Red Hat Connectivity Link

API catalog integration in Red Hat Developer Hub

By integrating Connectivity Link with Red Hat Developer Hub, you can create a self-service API catalog that makes API use easier. When API use is easier, teams can work together more effectively.

You can create a centralized portal where development teams can discover available APIs and understand their capabilities. Developers can request access to the APIs they want and get credentials without leaving their development workflow. You can centrally manage APIs spread across many teams and namespaces.

To achieve these goals, you must add the Connectivity Link plugin to a Red Hat Developer Hub deployment in an OpenShift Container Platform cluster. You must then inject your Red Hat Developer Hub configurations into your OpenShift Container Platform ConfigMap object.

Enable API catalog integration in Red Hat Developer Hub

When you want developers to discover and request access to Connectivity Link-protected APIs directly from Red Hat Developer Hub, integrate the Connectivity Link plugin. The plugin synchronizes API products into the Red Hat Developer Hub catalog and enables self-service API key management.

Red Hat Developer Hub pulls the {rhcl} plugin directly from registry.redhat.io as OCI artifacts. This method requires a registry authentication secret in the same OpenShift Container Platform project as your Red Hat Developer Hub deployment.

Important

Replace API Key features in the example dynamic plugin configuration YAML and enforce security, such as OpenID Connect (OIDC) or JSON web token (JWT) AuthPolicy objects, for production environments.

Prerequisites

You installed Connectivity Link 1.4 or later on an OpenShift Container Platform cluster.
You installed Red Hat Developer Hub on the same OpenShift Container Platform cluster.
You have a Red Hat account with access to registry.redhat.io.
You have a registry service account token from the Red Hat Customer Portal.
You have cluster privileges to configure role-based-access (RBAC) policies and service accounts.
You installed the OpenShift CLI (oc).
Your organization has APIs published through Connectivity Link gateways that you want to make discoverable to development teams.

Procedure

Create an auth.json file on your local machine with your registry.redhat.io credentials by using the following example:
```
{
  "auths": {
    "registry.redhat.io": {
      "auth": "<base64-encoded-username:password>"
    }
  }
}
```
To generate the base64-encoded value, use the printf '%s' '<username>:<password>' | base64 command.
Set the environment variable for your Red Hat Developer Hub namespace by running the following command:
```
$ export RHDH_NS=rhdh
```

Create the authentication Secret named dynamic-plugins-registry-auth in the OpenShift Container Platform project where you installed Red Hat Developer Hub. Use one of the two following methods:

For a default Operator installation with name developer-hub, run the following command:

$ oc create secret generic dynamic-plugins-registry-auth \
  --from-file=auth.json=./auth.json \
  -n $RHDH_NS

Important

The Red Hat Developer Hub Operator specifically looks for a secret named dynamic-plugins-registry-auth to authenticate against registry.redhat.io. Do not change or prefix this secret name.

If you already have Podman credentials configured locally, run the following command:
```
$ oc create secret generic dynamic-plugins-registry-auth \
  --from-file=auth.json=${XDG_RUNTIME_DIR}/containers/auth.json \
  -n $RHDH_NS
```
Important

You must create the Secret before you configure your plugin.

Verify that the Secret exists in your OpenShift Container Platform project by running the following command:
```
$ oc get secret dynamic-plugins-registry-auth -n $RHDH_NS
```

Set the environment variable for your cluster base hostname by running the following command:

$ export CLUSTER_HOSTNAME=$(oc get ingress.config.openshift.io cluster -o jsonpath='{.spec.domain}')

Save your full ConfigMap file as configmap.yaml by using the following example:

