials and applies the rate limits that you defined for the application plan of your API. If you make a call without credentials, or with invalid credentials, you will see the error message, Authentication failed . 2.4.4. Deploying APIcast on Podman This is a step-by-step guide for deploying APIcast on a Pod Manager (Podman) container environment to be used as a Red Hat 3scale API Management API gateway. Note When deploying APIcast on a Podman container environment, the supported versions of Red Hat Enterprise Linux (RHEL) and Podman are as follows: RHEL 8.x/9.x Podman 4.6.1 Prerequisites You must configure APIcast in your 3scale Admin Portal as per Installing APIcast . To deploy APIcast on the Podman container environment, perform the steps outlined in the following sections: Section 2.4.4.1, "Installing the Podman container environment" Section 2.4.4.2, "Running the Podman environment" 2.4.4.1. Installing the Podman container environment This guide covers the steps to set up the Podman container environment on RHEL 8.x. Docker is not included in RHEL 8.x, therefore, use Podman for working with containers. For more details about Podman with RHEL 8.x, see the Container command-line reference . Procedure Install the Podman container environment package: Additional resources For other operating systems, refer to the following Podman documentation: Podman Installation Instructions 2.4.4.2. Running the Podman environment To run the Podman container environment, follow the procedure below. Procedure Download a ready to use Podman container image from the Red Hat registry: Run APIcast in a Podman: Here, <access_token> is the Access Token for the 3scale Account Management API. You can use the Provider Key instead of the access token. <domain>-admin.3scale.net is the URL of your 3scale Admin Portal. This command runs a Podman container engine called "apicast" on port 8080 and fetches the JSON configuration file from your 3scale Admin Portal. For other configuration options, see Installing APIcast . 2.4.4.2.1. Testing APIcast with Podman The preceding steps ensure that your Podman container engine is running with your own configuration file and the Podman container image from the 3scale registry. You can test calls through APIcast on port 8080 and provide the correct authentication credentials, which you can get from your 3scale account. Test calls will not only verify that APIcast is running correctly but also that authentication and reporting is being handled successfully. Note Ensure that the host you use for the calls is the same as the one configured in the Public Base URL field on the Integration page. 2.4.4.3. The podman command options You can use the following option examples with the podman command: -d : Runs the container in detached mode and prints the container ID. When it is not specified, the container runs in the foreground mode and you can stop it using CTRL + c . When started in the detached mode, you can reattach to the container with the podman attach command, for example, podman attach apicast . ps and -a : Podman ps is used to list creating and running containers. Adding -a to the ps command will show all containers, both running and stopped, for example, podman ps -a . inspect and -l : Inspect a running container. For example, use inspect to see the ID that was assigned to the container. Use -l to get the details for the latest container, for example, podman inspect -l | grep Id\": . 2.4.4.4. Additional resources Red Hat 3scale API Management Supported Configurations Basic Setup and Use of Podman 2.5. Deploying an APIcast gateway self-managed solution using the operator This guide provides steps for deploying an APIcast gateway self-managed solution using the APIcast operator via the Openshift Container Platform console. The default settings are for production environment when you deploy APIcast. You can always adjust these settings for deploying a staging environment. For example, use the following oc command: For more information, see the: APIcast Custom Resource reference Prerequisites OpenShift Container Platform (OCP) 4.x or later with administrator privileges. * You followed the steps in Installing the APIcast operator on OpenShift . Procedure Log in to the OCP console using an account with administrator privileges. Click Operators > Installed Operators . Click the APIcast Operator from the list of Installed Operators . Click APIcast > Create APIcast . 