Access the Travels Blue partner portal by clicking here

You should see a 404 error status code because the travel-agency core services endpoint hasn’t been exposed using an HTTPRoute to make it available to other applications/systems.

Click the (+) button on the top navigation bar of {ocp_cluster_openshift_cluster_console_url}[OpenShift Console^, window="console"] to create a new HTTPRoute.

In the YAML editor, copy the following HTTPRoute CR for the travel REST API and click the Create button at the bottom of the YAML editor

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: travel-agency
  namespace: travel-agency
  labels:
    deployment: travels-v1
    service: travels
spec:
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: prod-web
      namespace: ingress-gateway
  hostnames:
    - api.travels.{ocp_cluster_workshop_main_domain}
  rules:
    - backendRefs:
        - group: ''
          kind: Service
          name: travels
          namespace: travel-agency
          port: 8000
          weight: 1
      matches:
        - path:
            type: PathPrefix
            value: /

Refresh the Web application or access it from here.

You should see a 403 - Forbidden error because while you have created the travels API’s HTTPRoute, the prod-web Gateway’s deny-all default policy kicks in and doesn’t allow any requests to be made. We have a zero-trust auth in place!!

You can validate this by accessing Red Hat Connectivity Link’s {ocp_cluster_openshift_cluster_console_url}/kuadrant/policy-topology[Policy Topology^, window="console"]. You will notice that the travel-agency HTTPRoute also inherits the Gateway’s policies (just like the echo-api HTTRoute)

Click the (+) button on the top navigation bar of {ocp_cluster_openshift_cluster_console_url}[OpenShift Console^, window="console"] to create a new AuthPolicy for the HTTPRoute.

In the YAML editor, copy the following CRs, which creates an AuthPolicy along with the API Key secret needed.

apiVersion: kuadrant.io/v1
kind: AuthPolicy
metadata:
  name: travel-agency-authpolicy
  namespace: travel-agency
spec:
  defaults:
    rules:
      authentication:
        api-key-authn:
          apiKey:
            allNamespaces: false
            selector:
              matchLabels:
                app: partner
          credentials:
            queryString:
              name: APIKEY
  targetRef:
    group: gateway.networking.k8s.io
    kind: HTTPRoute
    name: travel-agency

---
apiVersion: v1
kind: Secret
metadata:
  name: apikey-blue
  namespace: kuadrant-system
  labels:
    authorino.kuadrant.io/managed-by: authorino
    app: partner
stringData:
  api_key: blue
type: Opaque

Click Create to create these resources

The resources are created successfully.

Access Red Hat Connectivity Link’s {ocp_cluster_openshift_cluster_console_url}/kuadrant/policy-topology[Policy Topology^, window="console"] once more.

Refresh the partner portal one more time. You should now see an API Call is successful message.

Choose a City, a From, and a To date, and click the Find details button

Clicking the Find details button more than 5 times.

Expect to see a 429 error:

This is because of the super low rate limit configured for the Gateway.

Since there is no specific RateLimit Policy for the Travels service HTTPRoute, the Gateway’s RateLimit Policy is applied to the HTTPRoute as well.

Click the (+) button on the top navigation bar of {ocp_cluster_openshift_cluster_console_url}[OpenShift Console^, window="console"] to create a new RateLimitPolicy for the HTTPRoute.

In the YAML editor, copy the following CRs, which creates the RatLimit Policy of 20 calls per 10 seconds per user.

apiVersion: kuadrant.io/v1
kind: RateLimitPolicy
metadata:
  name: ratelimit-policy-travels
  namespace: travel-agency
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: HTTPRoute
    name: travel-agency
  limits:
    "per-user":
      rates:
        - limit: 20
          window: 10s
      counters:
        - expression: auth.identity.userid

Click Create.

Try accessing the details again by clicking the Find details button.

You should now be able to retrieve details without a 429 - Too Many Requests error for up to 20 requests in a duration of 10 seconds.

You will notice in the Red Hat Connectivity Link’s {ocp_cluster_openshift_cluster_console_url}/kuadrant/policy-topology[Policy Topology^, window="console"], that the travel-agency HTTPRoute has its own Auth and RateLimit policies which effectively override the zero-trust and super low-limits setup on the Gateway.

In this section, you played the role of a Developer and created a travel-agency HTTPRoute for the core services so that this can be accessed by the partner portal securely. You applied the right Auth and Rate Limit policies to the HTTPRoute thereby customising this to your specific needs in a self-service manner

In the next section, you will be introduced to observability and monitoring.