Manage the access to an external service via the AUTHENTICATION service of yuuvis® Momentum.

Introduction

The AUTHENTICATION service manages the access to the yuuvis® Momentum API gateway. With a suitable configuration, also the access to external services can be managed via the AUTHENTICATION service of yuuvis® Momentum.

Involved Services

Two services of yuuvis® Momentum are responsible for the service routing:

• the AUTHENTICATION service and
• the API gateway.

After successful authentication of incoming requests, the AUTHENTICATION service sends the requests to the API gateway.

AUTHENTICATION Service

The service has its own endpoints that are configured in the file authentication-prod.yml in the sections routing.endpoints and authorization.accesses.

Only for endpoints listed in routing.endpoints the AUTHENTICATION service endpoints are available.

In authorization.accesses, permissions can be defined for the access to the individual endpoints and sub-paths.
>> Access Authorization for Endpoints

API Gateway

The API gateway uses the Spring Cloud Kubernetes DiscoveryClient in order to dynamically create routes. This DiscoveryClient sends requests to the Kubernetes API. The corresponding permissions are configured via the Kubernetes objects ServiceAccount, RoleBinding and Role.

The pod for the API gateway is executed via the service account that is used by the DiscoveryClient to request namespaces.

The number of the Kubernetes Services can be limited. This can be configured in the file application-kubernetes.yml in the filter for Kubernetes Services. Only for services matching the filter internal routes are created by the API gateway. Per default, the following filter is applied:

metadata!=null && metadata.labels!=null && metadata.labels['yuuvis']=="true"

In order to create a route for a service in the API gateway, in the file authentication-service.yaml  in the section labels the entry yuuvis: true has to be added.

Example Configuration

In this example scenario, the required steps of configuration are shown. Afterwards, the external service app in the namespace other will be available via the AUTHENTICATION service.

Follow these steps:

• Deploy the pod for the external service app in the namespace other. 

  deployment

  apiVersion: apps/v1
  kind: Deployment
  metadata:
    namespace: other
    name: app
  spec:
    replicas: 1
    selector:
      matchLabels:
        name: app
    template:
      metadata:
        labels:
          name: app
      spec:
        containers:
        - name: app
        ...
          ports:
          - containerPort: 80
        ...
  
  

• Create a Kubernetes Service for cognisphere  in the namespace other, e.g. app-svc.

  service in the namespace other

  apiVersion: v1
  kind: Service
  metadata:
    name: app-svc
    labels:
    name: app-svc
    namespace: other
  spec:
    ports:
    - name: "http"
       port: 80
       targetPort: 80
    selector:
       name: app
    type: ClusterIP

• Create the Kubernetes Service in the namespace yuuvis. Use the type externalName that references the namespace other.

  service im namespace yuuvis type externalName:

  apiVersion: v1
  kind: Service
  metadata:
    name: app
    labels:
      yuuvis: "true"
    namespace: yuuvis
  spec:
    type: ExternalName
    externalName: app-svc.other.svc.cluster.local
    ports:
    - port: 80
  
  

• Add the external service app to the sections routing.endpoints: and routing.access: in the file authentication-prod.yml.

  authentiaction-prod.yml

  routing.endpoints:
    - 'app' # external service added to the list
  ...
  authorization.accesses:
    - endpoints: /app/** # add
    # optionally restrict to a method, e.g.: method: Post
    # optionally restrict to users with specific roles, e.g.: hasAuthority('COGNISPHERE')

• Restart the AUTHENTICATION service.

Summary