2.5.1. APICast deployment and configuration options You can deploy and configure an APIcast gateway self-managed solution using two approaches: Providing a 3scale API Management system endpoint Providing a configuration secret See also: Injecting custom environments with the APIcast operator Injecting custom policies with the APIcast operator Configuring OpenTracing with the APIcast operator Setting the APICAST_SERVICE_CACHE_SIZE 2.5.1.1. Providing a 3scale API Management system endpoint Procedure Create an OpenShift secret that contains 3scale System Admin Portal endpoint information: USD oc create secret generic USD{SOME_SECRET_NAME} --from-literal=AdminPortalURL=USD{MY_3SCALE_URL} USD{SOME_SECRET_NAME} is the name of the secret and can be any name you want as long as it does not conflict with an existing secret. USD{MY_3SCALE_URL} is the URI that includes your 3scale access token and 3scale System portal endpoint. For more details, see THREESCALE_PORTAL_ENDPOINT Example USD oc create secret generic 3scaleportal --from-literal=AdminPortalURL=https://access-token@account-admin.3scale.net For more information about the contents of the secret see the Admin portal configuration secret reference. Create the OpenShift object for APIcast apiVersion: apps.3scale.net/v1alpha1 kind: APIcast metadata: name: example-apicast spec: adminPortalCredentialsRef: name: SOME_SECRET_NAME The spec.adminPortalCredentialsRef.name must be the name of the existing OpenShift secret that contains the 3scale system Admin Portal endpoint information. Verify the APIcast pod is running and ready, by confirming that the readyReplicas field of the OpenShift Deployment associated with the APIcast object is 1 . Alternatively, wait until the field is set with: USD echo USD(oc get deployment apicast-example-apicast -o jsonpath='{.status.readyReplicas}') 1 2.5.1.1.1. Verifying the APIcast gateway is running and available Procedure Ensure the OpenShift Service APIcast is exposed to your local machine, and perform a test request. Do this by port-forwarding the APIcast OpenShift Service to localhost:8080 : USD oc port-forward svc/apicast-example-apicast 8080 Make a request to a configured 3scale service to verify a successful HTTP response. Use the domain name configured in Staging Public Base URL or Production Public Base URL settings of your service. For example: USD curl 127.0.0.1:8080/test -H "Host: localhost" { "method": "GET", "path": "/test", "args": "", "body": "", "headers": { "HTTP_VERSION": "HTTP/1.1", "HTTP_HOST": "echo-api.3scale.net", "HTTP_ACCEPT": "*/*", "HTTP_USER_AGENT": "curl/7.65.3", "HTTP_X_REAL_IP": "127.0.0.1", "HTTP_X_FORWARDED_FOR": ... "HTTP_X_FORWARDED_HOST": "echo-api.3scale.net", "HTTP_X_FORWARDED_PORT": "80", "HTTP_X_FORWARDED_PROTO": "http", "HTTP_FORWARDED": "for=10.0.101.216;host=echo-api.3scale.net;proto=http" }, "uuid": "603ba118-8f2e-4991-98c0-a9edd061f0f0" 2.5.1.1.2. Exposing APIcast externally via a Kubernetes Ingress To expose APIcast externally via a Kubernetes Ingress, set and configure the exposedHost section. When the host field in the exposedHost section is set, this creates a Kubernetes Ingress object. The Kubernetes Ingress object can then be used by a previously installed and existing Kubernetes Ingress Controller to make APIcast accessible externally. To learn what Ingress Controllers are available to make APIcast externally accessible and how they are configured see the Kubernetes Ingress Controllers documentation . The following example to expose APIcast with the hostname myhostname.com : apiVersion: apps.3scale.net/v1alpha1 