Connect, Secure and Protect with Red Hat Connectivity Link

Globex, a fictitious retail company, would like to share their product catalog api, deployed on  Kubernetes, with a new application in a secure fashion. Globex tasks their Platform Engineering and Development teams to solve this

Connect, Secure and Protect your Services on Kubernetes with Red Hat Connectivity Link

RHCL - Arcade Slides - Google Slides

Application connectivity for the hybrid cloud with Policy APIs - Google Slides

The teams adopt the following technologies to solve their problem

Gateway API to enable Ingress 
&
Red Hat Connectivity Link for attaching and managing, DNS, TLS, auth, rate limiting policies

RHCl - Arcade Slides - Google Slides

[STAGING] Red Hat Connectivity Link - Technical Deck - Google Slides

The primary goal of a Platform Engineer is to deploy a Gateway that  is ready for use by application development teams to deploy their service endpoints or APIs. This gateway should be protected and secured with global rate limiting and auth policies.

Platform Engineering Workflow

TLS
:
Define
a
TLS
issuer
for
TLS
certificates
for
secure
communication
to
the
Gateways.
DNS
Configuration
:
Setup
a
hosted
zone
using
a
DNS
provider.
Gateway
:
Create
a
Gateway
(based
on
Istio
gateway)
with
a
wildcard
hostname
based
on
the
root
domain.
Policies:
Setup
Connectivity
Link
Custom
Resources
(CRs)
for
DNS,
TLS,
Auth,
Rate
Limiting
Platform
Engineering
Task
List

Route 53 Console hosted zones

Overview · Cluster · Red Hat OpenShift

Import YAML · Red Hat OpenShift

To allow traffic using DNS you must define a Gateway using the Gateway API.  It is the new standard for Ingress from the Kubernetes community. Let's setup the gateway

Gateway

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: prod-web
  labels:
    kuadrant.io/lb-attribute-geo-code: US
spec:
  gatewayClassName: istio
  listeners:
    - allowedRoutes:
        namespaces:
          from: All
      hostname: '*.globex.sandbox127.opentlc.com'
      name: api
      port: 443
      protocol: HTTPS
      tls:
        certificateRefs:
          - group: ''
            kind: Secret
            name: api-tls
        mode: Terminate

Provide TLS for gateway listeners by managing the lifecycle of tls certificates using CertManager

TLS Policy

apiVersion: kuadrant.io/v1alpha1
kind: TLSPolicy
metadata:
  name: prod-web-tls-policy
  namespace: ingress-gateway
spec:
  issuerRef:
    group: cert-manager.io
    kind: ClusterIssuer
    name: prod-web-lets-encrypt-issuer
  targetRef:
    group: gateway.networking.k8s.io
    kind: Gateway
    name: prod-web

Apply an authorisation policy across all listeners attached to the gateway. 

Gateway Authentication

On incoming request, the gateway checks the matching rules for enforcing rate limits, as stated in the RateLimitPolicy custom resources and targeted Gateway API networking objects

Gateway Rate Limits

The DNSPolicy acts against a target Gateway by processing its listeners for hostnames and then create dns records for those hostnames.

DNS Policy

globex.sandbox127.opentlc.com - details

Now that the Platform Engineer has configured the Gateway with all the policies. Developers/App owners can now onboard their application/service endpoints to be available for secure access. Application developers can self service and refine policies to their specific needs in order to protect their exposed service endpoints.

Platform Configuration Complete

The Globex developers are now ready to onboard the ProductCatalog service to be securely exposed as an endpoint. The App and the services have already been deployed

Developer Workflow

Topology · Red Hat OpenShift

Globex Mobile

Sign in to globex-user1

HTTPRoute enables advanced routing capabilities for Ingress. HTTPRoute is a Gateway API type for specifying routing behavior of HTTP requests from a Gateway listener to an API object, i.e. Service.

HTTPRoute

globex-mobile-gateway · HTTP Route · Details · Red Hat OpenShift

Set up the auth policy specific to the service we want to expose

Auth Policy for HTTPRoute 

globex-mobile-gateway · Auth Policy · Details · Red Hat OpenShift

prod-web-rlp-lowlimits · Rate Limit Policy · YAML · Red Hat OpenShift

Let's create a new rate limit policy specific to the category service in order to increase the rate limits. 

Rate Limit Policy for HTTPRoute 

globex-mobile-gateway · Rate Limit Policy · Details · Red Hat OpenShift

We've now successfully portrayed how the platform engineering teams can enable the developers to connect, protect and secure APIs using Gateway API and Red Hat Connectivity Link. 

We hope you found this walkthrough useful. Below are some resources that can help you get started

Thank You

Red Hat

Thank You

We've now successfully portrayed how the platform engineering teams can enable the developers to connect, protect and secure APIs using Gateway API and Red Hat Connectivity Link. We hope you found this walkthrough useful. Below are some resources that can help you get started

Connect, Secure and Protect your Services on Kubernetes with Red Hat Connectivity Link

Globex, a fictitious retail company, would like to share their product catalog api, deployed on Kubernetes, with a new application in a secure fashion. Globex tasks their Platform Engineering and Development teams to solve this

Connect, Secure and Protect with Red Hat Connectivity Link

We've now successfully portrayed how the platform engineering teams can enable the developers to connect, protect and secure APIs using Gateway API and Red Hat Connectivity Link.

We hope you found this walkthrough useful. Below are some resources that can help you get started