Portal server
Review how the Gloo portal server backs up data and your setup options to make the backing database more resilient. For more information about the feature, see Portal in the Gloo Gateway docs.
What data gets stored
- API keys that end users can use to authenticate to destinations and routes that are protected by an external auth policy that the external auth server enforces.
Review data in Redis
To review the data, you can connect to the Redis instance. The following examples use the default local Redis instance that is deployed as the redis
deployment in the gloo-mesh-addons
namespace. If you bring your own Redis, you must use those connection values. For more information, see your Redis provider docs, such as Amazon ElastiCache or Google Cloud Memorystore.
You can use the Redis CLI built into your deployment to review the data in your database.
- From your terminal, log in to the Redis pod and open a Redis CLI shell.
kubectl exec -n gloo-mesh-addons deploy/redis -it -- redis-cli
- Run Redis CLI commands, such as
monitor
. For more information, see the Redis docs.monitor OK 1681223733.198361 [0 10.xxx.x.x:xxxxx] "zrange" "relation#clusters#list" "0" "-1"
RedisInsights is a desktop application that you can install for GUI- and CLI-based interactions. For more information, see the Redis docs.
- Download RedisInsights.
- Enable port forwarding on the Redis deployment.
kubectl port-forward -n gloo-mesh-addons deploy/redis 6379
- Launch the RedisInsights app.
- Click + Add Redis Database and enter your localhost and port details, which by default are
127.0.0.1:6379
. - Click the database that you just added.
- Use the GUI or CLI to explore the data. For example, you can click the Browser tab (the key icon) and toggle the Key view to explore all of the keys in the database instance, as shown in the following screenshot.
How the portal and external auth servers share backing storage
To use Gloo Platform Portal, you must configure both the portal and external auth servers to use the same backing storage. Review the following diagram for more information.
- As the portal admin, you configure the backing storage database for both the external auth and portal servers. For more information, see Backing storage options.
- As an end user, you use the developer portal to generate an API key. Then, the Gloo portal server writes this API key to the shared backing storage database, such as Redis.
- As an end user, you include the API key in subsequent requests to the API products that you want to access. The Gloo ingress gateway receives your requests and checks the API's route for external auth policies. The Gloo external auth server reads the API key value from the shared backing storage database, such as Redis. If the API key matches a valid value, then the Gloo gateway sends the request to the API product and you get back a successful response.
For steps to try out this process yourself, see Verify that external auth works with API keys in a backing storage database.
Backing storage options
Review the following options for setting up backing storage.
Option | Use case | Benefits | Drawbacks |
---|---|---|---|
Default (no backing storage) | Local testing in single clusters |
|
|
Built-in local Redis | Proof of concept and staging environments in single clusters |
|
|
Bring your own Redis | Production-level, multicluster environments |
|
|
Default (no backing storage)
By default, no backing storage is configured for the portal server. For testing purposes, you can manually create backing storage, such as saving an API key's details in a Kubernetes secret. For example steps, see Require API key external auth for Gloo Platform Portal.
Built-in local Redis
When you install Gloo Platform, a local Redis instance redis
is set up in the gloo-mesh-addons
namespace of the workload cluster. The rate limiting server automatically reads and writes to this Redis instance. However, you must manually configure the Gloo external auth and Gloo portal servers to read from and write data to this Redis instance.
Using a local Redis instance is not a recommended practice for production. To achieve higher availability, disaster recovery and add other security features, bring your own Redis instance instead.
-
Include the same local Redis settings for the external auth and portal servers when you install or upgrade Gloo Platform. Review the following table to understand the matching settings. For more information, check the Helm reference.