kind: APIcast metadata: name: example-apicast spec: ... exposedHost: host: "myhostname.com" ... The example creates a Kubernetes Ingress object on the port 80 using HTTP. When the APIcast deployment is in an OpenShift environment, the OpenShift default Ingress Controller will create a Route object using the Ingress object APIcast creates which allows external access to the APIcast installation. You may also configure TLS for the exposedHost section. Details about the available fields in the following table: Table 2.3. APIcastExposedHost reference table json/yaml field Type Required Default value Description host string Yes N/A Domain name being routed to the gateway tls []networkv1.IngressTLS No N/A Array of ingress TLS objects. See more on TLS . 2.5.1.2. Providing a configuration secret Procedure Create a secret with the configuration file: USD curl https://raw.githubusercontent.com/3scale/APIcast/master/examples/configuration/echo.json -o USDPWD/config.json USD oc create secret generic apicast-echo-api-conf-secret --from-file=USDPWD/config.json The configuration file must be called config.json . This is an APIcast CRD reference requirement. For more information about the contents of the secret see the Admin portal configuration secret reference. Create an APIcast custom resource : USD cat my-echo-apicast.yaml apiVersion: apps.3scale.net/v1alpha1 kind: APIcast metadata: name: my-echo-apicast spec: exposedHost: host: YOUR DOMAIN embeddedConfigurationSecretRef: name: apicast-echo-api-conf-secret USD oc apply -f my-echo-apicast.yaml The following is an example of an embedded configuration secret: apiVersion: v1 kind: Secret metadata: name: SOME_SECRET_NAME type: Opaque stringData: config.json: | { "services": [ { "proxy": { "policy_chain": [ { "name": "apicast.policy.upstream", "configuration": { "rules": [{ "regex": "/", "url": "http://echo-api.3scale.net" }] } } ] } } ] } Set the following content when creating the APIcast object: apiVersion: apps.3scale.net/v1alpha1 kind: APIcast metadata: name: example-apicast spec: embeddedConfigurationSecretRef: name: SOME_SECRET_NAME The spec.embeddedConfigurationSecretRef.name must be the name of the existing OpenShift secret that contains the configuration of the gateway. Verify the APIcast pod is running and ready, by confirming that the readyReplicas field of the OpenShift Deployment associated with the APIcast object is 1 . Alternatively, wait until the field is set with: USD echo USD(oc get deployment apicast-example-apicast -o jsonpath='{.status.readyReplicas}') 1 2.5.1.2.1. Verifying APIcast gateway is running and available Procedure Ensure the OpenShift Service APIcast is exposed to your local machine, and perform a test request. Do this by port-forwarding the APIcast OpenShift Service to localhost:8080 : USD oc port-forward svc/apicast-example-apicast 8080 : Make a request to a configured 3scale service and verify a successful HTTP response . 2.5.1.3. Injecting custom environments with the APIcast operator In a 3scale installation that uses self-managed APIcast, you can use the APIcast operator to inject custom environments. A custom environment defines behavior that APIcast applies to all upstream APIs that the gateway serves. To create a custom environment, define a global configuration in Lua code. You can inject a custom environment as part of or after APIcast installation. After injecting a custom environment, you can remove it and the APIcast operator reconciles the changes. Prerequisites The APIcast operator is installed. Procedure Write Lua code that defines the custom environment that you want to inject. For example, the following env1.lua file shows a custom logging policy that the APIcast operator loads for all services. local cjson = require('cjson') local PolicyChain = require('apicast.policy_chain') local policy_chain = context.policy_chain local logging_policy_config = cjson.decode([[ { "enable_access_logs": false, "custom_logging": "\"{{request}}\" to service {{service.id}} and {{service.name}}" } ]]) policy_chain:insert( PolicyChain.load_policy('logging', 'builtin', logging_policy_config), 1) return { policy_chain = policy_chain, port = { metrics = 9421 }, } Create a secret from the Lua file that defines the custom environment. For example: USD oc create secret generic custom-env-1 --from-file=./env1.lua A secret can contain multiple custom environments. Specify the -from-file option for each file that defines a custom environment. The operator loads each custom environment. Define an APIcast custom resource that references the secret you just created. The following example shows only content relative to referencing the secret that defines the custom environment. apiVersion: apps.3scale.net/v1alpha1 kind: APIcast metadata: name: apicast1 spec: customEnvironments: - secretRef: name: custom-env-1 An APIcast custom resource can reference multiple secrets that define custom environments. The operator loads each custom environment. Create the APIcast custom resource that adds the custom environment. For example, if you saved the APIcast custom resource in the apicast.yaml file, run the following command: USD oc apply -f apicast.yaml steps If you update your custom environment be sure to re-create its secret so the secret contains the update. The APIcast operator watches for updates and automatically redeploys when it finds an update. 2.5.1.4. Injecting custom policies with the APIcast operator In a 3scale installation that uses self-managed APIcast, you can use the APIcast operator to inject custom policies. Injecting a custom policy adds the policy code to APIcast. You can then use either of the following to add the custom policy to an API product's policy chain: 3scale API Product custom resource To use the 3scale Admin Portal to add the custom policy to a product's policy chain, you must also register the custom policy's schema with a CustomPolicyDefinition custom resource. Custom policy registration is a requirement only when you want to use the Admin Portal to configure a product's policy chain. You can inject a custom policy as part of or after APIcast installation. After injecting a custom policy, you can remove it and the APIcast operator reconciles the changes. Prerequisites The APIcast operator is installed or you are in the process of installing it. You have defined a custom policy as described in Write your own policy . That is, you have already created, for example, the my-first-custom-policy.lua , apicast-policy.json , and init.lua files that define a custom policy, Procedure Create a secret from the files that define one custom policy. For example: USD oc create secret generic my-first-custom-policy-secret \ --from-file=./apicast-policy.json \ --from-file=./init.lua \ --from-file=./my-first-custom-policy.lua If you have more than one custom policy, create a secret for each custom policy. A secret can contain only one custom policy. Define an APIcast custom resource that references the secret you just created. The following example shows only content relative to referencing the secret that defines the custom policy. apiVersion: apps.3scale.net/v1alpha1 kind: APIcast metadata: name: apicast1 spec: customPolicies: - name: my-first-custom-policy version: "0.1" secretRef: name: my-first-custom-policy-secret An APIcast custom resource can reference multiple secrets that define custom policies. The operator loads each custom policy. Create the APIcast custom resource that adds the custom policy. For example, if you saved the APIcast custom resource in the apicast.yaml file, run the following command: USD oc apply -f apicast.yaml steps If you update your custom policy be sure to re-create its secret so the secret contains the update. The APIcast operator watches for updates and automatically redeploys when it finds an update. Additional resources APIcast custom resource definition 2.5.1.5. Configuring OpenTracing with the APIcast operator In a 3scale installation that uses self-managed APIcast, you can use the APIcast operator to