MODSIDECAR-13: Options for handling modules which call OKAPI
Overview
User story: MODSIDECAR-13: PLACEHOLDER - Spike - Options for handling modules which call OKAPIClosed
Some modules (FE and BE) make API calls directly to OKAPI. On the new platform, these things are going to break. We need to look at the options and decide how we want to resolve this issue.
Okapi permissions usage
Permission | Interface | Required by modules | Notes |
---|---|---|---|
okapi.env.list |
|
|
|
okapi.proxy.modules.list |
|
| can be provided by |
okapi.proxy.tenants.modules.list |
|
| a list of installed modules can be provided by
|
okapi.proxy.tenants.modules.post |
|
| This API cannot be provided, cause mgr-components cannot perform installation of a single module |
okapi.proxy.tenants.modules.enabled.delete |
|
| This API cannot be provided, cause mgr-components cannot perform uninstallation of a single module |
okapi.discovery.get |
|
| Can be provided by |
okapi.version.get |
|
| There is no okapi in the system, this interface cannot be supported |
Note: UI-Developer is not included in the production deployment, according to the README.md file
mod-permissions
requires perms.users.assign.okapi
permission to assign okapi permissions to the user. This permission is hardcoded in the codebase and required in permissionsDesired
section, without this permission - okapi permissions cannot be assigned.
Okapi interface provision using mgr-components
mgr-tenant-entitlement
If the module requires okapi
interface API
allowed
okapi
endpoints are stored inmgr-tenant-entitlements
in Json (key is the permission id, values - is theAuthorization
resource(permission + endpoint)mgr-tenant-entitlements
generates and adds Keycloak resources (for instance,GET /_/proxy/tenants/{tenantId}/modules
)mgr-tenant-entitlements
generates corresponding capabilities (for instance,view + Tenant Modules
with assigned endpointGET /_/proxy/tenants/{tenantId}/modules
)
mgr-applications
mgr-applications
will collect (using HTTP calls) okapi interfaces from the mgr-components
and will include them in the module bootstrap information. This service will provide endpoints with new field pathOverwrite
, so sidecar can overwrite the path to call mgr-components: