Configuring user-defined policies on the API Gateway in a Kubernetes deployment

For a Kubernetes deployment that uses the DataPower API Gateway, user-defined Policies are externally configured. To distribute the user-defined policies on the DataPower API Gateway, you create a Kubernetes ConfigMap that is installed using the extra values file. The ConfigMap ensures the policies are available to the Management server.

• Create a configuration files containing the user-defined policies. In the following example, a configuration file named my-echo-policy.cfg defines a policy that sets the content of a response body from the value of a parameter.
  1. Define the policy in a file named, for example, my-echo-policy.cfg.

     The following DataPower configuration commands create an assembly-function object that represents the user-defined policy that will be advertised to the Management server in the ConfigMap. This example writes the value of the msg parameter provided as input to the user-defined policy to the message.body that is returned on the API invocation.

     assembly-setvar "my-echo-policy_1.0.0_assembly-setvar"
       variable
         action set
         name "message.body"
         type string
         value "$(local.parameter.msg)"
       exit
       variable
         action set
         name "message.headers.content-type"
         type string
         value "text/plain"
       exit
     exit
     
     api-rule "my-echo-policy_1.0.0_api-rule"
       action my-echo-policy_1.0.0_assembly-setvar
     exit
     
     assembly "my-echo-policy_1.0.0_assembly"
       rule my-echo-policy_1.0.0_api-rule
     exit
     
     assembly-function "my-echo-policy_1.0.0"
       summary "my-echo-policy_1.0.0"
       title "My Echo Policy"
       parameter
         name "msg"
         description "The message string"
         value-type string
       exit
       assembly my-echo-policy_1.0.0_assembly
     exit
     
     apic-gw-service
       user-defined-policies my-echo-policy_1.0.0
     exit

• Add the configuration file to the ConfigMap.
  1. To make the .cfg files available to the Gateway subsystem, create a Kubernetes ConfigMap named, for example, custom-dp-config:

     kubectl create configmap custom-dp-config --from-file=my-echo-policy.cfg
      

• Optionally, you can add your configuration files directly to the Helm chart.
  1. You create a directory for dynamic-gateway-service/config and place your configuration into a compressed tar file.
  2. Use apicup commands as shown below to place <your_config> into the Helm chart, so that it can be referenced by the values.yaml.

     For example:

     mkdir -p dynamic-gateway-service/config
     cp <your_config> dynamic-gateway-service/config/
     apicup subsys install gateway --out <dir>
     gunzip <dir>/helm/dynamic-gateway-service-X.X.XX.tgz
     tar -rf <dir>/helm/dynamic-gateway-service-X.X.XX.tar dynamic-gateway-service
     gzip <dir>/helm/dynamic-gateway-service-X.X.XX.tar
     mv <dir>/helm/dynamic-gateway-service-X.X.XX.tar.gz <dir>/helm/dynamic-gateway-service-X.X.XX.tgz
     

  3. In the extra values file, specify:

     datapower:
       additionalConfig:
       -  domain: <some-domain>
          config: config/<your config>

  4. Run the following commands to install the gateway with the specified configuration:

     apicup subsys set gateway extra-values-file <extra values file>
     apicup subsys install gateway --plan-dir <dir>

  5. If you are updating an existing install, you also need to restart the pod by running the following command:

     
     kubectl delete pod/<gateway_pod_name> -n <namespace>

     The new gateway pod is then automatically created with the new configuration.
• Optionally, you can add local files directly to the Helm charts.

  Local files can be added into the gateway deployment (Helm chart) by use of the datapower.additionalLocalTar value. This value is a path to a tar file which contains all the files you wish to add. This tar file should be a well formatted DataPower local: directory where files intended for the default domain are on the top level and all files intended for a different domain are in a subdirectory named for that domain.

  Use the same task flow as shown in Figure 1, but for the local path use local.tar.gz.

• Optionally, you can add certificates to the ConfigMap.

  Certificates and other crypto files can be added to the cert: directory by use of the datapower.additionalCerts value. This value takes the form of a list of domain-secret pairs. The secrets are Kubernetes secrets which contain the crypto files you wish to use. To create the secrets from an existing crypto key-cert pair:

  1. Create the secrets from a specified file:

     kubectl create secret generic my-secret --from-file=/path/to/key.pem --from-file=/path/to/cert.pem

  2. Reference the secret in the extra values file by specifying:

     datapower:
       additionalCerts:
       - domain: "default"
         secret: "some-default-cert-secret"
       - domain: "apiconnect"
         secret: "some-apiconnect-cert-secret"

• Install the ConfigMap containing the policies using the extra values file and the APICUP installer.
  1. In order to configure the Gateway to use the custom policies in the custom-dp-config ConfigMap, set the customDatapowerConfig value to point to the ConfigMap in the extra values file:
     For information on the extra values file, see Creating an extra values file in a Kubernetes environment.

     datapower:
       customDatapowerConfig: "custom-dp-config"

  2. Point to the extra values file from the Gateway subsystem by entering apicup subsys set gwy extra-values-file path/file.
  3. Execute the apicup subsys install gwy command to install the Gateway with the extra values file containing the ConfigMap entry.
• Use the externally-configured user-defined policy in an API.
  1. To use the externally-configured policy in the example from an API, create an assembly that resembles the following:

     assembly:
         execute:
           - my-echo-policy:
               title: Echo msg
               version: 1.0.0
               msg: $(request.parameters.msg)

  2. A request against that API should have ?msg=<text> as a query parameter, and the response body should be equal to <text>, which is the value of the msg query parameter.