Expose and secure a workload with OAuth2
This tutorial shows how to expose and secure services or Functions using API Gateway Controller. The controller reacts to an instance of the APIRule custom resource (CR) and creates an Istio VirtualService and Oathkeeper Access Rules according to the details specified in the CR.
Prerequisites
- Deploy a sample HttpBin service and a sample Function.
- Set up your custom domain or use a Kyma domain instead.
Depending on whether you use your custom domain or a Kyma domain, export the necessary values as environment variables:
- Custom domain
- Kyma domain
Configure your client ID and client secret using an OAuth2-compliant provider. Then, export the following values as environment variables:
Click to copyexport CLIENT_ID={CLIENT_ID}export CLIENT_SECRET={CLIENT_SECRET}export TOKEN_URL={TOKEN_URL}export INTROSPECTION_URL={INTROSPECTION_URL}
Get the tokens
Encode the client's credentials and export them as environment variables:
Click to copyexport ENCODED_CREDENTIALS=$(echo -n "$CLIENT_ID:$CLIENT_SECRET" | base64)Get tokens to interact with secured resources using the client credentials flow:
- Token with `read` scope
- Token with `write` scope
Expose and secure your workload
Follow the instructions to expose an instance of the HttpBin service or a sample Function, and secure them with Oauth2 scopes.
- HttpBin
- Function
CAUTION: When you secure a workload, don't create overlapping Access Rules for paths. Doing so can cause unexpected behavior and reduce the security of your implementation.
Access the secured resources
Follow the instructions to call the secured service or Functions using the tokens issued for the client you registered.
- HttpBin
- Function
To learn more about the security options, read the document describing authorization configuration.