Ext auth setting Portal setting Description extAuthService.extAuth.apiKeyStorage.name glooPortalServer.apiKeyStorage.type Use Redis as the backing storage for API keys. extAuthService.extAuth.apiKeyStorage.secretKey glooPortalServer.apiKeyStorage.secretKey The string value that you want to use to hash API keys before they are stored in the Redis database. N/A glooPortalServer.apiKeyStorage.configPath The path to the Redis configuration file. extAuthService.extAuth.apiKeyStorage.config.connection.host glooPortalServer.apiKeyStorage.config.host The host that the Redis instance is available on. When using the built-in local Redis, this value is set to the local redis
service in thegloo-mesh-addons
namespace:redis.gloo-mesh-addons:6379
.extAuthService.extAuth.apiKeyStorage.config.connection.db N/A The Redis database to use. The default value for the portal server is 0
, so the external auth server must set this value, too.helm upgrade --install gloo-agent-addons gloo-platform/gloo-platform \ --namespace gloo-mesh-addons \ --create-namespace \ --version $GLOO_VERSION \ --set common.cluster=$CLUSTER_NAME \ --set extAuthService.enabled=true \ --set rateLimiter.enabled=true \ --set glooPortalServer.enabled=true \ --set glooPortalServer.apiKeyStorage.type=redis \ --set glooPortalServer.apiKeyStorage.secretKey="ThisIsSecret" \ --set glooPortalServer.apiKeyStorage.configPath="/etc/redis/config.yaml" \ --set glooPortalServer.apiKeyStorage.config.host="redis.gloo-mesh-addons:6379" \ --set extAuthService.extAuth.apiKeyStorage.name=redis \ --set extAuthService.extAuth.apiKeyStorage.config.connection.host="redis.gloo-mesh-addons:6379" \ --set extAuthService.extAuth.apiKeyStorage.config.connection.db=0 \ --set extAuthService.extAuth.apiKeyStorage.secretKey="ThisIsSecret"
If you use a Helm values file, make sure that the following settings are enabled.
extAuthService enabled: true extAuth: apiKeyStorage: # Use the local gloo-mesh-addons Redis for backing storage name: redis config: connection: host: "redis.gloo-mesh-addons:6379" # Set to 0 to match the default database for the 'glooPortalServer.apiKeyStorage' configuration db: 0 # Replace with a random string to use to generate hash values for other keys secretKey: "ThisIsSecret" glooPortalServer: enabled: true apiKeyStorage: # Use the local gloo-mesh-addons Redis for backing storage type: redis config: host: "redis.gloo-mesh-addons:6379" # Path for API key storage config file in the gloo-mesh-addons backing Redis configPath: /etc/redis/config.yaml # Replace with a random string to use to generate hash values for other keys secretKey: "ThisIsSecret" rateLimiter enabled: true # Configuration for the managed north-south (ingress) gateway. Requires a Gloo Gateway license. northSouthGateways: - # Install the gateway in the cluster. enabled: true
-
Continue with the Install or Upgrade guides for more instructions to finish your installation or upgrade.
Bring your own Redis
Instead of using the built-in local Redis instance, you can achieve higher availability, disaster recovery, and enhanced control and security by bringing your own Redis cluster. This external Redis cluster is hosted outside your cluster, such as by using a cloud provider service like AWS ElastiCache. This way, you can support multicluster use cases where you use the same external Redis for the API keys that are shared by the Gloo external auth and portal servers.
Keep in mind that your external Redis database usually must be in the same cloud provider as your Gloo cluster, such as AWS ElastiCache and EC2 instances. Also, you must configure both the Gloo external auth and Gloo portal servers in your cluster to read from and write to the same Redis database. Any settings for your Redis instance, such as the maximum number of retries, are shared between these components.
-
Create or use an existing Redis cluster, such as AWS ElastiCache or Google Cloud Memorystore.
-
Make sure that you can connect to your instance from the Gloo management cluster. For example, your cloud provider might require for the cluster and Redis instance to share the same virtual private network (VPC). For more information, consult your cloud provider documentation, such as AWS ElastiCache or Google Cloud Memorystore.
-
Include the same external Redis settings for the external auth and portal servers when you install or upgrade Gloo Platform. Review the following table to understand the matching settings. For more information, check the Helm reference.
Ext auth setting Portal setting Description extAuthService.extAuth.apiKeyStorage.name glooPortalServer.apiKeyStorage.type Use Redis as the backing storage for API keys. extAuthService.extAuth.apiKeyStorage.secretKey glooPortalServer.apiKeyStorage.secretKey The string value that you want to use to hash API keys before they are stored in the Redis database. N/A glooPortalServer.apiKeyStorage.configPath The path to the Redis configuration file. extAuthService.extAuth.apiKeyStorage.config.connection.host glooPortalServer.apiKeyStorage.config.host Replace $REDIS_HOST
with the host and port that the Redis instance is available on. This host might need to be on the same virtual private network as your cluster or need to have a VPN connection.- An example Amazon ElastiCache host might look like
redis-cluster.ameaqx.0001.use1.cache.amazonaws.com
. For more information, see the Amazon ElastiCache docs. - An example Google Cloud Memorystore host might look like
10.xxx.xx.xx:6379
in the same VPC as your cluster. For more information, see the Google Cloud Memorystore docs.
