Gravitee.io — The Hybrid Way
Nowadays, more and more people are looking to deploy their infrastructure both in the cloud and on-premise.
The reasons for this are clear - getting the best of both worlds and an amazing mix between security, data compliance, and performance.
Another good reason for this kind of deployment is regarding the reality of on-premise deployments - all the services and data don’t need to be exposed publicly.
The purpose of this post is to show you how simply you can deploy Gravitee.io API Management using a hybrid architecture. In this case we will achieve everything using Kubernetes and our Helm charts.
Gravitee.io, premises of the hybrid deployment
For several years, Gravitee.io has provided a hybrid deployment capability. One of the most interesting benefits of this is the decrease in operational costs by removing some third-party dependencies (and switching to more adapted technologies).
As you will see in the documentation, the most important component for a hybrid deployment is the Bridge Gateway which acts as a bridge for the remote API gateways.
In the next section, we’ll see how you can extend our default Helm chart to deploy a Bridge Gateway and how to connect remote API gateways to this one.
NOTE: Is is important to mention that a Bridge Gateway is a typical API Gateway extended by some additional capabilities. It means that your Bridge Gateway is still able to process API calls.
Hybrid deployment with Helm Charts
Target architecture
In a previous article, we saw how to deploy Gravitee.io APIM in a matter of a few helm and kubectl commands in Google Cloud Platform (GCP).
In this post, we’ll see how to deploy it in two different GCP regions and two different k8S clusters.
- One will be dedicated to deploy the management part + the bridge gateway
- The other will be dedicated to deploy only API Gateway
From this schema we can see several things:
- MongoDB is used for all the management data (API definitions, subscriptions, api-keys, etc…)
- ElasticSearch is also deployed within the management cluster
- Redis is used to manage rate-limit and quota counters within the gateway cluster.
Before going ahead on how to achieve this, keep in mind that the Bridge Gateway (red box in this schema) is a pure Gravitee.io API Gateway with additional capabilities (it’s important to understand how we are deploying this bridge).
Deploying using Helm
Gravitee.io Helm Charts are already providing all you need to deploy this hybrid architecture.
Pre-requisites would be that you have knowledge of GCP, that the two clusters already exist and that helm is already installed on both clusters.
Let’s focus now on deploying the management cluster.
First, let’s initialize this cluster with pre-requisites:
> gcloud container clusters get-credentials hybrid-mgmt-eu --zone=europe-west1-b// Create namespace
> kubectl create namespace graviteeio// Nginx ingress controller is required for Gravitee APIM chart
> helm install --name nginx-ingress --namespace graviteeio stable/nginx-ingress --set rbac.create=true --set controller.publishService.enabled=true// Add Gravitee.io Helm repository
> helm repo add graviteeio https://helm.gravitee.io
Once done, we are ready to deploy Gravitee.io API Management which will include these components: Administration Console, Developer Portal, Management API and finally a Bridge Gateway which will be used as a bridge by the remote gateway clusters.
> helm install — name graviteeio-apim3 — namespace graviteeio \
-f values-bridge-http-server.yaml \
-f values-hybrid-management-eu.yaml \
graviteeio/apim3
Here is the content of the values-hybrid-management-eu.yaml:
mongo:
uri: mongodb+srv://xxxxxx:xxxxx@demo.xxxxx.gcp.mongodb.net/gio-apim-hybrid?retryWrites=true&w=majorityes:
endpoints:
- https://xxxxxxxxx-elasticsearch.services.elasticcloud.com/
index: demo_hybrid_apim
security:
enabled: true
username: xxxxxx
password: xxxxxxapi:
ingress:
management:
path: /management
hosts:
- demo-hybrid-apim-api.cloud.gravitee.io
tls:
- hosts:
- demo-hybrid-apim-api.cloud.gravitee.io
secretName: cloud-gravitee-cert
portal:
path: /portal
hosts:
- demo-hybrid-apim-api.cloud.gravitee.io
tls:
- hosts:
- demo-hybrid-apim-api.cloud.gravitee.io
secretName: cloud-gravitee-certgateway:
ingress:
enabled: false
services:
bridge:
enabled: true
username: xxxxxxxxx
password: xxxxxxxxx
service:
externalPort: 92
internalPort: 18092
ingress:
enabled: true
path: /
hosts:
- demo-hybrid-apim-bridge.cloud.gravitee.io
annotations:
kubernetes.io/ingress.class: nginx
nginx.ingress.kubernetes.io/ssl-redirect: "false"
nginx.ingress.kubernetes.io/enable-rewrite-log: "true"
nginx.ingress.kubernetes.io/configuration-snippet: "etag on;\nproxy_pass_header ETag;\nproxy_set_header if-match \"\";\n"
tls:
- secretName: cloud-gravitee-cert
hosts:
- demo-hybrid-apim-bridge.cloud.gravitee.ioui:
ingress:
path: /
hosts:
- demo-hybrid-apim-console.cloud.gravitee.io
annotations:
nginx.ingress.kubernetes.io/rewrite-target: /
tls:
- hosts:
- demo-hybrid-apim-console.cloud.gravitee.io
secretName: cloud-gravitee-certportal:
ingress:
path: /
hosts:
- demo-hybrid-apim-portal.cloud.gravitee.io
tls:
- hosts:
- demo-hybrid-apim-portal.cloud.gravitee.io
secretName: cloud-gravitee-cert
What can we learn from this file:
- The gateway is not exposed through the ingress controller (we are not accepting API calls for our Bridge Gateway), and
- We have enabled the bridge service for the gateway, and we have declared a new ingress to expose it to remote clusters.
We can now move to the other side: the gateway cluster.
Again, we have to initialize the cluster with some pre-requisites:
> gcloud container clusters get-credentials hybrid-gw-eu --zone=europe-west2-b// Create namespace
> kubectl create namespace graviteeio// Nginx ingress controller is required for Gravitee APIM chart
> helm install --name nginx-ingress --namespace graviteeio stable/nginx-ingress --set rbac.create=true --set controller.publishService.enabled=true// Add Gravitee.io Helm repository
> helm repo add graviteeio https://helm.gravitee.io
We are now ready to deploy Gravitee.io API Management which will include only API Gateways.
> helm install — name graviteeio-apim3 — namespace graviteeio \
-f values-bridge-http-client.yaml \
-f values-hybrid-gw-eu.yaml \
graviteeio/apim3
Here is the content of the values-hybrid-gw-eu.yaml:
mongo:
uri: mongodb+srv://xxxxxx:xxxxx@demo.xxxxx.gcp.mongodb.net/gio-apim-hybrid?retryWrites=true&w=majorityes:
endpoints:
- https://xxxxxxxxx-elasticsearch.services.elasticcloud.com/
index: demo_hybrid_apim
security:
enabled: true
username: xxxxxx
password: xxxxxxmanagement:
type: httpapi:
enabled: falsegateway:
management:
http:
version: 3.3.1
url: https://demo-hybrid-apim-bridge.cloud.gravitee.io/
username: xxxxxxxxx
password: xxxxxxxxx
ingress:
path: /
hosts:
- demo-hybrid-apim-gw.cloud.gravitee.io
tls:
- hosts:
- demo-hybrid-apim-gw.cloud.gravitee.io
secretName: cloud-gravitee-certui:
enabled: falseportal:
enabled: false
What can we learn from this file:
- All the “management” components have been disabled so as to not deploy them — the Management API, the Publisher Console and the Developer Portal.
- We have enabled the http management mode for the gateway and use this link to mount all the required information into the gateway to be able to process API calls.
If you have a look to the gateway pod logs, you will see something like this:
08:27:29.394 [graviteeio-node] [] INFO i.g.g.r.p.RepositoryPluginHandler - Register a new repository plugin: repository-bridge-http-client [io.gravitee.repository.bridge.client.HttpBridgeRepository]
08:27:29.402 [graviteeio-node] [] INFO i.g.g.r.p.RepositoryPluginHandler - Repository [MANAGEMENT] loaded by http
08:27:30.999 [graviteeio-node] [] INFO i.g.r.b.client.http.WebClientFactory - Validate Bridge Server connection ...
08:27:32.888 [vert.x-eventloop-thread-1] [] INFO i.g.r.b.client.http.WebClientFactory - Bridge Server connection successful.
And now, from the Publisher Console, we can see our two gateways running:
Here we are, our API Gateway is now connected to the remote management cluster! Next step ? Declare an API, and enjoy your new Gravitee.io hybrid deployment!