Example dynamic plugin config map

apiVersion: v1
kind: ConfigMap
metadata:
  name: dynamic-plugins-rhdh
  namespace: $RHDH_NS
data:
  dynamic-plugins.yaml: |
    includes:
      - dynamic-plugins.default.yaml
    plugins:
      - package: oci://registry.redhat.io/rhdh/kuadrant-backstage-plugin-backend-dynamic-rhel9:bs_1.4v0.2.1!kuadrant-backstage-plugin-backend-dynamic
        disabled: false
      - package: oci://registry.redhat.io/rhdh/kuadrant-backstage-plugin-frontend-dynamic-rhel9:bs_1.4v0.2.1!kuadrant-backstage-plugin-frontend-dynamic
        disabled: false
        pluginConfig:
          dynamicPlugins:
            frontend:
              kuadrant.kuadrant-backstage-plugin-frontend:
                apiFactories:
                  - importName: kuadrantApiFactory
                appIcons:
                  - name: kuadrantIcon
                    importName: KuadrantIcon
                  - name: apiIcon
                    importName: ApiIcon
                  - name: keyIcon
                    importName: KeyIcon
                  - name: approvalIcon
                    importName: ApprovalIcon
                menuItems:
                  kuadrant.api-products:
                    parent: kuadrant
                  kuadrant.my-api-keys:
                    parent: kuadrant
                  kuadrant.api-key-approval:
                    parent: kuadrant
                dynamicRoutes:
                  - path: /kuadrant
                    importName: KuadrantPage
                    menuItem:
                      icon: kuadrantIcon
                      text: Kuadrant
                  - path: /kuadrant/api-products
                    importName: ApiProductsPage
                    menuItem:
                      icon: apiIcon
                      text: API Products
                  - path: /kuadrant/my-api-keys
                    importName: MyApiKeysPage
                    menuItem:
                      icon: keyIcon
                      text: My API Keys
                  - path: /kuadrant/api-key-approval
                    importName: ApiKeyApprovalPage
                    menuItem:
                      icon: approvalIcon
                      text: API Key Approval
                  - path: /kuadrant/api-products/:namespace/:name
                    importName: ApiProductDetailPage
                  - path: /kuadrant/api-keys/:namespace/:name
                    importName: ApiKeyDetailPage
                entityTabs:
                  - mountPoint: entity.page.api-keys
                    path: /api-keys
                    title: API Keys
                  - mountPoint: entity.page.api-product-info
                    path: /api-product-info
                    title: API Product Info
                mountPoints:
                  - mountPoint: entity.page.api-keys/cards
                    importName: EntityKuadrantApiKeyManagementTab
                    config:
                      layout:
                        gridColumn: "1 / -1"
                      if:
                        allOf:
                          - isKind: api
                  - mountPoint: entity.page.api-product-info/cards
                    importName: EntityKuadrantApiProductInfoContent
                    config:
                      layout:
                        gridColumn: "1 / -1"
                      if:
                        allOf:
                          - isKind: api

Important

Enter your Red Hat Developer Hub version of Backstage and the plugin version, in the format bs_<backstage_version>__<plugin_version>; use the double underscore delimiter.

Find your Backstage version in the Red Hat Developer Hub release notes preface.
Locate the plugin version in the Dynamic Plugins Reference.

Create the ConfigMap CR by running the following command:
```
$ oc apply -f configmap.yaml
```

Configure the application settings

Configure specific application settings to give access to the Connectivity Link Red Hat Developer Hub plugin.

Prerequisites

You enabled API catalog integration in Red Hat Developer Hub.
You provisioned your custom Red Hat Developer Hub configuration.
You have auth set up in your existing app-config YAML.
You are logged into an OpenShift Container Platform cluster with administrator privileges.
You installed the OpenShift CLI (oc).

Procedure

Create a role-based access (RBAC) file, such as rbac-policy.csv, to define user roles and permissions by using the following example:

p, role:default/api-consumer, kuadrant.apiproduct.read.all, read, allow
p, role:default/api-consumer, kuadrant.apiproduct.list, read, allow
p, role:default/api-consumer, kuadrant.apikey.create, create, allow, apiproduct:*/*
p, role:default/api-consumer, kuadrant.apikey.read.own, read, allow
p, role:default/api-consumer, kuadrant.apikey.update.own, update, allow
p, role:default/api-consumer, kuadrant.apikey.delete.own, delete, allow
p, role:default/api-consumer, catalog.entity.read, read, allow
p, role:default/api-consumer, kuadrant.planpolicy.list, read, allow
p, role:default/api-consumer, kuadrant.authpolicy.list, read, allow
p, role:default/api-consumer, kuadrant.ratelimitpolicy.list, read, allow
p, role:default/api-consumer, kuadrant.httproute.list, read, allow