configure OpenTracing. By enabling OpenTracing, you get more insight and better observability on the APIcast instance. Prerequisites The APIcast operator is installed or you are in the process of installing it. Procedure Define a secret that contains your OpenTracing configuration details in stringData.config . This is the only valid value for the attribute that contains your OpenTracing configuration details. Any other specification prevents APIcast from receiving your OpenTracing configuration details. The folowing example shows a valid secret definition: apiVersion: v1 kind: Secret metadata: name: myjaeger stringData: config: |- { "service_name": "apicast", "disabled": false, "sampler": { "type": "const", "param": 1 }, "reporter": { "queueSize": 100, "bufferFlushInterval": 10, "logSpans": false, "localAgentHostPort": "jaeger-all-in-one-inmemory-agent:6831" }, "headers": { "jaegerDebugHeader": "debug-id", "jaegerBaggageHeader": "baggage", "TraceContextHeaderName": "uber-trace-id", "traceBaggageHeaderPrefix": "testctx-" }, "baggage_restrictions": { "denyBaggageOnInitializationFailure": false, "hostPort": "127.0.0.1:5778", "refreshInterval": 60 } } type: Opaque Create the secret. For example, if you saved the secret definition in the myjaeger.yaml file, you would run the following command: USD oc create -f myjaeger.yaml Define an APIcast custom resource that specifies the OpenTracing attributes. In the CR definition, set the spec.tracingConfigSecretRef.name attribute to the name of the secret that contains your OpenTracing configuration details. The following example shows only content relative to configuring OpenTracing. apiVersion: apps.3scale.net/v1alpha1 kind: APIcast metadata: name: apicast1 spec: ... openTracing: enabled: true tracingConfigSecretRef: name: myjaeger tracingLibrary: jaeger ... Create the APIcast custom resource that configures OpenTracing. For example, if you saved the APIcast custom resource in the apicast1.yaml file, you would run the following command: steps Depending on how OpenTracing is installed, you should see the traces in the Jaeger service user interface. Additional resource APIcast custom resource definition 2.5.1.6. Setting the APICAST_SERVICE_CACHE_SIZE environment variable You can specify the number of services that APIcast stores in the internal cache by adding an optional field in the APIcast custom resource (CR). Prerequisites You have installed the APIcast operator, or you are in the process of installing it. Procedure Add the serviceCacheSize optional field in the spec : Verification Type the following command to check the deployment: Verify inclusion of the environment variable: Additional resource APIcast custom resource definition 2.6. Additional resources To get information about the latest released and supported version of APIcast, see the articles: Red Hat 3scale API Management Supported Configurations Red Hat 3scale API Management - Component Details .
curl "https://echo-api.3scale.net:443" { "method": "GET", "path": "/", "args": "", "body": "", "headers": { "HTTP_VERSION": "HTTP/1.1", "HTTP_HOST": "echo-api.3scale.net", "HTTP_ACCEPT": "*/*", "HTTP_USER_AGENT": "curl/7.51.0", "HTTP_X_FORWARDED_FOR": "2.139.235.79, 10.0.103.58", "HTTP_X_FORWARDED_HOST": "echo-api.3scale.net", "HTTP_X_FORWARDED_PORT": "443", "HTTP_X_FORWARDED_PROTO": "https", "HTTP_FORWARDED": "for=10.0.103.58;host=echo-api.3scale.net;proto=https" }, "uuid": "ee626b70-e928-4cb1-a1a4-348b8e361733" } sudo dnf install podman podman pull registry.redhat.io/3scale-amp2/apicast-gateway-rhel8:3scale2.15 podman run --name apicast --rm -p 8080:8080 -e THREESCALE_PORTAL_ENDPOINT=https://<access_token>@<domain>-admin.3scale.net registry.redhat.io/3scale-amp2/apicast-gateway-rhel8:3scale2.15 oc patch apicast/{apicast_name} --type=merge -p '{"spec":{"deploymentEnvironment":"staging","configurationLoadMode":"lazy"}}' oc create secret generic USD{SOME_SECRET_NAME} --from-literal=AdminPortalURL=USD{MY_3SCALE_URL} oc create secret generic 3scaleportal --from-literal=AdminPortalURL=https://access-token@account-admin.3scale.net apiVersion: apps.3scale.net/v1alpha1 kind: APIcast metadata: name: example-apicast spec: adminPortalCredentialsRef: name: SOME_SECRET_NAME echo USD(oc get deployment apicast-example-apicast -o jsonpath='{.status.readyReplicas}') 1 oc port-forward svc/apicast-example-apicast 8080 curl 127.0.0.1:8080/test -H "Host: localhost" { "method": "GET", "path": "/test", "args": "", "body": "", "headers": { "HTTP_VERSION": "HTTP/1.1", "HTTP_HOST": "echo-api.3scale.net", "HTTP_ACCEPT": "*/*", "HTTP_USER_AGENT": "curl/7.65.3", "HTTP_X_REAL_IP": "127.0.0.1", "HTTP_X_FORWARDED_FOR": "HTTP_X_FORWARDED_HOST": "echo-api.3scale.net", "HTTP_X_FORWARDED_PORT": "80", "HTTP_X_FORWARDED_PROTO": "http", "HTTP_FORWARDED": "for=10.0.101.216;host=echo-api.3scale.net;proto=http" }, "uuid": "603ba118-8f2e-4991-98c0-a9edd061f0f0" apiVersion: apps.3scale.net/v1alpha1 kind: APIcast metadata: name: example-apicast spec: exposedHost: host: "myhostname.com" curl https://raw.githubusercontent.com/3scale/APIcast/master/examples/configuration/echo.json -o USDPWD/config.json oc create secret generic apicast-echo-api-conf-secret --from-file=USDPWD/config.json cat my-echo-apicast.yaml apiVersion: apps.3scale.net/v1alpha1 kind: APIcast metadata: name: my-echo-apicast spec: exposedHost: host: YOUR DOMAIN embeddedConfigurationSecretRef: name: apicast-echo-api-conf-secret oc apply -f my-echo-apicast.yaml apiVersion: v1 kind: Secret metadata: name: SOME_SECRET_NAME type: Opaque stringData: config.json: | { "services": [ { "proxy": { "policy_chain": [ { "name": "apicast.policy.upstream", "configuration": { "rules": [{ "regex": "/", "url": "http://echo-api.3scale.net" }] } } ] } } ] } apiVersion: apps.3scale.net/v1alpha1 kind: APIcast metadata: name: example-apicast spec: embeddedConfigurationSecretRef: name: SOME_SECRET_NAME echo USD(oc get deployment apicast-example-apicast -o jsonpath='{.status.readyReplicas}') 1 oc port-forward svc/apicast-example-apicast 8080 local cjson = require('cjson') local PolicyChain = require('apicast.policy_chain') local policy_chain = context.policy_chain local logging_policy_config = cjson.decode([[ { "enable_access_logs": false, "custom_logging": "\"{{request}}\" to service {{service.id}} and {{service.name}}" } ]]) policy_chain:insert( PolicyChain.load_policy('logging', 'builtin', logging_policy_config), 1) return { policy_chain = policy_chain, port = { metrics = 9421 }, } oc create secret generic custom-env-1 --from-file=./env1.lua apiVersion: apps.3scale.net/v1alpha1 kind: APIcast metadata: name: apicast1 spec: customEnvironments: - secretRef: name: custom-env-1 oc apply -f apicast.yaml oc create secret generic my-first-custom-policy-secret --from-file=./apicast-policy.json --from-file=./init.lua --from-file=./my-first-custom-policy.lua apiVersion: apps.3scale.net/v1alpha1 kind: APIcast metadata: name: apicast1 spec: customPolicies: - name: my-first-custom-policy version: "0.1" secretRef: name: my-first-custom-policy-secret oc apply -f apicast.yaml apiVersion: v1 kind: Secret metadata: name: myjaeger stringData: config: |- { "service_name": "apicast", "disabled": false, "sampler": { "type": "const", "param": 1 }, "reporter": { "queueSize": 100, "bufferFlushInterval": 10, "logSpans": false, "localAgentHostPort": "jaeger-all-in-one-inmemory-agent:6831" }, "headers": { "jaegerDebugHeader": "debug-id", "jaegerBaggageHeader": "baggage", "TraceContextHeaderName": "uber-trace-id", "traceBaggageHeaderPrefix": "testctx-" }, "baggage_restrictions": { "denyBaggageOnInitializationFailure": false, "hostPort": "127.0.0.1:5778", "refreshInterval": 60 } } type: Opaque oc create -f myjaeger.yaml apiVersion: apps.3scale.net/v1alpha1 kind: APIcast metadata: name: apicast1 spec: openTracing: enabled: true tracingConfigSecretRef: name: myjaeger tracingLibrary: jaeger oc apply -f apicast1.yaml spec: // serviceCacheSize: 42 oc get deployment/apicast-example-apicast -o yaml - name: APICAST_SERVICE_CACHE_SIZE value: '42'