...
what are the options for defining boundaries of internal network and providing this information to PRB plugin
what are the ways to inject the plugin into Kong request processing flow
is it possible to execute run the plugin just right after Kong has found a route
will the selected route be available to the plugin
...
| Drawio sketch | ||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
...
The diagram contains mod-scheduler to run scheduled jobs, and some business module, named “Module A”. Module A provides regular interface /regular-url-A along with _timer interface /timer-url-A. Detailed information about Module A interfaces contained as usual in its Module Descriptor.
At first Tenant Entitlement manager (MTE) enables an application with Module A for a tenant. During this process MTE gets Module Descriptor of Module A and
a. creates routes in Kong for all module’s public interfaces from "provides" section of Module Descriptor and all _timer interfaces so that they are also become available for routing by API Gateway
b. creates resources in Keycloak but only for public interfaces of the module. There are not resources created for timer interfaces, so Keycloak is still not aware of any system interfaces and has no specific rules (permissions) to authorize access to those resources
c. enables mod-users-keycloak module for the tenant. During this process the module creates special system user, named like <tenant>-system-user (example diku2-system-user), with "System" role which grants access to all resources in the system
...
d. creates (via Kafka) scheduled jobs for Module A _timer endpoints in mod-scheduler. Scheduler associates the system user with jobs created from timer interfaces. As a result these jobs will be executed on behalf of the system user
Option 2
Have mod-scheduler send egress requests to it’s sidecar like every other module, and add a switch to the module-sidecar which indicates it should retrieve ALL bootstrap info at startup, and consume all discovery events.
...