p, role:default/api-owner, kuadrant.httproute.list, read, allow
p, role:default/api-owner, kuadrant.ratelimitpolicy.list, read, allow
p, role:default/api-owner, kuadrant.authpolicy.list, read, allow
p, role:default/api-owner, kuadrant.planpolicy.read, read, allow
p, role:default/api-owner, kuadrant.planpolicy.list, read, allow
p, role:default/api-owner, kuadrant.apiproduct.create, create, allow
p, role:default/api-owner, kuadrant.apiproduct.read.all, read, allow
p, role:default/api-owner, kuadrant.apiproduct.update.own, update, allow
p, role:default/api-owner, kuadrant.apiproduct.delete.own, delete, allow
p, role:default/api-owner, kuadrant.apiproduct.list, read, allow
p, role:default/api-owner, kuadrant.apikey.create, create, allow, apiproduct:*/*
p, role:default/api-owner, kuadrant.apikey.read.own, read, allow
p, role:default/api-owner, kuadrant.apikey.update.own, update, allow
p, role:default/api-owner, kuadrant.apikey.delete.own, delete, allow
p, role:default/api-owner, kuadrant.apikey.approve, update, allow
p, role:default/api-owner, catalog.entity.read, read, allow

p, role:default/api-admin, kuadrant.planpolicy.read, read, allow
p, role:default/api-admin, kuadrant.planpolicy.list, read, allow
p, role:default/api-admin, kuadrant.authpolicy.list, read, allow
p, role:default/api-admin, kuadrant.ratelimitpolicy.list, read, allow
p, role:default/api-admin, kuadrant.apiproduct.create, create, allow
p, role:default/api-admin, kuadrant.apiproduct.read.all, read, allow
p, role:default/api-admin, kuadrant.apiproduct.update.all, update, allow
p, role:default/api-admin, kuadrant.apiproduct.delete.all, delete, allow
p, role:default/api-admin, kuadrant.apiproduct.list, read, allow
p, role:default/api-admin, kuadrant.httproute.list, read, allow
p, role:default/api-admin, kuadrant.apikey.create, create, allow, apiproduct:*/*
p, role:default/api-admin, kuadrant.apikey.read.all, read, allow
p, role:default/api-admin, kuadrant.apikey.update.all, update, allow
p, role:default/api-admin, kuadrant.apikey.delete.all, delete, allow
p, role:default/api-admin, kuadrant.apikey.approve, update, allow
p, role:default/api-admin, catalog.entity.read, read, allow
p, role:default/api-admin, policy.entity.read, read, allow
p, role:default/api-admin, policy.entity.create, create, allow
p, role:default/api-admin, policy.entity.update, update, allow
p, role:default/api-admin, policy.entity.delete, delete, allow

g, group:default/api-consumers, role:default/api-consumer
g, group:default/api-owners, role:default/api-owner
g, group:default/api-admins, role:default/api-admin

g, user:development/guest, role:default/api-admin

api consumer: Browses APIs, requests access.
api owner: Publishes APIs they own, approves requests for their APIs.
api admin: People who manage all API products.
g, group:default: Assign groups to roles.
g, user:development/guest, role:default/api-admin: Only for development and testing. Assigns a guest user an admin role. For production environments, remove this line and assign roles to your actual users or groups.

Create a ConfigMap object from the RBAC policy file by running the following command:
```
$ oc create configmap rbac-policy --from-file=rbac-policy.csv --namespace=$RHDH_NS
```
Add the RBAC policy reference to the app-config.yaml file:
```
permission:
  enabled: true
  rbac:
    policies-csv-file: /opt/app-root/etc/rbac-policy.csv
    policyFileReload: true
```
Make sure that the mounting path /opt/app-root/etc configured in the Backstage CR matches the path set here.

