Policy Versioning #473
Replies: 3 comments 4 replies
-
|
Expecting the api developer to specify the version resolution strategy seems too much. Can't we just leave it for the Gateway admin only? i.e. API developer always works with major.minor only. Gateway admin decides which version to bound to based on the policies.yaml. |
Beta Was this translation helpful? Give feedback.
-
|
Included downloadURL as well in the policy-manifest-lock.yaml. apipctl will use this link to download each policy. |
Beta Was this translation helpful? Give feedback.
-
Downloading policies from Policy HubOption 1: Using apipctl (Recommended)The apipctl CLI tool reads the policy-manifest.yaml file, sends the JSON request to the Policy Hub to resolve the versions based on the versionResolution defined, downloads the policies, and generates the policy-manifest-lock.yaml file with the resolved versions, provide the policy-manifest-lock.yaml to the gateway builder to build gateway images. In this approach, the policy file path should be communicated to the gateway builder. In this case, policy-manifest-lock.yaml will look like this: The filePath is included in the lock file to provide the gateway builderwith the location of the downloaded policies. version: v1/alpha1
policies:
- name: BasicAuth
version: v1.0.0
checksum: sha256:abc123...
source: hub
filePath: ./basic-auth/v1.0.0 # Include filePath
- name: BasicAuth
version: v1.0.1
checksum: sha256:abc123...
source: hub
filePath: ./basic-auth/v1.0.1
- name: BasicAuth
version: v1.0.8
checksum: sha256:abc123...
source: hub
filePath: ./basic-auth/v1.0.8
- name: MyCustomPolicy
version: v1.0.0
checksum: sha256:abc123...
source: local
filePath: ./my-custom-policy/v1.0.0Option 2: Gateway BuilderThe gateway builder can directly communicate with the Policy Hub to resolve the versions and download the policies. In this approach, the gateway builder should read the policy-manifest.yaml file, send the JSON request to the Policy Hub to resolve the versions based on the versionResolution defined, download the policies, and generate the policy-manifest-lock.yaml file with the resolved versions, and build the gateway image. |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
1. Policy Versioning in Policy Engine
Policy Engine can be built using one or more versions of the same policy.
For example the following both policies can be live at the same time.
1.1. versionResolution
Alternative names for versionResolution:
Available versionResolution:
Note: major is not available as it is dangerous.
Default to minor if not specified.
1.2. Policy Manifest File - policy-manifest.yaml (Used in build time)
1.2.1. User Provided File
The same policy can be defined multiple times with different versioning strategies. Because different APIs or the Same API may require different versions of the same policy.
User can define the versionResolution at the root level and override it at the individual policy level.
1.2.2. Policy Manifest Lock file - policy-manifest-lock.yaml
This contains the exact versions resolved based on the versionResolution defined in the policy-manifest.yaml file. This file also included in the gateway image to ensure the same versions are used when the gateway is deployed. User can even commit this file in the VCS to have a record of the exact versions used in the build.
In the following example, gateway load all the versions of the BasicAuth policy.
2. Policy Versioning in API YAML (Used in runtime when APIs are deployed to the Gateway)
Same versionResolution concepts applied here. Default to minor if not specified. The versionResolution resolved to the latest in the gateway not in the Policy Hub.
2.1. Version Resolution in the Policy Engine
Build-time: Gateway image contains (from lock file)
Runtime: API deployed asking for
Policy Engine will pick BasicAuth v1.0.8 as it is the latest minor version (actually the latest patch) available in the gateway image.
3. Version Resolution Workflow
Beta Was this translation helpful? Give feedback.
All reactions