extAuthService.extAuth.apiKeyStorage.config.connection.db glooPortalServer.apiKeyStorage.config.db The Redis database to use. The default value for the portal server is 0
, so the external auth server must set this value, too.helm upgrade --install gloo-agent-addons gloo-platform/gloo-platform \ --namespace gloo-mesh-addons \ --create-namespace \ --version $GLOO_VERSION \ --set common.cluster=$CLUSTER_NAME \ --set extAuthService.enabled=true \ --set rateLimiter.enabled=true \ --set glooPortalServer.enabled=true \ --set glooPortalServer.apiKeyStorage.type=redis \ --set glooPortalServer.apiKeyStorage.secretKey="ThisIsSecret" \ --set glooPortalServer.apiKeyStorage.configPath="/etc/redis/config.yaml" \ --set glooPortalServer.apiKeyStorage.config.host="$REDIS_HOST" \ --set extAuthService.extAuth.apiKeyStorage.name=redis \ --set extAuthService.extAuth.apiKeyStorage.config.connection.host="$REDIS_HOST" \ --set extAuthService.extAuth.apiKeyStorage.config.connection.db=0 \ --set extAuthService.extAuth.apiKeyStorage.secretKey="ThisIsSecret"
If you use a Helm values file, make sure that the following settings are enabled.
extAuthService enabled: true extAuth: apiKeyStorage: # Use an external Redis database for backing storage name: redis config: connection: # Provide the host to your external Redis database, such as AWS ElastiCache or Google Cloud Memorystore host: "$REDIS_HOST" # Set to 0 to match the default database for the 'glooPortalServer.apiKeyStorage' configuration db: 0 # Replace with a random string to use to generate hash values for other keys secretKey: "ThisIsSecret" glooPortalServer: enabled: true apiKeyStorage: # Use an external Redis database for backing storage type: redis config: # Provide the host to your external Redis database, such as AWS ElastiCache or Google Cloud Memorystore host: "$REDIS_HOST" # Path for the config file to use for the backing Redis database configPath: /etc/redis/config.yaml # Replace with a random string to use to generate hash values for other keys secretKey: "ThisIsSecret" rateLimiter enabled: true # Configuration for the managed north-south (ingress) gateway. Requires a Gloo Gateway license. northSouthGateways: - # Install the gateway in the cluster. enabled: true
- An example Amazon ElastiCache host might look like
-
Continue with the Install or Upgrade guides for more instructions to finish your installation or upgrade.
-
Optional: Verify that the external auth and portal server are configured with your external Redis database details.
-
Verify that the secrets are created.
kubectl get secrets -n gloo-mesh-addons
Example output:
NAME TYPE DATA AGE ext-auth-service-api-key-secret-key Opaque 1 47s ext-auth-service-api-key-storage Opaque 1 47s ext-auth-service-signing-key Opaque 1 47s portal-storage-config Opaque 1 47s
-
Log in to the portal and external auth server pods, and verify that the host information is stored along the config path that you set.
- Log in to the portal server pod.
kubectl exec -it -n gloo-mesh-addons pods/$(kubectl get pod -l app=gloo-mesh-portal-server -A -o jsonpath='{.items[0].metadata.name}') -- /bin/sh
- Check the file contents at the config path that you set, such as
/etc/redis/config.yaml
.cat /etc/redis/config.yaml
- Confirm that the value matches the host address for your external Redis database (
$REDIS_HOST
). - To log out of the pod, enter
exit
.
- Log in to the external auth server pod.
kubectl exec -it -n gloo-mesh-addons pods/$(kubectl get pod -l app=ext-auth-service -A -o jsonpath='{.items[0].metadata.name}') -- /bin/sh
- Check the file contents at the config path that you set, such as
/etc/apikeys/storage-config.yaml
.cat /etc/apikeys/storage-config.yaml
- Confirm that the value matches the host address for your external Redis database (
$REDIS_HOST
). - To log out of the pod, enter
exit
.
- Log in to the portal server pod.
-
-
Optional: Verify that API keys are stored in your external Redis database.