Add the APIProduct entity type to the catalog rules by adding the following content:

catalog:
  rules:
    - allow: [Component, System, API, APIProduct, Resource, Location]

Optional. Add catalog locations as required by adding the following content:

catalog:
  locations:
    - type: file
      target: /opt/app-root/src/catalog-entities/all.yaml

Create a ConfigMap from the app-config.yaml file by running the following command:

$ oc create configmap rhdh-app-config --from-file=app-config.yaml --namespace=$RHDH_NS

Verification

Verify that the ConfigMap resources exist by running the following command:
```
$ oc get configmap -n $RHDH_NS
```
Confirm that both rhdh-app-config and rbac-policy appear in the output.
Optional. Configure basic guest authentication and authorization for testing by adding the following content:
```
auth:
  environment: development
  providers:
    guest:
      dangerouslyAllowOutsideDevelopment: true
```

Create role-based access for Red Hat Developer Hub

When you want to secure developer access to Connectivity Link-protected APIs directly, create role-based-access permissions that allow Red Hat Developer Hub to manage Connectivity Link resources.

Prerequisites

You installed Connectivity Link 1.4 or later on an OpenShift Container Platform cluster.
You installed Red Hat Developer Hub on the same OpenShift Container Platform cluster.
You have cluster administrator privileges to configure role-based-access (RBAC) policies and service accounts.
You installed the OpenShift CLI (oc).
Your organization has APIs published through Connectivity Link gateways that you want to make discoverable to development teams.

Procedure

Create ClusterRole and ClusterRoleBinding custom resources (CRs) by using the following example:

Example ClusterRole and ClusterRoleBinding manifests

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: rhcl-rhdh-plugin-role
rules:
  - apiGroups: ["kuadrant.io"]
    resources:
      - authpolicies
      - ratelimitpolicies
      - dnspolicies
      - tlspolicies
    verbs: ["get", "list", "watch"]
  - apiGroups: ["extensions.kuadrant.io"]
    resources:
      - planpolicies
    verbs: ["get", "list", "watch"]
  - apiGroups: ["devportal.kuadrant.io"]
    resources:
      - apiproducts
      - apikeys
    verbs: ["get", "list", "watch", "create", "delete", "patch", "update"]
  - apiGroups: ["devportal.kuadrant.io"]
    resources:
      - apikeyrequests
    verbs: ["get", "list", "watch"]
  - apiGroups: ["devportal.kuadrant.io"]
    resources:
      - apikeyapprovals
    verbs: ["get", "list", "watch", "create", "patch", "update"]
  - apiGroups: ["gateway.networking.k8s.io"]
    resources:
      - gateways
      - httproutes
    verbs: ["get", "list", "watch"]
  - apiGroups: [""]
    resources:
      - namespaces
    verbs: ["get", "list", "watch", "create"]
  - apiGroups: [""]
    resources:
      - secrets
    verbs: ["get", "create", "delete"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: rhcl-rhdh-plugin-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: rhcl-rhdh-plugin-role
subjects:
  - kind: ServiceAccount
    name: default
    namespace: ${RHDH_NS}

Apply the CRs by running the following command:
```
$ oc apply -f <rhdh_rbac.yaml>
```
Replace the filename with the one you used.

Verify permissions by running the following command:

$ oc auth can-i update apikeys.devportal.kuadrant.io --as=system:serviceaccount:$RHDH_NS:default

Configure the Backstage custom resource

To apply your configurations in Red Hat Developer Hub, you must update your Backstage custom resource (CR) to put all of your instructions and permissions together.

Prerequisites

You installed Connectivity Link 1.4 or later on an OpenShift Container Platform cluster.
You installed Red Hat Developer Hub on the same OpenShift Container Platform cluster.
You have cluster administrator privileges to configure role-based-access (RBAC) policies and service accounts.
You installed the OpenShift CLI (oc).
Your organization has APIs published through Connectivity Link gateways that you want to make discoverable to development teams.

Procedure

Link the dynamic plugin ConfigMap object by adding the following content:

spec:
  application:
    dynamicPluginsConfigMapName: dynamic-plugins-rhdh

Link the main rhdh-app-config ConfigMap object by adding the following content:

spec:
  application:
    appConfig:
      mountPath: /opt/app-root/src
      configMaps:
         - name: rhdh-app-config

Link the RBAC policies from the rbac-policy ConfigMap object by adding the following content:
```
spec:
  application:
    extraFiles:
      mountPath: /opt/app-root/etc
      configMaps:
         - name: rbac-policy
```
The mounting path is referenced from app-config.yaml, RBAC for the kuadrant functionality section. Ensure they match.

Optional. Enable service account token auto mount for in-cluster mode by adding the following content:

spec:
  deployment:
    patch:
      spec:
        template:
          spec:
            automountServiceAccountToken: true

Confirm that developers can discover and access APIs

After you complete the integration, verify that API products appear in the Developer Hub catalog. Verify that developers can request access and generate API keys.

Prerequisites

You installed the Red Hat Developer Hub plugin.

Procedure

Get the Red Hat Developer Hub route URL by running the following commands:
```
$ export RHDH_URL=$(oc get route backstage-developer-hub -n ${RHDH_NS} -o jsonpath='{.status.ingress[0].host}')
$ echo "https://${RHDH_URL}"
```
The route name follows the pattern backstage-<cr_name>. The default custom resource (CR) name developer-hub is used in this example.
Navigate to the Red Hat Developer Hub URL in your web browser.
Navigate to the /kuadrant endpoint to view the Connectivity Link plugin page:
```
https://${RHDH_URL}/kuadrant
```
Verify that APIProduct objects appear in the catalog by navigating to the catalog view.
Select an API entity and verify that the Kuadrant tab is visible and displays Connectivity Link policy and configuration information.

Verification

You can create and manage API keys through the plugin interface based on your assigned role.

Customize RBAC policies

You can customize RBAC policies by modifying the ConfigMap custom resource (CR) in the Red Hat Developer Hub namespace.

Prerequisites

You installed the Red Hat Developer Hub plugin.
You have cluster administrator privileges to configure role-based-access (RBAC) policies and service accounts.
You installed the OpenShift CLI (oc).

Procedure

Add a custom role by running the following command:
```
$ oc edit configmap rbac-policy -n ${RHDH_NS}
```

Add the following lines to the rbac-policy.csv data:

p, role:default/api-viewer, kuadrant.apiproduct.read.all, read, allow
p, role:default/api-viewer, kuadrant.apikey.read.all, read, allow
g, user:default/developer1, role:default/api-viewer

After modifying the ConfigMap, restart the Red Hat Developer Hub pods for the changes to take effect by running the following command:
```
$ oc rollout restart deployment backstage-<rhdh> -n ${RHDH_NS}
```
Replace <rhdh> in the command with the name of your Backstage CR.

Red Hat Developer Hub plugin RBAC policy reference

The Connectivity Link Red Hat Developer Hub plugin uses role-based access control (RBAC) policies to manage user permissions for API products and API keys.

Default roles

The Connectivity Link Backstage plugin defines three default roles with different permission levels.

api-consumer

Users with this role can read API products and manage their own API keys and namespace-scoped Secrets. This role is suitable for developers who consume APIs.

Read API products
Create API keys
Read own API keys
Delete own API keys

api-owner

Users with this role can manage API products and approve and reject API keys. This role is suitable for API product managers.

Read API products
Create API products
Update API products
Delete API products
Approve and reject API keys

api-admin

Users with this role have full administrative access to API products and API keys. This role is suitable for platform administrators.

Read API products
Create API products
Update API products
Delete API products
Read API keys
Delete API keys
Approve and reject API keys

RBAC policy format

The RBAC policy uses the CSV format with the following structure:

p, role:default/<role_name>, kuadrant.<resource>.<permission>, <action>, <effect>
g, user:default/<username>, role:default/<role_name>

<role_name>: The name of the role.
<resource>: The resource type, such as apiproduct or apikey.
<permission>: The permission level, read, create, update, or delete.
<action>: The action type, read, create, update, or delete.
<effect>: Either allow or deny.
<username>: The user to assign to the role.